1 // SPDX-License-Identifier: GPL-2.0-only 2 /* 3 * NSA Security-Enhanced Linux (SELinux) security module 4 * 5 * This file contains the SELinux hook function implementations. 6 * 7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov> 8 * Chris Vance, <cvance@nai.com> 9 * Wayne Salamon, <wsalamon@nai.com> 10 * James Morris <jmorris@redhat.com> 11 * 12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc. 13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com> 14 * Eric Paris <eparis@redhat.com> 15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc. 16 * <dgoeddel@trustedcs.com> 17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P. 18 * Paul Moore <paul@paul-moore.com> 19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd. 20 * Yuichi Nakamura <ynakam@hitachisoft.jp> 21 * Copyright (C) 2016 Mellanox Technologies 22 */ 23 24 #include <linux/init.h> 25 #include <linux/kd.h> 26 #include <linux/kernel.h> 27 #include <linux/kernel_read_file.h> 28 #include <linux/tracehook.h> 29 #include <linux/errno.h> 30 #include <linux/sched/signal.h> 31 #include <linux/sched/task.h> 32 #include <linux/lsm_hooks.h> 33 #include <linux/xattr.h> 34 #include <linux/capability.h> 35 #include <linux/unistd.h> 36 #include <linux/mm.h> 37 #include <linux/mman.h> 38 #include <linux/slab.h> 39 #include <linux/pagemap.h> 40 #include <linux/proc_fs.h> 41 #include <linux/swap.h> 42 #include <linux/spinlock.h> 43 #include <linux/syscalls.h> 44 #include <linux/dcache.h> 45 #include <linux/file.h> 46 #include <linux/fdtable.h> 47 #include <linux/namei.h> 48 #include <linux/mount.h> 49 #include <linux/fs_context.h> 50 #include <linux/fs_parser.h> 51 #include <linux/netfilter_ipv4.h> 52 #include <linux/netfilter_ipv6.h> 53 #include <linux/tty.h> 54 #include <net/icmp.h> 55 #include <net/ip.h> /* for local_port_range[] */ 56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */ 57 #include <net/inet_connection_sock.h> 58 #include <net/net_namespace.h> 59 #include <net/netlabel.h> 60 #include <linux/uaccess.h> 61 #include <asm/ioctls.h> 62 #include <linux/atomic.h> 63 #include <linux/bitops.h> 64 #include <linux/interrupt.h> 65 #include <linux/netdevice.h> /* for network interface checks */ 66 #include <net/netlink.h> 67 #include <linux/tcp.h> 68 #include <linux/udp.h> 69 #include <linux/dccp.h> 70 #include <linux/sctp.h> 71 #include <net/sctp/structs.h> 72 #include <linux/quota.h> 73 #include <linux/un.h> /* for Unix socket types */ 74 #include <net/af_unix.h> /* for Unix socket types */ 75 #include <linux/parser.h> 76 #include <linux/nfs_mount.h> 77 #include <net/ipv6.h> 78 #include <linux/hugetlb.h> 79 #include <linux/personality.h> 80 #include <linux/audit.h> 81 #include <linux/string.h> 82 #include <linux/mutex.h> 83 #include <linux/posix-timers.h> 84 #include <linux/syslog.h> 85 #include <linux/user_namespace.h> 86 #include <linux/export.h> 87 #include <linux/msg.h> 88 #include <linux/shm.h> 89 #include <linux/bpf.h> 90 #include <linux/kernfs.h> 91 #include <linux/stringhash.h> /* for hashlen_string() */ 92 #include <uapi/linux/mount.h> 93 #include <linux/fsnotify.h> 94 #include <linux/fanotify.h> 95 96 #include "avc.h" 97 #include "objsec.h" 98 #include "netif.h" 99 #include "netnode.h" 100 #include "netport.h" 101 #include "ibpkey.h" 102 #include "xfrm.h" 103 #include "netlabel.h" 104 #include "audit.h" 105 #include "avc_ss.h" 106 107 struct selinux_state selinux_state; 108 109 /* SECMARK reference count */ 110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0); 111 112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP 113 static int selinux_enforcing_boot __initdata; 114 115 static int __init enforcing_setup(char *str) 116 { 117 unsigned long enforcing; 118 if (!kstrtoul(str, 0, &enforcing)) 119 selinux_enforcing_boot = enforcing ? 1 : 0; 120 return 1; 121 } 122 __setup("enforcing=", enforcing_setup); 123 #else 124 #define selinux_enforcing_boot 1 125 #endif 126 127 int selinux_enabled_boot __initdata = 1; 128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM 129 static int __init selinux_enabled_setup(char *str) 130 { 131 unsigned long enabled; 132 if (!kstrtoul(str, 0, &enabled)) 133 selinux_enabled_boot = enabled ? 1 : 0; 134 return 1; 135 } 136 __setup("selinux=", selinux_enabled_setup); 137 #endif 138 139 static unsigned int selinux_checkreqprot_boot = 140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE; 141 142 static int __init checkreqprot_setup(char *str) 143 { 144 unsigned long checkreqprot; 145 146 if (!kstrtoul(str, 0, &checkreqprot)) { 147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0; 148 if (checkreqprot) 149 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n"); 150 } 151 return 1; 152 } 153 __setup("checkreqprot=", checkreqprot_setup); 154 155 /** 156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled 157 * 158 * Description: 159 * This function checks the SECMARK reference counter to see if any SECMARK 160 * targets are currently configured, if the reference counter is greater than 161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is 162 * enabled, false (0) if SECMARK is disabled. If the always_check_network 163 * policy capability is enabled, SECMARK is always considered enabled. 164 * 165 */ 166 static int selinux_secmark_enabled(void) 167 { 168 return (selinux_policycap_alwaysnetwork() || 169 atomic_read(&selinux_secmark_refcount)); 170 } 171 172 /** 173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled 174 * 175 * Description: 176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true 177 * (1) if any are enabled or false (0) if neither are enabled. If the 178 * always_check_network policy capability is enabled, peer labeling 179 * is always considered enabled. 180 * 181 */ 182 static int selinux_peerlbl_enabled(void) 183 { 184 return (selinux_policycap_alwaysnetwork() || 185 netlbl_enabled() || selinux_xfrm_enabled()); 186 } 187 188 static int selinux_netcache_avc_callback(u32 event) 189 { 190 if (event == AVC_CALLBACK_RESET) { 191 sel_netif_flush(); 192 sel_netnode_flush(); 193 sel_netport_flush(); 194 synchronize_net(); 195 } 196 return 0; 197 } 198 199 static int selinux_lsm_notifier_avc_callback(u32 event) 200 { 201 if (event == AVC_CALLBACK_RESET) { 202 sel_ib_pkey_flush(); 203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL); 204 } 205 206 return 0; 207 } 208 209 /* 210 * initialise the security for the init task 211 */ 212 static void cred_init_security(void) 213 { 214 struct cred *cred = (struct cred *) current->real_cred; 215 struct task_security_struct *tsec; 216 217 tsec = selinux_cred(cred); 218 tsec->osid = tsec->sid = SECINITSID_KERNEL; 219 } 220 221 /* 222 * get the security ID of a set of credentials 223 */ 224 static inline u32 cred_sid(const struct cred *cred) 225 { 226 const struct task_security_struct *tsec; 227 228 tsec = selinux_cred(cred); 229 return tsec->sid; 230 } 231 232 /* 233 * get the objective security ID of a task 234 */ 235 static inline u32 task_sid_obj(const struct task_struct *task) 236 { 237 u32 sid; 238 239 rcu_read_lock(); 240 sid = cred_sid(__task_cred(task)); 241 rcu_read_unlock(); 242 return sid; 243 } 244 245 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry); 246 247 /* 248 * Try reloading inode security labels that have been marked as invalid. The 249 * @may_sleep parameter indicates when sleeping and thus reloading labels is 250 * allowed; when set to false, returns -ECHILD when the label is 251 * invalid. The @dentry parameter should be set to a dentry of the inode. 252 */ 253 static int __inode_security_revalidate(struct inode *inode, 254 struct dentry *dentry, 255 bool may_sleep) 256 { 257 struct inode_security_struct *isec = selinux_inode(inode); 258 259 might_sleep_if(may_sleep); 260 261 if (selinux_initialized(&selinux_state) && 262 isec->initialized != LABEL_INITIALIZED) { 263 if (!may_sleep) 264 return -ECHILD; 265 266 /* 267 * Try reloading the inode security label. This will fail if 268 * @opt_dentry is NULL and no dentry for this inode can be 269 * found; in that case, continue using the old label. 270 */ 271 inode_doinit_with_dentry(inode, dentry); 272 } 273 return 0; 274 } 275 276 static struct inode_security_struct *inode_security_novalidate(struct inode *inode) 277 { 278 return selinux_inode(inode); 279 } 280 281 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu) 282 { 283 int error; 284 285 error = __inode_security_revalidate(inode, NULL, !rcu); 286 if (error) 287 return ERR_PTR(error); 288 return selinux_inode(inode); 289 } 290 291 /* 292 * Get the security label of an inode. 293 */ 294 static struct inode_security_struct *inode_security(struct inode *inode) 295 { 296 __inode_security_revalidate(inode, NULL, true); 297 return selinux_inode(inode); 298 } 299 300 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry) 301 { 302 struct inode *inode = d_backing_inode(dentry); 303 304 return selinux_inode(inode); 305 } 306 307 /* 308 * Get the security label of a dentry's backing inode. 309 */ 310 static struct inode_security_struct *backing_inode_security(struct dentry *dentry) 311 { 312 struct inode *inode = d_backing_inode(dentry); 313 314 __inode_security_revalidate(inode, dentry, true); 315 return selinux_inode(inode); 316 } 317 318 static void inode_free_security(struct inode *inode) 319 { 320 struct inode_security_struct *isec = selinux_inode(inode); 321 struct superblock_security_struct *sbsec; 322 323 if (!isec) 324 return; 325 sbsec = selinux_superblock(inode->i_sb); 326 /* 327 * As not all inode security structures are in a list, we check for 328 * empty list outside of the lock to make sure that we won't waste 329 * time taking a lock doing nothing. 330 * 331 * The list_del_init() function can be safely called more than once. 332 * It should not be possible for this function to be called with 333 * concurrent list_add(), but for better safety against future changes 334 * in the code, we use list_empty_careful() here. 335 */ 336 if (!list_empty_careful(&isec->list)) { 337 spin_lock(&sbsec->isec_lock); 338 list_del_init(&isec->list); 339 spin_unlock(&sbsec->isec_lock); 340 } 341 } 342 343 struct selinux_mnt_opts { 344 const char *fscontext, *context, *rootcontext, *defcontext; 345 }; 346 347 static void selinux_free_mnt_opts(void *mnt_opts) 348 { 349 struct selinux_mnt_opts *opts = mnt_opts; 350 kfree(opts->fscontext); 351 kfree(opts->context); 352 kfree(opts->rootcontext); 353 kfree(opts->defcontext); 354 kfree(opts); 355 } 356 357 enum { 358 Opt_error = -1, 359 Opt_context = 0, 360 Opt_defcontext = 1, 361 Opt_fscontext = 2, 362 Opt_rootcontext = 3, 363 Opt_seclabel = 4, 364 }; 365 366 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg} 367 static struct { 368 const char *name; 369 int len; 370 int opt; 371 bool has_arg; 372 } tokens[] = { 373 A(context, true), 374 A(fscontext, true), 375 A(defcontext, true), 376 A(rootcontext, true), 377 A(seclabel, false), 378 }; 379 #undef A 380 381 static int match_opt_prefix(char *s, int l, char **arg) 382 { 383 int i; 384 385 for (i = 0; i < ARRAY_SIZE(tokens); i++) { 386 size_t len = tokens[i].len; 387 if (len > l || memcmp(s, tokens[i].name, len)) 388 continue; 389 if (tokens[i].has_arg) { 390 if (len == l || s[len] != '=') 391 continue; 392 *arg = s + len + 1; 393 } else if (len != l) 394 continue; 395 return tokens[i].opt; 396 } 397 return Opt_error; 398 } 399 400 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n" 401 402 static int may_context_mount_sb_relabel(u32 sid, 403 struct superblock_security_struct *sbsec, 404 const struct cred *cred) 405 { 406 const struct task_security_struct *tsec = selinux_cred(cred); 407 int rc; 408 409 rc = avc_has_perm(&selinux_state, 410 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 411 FILESYSTEM__RELABELFROM, NULL); 412 if (rc) 413 return rc; 414 415 rc = avc_has_perm(&selinux_state, 416 tsec->sid, sid, SECCLASS_FILESYSTEM, 417 FILESYSTEM__RELABELTO, NULL); 418 return rc; 419 } 420 421 static int may_context_mount_inode_relabel(u32 sid, 422 struct superblock_security_struct *sbsec, 423 const struct cred *cred) 424 { 425 const struct task_security_struct *tsec = selinux_cred(cred); 426 int rc; 427 rc = avc_has_perm(&selinux_state, 428 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM, 429 FILESYSTEM__RELABELFROM, NULL); 430 if (rc) 431 return rc; 432 433 rc = avc_has_perm(&selinux_state, 434 sid, sbsec->sid, SECCLASS_FILESYSTEM, 435 FILESYSTEM__ASSOCIATE, NULL); 436 return rc; 437 } 438 439 static int selinux_is_genfs_special_handling(struct super_block *sb) 440 { 441 /* Special handling. Genfs but also in-core setxattr handler */ 442 return !strcmp(sb->s_type->name, "sysfs") || 443 !strcmp(sb->s_type->name, "pstore") || 444 !strcmp(sb->s_type->name, "debugfs") || 445 !strcmp(sb->s_type->name, "tracefs") || 446 !strcmp(sb->s_type->name, "rootfs") || 447 (selinux_policycap_cgroupseclabel() && 448 (!strcmp(sb->s_type->name, "cgroup") || 449 !strcmp(sb->s_type->name, "cgroup2"))); 450 } 451 452 static int selinux_is_sblabel_mnt(struct super_block *sb) 453 { 454 struct superblock_security_struct *sbsec = selinux_superblock(sb); 455 456 /* 457 * IMPORTANT: Double-check logic in this function when adding a new 458 * SECURITY_FS_USE_* definition! 459 */ 460 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7); 461 462 switch (sbsec->behavior) { 463 case SECURITY_FS_USE_XATTR: 464 case SECURITY_FS_USE_TRANS: 465 case SECURITY_FS_USE_TASK: 466 case SECURITY_FS_USE_NATIVE: 467 return 1; 468 469 case SECURITY_FS_USE_GENFS: 470 return selinux_is_genfs_special_handling(sb); 471 472 /* Never allow relabeling on context mounts */ 473 case SECURITY_FS_USE_MNTPOINT: 474 case SECURITY_FS_USE_NONE: 475 default: 476 return 0; 477 } 478 } 479 480 static int sb_check_xattr_support(struct super_block *sb) 481 { 482 struct superblock_security_struct *sbsec = sb->s_security; 483 struct dentry *root = sb->s_root; 484 struct inode *root_inode = d_backing_inode(root); 485 u32 sid; 486 int rc; 487 488 /* 489 * Make sure that the xattr handler exists and that no 490 * error other than -ENODATA is returned by getxattr on 491 * the root directory. -ENODATA is ok, as this may be 492 * the first boot of the SELinux kernel before we have 493 * assigned xattr values to the filesystem. 494 */ 495 if (!(root_inode->i_opflags & IOP_XATTR)) { 496 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n", 497 sb->s_id, sb->s_type->name); 498 goto fallback; 499 } 500 501 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0); 502 if (rc < 0 && rc != -ENODATA) { 503 if (rc == -EOPNOTSUPP) { 504 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n", 505 sb->s_id, sb->s_type->name); 506 goto fallback; 507 } else { 508 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n", 509 sb->s_id, sb->s_type->name, -rc); 510 return rc; 511 } 512 } 513 return 0; 514 515 fallback: 516 /* No xattr support - try to fallback to genfs if possible. */ 517 rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/", 518 SECCLASS_DIR, &sid); 519 if (rc) 520 return -EOPNOTSUPP; 521 522 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n", 523 sb->s_id, sb->s_type->name); 524 sbsec->behavior = SECURITY_FS_USE_GENFS; 525 sbsec->sid = sid; 526 return 0; 527 } 528 529 static int sb_finish_set_opts(struct super_block *sb) 530 { 531 struct superblock_security_struct *sbsec = selinux_superblock(sb); 532 struct dentry *root = sb->s_root; 533 struct inode *root_inode = d_backing_inode(root); 534 int rc = 0; 535 536 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 537 rc = sb_check_xattr_support(sb); 538 if (rc) 539 return rc; 540 } 541 542 sbsec->flags |= SE_SBINITIALIZED; 543 544 /* 545 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply 546 * leave the flag untouched because sb_clone_mnt_opts might be handing 547 * us a superblock that needs the flag to be cleared. 548 */ 549 if (selinux_is_sblabel_mnt(sb)) 550 sbsec->flags |= SBLABEL_MNT; 551 else 552 sbsec->flags &= ~SBLABEL_MNT; 553 554 /* Initialize the root inode. */ 555 rc = inode_doinit_with_dentry(root_inode, root); 556 557 /* Initialize any other inodes associated with the superblock, e.g. 558 inodes created prior to initial policy load or inodes created 559 during get_sb by a pseudo filesystem that directly 560 populates itself. */ 561 spin_lock(&sbsec->isec_lock); 562 while (!list_empty(&sbsec->isec_head)) { 563 struct inode_security_struct *isec = 564 list_first_entry(&sbsec->isec_head, 565 struct inode_security_struct, list); 566 struct inode *inode = isec->inode; 567 list_del_init(&isec->list); 568 spin_unlock(&sbsec->isec_lock); 569 inode = igrab(inode); 570 if (inode) { 571 if (!IS_PRIVATE(inode)) 572 inode_doinit_with_dentry(inode, NULL); 573 iput(inode); 574 } 575 spin_lock(&sbsec->isec_lock); 576 } 577 spin_unlock(&sbsec->isec_lock); 578 return rc; 579 } 580 581 static int bad_option(struct superblock_security_struct *sbsec, char flag, 582 u32 old_sid, u32 new_sid) 583 { 584 char mnt_flags = sbsec->flags & SE_MNTMASK; 585 586 /* check if the old mount command had the same options */ 587 if (sbsec->flags & SE_SBINITIALIZED) 588 if (!(sbsec->flags & flag) || 589 (old_sid != new_sid)) 590 return 1; 591 592 /* check if we were passed the same options twice, 593 * aka someone passed context=a,context=b 594 */ 595 if (!(sbsec->flags & SE_SBINITIALIZED)) 596 if (mnt_flags & flag) 597 return 1; 598 return 0; 599 } 600 601 static int parse_sid(struct super_block *sb, const char *s, u32 *sid, 602 gfp_t gfp) 603 { 604 int rc = security_context_str_to_sid(&selinux_state, s, 605 sid, gfp); 606 if (rc) 607 pr_warn("SELinux: security_context_str_to_sid" 608 "(%s) failed for (dev %s, type %s) errno=%d\n", 609 s, sb->s_id, sb->s_type->name, rc); 610 return rc; 611 } 612 613 /* 614 * Allow filesystems with binary mount data to explicitly set mount point 615 * labeling information. 616 */ 617 static int selinux_set_mnt_opts(struct super_block *sb, 618 void *mnt_opts, 619 unsigned long kern_flags, 620 unsigned long *set_kern_flags) 621 { 622 const struct cred *cred = current_cred(); 623 struct superblock_security_struct *sbsec = selinux_superblock(sb); 624 struct dentry *root = sb->s_root; 625 struct selinux_mnt_opts *opts = mnt_opts; 626 struct inode_security_struct *root_isec; 627 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0; 628 u32 defcontext_sid = 0; 629 int rc = 0; 630 631 mutex_lock(&sbsec->lock); 632 633 if (!selinux_initialized(&selinux_state)) { 634 if (!opts) { 635 /* Defer initialization until selinux_complete_init, 636 after the initial policy is loaded and the security 637 server is ready to handle calls. */ 638 goto out; 639 } 640 rc = -EINVAL; 641 pr_warn("SELinux: Unable to set superblock options " 642 "before the security server is initialized\n"); 643 goto out; 644 } 645 if (kern_flags && !set_kern_flags) { 646 /* Specifying internal flags without providing a place to 647 * place the results is not allowed */ 648 rc = -EINVAL; 649 goto out; 650 } 651 652 /* 653 * Binary mount data FS will come through this function twice. Once 654 * from an explicit call and once from the generic calls from the vfs. 655 * Since the generic VFS calls will not contain any security mount data 656 * we need to skip the double mount verification. 657 * 658 * This does open a hole in which we will not notice if the first 659 * mount using this sb set explict options and a second mount using 660 * this sb does not set any security options. (The first options 661 * will be used for both mounts) 662 */ 663 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) 664 && !opts) 665 goto out; 666 667 root_isec = backing_inode_security_novalidate(root); 668 669 /* 670 * parse the mount options, check if they are valid sids. 671 * also check if someone is trying to mount the same sb more 672 * than once with different security options. 673 */ 674 if (opts) { 675 if (opts->fscontext) { 676 rc = parse_sid(sb, opts->fscontext, &fscontext_sid, 677 GFP_KERNEL); 678 if (rc) 679 goto out; 680 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, 681 fscontext_sid)) 682 goto out_double_mount; 683 sbsec->flags |= FSCONTEXT_MNT; 684 } 685 if (opts->context) { 686 rc = parse_sid(sb, opts->context, &context_sid, 687 GFP_KERNEL); 688 if (rc) 689 goto out; 690 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, 691 context_sid)) 692 goto out_double_mount; 693 sbsec->flags |= CONTEXT_MNT; 694 } 695 if (opts->rootcontext) { 696 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid, 697 GFP_KERNEL); 698 if (rc) 699 goto out; 700 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, 701 rootcontext_sid)) 702 goto out_double_mount; 703 sbsec->flags |= ROOTCONTEXT_MNT; 704 } 705 if (opts->defcontext) { 706 rc = parse_sid(sb, opts->defcontext, &defcontext_sid, 707 GFP_KERNEL); 708 if (rc) 709 goto out; 710 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, 711 defcontext_sid)) 712 goto out_double_mount; 713 sbsec->flags |= DEFCONTEXT_MNT; 714 } 715 } 716 717 if (sbsec->flags & SE_SBINITIALIZED) { 718 /* previously mounted with options, but not on this attempt? */ 719 if ((sbsec->flags & SE_MNTMASK) && !opts) 720 goto out_double_mount; 721 rc = 0; 722 goto out; 723 } 724 725 if (strcmp(sb->s_type->name, "proc") == 0) 726 sbsec->flags |= SE_SBPROC | SE_SBGENFS; 727 728 if (!strcmp(sb->s_type->name, "debugfs") || 729 !strcmp(sb->s_type->name, "tracefs") || 730 !strcmp(sb->s_type->name, "binder") || 731 !strcmp(sb->s_type->name, "bpf") || 732 !strcmp(sb->s_type->name, "pstore") || 733 !strcmp(sb->s_type->name, "securityfs")) 734 sbsec->flags |= SE_SBGENFS; 735 736 if (!strcmp(sb->s_type->name, "sysfs") || 737 !strcmp(sb->s_type->name, "cgroup") || 738 !strcmp(sb->s_type->name, "cgroup2")) 739 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR; 740 741 if (!sbsec->behavior) { 742 /* 743 * Determine the labeling behavior to use for this 744 * filesystem type. 745 */ 746 rc = security_fs_use(&selinux_state, sb); 747 if (rc) { 748 pr_warn("%s: security_fs_use(%s) returned %d\n", 749 __func__, sb->s_type->name, rc); 750 goto out; 751 } 752 } 753 754 /* 755 * If this is a user namespace mount and the filesystem type is not 756 * explicitly whitelisted, then no contexts are allowed on the command 757 * line and security labels must be ignored. 758 */ 759 if (sb->s_user_ns != &init_user_ns && 760 strcmp(sb->s_type->name, "tmpfs") && 761 strcmp(sb->s_type->name, "ramfs") && 762 strcmp(sb->s_type->name, "devpts") && 763 strcmp(sb->s_type->name, "overlay")) { 764 if (context_sid || fscontext_sid || rootcontext_sid || 765 defcontext_sid) { 766 rc = -EACCES; 767 goto out; 768 } 769 if (sbsec->behavior == SECURITY_FS_USE_XATTR) { 770 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 771 rc = security_transition_sid(&selinux_state, 772 current_sid(), 773 current_sid(), 774 SECCLASS_FILE, NULL, 775 &sbsec->mntpoint_sid); 776 if (rc) 777 goto out; 778 } 779 goto out_set_opts; 780 } 781 782 /* sets the context of the superblock for the fs being mounted. */ 783 if (fscontext_sid) { 784 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred); 785 if (rc) 786 goto out; 787 788 sbsec->sid = fscontext_sid; 789 } 790 791 /* 792 * Switch to using mount point labeling behavior. 793 * sets the label used on all file below the mountpoint, and will set 794 * the superblock context if not already set. 795 */ 796 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) { 797 sbsec->behavior = SECURITY_FS_USE_NATIVE; 798 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; 799 } 800 801 if (context_sid) { 802 if (!fscontext_sid) { 803 rc = may_context_mount_sb_relabel(context_sid, sbsec, 804 cred); 805 if (rc) 806 goto out; 807 sbsec->sid = context_sid; 808 } else { 809 rc = may_context_mount_inode_relabel(context_sid, sbsec, 810 cred); 811 if (rc) 812 goto out; 813 } 814 if (!rootcontext_sid) 815 rootcontext_sid = context_sid; 816 817 sbsec->mntpoint_sid = context_sid; 818 sbsec->behavior = SECURITY_FS_USE_MNTPOINT; 819 } 820 821 if (rootcontext_sid) { 822 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, 823 cred); 824 if (rc) 825 goto out; 826 827 root_isec->sid = rootcontext_sid; 828 root_isec->initialized = LABEL_INITIALIZED; 829 } 830 831 if (defcontext_sid) { 832 if (sbsec->behavior != SECURITY_FS_USE_XATTR && 833 sbsec->behavior != SECURITY_FS_USE_NATIVE) { 834 rc = -EINVAL; 835 pr_warn("SELinux: defcontext option is " 836 "invalid for this filesystem type\n"); 837 goto out; 838 } 839 840 if (defcontext_sid != sbsec->def_sid) { 841 rc = may_context_mount_inode_relabel(defcontext_sid, 842 sbsec, cred); 843 if (rc) 844 goto out; 845 } 846 847 sbsec->def_sid = defcontext_sid; 848 } 849 850 out_set_opts: 851 rc = sb_finish_set_opts(sb); 852 out: 853 mutex_unlock(&sbsec->lock); 854 return rc; 855 out_double_mount: 856 rc = -EINVAL; 857 pr_warn("SELinux: mount invalid. Same superblock, different " 858 "security settings for (dev %s, type %s)\n", sb->s_id, 859 sb->s_type->name); 860 goto out; 861 } 862 863 static int selinux_cmp_sb_context(const struct super_block *oldsb, 864 const struct super_block *newsb) 865 { 866 struct superblock_security_struct *old = selinux_superblock(oldsb); 867 struct superblock_security_struct *new = selinux_superblock(newsb); 868 char oldflags = old->flags & SE_MNTMASK; 869 char newflags = new->flags & SE_MNTMASK; 870 871 if (oldflags != newflags) 872 goto mismatch; 873 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid) 874 goto mismatch; 875 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid) 876 goto mismatch; 877 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid) 878 goto mismatch; 879 if (oldflags & ROOTCONTEXT_MNT) { 880 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root); 881 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root); 882 if (oldroot->sid != newroot->sid) 883 goto mismatch; 884 } 885 return 0; 886 mismatch: 887 pr_warn("SELinux: mount invalid. Same superblock, " 888 "different security settings for (dev %s, " 889 "type %s)\n", newsb->s_id, newsb->s_type->name); 890 return -EBUSY; 891 } 892 893 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb, 894 struct super_block *newsb, 895 unsigned long kern_flags, 896 unsigned long *set_kern_flags) 897 { 898 int rc = 0; 899 const struct superblock_security_struct *oldsbsec = 900 selinux_superblock(oldsb); 901 struct superblock_security_struct *newsbsec = selinux_superblock(newsb); 902 903 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT); 904 int set_context = (oldsbsec->flags & CONTEXT_MNT); 905 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT); 906 907 /* 908 * if the parent was able to be mounted it clearly had no special lsm 909 * mount options. thus we can safely deal with this superblock later 910 */ 911 if (!selinux_initialized(&selinux_state)) 912 return 0; 913 914 /* 915 * Specifying internal flags without providing a place to 916 * place the results is not allowed. 