2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/semaphore.h>
55 #include <asm/ioctls.h>
56 #include <linux/bitops.h>
57 #include <linux/interrupt.h>
58 #include <linux/netdevice.h> /* for network interface checks */
59 #include <linux/netlink.h>
60 #include <linux/tcp.h>
61 #include <linux/udp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
79 #include "selinux_netlabel.h"
81 #define XATTR_SELINUX_SUFFIX "selinux"
82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84 extern unsigned int policydb_loaded_version;
85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
86 extern int selinux_compat_net;
88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89 int selinux_enforcing = 0;
91 static int __init enforcing_setup(char *str)
93 selinux_enforcing = simple_strtol(str,NULL,0);
96 __setup("enforcing=", enforcing_setup);
99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102 static int __init selinux_enabled_setup(char *str)
104 selinux_enabled = simple_strtol(str, NULL, 0);
107 __setup("selinux=", selinux_enabled_setup);
109 int selinux_enabled = 1;
112 /* Original (dummy) security module. */
113 static struct security_operations *original_ops = NULL;
115 /* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119 static struct security_operations *secondary_ops = NULL;
121 /* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123 static LIST_HEAD(superblock_security_head);
124 static DEFINE_SPINLOCK(sb_security_lock);
126 static kmem_cache_t *sel_inode_cache;
128 /* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
136 rc = security_sid_to_context(sid, &context, &len);
140 if (!buffer || !size)
141 goto getsecurity_exit;
145 goto getsecurity_exit;
147 memcpy(buffer, context, len);
154 /* Allocate and free functions for each kind of security blob. */
156 static int task_alloc_security(struct task_struct *task)
158 struct task_security_struct *tsec;
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
171 static void task_free_security(struct task_struct *task)
173 struct task_security_struct *tsec = task->security;
174 task->security = NULL;
178 static int inode_alloc_security(struct inode *inode)
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
183 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
187 memset(isec, 0, sizeof(*isec));
188 init_MUTEX(&isec->sem);
189 INIT_LIST_HEAD(&isec->list);
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
199 static void inode_free_security(struct inode *inode)
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
213 static int file_alloc_security(struct file *file)
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
225 file->f_security = fsec;
230 static void file_free_security(struct file *file)
232 struct file_security_struct *fsec = file->f_security;
233 file->f_security = NULL;
237 static int superblock_alloc_security(struct super_block *sb)
239 struct superblock_security_struct *sbsec;
241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
245 init_MUTEX(&sbsec->sem);
246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253 sb->s_security = sbsec;
258 static void superblock_free_security(struct super_block *sb)
260 struct superblock_security_struct *sbsec = sb->s_security;
262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
267 sb->s_security = NULL;
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
273 struct sk_security_struct *ssec;
275 ssec = kzalloc(sizeof(*ssec), priority);
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
284 selinux_netlbl_sk_security_init(ssec, family);
289 static void sk_free_security(struct sock *sk)
291 struct sk_security_struct *ssec = sk->sk_security;
293 sk->sk_security = NULL;
297 /* The security server must be initialized before
298 any labeling or access decisions can be provided. */
299 extern int ss_initialized;
301 /* The file system's label must be initialized prior to use. */
303 static char *labeling_behaviors[6] = {
305 "uses transition SIDs",
307 "uses genfs_contexts",
308 "not configured for labeling",
309 "uses mountpoint labeling",
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
314 static inline int inode_doinit(struct inode *inode)
316 return inode_doinit_with_dentry(inode, NULL);
326 static match_table_t tokens = {
327 {Opt_context, "context=%s"},
328 {Opt_fscontext, "fscontext=%s"},
329 {Opt_defcontext, "defcontext=%s"},
330 {Opt_rootcontext, "rootcontext=%s"},
333 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
335 static int may_context_mount_sb_relabel(u32 sid,
336 struct superblock_security_struct *sbsec,
337 struct task_security_struct *tsec)
341 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342 FILESYSTEM__RELABELFROM, NULL);
346 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347 FILESYSTEM__RELABELTO, NULL);
351 static int may_context_mount_inode_relabel(u32 sid,
352 struct superblock_security_struct *sbsec,
353 struct task_security_struct *tsec)
356 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357 FILESYSTEM__RELABELFROM, NULL);
361 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362 FILESYSTEM__ASSOCIATE, NULL);
366 static int try_context_mount(struct super_block *sb, void *data)
368 char *context = NULL, *defcontext = NULL;
369 char *fscontext = NULL, *rootcontext = NULL;
372 int alloc = 0, rc = 0, seen = 0;
373 struct task_security_struct *tsec = current->security;
374 struct superblock_security_struct *sbsec = sb->s_security;
379 name = sb->s_type->name;
381 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
383 /* NFS we understand. */
384 if (!strcmp(name, "nfs")) {
385 struct nfs_mount_data *d = data;
387 if (d->version < NFS_MOUNT_VERSION)
391 context = d->context;
398 /* Standard string-based options. */
399 char *p, *options = data;
401 while ((p = strsep(&options, ",")) != NULL) {
403 substring_t args[MAX_OPT_ARGS];
408 token = match_token(p, tokens, args);
412 if (seen & (Opt_context|Opt_defcontext)) {
414 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
417 context = match_strdup(&args[0]);
428 if (seen & Opt_fscontext) {
430 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
433 fscontext = match_strdup(&args[0]);
440 seen |= Opt_fscontext;
443 case Opt_rootcontext:
444 if (seen & Opt_rootcontext) {
446 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
449 rootcontext = match_strdup(&args[0]);
456 seen |= Opt_rootcontext;
460 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
462 printk(KERN_WARNING "SELinux: "
463 "defcontext option is invalid "
464 "for this filesystem type\n");
467 if (seen & (Opt_context|Opt_defcontext)) {
469 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
472 defcontext = match_strdup(&args[0]);
479 seen |= Opt_defcontext;
484 printk(KERN_WARNING "SELinux: unknown mount "
495 /* sets the context of the superblock for the fs being mounted. */
497 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
499 printk(KERN_WARNING "SELinux: security_context_to_sid"
500 "(%s) failed for (dev %s, type %s) errno=%d\n",
501 fscontext, sb->s_id, name, rc);
505 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
513 * Switch to using mount point labeling behavior.
514 * sets the label used on all file below the mountpoint, and will set
515 * the superblock context if not already set.
518 rc = security_context_to_sid(context, strlen(context), &sid);
520 printk(KERN_WARNING "SELinux: security_context_to_sid"
521 "(%s) failed for (dev %s, type %s) errno=%d\n",
522 context, sb->s_id, name, rc);
527 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
532 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
536 sbsec->mntpoint_sid = sid;
538 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
542 struct inode *inode = sb->s_root->d_inode;
543 struct inode_security_struct *isec = inode->i_security;
544 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
546 printk(KERN_WARNING "SELinux: security_context_to_sid"
547 "(%s) failed for (dev %s, type %s) errno=%d\n",
548 rootcontext, sb->s_id, name, rc);
552 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
557 isec->initialized = 1;
561 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
563 printk(KERN_WARNING "SELinux: security_context_to_sid"
564 "(%s) failed for (dev %s, type %s) errno=%d\n",
565 defcontext, sb->s_id, name, rc);
569 if (sid == sbsec->def_sid)
572 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
576 sbsec->def_sid = sid;
590 static int superblock_doinit(struct super_block *sb, void *data)
592 struct superblock_security_struct *sbsec = sb->s_security;
593 struct dentry *root = sb->s_root;
594 struct inode *inode = root->d_inode;
598 if (sbsec->initialized)
601 if (!ss_initialized) {
602 /* Defer initialization until selinux_complete_init,
603 after the initial policy is loaded and the security
604 server is ready to handle calls. */
605 spin_lock(&sb_security_lock);
606 if (list_empty(&sbsec->list))
607 list_add(&sbsec->list, &superblock_security_head);
608 spin_unlock(&sb_security_lock);
612 /* Determine the labeling behavior to use for this filesystem type. */
613 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
615 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
616 __FUNCTION__, sb->s_type->name, rc);
620 rc = try_context_mount(sb, data);
624 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625 /* Make sure that the xattr handler exists and that no
626 error other than -ENODATA is returned by getxattr on
627 the root directory. -ENODATA is ok, as this may be
628 the first boot of the SELinux kernel before we have
629 assigned xattr values to the filesystem. */
630 if (!inode->i_op->getxattr) {
631 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632 "xattr support\n", sb->s_id, sb->s_type->name);
636 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637 if (rc < 0 && rc != -ENODATA) {
638 if (rc == -EOPNOTSUPP)
639 printk(KERN_WARNING "SELinux: (dev %s, type "
640 "%s) has no security xattr handler\n",
641 sb->s_id, sb->s_type->name);
643 printk(KERN_WARNING "SELinux: (dev %s, type "
644 "%s) getxattr errno %d\n", sb->s_id,
645 sb->s_type->name, -rc);
650 if (strcmp(sb->s_type->name, "proc") == 0)
653 sbsec->initialized = 1;
655 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657 sb->s_id, sb->s_type->name);
660 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
661 sb->s_id, sb->s_type->name,
662 labeling_behaviors[sbsec->behavior-1]);
665 /* Initialize the root inode. */
666 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
668 /* Initialize any other inodes associated with the superblock, e.g.
669 inodes created prior to initial policy load or inodes created
670 during get_sb by a pseudo filesystem that directly
672 spin_lock(&sbsec->isec_lock);
674 if (!list_empty(&sbsec->isec_head)) {
675 struct inode_security_struct *isec =
676 list_entry(sbsec->isec_head.next,
677 struct inode_security_struct, list);
678 struct inode *inode = isec->inode;
679 spin_unlock(&sbsec->isec_lock);
680 inode = igrab(inode);
682 if (!IS_PRIVATE (inode))
686 spin_lock(&sbsec->isec_lock);
687 list_del_init(&isec->list);
690 spin_unlock(&sbsec->isec_lock);
696 static inline u16 inode_mode_to_security_class(umode_t mode)
698 switch (mode & S_IFMT) {
700 return SECCLASS_SOCK_FILE;
702 return SECCLASS_LNK_FILE;
704 return SECCLASS_FILE;
706 return SECCLASS_BLK_FILE;
710 return SECCLASS_CHR_FILE;
712 return SECCLASS_FIFO_FILE;
716 return SECCLASS_FILE;
719 static inline int default_protocol_stream(int protocol)
721 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
724 static inline int default_protocol_dgram(int protocol)
726 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
736 return SECCLASS_UNIX_STREAM_SOCKET;
738 return SECCLASS_UNIX_DGRAM_SOCKET;
745 if (default_protocol_stream(protocol))
746 return SECCLASS_TCP_SOCKET;
748 return SECCLASS_RAWIP_SOCKET;
750 if (default_protocol_dgram(protocol))
751 return SECCLASS_UDP_SOCKET;
753 return SECCLASS_RAWIP_SOCKET;
755 return SECCLASS_RAWIP_SOCKET;
761 return SECCLASS_NETLINK_ROUTE_SOCKET;
762 case NETLINK_FIREWALL:
763 return SECCLASS_NETLINK_FIREWALL_SOCKET;
764 case NETLINK_INET_DIAG:
765 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
767 return SECCLASS_NETLINK_NFLOG_SOCKET;
769 return SECCLASS_NETLINK_XFRM_SOCKET;
770 case NETLINK_SELINUX:
771 return SECCLASS_NETLINK_SELINUX_SOCKET;
773 return SECCLASS_NETLINK_AUDIT_SOCKET;
775 return SECCLASS_NETLINK_IP6FW_SOCKET;
776 case NETLINK_DNRTMSG:
777 return SECCLASS_NETLINK_DNRT_SOCKET;
778 case NETLINK_KOBJECT_UEVENT:
779 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
781 return SECCLASS_NETLINK_SOCKET;
784 return SECCLASS_PACKET_SOCKET;
786 return SECCLASS_KEY_SOCKET;
788 return SECCLASS_APPLETALK_SOCKET;
791 return SECCLASS_SOCKET;
794 #ifdef CONFIG_PROC_FS
795 static int selinux_proc_get_sid(struct proc_dir_entry *de,
800 char *buffer, *path, *end;
802 buffer = (char*)__get_free_page(GFP_KERNEL);
812 while (de && de != de->parent) {
813 buflen -= de->namelen + 1;
817 memcpy(end, de->name, de->namelen);
822 rc = security_genfs_sid("proc", path, tclass, sid);
823 free_page((unsigned long)buffer);
827 static int selinux_proc_get_sid(struct proc_dir_entry *de,
835 /* The inode's security attributes must be initialized before first use. */
836 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
838 struct superblock_security_struct *sbsec = NULL;
839 struct inode_security_struct *isec = inode->i_security;
841 struct dentry *dentry;
842 #define INITCONTEXTLEN 255
843 char *context = NULL;
848 if (isec->initialized)
853 if (isec->initialized)
856 sbsec = inode->i_sb->s_security;
857 if (!sbsec->initialized) {
858 /* Defer initialization until selinux_complete_init,
859 after the initial policy is loaded and the security
860 server is ready to handle calls. */
861 spin_lock(&sbsec->isec_lock);
862 if (list_empty(&isec->list))
863 list_add(&isec->list, &sbsec->isec_head);
864 spin_unlock(&sbsec->isec_lock);
868 switch (sbsec->behavior) {
869 case SECURITY_FS_USE_XATTR:
870 if (!inode->i_op->getxattr) {
871 isec->sid = sbsec->def_sid;
875 /* Need a dentry, since the xattr API requires one.