917 */ 918 if (kern_flags && !set_kern_flags) 919 return -EINVAL; 920 921 /* how can we clone if the old one wasn't set up?? */ 922 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED)); 923 924 /* if fs is reusing a sb, make sure that the contexts match */ 925 if (newsbsec->flags & SE_SBINITIALIZED) { 926 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) 927 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; 928 return selinux_cmp_sb_context(oldsb, newsb); 929 } 930 931 mutex_lock(&newsbsec->lock); 932 933 newsbsec->flags = oldsbsec->flags; 934 935 newsbsec->sid = oldsbsec->sid; 936 newsbsec->def_sid = oldsbsec->def_sid; 937 newsbsec->behavior = oldsbsec->behavior; 938 939 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE && 940 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) { 941 rc = security_fs_use(&selinux_state, newsb); 942 if (rc) 943 goto out; 944 } 945 946 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) { 947 newsbsec->behavior = SECURITY_FS_USE_NATIVE; 948 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS; 949 } 950 951 if (set_context) { 952 u32 sid = oldsbsec->mntpoint_sid; 953 954 if (!set_fscontext) 955 newsbsec->sid = sid; 956 if (!set_rootcontext) { 957 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 958 newisec->sid = sid; 959 } 960 newsbsec->mntpoint_sid = sid; 961 } 962 if (set_rootcontext) { 963 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root); 964 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root); 965 966 newisec->sid = oldisec->sid; 967 } 968 969 sb_finish_set_opts(newsb); 970 out: 971 mutex_unlock(&newsbsec->lock); 972 return rc; 973 } 974 975 static int selinux_add_opt(int token, const char *s, void **mnt_opts) 976 { 977 struct selinux_mnt_opts *opts = *mnt_opts; 978 bool is_alloc_opts = false; 979 980 if (token == Opt_seclabel) 981 /* eaten and completely ignored */ 982 return 0; 983 if (!s) 984 return -ENOMEM; 985 986 if (!opts) { 987 opts = kzalloc(sizeof(*opts), GFP_KERNEL); 988 if (!opts) 989 return -ENOMEM; 990 *mnt_opts = opts; 991 is_alloc_opts = true; 992 } 993 994 switch (token) { 995 case Opt_context: 996 if (opts->context || opts->defcontext) 997 goto err; 998 opts->context = s; 999 break; 1000 case Opt_fscontext: 1001 if (opts->fscontext) 1002 goto err; 1003 opts->fscontext = s; 1004 break; 1005 case Opt_rootcontext: 1006 if (opts->rootcontext) 1007 goto err; 1008 opts->rootcontext = s; 1009 break; 1010 case Opt_defcontext: 1011 if (opts->context || opts->defcontext) 1012 goto err; 1013 opts->defcontext = s; 1014 break; 1015 } 1016 1017 return 0; 1018 1019 err: 1020 if (is_alloc_opts) { 1021 kfree(opts); 1022 *mnt_opts = NULL; 1023 } 1024 pr_warn(SEL_MOUNT_FAIL_MSG); 1025 return -EINVAL; 1026 } 1027 1028 static int show_sid(struct seq_file *m, u32 sid) 1029 { 1030 char *context = NULL; 1031 u32 len; 1032 int rc; 1033 1034 rc = security_sid_to_context(&selinux_state, sid, 1035 &context, &len); 1036 if (!rc) { 1037 bool has_comma = context && strchr(context, ','); 1038 1039 seq_putc(m, '='); 1040 if (has_comma) 1041 seq_putc(m, '\"'); 1042 seq_escape(m, context, "\"\n\\"); 1043 if (has_comma) 1044 seq_putc(m, '\"'); 1045 } 1046 kfree(context); 1047 return rc; 1048 } 1049 1050 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb) 1051 { 1052 struct superblock_security_struct *sbsec = selinux_superblock(sb); 1053 int rc; 1054 1055 if (!(sbsec->flags & SE_SBINITIALIZED)) 1056 return 0; 1057 1058 if (!selinux_initialized(&selinux_state)) 1059 return 0; 1060 1061 if (sbsec->flags & FSCONTEXT_MNT) { 1062 seq_putc(m, ','); 1063 seq_puts(m, FSCONTEXT_STR); 1064 rc = show_sid(m, sbsec->sid); 1065 if (rc) 1066 return rc; 1067 } 1068 if (sbsec->flags & CONTEXT_MNT) { 1069 seq_putc(m, ','); 1070 seq_puts(m, CONTEXT_STR); 1071 rc = show_sid(m, sbsec->mntpoint_sid); 1072 if (rc) 1073 return rc; 1074 } 1075 if (sbsec->flags & DEFCONTEXT_MNT) { 1076 seq_putc(m, ','); 1077 seq_puts(m, DEFCONTEXT_STR); 1078 rc = show_sid(m, sbsec->def_sid); 1079 if (rc) 1080 return rc; 1081 } 1082 if (sbsec->flags & ROOTCONTEXT_MNT) { 1083 struct dentry *root = sb->s_root; 1084 struct inode_security_struct *isec = backing_inode_security(root); 1085 seq_putc(m, ','); 1086 seq_puts(m, ROOTCONTEXT_STR); 1087 rc = show_sid(m, isec->sid); 1088 if (rc) 1089 return rc; 1090 } 1091 if (sbsec->flags & SBLABEL_MNT) { 1092 seq_putc(m, ','); 1093 seq_puts(m, SECLABEL_STR); 1094 } 1095 return 0; 1096 } 1097 1098 static inline u16 inode_mode_to_security_class(umode_t mode) 1099 { 1100 switch (mode & S_IFMT) { 1101 case S_IFSOCK: 1102 return SECCLASS_SOCK_FILE; 1103 case S_IFLNK: 1104 return SECCLASS_LNK_FILE; 1105 case S_IFREG: 1106 return SECCLASS_FILE; 1107 case S_IFBLK: 1108 return SECCLASS_BLK_FILE; 1109 case S_IFDIR: 1110 return SECCLASS_DIR; 1111 case S_IFCHR: 1112 return SECCLASS_CHR_FILE; 1113 case S_IFIFO: 1114 return SECCLASS_FIFO_FILE; 1115 1116 } 1117 1118 return SECCLASS_FILE; 1119 } 1120 1121 static inline int default_protocol_stream(int protocol) 1122 { 1123 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP || 1124 protocol == IPPROTO_MPTCP); 1125 } 1126 1127 static inline int default_protocol_dgram(int protocol) 1128 { 1129 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP); 1130 } 1131 1132 static inline u16 socket_type_to_security_class(int family, int type, int protocol) 1133 { 1134 int extsockclass = selinux_policycap_extsockclass(); 1135 1136 switch (family) { 1137 case PF_UNIX: 1138 switch (type) { 1139 case SOCK_STREAM: 1140 case SOCK_SEQPACKET: 1141 return SECCLASS_UNIX_STREAM_SOCKET; 1142 case SOCK_DGRAM: 1143 case SOCK_RAW: 1144 return SECCLASS_UNIX_DGRAM_SOCKET; 1145 } 1146 break; 1147 case PF_INET: 1148 case PF_INET6: 1149 switch (type) { 1150 case SOCK_STREAM: 1151 case SOCK_SEQPACKET: 1152 if (default_protocol_stream(protocol)) 1153 return SECCLASS_TCP_SOCKET; 1154 else if (extsockclass && protocol == IPPROTO_SCTP) 1155 return SECCLASS_SCTP_SOCKET; 1156 else 1157 return SECCLASS_RAWIP_SOCKET; 1158 case SOCK_DGRAM: 1159 if (default_protocol_dgram(protocol)) 1160 return SECCLASS_UDP_SOCKET; 1161 else if (extsockclass && (protocol == IPPROTO_ICMP || 1162 protocol == IPPROTO_ICMPV6)) 1163 return SECCLASS_ICMP_SOCKET; 1164 else 1165 return SECCLASS_RAWIP_SOCKET; 1166 case SOCK_DCCP: 1167 return SECCLASS_DCCP_SOCKET; 1168 default: 1169 return SECCLASS_RAWIP_SOCKET; 1170 } 1171 break; 1172 case PF_NETLINK: 1173 switch (protocol) { 1174 case NETLINK_ROUTE: 1175 return SECCLASS_NETLINK_ROUTE_SOCKET; 1176 case NETLINK_SOCK_DIAG: 1177 return SECCLASS_NETLINK_TCPDIAG_SOCKET; 1178 case NETLINK_NFLOG: 1179 return SECCLASS_NETLINK_NFLOG_SOCKET; 1180 case NETLINK_XFRM: 1181 return SECCLASS_NETLINK_XFRM_SOCKET; 1182 case NETLINK_SELINUX: 1183 return SECCLASS_NETLINK_SELINUX_SOCKET; 1184 case NETLINK_ISCSI: 1185 return SECCLASS_NETLINK_ISCSI_SOCKET; 1186 case NETLINK_AUDIT: 1187 return SECCLASS_NETLINK_AUDIT_SOCKET; 1188 case NETLINK_FIB_LOOKUP: 1189 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET; 1190 case NETLINK_CONNECTOR: 1191 return SECCLASS_NETLINK_CONNECTOR_SOCKET; 1192 case NETLINK_NETFILTER: 1193 return SECCLASS_NETLINK_NETFILTER_SOCKET; 1194 case NETLINK_DNRTMSG: 1195 return SECCLASS_NETLINK_DNRT_SOCKET; 1196 case NETLINK_KOBJECT_UEVENT: 1197 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET; 1198 case NETLINK_GENERIC: 1199 return SECCLASS_NETLINK_GENERIC_SOCKET; 1200 case NETLINK_SCSITRANSPORT: 1201 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET; 1202 case NETLINK_RDMA: 1203 return SECCLASS_NETLINK_RDMA_SOCKET; 1204 case NETLINK_CRYPTO: 1205 return SECCLASS_NETLINK_CRYPTO_SOCKET; 1206 default: 1207 return SECCLASS_NETLINK_SOCKET; 1208 } 1209 case PF_PACKET: 1210 return SECCLASS_PACKET_SOCKET; 1211 case PF_KEY: 1212 return SECCLASS_KEY_SOCKET; 1213 case PF_APPLETALK: 1214 return SECCLASS_APPLETALK_SOCKET; 1215 } 1216 1217 if (extsockclass) { 1218 switch (family) { 1219 case PF_AX25: 1220 return SECCLASS_AX25_SOCKET; 1221 case PF_IPX: 1222 return SECCLASS_IPX_SOCKET; 1223 case PF_NETROM: 1224 return SECCLASS_NETROM_SOCKET; 1225 case PF_ATMPVC: 1226 return SECCLASS_ATMPVC_SOCKET; 1227 case PF_X25: 1228 return SECCLASS_X25_SOCKET; 1229 case PF_ROSE: 1230 return SECCLASS_ROSE_SOCKET; 1231 case PF_DECnet: 1232 return SECCLASS_DECNET_SOCKET; 1233 case PF_ATMSVC: 1234 return SECCLASS_ATMSVC_SOCKET; 1235 case PF_RDS: 1236 return SECCLASS_RDS_SOCKET; 1237 case PF_IRDA: 1238 return SECCLASS_IRDA_SOCKET; 1239 case PF_PPPOX: 1240 return SECCLASS_PPPOX_SOCKET; 1241 case PF_LLC: 1242 return SECCLASS_LLC_SOCKET; 1243 case PF_CAN: 1244 return SECCLASS_CAN_SOCKET; 1245 case PF_TIPC: 1246 return SECCLASS_TIPC_SOCKET; 1247 case PF_BLUETOOTH: 1248 return SECCLASS_BLUETOOTH_SOCKET; 1249 case PF_IUCV: 1250 return SECCLASS_IUCV_SOCKET; 1251 case PF_RXRPC: 1252 return SECCLASS_RXRPC_SOCKET; 1253 case PF_ISDN: 1254 return SECCLASS_ISDN_SOCKET; 1255 case PF_PHONET: 1256 return SECCLASS_PHONET_SOCKET; 1257 case PF_IEEE802154: 1258 return SECCLASS_IEEE802154_SOCKET; 1259 case PF_CAIF: 1260 return SECCLASS_CAIF_SOCKET; 1261 case PF_ALG: 1262 return SECCLASS_ALG_SOCKET; 1263 case PF_NFC: 1264 return SECCLASS_NFC_SOCKET; 1265 case PF_VSOCK: 1266 return SECCLASS_VSOCK_SOCKET; 1267 case PF_KCM: 1268 return SECCLASS_KCM_SOCKET; 1269 case PF_QIPCRTR: 1270 return SECCLASS_QIPCRTR_SOCKET; 1271 case PF_SMC: 1272 return SECCLASS_SMC_SOCKET; 1273 case PF_XDP: 1274 return SECCLASS_XDP_SOCKET; 1275 case PF_MCTP: 1276 return SECCLASS_MCTP_SOCKET; 1277 #if PF_MAX > 46 1278 #error New address family defined, please update this function. 1279 #endif 1280 } 1281 } 1282 1283 return SECCLASS_SOCKET; 1284 } 1285 1286 static int selinux_genfs_get_sid(struct dentry *dentry, 1287 u16 tclass, 1288 u16 flags, 1289 u32 *sid) 1290 { 1291 int rc; 1292 struct super_block *sb = dentry->d_sb; 1293 char *buffer, *path; 1294 1295 buffer = (char *)__get_free_page(GFP_KERNEL); 1296 if (!buffer) 1297 return -ENOMEM; 1298 1299 path = dentry_path_raw(dentry, buffer, PAGE_SIZE); 1300 if (IS_ERR(path)) 1301 rc = PTR_ERR(path); 1302 else { 1303 if (flags & SE_SBPROC) { 1304 /* each process gets a /proc/PID/ entry. Strip off the 1305 * PID part to get a valid selinux labeling. 1306 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */ 1307 while (path[1] >= '0' && path[1] <= '9') { 1308 path[1] = '/'; 1309 path++; 1310 } 1311 } 1312 rc = security_genfs_sid(&selinux_state, sb->s_type->name, 1313 path, tclass, sid); 1314 if (rc == -ENOENT) { 1315 /* No match in policy, mark as unlabeled. */ 1316 *sid = SECINITSID_UNLABELED; 1317 rc = 0; 1318 } 1319 } 1320 free_page((unsigned long)buffer); 1321 return rc; 1322 } 1323 1324 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry, 1325 u32 def_sid, u32 *sid) 1326 { 1327 #define INITCONTEXTLEN 255 1328 char *context; 1329 unsigned int len; 1330 int rc; 1331 1332 len = INITCONTEXTLEN; 1333 context = kmalloc(len + 1, GFP_NOFS); 1334 if (!context) 1335 return -ENOMEM; 1336 1337 context[len] = '\0'; 1338 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len); 1339 if (rc == -ERANGE) { 1340 kfree(context); 1341 1342 /* Need a larger buffer. Query for the right size. */ 1343 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0); 1344 if (rc < 0) 1345 return rc; 1346 1347 len = rc; 1348 context = kmalloc(len + 1, GFP_NOFS); 1349 if (!context) 1350 return -ENOMEM; 1351 1352 context[len] = '\0'; 1353 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, 1354 context, len); 1355 } 1356 if (rc < 0) { 1357 kfree(context); 1358 if (rc != -ENODATA) { 1359 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n", 1360 __func__, -rc, inode->i_sb->s_id, inode->i_ino); 1361 return rc; 1362 } 1363 *sid = def_sid; 1364 return 0; 1365 } 1366 1367 rc = security_context_to_sid_default(&selinux_state, context, rc, sid, 1368 def_sid, GFP_NOFS); 1369 if (rc) { 1370 char *dev = inode->i_sb->s_id; 1371 unsigned long ino = inode->i_ino; 1372 1373 if (rc == -EINVAL) { 1374 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n", 1375 ino, dev, context); 1376 } else { 1377 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n", 1378 __func__, context, -rc, dev, ino); 1379 } 1380 } 1381 kfree(context); 1382 return 0; 1383 } 1384 1385 /* The inode's security attributes must be initialized before first use. */ 1386 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry) 1387 { 1388 struct superblock_security_struct *sbsec = NULL; 1389 struct inode_security_struct *isec = selinux_inode(inode); 1390 u32 task_sid, sid = 0; 1391 u16 sclass; 1392 struct dentry *dentry; 1393 int rc = 0; 1394 1395 if (isec->initialized == LABEL_INITIALIZED) 1396 return 0; 1397 1398 spin_lock(&isec->lock); 1399 if (isec->initialized == LABEL_INITIALIZED) 1400 goto out_unlock; 1401 1402 if (isec->sclass == SECCLASS_FILE) 1403 isec->sclass = inode_mode_to_security_class(inode->i_mode); 1404 1405 sbsec = selinux_superblock(inode->i_sb); 1406 if (!(sbsec->flags & SE_SBINITIALIZED)) { 1407 /* Defer initialization until selinux_complete_init, 1408 after the initial policy is loaded and the security 1409 server is ready to handle calls. */ 1410 spin_lock(&sbsec->isec_lock); 1411 if (list_empty(&isec->list)) 1412 list_add(&isec->list, &sbsec->isec_head); 1413 spin_unlock(&sbsec->isec_lock); 1414 goto out_unlock; 1415 } 1416 1417 sclass = isec->sclass; 1418 task_sid = isec->task_sid; 1419 sid = isec->sid; 1420 isec->initialized = LABEL_PENDING; 1421 spin_unlock(&isec->lock); 1422 1423 switch (sbsec->behavior) { 1424 case SECURITY_FS_USE_NATIVE: 1425 break; 1426 case SECURITY_FS_USE_XATTR: 1427 if (!(inode->i_opflags & IOP_XATTR)) { 1428 sid = sbsec->def_sid; 1429 break; 1430 } 1431 /* Need a dentry, since the xattr API requires one. 1432 Life would be simpler if we could just pass the inode. */ 1433 if (opt_dentry) { 1434 /* Called from d_instantiate or d_splice_alias. */ 1435 dentry = dget(opt_dentry); 1436 } else { 1437 /* 1438 * Called from selinux_complete_init, try to find a dentry. 1439 * Some filesystems really want a connected one, so try 1440 * that first. We could split SECURITY_FS_USE_XATTR in 1441 * two, depending upon that... 1442 */ 1443 dentry = d_find_alias(inode); 1444 if (!dentry) 1445 dentry = d_find_any_alias(inode); 1446 } 1447 if (!dentry) { 1448 /* 1449 * this is can be hit on boot when a file is accessed 1450 * before the policy is loaded. When we load policy we 1451 * may find inodes that have no dentry on the 1452 * sbsec->isec_head list. No reason to complain as these 1453 * will get fixed up the next time we go through 1454 * inode_doinit with a dentry, before these inodes could 1455 * be used again by userspace. 1456 */ 1457 goto out_invalid; 1458 } 1459 1460 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid, 1461 &sid); 1462 dput(dentry); 1463 if (rc) 1464 goto out; 1465 break; 1466 case SECURITY_FS_USE_TASK: 1467 sid = task_sid; 1468 break; 1469 case SECURITY_FS_USE_TRANS: 1470 /* Default to the fs SID. */ 1471 sid = sbsec->sid; 1472 1473 /* Try to obtain a transition SID. */ 1474 rc = security_transition_sid(&selinux_state, task_sid, sid, 1475 sclass, NULL, &sid); 1476 if (rc) 1477 goto out; 1478 break; 1479 case SECURITY_FS_USE_MNTPOINT: 1480 sid = sbsec->mntpoint_sid; 1481 break; 1482 default: 1483 /* Default to the fs superblock SID. */ 1484 sid = sbsec->sid; 1485 1486 if ((sbsec->flags & SE_SBGENFS) && 1487 (!S_ISLNK(inode->i_mode) || 1488 selinux_policycap_genfs_seclabel_symlinks())) { 1489 /* We must have a dentry to determine the label on 1490 * procfs inodes */ 1491 if (opt_dentry) { 1492 /* Called from d_instantiate or 1493 * d_splice_alias. */ 1494 dentry = dget(opt_dentry); 1495 } else { 1496 /* Called from selinux_complete_init, try to 1497 * find a dentry. Some filesystems really want 1498 * a connected one, so try that first. 1499 */ 1500 dentry = d_find_alias(inode); 1501 if (!dentry) 1502 dentry = d_find_any_alias(inode); 1503 } 1504 /* 1505 * This can be hit on boot when a file is accessed 1506 * before the policy is loaded. When we load policy we 1507 * may find inodes that have no dentry on the 1508 * sbsec->isec_head list. No reason to complain as 1509 * these will get fixed up the next time we go through 1510 * inode_doinit() with a dentry, before these inodes 1511 * could be used again by userspace. 1512 */ 1513 if (!dentry) 1514 goto out_invalid; 1515 rc = selinux_genfs_get_sid(dentry, sclass, 1516 sbsec->flags, &sid); 1517 if (rc) { 1518 dput(dentry); 1519 goto out; 1520 } 1521 1522 if ((sbsec->flags & SE_SBGENFS_XATTR) && 1523 (inode->i_opflags & IOP_XATTR)) { 1524 rc = inode_doinit_use_xattr(inode, dentry, 1525 sid, &sid); 1526 if (rc) { 1527 dput(dentry); 1528 goto out; 1529 } 1530 } 1531 dput(dentry); 1532 } 1533 break; 1534 } 1535 1536 out: 1537 spin_lock(&isec->lock); 1538 if (isec->initialized == LABEL_PENDING) { 1539 if (rc) { 1540 isec->initialized = LABEL_INVALID; 1541 goto out_unlock; 1542 } 1543 isec->initialized = LABEL_INITIALIZED; 1544 isec->sid = sid; 1545 } 1546 1547 out_unlock: 1548 spin_unlock(&isec->lock); 1549 return rc; 1550 1551 out_invalid: 1552 spin_lock(&isec->lock); 1553 if (isec->initialized == LABEL_PENDING) { 1554 isec->initialized = LABEL_INVALID; 1555 isec->sid = sid; 1556 } 1557 spin_unlock(&isec->lock); 1558 return 0; 1559 } 1560 1561 /* Convert a Linux signal to an access vector. */ 1562 static inline u32 signal_to_av(int sig) 1563 { 1564 u32 perm = 0; 1565 1566 switch (sig) { 1567 case SIGCHLD: 1568 /* Commonly granted from child to parent. */ 1569 perm = PROCESS__SIGCHLD; 1570 break; 1571 case SIGKILL: 1572 /* Cannot be caught or ignored */ 1573 perm = PROCESS__SIGKILL; 1574 break; 1575 case SIGSTOP: 1576 /* Cannot be caught or ignored */ 1577 perm = PROCESS__SIGSTOP; 1578 break; 1579 default: 1580 /* All other signals. */ 1581 perm = PROCESS__SIGNAL; 1582 break; 1583 } 1584 1585 return perm; 1586 } 1587 1588 #if CAP_LAST_CAP > 63 1589 #error Fix SELinux to handle capabilities > 63. 1590 #endif 1591 1592 /* Check whether a task is allowed to use a capability. */ 1593 static int cred_has_capability(const struct cred *cred, 1594 int cap, unsigned int opts, bool initns) 1595 { 1596 struct common_audit_data ad; 1597 struct av_decision avd; 1598 u16 sclass; 1599 u32 sid = cred_sid(cred); 1600 u32 av = CAP_TO_MASK(cap); 1601 int rc; 1602 1603 ad.type = LSM_AUDIT_DATA_CAP; 1604 ad.u.cap = cap; 1605 1606 switch (CAP_TO_INDEX(cap)) { 1607 case 0: 1608 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS; 1609 break; 1610 case 1: 1611 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS; 1612 break; 1613 default: 1614 pr_err("SELinux: out of range capability %d\n", cap); 1615 BUG(); 1616 return -EINVAL; 1617 } 1618 1619 rc = avc_has_perm_noaudit(&selinux_state, 1620 sid, sid, sclass, av, 0, &avd); 1621 if (!(opts & CAP_OPT_NOAUDIT)) { 1622 int rc2 = avc_audit(&selinux_state, 1623 sid, sid, sclass, av, &avd, rc, &ad); 1624 if (rc2) 1625 return rc2; 1626 } 1627 return rc; 1628 } 1629 1630 /* Check whether a task has a particular permission to an inode. 1631 The 'adp' parameter is optional and allows other audit 1632 data to be passed (e.g. the dentry). */ 1633 static int inode_has_perm(const struct cred *cred, 1634 struct inode *inode, 1635 u32 perms, 1636 struct common_audit_data *adp) 1637 { 1638 struct inode_security_struct *isec; 1639 u32 sid; 1640 1641 validate_creds(cred); 1642 1643 if (unlikely(IS_PRIVATE(inode))) 1644 return 0; 1645 1646 sid = cred_sid(cred); 1647 isec = selinux_inode(inode); 1648 1649 return avc_has_perm(&selinux_state, 1650 sid, isec->sid, isec->sclass, perms, adp); 1651 } 1652 1653 /* Same as inode_has_perm, but pass explicit audit data containing 1654 the dentry to help the auditing code to more easily generate the 1655 pathname if needed. */ 1656 static inline int dentry_has_perm(const struct cred *cred, 1657 struct dentry *dentry, 1658 u32 av) 1659 { 1660 struct inode *inode = d_backing_inode(dentry); 1661 struct common_audit_data ad; 1662 1663 ad.type = LSM_AUDIT_DATA_DENTRY; 1664 ad.u.dentry = dentry; 1665 __inode_security_revalidate(inode, dentry, true); 1666 return inode_has_perm(cred, inode, av, &ad); 1667 } 1668 1669 /* Same as inode_has_perm, but pass explicit audit data containing 1670 the path to help the auditing code to more easily generate the 1671 pathname if needed. */ 1672 static inline int path_has_perm(const struct cred *cred, 1673 const struct path *path, 1674 u32 av) 1675 { 1676 struct inode *inode = d_backing_inode(path->dentry); 1677 struct common_audit_data ad; 1678 1679 ad.type = LSM_AUDIT_DATA_PATH; 1680 ad.u.path = *path; 1681 __inode_security_revalidate(inode, path->dentry, true); 1682 return inode_has_perm(cred, inode, av, &ad); 1683 } 1684 1685 /* Same as path_has_perm, but uses the inode from the file struct. */ 1686 static inline int file_path_has_perm(const struct cred *cred, 1687 struct file *file, 1688 u32 av) 1689 { 1690 struct common_audit_data ad; 1691 1692 ad.type = LSM_AUDIT_DATA_FILE; 1693 ad.u.file = file; 1694 return inode_has_perm(cred, file_inode(file), av, &ad); 1695 } 1696 1697 #ifdef CONFIG_BPF_SYSCALL 1698 static int bpf_fd_pass(struct file *file, u32 sid); 1699 #endif 1700 1701 /* Check whether a task can use an open file descriptor to 1702 access an inode in a given way. Check access to the 1703 descriptor itself, and then use dentry_has_perm to 1704 check a particular permission to the file. 1705 Access to the descriptor is implicitly granted if it 1706 has the same SID as the process. If av is zero, then 1707 access to the file is not checked, e.g. for cases 1708 where only the descriptor is affected like seek. */ 1709 static int file_has_perm(const struct cred *cred, 1710 struct file *file, 1711 u32 av) 1712 { 1713 struct file_security_struct *fsec = selinux_file(file); 1714 struct inode *inode = file_inode(file); 1715 struct common_audit_data ad; 1716 u32 sid = cred_sid(cred); 1717 int rc; 1718 1719 ad.type = LSM_AUDIT_DATA_FILE; 1720 ad.u.file = file; 1721 1722 if (sid != fsec->sid) { 1723 rc = avc_has_perm(&selinux_state, 1724 sid, fsec->sid, 1725 SECCLASS_FD, 1726 FD__USE, 1727 &ad); 1728 if (rc) 1729 goto out; 1730 } 1731 1732 #ifdef CONFIG_BPF_SYSCALL 1733 rc = bpf_fd_pass(file, cred_sid(cred)); 1734 if (rc) 1735 return rc; 1736 #endif 1737 1738 /* av is zero if only checking access to the descriptor. */ 1739 rc = 0; 1740 if (av) 1741 rc = inode_has_perm(cred, inode, av, &ad); 1742 1743 out: 1744 return rc; 1745 } 1746 1747 /* 1748 * Determine the label for an inode that might be unioned. 1749 */ 1750 static int 1751 selinux_determine_inode_label(const struct task_security_struct *tsec, 1752 struct inode *dir, 1753 const struct qstr *name, u16 tclass, 1754 u32 *_new_isid) 1755 { 1756 const struct superblock_security_struct *sbsec = 1757 selinux_superblock(dir->i_sb); 1758 1759 if ((sbsec->flags & SE_SBINITIALIZED) && 1760 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) { 1761 *_new_isid = sbsec->mntpoint_sid; 1762 } else if ((sbsec->flags & SBLABEL_MNT) && 1763 tsec->create_sid) { 1764 *_new_isid = tsec->create_sid; 1765 } else { 1766 const struct inode_security_struct *dsec = inode_security(dir); 1767 return security_transition_sid(&selinux_state, tsec->sid, 1768 dsec->sid, tclass, 1769 name, _new_isid); 1770 } 1771 1772 return 0; 1773 } 1774 1775 /* Check whether a task can create a file. */ 1776 static int may_create(struct inode *dir, 1777 struct dentry *dentry, 1778 u16 tclass) 1779 { 1780 const struct task_security_struct *tsec = selinux_cred(current_cred()); 1781 struct inode_security_struct *dsec; 1782 struct superblock_security_struct *sbsec; 1783 u32 sid, newsid; 1784 struct common_audit_data ad; 1785 int rc; 1786 1787 dsec = inode_security(dir); 1788 sbsec = selinux_superblock(dir->i_sb); 1789 1790 sid = tsec->sid; 1791 1792 ad.type = LSM_AUDIT_DATA_DENTRY; 1793 ad.u.dentry = dentry; 1794 1795 rc = avc_has_perm(&selinux_state, 1796 sid, dsec->sid, SECCLASS_DIR, 1797 DIR__ADD_NAME | DIR__SEARCH, 1798 &ad); 1799 if (rc) 1800 return rc; 1801 1802 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass, 1803 &newsid); 1804 if (rc) 1805 return rc; 1806 1807 rc = avc_has_perm(&selinux_state, 1808 sid, newsid, tclass, FILE__CREATE, &ad); 1809 if (rc) 1810 return rc; 1811 1812 return avc_has_perm(&selinux_state, 1813 newsid, sbsec->sid, 1814 SECCLASS_FILESYSTEM, 1815 FILESYSTEM__ASSOCIATE, &ad); 1816 } 1817 1818 #define MAY_LINK 0 1819 #define MAY_UNLINK 1 1820 #define MAY_RMDIR 2 1821 1822 /* Check whether a task can link, unlink, or rmdir a file/directory. */ 1823 static int may_link(struct inode *dir, 1824 struct dentry *dentry, 1825 int kind) 1826 1827 { 1828 struct inode_security_struct *dsec, *isec; 1829 struct common_audit_data ad; 1830 u32 sid = current_sid(); 1831 u32 av; 1832 int rc; 1833 1834 dsec = inode_security(dir); 1835 isec = backing_inode_security(dentry); 1836 1837 ad.type = LSM_AUDIT_DATA_DENTRY; 1838 ad.u.dentry = dentry; 1839 1840 av = DIR__SEARCH; 1841 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME); 1842 rc = avc_has_perm(&selinux_state, 1843 sid, dsec->sid, SECCLASS_DIR, av, &ad); 1844 if (rc) 1845 return rc; 1846 1847 switch (kind) { 1848 case MAY_LINK: 1849 av = FILE__LINK; 1850 break; 1851 case MAY_UNLINK: 1852 av = FILE__UNLINK; 1853 break; 1854 case MAY_RMDIR: 1855 av = DIR__RMDIR; 1856 break; 1857 default: 1858 pr_warn("SELinux: %s: unrecognized kind %d\n", 1859 __func__, kind); 1860 return 0; 1861 } 1862 1863 rc = avc_has_perm(&selinux_state, 1864 sid, isec->sid, isec->sclass, av, &ad); 1865 return rc; 1866 } 1867 1868 static inline int may_rename(struct inode *old_dir, 1869 struct dentry *old_dentry, 1870 struct inode *new_dir, 1871 struct dentry *new_dentry) 1872 { 1873 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec; 1874 struct common_audit_data ad; 1875 u32 sid = current_sid(); 1876 u32 av; 1877 int old_is_dir, new_is_dir; 1878 int rc; 1879 1880 old_dsec = inode_security(old_dir); 1881 old_isec = backing_inode_security(old_dentry); 1882 old_is_dir = d_is_dir(old_dentry); 1883 new_dsec = inode_security(new_dir); 1884 1885 ad.type = LSM_AUDIT_DATA_DENTRY; 1886 1887 ad.u.dentry = old_dentry; 1888 rc = avc_has_perm(&selinux_state, 1889 sid, old_dsec->sid, SECCLASS_DIR, 1890 DIR__REMOVE_NAME | DIR__SEARCH, &ad); 1891 if (rc) 1892 return rc; 1893 rc = avc_has_perm(&selinux_state, 1894 sid, old_isec->sid, 1895 old_isec->sclass, FILE__RENAME, &ad); 1896 if (rc) 1897 return rc; 1898 if (old_is_dir && new_dir != old_dir) { 1899 rc = avc_has_perm(&selinux_state, 1900 sid, old_isec->sid, 1901 old_isec->sclass, DIR__REPARENT, &ad); 1902 if (rc) 1903 return rc; 1904 } 1905 1906 ad.u.dentry = new_dentry; 1907 av = DIR__ADD_NAME | DIR__SEARCH; 1908 if (d_is_positive(new_dentry)) 1909 av |= DIR__REMOVE_NAME; 1910 rc = avc_has_perm(&selinux_state, 1911 sid, new_dsec->sid, SECCLASS_DIR, av, &ad); 1912 if (rc) 1913 return rc; 1914 if (d_is_positive(new_dentry)) { 1915 new_isec = backing_inode_security(new_dentry); 1916 new_is_dir = d_is_dir(new_dentry); 1917 rc = avc_has_perm(&selinux_state, 1918 sid, new_isec->sid, 1919 new_isec->sclass, 1920 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad); 1921 if (rc) 1922 return rc; 1923 } 1924 1925 return 0; 1926 } 1927 1928 /* Check whether a task can perform a filesystem operation. */ 1929 static int superblock_has_perm(const struct cred *cred, 1930 struct super_block *sb, 1931 u32 perms, 1932 struct common_audit_data *ad) 1933 { 1934 struct superblock_security_struct *sbsec; 1935 u32 sid = cred_sid(cred); 1936 1937 sbsec = selinux_superblock(sb); 1938 return avc_has_perm(&selinux_state, 1939 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad); 1940 } 1941 1942 /* Convert a Linux mode and permission mask to an access vector. */ 1943 static inline u32 file_mask_to_av(int mode, int mask) 1944 { 1945 u32 av = 0; 1946 1947 if (!S_ISDIR(mode)) { 1948 if (mask & MAY_EXEC) 1949 av |= FILE__EXECUTE; 1950 if (mask & MAY_READ) 1951 av |= FILE__READ; 1952 1953 if (mask & MAY_APPEND) 1954 av |= FILE__APPEND; 1955 else if (mask & MAY_WRITE) 1956 av |= FILE__WRITE; 1957 1958 } else { 1959 if (mask & MAY_EXEC) 1960 av |= DIR__SEARCH; 1961 if (mask & MAY_WRITE) 1962 av |= DIR__WRITE; 1963 if (mask & MAY_READ) 1964 av |= DIR__READ; 1965 } 1966 1967 return av; 1968 } 1969 1970 /* Convert a Linux file to an access vector. */ 1971 static inline u32 file_to_av(struct file *file) 1972 { 1973 u32 av = 0; 1974 1975 if (file->f_mode & FMODE_READ) 1976 av |= FILE__READ; 1977 if (file->f_mode & FMODE_WRITE) { 1978 if (file->f_flags & O_APPEND) 1979 av |= FILE__APPEND; 1980 else 1981 av |= FILE__WRITE; 1982 } 1983 if (!av) { 1984 /* 1985 * Special file opened with flags 3 for ioctl-only use. 1986 */ 1987 av = FILE__IOCTL; 1988 } 1989 1990 return av; 1991 } 1992 1993 /* 1994 * Convert a file to an access vector and include the correct 1995 * open permission. 