876 Life would be simpler if we could just pass the inode. */
878 /* Called from d_instantiate or d_splice_alias. */
879 dentry = dget(opt_dentry);
881 /* Called from selinux_complete_init, try to find a dentry. */
882 dentry = d_find_alias(inode);
885 printk(KERN_WARNING "%s: no dentry for dev=%s "
886 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
891 len = INITCONTEXTLEN;
892 context = kmalloc(len, GFP_KERNEL);
898 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
901 /* Need a larger buffer. Query for the right size. */
902 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
910 context = kmalloc(len, GFP_KERNEL);
916 rc = inode->i_op->getxattr(dentry,
922 if (rc != -ENODATA) {
923 printk(KERN_WARNING "%s: getxattr returned "
924 "%d for dev=%s ino=%ld\n", __FUNCTION__,
925 -rc, inode->i_sb->s_id, inode->i_ino);
929 /* Map ENODATA to the default file SID */
930 sid = sbsec->def_sid;
933 rc = security_context_to_sid_default(context, rc, &sid,
936 printk(KERN_WARNING "%s: context_to_sid(%s) "
937 "returned %d for dev=%s ino=%ld\n",
938 __FUNCTION__, context, -rc,
939 inode->i_sb->s_id, inode->i_ino);
941 /* Leave with the unlabeled SID */
949 case SECURITY_FS_USE_TASK:
950 isec->sid = isec->task_sid;
952 case SECURITY_FS_USE_TRANS:
953 /* Default to the fs SID. */
954 isec->sid = sbsec->sid;
956 /* Try to obtain a transition SID. */
957 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958 rc = security_transition_sid(isec->task_sid,
966 case SECURITY_FS_USE_MNTPOINT:
967 isec->sid = sbsec->mntpoint_sid;
970 /* Default to the fs superblock SID. */
971 isec->sid = sbsec->sid;
974 struct proc_inode *proci = PROC_I(inode);
976 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977 rc = selinux_proc_get_sid(proci->pde,
988 isec->initialized = 1;
991 if (isec->sclass == SECCLASS_FILE)
992 isec->sclass = inode_mode_to_security_class(inode->i_mode);
999 /* Convert a Linux signal to an access vector. */
1000 static inline u32 signal_to_av(int sig)
1006 /* Commonly granted from child to parent. */
1007 perm = PROCESS__SIGCHLD;
1010 /* Cannot be caught or ignored */
1011 perm = PROCESS__SIGKILL;
1014 /* Cannot be caught or ignored */
1015 perm = PROCESS__SIGSTOP;
1018 /* All other signals. */
1019 perm = PROCESS__SIGNAL;
1026 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1027 fork check, ptrace check, etc. */
1028 static int task_has_perm(struct task_struct *tsk1,
1029 struct task_struct *tsk2,
1032 struct task_security_struct *tsec1, *tsec2;
1034 tsec1 = tsk1->security;
1035 tsec2 = tsk2->security;
1036 return avc_has_perm(tsec1->sid, tsec2->sid,
1037 SECCLASS_PROCESS, perms, NULL);
1040 /* Check whether a task is allowed to use a capability. */
1041 static int task_has_capability(struct task_struct *tsk,
1044 struct task_security_struct *tsec;
1045 struct avc_audit_data ad;
1047 tsec = tsk->security;
1049 AVC_AUDIT_DATA_INIT(&ad,CAP);
1053 return avc_has_perm(tsec->sid, tsec->sid,
1054 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1057 /* Check whether a task is allowed to use a system operation. */
1058 static int task_has_system(struct task_struct *tsk,
1061 struct task_security_struct *tsec;
1063 tsec = tsk->security;
1065 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1066 SECCLASS_SYSTEM, perms, NULL);
1069 /* Check whether a task has a particular permission to an inode.
1070 The 'adp' parameter is optional and allows other audit
1071 data to be passed (e.g. the dentry). */
1072 static int inode_has_perm(struct task_struct *tsk,
1073 struct inode *inode,
1075 struct avc_audit_data *adp)
1077 struct task_security_struct *tsec;
1078 struct inode_security_struct *isec;
1079 struct avc_audit_data ad;
1081 tsec = tsk->security;
1082 isec = inode->i_security;
1086 AVC_AUDIT_DATA_INIT(&ad, FS);
1087 ad.u.fs.inode = inode;
1090 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 /* Same as inode_has_perm, but pass explicit audit data containing
1094 the dentry to help the auditing code to more easily generate the
1095 pathname if needed. */
1096 static inline int dentry_has_perm(struct task_struct *tsk,
1097 struct vfsmount *mnt,
1098 struct dentry *dentry,
1101 struct inode *inode = dentry->d_inode;
1102 struct avc_audit_data ad;
1103 AVC_AUDIT_DATA_INIT(&ad,FS);
1105 ad.u.fs.dentry = dentry;
1106 return inode_has_perm(tsk, inode, av, &ad);
1109 /* Check whether a task can use an open file descriptor to
1110 access an inode in a given way. Check access to the
1111 descriptor itself, and then use dentry_has_perm to
1112 check a particular permission to the file.
1113 Access to the descriptor is implicitly granted if it
1114 has the same SID as the process. If av is zero, then
1115 access to the file is not checked, e.g. for cases
1116 where only the descriptor is affected like seek. */
1117 static int file_has_perm(struct task_struct *tsk,
1121 struct task_security_struct *tsec = tsk->security;
1122 struct file_security_struct *fsec = file->f_security;
1123 struct vfsmount *mnt = file->f_vfsmnt;
1124 struct dentry *dentry = file->f_dentry;
1125 struct inode *inode = dentry->d_inode;
1126 struct avc_audit_data ad;
1129 AVC_AUDIT_DATA_INIT(&ad, FS);
1131 ad.u.fs.dentry = dentry;
1133 if (tsec->sid != fsec->sid) {
1134 rc = avc_has_perm(tsec->sid, fsec->sid,
1142 /* av is zero if only checking access to the descriptor. */
1144 return inode_has_perm(tsk, inode, av, &ad);
1149 /* Check whether a task can create a file. */
1150 static int may_create(struct inode *dir,
1151 struct dentry *dentry,
1154 struct task_security_struct *tsec;
1155 struct inode_security_struct *dsec;
1156 struct superblock_security_struct *sbsec;
1158 struct avc_audit_data ad;
1161 tsec = current->security;
1162 dsec = dir->i_security;
1163 sbsec = dir->i_sb->s_security;
1165 AVC_AUDIT_DATA_INIT(&ad, FS);
1166 ad.u.fs.dentry = dentry;
1168 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1169 DIR__ADD_NAME | DIR__SEARCH,
1174 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1175 newsid = tsec->create_sid;
1177 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1183 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1187 return avc_has_perm(newsid, sbsec->sid,
1188 SECCLASS_FILESYSTEM,
1189 FILESYSTEM__ASSOCIATE, &ad);
1192 /* Check whether a task can create a key. */
1193 static int may_create_key(u32 ksid,
1194 struct task_struct *ctx)
1196 struct task_security_struct *tsec;
1198 tsec = ctx->security;
1200 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1204 #define MAY_UNLINK 1
1207 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1208 static int may_link(struct inode *dir,
1209 struct dentry *dentry,
1213 struct task_security_struct *tsec;
1214 struct inode_security_struct *dsec, *isec;
1215 struct avc_audit_data ad;
1219 tsec = current->security;
1220 dsec = dir->i_security;
1221 isec = dentry->d_inode->i_security;
1223 AVC_AUDIT_DATA_INIT(&ad, FS);
1224 ad.u.fs.dentry = dentry;
1227 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1228 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1243 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1247 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1251 static inline int may_rename(struct inode *old_dir,
1252 struct dentry *old_dentry,
1253 struct inode *new_dir,
1254 struct dentry *new_dentry)
1256 struct task_security_struct *tsec;
1257 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1258 struct avc_audit_data ad;
1260 int old_is_dir, new_is_dir;
1263 tsec = current->security;
1264 old_dsec = old_dir->i_security;
1265 old_isec = old_dentry->d_inode->i_security;
1266 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1267 new_dsec = new_dir->i_security;
1269 AVC_AUDIT_DATA_INIT(&ad, FS);
1271 ad.u.fs.dentry = old_dentry;
1272 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1273 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276 rc = avc_has_perm(tsec->sid, old_isec->sid,
1277 old_isec->sclass, FILE__RENAME, &ad);
1280 if (old_is_dir && new_dir != old_dir) {
1281 rc = avc_has_perm(tsec->sid, old_isec->sid,
1282 old_isec->sclass, DIR__REPARENT, &ad);
1287 ad.u.fs.dentry = new_dentry;
1288 av = DIR__ADD_NAME | DIR__SEARCH;
1289 if (new_dentry->d_inode)
1290 av |= DIR__REMOVE_NAME;
1291 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294 if (new_dentry->d_inode) {
1295 new_isec = new_dentry->d_inode->i_security;
1296 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1297 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1307 /* Check whether a task can perform a filesystem operation. */
1308 static int superblock_has_perm(struct task_struct *tsk,
1309 struct super_block *sb,
1311 struct avc_audit_data *ad)
1313 struct task_security_struct *tsec;
1314 struct superblock_security_struct *sbsec;
1316 tsec = tsk->security;
1317 sbsec = sb->s_security;
1318 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1322 /* Convert a Linux mode and permission mask to an access vector. */
1323 static inline u32 file_mask_to_av(int mode, int mask)
1327 if ((mode & S_IFMT) != S_IFDIR) {
1328 if (mask & MAY_EXEC)
1329 av |= FILE__EXECUTE;
1330 if (mask & MAY_READ)
1333 if (mask & MAY_APPEND)
1335 else if (mask & MAY_WRITE)
1339 if (mask & MAY_EXEC)
1341 if (mask & MAY_WRITE)
1343 if (mask & MAY_READ)
1350 /* Convert a Linux file to an access vector. */
1351 static inline u32 file_to_av(struct file *file)
1355 if (file->f_mode & FMODE_READ)
1357 if (file->f_mode & FMODE_WRITE) {
1358 if (file->f_flags & O_APPEND)
1367 /* Hook functions begin here. */
1369 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371 struct task_security_struct *psec = parent->security;
1372 struct task_security_struct *csec = child->security;
1375 rc = secondary_ops->ptrace(parent,child);
1379 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1380 /* Save the SID of the tracing process for later use in apply_creds. */
1381 if (!(child->ptrace & PT_PTRACED) && !rc)
1382 csec->ptrace_sid = psec->sid;
1386 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1387 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1391 error = task_has_perm(current, target, PROCESS__GETCAP);
1395 return secondary_ops->capget(target, effective, inheritable, permitted);
1398 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1399 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1403 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1407 return task_has_perm(current, target, PROCESS__SETCAP);
1410 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1411 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 static int selinux_capable(struct task_struct *tsk, int cap)
1420 rc = secondary_ops->capable(tsk, cap);
1424 return task_has_capability(tsk,cap);
1427 static int selinux_sysctl(ctl_table *table, int op)
1431 struct task_security_struct *tsec;
1435 rc = secondary_ops->sysctl(table, op);
1439 tsec = current->security;
1441 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1442 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1444 /* Default to the well-defined sysctl SID. */
1445 tsid = SECINITSID_SYSCTL;
1448 /* The op values are "defined" in sysctl.c, thereby creating
1449 * a bad coupling between this module and sysctl.c */
1451 error = avc_has_perm(tsec->sid, tsid,
1452 SECCLASS_DIR, DIR__SEARCH, NULL);
1460 error = avc_has_perm(tsec->sid, tsid,
1461 SECCLASS_FILE, av, NULL);
1467 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1480 rc = superblock_has_perm(current,
1482 FILESYSTEM__QUOTAMOD, NULL);
1487 rc = superblock_has_perm(current,
1489 FILESYSTEM__QUOTAGET, NULL);
1492 rc = 0; /* let the kernel handle invalid cmds */
1498 static int selinux_quota_on(struct dentry *dentry)
1500 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1503 static int selinux_syslog(int type)
1507 rc = secondary_ops->syslog(type);
1512 case 3: /* Read last kernel messages */
1513 case 10: /* Return size of the log buffer */
1514 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1516 case 6: /* Disable logging to console */
1517 case 7: /* Enable logging to console */
1518 case 8: /* Set level of messages printed to console */
1519 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1521 case 0: /* Close log */
1522 case 1: /* Open log */
1523 case 2: /* Read from log */
1524 case 4: /* Read/clear last kernel messages */
1525 case 5: /* Clear ring buffer */
1527 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1534 * Check that a process has enough memory to allocate a new virtual
1535 * mapping. 0 means there is enough memory for the allocation to
1536 * succeed and -ENOMEM implies there is not.
1538 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1539 * if the capability is granted, but __vm_enough_memory requires 1 if
1540 * the capability is granted.
1542 * Do not audit the selinux permission check, as this is applied to all
1543 * processes that allocate mappings.
1545 static int selinux_vm_enough_memory(long pages)
1547 int rc, cap_sys_admin = 0;
1548 struct task_security_struct *tsec = current->security;
1550 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1552 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1553 SECCLASS_CAPABILITY,
1554 CAP_TO_MASK(CAP_SYS_ADMIN),
1560 return __vm_enough_memory(pages, cap_sys_admin);
1563 /* binprm security operations */
1565 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1567 struct bprm_security_struct *bsec;
1569 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1574 bsec->sid = SECINITSID_UNLABELED;
1577 bprm->security = bsec;
1581 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1583 struct task_security_struct *tsec;
1584 struct inode *inode = bprm->file->f_dentry->d_inode;
1585 struct inode_security_struct *isec;
1586 struct bprm_security_struct *bsec;
1588 struct avc_audit_data ad;
1591 rc = secondary_ops->bprm_set_security(bprm);
1595 bsec = bprm->security;
1600 tsec = current->security;
1601 isec = inode->i_security;
1603 /* Default to the current task SID. */
1604 bsec->sid = tsec->sid;
1606 /* Reset fs, key, and sock SIDs on execve. */
1607 tsec->create_sid = 0;
1608 tsec->keycreate_sid = 0;
1609 tsec->sockcreate_sid = 0;
1611 if (tsec->exec_sid) {
1612 newsid = tsec->exec_sid;
1613 /* Reset exec SID on execve. */
1616 /* Check for a default transition on this program. */
1617 rc = security_transition_sid(tsec->sid, isec->sid,
1618 SECCLASS_PROCESS, &newsid);
1623 AVC_AUDIT_DATA_INIT(&ad, FS);
1624 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1625 ad.u.fs.dentry = bprm->file->f_dentry;
1627 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1630 if (tsec->sid == newsid) {
1631 rc = avc_has_perm(tsec->sid, isec->sid,
1632 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1636 /* Check permissions for the transition. */
1637 rc = avc_has_perm(tsec->sid, newsid,
1638 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1642 rc = avc_has_perm(newsid, isec->sid,
1643 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1647 /* Clear any possibly unsafe personality bits on exec: */
1648 current->personality &= ~PER_CLEAR_ON_SETID;
1650 /* Set the security field to the new SID. */
1658 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1660 return secondary_ops->bprm_check_security(bprm);
1664 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1666 struct task_security_struct *tsec = current->security;
1669 if (tsec->osid != tsec->sid) {
1670 /* Enable secure mode for SIDs transitions unless
1671 the noatsecure permission is granted between
1672 the two SIDs, i.e. ahp returns 0. */
1673 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1675 PROCESS__NOATSECURE, NULL);
1678 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1681 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1683 kfree(bprm->security);
1684 bprm->security = NULL;
1687 extern struct vfsmount *selinuxfs_mount;
1688 extern struct dentry *selinux_null;
1690 /* Derived from fs/exec.c:flush_old_files. */
1691 static inline void flush_unauthorized_files(struct files_struct * files)
1693 struct avc_audit_data ad;
1694 struct file *file, *devnull = NULL;
1695 struct tty_struct *tty = current->signal->tty;
1696 struct fdtable *fdt;
1701 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1703 /* Revalidate access to controlling tty.
1704 Use inode_has_perm on the tty inode directly rather
1705 than using file_has_perm, as this particular open
1706 file may belong to another process and we are only
1707 interested in the inode-based check here. */
1708 struct inode *inode = file->f_dentry->d_inode;
1709 if (inode_has_perm(current, inode,
1710 FILE__READ | FILE__WRITE, NULL)) {
1711 /* Reset controlling tty. */
1712 current->signal->tty = NULL;
1713 current->signal->tty_old_pgrp = 0;
1719 /* Revalidate access to inherited open files. */
1721 AVC_AUDIT_DATA_INIT(&ad,FS);
1723 spin_lock(&files->file_lock);
1725 unsigned long set, i;
1730 fdt = files_fdtable(files);
1731 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1733 set = fdt->open_fds->fds_bits[j];
1736 spin_unlock(&files->file_lock);
1737 for ( ; set ; i++,set >>= 1) {
1742 if (file_has_perm(current,
1744 file_to_av(file))) {
1746 fd = get_unused_fd();
1756 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1763 fd_install(fd, devnull);
1768 spin_lock(&files->file_lock);
1771 spin_unlock(&files->file_lock);
1774 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1776 struct task_security_struct *tsec;
1777 struct bprm_security_struct *bsec;
1781 secondary_ops->bprm_apply_creds(bprm, unsafe);
1783 tsec = current->security;
1785 bsec = bprm->security;
1788 tsec->osid = tsec->sid;
1790 if (tsec->sid != sid) {
1791 /* Check for shared state. If not ok, leave SID
1792 unchanged and kill. */
1793 if (unsafe & LSM_UNSAFE_SHARE) {
1794 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1795 PROCESS__SHARE, NULL);
1802 /* Check for ptracing, and update the task SID if ok.
1803 Otherwise, leave SID unchanged and kill. */
1804 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1805 rc = avc_has_perm(tsec->ptrace_sid, sid,
1806 SECCLASS_PROCESS, PROCESS__PTRACE,
1818 * called after apply_creds without the task lock held
1820 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1822 struct task_security_struct *tsec;
1823 struct rlimit *rlim, *initrlim;
1824 struct itimerval itimer;
1825 struct bprm_security_struct *bsec;
1828 tsec = current->security;
1829 bsec = bprm->security;
1832 force_sig_specific(SIGKILL, current);
1835 if (tsec->osid == tsec->sid)
1838 /* Close files for which the new task SID is not authorized. */
1839 flush_unauthorized_files(current->files);
1841 /* Check whether the new SID can inherit signal state
1842 from the old SID. If not, clear itimers to avoid
1843 subsequent signal generation and flush and unblock
1844 signals. This must occur _after_ the task SID has
1845 been updated so that any kill done after the flush
1846 will be checked against the new SID. */
1847 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1848 PROCESS__SIGINH, NULL);
1850 memset(&itimer, 0, sizeof itimer);
1851 for (i = 0; i < 3; i++)
1852 do_setitimer(i, &itimer, NULL);
1853 flush_signals(current);
1854 spin_lock_irq(¤t->sighand->siglock);
1855 flush_signal_handlers(current, 1);
1856 sigemptyset(¤t->blocked);
1857 recalc_sigpending();
1858 spin_unlock_irq(¤t->sighand->siglock);
1861 /* Check whether the new SID can inherit resource limits
1862 from the old SID. If not, reset all soft limits to
1863 the lower of the current task's hard limit and the init
1864 task's soft limit. Note that the setting of hard limits
1865 (even to lower them) can be controlled by the setrlimit
1866 check. The inclusion of the init task's soft limit into
1867 the computation is to avoid resetting soft limits higher
1868 than the default soft limit for cases where the default
1869 is lower than the hard limit, e.g. RLIMIT_CORE or
1871 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1872 PROCESS__RLIMITINH, NULL);
1874 for (i = 0; i < RLIM_NLIMITS; i++) {
1875 rlim = current->signal->rlim + i;
1876 initrlim = init_task.signal->rlim+i;
1877 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1879 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1881 * This will cause RLIMIT_CPU calculations
1884 current->it_prof_expires = jiffies_to_cputime(1);
1888 /* Wake up the parent if it is waiting so that it can
1889 recheck wait permission to the new task SID. */
1890 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1893 /* superblock security operations */
1895 static int selinux_sb_alloc_security(struct super_block *sb)
1897 return superblock_alloc_security(sb);
1900 static void selinux_sb_free_security(struct super_block *sb)
1902 superblock_free_security(sb);
1905 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1910 return !memcmp(prefix, option, plen);
1913 static inline int selinux_option(char *option, int len)
1915 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1916 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1917 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1918 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1921 static inline void take_option(char **to, char *from, int *first, int len)
1929 memcpy(*to, from, len);
1933 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1935 int fnosec, fsec, rc = 0;
1936 char *in_save, *in_curr, *in_end;
1937 char *sec_curr, *nosec_save, *nosec;
1942 /* Binary mount data: just copy */
1943 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1944 copy_page(sec_curr, in_curr);
1948 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1956 in_save = in_end = orig;
1959 if (*in_end == ',' || *in_end == '\0') {
1960 int len = in_end - in_curr;
1962 if (selinux_option(in_curr, len))
1963 take_option(&sec_curr, in_curr, &fsec, len);
1965 take_option(&nosec, in_curr, &fnosec, len);
1967 in_curr = in_end + 1;
1969 } while (*in_end++);
1971 strcpy(in_save, nosec_save);
1972 free_page((unsigned long)nosec_save);
1977 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1979 struct avc_audit_data ad;
1982 rc = superblock_doinit(sb, data);
1986 AVC_AUDIT_DATA_INIT(&ad,FS);
1987 ad.u.fs.dentry = sb->s_root;
1988 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1991 static int selinux_sb_statfs(struct dentry *dentry)
1993 struct avc_audit_data ad;
1995 AVC_AUDIT_DATA_INIT(&ad,FS);
1996 ad.u.fs.dentry = dentry->d_sb->s_root;
1997 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2000 static int selinux_mount(char * dev_name,
2001 struct nameidata *nd,
2003 unsigned long flags,
2008 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2012 if (flags & MS_REMOUNT)
2013 return superblock_has_perm(current, nd->mnt->mnt_sb,
2014 FILESYSTEM__REMOUNT, NULL);
2016 return dentry_has_perm(current, nd->mnt, nd->dentry,
2020 static int selinux_umount(struct vfsmount *mnt, int flags)
2024 rc = secondary_ops->sb_umount(mnt, flags);
2028 return superblock_has_perm(current,mnt->mnt_sb,
2029 FILESYSTEM__UNMOUNT,NULL);
2032 /* inode security operations */
2034 static int selinux_inode_alloc_security(struct inode *inode)
2036 return inode_alloc_security(inode);
2039 static void selinux_inode_free_security(struct inode *inode)
2041 inode_free_security(inode);
2044 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2045 char **name, void **value,
2048 struct task_security_struct *tsec;
2049 struct inode_security_struct *dsec;
2050 struct superblock_security_struct *sbsec;
2053 char *namep = NULL, *context;
2055 tsec = current->security;
2056 dsec = dir->i_security;
2057 sbsec = dir->i_sb->s_security;
2059 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2060 newsid = tsec->create_sid;
2062 rc = security_transition_sid(tsec->sid, dsec->sid,
2063 inode_mode_to_security_class(inode->i_mode),
2066 printk(KERN_WARNING "%s: "
2067 "security_transition_sid failed, rc=%d (dev=%s "
2070 -rc, inode->i_sb->s_id, inode->i_ino);
2075 /* Possibly defer initialization to selinux_complete_init. */
2076 if (sbsec->initialized) {
2077 struct inode_security_struct *isec = inode->i_security;
2078 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2080 isec->initialized = 1;