1996 */ 1997 static inline u32 open_file_to_av(struct file *file) 1998 { 1999 u32 av = file_to_av(file); 2000 struct inode *inode = file_inode(file); 2001 2002 if (selinux_policycap_openperm() && 2003 inode->i_sb->s_magic != SOCKFS_MAGIC) 2004 av |= FILE__OPEN; 2005 2006 return av; 2007 } 2008 2009 /* Hook functions begin here. */ 2010 2011 static int selinux_binder_set_context_mgr(const struct cred *mgr) 2012 { 2013 return avc_has_perm(&selinux_state, 2014 current_sid(), cred_sid(mgr), SECCLASS_BINDER, 2015 BINDER__SET_CONTEXT_MGR, NULL); 2016 } 2017 2018 static int selinux_binder_transaction(const struct cred *from, 2019 const struct cred *to) 2020 { 2021 u32 mysid = current_sid(); 2022 u32 fromsid = cred_sid(from); 2023 u32 tosid = cred_sid(to); 2024 int rc; 2025 2026 if (mysid != fromsid) { 2027 rc = avc_has_perm(&selinux_state, 2028 mysid, fromsid, SECCLASS_BINDER, 2029 BINDER__IMPERSONATE, NULL); 2030 if (rc) 2031 return rc; 2032 } 2033 2034 return avc_has_perm(&selinux_state, fromsid, tosid, 2035 SECCLASS_BINDER, BINDER__CALL, NULL); 2036 } 2037 2038 static int selinux_binder_transfer_binder(const struct cred *from, 2039 const struct cred *to) 2040 { 2041 return avc_has_perm(&selinux_state, 2042 cred_sid(from), cred_sid(to), 2043 SECCLASS_BINDER, BINDER__TRANSFER, 2044 NULL); 2045 } 2046 2047 static int selinux_binder_transfer_file(const struct cred *from, 2048 const struct cred *to, 2049 struct file *file) 2050 { 2051 u32 sid = cred_sid(to); 2052 struct file_security_struct *fsec = selinux_file(file); 2053 struct dentry *dentry = file->f_path.dentry; 2054 struct inode_security_struct *isec; 2055 struct common_audit_data ad; 2056 int rc; 2057 2058 ad.type = LSM_AUDIT_DATA_PATH; 2059 ad.u.path = file->f_path; 2060 2061 if (sid != fsec->sid) { 2062 rc = avc_has_perm(&selinux_state, 2063 sid, fsec->sid, 2064 SECCLASS_FD, 2065 FD__USE, 2066 &ad); 2067 if (rc) 2068 return rc; 2069 } 2070 2071 #ifdef CONFIG_BPF_SYSCALL 2072 rc = bpf_fd_pass(file, sid); 2073 if (rc) 2074 return rc; 2075 #endif 2076 2077 if (unlikely(IS_PRIVATE(d_backing_inode(dentry)))) 2078 return 0; 2079 2080 isec = backing_inode_security(dentry); 2081 return avc_has_perm(&selinux_state, 2082 sid, isec->sid, isec->sclass, file_to_av(file), 2083 &ad); 2084 } 2085 2086 static int selinux_ptrace_access_check(struct task_struct *child, 2087 unsigned int mode) 2088 { 2089 u32 sid = current_sid(); 2090 u32 csid = task_sid_obj(child); 2091 2092 if (mode & PTRACE_MODE_READ) 2093 return avc_has_perm(&selinux_state, 2094 sid, csid, SECCLASS_FILE, FILE__READ, NULL); 2095 2096 return avc_has_perm(&selinux_state, 2097 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL); 2098 } 2099 2100 static int selinux_ptrace_traceme(struct task_struct *parent) 2101 { 2102 return avc_has_perm(&selinux_state, 2103 task_sid_obj(parent), task_sid_obj(current), 2104 SECCLASS_PROCESS, PROCESS__PTRACE, NULL); 2105 } 2106 2107 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective, 2108 kernel_cap_t *inheritable, kernel_cap_t *permitted) 2109 { 2110 return avc_has_perm(&selinux_state, 2111 current_sid(), task_sid_obj(target), SECCLASS_PROCESS, 2112 PROCESS__GETCAP, NULL); 2113 } 2114 2115 static int selinux_capset(struct cred *new, const struct cred *old, 2116 const kernel_cap_t *effective, 2117 const kernel_cap_t *inheritable, 2118 const kernel_cap_t *permitted) 2119 { 2120 return avc_has_perm(&selinux_state, 2121 cred_sid(old), cred_sid(new), SECCLASS_PROCESS, 2122 PROCESS__SETCAP, NULL); 2123 } 2124 2125 /* 2126 * (This comment used to live with the selinux_task_setuid hook, 2127 * which was removed). 2128 * 2129 * Since setuid only affects the current process, and since the SELinux 2130 * controls are not based on the Linux identity attributes, SELinux does not 2131 * need to control this operation. However, SELinux does control the use of 2132 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook. 2133 */ 2134 2135 static int selinux_capable(const struct cred *cred, struct user_namespace *ns, 2136 int cap, unsigned int opts) 2137 { 2138 return cred_has_capability(cred, cap, opts, ns == &init_user_ns); 2139 } 2140 2141 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb) 2142 { 2143 const struct cred *cred = current_cred(); 2144 int rc = 0; 2145 2146 if (!sb) 2147 return 0; 2148 2149 switch (cmds) { 2150 case Q_SYNC: 2151 case Q_QUOTAON: 2152 case Q_QUOTAOFF: 2153 case Q_SETINFO: 2154 case Q_SETQUOTA: 2155 case Q_XQUOTAOFF: 2156 case Q_XQUOTAON: 2157 case Q_XSETQLIM: 2158 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL); 2159 break; 2160 case Q_GETFMT: 2161 case Q_GETINFO: 2162 case Q_GETQUOTA: 2163 case Q_XGETQUOTA: 2164 case Q_XGETQSTAT: 2165 case Q_XGETQSTATV: 2166 case Q_XGETNEXTQUOTA: 2167 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL); 2168 break; 2169 default: 2170 rc = 0; /* let the kernel handle invalid cmds */ 2171 break; 2172 } 2173 return rc; 2174 } 2175 2176 static int selinux_quota_on(struct dentry *dentry) 2177 { 2178 const struct cred *cred = current_cred(); 2179 2180 return dentry_has_perm(cred, dentry, FILE__QUOTAON); 2181 } 2182 2183 static int selinux_syslog(int type) 2184 { 2185 switch (type) { 2186 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */ 2187 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */ 2188 return avc_has_perm(&selinux_state, 2189 current_sid(), SECINITSID_KERNEL, 2190 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL); 2191 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */ 2192 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */ 2193 /* Set level of messages printed to console */ 2194 case SYSLOG_ACTION_CONSOLE_LEVEL: 2195 return avc_has_perm(&selinux_state, 2196 current_sid(), SECINITSID_KERNEL, 2197 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE, 2198 NULL); 2199 } 2200 /* All other syslog types */ 2201 return avc_has_perm(&selinux_state, 2202 current_sid(), SECINITSID_KERNEL, 2203 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL); 2204 } 2205 2206 /* 2207 * Check that a process has enough memory to allocate a new virtual 2208 * mapping. 0 means there is enough memory for the allocation to 2209 * succeed and -ENOMEM implies there is not. 2210 * 2211 * Do not audit the selinux permission check, as this is applied to all 2212 * processes that allocate mappings. 2213 */ 2214 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages) 2215 { 2216 int rc, cap_sys_admin = 0; 2217 2218 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN, 2219 CAP_OPT_NOAUDIT, true); 2220 if (rc == 0) 2221 cap_sys_admin = 1; 2222 2223 return cap_sys_admin; 2224 } 2225 2226 /* binprm security operations */ 2227 2228 static u32 ptrace_parent_sid(void) 2229 { 2230 u32 sid = 0; 2231 struct task_struct *tracer; 2232 2233 rcu_read_lock(); 2234 tracer = ptrace_parent(current); 2235 if (tracer) 2236 sid = task_sid_obj(tracer); 2237 rcu_read_unlock(); 2238 2239 return sid; 2240 } 2241 2242 static int check_nnp_nosuid(const struct linux_binprm *bprm, 2243 const struct task_security_struct *old_tsec, 2244 const struct task_security_struct *new_tsec) 2245 { 2246 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS); 2247 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt); 2248 int rc; 2249 u32 av; 2250 2251 if (!nnp && !nosuid) 2252 return 0; /* neither NNP nor nosuid */ 2253 2254 if (new_tsec->sid == old_tsec->sid) 2255 return 0; /* No change in credentials */ 2256 2257 /* 2258 * If the policy enables the nnp_nosuid_transition policy capability, 2259 * then we permit transitions under NNP or nosuid if the 2260 * policy allows the corresponding permission between 2261 * the old and new contexts. 2262 */ 2263 if (selinux_policycap_nnp_nosuid_transition()) { 2264 av = 0; 2265 if (nnp) 2266 av |= PROCESS2__NNP_TRANSITION; 2267 if (nosuid) 2268 av |= PROCESS2__NOSUID_TRANSITION; 2269 rc = avc_has_perm(&selinux_state, 2270 old_tsec->sid, new_tsec->sid, 2271 SECCLASS_PROCESS2, av, NULL); 2272 if (!rc) 2273 return 0; 2274 } 2275 2276 /* 2277 * We also permit NNP or nosuid transitions to bounded SIDs, 2278 * i.e. SIDs that are guaranteed to only be allowed a subset 2279 * of the permissions of the current SID. 2280 */ 2281 rc = security_bounded_transition(&selinux_state, old_tsec->sid, 2282 new_tsec->sid); 2283 if (!rc) 2284 return 0; 2285 2286 /* 2287 * On failure, preserve the errno values for NNP vs nosuid. 2288 * NNP: Operation not permitted for caller. 2289 * nosuid: Permission denied to file. 2290 */ 2291 if (nnp) 2292 return -EPERM; 2293 return -EACCES; 2294 } 2295 2296 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm) 2297 { 2298 const struct task_security_struct *old_tsec; 2299 struct task_security_struct *new_tsec; 2300 struct inode_security_struct *isec; 2301 struct common_audit_data ad; 2302 struct inode *inode = file_inode(bprm->file); 2303 int rc; 2304 2305 /* SELinux context only depends on initial program or script and not 2306 * the script interpreter */ 2307 2308 old_tsec = selinux_cred(current_cred()); 2309 new_tsec = selinux_cred(bprm->cred); 2310 isec = inode_security(inode); 2311 2312 /* Default to the current task SID. */ 2313 new_tsec->sid = old_tsec->sid; 2314 new_tsec->osid = old_tsec->sid; 2315 2316 /* Reset fs, key, and sock SIDs on execve. */ 2317 new_tsec->create_sid = 0; 2318 new_tsec->keycreate_sid = 0; 2319 new_tsec->sockcreate_sid = 0; 2320 2321 if (old_tsec->exec_sid) { 2322 new_tsec->sid = old_tsec->exec_sid; 2323 /* Reset exec SID on execve. */ 2324 new_tsec->exec_sid = 0; 2325 2326 /* Fail on NNP or nosuid if not an allowed transition. */ 2327 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2328 if (rc) 2329 return rc; 2330 } else { 2331 /* Check for a default transition on this program. */ 2332 rc = security_transition_sid(&selinux_state, old_tsec->sid, 2333 isec->sid, SECCLASS_PROCESS, NULL, 2334 &new_tsec->sid); 2335 if (rc) 2336 return rc; 2337 2338 /* 2339 * Fallback to old SID on NNP or nosuid if not an allowed 2340 * transition. 2341 */ 2342 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec); 2343 if (rc) 2344 new_tsec->sid = old_tsec->sid; 2345 } 2346 2347 ad.type = LSM_AUDIT_DATA_FILE; 2348 ad.u.file = bprm->file; 2349 2350 if (new_tsec->sid == old_tsec->sid) { 2351 rc = avc_has_perm(&selinux_state, 2352 old_tsec->sid, isec->sid, 2353 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad); 2354 if (rc) 2355 return rc; 2356 } else { 2357 /* Check permissions for the transition. */ 2358 rc = avc_has_perm(&selinux_state, 2359 old_tsec->sid, new_tsec->sid, 2360 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad); 2361 if (rc) 2362 return rc; 2363 2364 rc = avc_has_perm(&selinux_state, 2365 new_tsec->sid, isec->sid, 2366 SECCLASS_FILE, FILE__ENTRYPOINT, &ad); 2367 if (rc) 2368 return rc; 2369 2370 /* Check for shared state */ 2371 if (bprm->unsafe & LSM_UNSAFE_SHARE) { 2372 rc = avc_has_perm(&selinux_state, 2373 old_tsec->sid, new_tsec->sid, 2374 SECCLASS_PROCESS, PROCESS__SHARE, 2375 NULL); 2376 if (rc) 2377 return -EPERM; 2378 } 2379 2380 /* Make sure that anyone attempting to ptrace over a task that 2381 * changes its SID has the appropriate permit */ 2382 if (bprm->unsafe & LSM_UNSAFE_PTRACE) { 2383 u32 ptsid = ptrace_parent_sid(); 2384 if (ptsid != 0) { 2385 rc = avc_has_perm(&selinux_state, 2386 ptsid, new_tsec->sid, 2387 SECCLASS_PROCESS, 2388 PROCESS__PTRACE, NULL); 2389 if (rc) 2390 return -EPERM; 2391 } 2392 } 2393 2394 /* Clear any possibly unsafe personality bits on exec: */ 2395 bprm->per_clear |= PER_CLEAR_ON_SETID; 2396 2397 /* Enable secure mode for SIDs transitions unless 2398 the noatsecure permission is granted between 2399 the two SIDs, i.e. ahp returns 0. */ 2400 rc = avc_has_perm(&selinux_state, 2401 old_tsec->sid, new_tsec->sid, 2402 SECCLASS_PROCESS, PROCESS__NOATSECURE, 2403 NULL); 2404 bprm->secureexec |= !!rc; 2405 } 2406 2407 return 0; 2408 } 2409 2410 static int match_file(const void *p, struct file *file, unsigned fd) 2411 { 2412 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0; 2413 } 2414 2415 /* Derived from fs/exec.c:flush_old_files. */ 2416 static inline void flush_unauthorized_files(const struct cred *cred, 2417 struct files_struct *files) 2418 { 2419 struct file *file, *devnull = NULL; 2420 struct tty_struct *tty; 2421 int drop_tty = 0; 2422 unsigned n; 2423 2424 tty = get_current_tty(); 2425 if (tty) { 2426 spin_lock(&tty->files_lock); 2427 if (!list_empty(&tty->tty_files)) { 2428 struct tty_file_private *file_priv; 2429 2430 /* Revalidate access to controlling tty. 2431 Use file_path_has_perm on the tty path directly 2432 rather than using file_has_perm, as this particular 2433 open file may belong to another process and we are 2434 only interested in the inode-based check here. */ 2435 file_priv = list_first_entry(&tty->tty_files, 2436 struct tty_file_private, list); 2437 file = file_priv->file; 2438 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE)) 2439 drop_tty = 1; 2440 } 2441 spin_unlock(&tty->files_lock); 2442 tty_kref_put(tty); 2443 } 2444 /* Reset controlling tty. */ 2445 if (drop_tty) 2446 no_tty(); 2447 2448 /* Revalidate access to inherited open files. */ 2449 n = iterate_fd(files, 0, match_file, cred); 2450 if (!n) /* none found? */ 2451 return; 2452 2453 devnull = dentry_open(&selinux_null, O_RDWR, cred); 2454 if (IS_ERR(devnull)) 2455 devnull = NULL; 2456 /* replace all the matching ones with this */ 2457 do { 2458 replace_fd(n - 1, devnull, 0); 2459 } while ((n = iterate_fd(files, n, match_file, cred)) != 0); 2460 if (devnull) 2461 fput(devnull); 2462 } 2463 2464 /* 2465 * Prepare a process for imminent new credential changes due to exec 2466 */ 2467 static void selinux_bprm_committing_creds(struct linux_binprm *bprm) 2468 { 2469 struct task_security_struct *new_tsec; 2470 struct rlimit *rlim, *initrlim; 2471 int rc, i; 2472 2473 new_tsec = selinux_cred(bprm->cred); 2474 if (new_tsec->sid == new_tsec->osid) 2475 return; 2476 2477 /* Close files for which the new task SID is not authorized. */ 2478 flush_unauthorized_files(bprm->cred, current->files); 2479 2480 /* Always clear parent death signal on SID transitions. */ 2481 current->pdeath_signal = 0; 2482 2483 /* Check whether the new SID can inherit resource limits from the old 2484 * SID. If not, reset all soft limits to the lower of the current 2485 * task's hard limit and the init task's soft limit. 2486 * 2487 * Note that the setting of hard limits (even to lower them) can be 2488 * controlled by the setrlimit check. The inclusion of the init task's 2489 * soft limit into the computation is to avoid resetting soft limits 2490 * higher than the default soft limit for cases where the default is 2491 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK. 2492 */ 2493 rc = avc_has_perm(&selinux_state, 2494 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS, 2495 PROCESS__RLIMITINH, NULL); 2496 if (rc) { 2497 /* protect against do_prlimit() */ 2498 task_lock(current); 2499 for (i = 0; i < RLIM_NLIMITS; i++) { 2500 rlim = current->signal->rlim + i; 2501 initrlim = init_task.signal->rlim + i; 2502 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur); 2503 } 2504 task_unlock(current); 2505 if (IS_ENABLED(CONFIG_POSIX_TIMERS)) 2506 update_rlimit_cpu(current, rlimit(RLIMIT_CPU)); 2507 } 2508 } 2509 2510 /* 2511 * Clean up the process immediately after the installation of new credentials 2512 * due to exec 2513 */ 2514 static void selinux_bprm_committed_creds(struct linux_binprm *bprm) 2515 { 2516 const struct task_security_struct *tsec = selinux_cred(current_cred()); 2517 u32 osid, sid; 2518 int rc; 2519 2520 osid = tsec->osid; 2521 sid = tsec->sid; 2522 2523 if (sid == osid) 2524 return; 2525 2526 /* Check whether the new SID can inherit signal state from the old SID. 2527 * If not, clear itimers to avoid subsequent signal generation and 2528 * flush and unblock signals. 2529 * 2530 * This must occur _after_ the task SID has been updated so that any 2531 * kill done after the flush will be checked against the new SID. 2532 */ 2533 rc = avc_has_perm(&selinux_state, 2534 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL); 2535 if (rc) { 2536 clear_itimer(); 2537 2538 spin_lock_irq(¤t->sighand->siglock); 2539 if (!fatal_signal_pending(current)) { 2540 flush_sigqueue(¤t->pending); 2541 flush_sigqueue(¤t->signal->shared_pending); 2542 flush_signal_handlers(current, 1); 2543 sigemptyset(¤t->blocked); 2544 recalc_sigpending(); 2545 } 2546 spin_unlock_irq(¤t->sighand->siglock); 2547 } 2548 2549 /* Wake up the parent if it is waiting so that it can recheck 2550 * wait permission to the new task SID. */ 2551 read_lock(&tasklist_lock); 2552 __wake_up_parent(current, current->real_parent); 2553 read_unlock(&tasklist_lock); 2554 } 2555 2556 /* superblock security operations */ 2557 2558 static int selinux_sb_alloc_security(struct super_block *sb) 2559 { 2560 struct superblock_security_struct *sbsec = selinux_superblock(sb); 2561 2562 mutex_init(&sbsec->lock); 2563 INIT_LIST_HEAD(&sbsec->isec_head); 2564 spin_lock_init(&sbsec->isec_lock); 2565 sbsec->sid = SECINITSID_UNLABELED; 2566 sbsec->def_sid = SECINITSID_FILE; 2567 sbsec->mntpoint_sid = SECINITSID_UNLABELED; 2568 2569 return 0; 2570 } 2571 2572 static inline int opt_len(const char *s) 2573 { 2574 bool open_quote = false; 2575 int len; 2576 char c; 2577 2578 for (len = 0; (c = s[len]) != '\0'; len++) { 2579 if (c == '"') 2580 open_quote = !open_quote; 2581 if (c == ',' && !open_quote) 2582 break; 2583 } 2584 return len; 2585 } 2586 2587 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts) 2588 { 2589 char *from = options; 2590 char *to = options; 2591 bool first = true; 2592 int rc; 2593 2594 while (1) { 2595 int len = opt_len(from); 2596 int token; 2597 char *arg = NULL; 2598 2599 token = match_opt_prefix(from, len, &arg); 2600 2601 if (token != Opt_error) { 2602 char *p, *q; 2603 2604 /* strip quotes */ 2605 if (arg) { 2606 for (p = q = arg; p < from + len; p++) { 2607 char c = *p; 2608 if (c != '"') 2609 *q++ = c; 2610 } 2611 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL); 2612 if (!arg) { 2613 rc = -ENOMEM; 2614 goto free_opt; 2615 } 2616 } 2617 rc = selinux_add_opt(token, arg, mnt_opts); 2618 if (unlikely(rc)) { 2619 kfree(arg); 2620 goto free_opt; 2621 } 2622 } else { 2623 if (!first) { // copy with preceding comma 2624 from--; 2625 len++; 2626 } 2627 if (to != from) 2628 memmove(to, from, len); 2629 to += len; 2630 first = false; 2631 } 2632 if (!from[len]) 2633 break; 2634 from += len + 1; 2635 } 2636 *to = '\0'; 2637 return 0; 2638 2639 free_opt: 2640 if (*mnt_opts) { 2641 selinux_free_mnt_opts(*mnt_opts); 2642 *mnt_opts = NULL; 2643 } 2644 return rc; 2645 } 2646 2647 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts) 2648 { 2649 struct selinux_mnt_opts *opts = mnt_opts; 2650 struct superblock_security_struct *sbsec = sb->s_security; 2651 u32 sid; 2652 int rc; 2653 2654 /* 2655 * Superblock not initialized (i.e. no options) - reject if any 2656 * options specified, otherwise accept. 2657 */ 2658 if (!(sbsec->flags & SE_SBINITIALIZED)) 2659 return opts ? 1 : 0; 2660 2661 /* 2662 * Superblock initialized and no options specified - reject if 2663 * superblock has any options set, otherwise accept. 2664 */ 2665 if (!opts) 2666 return (sbsec->flags & SE_MNTMASK) ? 1 : 0; 2667 2668 if (opts->fscontext) { 2669 rc = parse_sid(sb, opts->fscontext, &sid, GFP_NOWAIT); 2670 if (rc) 2671 return 1; 2672 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) 2673 return 1; 2674 } 2675 if (opts->context) { 2676 rc = parse_sid(sb, opts->context, &sid, GFP_NOWAIT); 2677 if (rc) 2678 return 1; 2679 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) 2680 return 1; 2681 } 2682 if (opts->rootcontext) { 2683 struct inode_security_struct *root_isec; 2684 2685 root_isec = backing_inode_security(sb->s_root); 2686 rc = parse_sid(sb, opts->rootcontext, &sid, GFP_NOWAIT); 2687 if (rc) 2688 return 1; 2689 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid)) 2690 return 1; 2691 } 2692 if (opts->defcontext) { 2693 rc = parse_sid(sb, opts->defcontext, &sid, GFP_NOWAIT); 2694 if (rc) 2695 return 1; 2696 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) 2697 return 1; 2698 } 2699 return 0; 2700 } 2701 2702 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts) 2703 { 2704 struct selinux_mnt_opts *opts = mnt_opts; 2705 struct superblock_security_struct *sbsec = selinux_superblock(sb); 2706 u32 sid; 2707 int rc; 2708 2709 if (!(sbsec->flags & SE_SBINITIALIZED)) 2710 return 0; 2711 2712 if (!opts) 2713 return 0; 2714 2715 if (opts->fscontext) { 2716 rc = parse_sid(sb, opts->fscontext, &sid, GFP_KERNEL); 2717 if (rc) 2718 return rc; 2719 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid)) 2720 goto out_bad_option; 2721 } 2722 if (opts->context) { 2723 rc = parse_sid(sb, opts->context, &sid, GFP_KERNEL); 2724 if (rc) 2725 return rc; 2726 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid)) 2727 goto out_bad_option; 2728 } 2729 if (opts->rootcontext) { 2730 struct inode_security_struct *root_isec; 2731 root_isec = backing_inode_security(sb->s_root); 2732 rc = parse_sid(sb, opts->rootcontext, &sid, GFP_KERNEL); 2733 if (rc) 2734 return rc; 2735 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid)) 2736 goto out_bad_option; 2737 } 2738 if (opts->defcontext) { 2739 rc = parse_sid(sb, opts->defcontext, &sid, GFP_KERNEL); 2740 if (rc) 2741 return rc; 2742 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid)) 2743 goto out_bad_option; 2744 } 2745 return 0; 2746 2747 out_bad_option: 2748 pr_warn("SELinux: unable to change security options " 2749 "during remount (dev %s, type=%s)\n", sb->s_id, 2750 sb->s_type->name); 2751 return -EINVAL; 2752 } 2753 2754 static int selinux_sb_kern_mount(struct super_block *sb) 2755 { 2756 const struct cred *cred = current_cred(); 2757 struct common_audit_data ad; 2758 2759 ad.type = LSM_AUDIT_DATA_DENTRY; 2760 ad.u.dentry = sb->s_root; 2761 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad); 2762 } 2763 2764 static int selinux_sb_statfs(struct dentry *dentry) 2765 { 2766 const struct cred *cred = current_cred(); 2767 struct common_audit_data ad; 2768 2769 ad.type = LSM_AUDIT_DATA_DENTRY; 2770 ad.u.dentry = dentry->d_sb->s_root; 2771 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad); 2772 } 2773 2774 static int selinux_mount(const char *dev_name, 2775 const struct path *path, 2776 const char *type, 2777 unsigned long flags, 2778 void *data) 2779 { 2780 const struct cred *cred = current_cred(); 2781 2782 if (flags & MS_REMOUNT) 2783 return superblock_has_perm(cred, path->dentry->d_sb, 2784 FILESYSTEM__REMOUNT, NULL); 2785 else 2786 return path_has_perm(cred, path, FILE__MOUNTON); 2787 } 2788 2789 static int selinux_move_mount(const struct path *from_path, 2790 const struct path *to_path) 2791 { 2792 const struct cred *cred = current_cred(); 2793 2794 return path_has_perm(cred, to_path, FILE__MOUNTON); 2795 } 2796 2797 static int selinux_umount(struct vfsmount *mnt, int flags) 2798 { 2799 const struct cred *cred = current_cred(); 2800 2801 return superblock_has_perm(cred, mnt->mnt_sb, 2802 FILESYSTEM__UNMOUNT, NULL); 2803 } 2804 2805 static int selinux_fs_context_dup(struct fs_context *fc, 2806 struct fs_context *src_fc) 2807 { 2808 const struct selinux_mnt_opts *src = src_fc->security; 2809 struct selinux_mnt_opts *opts; 2810 2811 if (!src) 2812 return 0; 2813 2814 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL); 2815 if (!fc->security) 2816 return -ENOMEM; 2817 2818 opts = fc->security; 2819 2820 if (src->fscontext) { 2821 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL); 2822 if (!opts->fscontext) 2823 return -ENOMEM; 2824 } 2825 if (src->context) { 2826 opts->context = kstrdup(src->context, GFP_KERNEL); 2827 if (!opts->context) 2828 return -ENOMEM; 2829 } 2830 if (src->rootcontext) { 2831 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL); 2832 if (!opts->rootcontext) 2833 return -ENOMEM; 2834 } 2835 if (src->defcontext) { 2836 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL); 2837 if (!opts->defcontext) 2838 return -ENOMEM; 2839 } 2840 return 0; 2841 } 2842 2843 static const struct fs_parameter_spec selinux_fs_parameters[] = { 2844 fsparam_string(CONTEXT_STR, Opt_context), 2845 fsparam_string(DEFCONTEXT_STR, Opt_defcontext), 2846 fsparam_string(FSCONTEXT_STR, Opt_fscontext), 2847 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext), 2848 fsparam_flag (SECLABEL_STR, Opt_seclabel), 2849 {} 2850 }; 2851 2852 static int selinux_fs_context_parse_param(struct fs_context *fc, 2853 struct fs_parameter *param) 2854 { 2855 struct fs_parse_result result; 2856 int opt, rc; 2857 2858 opt = fs_parse(fc, selinux_fs_parameters, param, &result); 2859 if (opt < 0) 2860 return opt; 2861 2862 rc = selinux_add_opt(opt, param->string, &fc->security); 2863 if (!rc) { 2864 param->string = NULL; 2865 rc = 1; 2866 } 2867 return rc; 2868 } 2869 2870 /* inode security operations */ 2871 2872 static int selinux_inode_alloc_security(struct inode *inode) 2873 { 2874 struct inode_security_struct *isec = selinux_inode(inode); 2875 u32 sid = current_sid(); 2876 2877 spin_lock_init(&isec->lock); 2878 INIT_LIST_HEAD(&isec->list); 2879 isec->inode = inode; 2880 isec->sid = SECINITSID_UNLABELED; 2881 isec->sclass = SECCLASS_FILE; 2882 isec->task_sid = sid; 2883 isec->initialized = LABEL_INVALID; 2884 2885 return 0; 2886 } 2887 2888 static void selinux_inode_free_security(struct inode *inode) 2889 { 2890 inode_free_security(inode); 2891 } 2892 2893 static int selinux_dentry_init_security(struct dentry *dentry, int mode, 2894 const struct qstr *name, 2895 const char **xattr_name, void **ctx, 2896 u32 *ctxlen) 2897 { 2898 u32 newsid; 2899 int rc; 2900 2901 rc = selinux_determine_inode_label(selinux_cred(current_cred()), 2902 d_inode(dentry->d_parent), name, 2903 inode_mode_to_security_class(mode), 2904 &newsid); 2905 if (rc) 2906 return rc; 2907 2908 if (xattr_name) 2909 *xattr_name = XATTR_NAME_SELINUX; 2910 2911 return security_sid_to_context(&selinux_state, newsid, (char **)ctx, 2912 ctxlen); 2913 } 2914 2915 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode, 2916 struct qstr *name, 2917 const struct cred *old, 2918 struct cred *new) 2919 { 2920 u32 newsid; 2921 int rc; 2922 struct task_security_struct *tsec; 2923 2924 rc = selinux_determine_inode_label(selinux_cred(old), 2925 d_inode(dentry->d_parent), name, 2926 inode_mode_to_security_class(mode), 2927 &newsid); 2928 if (rc) 2929 return rc; 2930 2931 tsec = selinux_cred(new); 2932 tsec->create_sid = newsid; 2933 return 0; 2934 } 2935 2936 static int selinux_inode_init_security(struct inode *inode, struct inode *dir, 2937 const struct qstr *qstr, 2938 const char **name, 2939 void **value, size_t *len) 2940 { 2941 const struct task_security_struct *tsec = selinux_cred(current_cred()); 2942 struct superblock_security_struct *sbsec; 2943 u32 newsid, clen; 2944 int rc; 2945 char *context; 2946 2947 sbsec = selinux_superblock(dir->i_sb); 2948 2949 newsid = tsec->create_sid; 2950 2951 rc = selinux_determine_inode_label(tsec, dir, qstr, 2952 inode_mode_to_security_class(inode->i_mode), 2953 &newsid); 2954 if (rc) 2955 return rc; 2956 2957 /* Possibly defer initialization to selinux_complete_init. */ 2958 if (sbsec->flags & SE_SBINITIALIZED) { 2959 struct inode_security_struct *isec = selinux_inode(inode); 2960 isec->sclass = inode_mode_to_security_class(inode->i_mode); 2961 isec->sid = newsid; 2962 isec->initialized = LABEL_INITIALIZED; 2963 } 2964 2965 if (!selinux_initialized(&selinux_state) || 2966 !(sbsec->flags & SBLABEL_MNT)) 2967 return -EOPNOTSUPP; 2968 2969 if (name) 2970 *name = XATTR_SELINUX_SUFFIX; 2971 2972 if (value && len) { 2973 rc = security_sid_to_context_force(&selinux_state, newsid, 2974 &context, &clen); 2975 if (rc) 2976 return rc; 2977 *value = context; 2978 *len = clen; 2979 } 2980 2981 return 0; 2982 } 2983 2984 static int selinux_inode_init_security_anon(struct inode *inode, 2985 const struct qstr *name, 2986 const struct inode *context_inode) 2987 { 2988 const struct task_security_struct *tsec = selinux_cred(current_cred()); 2989 struct common_audit_data ad; 2990 struct inode_security_struct *isec; 2991 int rc; 2992 2993 if (unlikely(!selinux_initialized(&selinux_state))) 2994 return 0; 2995 2996 isec = selinux_inode(inode); 2997 2998 /* 2999 * We only get here once per ephemeral inode. The inode has 3000 * been initialized via inode_alloc_security but is otherwise 3001 * untouched. 3002 */ 3003 3004 if (context_inode) { 3005 struct inode_security_struct *context_isec = 3006 selinux_inode(context_inode); 3007 if (context_isec->initialized != LABEL_INITIALIZED) { 3008 pr_err("SELinux: context_inode is not initialized"); 3009 return -EACCES; 3010 } 3011 3012 isec->sclass = context_isec->sclass; 3013 isec->sid = context_isec->sid; 3014 } else { 3015 isec->sclass = SECCLASS_ANON_INODE; 3016 rc = security_transition_sid( 3017 &selinux_state, tsec->sid, tsec->sid, 3018 isec->sclass, name, &isec->sid); 3019 if (rc) 3020 return rc; 3021 } 3022 3023 isec->initialized = LABEL_INITIALIZED; 3024 /* 3025 * Now that we've initialized security, check whether we're 3026 * allowed to actually create this type of anonymous inode. 3027 */ 3028 3029 ad.type = LSM_AUDIT_DATA_INODE; 3030 ad.u.inode = inode; 3031 3032 return avc_has_perm(&selinux_state, 3033 tsec->sid, 3034 isec->sid, 3035 isec->sclass, 3036 FILE__CREATE, 3037 &ad); 3038 } 3039 3040 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode) 3041 { 3042 return may_create(dir, dentry, SECCLASS_FILE); 3043 } 3044 3045 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry) 3046 { 3047 return may_link(dir, old_dentry, MAY_LINK); 3048 } 3049 3050 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry) 3051 { 3052 return may_link(dir, dentry, MAY_UNLINK); 3053 } 3054 3055 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name) 3056 { 3057 return may_create(dir, dentry, SECCLASS_LNK_FILE); 3058 } 3059 3060 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask) 3061 { 3062 return may_create(dir, dentry, SECCLASS_DIR); 3063 } 3064 3065 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry) 3066 { 3067 return may_link(dir, dentry, MAY_RMDIR); 3068 } 3069 3070 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev) 3071 { 3072 return may_create(dir, dentry, inode_mode_to_security_class(mode)); 3073 } 3074 3075 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry, 3076 struct inode *new_inode, struct dentry *new_dentry) 3077 { 3078 return may_rename(old_inode, old_dentry, new_inode, new_dentry); 3079 } 3080 3081 static int selinux_inode_readlink(struct dentry *dentry) 3082 { 3083 const struct cred *cred = current_cred(); 3084 3085 return dentry_has_perm(cred, dentry, FILE__READ); 3086 } 3087 3088 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode, 3089 bool rcu) 3090 { 3091 const struct cred *cred = current_cred(); 3092 struct common_audit_data ad; 3093 struct inode_security_struct *isec; 3094 u32 sid; 3095 3096 validate_creds(cred); 3097 3098 ad.type = LSM_AUDIT_DATA_DENTRY; 3099 ad.u.dentry = dentry; 3100 sid = cred_sid(cred); 3101 isec = inode_security_rcu(inode, rcu); 3102 if (IS_ERR(isec)) 3103 return PTR_ERR(isec); 3104 3105 return avc_has_perm(&selinux_state, 3106 sid, isec->sid, isec->sclass, FILE__READ, &ad); 3107 } 3108 3109 static noinline int audit_inode_permission(struct inode *inode, 3110 u32 perms, u32 audited, u32 denied, 3111 int result) 3112 { 3113 struct common_audit_data ad; 3114 struct inode_security_struct *isec = selinux_inode(inode); 3115 3116 ad.type = LSM_AUDIT_DATA_INODE; 3117 ad.u.inode = inode; 3118 3119 return slow_avc_audit(&selinux_state, 3120 current_sid(), isec->sid, isec->sclass, perms, 3121 audited, denied, result, &ad); 3122 } 3123 3124 static int selinux_inode_permission(struct inode *inode, int mask) 3125 { 3126 const struct cred *cred = current_cred(); 3127 u32 perms; 3128 bool from_access; 3129 bool no_block = mask & MAY_NOT_BLOCK; 3130 struct inode_security_struct *isec; 3131 u32 sid; 3132 struct av_decision avd; 3133 int rc, rc2; 3134 u32 audited, denied; 3135 3136 from_access = mask & MAY_ACCESS; 3137 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND); 3138 3139 /* No permission to check. Existence test. */ 3140 if (!mask) 3141 return 0; 3142 3143 validate_creds(cred); 3144 3145 if (unlikely(IS_PRIVATE(inode))) 3146 return 0; 3147 3148 perms = file_mask_to_av(inode->i_mode, mask); 3149 3150 sid = cred_sid(cred); 3151 isec = inode_security_rcu(inode, no_block); 3152 if (IS_ERR(isec)) 3153 return PTR_ERR(isec); 3154 3155 rc = avc_has_perm_noaudit(&selinux_state, 3156 sid, isec->sid, isec->sclass, perms, 0, 3157 &avd); 3158 audited = avc_audit_required(perms, &avd, rc, 3159 from_access ? FILE__AUDIT_ACCESS : 0, 3160 &denied); 3161 if (likely(!audited)) 3162 return rc; 3163 3164 rc2 = audit_inode_permission(inode, perms, audited, denied, rc); 3165 if (rc2) 3166 return rc2; 3167 return rc; 3168 } 3169 3170 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr) 3171 { 3172 const struct cred *cred = current_cred(); 3173 struct inode *inode = d_backing_inode(dentry); 3174 unsigned int ia_valid = iattr->ia_valid; 3175 __u32 av = FILE__WRITE; 3176 3177 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */ 3178 if (ia_valid & ATTR_FORCE) { 3179 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE | 3180 ATTR_FORCE); 3181 if (!ia_valid) 3182 return 0; 3183 } 3184 3185 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID | 3186 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET)) 3187 return dentry_has_perm(cred, dentry, FILE__SETATTR); 3188 3189 if (selinux_policycap_openperm() && 3190 inode->i_sb->s_magic != SOCKFS_MAGIC && 3191 (ia_valid & ATTR_SIZE) && 3192 !(ia_valid & ATTR_FILE)) 3193 av |= FILE__OPEN; 3194 3195 return dentry_has_perm(cred, dentry, av); 3196 } 3197 3198 static int selinux_inode_getattr(const struct path *path) 3199 { 3200 return path_has_perm(current_cred(), path, FILE__GETATTR); 3201 } 3202 3203 static bool has_cap_mac_admin(bool audit) 3204 { 3205 const struct cred *cred = current_cred(); 3206 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT; 3207 3208 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts)) 3209 return false; 3210 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true)) 3211 return false; 3212 return true; 3213 } 3214 3215 static int selinux_inode_setxattr(struct user_namespace *mnt_userns, 3216 struct dentry *dentry, const char *name, 3217 const void *value, size_t size, int flags) 3218 { 3219 struct inode *inode = d_backing_inode(dentry); 3220 struct inode_security_struct *isec; 3221 struct superblock_security_struct *sbsec; 3222 struct common_audit_data ad; 3223 u32 newsid, sid = current_sid(); 3224 int rc = 0; 3225 3226 if (strcmp(name, XATTR_NAME_SELINUX)) { 3227 rc = cap_inode_setxattr(dentry, name, value, size, flags); 3228 if (rc) 3229 return rc; 3230 3231 /* Not an attribute we recognize, so just check the 3232 ordinary setattr permission. */ 3233 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); 3234 } 3235 3236 if (!selinux_initialized(&selinux_state)) 3237 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM); 3238 3239 sbsec = selinux_superblock(inode->i_sb); 3240 if (!(sbsec->flags & SBLABEL_MNT)) 3241 return -EOPNOTSUPP; 3242 3243 if (!inode_owner_or_capable(mnt_userns, inode)) 3244 return -EPERM; 3245 3246 ad.type = LSM_AUDIT_DATA_DENTRY; 3247 ad.u.dentry = dentry; 3248 3249 isec = backing_inode_security(dentry); 3250 rc = avc_has_perm(&selinux_state, 3251 sid, isec->sid, isec->sclass, 3252 FILE__RELABELFROM, &ad); 3253 if (rc) 3254 return rc; 3255 3256 rc = security_context_to_sid(&selinux_state, value, size, &newsid, 3257 GFP_KERNEL); 3258 if (rc == -EINVAL) { 3259 if (!has_cap_mac_admin(true)) { 3260 struct audit_buffer *ab; 3261 size_t audit_size; 3262 3263 /* We strip a nul only if it is at the end, otherwise the 3264 * context contains a nul and we should audit that */ 3265 if (value) { 3266 const char *str = value; 3267 3268 if (str[size - 1] == '\0') 3269 audit_size = size - 1; 3270 else 3271 audit_size = size; 3272 } else { 3273 audit_size = 0; 3274 } 3275 ab = audit_log_start(audit_context(), 3276 GFP_ATOMIC, AUDIT_SELINUX_ERR); 3277 if (!ab) 3278 return rc; 3279 audit_log_format(ab, "op=setxattr invalid_context="); 3280 audit_log_n_untrustedstring(ab, value, audit_size); 3281 audit_log_end(ab); 3282 3283 return rc; 3284 } 3285 rc = security_context_to_sid_force(&selinux_state, value, 3286 size, &newsid); 3287 } 3288 if (rc) 3289 return rc; 3290 3291 rc = avc_has_perm(&selinux_state, 3292 sid, newsid, isec->sclass, 3293 FILE__RELABELTO, &ad); 3294 if (rc) 3295 return rc; 3296 3297 rc = security_validate_transition(&selinux_state, isec->sid, newsid, 3298 sid, isec->sclass); 3299 if (rc) 3300 return rc; 3301 3302 return avc_has_perm(&selinux_state, 3303 newsid, 3304 sbsec->sid, 3305 SECCLASS_FILESYSTEM, 3306 FILESYSTEM__ASSOCIATE, 3307 &ad); 3308 } 3309 3310 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name, 3311 const void *value, size_t size, 3312 int flags) 3313 { 3314 struct inode *inode = d_backing_inode(dentry); 3315 struct inode_security_struct *isec; 3316 u32 newsid; 3317 int rc; 3318 3319 if (strcmp(name, XATTR_NAME_SELINUX)) { 3320 /* Not an attribute we recognize, so nothing to do. */ 3321 return; 3322 } 3323 3324 if (!selinux_initialized(&selinux_state)) { 3325 /* If we haven't even been initialized, then we can't validate 3326 * against a policy, so leave the label as invalid. It may 3327 * resolve to a valid label on the next revalidation try if 3328 * we've since initialized. 3329 */ 3330 return; 3331 } 3332 3333 rc = security_context_to_sid_force(&selinux_state, value, size, 3334 &newsid); 3335 if (rc) { 3336 pr_err("SELinux: unable to map context to SID" 3337 "for (%s, %lu), rc=%d\n", 3338 inode->i_sb->s_id, inode->i_ino, -rc); 3339 return; 3340 } 3341 3342 isec = backing_inode_security(dentry); 3343 spin_lock(&isec->lock); 3344 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3345 isec->sid = newsid; 3346 isec->initialized = LABEL_INITIALIZED; 3347 spin_unlock(&isec->lock); 3348 3349 return; 3350 } 3351 3352 static int selinux_inode_getxattr(struct dentry *dentry, const char *name) 3353 { 3354 const struct cred *cred = current_cred(); 3355 3356 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3357 } 3358 3359 static int selinux_inode_listxattr(struct dentry *dentry) 3360 { 3361 const struct cred *cred = current_cred(); 3362 3363 return dentry_has_perm(cred, dentry, FILE__GETATTR); 3364 } 3365 3366 static int selinux_inode_removexattr(struct user_namespace *mnt_userns, 3367 struct dentry *dentry, const char *name) 3368 { 3369 if (strcmp(name, XATTR_NAME_SELINUX)) { 3370 int rc = cap_inode_removexattr(mnt_userns, dentry, name); 3371 if (rc) 3372 return rc; 3373 3374 /* Not an attribute we recognize, so just check the 3375 ordinary setattr permission. */ 3376 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR); 3377 } 3378 3379 if (!selinux_initialized(&selinux_state)) 3380 return 0; 3381 3382 /* No one is allowed to remove a SELinux security label. 3383 You can change the label, but all data must be labeled. */ 3384 return -EACCES; 3385 } 3386 3387 static int selinux_path_notify(const struct path *path, u64 mask, 3388 unsigned int obj_type) 3389 { 3390 int ret; 3391 u32 perm; 3392 3393 struct common_audit_data ad; 3394 3395 ad.type = LSM_AUDIT_DATA_PATH; 3396 ad.u.path = *path; 3397 3398 /* 3399 * Set permission needed based on the type of mark being set. 3400 * Performs an additional check for sb watches. 3401 */ 3402 switch (obj_type) { 3403 case FSNOTIFY_OBJ_TYPE_VFSMOUNT: 3404 perm = FILE__WATCH_MOUNT; 3405 break; 3406 case FSNOTIFY_OBJ_TYPE_SB: 3407 perm = FILE__WATCH_SB; 3408 ret = superblock_has_perm(current_cred(), path->dentry->d_sb, 3409 FILESYSTEM__WATCH, &ad); 3410 if (ret) 3411 return ret; 3412 break; 3413 case FSNOTIFY_OBJ_TYPE_INODE: 3414 perm = FILE__WATCH; 3415 break; 3416 default: 3417 return -EINVAL; 3418 } 3419 3420 /* blocking watches require the file:watch_with_perm permission */ 3421 if (mask & (ALL_FSNOTIFY_PERM_EVENTS)) 3422 perm |= FILE__WATCH_WITH_PERM; 3423 3424 /* watches on read-like events need the file:watch_reads permission */ 3425 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE)) 3426 perm |= FILE__WATCH_READS; 3427 3428 return path_has_perm(current_cred(), path, perm); 3429 } 3430 3431 /* 3432 * Copy the inode security context value to the user. 3433 * 3434 * Permission check is handled by selinux_inode_getxattr hook. 3435 */ 3436 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns, 3437 struct inode *inode, const char *name, 3438 void **buffer, bool alloc) 3439 { 3440 u32 size; 3441 int error; 3442 char *context = NULL; 3443 struct inode_security_struct *isec; 3444 3445 /* 3446 * If we're not initialized yet, then we can't validate contexts, so 3447 * just let vfs_getxattr fall back to using the on-disk xattr. 3448 */ 3449 if (!selinux_initialized(&selinux_state) || 3450 strcmp(name, XATTR_SELINUX_SUFFIX)) 3451 return -EOPNOTSUPP; 3452 3453 /* 3454 * If the caller has CAP_MAC_ADMIN, then get the raw context 3455 * value even if it is not defined by current policy; otherwise, 3456 * use the in-core value under current policy. 3457 * Use the non-auditing forms of the permission checks since 3458 * getxattr may be called by unprivileged processes commonly 3459 * and lack of permission just means that we fall back to the 3460 * in-core context value, not a denial. 3461 */ 3462 isec = inode_security(inode); 3463 if (has_cap_mac_admin(false)) 3464 error = security_sid_to_context_force(&selinux_state, 3465 isec->sid, &context, 3466 &size); 3467 else 3468 error = security_sid_to_context(&selinux_state, isec->sid, 3469 &context, &size); 3470 if (error) 3471 return error; 3472 error = size; 3473 if (alloc) { 3474 *buffer = context; 3475 goto out_nofree; 3476 } 3477 kfree(context); 3478 out_nofree: 3479 return error; 3480 } 3481 3482 static int selinux_inode_setsecurity(struct inode *inode, const char *name, 3483 const void *value, size_t size, int flags) 3484 { 3485 struct inode_security_struct *isec = inode_security_novalidate(inode); 3486 struct superblock_security_struct *sbsec; 3487 u32 newsid; 3488 int rc; 3489 3490 if (strcmp(name, XATTR_SELINUX_SUFFIX)) 3491 return -EOPNOTSUPP; 3492 3493 sbsec = selinux_superblock(inode->i_sb); 3494 if (!(sbsec->flags & SBLABEL_MNT)) 3495 return -EOPNOTSUPP; 3496 3497 if (!value || !size) 3498 return -EACCES; 3499 3500 rc = security_context_to_sid(&selinux_state, value, size, &newsid, 3501 GFP_KERNEL); 3502 if (rc) 3503 return rc; 3504 3505 spin_lock(&isec->lock); 3506 isec->sclass = inode_mode_to_security_class(inode->i_mode); 3507 isec->sid = newsid; 3508 isec->initialized = LABEL_INITIALIZED; 3509 spin_unlock(&isec->lock); 3510 return 0; 3511 } 3512 3513 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size) 3514 { 3515 const int len = sizeof(XATTR_NAME_SELINUX); 3516 3517 if (!selinux_initialized(&selinux_state)) 3518 return 0; 3519 3520 if (buffer && len <= buffer_size) 3521 memcpy(buffer, XATTR_NAME_SELINUX, len); 3522 return len; 3523 } 3524 3525 static void selinux_inode_getsecid(struct inode *inode, u32 *secid) 3526 { 3527 struct inode_security_struct *isec = inode_security_novalidate(inode); 3528 *secid = isec->sid; 3529 } 3530 3531 static int selinux_inode_copy_up(struct dentry *src, struct cred **new) 3532 { 3533 u32 sid; 3534 struct task_security_struct *tsec; 3535 struct cred *new_creds = *new; 3536 3537 if (new_creds == NULL) { 3538 new_creds = prepare_creds(); 3539 if (!new_creds) 3540 return -ENOMEM; 3541 } 3542 3543 tsec = selinux_cred(new_creds); 3544 /* Get label from overlay inode and set it in create_sid */ 3545 selinux_inode_getsecid(d_inode(src), &sid); 3546 tsec->create_sid = sid; 3547 *new = new_creds; 3548 return 0; 3549 } 3550 3551 static int selinux_inode_copy_up_xattr(const char *name) 3552 { 3553 /* The copy_up hook above sets the initial context on an inode, but we 3554 * don't then want to overwrite it by blindly copying all the lower 3555 * xattrs up. Instead, we have to filter out SELinux-related xattrs. 3556 */ 3557 if (strcmp(name, XATTR_NAME_SELINUX) == 0) 3558 return 1; /* Discard */ 3559 /* 3560 * Any other attribute apart from SELINUX is not claimed, supported 3561 * by selinux. 3562 */ 3563 return -EOPNOTSUPP; 3564 } 3565 3566 /* kernfs node operations */ 3567 3568 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir, 3569 struct kernfs_node *kn) 3570 { 3571 const struct task_security_struct *tsec = selinux_cred(current_cred()); 3572 u32 parent_sid, newsid, clen; 3573 int rc; 3574 char *context; 3575 3576 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0); 3577 if (rc == -ENODATA) 3578 return 0; 3579 else if (rc < 0) 3580 return rc; 3581 3582 clen = (u32)rc; 3583 context = kmalloc(clen, GFP_KERNEL); 3584 if (!context) 3585 return -ENOMEM; 3586 3587 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen); 3588 if (rc < 0) { 3589 kfree(context); 3590 return rc; 3591 } 3592 3593 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid, 3594 GFP_KERNEL); 3595 kfree(context); 3596 if (rc) 3597 return rc; 3598 3599 if (tsec->create_sid) { 3600 newsid = tsec->create_sid; 3601 } else { 3602 u16 secclass = inode_mode_to_security_class(kn->mode); 3603 struct qstr q; 3604 3605 q.name = kn->name; 3606 q.hash_len = hashlen_string(kn_dir, kn->name); 3607 3608 rc = security_transition_sid(&selinux_state, tsec->sid, 3609 parent_sid, secclass, &q, 3610 &newsid); 3611 if (rc) 3612 return rc; 3613 } 3614 3615 rc = security_sid_to_context_force(&selinux_state, newsid, 3616 &context, &clen); 3617 if (rc) 3618 return rc; 3619 3620 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen, 3621 XATTR_CREATE); 3622 kfree(context); 3623 return rc; 3624 } 3625 3626 3627 /* file security operations */ 3628 3629 static int selinux_revalidate_file_permission(struct file *file, int mask) 3630 { 3631 const struct cred *cred = current_cred(); 3632 struct inode *inode = file_inode(file); 3633 3634 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */ 3635 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE)) 3636 mask |= MAY_APPEND; 3637 3638 return file_has_perm(cred, file, 3639 file_mask_to_av(inode->i_mode, mask)); 3640 } 3641 3642 static int selinux_file_permission(struct file *file, int mask) 3643 { 3644 struct inode *inode = file_inode(file); 3645 struct file_security_struct *fsec = selinux_file(file); 3646 struct inode_security_struct *isec; 3647 u32 sid = current_sid(); 3648 3649 if (!mask) 3650 /* No permission to check. Existence test. */ 3651 return 0; 3652 3653 isec = inode_security(inode); 3654 if (sid == fsec->sid && fsec->isid == isec->sid && 3655 fsec->pseqno == avc_policy_seqno(&selinux_state)) 3656 /* No change since file_open check. */ 3657 return 0; 3658 3659 return selinux_revalidate_file_permission(file, mask); 3660 } 3661 3662 static int selinux_file_alloc_security(struct file *file) 3663 { 3664 struct file_security_struct *fsec = selinux_file(file); 3665 u32 sid = current_sid(); 3666 3667 fsec->sid = sid; 3668 fsec->fown_sid = sid; 3669 3670 return 0; 3671 } 3672 3673 /* 3674 * Check whether a task has the ioctl permission and cmd 3675 * operation to an inode. 3676 */ 3677 static int ioctl_has_perm(const struct cred *cred, struct file *file, 3678 u32 requested, u16 cmd) 3679 { 3680 struct common_audit_data ad; 3681 struct file_security_struct *fsec = selinux_file(file); 3682 struct inode *inode = file_inode(file); 3683 struct inode_security_struct *isec; 3684 struct lsm_ioctlop_audit ioctl; 3685 u32 ssid = cred_sid(cred); 3686 int rc; 3687 u8 driver = cmd >> 8; 3688 u8 xperm = cmd & 0xff; 3689 3690 ad.type = LSM_AUDIT_DATA_IOCTL_OP; 3691 ad.u.op = &ioctl; 3692 ad.u.op->cmd = cmd; 3693 ad.u.op->path = file->f_path; 3694 3695 if (ssid != fsec->sid) { 3696 rc = avc_has_perm(&selinux_state, 3697 ssid, fsec->sid, 3698 SECCLASS_FD, 3699 FD__USE, 3700 &ad); 3701 if (rc) 3702 goto out; 3703 } 3704 3705 if (unlikely(IS_PRIVATE(inode))) 3706 return 0; 3707 3708 isec = inode_security(inode); 3709 rc = avc_has_extended_perms(&selinux_state, 3710 ssid, isec->sid, isec->sclass, 3711 requested, driver, xperm, &ad); 3712 out: 3713 return rc; 3714 } 3715 3716 static int selinux_file_ioctl(struct file *file, unsigned int cmd, 3717 unsigned long arg) 3718 { 3719 const struct cred *cred = current_cred(); 3720 int error = 0; 3721 3722 switch (cmd) { 3723 case FIONREAD: 3724 case FIBMAP: 3725 case FIGETBSZ: 3726 case FS_IOC_GETFLAGS: 3727 case FS_IOC_GETVERSION: 3728 error = file_has_perm(cred, file, FILE__GETATTR); 3729 break; 3730 3731 case FS_IOC_SETFLAGS: 3732 case FS_IOC_SETVERSION: 3733 error = file_has_perm(cred, file, FILE__SETATTR); 3734 break; 3735 3736 /* sys_ioctl() checks */ 3737 case FIONBIO: 3738 case FIOASYNC: 3739 error = file_has_perm(cred, file, 0); 3740 break; 3741 3742 case KDSKBENT: 3743 case KDSKBSENT: 3744 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG, 3745 CAP_OPT_NONE, true); 3746 break; 3747 3748 /* default case assumes that the command will go 3749 * to the file's ioctl() function. 3750 */ 3751 default: 3752 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd); 3753 } 3754 return error; 3755 } 3756 3757 static int default_noexec __ro_after_init; 3758 3759 static int file_map_prot_check(struct file *file, unsigned long prot, int shared) 3760 { 3761 const struct cred *cred = current_cred(); 3762 u32 sid = cred_sid(cred); 3763 int rc = 0; 3764 3765 if (default_noexec && 3766 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) || 3767 (!shared && (prot & PROT_WRITE)))) { 3768 /* 3769 * We are making executable an anonymous mapping or a 3770 * private file mapping that will also be writable. 3771 * This has an additional check. 3772 */ 3773 rc = avc_has_perm(&selinux_state, 3774 sid, sid, SECCLASS_PROCESS, 3775 PROCESS__EXECMEM, NULL); 3776 if (rc) 3777 goto error; 3778 } 3779 3780 if (file) { 3781 /* read access is always possible with a mapping */ 3782 u32 av = FILE__READ; 3783 3784 /* write access only matters if the mapping is shared */ 3785 if (shared && (prot & PROT_WRITE)) 3786 av |= FILE__WRITE; 3787 3788 if (prot & PROT_EXEC) 3789 av |= FILE__EXECUTE; 3790 3791 return file_has_perm(cred, file, av); 3792 } 3793 3794 error: 3795 return rc; 3796 } 3797 3798 static int selinux_mmap_addr(unsigned long addr) 3799 { 3800 int rc = 0; 3801 3802 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) { 3803 u32 sid = current_sid(); 3804 rc = avc_has_perm(&selinux_state, 3805 sid, sid, SECCLASS_MEMPROTECT, 3806 MEMPROTECT__MMAP_ZERO, NULL); 3807 } 3808 3809 return rc; 3810 } 3811 3812 static int selinux_mmap_file(struct file *file, unsigned long reqprot, 3813 unsigned long prot, unsigned long flags) 3814 { 3815 struct common_audit_data ad; 3816 int rc; 3817 3818 if (file) { 3819 ad.type = LSM_AUDIT_DATA_FILE; 3820 ad.u.file = file; 3821 rc = inode_has_perm(current_cred(), file_inode(file), 3822 FILE__MAP, &ad); 3823 if (rc) 3824 return rc; 3825 } 3826 3827 if (checkreqprot_get(&selinux_state)) 3828 prot = reqprot; 3829 3830 return file_map_prot_check(file, prot, 3831 (flags & MAP_TYPE) == MAP_SHARED); 3832 } 3833 3834 static int selinux_file_mprotect(struct vm_area_struct *vma, 3835 unsigned long reqprot, 3836 unsigned long prot) 3837 { 3838 const struct cred *cred = current_cred(); 3839 u32 sid = cred_sid(cred); 3840 3841 if (checkreqprot_get(&selinux_state)) 3842 prot = reqprot; 3843 3844 if (default_noexec && 3845 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) { 3846 int rc = 0; 3847 if (vma->vm_start >= vma->vm_mm->start_brk && 3848 vma->vm_end <= vma->vm_mm->brk) { 3849 rc = avc_has_perm(&selinux_state, 3850 sid, sid, SECCLASS_PROCESS, 3851 PROCESS__EXECHEAP, NULL); 3852 } else if (!vma->vm_file && 3853 ((vma->vm_start <= vma->vm_mm->start_stack && 3854 vma->vm_end >= vma->vm_mm->start_stack) || 3855 vma_is_stack_for_current(vma))) { 3856 rc = avc_has_perm(&selinux_state, 3857 sid, sid, SECCLASS_PROCESS, 3858 PROCESS__EXECSTACK, NULL); 3859 } else if (vma->vm_file && vma->anon_vma) { 3860 /* 3861 * We are making executable a file mapping that has 3862 * had some COW done. Since pages might have been 3863 * written, check ability to execute the possibly 3864 * modified content. This typically should only 3865 * occur for text relocations. 