2083 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2087 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2094 rc = security_sid_to_context(newsid, &context, &clen);
2106 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2108 return may_create(dir, dentry, SECCLASS_FILE);
2111 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2115 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2118 return may_link(dir, old_dentry, MAY_LINK);
2121 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2125 rc = secondary_ops->inode_unlink(dir, dentry);
2128 return may_link(dir, dentry, MAY_UNLINK);
2131 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2133 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2136 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2138 return may_create(dir, dentry, SECCLASS_DIR);
2141 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2143 return may_link(dir, dentry, MAY_RMDIR);
2146 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2150 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2154 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2157 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2158 struct inode *new_inode, struct dentry *new_dentry)
2160 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2163 static int selinux_inode_readlink(struct dentry *dentry)
2165 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2168 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2172 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2175 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2178 static int selinux_inode_permission(struct inode *inode, int mask,
2179 struct nameidata *nd)
2183 rc = secondary_ops->inode_permission(inode, mask, nd);
2188 /* No permission to check. Existence test. */
2192 return inode_has_perm(current, inode,
2193 file_mask_to_av(inode->i_mode, mask), NULL);
2196 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2200 rc = secondary_ops->inode_setattr(dentry, iattr);
2204 if (iattr->ia_valid & ATTR_FORCE)
2207 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2208 ATTR_ATIME_SET | ATTR_MTIME_SET))
2209 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2211 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2214 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2216 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2219 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2221 struct task_security_struct *tsec = current->security;
2222 struct inode *inode = dentry->d_inode;
2223 struct inode_security_struct *isec = inode->i_security;
2224 struct superblock_security_struct *sbsec;
2225 struct avc_audit_data ad;
2229 if (strcmp(name, XATTR_NAME_SELINUX)) {
2230 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2231 sizeof XATTR_SECURITY_PREFIX - 1) &&
2232 !capable(CAP_SYS_ADMIN)) {
2233 /* A different attribute in the security namespace.
2234 Restrict to administrator. */
2238 /* Not an attribute we recognize, so just check the
2239 ordinary setattr permission. */
2240 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2243 sbsec = inode->i_sb->s_security;
2244 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2247 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2250 AVC_AUDIT_DATA_INIT(&ad,FS);
2251 ad.u.fs.dentry = dentry;
2253 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2254 FILE__RELABELFROM, &ad);
2258 rc = security_context_to_sid(value, size, &newsid);
2262 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2263 FILE__RELABELTO, &ad);
2267 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2272 return avc_has_perm(newsid,
2274 SECCLASS_FILESYSTEM,
2275 FILESYSTEM__ASSOCIATE,
2279 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2280 void *value, size_t size, int flags)
2282 struct inode *inode = dentry->d_inode;
2283 struct inode_security_struct *isec = inode->i_security;
2287 if (strcmp(name, XATTR_NAME_SELINUX)) {
2288 /* Not an attribute we recognize, so nothing to do. */
2292 rc = security_context_to_sid(value, size, &newsid);
2294 printk(KERN_WARNING "%s: unable to obtain SID for context "
2295 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2303 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2305 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2308 static int selinux_inode_listxattr (struct dentry *dentry)
2310 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2313 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2315 if (strcmp(name, XATTR_NAME_SELINUX)) {
2316 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2317 sizeof XATTR_SECURITY_PREFIX - 1) &&
2318 !capable(CAP_SYS_ADMIN)) {
2319 /* A different attribute in the security namespace.
2320 Restrict to administrator. */
2324 /* Not an attribute we recognize, so just check the
2325 ordinary setattr permission. Might want a separate
2326 permission for removexattr. */
2327 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2330 /* No one is allowed to remove a SELinux security label.
2331 You can change the label, but all data must be labeled. */
2335 static const char *selinux_inode_xattr_getsuffix(void)
2337 return XATTR_SELINUX_SUFFIX;
2341 * Copy the in-core inode security context value to the user. If the
2342 * getxattr() prior to this succeeded, check to see if we need to
2343 * canonicalize the value to be finally returned to the user.
2345 * Permission check is handled by selinux_inode_getxattr hook.
2347 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2349 struct inode_security_struct *isec = inode->i_security;
2351 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2354 return selinux_getsecurity(isec->sid, buffer, size);
2357 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2358 const void *value, size_t size, int flags)
2360 struct inode_security_struct *isec = inode->i_security;
2364 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2367 if (!value || !size)
2370 rc = security_context_to_sid((void*)value, size, &newsid);
2378 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2380 const int len = sizeof(XATTR_NAME_SELINUX);
2381 if (buffer && len <= buffer_size)
2382 memcpy(buffer, XATTR_NAME_SELINUX, len);
2386 /* file security operations */
2388 static int selinux_file_permission(struct file *file, int mask)
2391 struct inode *inode = file->f_dentry->d_inode;
2394 /* No permission to check. Existence test. */
2398 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2399 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2402 rc = file_has_perm(current, file,
2403 file_mask_to_av(inode->i_mode, mask));
2407 return selinux_netlbl_inode_permission(inode, mask);
2410 static int selinux_file_alloc_security(struct file *file)
2412 return file_alloc_security(file);
2415 static void selinux_file_free_security(struct file *file)
2417 file_free_security(file);
2420 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2432 case EXT2_IOC_GETFLAGS:
2434 case EXT2_IOC_GETVERSION:
2435 error = file_has_perm(current, file, FILE__GETATTR);
2438 case EXT2_IOC_SETFLAGS:
2440 case EXT2_IOC_SETVERSION:
2441 error = file_has_perm(current, file, FILE__SETATTR);
2444 /* sys_ioctl() checks */
2448 error = file_has_perm(current, file, 0);
2453 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2456 /* default case assumes that the command will go
2457 * to the file's ioctl() function.
2460 error = file_has_perm(current, file, FILE__IOCTL);
2466 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2468 #ifndef CONFIG_PPC32
2469 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2471 * We are making executable an anonymous mapping or a
2472 * private file mapping that will also be writable.
2473 * This has an additional check.
2475 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2482 /* read access is always possible with a mapping */
2483 u32 av = FILE__READ;
2485 /* write access only matters if the mapping is shared */
2486 if (shared && (prot & PROT_WRITE))
2489 if (prot & PROT_EXEC)
2490 av |= FILE__EXECUTE;
2492 return file_has_perm(current, file, av);
2497 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2498 unsigned long prot, unsigned long flags)
2502 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2506 if (selinux_checkreqprot)
2509 return file_map_prot_check(file, prot,
2510 (flags & MAP_TYPE) == MAP_SHARED);
2513 static int selinux_file_mprotect(struct vm_area_struct *vma,
2514 unsigned long reqprot,
2519 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2523 if (selinux_checkreqprot)
2526 #ifndef CONFIG_PPC32
2527 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2529 if (vma->vm_start >= vma->vm_mm->start_brk &&
2530 vma->vm_end <= vma->vm_mm->brk) {
2531 rc = task_has_perm(current, current,
2533 } else if (!vma->vm_file &&
2534 vma->vm_start <= vma->vm_mm->start_stack &&
2535 vma->vm_end >= vma->vm_mm->start_stack) {
2536 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2537 } else if (vma->vm_file && vma->anon_vma) {
2539 * We are making executable a file mapping that has
2540 * had some COW done. Since pages might have been
2541 * written, check ability to execute the possibly
2542 * modified content. This typically should only
2543 * occur for text relocations.
2545 rc = file_has_perm(current, vma->vm_file,
2553 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2556 static int selinux_file_lock(struct file *file, unsigned int cmd)
2558 return file_has_perm(current, file, FILE__LOCK);
2561 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2568 if (!file->f_dentry || !file->f_dentry->d_inode) {
2573 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2574 err = file_has_perm(current, file,FILE__WRITE);
2583 /* Just check FD__USE permission */
2584 err = file_has_perm(current, file, 0);
2589 #if BITS_PER_LONG == 32
2594 if (!file->f_dentry || !file->f_dentry->d_inode) {
2598 err = file_has_perm(current, file, FILE__LOCK);
2605 static int selinux_file_set_fowner(struct file *file)
2607 struct task_security_struct *tsec;
2608 struct file_security_struct *fsec;
2610 tsec = current->security;
2611 fsec = file->f_security;
2612 fsec->fown_sid = tsec->sid;
2617 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2618 struct fown_struct *fown, int signum)
2622 struct task_security_struct *tsec;
2623 struct file_security_struct *fsec;
2625 /* struct fown_struct is never outside the context of a struct file */
2626 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2628 tsec = tsk->security;
2629 fsec = file->f_security;
2632 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2634 perm = signal_to_av(signum);
2636 return avc_has_perm(fsec->fown_sid, tsec->sid,
2637 SECCLASS_PROCESS, perm, NULL);
2640 static int selinux_file_receive(struct file *file)
2642 return file_has_perm(current, file, file_to_av(file));
2645 /* task security operations */
2647 static int selinux_task_create(unsigned long clone_flags)
2651 rc = secondary_ops->task_create(clone_flags);
2655 return task_has_perm(current, current, PROCESS__FORK);
2658 static int selinux_task_alloc_security(struct task_struct *tsk)
2660 struct task_security_struct *tsec1, *tsec2;
2663 tsec1 = current->security;
2665 rc = task_alloc_security(tsk);
2668 tsec2 = tsk->security;
2670 tsec2->osid = tsec1->osid;
2671 tsec2->sid = tsec1->sid;
2673 /* Retain the exec, fs, key, and sock SIDs across fork */
2674 tsec2->exec_sid = tsec1->exec_sid;
2675 tsec2->create_sid = tsec1->create_sid;
2676 tsec2->keycreate_sid = tsec1->keycreate_sid;
2677 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2679 /* Retain ptracer SID across fork, if any.