3866 */ 3867 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD); 3868 } 3869 if (rc) 3870 return rc; 3871 } 3872 3873 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED); 3874 } 3875 3876 static int selinux_file_lock(struct file *file, unsigned int cmd) 3877 { 3878 const struct cred *cred = current_cred(); 3879 3880 return file_has_perm(cred, file, FILE__LOCK); 3881 } 3882 3883 static int selinux_file_fcntl(struct file *file, unsigned int cmd, 3884 unsigned long arg) 3885 { 3886 const struct cred *cred = current_cred(); 3887 int err = 0; 3888 3889 switch (cmd) { 3890 case F_SETFL: 3891 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) { 3892 err = file_has_perm(cred, file, FILE__WRITE); 3893 break; 3894 } 3895 fallthrough; 3896 case F_SETOWN: 3897 case F_SETSIG: 3898 case F_GETFL: 3899 case F_GETOWN: 3900 case F_GETSIG: 3901 case F_GETOWNER_UIDS: 3902 /* Just check FD__USE permission */ 3903 err = file_has_perm(cred, file, 0); 3904 break; 3905 case F_GETLK: 3906 case F_SETLK: 3907 case F_SETLKW: 3908 case F_OFD_GETLK: 3909 case F_OFD_SETLK: 3910 case F_OFD_SETLKW: 3911 #if BITS_PER_LONG == 32 3912 case F_GETLK64: 3913 case F_SETLK64: 3914 case F_SETLKW64: 3915 #endif 3916 err = file_has_perm(cred, file, FILE__LOCK); 3917 break; 3918 } 3919 3920 return err; 3921 } 3922 3923 static void selinux_file_set_fowner(struct file *file) 3924 { 3925 struct file_security_struct *fsec; 3926 3927 fsec = selinux_file(file); 3928 fsec->fown_sid = current_sid(); 3929 } 3930 3931 static int selinux_file_send_sigiotask(struct task_struct *tsk, 3932 struct fown_struct *fown, int signum) 3933 { 3934 struct file *file; 3935 u32 sid = task_sid_obj(tsk); 3936 u32 perm; 3937 struct file_security_struct *fsec; 3938 3939 /* struct fown_struct is never outside the context of a struct file */ 3940 file = container_of(fown, struct file, f_owner); 3941 3942 fsec = selinux_file(file); 3943 3944 if (!signum) 3945 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */ 3946 else 3947 perm = signal_to_av(signum); 3948 3949 return avc_has_perm(&selinux_state, 3950 fsec->fown_sid, sid, 3951 SECCLASS_PROCESS, perm, NULL); 3952 } 3953 3954 static int selinux_file_receive(struct file *file) 3955 { 3956 const struct cred *cred = current_cred(); 3957 3958 return file_has_perm(cred, file, file_to_av(file)); 3959 } 3960 3961 static int selinux_file_open(struct file *file) 3962 { 3963 struct file_security_struct *fsec; 3964 struct inode_security_struct *isec; 3965 3966 fsec = selinux_file(file); 3967 isec = inode_security(file_inode(file)); 3968 /* 3969 * Save inode label and policy sequence number 3970 * at open-time so that selinux_file_permission 3971 * can determine whether revalidation is necessary. 3972 * Task label is already saved in the file security 3973 * struct as its SID. 3974 */ 3975 fsec->isid = isec->sid; 3976 fsec->pseqno = avc_policy_seqno(&selinux_state); 3977 /* 3978 * Since the inode label or policy seqno may have changed 3979 * between the selinux_inode_permission check and the saving 3980 * of state above, recheck that access is still permitted. 3981 * Otherwise, access might never be revalidated against the 3982 * new inode label or new policy. 3983 * This check is not redundant - do not remove. 3984 */ 3985 return file_path_has_perm(file->f_cred, file, open_file_to_av(file)); 3986 } 3987 3988 /* task security operations */ 3989 3990 static int selinux_task_alloc(struct task_struct *task, 3991 unsigned long clone_flags) 3992 { 3993 u32 sid = current_sid(); 3994 3995 return avc_has_perm(&selinux_state, 3996 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL); 3997 } 3998 3999 /* 4000 * prepare a new set of credentials for modification 4001 */ 4002 static int selinux_cred_prepare(struct cred *new, const struct cred *old, 4003 gfp_t gfp) 4004 { 4005 const struct task_security_struct *old_tsec = selinux_cred(old); 4006 struct task_security_struct *tsec = selinux_cred(new); 4007 4008 *tsec = *old_tsec; 4009 return 0; 4010 } 4011 4012 /* 4013 * transfer the SELinux data to a blank set of creds 4014 */ 4015 static void selinux_cred_transfer(struct cred *new, const struct cred *old) 4016 { 4017 const struct task_security_struct *old_tsec = selinux_cred(old); 4018 struct task_security_struct *tsec = selinux_cred(new); 4019 4020 *tsec = *old_tsec; 4021 } 4022 4023 static void selinux_cred_getsecid(const struct cred *c, u32 *secid) 4024 { 4025 *secid = cred_sid(c); 4026 } 4027 4028 /* 4029 * set the security data for a kernel service 4030 * - all the creation contexts are set to unlabelled 4031 */ 4032 static int selinux_kernel_act_as(struct cred *new, u32 secid) 4033 { 4034 struct task_security_struct *tsec = selinux_cred(new); 4035 u32 sid = current_sid(); 4036 int ret; 4037 4038 ret = avc_has_perm(&selinux_state, 4039 sid, secid, 4040 SECCLASS_KERNEL_SERVICE, 4041 KERNEL_SERVICE__USE_AS_OVERRIDE, 4042 NULL); 4043 if (ret == 0) { 4044 tsec->sid = secid; 4045 tsec->create_sid = 0; 4046 tsec->keycreate_sid = 0; 4047 tsec->sockcreate_sid = 0; 4048 } 4049 return ret; 4050 } 4051 4052 /* 4053 * set the file creation context in a security record to the same as the 4054 * objective context of the specified inode 4055 */ 4056 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode) 4057 { 4058 struct inode_security_struct *isec = inode_security(inode); 4059 struct task_security_struct *tsec = selinux_cred(new); 4060 u32 sid = current_sid(); 4061 int ret; 4062 4063 ret = avc_has_perm(&selinux_state, 4064 sid, isec->sid, 4065 SECCLASS_KERNEL_SERVICE, 4066 KERNEL_SERVICE__CREATE_FILES_AS, 4067 NULL); 4068 4069 if (ret == 0) 4070 tsec->create_sid = isec->sid; 4071 return ret; 4072 } 4073 4074 static int selinux_kernel_module_request(char *kmod_name) 4075 { 4076 struct common_audit_data ad; 4077 4078 ad.type = LSM_AUDIT_DATA_KMOD; 4079 ad.u.kmod_name = kmod_name; 4080 4081 return avc_has_perm(&selinux_state, 4082 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM, 4083 SYSTEM__MODULE_REQUEST, &ad); 4084 } 4085 4086 static int selinux_kernel_module_from_file(struct file *file) 4087 { 4088 struct common_audit_data ad; 4089 struct inode_security_struct *isec; 4090 struct file_security_struct *fsec; 4091 u32 sid = current_sid(); 4092 int rc; 4093 4094 /* init_module */ 4095 if (file == NULL) 4096 return avc_has_perm(&selinux_state, 4097 sid, sid, SECCLASS_SYSTEM, 4098 SYSTEM__MODULE_LOAD, NULL); 4099 4100 /* finit_module */ 4101 4102 ad.type = LSM_AUDIT_DATA_FILE; 4103 ad.u.file = file; 4104 4105 fsec = selinux_file(file); 4106 if (sid != fsec->sid) { 4107 rc = avc_has_perm(&selinux_state, 4108 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad); 4109 if (rc) 4110 return rc; 4111 } 4112 4113 isec = inode_security(file_inode(file)); 4114 return avc_has_perm(&selinux_state, 4115 sid, isec->sid, SECCLASS_SYSTEM, 4116 SYSTEM__MODULE_LOAD, &ad); 4117 } 4118 4119 static int selinux_kernel_read_file(struct file *file, 4120 enum kernel_read_file_id id, 4121 bool contents) 4122 { 4123 int rc = 0; 4124 4125 switch (id) { 4126 case READING_MODULE: 4127 rc = selinux_kernel_module_from_file(contents ? file : NULL); 4128 break; 4129 default: 4130 break; 4131 } 4132 4133 return rc; 4134 } 4135 4136 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents) 4137 { 4138 int rc = 0; 4139 4140 switch (id) { 4141 case LOADING_MODULE: 4142 rc = selinux_kernel_module_from_file(NULL); 4143 break; 4144 default: 4145 break; 4146 } 4147 4148 return rc; 4149 } 4150 4151 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid) 4152 { 4153 return avc_has_perm(&selinux_state, 4154 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4155 PROCESS__SETPGID, NULL); 4156 } 4157 4158 static int selinux_task_getpgid(struct task_struct *p) 4159 { 4160 return avc_has_perm(&selinux_state, 4161 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4162 PROCESS__GETPGID, NULL); 4163 } 4164 4165 static int selinux_task_getsid(struct task_struct *p) 4166 { 4167 return avc_has_perm(&selinux_state, 4168 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4169 PROCESS__GETSESSION, NULL); 4170 } 4171 4172 static void selinux_current_getsecid_subj(u32 *secid) 4173 { 4174 *secid = current_sid(); 4175 } 4176 4177 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid) 4178 { 4179 *secid = task_sid_obj(p); 4180 } 4181 4182 static int selinux_task_setnice(struct task_struct *p, int nice) 4183 { 4184 return avc_has_perm(&selinux_state, 4185 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4186 PROCESS__SETSCHED, NULL); 4187 } 4188 4189 static int selinux_task_setioprio(struct task_struct *p, int ioprio) 4190 { 4191 return avc_has_perm(&selinux_state, 4192 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4193 PROCESS__SETSCHED, NULL); 4194 } 4195 4196 static int selinux_task_getioprio(struct task_struct *p) 4197 { 4198 return avc_has_perm(&selinux_state, 4199 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4200 PROCESS__GETSCHED, NULL); 4201 } 4202 4203 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred, 4204 unsigned int flags) 4205 { 4206 u32 av = 0; 4207 4208 if (!flags) 4209 return 0; 4210 if (flags & LSM_PRLIMIT_WRITE) 4211 av |= PROCESS__SETRLIMIT; 4212 if (flags & LSM_PRLIMIT_READ) 4213 av |= PROCESS__GETRLIMIT; 4214 return avc_has_perm(&selinux_state, 4215 cred_sid(cred), cred_sid(tcred), 4216 SECCLASS_PROCESS, av, NULL); 4217 } 4218 4219 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource, 4220 struct rlimit *new_rlim) 4221 { 4222 struct rlimit *old_rlim = p->signal->rlim + resource; 4223 4224 /* Control the ability to change the hard limit (whether 4225 lowering or raising it), so that the hard limit can 4226 later be used as a safe reset point for the soft limit 4227 upon context transitions. See selinux_bprm_committing_creds. */ 4228 if (old_rlim->rlim_max != new_rlim->rlim_max) 4229 return avc_has_perm(&selinux_state, 4230 current_sid(), task_sid_obj(p), 4231 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL); 4232 4233 return 0; 4234 } 4235 4236 static int selinux_task_setscheduler(struct task_struct *p) 4237 { 4238 return avc_has_perm(&selinux_state, 4239 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4240 PROCESS__SETSCHED, NULL); 4241 } 4242 4243 static int selinux_task_getscheduler(struct task_struct *p) 4244 { 4245 return avc_has_perm(&selinux_state, 4246 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4247 PROCESS__GETSCHED, NULL); 4248 } 4249 4250 static int selinux_task_movememory(struct task_struct *p) 4251 { 4252 return avc_has_perm(&selinux_state, 4253 current_sid(), task_sid_obj(p), SECCLASS_PROCESS, 4254 PROCESS__SETSCHED, NULL); 4255 } 4256 4257 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info, 4258 int sig, const struct cred *cred) 4259 { 4260 u32 secid; 4261 u32 perm; 4262 4263 if (!sig) 4264 perm = PROCESS__SIGNULL; /* null signal; existence test */ 4265 else 4266 perm = signal_to_av(sig); 4267 if (!cred) 4268 secid = current_sid(); 4269 else 4270 secid = cred_sid(cred); 4271 return avc_has_perm(&selinux_state, 4272 secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL); 4273 } 4274 4275 static void selinux_task_to_inode(struct task_struct *p, 4276 struct inode *inode) 4277 { 4278 struct inode_security_struct *isec = selinux_inode(inode); 4279 u32 sid = task_sid_obj(p); 4280 4281 spin_lock(&isec->lock); 4282 isec->sclass = inode_mode_to_security_class(inode->i_mode); 4283 isec->sid = sid; 4284 isec->initialized = LABEL_INITIALIZED; 4285 spin_unlock(&isec->lock); 4286 } 4287 4288 /* Returns error only if unable to parse addresses */ 4289 static int selinux_parse_skb_ipv4(struct sk_buff *skb, 4290 struct common_audit_data *ad, u8 *proto) 4291 { 4292 int offset, ihlen, ret = -EINVAL; 4293 struct iphdr _iph, *ih; 4294 4295 offset = skb_network_offset(skb); 4296 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph); 4297 if (ih == NULL) 4298 goto out; 4299 4300 ihlen = ih->ihl * 4; 4301 if (ihlen < sizeof(_iph)) 4302 goto out; 4303 4304 ad->u.net->v4info.saddr = ih->saddr; 4305 ad->u.net->v4info.daddr = ih->daddr; 4306 ret = 0; 4307 4308 if (proto) 4309 *proto = ih->protocol; 4310 4311 switch (ih->protocol) { 4312 case IPPROTO_TCP: { 4313 struct tcphdr _tcph, *th; 4314 4315 if (ntohs(ih->frag_off) & IP_OFFSET) 4316 break; 4317 4318 offset += ihlen; 4319 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4320 if (th == NULL) 4321 break; 4322 4323 ad->u.net->sport = th->source; 4324 ad->u.net->dport = th->dest; 4325 break; 4326 } 4327 4328 case IPPROTO_UDP: { 4329 struct udphdr _udph, *uh; 4330 4331 if (ntohs(ih->frag_off) & IP_OFFSET) 4332 break; 4333 4334 offset += ihlen; 4335 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4336 if (uh == NULL) 4337 break; 4338 4339 ad->u.net->sport = uh->source; 4340 ad->u.net->dport = uh->dest; 4341 break; 4342 } 4343 4344 case IPPROTO_DCCP: { 4345 struct dccp_hdr _dccph, *dh; 4346 4347 if (ntohs(ih->frag_off) & IP_OFFSET) 4348 break; 4349 4350 offset += ihlen; 4351 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 4352 if (dh == NULL) 4353 break; 4354 4355 ad->u.net->sport = dh->dccph_sport; 4356 ad->u.net->dport = dh->dccph_dport; 4357 break; 4358 } 4359 4360 #if IS_ENABLED(CONFIG_IP_SCTP) 4361 case IPPROTO_SCTP: { 4362 struct sctphdr _sctph, *sh; 4363 4364 if (ntohs(ih->frag_off) & IP_OFFSET) 4365 break; 4366 4367 offset += ihlen; 4368 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph); 4369 if (sh == NULL) 4370 break; 4371 4372 ad->u.net->sport = sh->source; 4373 ad->u.net->dport = sh->dest; 4374 break; 4375 } 4376 #endif 4377 default: 4378 break; 4379 } 4380 out: 4381 return ret; 4382 } 4383 4384 #if IS_ENABLED(CONFIG_IPV6) 4385 4386 /* Returns error only if unable to parse addresses */ 4387 static int selinux_parse_skb_ipv6(struct sk_buff *skb, 4388 struct common_audit_data *ad, u8 *proto) 4389 { 4390 u8 nexthdr; 4391 int ret = -EINVAL, offset; 4392 struct ipv6hdr _ipv6h, *ip6; 4393 __be16 frag_off; 4394 4395 offset = skb_network_offset(skb); 4396 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h); 4397 if (ip6 == NULL) 4398 goto out; 4399 4400 ad->u.net->v6info.saddr = ip6->saddr; 4401 ad->u.net->v6info.daddr = ip6->daddr; 4402 ret = 0; 4403 4404 nexthdr = ip6->nexthdr; 4405 offset += sizeof(_ipv6h); 4406 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off); 4407 if (offset < 0) 4408 goto out; 4409 4410 if (proto) 4411 *proto = nexthdr; 4412 4413 switch (nexthdr) { 4414 case IPPROTO_TCP: { 4415 struct tcphdr _tcph, *th; 4416 4417 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph); 4418 if (th == NULL) 4419 break; 4420 4421 ad->u.net->sport = th->source; 4422 ad->u.net->dport = th->dest; 4423 break; 4424 } 4425 4426 case IPPROTO_UDP: { 4427 struct udphdr _udph, *uh; 4428 4429 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph); 4430 if (uh == NULL) 4431 break; 4432 4433 ad->u.net->sport = uh->source; 4434 ad->u.net->dport = uh->dest; 4435 break; 4436 } 4437 4438 case IPPROTO_DCCP: { 4439 struct dccp_hdr _dccph, *dh; 4440 4441 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph); 4442 if (dh == NULL) 4443 break; 4444 4445 ad->u.net->sport = dh->dccph_sport; 4446 ad->u.net->dport = dh->dccph_dport; 4447 break; 4448 } 4449 4450 #if IS_ENABLED(CONFIG_IP_SCTP) 4451 case IPPROTO_SCTP: { 4452 struct sctphdr _sctph, *sh; 4453 4454 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph); 4455 if (sh == NULL) 4456 break; 4457 4458 ad->u.net->sport = sh->source; 4459 ad->u.net->dport = sh->dest; 4460 break; 4461 } 4462 #endif 4463 /* includes fragments */ 4464 default: 4465 break; 4466 } 4467 out: 4468 return ret; 4469 } 4470 4471 #endif /* IPV6 */ 4472 4473 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad, 4474 char **_addrp, int src, u8 *proto) 4475 { 4476 char *addrp; 4477 int ret; 4478 4479 switch (ad->u.net->family) { 4480 case PF_INET: 4481 ret = selinux_parse_skb_ipv4(skb, ad, proto); 4482 if (ret) 4483 goto parse_error; 4484 addrp = (char *)(src ? &ad->u.net->v4info.saddr : 4485 &ad->u.net->v4info.daddr); 4486 goto okay; 4487 4488 #if IS_ENABLED(CONFIG_IPV6) 4489 case PF_INET6: 4490 ret = selinux_parse_skb_ipv6(skb, ad, proto); 4491 if (ret) 4492 goto parse_error; 4493 addrp = (char *)(src ? &ad->u.net->v6info.saddr : 4494 &ad->u.net->v6info.daddr); 4495 goto okay; 4496 #endif /* IPV6 */ 4497 default: 4498 addrp = NULL; 4499 goto okay; 4500 } 4501 4502 parse_error: 4503 pr_warn( 4504 "SELinux: failure in selinux_parse_skb()," 4505 " unable to parse packet\n"); 4506 return ret; 4507 4508 okay: 4509 if (_addrp) 4510 *_addrp = addrp; 4511 return 0; 4512 } 4513 4514 /** 4515 * selinux_skb_peerlbl_sid - Determine the peer label of a packet 4516 * @skb: the packet 4517 * @family: protocol family 4518 * @sid: the packet's peer label SID 4519 * 4520 * Description: 4521 * Check the various different forms of network peer labeling and determine 4522 * the peer label/SID for the packet; most of the magic actually occurs in 4523 * the security server function security_net_peersid_cmp(). The function 4524 * returns zero if the value in @sid is valid (although it may be SECSID_NULL) 4525 * or -EACCES if @sid is invalid due to inconsistencies with the different 4526 * peer labels. 4527 * 4528 */ 4529 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid) 4530 { 4531 int err; 4532 u32 xfrm_sid; 4533 u32 nlbl_sid; 4534 u32 nlbl_type; 4535 4536 err = selinux_xfrm_skb_sid(skb, &xfrm_sid); 4537 if (unlikely(err)) 4538 return -EACCES; 4539 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid); 4540 if (unlikely(err)) 4541 return -EACCES; 4542 4543 err = security_net_peersid_resolve(&selinux_state, nlbl_sid, 4544 nlbl_type, xfrm_sid, sid); 4545 if (unlikely(err)) { 4546 pr_warn( 4547 "SELinux: failure in selinux_skb_peerlbl_sid()," 4548 " unable to determine packet's peer label\n"); 4549 return -EACCES; 4550 } 4551 4552 return 0; 4553 } 4554 4555 /** 4556 * selinux_conn_sid - Determine the child socket label for a connection 4557 * @sk_sid: the parent socket's SID 4558 * @skb_sid: the packet's SID 4559 * @conn_sid: the resulting connection SID 4560 * 4561 * If @skb_sid is valid then the user:role:type information from @sk_sid is 4562 * combined with the MLS information from @skb_sid in order to create 4563 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy 4564 * of @sk_sid. Returns zero on success, negative values on failure. 4565 * 4566 */ 4567 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid) 4568 { 4569 int err = 0; 4570 4571 if (skb_sid != SECSID_NULL) 4572 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid, 4573 conn_sid); 4574 else 4575 *conn_sid = sk_sid; 4576 4577 return err; 4578 } 4579 4580 /* socket security operations */ 4581 4582 static int socket_sockcreate_sid(const struct task_security_struct *tsec, 4583 u16 secclass, u32 *socksid) 4584 { 4585 if (tsec->sockcreate_sid > SECSID_NULL) { 4586 *socksid = tsec->sockcreate_sid; 4587 return 0; 4588 } 4589 4590 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid, 4591 secclass, NULL, socksid); 4592 } 4593 4594 static int sock_has_perm(struct sock *sk, u32 perms) 4595 { 4596 struct sk_security_struct *sksec = sk->sk_security; 4597 struct common_audit_data ad; 4598 struct lsm_network_audit net = {0,}; 4599 4600 if (sksec->sid == SECINITSID_KERNEL) 4601 return 0; 4602 4603 ad.type = LSM_AUDIT_DATA_NET; 4604 ad.u.net = &net; 4605 ad.u.net->sk = sk; 4606 4607 return avc_has_perm(&selinux_state, 4608 current_sid(), sksec->sid, sksec->sclass, perms, 4609 &ad); 4610 } 4611 4612 static int selinux_socket_create(int family, int type, 4613 int protocol, int kern) 4614 { 4615 const struct task_security_struct *tsec = selinux_cred(current_cred()); 4616 u32 newsid; 4617 u16 secclass; 4618 int rc; 4619 4620 if (kern) 4621 return 0; 4622 4623 secclass = socket_type_to_security_class(family, type, protocol); 4624 rc = socket_sockcreate_sid(tsec, secclass, &newsid); 4625 if (rc) 4626 return rc; 4627 4628 return avc_has_perm(&selinux_state, 4629 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL); 4630 } 4631 4632 static int selinux_socket_post_create(struct socket *sock, int family, 4633 int type, int protocol, int kern) 4634 { 4635 const struct task_security_struct *tsec = selinux_cred(current_cred()); 4636 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock)); 4637 struct sk_security_struct *sksec; 4638 u16 sclass = socket_type_to_security_class(family, type, protocol); 4639 u32 sid = SECINITSID_KERNEL; 4640 int err = 0; 4641 4642 if (!kern) { 4643 err = socket_sockcreate_sid(tsec, sclass, &sid); 4644 if (err) 4645 return err; 4646 } 4647 4648 isec->sclass = sclass; 4649 isec->sid = sid; 4650 isec->initialized = LABEL_INITIALIZED; 4651 4652 if (sock->sk) { 4653 sksec = sock->sk->sk_security; 4654 sksec->sclass = sclass; 4655 sksec->sid = sid; 4656 /* Allows detection of the first association on this socket */ 4657 if (sksec->sclass == SECCLASS_SCTP_SOCKET) 4658 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET; 4659 4660 err = selinux_netlbl_socket_post_create(sock->sk, family); 4661 } 4662 4663 return err; 4664 } 4665 4666 static int selinux_socket_socketpair(struct socket *socka, 4667 struct socket *sockb) 4668 { 4669 struct sk_security_struct *sksec_a = socka->sk->sk_security; 4670 struct sk_security_struct *sksec_b = sockb->sk->sk_security; 4671 4672 sksec_a->peer_sid = sksec_b->sid; 4673 sksec_b->peer_sid = sksec_a->sid; 4674 4675 return 0; 4676 } 4677 4678 /* Range of port numbers used to automatically bind. 4679 Need to determine whether we should perform a name_bind 4680 permission check between the socket and the port number. */ 4681 4682 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen) 4683 { 4684 struct sock *sk = sock->sk; 4685 struct sk_security_struct *sksec = sk->sk_security; 4686 u16 family; 4687 int err; 4688 4689 err = sock_has_perm(sk, SOCKET__BIND); 4690 if (err) 4691 goto out; 4692 4693 /* If PF_INET or PF_INET6, check name_bind permission for the port. */ 4694 family = sk->sk_family; 4695 if (family == PF_INET || family == PF_INET6) { 4696 char *addrp; 4697 struct common_audit_data ad; 4698 struct lsm_network_audit net = {0,}; 4699 struct sockaddr_in *addr4 = NULL; 4700 struct sockaddr_in6 *addr6 = NULL; 4701 u16 family_sa; 4702 unsigned short snum; 4703 u32 sid, node_perm; 4704 4705 /* 4706 * sctp_bindx(3) calls via selinux_sctp_bind_connect() 4707 * that validates multiple binding addresses. Because of this 4708 * need to check address->sa_family as it is possible to have 4709 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET. 4710 */ 4711 if (addrlen < offsetofend(struct sockaddr, sa_family)) 4712 return -EINVAL; 4713 family_sa = address->sa_family; 4714 switch (family_sa) { 4715 case AF_UNSPEC: 4716 case AF_INET: 4717 if (addrlen < sizeof(struct sockaddr_in)) 4718 return -EINVAL; 4719 addr4 = (struct sockaddr_in *)address; 4720 if (family_sa == AF_UNSPEC) { 4721 /* see __inet_bind(), we only want to allow 4722 * AF_UNSPEC if the address is INADDR_ANY 4723 */ 4724 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY)) 4725 goto err_af; 4726 family_sa = AF_INET; 4727 } 4728 snum = ntohs(addr4->sin_port); 4729 addrp = (char *)&addr4->sin_addr.s_addr; 4730 break; 4731 case AF_INET6: 4732 if (addrlen < SIN6_LEN_RFC2133) 4733 return -EINVAL; 4734 addr6 = (struct sockaddr_in6 *)address; 4735 snum = ntohs(addr6->sin6_port); 4736 addrp = (char *)&addr6->sin6_addr.s6_addr; 4737 break; 4738 default: 4739 goto err_af; 4740 } 4741 4742 ad.type = LSM_AUDIT_DATA_NET; 4743 ad.u.net = &net; 4744 ad.u.net->sport = htons(snum); 4745 ad.u.net->family = family_sa; 4746 4747 if (snum) { 4748 int low, high; 4749 4750 inet_get_local_port_range(sock_net(sk), &low, &high); 4751 4752 if (inet_port_requires_bind_service(sock_net(sk), snum) || 4753 snum < low || snum > high) { 4754 err = sel_netport_sid(sk->sk_protocol, 4755 snum, &sid); 4756 if (err) 4757 goto out; 4758 err = avc_has_perm(&selinux_state, 4759 sksec->sid, sid, 4760 sksec->sclass, 4761 SOCKET__NAME_BIND, &ad); 4762 if (err) 4763 goto out; 4764 } 4765 } 4766 4767 switch (sksec->sclass) { 4768 case SECCLASS_TCP_SOCKET: 4769 node_perm = TCP_SOCKET__NODE_BIND; 4770 break; 4771 4772 case SECCLASS_UDP_SOCKET: 4773 node_perm = UDP_SOCKET__NODE_BIND; 4774 break; 4775 4776 case SECCLASS_DCCP_SOCKET: 4777 node_perm = DCCP_SOCKET__NODE_BIND; 4778 break; 4779 4780 case SECCLASS_SCTP_SOCKET: 4781 node_perm = SCTP_SOCKET__NODE_BIND; 4782 break; 4783 4784 default: 4785 node_perm = RAWIP_SOCKET__NODE_BIND; 4786 break; 4787 } 4788 4789 err = sel_netnode_sid(addrp, family_sa, &sid); 4790 if (err) 4791 goto out; 4792 4793 if (family_sa == AF_INET) 4794 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr; 4795 else 4796 ad.u.net->v6info.saddr = addr6->sin6_addr; 4797 4798 err = avc_has_perm(&selinux_state, 4799 sksec->sid, sid, 4800 sksec->sclass, node_perm, &ad); 4801 if (err) 4802 goto out; 4803 } 4804 out: 4805 return err; 4806 err_af: 4807 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */ 4808 if (sksec->sclass == SECCLASS_SCTP_SOCKET) 4809 return -EINVAL; 4810 return -EAFNOSUPPORT; 4811 } 4812 4813 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3) 4814 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst 4815 */ 4816 static int selinux_socket_connect_helper(struct socket *sock, 4817 struct sockaddr *address, int addrlen) 4818 { 4819 struct sock *sk = sock->sk; 4820 struct sk_security_struct *sksec = sk->sk_security; 4821 int err; 4822 4823 err = sock_has_perm(sk, SOCKET__CONNECT); 4824 if (err) 4825 return err; 4826 if (addrlen < offsetofend(struct sockaddr, sa_family)) 4827 return -EINVAL; 4828 4829 /* connect(AF_UNSPEC) has special handling, as it is a documented 4830 * way to disconnect the socket 4831 */ 4832 if (address->sa_family == AF_UNSPEC) 4833 return 0; 4834 4835 /* 4836 * If a TCP, DCCP or SCTP socket, check name_connect permission 4837 * for the port. 4838 */ 4839 if (sksec->sclass == SECCLASS_TCP_SOCKET || 4840 sksec->sclass == SECCLASS_DCCP_SOCKET || 4841 sksec->sclass == SECCLASS_SCTP_SOCKET) { 4842 struct common_audit_data ad; 4843 struct lsm_network_audit net = {0,}; 4844 struct sockaddr_in *addr4 = NULL; 4845 struct sockaddr_in6 *addr6 = NULL; 4846 unsigned short snum; 4847 u32 sid, perm; 4848 4849 /* sctp_connectx(3) calls via selinux_sctp_bind_connect() 4850 * that validates multiple connect addresses. Because of this 4851 * need to check address->sa_family as it is possible to have 4852 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET. 4853 */ 4854 switch (address->sa_family) { 4855 case AF_INET: 4856 addr4 = (struct sockaddr_in *)address; 4857 if (addrlen < sizeof(struct sockaddr_in)) 4858 return -EINVAL; 4859 snum = ntohs(addr4->sin_port); 4860 break; 4861 case AF_INET6: 4862 addr6 = (struct sockaddr_in6 *)address; 4863 if (addrlen < SIN6_LEN_RFC2133) 4864 return -EINVAL; 4865 snum = ntohs(addr6->sin6_port); 4866 break; 4867 default: 4868 /* Note that SCTP services expect -EINVAL, whereas 4869 * others expect -EAFNOSUPPORT. 