2680 This will be reset by the ptrace hook upon any
2681 subsequent ptrace_attach operations. */
2682 tsec2->ptrace_sid = tsec1->ptrace_sid;
2687 static void selinux_task_free_security(struct task_struct *tsk)
2689 task_free_security(tsk);
2692 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2694 /* Since setuid only affects the current process, and
2695 since the SELinux controls are not based on the Linux
2696 identity attributes, SELinux does not need to control
2697 this operation. However, SELinux does control the use
2698 of the CAP_SETUID and CAP_SETGID capabilities using the
2703 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2705 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2708 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2710 /* See the comment for setuid above. */
2714 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2716 return task_has_perm(current, p, PROCESS__SETPGID);
2719 static int selinux_task_getpgid(struct task_struct *p)
2721 return task_has_perm(current, p, PROCESS__GETPGID);
2724 static int selinux_task_getsid(struct task_struct *p)
2726 return task_has_perm(current, p, PROCESS__GETSESSION);
2729 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2731 selinux_get_task_sid(p, secid);
2734 static int selinux_task_setgroups(struct group_info *group_info)
2736 /* See the comment for setuid above. */
2740 static int selinux_task_setnice(struct task_struct *p, int nice)
2744 rc = secondary_ops->task_setnice(p, nice);
2748 return task_has_perm(current,p, PROCESS__SETSCHED);
2751 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2753 return task_has_perm(current, p, PROCESS__SETSCHED);
2756 static int selinux_task_getioprio(struct task_struct *p)
2758 return task_has_perm(current, p, PROCESS__GETSCHED);
2761 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2763 struct rlimit *old_rlim = current->signal->rlim + resource;
2766 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2770 /* Control the ability to change the hard limit (whether
2771 lowering or raising it), so that the hard limit can
2772 later be used as a safe reset point for the soft limit
2773 upon context transitions. See selinux_bprm_apply_creds. */
2774 if (old_rlim->rlim_max != new_rlim->rlim_max)
2775 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2780 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2782 return task_has_perm(current, p, PROCESS__SETSCHED);
2785 static int selinux_task_getscheduler(struct task_struct *p)
2787 return task_has_perm(current, p, PROCESS__GETSCHED);
2790 static int selinux_task_movememory(struct task_struct *p)
2792 return task_has_perm(current, p, PROCESS__SETSCHED);
2795 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2800 struct task_security_struct *tsec;
2802 rc = secondary_ops->task_kill(p, info, sig, secid);
2806 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2810 perm = PROCESS__SIGNULL; /* null signal; existence test */
2812 perm = signal_to_av(sig);
2815 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2817 rc = task_has_perm(current, p, perm);
2821 static int selinux_task_prctl(int option,
2827 /* The current prctl operations do not appear to require
2828 any SELinux controls since they merely observe or modify
2829 the state of the current process. */
2833 static int selinux_task_wait(struct task_struct *p)
2837 perm = signal_to_av(p->exit_signal);
2839 return task_has_perm(p, current, perm);
2842 static void selinux_task_reparent_to_init(struct task_struct *p)
2844 struct task_security_struct *tsec;
2846 secondary_ops->task_reparent_to_init(p);
2849 tsec->osid = tsec->sid;
2850 tsec->sid = SECINITSID_KERNEL;
2854 static void selinux_task_to_inode(struct task_struct *p,
2855 struct inode *inode)
2857 struct task_security_struct *tsec = p->security;
2858 struct inode_security_struct *isec = inode->i_security;
2860 isec->sid = tsec->sid;
2861 isec->initialized = 1;
2865 /* Returns error only if unable to parse addresses */
2866 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2868 int offset, ihlen, ret = -EINVAL;
2869 struct iphdr _iph, *ih;
2871 offset = skb->nh.raw - skb->data;
2872 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2876 ihlen = ih->ihl * 4;
2877 if (ihlen < sizeof(_iph))
2880 ad->u.net.v4info.saddr = ih->saddr;
2881 ad->u.net.v4info.daddr = ih->daddr;
2884 switch (ih->protocol) {
2886 struct tcphdr _tcph, *th;
2888 if (ntohs(ih->frag_off) & IP_OFFSET)
2892 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2896 ad->u.net.sport = th->source;
2897 ad->u.net.dport = th->dest;
2902 struct udphdr _udph, *uh;
2904 if (ntohs(ih->frag_off) & IP_OFFSET)
2908 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2912 ad->u.net.sport = uh->source;
2913 ad->u.net.dport = uh->dest;
2924 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2926 /* Returns error only if unable to parse addresses */
2927 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2930 int ret = -EINVAL, offset;
2931 struct ipv6hdr _ipv6h, *ip6;
2933 offset = skb->nh.raw - skb->data;
2934 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2938 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2939 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2942 nexthdr = ip6->nexthdr;
2943 offset += sizeof(_ipv6h);
2944 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2950 struct tcphdr _tcph, *th;
2952 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2956 ad->u.net.sport = th->source;
2957 ad->u.net.dport = th->dest;
2962 struct udphdr _udph, *uh;
2964 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2968 ad->u.net.sport = uh->source;
2969 ad->u.net.dport = uh->dest;
2973 /* includes fragments */
2983 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2984 char **addrp, int *len, int src)
2988 switch (ad->u.net.family) {
2990 ret = selinux_parse_skb_ipv4(skb, ad);
2994 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2995 &ad->u.net.v4info.daddr);
2998 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3000 ret = selinux_parse_skb_ipv6(skb, ad);
3004 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3005 &ad->u.net.v6info.daddr);
3015 /* socket security operations */
3016 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3019 struct inode_security_struct *isec;
3020 struct task_security_struct *tsec;
3021 struct avc_audit_data ad;
3024 tsec = task->security;
3025 isec = SOCK_INODE(sock)->i_security;
3027 if (isec->sid == SECINITSID_KERNEL)
3030 AVC_AUDIT_DATA_INIT(&ad,NET);
3031 ad.u.net.sk = sock->sk;
3032 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3038 static int selinux_socket_create(int family, int type,
3039 int protocol, int kern)
3042 struct task_security_struct *tsec;
3048 tsec = current->security;
3049 newsid = tsec->sockcreate_sid ? : tsec->sid;
3050 err = avc_has_perm(tsec->sid, newsid,
3051 socket_type_to_security_class(family, type,
3052 protocol), SOCKET__CREATE, NULL);
3058 static int selinux_socket_post_create(struct socket *sock, int family,
3059 int type, int protocol, int kern)
3062 struct inode_security_struct *isec;
3063 struct task_security_struct *tsec;
3064 struct sk_security_struct *sksec;
3067 isec = SOCK_INODE(sock)->i_security;
3069 tsec = current->security;
3070 newsid = tsec->sockcreate_sid ? : tsec->sid;
3071 isec->sclass = socket_type_to_security_class(family, type, protocol);
3072 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3073 isec->initialized = 1;
3076 sksec = sock->sk->sk_security;
3077 sksec->sid = isec->sid;
3078 err = selinux_netlbl_socket_post_create(sock,
3086 /* Range of port numbers used to automatically bind.
3087 Need to determine whether we should perform a name_bind
3088 permission check between the socket and the port number. */
3089 #define ip_local_port_range_0 sysctl_local_port_range[0]
3090 #define ip_local_port_range_1 sysctl_local_port_range[1]
3092 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3097 err = socket_has_perm(current, sock, SOCKET__BIND);
3102 * If PF_INET or PF_INET6, check name_bind permission for the port.
3103 * Multiple address binding for SCTP is not supported yet: we just
3104 * check the first address now.
3106 family = sock->sk->sk_family;
3107 if (family == PF_INET || family == PF_INET6) {
3109 struct inode_security_struct *isec;
3110 struct task_security_struct *tsec;
3111 struct avc_audit_data ad;
3112 struct sockaddr_in *addr4 = NULL;
3113 struct sockaddr_in6 *addr6 = NULL;
3114 unsigned short snum;
3115 struct sock *sk = sock->sk;
3116 u32 sid, node_perm, addrlen;
3118 tsec = current->security;
3119 isec = SOCK_INODE(sock)->i_security;
3121 if (family == PF_INET) {
3122 addr4 = (struct sockaddr_in *)address;
3123 snum = ntohs(addr4->sin_port);
3124 addrlen = sizeof(addr4->sin_addr.s_addr);
3125 addrp = (char *)&addr4->sin_addr.s_addr;
3127 addr6 = (struct sockaddr_in6 *)address;
3128 snum = ntohs(addr6->sin6_port);
3129 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3130 addrp = (char *)&addr6->sin6_addr.s6_addr;
3133 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3134 snum > ip_local_port_range_1)) {
3135 err = security_port_sid(sk->sk_family, sk->sk_type,
3136 sk->sk_protocol, snum, &sid);
3139 AVC_AUDIT_DATA_INIT(&ad,NET);
3140 ad.u.net.sport = htons(snum);
3141 ad.u.net.family = family;
3142 err = avc_has_perm(isec->sid, sid,
3144 SOCKET__NAME_BIND, &ad);
3149 switch(isec->sclass) {
3150 case SECCLASS_TCP_SOCKET:
3151 node_perm = TCP_SOCKET__NODE_BIND;
3154 case SECCLASS_UDP_SOCKET:
3155 node_perm = UDP_SOCKET__NODE_BIND;
3159 node_perm = RAWIP_SOCKET__NODE_BIND;
3163 err = security_node_sid(family, addrp, addrlen, &sid);
3167 AVC_AUDIT_DATA_INIT(&ad,NET);
3168 ad.u.net.sport = htons(snum);
3169 ad.u.net.family = family;
3171 if (family == PF_INET)
3172 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3174 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3176 err = avc_has_perm(isec->sid, sid,
3177 isec->sclass, node_perm, &ad);
3185 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3187 struct inode_security_struct *isec;
3190 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3195 * If a TCP socket, check name_connect permission for the port.
3197 isec = SOCK_INODE(sock)->i_security;
3198 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3199 struct sock *sk = sock->sk;
3200 struct avc_audit_data ad;
3201 struct sockaddr_in *addr4 = NULL;
3202 struct sockaddr_in6 *addr6 = NULL;
3203 unsigned short snum;
3206 if (sk->sk_family == PF_INET) {
3207 addr4 = (struct sockaddr_in *)address;
3208 if (addrlen < sizeof(struct sockaddr_in))
3210 snum = ntohs(addr4->sin_port);
3212 addr6 = (struct sockaddr_in6 *)address;
3213 if (addrlen < SIN6_LEN_RFC2133)
3215 snum = ntohs(addr6->sin6_port);
3218 err = security_port_sid(sk->sk_family, sk->sk_type,
3219 sk->sk_protocol, snum, &sid);
3223 AVC_AUDIT_DATA_INIT(&ad,NET);
3224 ad.u.net.dport = htons(snum);
3225 ad.u.net.family = sk->sk_family;
3226 err = avc_has_perm(isec->sid, sid, isec->sclass,
3227 TCP_SOCKET__NAME_CONNECT, &ad);
3236 static int selinux_socket_listen(struct socket *sock, int backlog)
3238 return socket_has_perm(current, sock, SOCKET__LISTEN);
3241 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3244 struct inode_security_struct *isec;
3245 struct inode_security_struct *newisec;
3247 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3251 newisec = SOCK_INODE(newsock)->i_security;
3253 isec = SOCK_INODE(sock)->i_security;
3254 newisec->sclass = isec->sclass;
3255 newisec->sid = isec->sid;
3256 newisec->initialized = 1;
3261 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3266 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3270 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3273 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3274 int size, int flags)
3276 return socket_has_perm(current, sock, SOCKET__READ);
3279 static int selinux_socket_getsockname(struct socket *sock)
3281 return socket_has_perm(current, sock, SOCKET__GETATTR);
3284 static int selinux_socket_getpeername(struct socket *sock)
3286 return socket_has_perm(current, sock, SOCKET__GETATTR);
3289 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3291 return socket_has_perm(current, sock, SOCKET__SETOPT);
3294 static int selinux_socket_getsockopt(struct socket *sock, int level,
3297 return socket_has_perm(current, sock, SOCKET__GETOPT);
3300 static int selinux_socket_shutdown(struct socket *sock, int how)
3302 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3305 static int selinux_socket_unix_stream_connect(struct socket *sock,
3306 struct socket *other,
3309 struct sk_security_struct *ssec;
3310 struct inode_security_struct *isec;
3311 struct inode_security_struct *other_isec;
3312 struct avc_audit_data ad;
3315 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3319 isec = SOCK_INODE(sock)->i_security;
3320 other_isec = SOCK_INODE(other)->i_security;
3322 AVC_AUDIT_DATA_INIT(&ad,NET);
3323 ad.u.net.sk = other->sk;
3325 err = avc_has_perm(isec->sid, other_isec->sid,
3327 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3331 /* connecting socket */
3332 ssec = sock->sk->sk_security;
3333 ssec->peer_sid = other_isec->sid;
3335 /* server child socket */
3336 ssec = newsk->sk_security;
3337 ssec->peer_sid = isec->sid;
3338 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3343 static int selinux_socket_unix_may_send(struct socket *sock,
3344 struct socket *other)
3346 struct inode_security_struct *isec;
3347 struct inode_security_struct *other_isec;
3348 struct avc_audit_data ad;
3351 isec = SOCK_INODE(sock)->i_security;
3352 other_isec = SOCK_INODE(other)->i_security;
3354 AVC_AUDIT_DATA_INIT(&ad,NET);
3355 ad.u.net.sk = other->sk;
3357 err = avc_has_perm(isec->sid, other_isec->sid,
3358 isec->sclass, SOCKET__SENDTO, &ad);
3365 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3366 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3369 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3370 struct socket *sock;
3374 read_lock_bh(&sk->sk_callback_lock);
3375 sock = sk->sk_socket;
3377 struct inode *inode;
3378 inode = SOCK_INODE(sock);
3380 struct inode_security_struct *isec;
3381 isec = inode->i_security;
3382 sock_sid = isec->sid;
3383 sock_class = isec->sclass;
3386 read_unlock_bh(&sk->sk_callback_lock);
3393 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3397 switch (sock_class) {
3398 case SECCLASS_UDP_SOCKET:
3399 netif_perm = NETIF__UDP_RECV;
3400 node_perm = NODE__UDP_RECV;
3401 recv_perm = UDP_SOCKET__RECV_MSG;
3404 case SECCLASS_TCP_SOCKET:
3405 netif_perm = NETIF__TCP_RECV;
3406 node_perm = NODE__TCP_RECV;
3407 recv_perm = TCP_SOCKET__RECV_MSG;
3411 netif_perm = NETIF__RAWIP_RECV;
3412 node_perm = NODE__RAWIP_RECV;
3416 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3420 err = security_node_sid(family, addrp, len, &node_sid);
3424 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3431 err = security_port_sid(sk->sk_family, sk->sk_type,
3432 sk->sk_protocol, ntohs(ad->u.net.sport),
3437 err = avc_has_perm(sock_sid, port_sid,
3438 sock_class, recv_perm, ad);
3445 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3450 struct avc_audit_data ad;
3451 struct sk_security_struct *sksec = sk->sk_security;
3453 family = sk->sk_family;
3454 if (family != PF_INET && family != PF_INET6)
3457 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3458 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3461 AVC_AUDIT_DATA_INIT(&ad, NET);
3462 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3463 ad.u.net.family = family;
3465 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3469 if (selinux_compat_net)
3470 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3473 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3478 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3482 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3487 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3488 int __user *optlen, unsigned len)
3493 struct sk_security_struct *ssec;
3494 struct inode_security_struct *isec;
3497 isec = SOCK_INODE(sock)->i_security;
3499 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3500 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3501 ssec = sock->sk->sk_security;
3502 peer_sid = ssec->peer_sid;
3504 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3505 peer_sid = selinux_netlbl_socket_getpeersec_stream(sock);
3506 if (peer_sid == SECSID_NULL)
3507 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3508 if (peer_sid == SECSID_NULL) {
3518 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3523 if (scontext_len > len) {
3528 if (copy_to_user(optval, scontext, scontext_len))
3532 if (put_user(scontext_len, optlen))
3540 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3542 u32 peer_secid = SECSID_NULL;
3545 if (sock && (sock->sk->sk_family == PF_UNIX))
3546 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3548 peer_secid = selinux_netlbl_socket_getpeersec_dgram(skb);
3549 if (peer_secid == SECSID_NULL)
3550 peer_secid = selinux_socket_getpeer_dgram(skb);
3553 if (peer_secid == SECSID_NULL)
3555 *secid = peer_secid;
3560 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3562 return sk_alloc_security(sk, family, priority);
3565 static void selinux_sk_free_security(struct sock *sk)
3567 sk_free_security(sk);
3570 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3572 struct sk_security_struct *ssec = sk->sk_security;
3573 struct sk_security_struct *newssec = newsk->sk_security;
3575 newssec->sid = ssec->sid;
3576 newssec->peer_sid = ssec->peer_sid;
3578 selinux_netlbl_sk_clone_security(ssec, newssec);
3581 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3584 *secid = SECINITSID_ANY_SOCKET;
3586 struct sk_security_struct *sksec = sk->sk_security;
3588 *secid = sksec->sid;
3592 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3594 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3595 struct sk_security_struct *sksec = sk->sk_security;
3597 isec->sid = sksec->sid;
3599 selinux_netlbl_sock_graft(sk, parent);
3602 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3603 struct request_sock *req)
3605 struct sk_security_struct *sksec = sk->sk_security;
3610 newsid = selinux_netlbl_inet_conn_request(skb, sksec->sid);
3611 if (newsid != SECSID_NULL) {
3612 req->secid = newsid;
3616 err = selinux_xfrm_decode_session(skb, &peersid, 0);
3619 if (peersid == SECSID_NULL) {
3620 req->secid = sksec->sid;
3624 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3628 req->secid = newsid;
3632 static void selinux_inet_csk_clone(struct sock *newsk,
3633 const struct request_sock *req)
3635 struct sk_security_struct *newsksec = newsk->sk_security;
3637 newsksec->sid = req->secid;
3638 /* NOTE: Ideally, we should also get the isec->sid for the
3639 new socket in sync, but we don't have the isec available yet.
3640 So we will wait until sock_graft to do it, by which
3641 time it will have been created and available. */
3643 selinux_netlbl_sk_security_init(newsksec, req->rsk_ops->family);
3646 static void selinux_req_classify_flow(const struct request_sock *req,
3649 fl->secid = req->secid;
3652 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3656 struct nlmsghdr *nlh;
3657 struct socket *sock = sk->sk_socket;
3658 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3660 if (skb->len < NLMSG_SPACE(0)) {
3664 nlh = (struct nlmsghdr *)skb->data;
3666 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3668 if (err == -EINVAL) {
3669 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3670 "SELinux: unrecognized netlink message"
3671 " type=%hu for sclass=%hu\n",
3672 nlh->nlmsg_type, isec->sclass);
3673 if (!selinux_enforcing)
3683 err = socket_has_perm(current, sock, perm);
3688 #ifdef CONFIG_NETFILTER
3690 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3691 struct avc_audit_data *ad,
3692 u16 family, char *addrp, int len)
3695 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3696 struct socket *sock;
3697 struct inode *inode;
3698 struct inode_security_struct *isec;
3700 sock = sk->sk_socket;
3704 inode = SOCK_INODE(sock);
3708 isec = inode->i_security;
3710 err = sel_netif_sids(dev, &if_sid, NULL);
3714 switch (isec->sclass) {
3715 case SECCLASS_UDP_SOCKET:
3716 netif_perm = NETIF__UDP_SEND;
3717 node_perm = NODE__UDP_SEND;
3718 send_perm = UDP_SOCKET__SEND_MSG;
3721 case SECCLASS_TCP_SOCKET:
3722 netif_perm = NETIF__TCP_SEND;
3723 node_perm = NODE__TCP_SEND;
3724 send_perm = TCP_SOCKET__SEND_MSG;
3728 netif_perm = NETIF__RAWIP_SEND;
3729 node_perm = NODE__RAWIP_SEND;
3733 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3737 err = security_node_sid(family, addrp, len, &node_sid);
3741 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3748 err = security_port_sid(sk->sk_family,
3751 ntohs(ad->u.net.dport),
3756 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3763 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3764 struct sk_buff **pskb,
3765 const struct net_device *in,
3766 const struct net_device *out,
3767 int (*okfn)(struct sk_buff *),
3773 struct sk_buff *skb = *pskb;
3774 struct avc_audit_data ad;
3775 struct net_device *dev = (struct net_device *)out;
3776 struct sk_security_struct *sksec;
3782 sksec = sk->sk_security;
3784 AVC_AUDIT_DATA_INIT(&ad, NET);
3785 ad.u.net.netif = dev->name;
3786 ad.u.net.family = family;
3788 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3792 if (selinux_compat_net)
3793 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3794 family, addrp, len);
3796 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3802 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad);
3804 return err ? NF_DROP : NF_ACCEPT;
3807 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3808 struct sk_buff **pskb,
3809 const struct net_device *in,
3810 const struct net_device *out,
3811 int (*okfn)(struct sk_buff *))
3813 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3816 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3818 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3819 struct sk_buff **pskb,
3820 const struct net_device *in,
3821 const struct net_device *out,
3822 int (*okfn)(struct sk_buff *))
3824 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3829 #endif /* CONFIG_NETFILTER */