4870 */ 4871 if (sksec->sclass == SECCLASS_SCTP_SOCKET) 4872 return -EINVAL; 4873 else 4874 return -EAFNOSUPPORT; 4875 } 4876 4877 err = sel_netport_sid(sk->sk_protocol, snum, &sid); 4878 if (err) 4879 return err; 4880 4881 switch (sksec->sclass) { 4882 case SECCLASS_TCP_SOCKET: 4883 perm = TCP_SOCKET__NAME_CONNECT; 4884 break; 4885 case SECCLASS_DCCP_SOCKET: 4886 perm = DCCP_SOCKET__NAME_CONNECT; 4887 break; 4888 case SECCLASS_SCTP_SOCKET: 4889 perm = SCTP_SOCKET__NAME_CONNECT; 4890 break; 4891 } 4892 4893 ad.type = LSM_AUDIT_DATA_NET; 4894 ad.u.net = &net; 4895 ad.u.net->dport = htons(snum); 4896 ad.u.net->family = address->sa_family; 4897 err = avc_has_perm(&selinux_state, 4898 sksec->sid, sid, sksec->sclass, perm, &ad); 4899 if (err) 4900 return err; 4901 } 4902 4903 return 0; 4904 } 4905 4906 /* Supports connect(2), see comments in selinux_socket_connect_helper() */ 4907 static int selinux_socket_connect(struct socket *sock, 4908 struct sockaddr *address, int addrlen) 4909 { 4910 int err; 4911 struct sock *sk = sock->sk; 4912 4913 err = selinux_socket_connect_helper(sock, address, addrlen); 4914 if (err) 4915 return err; 4916 4917 return selinux_netlbl_socket_connect(sk, address); 4918 } 4919 4920 static int selinux_socket_listen(struct socket *sock, int backlog) 4921 { 4922 return sock_has_perm(sock->sk, SOCKET__LISTEN); 4923 } 4924 4925 static int selinux_socket_accept(struct socket *sock, struct socket *newsock) 4926 { 4927 int err; 4928 struct inode_security_struct *isec; 4929 struct inode_security_struct *newisec; 4930 u16 sclass; 4931 u32 sid; 4932 4933 err = sock_has_perm(sock->sk, SOCKET__ACCEPT); 4934 if (err) 4935 return err; 4936 4937 isec = inode_security_novalidate(SOCK_INODE(sock)); 4938 spin_lock(&isec->lock); 4939 sclass = isec->sclass; 4940 sid = isec->sid; 4941 spin_unlock(&isec->lock); 4942 4943 newisec = inode_security_novalidate(SOCK_INODE(newsock)); 4944 newisec->sclass = sclass; 4945 newisec->sid = sid; 4946 newisec->initialized = LABEL_INITIALIZED; 4947 4948 return 0; 4949 } 4950 4951 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg, 4952 int size) 4953 { 4954 return sock_has_perm(sock->sk, SOCKET__WRITE); 4955 } 4956 4957 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg, 4958 int size, int flags) 4959 { 4960 return sock_has_perm(sock->sk, SOCKET__READ); 4961 } 4962 4963 static int selinux_socket_getsockname(struct socket *sock) 4964 { 4965 return sock_has_perm(sock->sk, SOCKET__GETATTR); 4966 } 4967 4968 static int selinux_socket_getpeername(struct socket *sock) 4969 { 4970 return sock_has_perm(sock->sk, SOCKET__GETATTR); 4971 } 4972 4973 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname) 4974 { 4975 int err; 4976 4977 err = sock_has_perm(sock->sk, SOCKET__SETOPT); 4978 if (err) 4979 return err; 4980 4981 return selinux_netlbl_socket_setsockopt(sock, level, optname); 4982 } 4983 4984 static int selinux_socket_getsockopt(struct socket *sock, int level, 4985 int optname) 4986 { 4987 return sock_has_perm(sock->sk, SOCKET__GETOPT); 4988 } 4989 4990 static int selinux_socket_shutdown(struct socket *sock, int how) 4991 { 4992 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN); 4993 } 4994 4995 static int selinux_socket_unix_stream_connect(struct sock *sock, 4996 struct sock *other, 4997 struct sock *newsk) 4998 { 4999 struct sk_security_struct *sksec_sock = sock->sk_security; 5000 struct sk_security_struct *sksec_other = other->sk_security; 5001 struct sk_security_struct *sksec_new = newsk->sk_security; 5002 struct common_audit_data ad; 5003 struct lsm_network_audit net = {0,}; 5004 int err; 5005 5006 ad.type = LSM_AUDIT_DATA_NET; 5007 ad.u.net = &net; 5008 ad.u.net->sk = other; 5009 5010 err = avc_has_perm(&selinux_state, 5011 sksec_sock->sid, sksec_other->sid, 5012 sksec_other->sclass, 5013 UNIX_STREAM_SOCKET__CONNECTTO, &ad); 5014 if (err) 5015 return err; 5016 5017 /* server child socket */ 5018 sksec_new->peer_sid = sksec_sock->sid; 5019 err = security_sid_mls_copy(&selinux_state, sksec_other->sid, 5020 sksec_sock->sid, &sksec_new->sid); 5021 if (err) 5022 return err; 5023 5024 /* connecting socket */ 5025 sksec_sock->peer_sid = sksec_new->sid; 5026 5027 return 0; 5028 } 5029 5030 static int selinux_socket_unix_may_send(struct socket *sock, 5031 struct socket *other) 5032 { 5033 struct sk_security_struct *ssec = sock->sk->sk_security; 5034 struct sk_security_struct *osec = other->sk->sk_security; 5035 struct common_audit_data ad; 5036 struct lsm_network_audit net = {0,}; 5037 5038 ad.type = LSM_AUDIT_DATA_NET; 5039 ad.u.net = &net; 5040 ad.u.net->sk = other->sk; 5041 5042 return avc_has_perm(&selinux_state, 5043 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO, 5044 &ad); 5045 } 5046 5047 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex, 5048 char *addrp, u16 family, u32 peer_sid, 5049 struct common_audit_data *ad) 5050 { 5051 int err; 5052 u32 if_sid; 5053 u32 node_sid; 5054 5055 err = sel_netif_sid(ns, ifindex, &if_sid); 5056 if (err) 5057 return err; 5058 err = avc_has_perm(&selinux_state, 5059 peer_sid, if_sid, 5060 SECCLASS_NETIF, NETIF__INGRESS, ad); 5061 if (err) 5062 return err; 5063 5064 err = sel_netnode_sid(addrp, family, &node_sid); 5065 if (err) 5066 return err; 5067 return avc_has_perm(&selinux_state, 5068 peer_sid, node_sid, 5069 SECCLASS_NODE, NODE__RECVFROM, ad); 5070 } 5071 5072 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb, 5073 u16 family) 5074 { 5075 int err = 0; 5076 struct sk_security_struct *sksec = sk->sk_security; 5077 u32 sk_sid = sksec->sid; 5078 struct common_audit_data ad; 5079 struct lsm_network_audit net = {0,}; 5080 char *addrp; 5081 5082 ad.type = LSM_AUDIT_DATA_NET; 5083 ad.u.net = &net; 5084 ad.u.net->netif = skb->skb_iif; 5085 ad.u.net->family = family; 5086 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 5087 if (err) 5088 return err; 5089 5090 if (selinux_secmark_enabled()) { 5091 err = avc_has_perm(&selinux_state, 5092 sk_sid, skb->secmark, SECCLASS_PACKET, 5093 PACKET__RECV, &ad); 5094 if (err) 5095 return err; 5096 } 5097 5098 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad); 5099 if (err) 5100 return err; 5101 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad); 5102 5103 return err; 5104 } 5105 5106 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb) 5107 { 5108 int err; 5109 struct sk_security_struct *sksec = sk->sk_security; 5110 u16 family = sk->sk_family; 5111 u32 sk_sid = sksec->sid; 5112 struct common_audit_data ad; 5113 struct lsm_network_audit net = {0,}; 5114 char *addrp; 5115 u8 secmark_active; 5116 u8 peerlbl_active; 5117 5118 if (family != PF_INET && family != PF_INET6) 5119 return 0; 5120 5121 /* Handle mapped IPv4 packets arriving via IPv6 sockets */ 5122 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 5123 family = PF_INET; 5124 5125 /* If any sort of compatibility mode is enabled then handoff processing 5126 * to the selinux_sock_rcv_skb_compat() function to deal with the 5127 * special handling. We do this in an attempt to keep this function 5128 * as fast and as clean as possible. */ 5129 if (!selinux_policycap_netpeer()) 5130 return selinux_sock_rcv_skb_compat(sk, skb, family); 5131 5132 secmark_active = selinux_secmark_enabled(); 5133 peerlbl_active = selinux_peerlbl_enabled(); 5134 if (!secmark_active && !peerlbl_active) 5135 return 0; 5136 5137 ad.type = LSM_AUDIT_DATA_NET; 5138 ad.u.net = &net; 5139 ad.u.net->netif = skb->skb_iif; 5140 ad.u.net->family = family; 5141 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL); 5142 if (err) 5143 return err; 5144 5145 if (peerlbl_active) { 5146 u32 peer_sid; 5147 5148 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid); 5149 if (err) 5150 return err; 5151 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif, 5152 addrp, family, peer_sid, &ad); 5153 if (err) { 5154 selinux_netlbl_err(skb, family, err, 0); 5155 return err; 5156 } 5157 err = avc_has_perm(&selinux_state, 5158 sk_sid, peer_sid, SECCLASS_PEER, 5159 PEER__RECV, &ad); 5160 if (err) { 5161 selinux_netlbl_err(skb, family, err, 0); 5162 return err; 5163 } 5164 } 5165 5166 if (secmark_active) { 5167 err = avc_has_perm(&selinux_state, 5168 sk_sid, skb->secmark, SECCLASS_PACKET, 5169 PACKET__RECV, &ad); 5170 if (err) 5171 return err; 5172 } 5173 5174 return err; 5175 } 5176 5177 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval, 5178 int __user *optlen, unsigned len) 5179 { 5180 int err = 0; 5181 char *scontext; 5182 u32 scontext_len; 5183 struct sk_security_struct *sksec = sock->sk->sk_security; 5184 u32 peer_sid = SECSID_NULL; 5185 5186 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET || 5187 sksec->sclass == SECCLASS_TCP_SOCKET || 5188 sksec->sclass == SECCLASS_SCTP_SOCKET) 5189 peer_sid = sksec->peer_sid; 5190 if (peer_sid == SECSID_NULL) 5191 return -ENOPROTOOPT; 5192 5193 err = security_sid_to_context(&selinux_state, peer_sid, &scontext, 5194 &scontext_len); 5195 if (err) 5196 return err; 5197 5198 if (scontext_len > len) { 5199 err = -ERANGE; 5200 goto out_len; 5201 } 5202 5203 if (copy_to_user(optval, scontext, scontext_len)) 5204 err = -EFAULT; 5205 5206 out_len: 5207 if (put_user(scontext_len, optlen)) 5208 err = -EFAULT; 5209 kfree(scontext); 5210 return err; 5211 } 5212 5213 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid) 5214 { 5215 u32 peer_secid = SECSID_NULL; 5216 u16 family; 5217 struct inode_security_struct *isec; 5218 5219 if (skb && skb->protocol == htons(ETH_P_IP)) 5220 family = PF_INET; 5221 else if (skb && skb->protocol == htons(ETH_P_IPV6)) 5222 family = PF_INET6; 5223 else if (sock) 5224 family = sock->sk->sk_family; 5225 else 5226 goto out; 5227 5228 if (sock && family == PF_UNIX) { 5229 isec = inode_security_novalidate(SOCK_INODE(sock)); 5230 peer_secid = isec->sid; 5231 } else if (skb) 5232 selinux_skb_peerlbl_sid(skb, family, &peer_secid); 5233 5234 out: 5235 *secid = peer_secid; 5236 if (peer_secid == SECSID_NULL) 5237 return -EINVAL; 5238 return 0; 5239 } 5240 5241 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority) 5242 { 5243 struct sk_security_struct *sksec; 5244 5245 sksec = kzalloc(sizeof(*sksec), priority); 5246 if (!sksec) 5247 return -ENOMEM; 5248 5249 sksec->peer_sid = SECINITSID_UNLABELED; 5250 sksec->sid = SECINITSID_UNLABELED; 5251 sksec->sclass = SECCLASS_SOCKET; 5252 selinux_netlbl_sk_security_reset(sksec); 5253 sk->sk_security = sksec; 5254 5255 return 0; 5256 } 5257 5258 static void selinux_sk_free_security(struct sock *sk) 5259 { 5260 struct sk_security_struct *sksec = sk->sk_security; 5261 5262 sk->sk_security = NULL; 5263 selinux_netlbl_sk_security_free(sksec); 5264 kfree(sksec); 5265 } 5266 5267 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk) 5268 { 5269 struct sk_security_struct *sksec = sk->sk_security; 5270 struct sk_security_struct *newsksec = newsk->sk_security; 5271 5272 newsksec->sid = sksec->sid; 5273 newsksec->peer_sid = sksec->peer_sid; 5274 newsksec->sclass = sksec->sclass; 5275 5276 selinux_netlbl_sk_security_reset(newsksec); 5277 } 5278 5279 static void selinux_sk_getsecid(struct sock *sk, u32 *secid) 5280 { 5281 if (!sk) 5282 *secid = SECINITSID_ANY_SOCKET; 5283 else { 5284 struct sk_security_struct *sksec = sk->sk_security; 5285 5286 *secid = sksec->sid; 5287 } 5288 } 5289 5290 static void selinux_sock_graft(struct sock *sk, struct socket *parent) 5291 { 5292 struct inode_security_struct *isec = 5293 inode_security_novalidate(SOCK_INODE(parent)); 5294 struct sk_security_struct *sksec = sk->sk_security; 5295 5296 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 || 5297 sk->sk_family == PF_UNIX) 5298 isec->sid = sksec->sid; 5299 sksec->sclass = isec->sclass; 5300 } 5301 5302 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming 5303 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association 5304 * already present). 5305 */ 5306 static int selinux_sctp_assoc_request(struct sctp_association *asoc, 5307 struct sk_buff *skb) 5308 { 5309 struct sk_security_struct *sksec = asoc->base.sk->sk_security; 5310 struct common_audit_data ad; 5311 struct lsm_network_audit net = {0,}; 5312 u8 peerlbl_active; 5313 u32 peer_sid = SECINITSID_UNLABELED; 5314 u32 conn_sid; 5315 int err = 0; 5316 5317 if (!selinux_policycap_extsockclass()) 5318 return 0; 5319 5320 peerlbl_active = selinux_peerlbl_enabled(); 5321 5322 if (peerlbl_active) { 5323 /* This will return peer_sid = SECSID_NULL if there are 5324 * no peer labels, see security_net_peersid_resolve(). 5325 */ 5326 err = selinux_skb_peerlbl_sid(skb, asoc->base.sk->sk_family, 5327 &peer_sid); 5328 if (err) 5329 return err; 5330 5331 if (peer_sid == SECSID_NULL) 5332 peer_sid = SECINITSID_UNLABELED; 5333 } 5334 5335 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) { 5336 sksec->sctp_assoc_state = SCTP_ASSOC_SET; 5337 5338 /* Here as first association on socket. As the peer SID 5339 * was allowed by peer recv (and the netif/node checks), 5340 * then it is approved by policy and used as the primary 5341 * peer SID for getpeercon(3). 5342 */ 5343 sksec->peer_sid = peer_sid; 5344 } else if (sksec->peer_sid != peer_sid) { 5345 /* Other association peer SIDs are checked to enforce 5346 * consistency among the peer SIDs. 5347 */ 5348 ad.type = LSM_AUDIT_DATA_NET; 5349 ad.u.net = &net; 5350 ad.u.net->sk = asoc->base.sk; 5351 err = avc_has_perm(&selinux_state, 5352 sksec->peer_sid, peer_sid, sksec->sclass, 5353 SCTP_SOCKET__ASSOCIATION, &ad); 5354 if (err) 5355 return err; 5356 } 5357 5358 /* Compute the MLS component for the connection and store 5359 * the information in asoc. This will be used by SCTP TCP type 5360 * sockets and peeled off connections as they cause a new 5361 * socket to be generated. selinux_sctp_sk_clone() will then 5362 * plug this into the new socket. 5363 */ 5364 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid); 5365 if (err) 5366 return err; 5367 5368 asoc->secid = conn_sid; 5369 asoc->peer_secid = peer_sid; 5370 5371 /* Set any NetLabel labels including CIPSO/CALIPSO options. */ 5372 return selinux_netlbl_sctp_assoc_request(asoc, skb); 5373 } 5374 5375 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting 5376 * based on their @optname. 5377 */ 5378 static int selinux_sctp_bind_connect(struct sock *sk, int optname, 5379 struct sockaddr *address, 5380 int addrlen) 5381 { 5382 int len, err = 0, walk_size = 0; 5383 void *addr_buf; 5384 struct sockaddr *addr; 5385 struct socket *sock; 5386 5387 if (!selinux_policycap_extsockclass()) 5388 return 0; 5389 5390 /* Process one or more addresses that may be IPv4 or IPv6 */ 5391 sock = sk->sk_socket; 5392 addr_buf = address; 5393 5394 while (walk_size < addrlen) { 5395 if (walk_size + sizeof(sa_family_t) > addrlen) 5396 return -EINVAL; 5397 5398 addr = addr_buf; 5399 switch (addr->sa_family) { 5400 case AF_UNSPEC: 5401 case AF_INET: 5402 len = sizeof(struct sockaddr_in); 5403 break; 5404 case AF_INET6: 5405 len = sizeof(struct sockaddr_in6); 5406 break; 5407 default: 5408 return -EINVAL; 5409 } 5410 5411 if (walk_size + len > addrlen) 5412 return -EINVAL; 5413 5414 err = -EINVAL; 5415 switch (optname) { 5416 /* Bind checks */ 5417 case SCTP_PRIMARY_ADDR: 5418 case SCTP_SET_PEER_PRIMARY_ADDR: 5419 case SCTP_SOCKOPT_BINDX_ADD: 5420 err = selinux_socket_bind(sock, addr, len); 5421 break; 5422 /* Connect checks */ 5423 case SCTP_SOCKOPT_CONNECTX: 5424 case SCTP_PARAM_SET_PRIMARY: 5425 case SCTP_PARAM_ADD_IP: 5426 case SCTP_SENDMSG_CONNECT: 5427 err = selinux_socket_connect_helper(sock, addr, len); 5428 if (err) 5429 return err; 5430 5431 /* As selinux_sctp_bind_connect() is called by the 5432 * SCTP protocol layer, the socket is already locked, 5433 * therefore selinux_netlbl_socket_connect_locked() 5434 * is called here. The situations handled are: 5435 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2), 5436 * whenever a new IP address is added or when a new 5437 * primary address is selected. 5438 * Note that an SCTP connect(2) call happens before 5439 * the SCTP protocol layer and is handled via 5440 * selinux_socket_connect(). 5441 */ 5442 err = selinux_netlbl_socket_connect_locked(sk, addr); 5443 break; 5444 } 5445 5446 if (err) 5447 return err; 5448 5449 addr_buf += len; 5450 walk_size += len; 5451 } 5452 5453 return 0; 5454 } 5455 5456 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */ 5457 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk, 5458 struct sock *newsk) 5459 { 5460 struct sk_security_struct *sksec = sk->sk_security; 5461 struct sk_security_struct *newsksec = newsk->sk_security; 5462 5463 /* If policy does not support SECCLASS_SCTP_SOCKET then call 5464 * the non-sctp clone version. 5465 */ 5466 if (!selinux_policycap_extsockclass()) 5467 return selinux_sk_clone_security(sk, newsk); 5468 5469 newsksec->sid = asoc->secid; 5470 newsksec->peer_sid = asoc->peer_secid; 5471 newsksec->sclass = sksec->sclass; 5472 selinux_netlbl_sctp_sk_clone(sk, newsk); 5473 } 5474 5475 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb, 5476 struct request_sock *req) 5477 { 5478 struct sk_security_struct *sksec = sk->sk_security; 5479 int err; 5480 u16 family = req->rsk_ops->family; 5481 u32 connsid; 5482 u32 peersid; 5483 5484 err = selinux_skb_peerlbl_sid(skb, family, &peersid); 5485 if (err) 5486 return err; 5487 err = selinux_conn_sid(sksec->sid, peersid, &connsid); 5488 if (err) 5489 return err; 5490 req->secid = connsid; 5491 req->peer_secid = peersid; 5492 5493 return selinux_netlbl_inet_conn_request(req, family); 5494 } 5495 5496 static void selinux_inet_csk_clone(struct sock *newsk, 5497 const struct request_sock *req) 5498 { 5499 struct sk_security_struct *newsksec = newsk->sk_security; 5500 5501 newsksec->sid = req->secid; 5502 newsksec->peer_sid = req->peer_secid; 5503 /* NOTE: Ideally, we should also get the isec->sid for the 5504 new socket in sync, but we don't have the isec available yet. 5505 So we will wait until sock_graft to do it, by which 5506 time it will have been created and available. */ 5507 5508 /* We don't need to take any sort of lock here as we are the only 5509 * thread with access to newsksec */ 5510 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family); 5511 } 5512 5513 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb) 5514 { 5515 u16 family = sk->sk_family; 5516 struct sk_security_struct *sksec = sk->sk_security; 5517 5518 /* handle mapped IPv4 packets arriving via IPv6 sockets */ 5519 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP)) 5520 family = PF_INET; 5521 5522 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid); 5523 } 5524 5525 static int selinux_secmark_relabel_packet(u32 sid) 5526 { 5527 const struct task_security_struct *__tsec; 5528 u32 tsid; 5529 5530 __tsec = selinux_cred(current_cred()); 5531 tsid = __tsec->sid; 5532 5533 return avc_has_perm(&selinux_state, 5534 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, 5535 NULL); 5536 } 5537 5538 static void selinux_secmark_refcount_inc(void) 5539 { 5540 atomic_inc(&selinux_secmark_refcount); 5541 } 5542 5543 static void selinux_secmark_refcount_dec(void) 5544 { 5545 atomic_dec(&selinux_secmark_refcount); 5546 } 5547 5548 static void selinux_req_classify_flow(const struct request_sock *req, 5549 struct flowi_common *flic) 5550 { 5551 flic->flowic_secid = req->secid; 5552 } 5553 5554 static int selinux_tun_dev_alloc_security(void **security) 5555 { 5556 struct tun_security_struct *tunsec; 5557 5558 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL); 5559 if (!tunsec) 5560 return -ENOMEM; 5561 tunsec->sid = current_sid(); 5562 5563 *security = tunsec; 5564 return 0; 5565 } 5566 5567 static void selinux_tun_dev_free_security(void *security) 5568 { 5569 kfree(security); 5570 } 5571 5572 static int selinux_tun_dev_create(void) 5573 { 5574 u32 sid = current_sid(); 5575 5576 /* we aren't taking into account the "sockcreate" SID since the socket 5577 * that is being created here is not a socket in the traditional sense, 5578 * instead it is a private sock, accessible only to the kernel, and 5579 * representing a wide range of network traffic spanning multiple 5580 * connections unlike traditional sockets - check the TUN driver to 5581 * get a better understanding of why this socket is special */ 5582 5583 return avc_has_perm(&selinux_state, 5584 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE, 5585 NULL); 5586 } 5587 5588 static int selinux_tun_dev_attach_queue(void *security) 5589 { 5590 struct tun_security_struct *tunsec = security; 5591 5592 return avc_has_perm(&selinux_state, 5593 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET, 5594 TUN_SOCKET__ATTACH_QUEUE, NULL); 5595 } 5596 5597 static int selinux_tun_dev_attach(struct sock *sk, void *security) 5598 { 5599 struct tun_security_struct *tunsec = security; 5600 struct sk_security_struct *sksec = sk->sk_security; 5601 5602 /* we don't currently perform any NetLabel based labeling here and it 5603 * isn't clear that we would want to do so anyway; while we could apply 5604 * labeling without the support of the TUN user the resulting labeled 5605 * traffic from the other end of the connection would almost certainly 5606 * cause confusion to the TUN user that had no idea network labeling 5607 * protocols were being used */ 5608 5609 sksec->sid = tunsec->sid; 5610 sksec->sclass = SECCLASS_TUN_SOCKET; 5611 5612 return 0; 5613 } 5614 5615 static int selinux_tun_dev_open(void *security) 5616 { 5617 struct tun_security_struct *tunsec = security; 5618 u32 sid = current_sid(); 5619 int err; 5620 5621 err = avc_has_perm(&selinux_state, 5622 sid, tunsec->sid, SECCLASS_TUN_SOCKET, 5623 TUN_SOCKET__RELABELFROM, NULL); 5624 if (err) 5625 return err; 5626 err = avc_has_perm(&selinux_state, 5627 sid, sid, SECCLASS_TUN_SOCKET, 5628 TUN_SOCKET__RELABELTO, NULL); 5629 if (err) 5630 return err; 5631 tunsec->sid = sid; 5632 5633 return 0; 5634 } 5635 5636 #ifdef CONFIG_NETFILTER 5637 5638 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb, 5639 const struct nf_hook_state *state) 5640 { 5641 int ifindex; 5642 u16 family; 5643 char *addrp; 5644 u32 peer_sid; 5645 struct common_audit_data ad; 5646 struct lsm_network_audit net = {0,}; 5647 int secmark_active, peerlbl_active; 5648 5649 if (!selinux_policycap_netpeer()) 5650 return NF_ACCEPT; 5651 5652 secmark_active = selinux_secmark_enabled(); 5653 peerlbl_active = selinux_peerlbl_enabled(); 5654 if (!secmark_active && !peerlbl_active) 5655 return NF_ACCEPT; 5656 5657 family = state->pf; 5658 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0) 5659 return NF_DROP; 5660 5661 ifindex = state->in->ifindex; 5662 ad.type = LSM_AUDIT_DATA_NET; 5663 ad.u.net = &net; 5664 ad.u.net->netif = ifindex; 5665 ad.u.net->family = family; 5666 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0) 5667 return NF_DROP; 5668 5669 if (peerlbl_active) { 5670 int err; 5671 5672 err = selinux_inet_sys_rcv_skb(state->net, ifindex, 5673 addrp, family, peer_sid, &ad); 5674 if (err) { 5675 selinux_netlbl_err(skb, family, err, 1); 5676 return NF_DROP; 5677 } 5678 } 5679 5680 if (secmark_active) 5681 if (avc_has_perm(&selinux_state, 5682 peer_sid, skb->secmark, 5683 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad)) 5684 return NF_DROP; 5685 5686 if (netlbl_enabled()) 5687 /* we do this in the FORWARD path and not the POST_ROUTING 5688 * path because we want to make sure we apply the necessary 5689 * labeling before IPsec is applied so we can leverage AH 5690 * protection */ 5691 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0) 5692 return NF_DROP; 5693 5694 return NF_ACCEPT; 5695 } 5696 5697 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb, 5698 const struct nf_hook_state *state) 5699 { 5700 struct sock *sk; 5701 u32 sid; 5702 5703 if (!netlbl_enabled()) 5704 return NF_ACCEPT; 5705 5706 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path 5707 * because we want to make sure we apply the necessary labeling 5708 * before IPsec is applied so we can leverage AH protection */ 5709 sk = skb->sk; 5710 if (sk) { 5711 struct sk_security_struct *sksec; 5712 5713 if (sk_listener(sk)) 5714 /* if the socket is the listening state then this 5715 * packet is a SYN-ACK packet which means it needs to 5716 * be labeled based on the connection/request_sock and 5717 * not the parent socket. unfortunately, we can't 5718 * lookup the request_sock yet as it isn't queued on 5719 * the parent socket until after the SYN-ACK is sent. 5720 * the "solution" is to simply pass the packet as-is 5721 * as any IP option based labeling should be copied 5722 * from the initial connection request (in the IP 5723 * layer). it is far from ideal, but until we get a 5724 * security label in the packet itself this is the 5725 * best we can do. */ 5726 return NF_ACCEPT; 5727 5728 /* standard practice, label using the parent socket */ 5729 sksec = sk->sk_security; 5730 sid = sksec->sid; 5731 } else 5732 sid = SECINITSID_KERNEL; 5733 if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0) 5734 return NF_DROP; 5735 5736 return NF_ACCEPT; 5737 } 5738 5739 5740 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb, 5741 const struct nf_hook_state *state) 5742 { 5743 struct sock *sk; 5744 struct sk_security_struct *sksec; 5745 struct common_audit_data ad; 5746 struct lsm_network_audit net = {0,}; 5747 u8 proto = 0; 5748 5749 sk = skb_to_full_sk(skb); 5750 if (sk == NULL) 5751 return NF_ACCEPT; 5752 sksec = sk->sk_security; 5753 5754 ad.type = LSM_AUDIT_DATA_NET; 5755 ad.u.net = &net; 5756 ad.u.net->netif = state->out->ifindex; 5757 ad.u.net->family = state->pf; 5758 if (selinux_parse_skb(skb, &ad, NULL, 0, &proto)) 5759 return NF_DROP; 5760 5761 if (selinux_secmark_enabled()) 5762 if (avc_has_perm(&selinux_state, 5763 sksec->sid, skb->secmark, 5764 SECCLASS_PACKET, PACKET__SEND, &ad)) 5765 return NF_DROP_ERR(-ECONNREFUSED); 5766 5767 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto)) 5768 return NF_DROP_ERR(-ECONNREFUSED); 5769 5770 return NF_ACCEPT; 5771 } 5772 5773 static unsigned int selinux_ip_postroute(void *priv, 5774 struct sk_buff *skb, 5775 const struct nf_hook_state *state) 5776 { 5777 u16 family; 5778 u32 secmark_perm; 5779 u32 peer_sid; 5780 int ifindex; 5781 struct sock *sk; 5782 struct common_audit_data ad; 5783 struct lsm_network_audit net = {0,}; 5784 char *addrp; 5785 int secmark_active, peerlbl_active; 5786 5787 /* If any sort of compatibility mode is enabled then handoff processing 5788 * to the selinux_ip_postroute_compat() function to deal with the 5789 * special handling. We do this in an attempt to keep this function 5790 * as fast and as clean as possible. */ 5791 if (!selinux_policycap_netpeer()) 5792 return selinux_ip_postroute_compat(skb, state); 5793 5794 secmark_active = selinux_secmark_enabled(); 5795 peerlbl_active = selinux_peerlbl_enabled(); 5796 if (!secmark_active && !peerlbl_active) 5797 return NF_ACCEPT; 5798 5799 sk = skb_to_full_sk(skb); 5800 5801 #ifdef CONFIG_XFRM 5802 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec 5803 * packet transformation so allow the packet to pass without any checks 5804 * since we'll have another chance to perform access control checks 5805 * when the packet is on it's final way out. 5806 * NOTE: there appear to be some IPv6 multicast cases where skb->dst 5807 * is NULL, in this case go ahead and apply access control. 