3831 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3835 err = secondary_ops->netlink_send(sk, skb);
3839 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3840 err = selinux_nlmsg_perm(sk, skb);
3845 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3848 struct avc_audit_data ad;
3850 err = secondary_ops->netlink_recv(skb, capability);
3854 AVC_AUDIT_DATA_INIT(&ad, CAP);
3855 ad.u.cap = capability;
3857 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3858 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3861 static int ipc_alloc_security(struct task_struct *task,
3862 struct kern_ipc_perm *perm,
3865 struct task_security_struct *tsec = task->security;
3866 struct ipc_security_struct *isec;
3868 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3872 isec->sclass = sclass;
3873 isec->ipc_perm = perm;
3874 isec->sid = tsec->sid;
3875 perm->security = isec;
3880 static void ipc_free_security(struct kern_ipc_perm *perm)
3882 struct ipc_security_struct *isec = perm->security;
3883 perm->security = NULL;
3887 static int msg_msg_alloc_security(struct msg_msg *msg)
3889 struct msg_security_struct *msec;
3891 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3896 msec->sid = SECINITSID_UNLABELED;
3897 msg->security = msec;
3902 static void msg_msg_free_security(struct msg_msg *msg)
3904 struct msg_security_struct *msec = msg->security;
3906 msg->security = NULL;
3910 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3913 struct task_security_struct *tsec;
3914 struct ipc_security_struct *isec;
3915 struct avc_audit_data ad;
3917 tsec = current->security;
3918 isec = ipc_perms->security;
3920 AVC_AUDIT_DATA_INIT(&ad, IPC);
3921 ad.u.ipc_id = ipc_perms->key;
3923 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3926 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3928 return msg_msg_alloc_security(msg);
3931 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3933 msg_msg_free_security(msg);
3936 /* message queue security operations */
3937 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3939 struct task_security_struct *tsec;
3940 struct ipc_security_struct *isec;
3941 struct avc_audit_data ad;
3944 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3948 tsec = current->security;
3949 isec = msq->q_perm.security;
3951 AVC_AUDIT_DATA_INIT(&ad, IPC);
3952 ad.u.ipc_id = msq->q_perm.key;
3954 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3957 ipc_free_security(&msq->q_perm);
3963 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3965 ipc_free_security(&msq->q_perm);
3968 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3970 struct task_security_struct *tsec;
3971 struct ipc_security_struct *isec;
3972 struct avc_audit_data ad;
3974 tsec = current->security;
3975 isec = msq->q_perm.security;
3977 AVC_AUDIT_DATA_INIT(&ad, IPC);
3978 ad.u.ipc_id = msq->q_perm.key;
3980 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3981 MSGQ__ASSOCIATE, &ad);
3984 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3992 /* No specific object, just general system-wide information. */
3993 return task_has_system(current, SYSTEM__IPC_INFO);
3996 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3999 perms = MSGQ__SETATTR;
4002 perms = MSGQ__DESTROY;
4008 err = ipc_has_perm(&msq->q_perm, perms);
4012 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4014 struct task_security_struct *tsec;
4015 struct ipc_security_struct *isec;
4016 struct msg_security_struct *msec;
4017 struct avc_audit_data ad;
4020 tsec = current->security;
4021 isec = msq->q_perm.security;
4022 msec = msg->security;
4025 * First time through, need to assign label to the message
4027 if (msec->sid == SECINITSID_UNLABELED) {
4029 * Compute new sid based on current process and
4030 * message queue this message will be stored in
4032 rc = security_transition_sid(tsec->sid,
4040 AVC_AUDIT_DATA_INIT(&ad, IPC);
4041 ad.u.ipc_id = msq->q_perm.key;
4043 /* Can this process write to the queue? */
4044 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4047 /* Can this process send the message */
4048 rc = avc_has_perm(tsec->sid, msec->sid,
4049 SECCLASS_MSG, MSG__SEND, &ad);
4051 /* Can the message be put in the queue? */
4052 rc = avc_has_perm(msec->sid, isec->sid,
4053 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4058 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4059 struct task_struct *target,
4060 long type, int mode)
4062 struct task_security_struct *tsec;
4063 struct ipc_security_struct *isec;
4064 struct msg_security_struct *msec;
4065 struct avc_audit_data ad;
4068 tsec = target->security;
4069 isec = msq->q_perm.security;
4070 msec = msg->security;
4072 AVC_AUDIT_DATA_INIT(&ad, IPC);
4073 ad.u.ipc_id = msq->q_perm.key;
4075 rc = avc_has_perm(tsec->sid, isec->sid,
4076 SECCLASS_MSGQ, MSGQ__READ, &ad);
4078 rc = avc_has_perm(tsec->sid, msec->sid,
4079 SECCLASS_MSG, MSG__RECEIVE, &ad);
4083 /* Shared Memory security operations */
4084 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4086 struct task_security_struct *tsec;
4087 struct ipc_security_struct *isec;
4088 struct avc_audit_data ad;
4091 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4095 tsec = current->security;
4096 isec = shp->shm_perm.security;
4098 AVC_AUDIT_DATA_INIT(&ad, IPC);
4099 ad.u.ipc_id = shp->shm_perm.key;
4101 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4104 ipc_free_security(&shp->shm_perm);
4110 static void selinux_shm_free_security(struct shmid_kernel *shp)
4112 ipc_free_security(&shp->shm_perm);
4115 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4117 struct task_security_struct *tsec;
4118 struct ipc_security_struct *isec;
4119 struct avc_audit_data ad;
4121 tsec = current->security;
4122 isec = shp->shm_perm.security;
4124 AVC_AUDIT_DATA_INIT(&ad, IPC);
4125 ad.u.ipc_id = shp->shm_perm.key;
4127 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4128 SHM__ASSOCIATE, &ad);
4131 /* Note, at this point, shp is locked down */
4132 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4140 /* No specific object, just general system-wide information. */
4141 return task_has_system(current, SYSTEM__IPC_INFO);
4144 perms = SHM__GETATTR | SHM__ASSOCIATE;
4147 perms = SHM__SETATTR;
4154 perms = SHM__DESTROY;
4160 err = ipc_has_perm(&shp->shm_perm, perms);
4164 static int selinux_shm_shmat(struct shmid_kernel *shp,
4165 char __user *shmaddr, int shmflg)
4170 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4174 if (shmflg & SHM_RDONLY)
4177 perms = SHM__READ | SHM__WRITE;
4179 return ipc_has_perm(&shp->shm_perm, perms);
4182 /* Semaphore security operations */
4183 static int selinux_sem_alloc_security(struct sem_array *sma)
4185 struct task_security_struct *tsec;
4186 struct ipc_security_struct *isec;
4187 struct avc_audit_data ad;
4190 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4194 tsec = current->security;
4195 isec = sma->sem_perm.security;
4197 AVC_AUDIT_DATA_INIT(&ad, IPC);
4198 ad.u.ipc_id = sma->sem_perm.key;
4200 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4203 ipc_free_security(&sma->sem_perm);
4209 static void selinux_sem_free_security(struct sem_array *sma)
4211 ipc_free_security(&sma->sem_perm);
4214 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4216 struct task_security_struct *tsec;
4217 struct ipc_security_struct *isec;
4218 struct avc_audit_data ad;
4220 tsec = current->security;
4221 isec = sma->sem_perm.security;
4223 AVC_AUDIT_DATA_INIT(&ad, IPC);
4224 ad.u.ipc_id = sma->sem_perm.key;
4226 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4227 SEM__ASSOCIATE, &ad);
4230 /* Note, at this point, sma is locked down */
4231 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4239 /* No specific object, just general system-wide information. */
4240 return task_has_system(current, SYSTEM__IPC_INFO);
4244 perms = SEM__GETATTR;
4255 perms = SEM__DESTROY;
4258 perms = SEM__SETATTR;
4262 perms = SEM__GETATTR | SEM__ASSOCIATE;
4268 err = ipc_has_perm(&sma->sem_perm, perms);
4272 static int selinux_sem_semop(struct sem_array *sma,
4273 struct sembuf *sops, unsigned nsops, int alter)
4278 perms = SEM__READ | SEM__WRITE;
4282 return ipc_has_perm(&sma->sem_perm, perms);
4285 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4291 av |= IPC__UNIX_READ;
4293 av |= IPC__UNIX_WRITE;
4298 return ipc_has_perm(ipcp, av);
4301 /* module stacking operations */
4302 static int selinux_register_security (const char *name, struct security_operations *ops)
4304 if (secondary_ops != original_ops) {
4305 printk(KERN_INFO "%s: There is already a secondary security "
4306 "module registered.\n", __FUNCTION__);
4310 secondary_ops = ops;
4312 printk(KERN_INFO "%s: Registering secondary module %s\n",
4319 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4321 if (ops != secondary_ops) {
4322 printk (KERN_INFO "%s: trying to unregister a security module "
4323 "that is not registered.\n", __FUNCTION__);
4327 secondary_ops = original_ops;
4332 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4335 inode_doinit_with_dentry(inode, dentry);
4338 static int selinux_getprocattr(struct task_struct *p,
4339 char *name, void *value, size_t size)
4341 struct task_security_struct *tsec;
4346 error = task_has_perm(current, p, PROCESS__GETATTR);
4353 if (!strcmp(name, "current"))
4355 else if (!strcmp(name, "prev"))
4357 else if (!strcmp(name, "exec"))
4358 sid = tsec->exec_sid;
4359 else if (!strcmp(name, "fscreate"))
4360 sid = tsec->create_sid;
4361 else if (!strcmp(name, "keycreate"))
4362 sid = tsec->keycreate_sid;
4363 else if (!strcmp(name, "sockcreate"))
4364 sid = tsec->sockcreate_sid;
4371 return selinux_getsecurity(sid, value, size);
4374 static int selinux_setprocattr(struct task_struct *p,
4375 char *name, void *value, size_t size)
4377 struct task_security_struct *tsec;
4383 /* SELinux only allows a process to change its own
4384 security attributes. */
4389 * Basic control over ability to set these attributes at all.
4390 * current == p, but we'll pass them separately in case the
4391 * above restriction is ever removed.
4393 if (!strcmp(name, "exec"))
4394 error = task_has_perm(current, p, PROCESS__SETEXEC);
4395 else if (!strcmp(name, "fscreate"))
4396 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4397 else if (!strcmp(name, "keycreate"))
4398 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4399 else if (!strcmp(name, "sockcreate"))
4400 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4401 else if (!strcmp(name, "current"))
4402 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4408 /* Obtain a SID for the context, if one was specified. */
4409 if (size && str[1] && str[1] != '\n') {
4410 if (str[size-1] == '\n') {
4414 error = security_context_to_sid(value, size, &sid);
4419 /* Permission checking based on the specified context is
4420 performed during the actual operation (execve,
4421 open/mkdir/...), when we know the full context of the
4422 operation. See selinux_bprm_set_security for the execve
4423 checks and may_create for the file creation checks. The
4424 operation will then fail if the context is not permitted. */
4426 if (!strcmp(name, "exec"))
4427 tsec->exec_sid = sid;
4428 else if (!strcmp(name, "fscreate"))
4429 tsec->create_sid = sid;
4430 else if (!strcmp(name, "keycreate")) {
4431 error = may_create_key(sid, p);
4434 tsec->keycreate_sid = sid;
4435 } else if (!strcmp(name, "sockcreate"))
4436 tsec->sockcreate_sid = sid;
4437 else if (!strcmp(name, "current")) {
4438 struct av_decision avd;
4443 /* Only allow single threaded processes to change context */
4444 if (atomic_read(&p->mm->mm_users) != 1) {
4445 struct task_struct *g, *t;
4446 struct mm_struct *mm = p->mm;
4447 read_lock(&tasklist_lock);
4448 do_each_thread(g, t)
4449 if (t->mm == mm && t != p) {
4450 read_unlock(&tasklist_lock);
4453 while_each_thread(g, t);
4454 read_unlock(&tasklist_lock);
4457 /* Check permissions for the transition. */
4458 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4459 PROCESS__DYNTRANSITION, NULL);
4463 /* Check for ptracing, and update the task SID if ok.