5808 * NOTE: if this is a local socket (skb->sk != NULL) that is in the 5809 * TCP listening state we cannot wait until the XFRM processing 5810 * is done as we will miss out on the SA label if we do; 5811 * unfortunately, this means more work, but it is only once per 5812 * connection. */ 5813 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL && 5814 !(sk && sk_listener(sk))) 5815 return NF_ACCEPT; 5816 #endif 5817 5818 family = state->pf; 5819 if (sk == NULL) { 5820 /* Without an associated socket the packet is either coming 5821 * from the kernel or it is being forwarded; check the packet 5822 * to determine which and if the packet is being forwarded 5823 * query the packet directly to determine the security label. */ 5824 if (skb->skb_iif) { 5825 secmark_perm = PACKET__FORWARD_OUT; 5826 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid)) 5827 return NF_DROP; 5828 } else { 5829 secmark_perm = PACKET__SEND; 5830 peer_sid = SECINITSID_KERNEL; 5831 } 5832 } else if (sk_listener(sk)) { 5833 /* Locally generated packet but the associated socket is in the 5834 * listening state which means this is a SYN-ACK packet. In 5835 * this particular case the correct security label is assigned 5836 * to the connection/request_sock but unfortunately we can't 5837 * query the request_sock as it isn't queued on the parent 5838 * socket until after the SYN-ACK packet is sent; the only 5839 * viable choice is to regenerate the label like we do in 5840 * selinux_inet_conn_request(). See also selinux_ip_output() 5841 * for similar problems. */ 5842 u32 skb_sid; 5843 struct sk_security_struct *sksec; 5844 5845 sksec = sk->sk_security; 5846 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid)) 5847 return NF_DROP; 5848 /* At this point, if the returned skb peerlbl is SECSID_NULL 5849 * and the packet has been through at least one XFRM 5850 * transformation then we must be dealing with the "final" 5851 * form of labeled IPsec packet; since we've already applied 5852 * all of our access controls on this packet we can safely 5853 * pass the packet. */ 5854 if (skb_sid == SECSID_NULL) { 5855 switch (family) { 5856 case PF_INET: 5857 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED) 5858 return NF_ACCEPT; 5859 break; 5860 case PF_INET6: 5861 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED) 5862 return NF_ACCEPT; 5863 break; 5864 default: 5865 return NF_DROP_ERR(-ECONNREFUSED); 5866 } 5867 } 5868 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid)) 5869 return NF_DROP; 5870 secmark_perm = PACKET__SEND; 5871 } else { 5872 /* Locally generated packet, fetch the security label from the 5873 * associated socket. */ 5874 struct sk_security_struct *sksec = sk->sk_security; 5875 peer_sid = sksec->sid; 5876 secmark_perm = PACKET__SEND; 5877 } 5878 5879 ifindex = state->out->ifindex; 5880 ad.type = LSM_AUDIT_DATA_NET; 5881 ad.u.net = &net; 5882 ad.u.net->netif = ifindex; 5883 ad.u.net->family = family; 5884 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL)) 5885 return NF_DROP; 5886 5887 if (secmark_active) 5888 if (avc_has_perm(&selinux_state, 5889 peer_sid, skb->secmark, 5890 SECCLASS_PACKET, secmark_perm, &ad)) 5891 return NF_DROP_ERR(-ECONNREFUSED); 5892 5893 if (peerlbl_active) { 5894 u32 if_sid; 5895 u32 node_sid; 5896 5897 if (sel_netif_sid(state->net, ifindex, &if_sid)) 5898 return NF_DROP; 5899 if (avc_has_perm(&selinux_state, 5900 peer_sid, if_sid, 5901 SECCLASS_NETIF, NETIF__EGRESS, &ad)) 5902 return NF_DROP_ERR(-ECONNREFUSED); 5903 5904 if (sel_netnode_sid(addrp, family, &node_sid)) 5905 return NF_DROP; 5906 if (avc_has_perm(&selinux_state, 5907 peer_sid, node_sid, 5908 SECCLASS_NODE, NODE__SENDTO, &ad)) 5909 return NF_DROP_ERR(-ECONNREFUSED); 5910 } 5911 5912 return NF_ACCEPT; 5913 } 5914 #endif /* CONFIG_NETFILTER */ 5915 5916 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb) 5917 { 5918 int rc = 0; 5919 unsigned int msg_len; 5920 unsigned int data_len = skb->len; 5921 unsigned char *data = skb->data; 5922 struct nlmsghdr *nlh; 5923 struct sk_security_struct *sksec = sk->sk_security; 5924 u16 sclass = sksec->sclass; 5925 u32 perm; 5926 5927 while (data_len >= nlmsg_total_size(0)) { 5928 nlh = (struct nlmsghdr *)data; 5929 5930 /* NOTE: the nlmsg_len field isn't reliably set by some netlink 5931 * users which means we can't reject skb's with bogus 5932 * length fields; our solution is to follow what 5933 * netlink_rcv_skb() does and simply skip processing at 5934 * messages with length fields that are clearly junk 5935 */ 5936 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len) 5937 return 0; 5938 5939 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm); 5940 if (rc == 0) { 5941 rc = sock_has_perm(sk, perm); 5942 if (rc) 5943 return rc; 5944 } else if (rc == -EINVAL) { 5945 /* -EINVAL is a missing msg/perm mapping */ 5946 pr_warn_ratelimited("SELinux: unrecognized netlink" 5947 " message: protocol=%hu nlmsg_type=%hu sclass=%s" 5948 " pid=%d comm=%s\n", 5949 sk->sk_protocol, nlh->nlmsg_type, 5950 secclass_map[sclass - 1].name, 5951 task_pid_nr(current), current->comm); 5952 if (enforcing_enabled(&selinux_state) && 5953 !security_get_allow_unknown(&selinux_state)) 5954 return rc; 5955 rc = 0; 5956 } else if (rc == -ENOENT) { 5957 /* -ENOENT is a missing socket/class mapping, ignore */ 5958 rc = 0; 5959 } else { 5960 return rc; 5961 } 5962 5963 /* move to the next message after applying netlink padding */ 5964 msg_len = NLMSG_ALIGN(nlh->nlmsg_len); 5965 if (msg_len >= data_len) 5966 return 0; 5967 data_len -= msg_len; 5968 data += msg_len; 5969 } 5970 5971 return rc; 5972 } 5973 5974 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass) 5975 { 5976 isec->sclass = sclass; 5977 isec->sid = current_sid(); 5978 } 5979 5980 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms, 5981 u32 perms) 5982 { 5983 struct ipc_security_struct *isec; 5984 struct common_audit_data ad; 5985 u32 sid = current_sid(); 5986 5987 isec = selinux_ipc(ipc_perms); 5988 5989 ad.type = LSM_AUDIT_DATA_IPC; 5990 ad.u.ipc_id = ipc_perms->key; 5991 5992 return avc_has_perm(&selinux_state, 5993 sid, isec->sid, isec->sclass, perms, &ad); 5994 } 5995 5996 static int selinux_msg_msg_alloc_security(struct msg_msg *msg) 5997 { 5998 struct msg_security_struct *msec; 5999 6000 msec = selinux_msg_msg(msg); 6001 msec->sid = SECINITSID_UNLABELED; 6002 6003 return 0; 6004 } 6005 6006 /* message queue security operations */ 6007 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq) 6008 { 6009 struct ipc_security_struct *isec; 6010 struct common_audit_data ad; 6011 u32 sid = current_sid(); 6012 int rc; 6013 6014 isec = selinux_ipc(msq); 6015 ipc_init_security(isec, SECCLASS_MSGQ); 6016 6017 ad.type = LSM_AUDIT_DATA_IPC; 6018 ad.u.ipc_id = msq->key; 6019 6020 rc = avc_has_perm(&selinux_state, 6021 sid, isec->sid, SECCLASS_MSGQ, 6022 MSGQ__CREATE, &ad); 6023 return rc; 6024 } 6025 6026 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg) 6027 { 6028 struct ipc_security_struct *isec; 6029 struct common_audit_data ad; 6030 u32 sid = current_sid(); 6031 6032 isec = selinux_ipc(msq); 6033 6034 ad.type = LSM_AUDIT_DATA_IPC; 6035 ad.u.ipc_id = msq->key; 6036 6037 return avc_has_perm(&selinux_state, 6038 sid, isec->sid, SECCLASS_MSGQ, 6039 MSGQ__ASSOCIATE, &ad); 6040 } 6041 6042 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd) 6043 { 6044 int err; 6045 int perms; 6046 6047 switch (cmd) { 6048 case IPC_INFO: 6049 case MSG_INFO: 6050 /* No specific object, just general system-wide information. */ 6051 return avc_has_perm(&selinux_state, 6052 current_sid(), SECINITSID_KERNEL, 6053 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 6054 case IPC_STAT: 6055 case MSG_STAT: 6056 case MSG_STAT_ANY: 6057 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE; 6058 break; 6059 case IPC_SET: 6060 perms = MSGQ__SETATTR; 6061 break; 6062 case IPC_RMID: 6063 perms = MSGQ__DESTROY; 6064 break; 6065 default: 6066 return 0; 6067 } 6068 6069 err = ipc_has_perm(msq, perms); 6070 return err; 6071 } 6072 6073 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg) 6074 { 6075 struct ipc_security_struct *isec; 6076 struct msg_security_struct *msec; 6077 struct common_audit_data ad; 6078 u32 sid = current_sid(); 6079 int rc; 6080 6081 isec = selinux_ipc(msq); 6082 msec = selinux_msg_msg(msg); 6083 6084 /* 6085 * First time through, need to assign label to the message 6086 */ 6087 if (msec->sid == SECINITSID_UNLABELED) { 6088 /* 6089 * Compute new sid based on current process and 6090 * message queue this message will be stored in 6091 */ 6092 rc = security_transition_sid(&selinux_state, sid, isec->sid, 6093 SECCLASS_MSG, NULL, &msec->sid); 6094 if (rc) 6095 return rc; 6096 } 6097 6098 ad.type = LSM_AUDIT_DATA_IPC; 6099 ad.u.ipc_id = msq->key; 6100 6101 /* Can this process write to the queue? */ 6102 rc = avc_has_perm(&selinux_state, 6103 sid, isec->sid, SECCLASS_MSGQ, 6104 MSGQ__WRITE, &ad); 6105 if (!rc) 6106 /* Can this process send the message */ 6107 rc = avc_has_perm(&selinux_state, 6108 sid, msec->sid, SECCLASS_MSG, 6109 MSG__SEND, &ad); 6110 if (!rc) 6111 /* Can the message be put in the queue? */ 6112 rc = avc_has_perm(&selinux_state, 6113 msec->sid, isec->sid, SECCLASS_MSGQ, 6114 MSGQ__ENQUEUE, &ad); 6115 6116 return rc; 6117 } 6118 6119 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg, 6120 struct task_struct *target, 6121 long type, int mode) 6122 { 6123 struct ipc_security_struct *isec; 6124 struct msg_security_struct *msec; 6125 struct common_audit_data ad; 6126 u32 sid = task_sid_obj(target); 6127 int rc; 6128 6129 isec = selinux_ipc(msq); 6130 msec = selinux_msg_msg(msg); 6131 6132 ad.type = LSM_AUDIT_DATA_IPC; 6133 ad.u.ipc_id = msq->key; 6134 6135 rc = avc_has_perm(&selinux_state, 6136 sid, isec->sid, 6137 SECCLASS_MSGQ, MSGQ__READ, &ad); 6138 if (!rc) 6139 rc = avc_has_perm(&selinux_state, 6140 sid, msec->sid, 6141 SECCLASS_MSG, MSG__RECEIVE, &ad); 6142 return rc; 6143 } 6144 6145 /* Shared Memory security operations */ 6146 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp) 6147 { 6148 struct ipc_security_struct *isec; 6149 struct common_audit_data ad; 6150 u32 sid = current_sid(); 6151 int rc; 6152 6153 isec = selinux_ipc(shp); 6154 ipc_init_security(isec, SECCLASS_SHM); 6155 6156 ad.type = LSM_AUDIT_DATA_IPC; 6157 ad.u.ipc_id = shp->key; 6158 6159 rc = avc_has_perm(&selinux_state, 6160 sid, isec->sid, SECCLASS_SHM, 6161 SHM__CREATE, &ad); 6162 return rc; 6163 } 6164 6165 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg) 6166 { 6167 struct ipc_security_struct *isec; 6168 struct common_audit_data ad; 6169 u32 sid = current_sid(); 6170 6171 isec = selinux_ipc(shp); 6172 6173 ad.type = LSM_AUDIT_DATA_IPC; 6174 ad.u.ipc_id = shp->key; 6175 6176 return avc_has_perm(&selinux_state, 6177 sid, isec->sid, SECCLASS_SHM, 6178 SHM__ASSOCIATE, &ad); 6179 } 6180 6181 /* Note, at this point, shp is locked down */ 6182 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd) 6183 { 6184 int perms; 6185 int err; 6186 6187 switch (cmd) { 6188 case IPC_INFO: 6189 case SHM_INFO: 6190 /* No specific object, just general system-wide information. */ 6191 return avc_has_perm(&selinux_state, 6192 current_sid(), SECINITSID_KERNEL, 6193 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 6194 case IPC_STAT: 6195 case SHM_STAT: 6196 case SHM_STAT_ANY: 6197 perms = SHM__GETATTR | SHM__ASSOCIATE; 6198 break; 6199 case IPC_SET: 6200 perms = SHM__SETATTR; 6201 break; 6202 case SHM_LOCK: 6203 case SHM_UNLOCK: 6204 perms = SHM__LOCK; 6205 break; 6206 case IPC_RMID: 6207 perms = SHM__DESTROY; 6208 break; 6209 default: 6210 return 0; 6211 } 6212 6213 err = ipc_has_perm(shp, perms); 6214 return err; 6215 } 6216 6217 static int selinux_shm_shmat(struct kern_ipc_perm *shp, 6218 char __user *shmaddr, int shmflg) 6219 { 6220 u32 perms; 6221 6222 if (shmflg & SHM_RDONLY) 6223 perms = SHM__READ; 6224 else 6225 perms = SHM__READ | SHM__WRITE; 6226 6227 return ipc_has_perm(shp, perms); 6228 } 6229 6230 /* Semaphore security operations */ 6231 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma) 6232 { 6233 struct ipc_security_struct *isec; 6234 struct common_audit_data ad; 6235 u32 sid = current_sid(); 6236 int rc; 6237 6238 isec = selinux_ipc(sma); 6239 ipc_init_security(isec, SECCLASS_SEM); 6240 6241 ad.type = LSM_AUDIT_DATA_IPC; 6242 ad.u.ipc_id = sma->key; 6243 6244 rc = avc_has_perm(&selinux_state, 6245 sid, isec->sid, SECCLASS_SEM, 6246 SEM__CREATE, &ad); 6247 return rc; 6248 } 6249 6250 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg) 6251 { 6252 struct ipc_security_struct *isec; 6253 struct common_audit_data ad; 6254 u32 sid = current_sid(); 6255 6256 isec = selinux_ipc(sma); 6257 6258 ad.type = LSM_AUDIT_DATA_IPC; 6259 ad.u.ipc_id = sma->key; 6260 6261 return avc_has_perm(&selinux_state, 6262 sid, isec->sid, SECCLASS_SEM, 6263 SEM__ASSOCIATE, &ad); 6264 } 6265 6266 /* Note, at this point, sma is locked down */ 6267 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd) 6268 { 6269 int err; 6270 u32 perms; 6271 6272 switch (cmd) { 6273 case IPC_INFO: 6274 case SEM_INFO: 6275 /* No specific object, just general system-wide information. */ 6276 return avc_has_perm(&selinux_state, 6277 current_sid(), SECINITSID_KERNEL, 6278 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL); 6279 case GETPID: 6280 case GETNCNT: 6281 case GETZCNT: 6282 perms = SEM__GETATTR; 6283 break; 6284 case GETVAL: 6285 case GETALL: 6286 perms = SEM__READ; 6287 break; 6288 case SETVAL: 6289 case SETALL: 6290 perms = SEM__WRITE; 6291 break; 6292 case IPC_RMID: 6293 perms = SEM__DESTROY; 6294 break; 6295 case IPC_SET: 6296 perms = SEM__SETATTR; 6297 break; 6298 case IPC_STAT: 6299 case SEM_STAT: 6300 case SEM_STAT_ANY: 6301 perms = SEM__GETATTR | SEM__ASSOCIATE; 6302 break; 6303 default: 6304 return 0; 6305 } 6306 6307 err = ipc_has_perm(sma, perms); 6308 return err; 6309 } 6310 6311 static int selinux_sem_semop(struct kern_ipc_perm *sma, 6312 struct sembuf *sops, unsigned nsops, int alter) 6313 { 6314 u32 perms; 6315 6316 if (alter) 6317 perms = SEM__READ | SEM__WRITE; 6318 else 6319 perms = SEM__READ; 6320 6321 return ipc_has_perm(sma, perms); 6322 } 6323 6324 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag) 6325 { 6326 u32 av = 0; 6327 6328 av = 0; 6329 if (flag & S_IRUGO) 6330 av |= IPC__UNIX_READ; 6331 if (flag & S_IWUGO) 6332 av |= IPC__UNIX_WRITE; 6333 6334 if (av == 0) 6335 return 0; 6336 6337 return ipc_has_perm(ipcp, av); 6338 } 6339 6340 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid) 6341 { 6342 struct ipc_security_struct *isec = selinux_ipc(ipcp); 6343 *secid = isec->sid; 6344 } 6345 6346 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode) 6347 { 6348 if (inode) 6349 inode_doinit_with_dentry(inode, dentry); 6350 } 6351 6352 static int selinux_getprocattr(struct task_struct *p, 6353 char *name, char **value) 6354 { 6355 const struct task_security_struct *__tsec; 6356 u32 sid; 6357 int error; 6358 unsigned len; 6359 6360 rcu_read_lock(); 6361 __tsec = selinux_cred(__task_cred(p)); 6362 6363 if (current != p) { 6364 error = avc_has_perm(&selinux_state, 6365 current_sid(), __tsec->sid, 6366 SECCLASS_PROCESS, PROCESS__GETATTR, NULL); 6367 if (error) 6368 goto bad; 6369 } 6370 6371 if (!strcmp(name, "current")) 6372 sid = __tsec->sid; 6373 else if (!strcmp(name, "prev")) 6374 sid = __tsec->osid; 6375 else if (!strcmp(name, "exec")) 6376 sid = __tsec->exec_sid; 6377 else if (!strcmp(name, "fscreate")) 6378 sid = __tsec->create_sid; 6379 else if (!strcmp(name, "keycreate")) 6380 sid = __tsec->keycreate_sid; 6381 else if (!strcmp(name, "sockcreate")) 6382 sid = __tsec->sockcreate_sid; 6383 else { 6384 error = -EINVAL; 6385 goto bad; 6386 } 6387 rcu_read_unlock(); 6388 6389 if (!sid) 6390 return 0; 6391 6392 error = security_sid_to_context(&selinux_state, sid, value, &len); 6393 if (error) 6394 return error; 6395 return len; 6396 6397 bad: 6398 rcu_read_unlock(); 6399 return error; 6400 } 6401 6402 static int selinux_setprocattr(const char *name, void *value, size_t size) 6403 { 6404 struct task_security_struct *tsec; 6405 struct cred *new; 6406 u32 mysid = current_sid(), sid = 0, ptsid; 6407 int error; 6408 char *str = value; 6409 6410 /* 6411 * Basic control over ability to set these attributes at all. 6412 */ 6413 if (!strcmp(name, "exec")) 6414 error = avc_has_perm(&selinux_state, 6415 mysid, mysid, SECCLASS_PROCESS, 6416 PROCESS__SETEXEC, NULL); 6417 else if (!strcmp(name, "fscreate")) 6418 error = avc_has_perm(&selinux_state, 6419 mysid, mysid, SECCLASS_PROCESS, 6420 PROCESS__SETFSCREATE, NULL); 6421 else if (!strcmp(name, "keycreate")) 6422 error = avc_has_perm(&selinux_state, 6423 mysid, mysid, SECCLASS_PROCESS, 6424 PROCESS__SETKEYCREATE, NULL); 6425 else if (!strcmp(name, "sockcreate")) 6426 error = avc_has_perm(&selinux_state, 6427 mysid, mysid, SECCLASS_PROCESS, 6428 PROCESS__SETSOCKCREATE, NULL); 6429 else if (!strcmp(name, "current")) 6430 error = avc_has_perm(&selinux_state, 6431 mysid, mysid, SECCLASS_PROCESS, 6432 PROCESS__SETCURRENT, NULL); 6433 else 6434 error = -EINVAL; 6435 if (error) 6436 return error; 6437 6438 /* Obtain a SID for the context, if one was specified. */ 6439 if (size && str[0] && str[0] != '\n') { 6440 if (str[size-1] == '\n') { 6441 str[size-1] = 0; 6442 size--; 6443 } 6444 error = security_context_to_sid(&selinux_state, value, size, 6445 &sid, GFP_KERNEL); 6446 if (error == -EINVAL && !strcmp(name, "fscreate")) { 6447 if (!has_cap_mac_admin(true)) { 6448 struct audit_buffer *ab; 6449 size_t audit_size; 6450 6451 /* We strip a nul only if it is at the end, otherwise the 6452 * context contains a nul and we should audit that */ 6453 if (str[size - 1] == '\0') 6454 audit_size = size - 1; 6455 else 6456 audit_size = size; 6457 ab = audit_log_start(audit_context(), 6458 GFP_ATOMIC, 6459 AUDIT_SELINUX_ERR); 6460 if (!ab) 6461 return error; 6462 audit_log_format(ab, "op=fscreate invalid_context="); 6463 audit_log_n_untrustedstring(ab, value, audit_size); 6464 audit_log_end(ab); 6465 6466 return error; 6467 } 6468 error = security_context_to_sid_force( 6469 &selinux_state, 6470 value, size, &sid); 6471 } 6472 if (error) 6473 return error; 6474 } 6475 6476 new = prepare_creds(); 6477 if (!new) 6478 return -ENOMEM; 6479 6480 /* Permission checking based on the specified context is 6481 performed during the actual operation (execve, 6482 open/mkdir/...), when we know the full context of the 6483 operation. See selinux_bprm_creds_for_exec for the execve 6484 checks and may_create for the file creation checks. The 6485 operation will then fail if the context is not permitted. */ 6486 tsec = selinux_cred(new); 6487 if (!strcmp(name, "exec")) { 6488 tsec->exec_sid = sid; 6489 } else if (!strcmp(name, "fscreate")) { 6490 tsec->create_sid = sid; 6491 } else if (!strcmp(name, "keycreate")) { 6492 if (sid) { 6493 error = avc_has_perm(&selinux_state, mysid, sid, 6494 SECCLASS_KEY, KEY__CREATE, NULL); 6495 if (error) 6496 goto abort_change; 6497 } 6498 tsec->keycreate_sid = sid; 6499 } else if (!strcmp(name, "sockcreate")) { 6500 tsec->sockcreate_sid = sid; 6501 } else if (!strcmp(name, "current")) { 6502 error = -EINVAL; 6503 if (sid == 0) 6504 goto abort_change; 6505 6506 /* Only allow single threaded processes to change context */ 6507 error = -EPERM; 6508 if (!current_is_single_threaded()) { 6509 error = security_bounded_transition(&selinux_state, 6510 tsec->sid, sid); 6511 if (error) 6512 goto abort_change; 6513 } 6514 6515 /* Check permissions for the transition. */ 6516 error = avc_has_perm(&selinux_state, 6517 tsec->sid, sid, SECCLASS_PROCESS, 6518 PROCESS__DYNTRANSITION, NULL); 6519 if (error) 6520 goto abort_change; 6521 6522 /* Check for ptracing, and update the task SID if ok. 6523 Otherwise, leave SID unchanged and fail. */ 6524 ptsid = ptrace_parent_sid(); 6525 if (ptsid != 0) { 6526 error = avc_has_perm(&selinux_state, 6527 ptsid, sid, SECCLASS_PROCESS, 6528 PROCESS__PTRACE, NULL); 6529 if (error) 6530 goto abort_change; 6531 } 6532 6533 tsec->sid = sid; 6534 } else { 6535 error = -EINVAL; 6536 goto abort_change; 6537 } 6538 6539 commit_creds(new); 6540 return size; 6541 6542 abort_change: 6543 abort_creds(new); 6544 return error; 6545 } 6546 6547 static int selinux_ismaclabel(const char *name) 6548 { 6549 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0); 6550 } 6551 6552 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen) 6553 { 6554 return security_sid_to_context(&selinux_state, secid, 6555 secdata, seclen); 6556 } 6557 6558 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid) 6559 { 6560 return security_context_to_sid(&selinux_state, secdata, seclen, 6561 secid, GFP_KERNEL); 6562 } 6563 6564 static void selinux_release_secctx(char *secdata, u32 seclen) 6565 { 6566 kfree(secdata); 6567 } 6568 6569 static void selinux_inode_invalidate_secctx(struct inode *inode) 6570 { 6571 struct inode_security_struct *isec = selinux_inode(inode); 6572 6573 spin_lock(&isec->lock); 6574 isec->initialized = LABEL_INVALID; 6575 spin_unlock(&isec->lock); 6576 } 6577 6578 /* 6579 * called with inode->i_mutex locked 6580 */ 6581 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen) 6582 { 6583 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, 6584 ctx, ctxlen, 0); 6585 /* Do not return error when suppressing label (SBLABEL_MNT not set). */ 6586 return rc == -EOPNOTSUPP ? 0 : rc; 6587 } 6588 6589 /* 6590 * called with inode->i_mutex locked 6591 */ 6592 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen) 6593 { 6594 return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX, 6595 ctx, ctxlen, 0); 6596 } 6597 6598 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen) 6599 { 6600 int len = 0; 6601 len = selinux_inode_getsecurity(&init_user_ns, inode, 6602 XATTR_SELINUX_SUFFIX, ctx, true); 6603 if (len < 0) 6604 return len; 6605 *ctxlen = len; 6606 return 0; 6607 } 6608 #ifdef CONFIG_KEYS 6609 6610 static int selinux_key_alloc(struct key *k, const struct cred *cred, 6611 unsigned long flags) 6612 { 6613 const struct task_security_struct *tsec; 6614 struct key_security_struct *ksec; 6615 6616 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL); 6617 if (!ksec) 6618 return -ENOMEM; 6619 6620 tsec = selinux_cred(cred); 6621 if (tsec->keycreate_sid) 6622 ksec->sid = tsec->keycreate_sid; 6623 else 6624 ksec->sid = tsec->sid; 6625 6626 k->security = ksec; 6627 return 0; 6628 } 6629 6630 static void selinux_key_free(struct key *k) 6631 { 6632 struct key_security_struct *ksec = k->security; 6633 6634 k->security = NULL; 6635 kfree(ksec); 6636 } 6637 6638 static int selinux_key_permission(key_ref_t key_ref, 6639 const struct cred *cred, 6640 enum key_need_perm need_perm) 6641 { 6642 struct key *key; 6643 struct key_security_struct *ksec; 6644 u32 perm, sid; 6645 6646 switch (need_perm) { 6647 case KEY_NEED_VIEW: 6648 perm = KEY__VIEW; 6649 break; 6650 case KEY_NEED_READ: 6651 perm = KEY__READ; 6652 break; 6653 case KEY_NEED_WRITE: 6654 perm = KEY__WRITE; 6655 break; 6656 case KEY_NEED_SEARCH: 6657 perm = KEY__SEARCH; 6658 break; 6659 case KEY_NEED_LINK: 6660 perm = KEY__LINK; 6661 break; 6662 case KEY_NEED_SETATTR: 6663 perm = KEY__SETATTR; 6664 break; 6665 case KEY_NEED_UNLINK: 6666 case KEY_SYSADMIN_OVERRIDE: 6667 case KEY_AUTHTOKEN_OVERRIDE: 6668 case KEY_DEFER_PERM_CHECK: 6669 return 0; 6670 default: 6671 WARN_ON(1); 6672 return -EPERM; 6673 6674 } 6675 6676 sid = cred_sid(cred); 6677 key = key_ref_to_ptr(key_ref); 6678 ksec = key->security; 6679 6680 return avc_has_perm(&selinux_state, 6681 sid, ksec->sid, SECCLASS_KEY, perm, NULL); 6682 } 6683 6684 static int selinux_key_getsecurity(struct key *key, char **_buffer) 6685 { 6686 struct key_security_struct *ksec = key->security; 6687 char *context = NULL; 6688 unsigned len; 6689 int rc; 6690 6691 rc = security_sid_to_context(&selinux_state, ksec->sid, 6692 &context, &len); 6693 if (!rc) 6694 rc = len; 6695 *_buffer = context; 6696 return rc; 6697 } 6698 6699 #ifdef CONFIG_KEY_NOTIFICATIONS 6700 static int selinux_watch_key(struct key *key) 6701 { 6702 struct key_security_struct *ksec = key->security; 6703 u32 sid = current_sid(); 6704 6705 return avc_has_perm(&selinux_state, 6706 sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL); 6707 } 6708 #endif 6709 #endif 6710 6711 #ifdef CONFIG_SECURITY_INFINIBAND 6712 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val) 6713 { 6714 struct common_audit_data ad; 6715 int err; 6716 u32 sid = 0; 6717 struct ib_security_struct *sec = ib_sec; 6718 struct lsm_ibpkey_audit ibpkey; 6719 6720 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid); 6721 if (err) 6722 return err; 6723 6724 ad.type = LSM_AUDIT_DATA_IBPKEY; 6725 ibpkey.subnet_prefix = subnet_prefix; 6726 ibpkey.pkey = pkey_val; 6727 ad.u.ibpkey = &ibpkey; 6728 return avc_has_perm(&selinux_state, 6729 sec->sid, sid, 6730 SECCLASS_INFINIBAND_PKEY, 6731 INFINIBAND_PKEY__ACCESS, &ad); 6732 } 6733 6734 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name, 6735 u8 port_num) 6736 { 6737 struct common_audit_data ad; 6738 int err; 6739 u32 sid = 0; 6740 struct ib_security_struct *sec = ib_sec; 6741 struct lsm_ibendport_audit ibendport; 6742 6743 err = security_ib_endport_sid(&selinux_state, dev_name, port_num, 6744 &sid); 6745 6746 if (err) 6747 return err; 6748 6749 ad.type = LSM_AUDIT_DATA_IBENDPORT; 6750 ibendport.dev_name = dev_name; 6751 ibendport.port = port_num; 6752 ad.u.ibendport = &ibendport; 6753 return avc_has_perm(&selinux_state, 6754 sec->sid, sid, 6755 SECCLASS_INFINIBAND_ENDPORT, 6756 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad); 6757 } 6758 6759 static int selinux_ib_alloc_security(void **ib_sec) 6760 { 6761 struct ib_security_struct *sec; 6762 6763 sec = kzalloc(sizeof(*sec), GFP_KERNEL); 6764 if (!sec) 6765 return -ENOMEM; 6766 sec->sid = current_sid(); 6767 6768 *ib_sec = sec; 6769 return 0; 6770 } 6771 6772 static void selinux_ib_free_security(void *ib_sec) 6773 { 6774 kfree(ib_sec); 6775 } 6776 #endif 6777 6778 #ifdef CONFIG_BPF_SYSCALL 6779 static int selinux_bpf(int cmd, union bpf_attr *attr, 6780 unsigned int size) 6781 { 6782 u32 sid = current_sid(); 6783 int ret; 6784 6785 switch (cmd) { 6786 case BPF_MAP_CREATE: 6787 ret = avc_has_perm(&selinux_state, 6788 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE, 6789 NULL); 6790 break; 6791 case BPF_PROG_LOAD: 6792 ret = avc_has_perm(&selinux_state, 6793 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD, 6794 NULL); 6795 break; 6796 default: 6797 ret = 0; 6798 break; 6799 } 6800 6801 return ret; 6802 } 6803 6804 static u32 bpf_map_fmode_to_av(fmode_t fmode) 6805 { 6806 u32 av = 0; 6807 6808 if (fmode & FMODE_READ) 6809 av |= BPF__MAP_READ; 6810 if (fmode & FMODE_WRITE) 6811 av |= BPF__MAP_WRITE; 6812 return av; 6813 } 6814 6815 /* This function will check the file pass through unix socket or binder to see 6816 * if it is a bpf related object. And apply correspinding checks on the bpf 6817 * object based on the type. The bpf maps and programs, not like other files and 6818 * socket, are using a shared anonymous inode inside the kernel as their inode. 