4464 Otherwise, leave SID unchanged and fail. */
4466 if (p->ptrace & PT_PTRACED) {
4467 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4469 PROCESS__PTRACE, &avd);
4473 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4474 PROCESS__PTRACE, &avd, error, NULL);
4488 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4490 return security_sid_to_context(secid, secdata, seclen);
4493 static void selinux_release_secctx(char *secdata, u32 seclen)
4501 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4502 unsigned long flags)
4504 struct task_security_struct *tsec = tsk->security;
4505 struct key_security_struct *ksec;
4507 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4512 if (tsec->keycreate_sid)
4513 ksec->sid = tsec->keycreate_sid;
4515 ksec->sid = tsec->sid;
4521 static void selinux_key_free(struct key *k)
4523 struct key_security_struct *ksec = k->security;
4529 static int selinux_key_permission(key_ref_t key_ref,
4530 struct task_struct *ctx,
4534 struct task_security_struct *tsec;
4535 struct key_security_struct *ksec;
4537 key = key_ref_to_ptr(key_ref);
4539 tsec = ctx->security;
4540 ksec = key->security;
4542 /* if no specific permissions are requested, we skip the
4543 permission check. No serious, additional covert channels
4544 appear to be created. */
4548 return avc_has_perm(tsec->sid, ksec->sid,
4549 SECCLASS_KEY, perm, NULL);
4554 static struct security_operations selinux_ops = {
4555 .ptrace = selinux_ptrace,
4556 .capget = selinux_capget,
4557 .capset_check = selinux_capset_check,
4558 .capset_set = selinux_capset_set,
4559 .sysctl = selinux_sysctl,
4560 .capable = selinux_capable,
4561 .quotactl = selinux_quotactl,
4562 .quota_on = selinux_quota_on,
4563 .syslog = selinux_syslog,
4564 .vm_enough_memory = selinux_vm_enough_memory,
4566 .netlink_send = selinux_netlink_send,
4567 .netlink_recv = selinux_netlink_recv,
4569 .bprm_alloc_security = selinux_bprm_alloc_security,
4570 .bprm_free_security = selinux_bprm_free_security,
4571 .bprm_apply_creds = selinux_bprm_apply_creds,
4572 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4573 .bprm_set_security = selinux_bprm_set_security,
4574 .bprm_check_security = selinux_bprm_check_security,
4575 .bprm_secureexec = selinux_bprm_secureexec,
4577 .sb_alloc_security = selinux_sb_alloc_security,
4578 .sb_free_security = selinux_sb_free_security,
4579 .sb_copy_data = selinux_sb_copy_data,
4580 .sb_kern_mount = selinux_sb_kern_mount,
4581 .sb_statfs = selinux_sb_statfs,
4582 .sb_mount = selinux_mount,
4583 .sb_umount = selinux_umount,
4585 .inode_alloc_security = selinux_inode_alloc_security,
4586 .inode_free_security = selinux_inode_free_security,
4587 .inode_init_security = selinux_inode_init_security,
4588 .inode_create = selinux_inode_create,
4589 .inode_link = selinux_inode_link,
4590 .inode_unlink = selinux_inode_unlink,
4591 .inode_symlink = selinux_inode_symlink,
4592 .inode_mkdir = selinux_inode_mkdir,
4593 .inode_rmdir = selinux_inode_rmdir,
4594 .inode_mknod = selinux_inode_mknod,
4595 .inode_rename = selinux_inode_rename,
4596 .inode_readlink = selinux_inode_readlink,
4597 .inode_follow_link = selinux_inode_follow_link,
4598 .inode_permission = selinux_inode_permission,
4599 .inode_setattr = selinux_inode_setattr,
4600 .inode_getattr = selinux_inode_getattr,
4601 .inode_setxattr = selinux_inode_setxattr,
4602 .inode_post_setxattr = selinux_inode_post_setxattr,
4603 .inode_getxattr = selinux_inode_getxattr,
4604 .inode_listxattr = selinux_inode_listxattr,
4605 .inode_removexattr = selinux_inode_removexattr,
4606 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4607 .inode_getsecurity = selinux_inode_getsecurity,
4608 .inode_setsecurity = selinux_inode_setsecurity,
4609 .inode_listsecurity = selinux_inode_listsecurity,
4611 .file_permission = selinux_file_permission,
4612 .file_alloc_security = selinux_file_alloc_security,
4613 .file_free_security = selinux_file_free_security,
4614 .file_ioctl = selinux_file_ioctl,
4615 .file_mmap = selinux_file_mmap,
4616 .file_mprotect = selinux_file_mprotect,
4617 .file_lock = selinux_file_lock,
4618 .file_fcntl = selinux_file_fcntl,
4619 .file_set_fowner = selinux_file_set_fowner,
4620 .file_send_sigiotask = selinux_file_send_sigiotask,
4621 .file_receive = selinux_file_receive,
4623 .task_create = selinux_task_create,
4624 .task_alloc_security = selinux_task_alloc_security,
4625 .task_free_security = selinux_task_free_security,
4626 .task_setuid = selinux_task_setuid,
4627 .task_post_setuid = selinux_task_post_setuid,
4628 .task_setgid = selinux_task_setgid,
4629 .task_setpgid = selinux_task_setpgid,
4630 .task_getpgid = selinux_task_getpgid,
4631 .task_getsid = selinux_task_getsid,
4632 .task_getsecid = selinux_task_getsecid,
4633 .task_setgroups = selinux_task_setgroups,
4634 .task_setnice = selinux_task_setnice,
4635 .task_setioprio = selinux_task_setioprio,
4636 .task_getioprio = selinux_task_getioprio,
4637 .task_setrlimit = selinux_task_setrlimit,
4638 .task_setscheduler = selinux_task_setscheduler,
4639 .task_getscheduler = selinux_task_getscheduler,
4640 .task_movememory = selinux_task_movememory,
4641 .task_kill = selinux_task_kill,
4642 .task_wait = selinux_task_wait,
4643 .task_prctl = selinux_task_prctl,
4644 .task_reparent_to_init = selinux_task_reparent_to_init,
4645 .task_to_inode = selinux_task_to_inode,
4647 .ipc_permission = selinux_ipc_permission,
4649 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4650 .msg_msg_free_security = selinux_msg_msg_free_security,
4652 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4653 .msg_queue_free_security = selinux_msg_queue_free_security,
4654 .msg_queue_associate = selinux_msg_queue_associate,
4655 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4656 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4657 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4659 .shm_alloc_security = selinux_shm_alloc_security,
4660 .shm_free_security = selinux_shm_free_security,
4661 .shm_associate = selinux_shm_associate,
4662 .shm_shmctl = selinux_shm_shmctl,
4663 .shm_shmat = selinux_shm_shmat,
4665 .sem_alloc_security = selinux_sem_alloc_security,
4666 .sem_free_security = selinux_sem_free_security,
4667 .sem_associate = selinux_sem_associate,
4668 .sem_semctl = selinux_sem_semctl,
4669 .sem_semop = selinux_sem_semop,
4671 .register_security = selinux_register_security,
4672 .unregister_security = selinux_unregister_security,
4674 .d_instantiate = selinux_d_instantiate,
4676 .getprocattr = selinux_getprocattr,
4677 .setprocattr = selinux_setprocattr,
4679 .secid_to_secctx = selinux_secid_to_secctx,
4680 .release_secctx = selinux_release_secctx,
4682 .unix_stream_connect = selinux_socket_unix_stream_connect,
4683 .unix_may_send = selinux_socket_unix_may_send,
4685 .socket_create = selinux_socket_create,
4686 .socket_post_create = selinux_socket_post_create,
4687 .socket_bind = selinux_socket_bind,
4688 .socket_connect = selinux_socket_connect,
4689 .socket_listen = selinux_socket_listen,
4690 .socket_accept = selinux_socket_accept,
4691 .socket_sendmsg = selinux_socket_sendmsg,
4692 .socket_recvmsg = selinux_socket_recvmsg,
4693 .socket_getsockname = selinux_socket_getsockname,
4694 .socket_getpeername = selinux_socket_getpeername,
4695 .socket_getsockopt = selinux_socket_getsockopt,
4696 .socket_setsockopt = selinux_socket_setsockopt,
4697 .socket_shutdown = selinux_socket_shutdown,
4698 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4699 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4700 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4701 .sk_alloc_security = selinux_sk_alloc_security,
4702 .sk_free_security = selinux_sk_free_security,
4703 .sk_clone_security = selinux_sk_clone_security,
4704 .sk_getsecid = selinux_sk_getsecid,
4705 .sock_graft = selinux_sock_graft,
4706 .inet_conn_request = selinux_inet_conn_request,
4707 .inet_csk_clone = selinux_inet_csk_clone,
4708 .req_classify_flow = selinux_req_classify_flow,
4710 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4711 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4712 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4713 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4714 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4715 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4716 .xfrm_state_free_security = selinux_xfrm_state_free,
4717 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4718 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4719 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4720 .xfrm_flow_state_match = selinux_xfrm_flow_state_match,
4721 .xfrm_decode_session = selinux_xfrm_decode_session,
4725 .key_alloc = selinux_key_alloc,
4726 .key_free = selinux_key_free,
4727 .key_permission = selinux_key_permission,
4731 static __init int selinux_init(void)
4733 struct task_security_struct *tsec;
4735 if (!selinux_enabled) {
4736 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4740 printk(KERN_INFO "SELinux: Initializing.\n");
4742 /* Set the security state for the initial task. */
4743 if (task_alloc_security(current))
4744 panic("SELinux: Failed to initialize initial task.\n");
4745 tsec = current->security;
4746 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4748 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4749 sizeof(struct inode_security_struct),
4750 0, SLAB_PANIC, NULL, NULL);
4753 original_ops = secondary_ops = security_ops;
4755 panic ("SELinux: No initial security operations\n");
4756 if (register_security (&selinux_ops))
4757 panic("SELinux: Unable to register with kernel.\n");
4759 if (selinux_enforcing) {
4760 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4762 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4766 /* Add security information to initial keyrings */
4767 selinux_key_alloc(&root_user_keyring, current,
4768 KEY_ALLOC_NOT_IN_QUOTA);
4769 selinux_key_alloc(&root_session_keyring, current,
4770 KEY_ALLOC_NOT_IN_QUOTA);
4776 void selinux_complete_init(void)
4778 printk(KERN_INFO "SELinux: Completing initialization.\n");
4780 /* Set up any superblocks initialized prior to the policy load. */
4781 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4782 spin_lock(&sb_lock);
4783 spin_lock(&sb_security_lock);
4785 if (!list_empty(&superblock_security_head)) {
4786 struct superblock_security_struct *sbsec =
4787 list_entry(superblock_security_head.next,
4788 struct superblock_security_struct,
4790 struct super_block *sb = sbsec->sb;
4792 spin_unlock(&sb_security_lock);
4793 spin_unlock(&sb_lock);
4794 down_read(&sb->s_umount);
4796 superblock_doinit(sb, NULL);
4798 spin_lock(&sb_lock);
4799 spin_lock(&sb_security_lock);
4800 list_del_init(&sbsec->list);
4803 spin_unlock(&sb_security_lock);
4804 spin_unlock(&sb_lock);
4807 /* SELinux requires early initialization in order to label
4808 all processes and objects when they are created. */
4809 security_initcall(selinux_init);
4811 #if defined(CONFIG_NETFILTER)
4813 static struct nf_hook_ops selinux_ipv4_op = {
4814 .hook = selinux_ipv4_postroute_last,
4815 .owner = THIS_MODULE,
4817 .hooknum = NF_IP_POST_ROUTING,
4818 .priority = NF_IP_PRI_SELINUX_LAST,
4821 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4823 static struct nf_hook_ops selinux_ipv6_op = {
4824 .hook = selinux_ipv6_postroute_last,
4825 .owner = THIS_MODULE,
4827 .hooknum = NF_IP6_POST_ROUTING,
4828 .priority = NF_IP6_PRI_SELINUX_LAST,
4833 static int __init selinux_nf_ip_init(void)
4837 if (!selinux_enabled)
4840 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4842 err = nf_register_hook(&selinux_ipv4_op);
4844 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4846 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4848 err = nf_register_hook(&selinux_ipv6_op);
4850 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4858 __initcall(selinux_nf_ip_init);
4860 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4861 static void selinux_nf_ip_exit(void)
4863 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4865 nf_unregister_hook(&selinux_ipv4_op);
4866 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4867 nf_unregister_hook(&selinux_ipv6_op);
4872 #else /* CONFIG_NETFILTER */
4874 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4875 #define selinux_nf_ip_exit()
4878 #endif /* CONFIG_NETFILTER */
4880 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4881 int selinux_disable(void)
4883 extern void exit_sel_fs(void);
4884 static int selinux_disabled = 0;
4886 if (ss_initialized) {
4887 /* Not permitted after initial policy load. */
4891 if (selinux_disabled) {
4892 /* Only do this once. */
4896 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4898 selinux_disabled = 1;
4899 selinux_enabled = 0;
4901 /* Reset security_ops to the secondary module, dummy or capability. */
4902 security_ops = secondary_ops;
4904 /* Unregister netfilter hooks. */
4905 selinux_nf_ip_exit();
4907 /* Unregister selinuxfs. */