6819 * So checking that inode cannot identify if the process have privilege to 6820 * access the bpf object and that's why we have to add this additional check in 6821 * selinux_file_receive and selinux_binder_transfer_files. 6822 */ 6823 static int bpf_fd_pass(struct file *file, u32 sid) 6824 { 6825 struct bpf_security_struct *bpfsec; 6826 struct bpf_prog *prog; 6827 struct bpf_map *map; 6828 int ret; 6829 6830 if (file->f_op == &bpf_map_fops) { 6831 map = file->private_data; 6832 bpfsec = map->security; 6833 ret = avc_has_perm(&selinux_state, 6834 sid, bpfsec->sid, SECCLASS_BPF, 6835 bpf_map_fmode_to_av(file->f_mode), NULL); 6836 if (ret) 6837 return ret; 6838 } else if (file->f_op == &bpf_prog_fops) { 6839 prog = file->private_data; 6840 bpfsec = prog->aux->security; 6841 ret = avc_has_perm(&selinux_state, 6842 sid, bpfsec->sid, SECCLASS_BPF, 6843 BPF__PROG_RUN, NULL); 6844 if (ret) 6845 return ret; 6846 } 6847 return 0; 6848 } 6849 6850 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode) 6851 { 6852 u32 sid = current_sid(); 6853 struct bpf_security_struct *bpfsec; 6854 6855 bpfsec = map->security; 6856 return avc_has_perm(&selinux_state, 6857 sid, bpfsec->sid, SECCLASS_BPF, 6858 bpf_map_fmode_to_av(fmode), NULL); 6859 } 6860 6861 static int selinux_bpf_prog(struct bpf_prog *prog) 6862 { 6863 u32 sid = current_sid(); 6864 struct bpf_security_struct *bpfsec; 6865 6866 bpfsec = prog->aux->security; 6867 return avc_has_perm(&selinux_state, 6868 sid, bpfsec->sid, SECCLASS_BPF, 6869 BPF__PROG_RUN, NULL); 6870 } 6871 6872 static int selinux_bpf_map_alloc(struct bpf_map *map) 6873 { 6874 struct bpf_security_struct *bpfsec; 6875 6876 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL); 6877 if (!bpfsec) 6878 return -ENOMEM; 6879 6880 bpfsec->sid = current_sid(); 6881 map->security = bpfsec; 6882 6883 return 0; 6884 } 6885 6886 static void selinux_bpf_map_free(struct bpf_map *map) 6887 { 6888 struct bpf_security_struct *bpfsec = map->security; 6889 6890 map->security = NULL; 6891 kfree(bpfsec); 6892 } 6893 6894 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux) 6895 { 6896 struct bpf_security_struct *bpfsec; 6897 6898 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL); 6899 if (!bpfsec) 6900 return -ENOMEM; 6901 6902 bpfsec->sid = current_sid(); 6903 aux->security = bpfsec; 6904 6905 return 0; 6906 } 6907 6908 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux) 6909 { 6910 struct bpf_security_struct *bpfsec = aux->security; 6911 6912 aux->security = NULL; 6913 kfree(bpfsec); 6914 } 6915 #endif 6916 6917 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = { 6918 .lbs_cred = sizeof(struct task_security_struct), 6919 .lbs_file = sizeof(struct file_security_struct), 6920 .lbs_inode = sizeof(struct inode_security_struct), 6921 .lbs_ipc = sizeof(struct ipc_security_struct), 6922 .lbs_msg_msg = sizeof(struct msg_security_struct), 6923 .lbs_superblock = sizeof(struct superblock_security_struct), 6924 }; 6925 6926 #ifdef CONFIG_PERF_EVENTS 6927 static int selinux_perf_event_open(struct perf_event_attr *attr, int type) 6928 { 6929 u32 requested, sid = current_sid(); 6930 6931 if (type == PERF_SECURITY_OPEN) 6932 requested = PERF_EVENT__OPEN; 6933 else if (type == PERF_SECURITY_CPU) 6934 requested = PERF_EVENT__CPU; 6935 else if (type == PERF_SECURITY_KERNEL) 6936 requested = PERF_EVENT__KERNEL; 6937 else if (type == PERF_SECURITY_TRACEPOINT) 6938 requested = PERF_EVENT__TRACEPOINT; 6939 else 6940 return -EINVAL; 6941 6942 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT, 6943 requested, NULL); 6944 } 6945 6946 static int selinux_perf_event_alloc(struct perf_event *event) 6947 { 6948 struct perf_event_security_struct *perfsec; 6949 6950 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL); 6951 if (!perfsec) 6952 return -ENOMEM; 6953 6954 perfsec->sid = current_sid(); 6955 event->security = perfsec; 6956 6957 return 0; 6958 } 6959 6960 static void selinux_perf_event_free(struct perf_event *event) 6961 { 6962 struct perf_event_security_struct *perfsec = event->security; 6963 6964 event->security = NULL; 6965 kfree(perfsec); 6966 } 6967 6968 static int selinux_perf_event_read(struct perf_event *event) 6969 { 6970 struct perf_event_security_struct *perfsec = event->security; 6971 u32 sid = current_sid(); 6972 6973 return avc_has_perm(&selinux_state, sid, perfsec->sid, 6974 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL); 6975 } 6976 6977 static int selinux_perf_event_write(struct perf_event *event) 6978 { 6979 struct perf_event_security_struct *perfsec = event->security; 6980 u32 sid = current_sid(); 6981 6982 return avc_has_perm(&selinux_state, sid, perfsec->sid, 6983 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL); 6984 } 6985 #endif 6986 6987 #ifdef CONFIG_IO_URING 6988 /** 6989 * selinux_uring_override_creds - check the requested cred override 6990 * @new: the target creds 6991 * 6992 * Check to see if the current task is allowed to override it's credentials 6993 * to service an io_uring operation. 6994 */ 6995 static int selinux_uring_override_creds(const struct cred *new) 6996 { 6997 return avc_has_perm(&selinux_state, current_sid(), cred_sid(new), 6998 SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL); 6999 } 7000 7001 /** 7002 * selinux_uring_sqpoll - check if a io_uring polling thread can be created 7003 * 7004 * Check to see if the current task is allowed to create a new io_uring 7005 * kernel polling thread. 7006 */ 7007 static int selinux_uring_sqpoll(void) 7008 { 7009 int sid = current_sid(); 7010 7011 return avc_has_perm(&selinux_state, sid, sid, 7012 SECCLASS_IO_URING, IO_URING__SQPOLL, NULL); 7013 } 7014 #endif /* CONFIG_IO_URING */ 7015 7016 /* 7017 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order: 7018 * 1. any hooks that don't belong to (2.) or (3.) below, 7019 * 2. hooks that both access structures allocated by other hooks, and allocate 7020 * structures that can be later accessed by other hooks (mostly "cloning" 7021 * hooks), 7022 * 3. hooks that only allocate structures that can be later accessed by other 7023 * hooks ("allocating" hooks). 7024 * 7025 * Please follow block comment delimiters in the list to keep this order. 7026 * 7027 * This ordering is needed for SELinux runtime disable to work at least somewhat 7028 * safely. Breaking the ordering rules above might lead to NULL pointer derefs 7029 * when disabling SELinux at runtime. 7030 */ 7031 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = { 7032 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr), 7033 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction), 7034 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder), 7035 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file), 7036 7037 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check), 7038 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme), 7039 LSM_HOOK_INIT(capget, selinux_capget), 7040 LSM_HOOK_INIT(capset, selinux_capset), 7041 LSM_HOOK_INIT(capable, selinux_capable), 7042 LSM_HOOK_INIT(quotactl, selinux_quotactl), 7043 LSM_HOOK_INIT(quota_on, selinux_quota_on), 7044 LSM_HOOK_INIT(syslog, selinux_syslog), 7045 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory), 7046 7047 LSM_HOOK_INIT(netlink_send, selinux_netlink_send), 7048 7049 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec), 7050 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds), 7051 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds), 7052 7053 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts), 7054 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat), 7055 LSM_HOOK_INIT(sb_remount, selinux_sb_remount), 7056 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount), 7057 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options), 7058 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs), 7059 LSM_HOOK_INIT(sb_mount, selinux_mount), 7060 LSM_HOOK_INIT(sb_umount, selinux_umount), 7061 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts), 7062 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts), 7063 7064 LSM_HOOK_INIT(move_mount, selinux_move_mount), 7065 7066 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security), 7067 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as), 7068 7069 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security), 7070 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security), 7071 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon), 7072 LSM_HOOK_INIT(inode_create, selinux_inode_create), 7073 LSM_HOOK_INIT(inode_link, selinux_inode_link), 7074 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink), 7075 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink), 7076 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir), 7077 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir), 7078 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod), 7079 LSM_HOOK_INIT(inode_rename, selinux_inode_rename), 7080 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink), 7081 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link), 7082 LSM_HOOK_INIT(inode_permission, selinux_inode_permission), 7083 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr), 7084 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr), 7085 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr), 7086 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr), 7087 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr), 7088 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr), 7089 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr), 7090 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity), 7091 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity), 7092 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity), 7093 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid), 7094 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up), 7095 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr), 7096 LSM_HOOK_INIT(path_notify, selinux_path_notify), 7097 7098 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security), 7099 7100 LSM_HOOK_INIT(file_permission, selinux_file_permission), 7101 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security), 7102 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl), 7103 LSM_HOOK_INIT(mmap_file, selinux_mmap_file), 7104 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr), 7105 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect), 7106 LSM_HOOK_INIT(file_lock, selinux_file_lock), 7107 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl), 7108 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner), 7109 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask), 7110 LSM_HOOK_INIT(file_receive, selinux_file_receive), 7111 7112 LSM_HOOK_INIT(file_open, selinux_file_open), 7113 7114 LSM_HOOK_INIT(task_alloc, selinux_task_alloc), 7115 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare), 7116 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer), 7117 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid), 7118 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as), 7119 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as), 7120 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request), 7121 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data), 7122 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file), 7123 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid), 7124 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid), 7125 LSM_HOOK_INIT(task_getsid, selinux_task_getsid), 7126 LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj), 7127 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj), 7128 LSM_HOOK_INIT(task_setnice, selinux_task_setnice), 7129 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio), 7130 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio), 7131 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit), 7132 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit), 7133 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler), 7134 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler), 7135 LSM_HOOK_INIT(task_movememory, selinux_task_movememory), 7136 LSM_HOOK_INIT(task_kill, selinux_task_kill), 7137 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode), 7138 7139 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission), 7140 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid), 7141 7142 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate), 7143 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl), 7144 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd), 7145 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv), 7146 7147 LSM_HOOK_INIT(shm_associate, selinux_shm_associate), 7148 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl), 7149 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat), 7150 7151 LSM_HOOK_INIT(sem_associate, selinux_sem_associate), 7152 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl), 7153 LSM_HOOK_INIT(sem_semop, selinux_sem_semop), 7154 7155 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate), 7156 7157 LSM_HOOK_INIT(getprocattr, selinux_getprocattr), 7158 LSM_HOOK_INIT(setprocattr, selinux_setprocattr), 7159 7160 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel), 7161 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid), 7162 LSM_HOOK_INIT(release_secctx, selinux_release_secctx), 7163 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx), 7164 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx), 7165 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx), 7166 7167 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect), 7168 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send), 7169 7170 LSM_HOOK_INIT(socket_create, selinux_socket_create), 7171 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create), 7172 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair), 7173 LSM_HOOK_INIT(socket_bind, selinux_socket_bind), 7174 LSM_HOOK_INIT(socket_connect, selinux_socket_connect), 7175 LSM_HOOK_INIT(socket_listen, selinux_socket_listen), 7176 LSM_HOOK_INIT(socket_accept, selinux_socket_accept), 7177 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg), 7178 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg), 7179 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname), 7180 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername), 7181 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt), 7182 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt), 7183 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown), 7184 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb), 7185 LSM_HOOK_INIT(socket_getpeersec_stream, 7186 selinux_socket_getpeersec_stream), 7187 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram), 7188 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security), 7189 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security), 7190 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid), 7191 LSM_HOOK_INIT(sock_graft, selinux_sock_graft), 7192 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request), 7193 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone), 7194 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect), 7195 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request), 7196 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone), 7197 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established), 7198 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet), 7199 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc), 7200 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec), 7201 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow), 7202 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security), 7203 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create), 7204 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue), 7205 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach), 7206 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open), 7207 #ifdef CONFIG_SECURITY_INFINIBAND 7208 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access), 7209 LSM_HOOK_INIT(ib_endport_manage_subnet, 7210 selinux_ib_endport_manage_subnet), 7211 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security), 7212 #endif 7213 #ifdef CONFIG_SECURITY_NETWORK_XFRM 7214 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free), 7215 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete), 7216 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free), 7217 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete), 7218 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup), 7219 LSM_HOOK_INIT(xfrm_state_pol_flow_match, 7220 selinux_xfrm_state_pol_flow_match), 7221 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session), 7222 #endif 7223 7224 #ifdef CONFIG_KEYS 7225 LSM_HOOK_INIT(key_free, selinux_key_free), 7226 LSM_HOOK_INIT(key_permission, selinux_key_permission), 7227 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity), 7228 #ifdef CONFIG_KEY_NOTIFICATIONS 7229 LSM_HOOK_INIT(watch_key, selinux_watch_key), 7230 #endif 7231 #endif 7232 7233 #ifdef CONFIG_AUDIT 7234 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known), 7235 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match), 7236 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free), 7237 #endif 7238 7239 #ifdef CONFIG_BPF_SYSCALL 7240 LSM_HOOK_INIT(bpf, selinux_bpf), 7241 LSM_HOOK_INIT(bpf_map, selinux_bpf_map), 7242 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog), 7243 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free), 7244 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free), 7245 #endif 7246 7247 #ifdef CONFIG_PERF_EVENTS 7248 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open), 7249 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free), 7250 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read), 7251 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write), 7252 #endif 7253 7254 #ifdef CONFIG_IO_URING 7255 LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds), 7256 LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll), 7257 #endif 7258 7259 /* 7260 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE 7261 */ 7262 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup), 7263 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param), 7264 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts), 7265 #ifdef CONFIG_SECURITY_NETWORK_XFRM 7266 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone), 7267 #endif 7268 7269 /* 7270 * PUT "ALLOCATING" HOOKS HERE 7271 */ 7272 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security), 7273 LSM_HOOK_INIT(msg_queue_alloc_security, 7274 selinux_msg_queue_alloc_security), 7275 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security), 7276 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security), 7277 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security), 7278 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security), 7279 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx), 7280 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx), 7281 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security), 7282 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security), 7283 #ifdef CONFIG_SECURITY_INFINIBAND 7284 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security), 7285 #endif 7286 #ifdef CONFIG_SECURITY_NETWORK_XFRM 7287 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc), 7288 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc), 7289 LSM_HOOK_INIT(xfrm_state_alloc_acquire, 7290 selinux_xfrm_state_alloc_acquire), 7291 #endif 7292 #ifdef CONFIG_KEYS 7293 LSM_HOOK_INIT(key_alloc, selinux_key_alloc), 7294 #endif 7295 #ifdef CONFIG_AUDIT 7296 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init), 7297 #endif 7298 #ifdef CONFIG_BPF_SYSCALL 7299 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc), 7300 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc), 7301 #endif 7302 #ifdef CONFIG_PERF_EVENTS 7303 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc), 7304 #endif 7305 }; 7306 7307 static __init int selinux_init(void) 7308 { 7309 pr_info("SELinux: Initializing.\n"); 7310 7311 memset(&selinux_state, 0, sizeof(selinux_state)); 7312 enforcing_set(&selinux_state, selinux_enforcing_boot); 7313 checkreqprot_set(&selinux_state, selinux_checkreqprot_boot); 7314 selinux_avc_init(&selinux_state.avc); 7315 mutex_init(&selinux_state.status_lock); 7316 mutex_init(&selinux_state.policy_mutex); 7317 7318 /* Set the security state for the initial task. */ 7319 cred_init_security(); 7320 7321 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC); 7322 7323 avc_init(); 7324 7325 avtab_cache_init(); 7326 7327 ebitmap_cache_init(); 7328 7329 hashtab_cache_init(); 7330 7331 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux"); 7332 7333 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET)) 7334 panic("SELinux: Unable to register AVC netcache callback\n"); 7335 7336 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET)) 7337 panic("SELinux: Unable to register AVC LSM notifier callback\n"); 7338 7339 if (selinux_enforcing_boot) 7340 pr_debug("SELinux: Starting in enforcing mode\n"); 7341 else 7342 pr_debug("SELinux: Starting in permissive mode\n"); 7343 7344 fs_validate_description("selinux", selinux_fs_parameters); 7345 7346 return 0; 7347 } 7348 7349 static void delayed_superblock_init(struct super_block *sb, void *unused) 7350 { 7351 selinux_set_mnt_opts(sb, NULL, 0, NULL); 7352 } 7353 7354 void selinux_complete_init(void) 7355 { 7356 pr_debug("SELinux: Completing initialization.\n"); 7357 7358 /* Set up any superblocks initialized prior to the policy load. */ 7359 pr_debug("SELinux: Setting up existing superblocks.\n"); 7360 iterate_supers(delayed_superblock_init, NULL); 7361 } 7362 7363 /* SELinux requires early initialization in order to label 7364 all processes and objects when they are created. */ 7365 DEFINE_LSM(selinux) = { 7366 .name = "selinux", 7367 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE, 7368 .enabled = &selinux_enabled_boot, 7369 .blobs = &selinux_blob_sizes, 7370 .init = selinux_init, 7371 }; 7372 7373 #if defined(CONFIG_NETFILTER) 7374 7375 static const struct nf_hook_ops selinux_nf_ops[] = { 7376 { 7377 .hook = selinux_ip_postroute, 7378 .pf = NFPROTO_IPV4, 7379 .hooknum = NF_INET_POST_ROUTING, 7380 .priority = NF_IP_PRI_SELINUX_LAST, 7381 }, 7382 { 7383 .hook = selinux_ip_forward, 7384 .pf = NFPROTO_IPV4, 7385 .hooknum = NF_INET_FORWARD, 7386 .priority = NF_IP_PRI_SELINUX_FIRST, 7387 }, 7388 { 7389 .hook = selinux_ip_output, 7390 .pf = NFPROTO_IPV4, 7391 .hooknum = NF_INET_LOCAL_OUT, 7392 .priority = NF_IP_PRI_SELINUX_FIRST, 7393 }, 7394 #if IS_ENABLED(CONFIG_IPV6) 7395 { 7396 .hook = selinux_ip_postroute, 7397 .pf = NFPROTO_IPV6, 7398 .hooknum = NF_INET_POST_ROUTING, 7399 .priority = NF_IP6_PRI_SELINUX_LAST, 7400 }, 7401 { 7402 .hook = selinux_ip_forward, 7403 .pf = NFPROTO_IPV6, 7404 .hooknum = NF_INET_FORWARD, 7405 .priority = NF_IP6_PRI_SELINUX_FIRST, 7406 }, 7407 { 7408 .hook = selinux_ip_output, 7409 .pf = NFPROTO_IPV6, 7410 .hooknum = NF_INET_LOCAL_OUT, 7411 .priority = NF_IP6_PRI_SELINUX_FIRST, 7412 }, 7413 #endif /* IPV6 */ 7414 }; 7415 7416 static int __net_init selinux_nf_register(struct net *net) 7417 { 7418 return nf_register_net_hooks(net, selinux_nf_ops, 7419 ARRAY_SIZE(selinux_nf_ops)); 7420 } 7421 7422 static void __net_exit selinux_nf_unregister(struct net *net) 7423 { 7424 nf_unregister_net_hooks(net, selinux_nf_ops, 7425 ARRAY_SIZE(selinux_nf_ops)); 7426 } 7427 7428 static struct pernet_operations selinux_net_ops = { 7429 .init = selinux_nf_register, 7430 .exit = selinux_nf_unregister, 7431 }; 7432 7433 static int __init selinux_nf_ip_init(void) 7434 { 7435 int err; 7436 7437 if (!selinux_enabled_boot) 7438 return 0; 7439 7440 pr_debug("SELinux: Registering netfilter hooks\n"); 7441 7442 err = register_pernet_subsys(&selinux_net_ops); 7443 if (err) 7444 panic("SELinux: register_pernet_subsys: error %d\n", err); 7445 7446 return 0; 7447 } 7448 __initcall(selinux_nf_ip_init); 7449 7450 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 7451 static void selinux_nf_ip_exit(void) 7452 { 7453 pr_debug("SELinux: Unregistering netfilter hooks\n"); 7454 7455 unregister_pernet_subsys(&selinux_net_ops); 7456 } 7457 #endif 7458 7459 #else /* CONFIG_NETFILTER */ 7460 7461 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 7462 #define selinux_nf_ip_exit() 7463 #endif 7464 7465 #endif /* CONFIG_NETFILTER */ 7466 7467 #ifdef CONFIG_SECURITY_SELINUX_DISABLE 7468 int selinux_disable(struct selinux_state *state) 7469 { 7470 if (selinux_initialized(state)) { 7471 /* Not permitted after initial policy load. */ 7472 return -EINVAL; 7473 } 7474 7475 if (selinux_disabled(state)) { 7476 /* Only do this once. */ 7477 return -EINVAL; 7478 } 7479 7480 selinux_mark_disabled(state); 7481 7482 pr_info("SELinux: Disabled at runtime.\n"); 7483 7484 /* 7485 * Unregister netfilter hooks. 7486 * Must be done before security_delete_hooks() to avoid breaking 7487 * runtime disable. 7488 */ 7489 selinux_nf_ip_exit(); 7490 7491 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks)); 7492 7493 /* Try to destroy the avc node cache */ 7494 avc_disable(); 7495 7496 /* Unregister selinuxfs. */ 7497 exit_sel_fs(); 7498 7499 return 0; 7500 } 7501 #endif 7502