2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16 * Paul Moore, <paul.moore@hp.com>
18 * This program is free software; you can redistribute it and/or modify
19 * it under the terms of the GNU General Public License version 2,
20 * as published by the Free Software Foundation.
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for sysctl_local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/semaphore.h>
55 #include <asm/ioctls.h>
56 #include <linux/bitops.h>
57 #include <linux/interrupt.h>
58 #include <linux/netdevice.h> /* for network interface checks */
59 #include <linux/netlink.h>
60 #include <linux/tcp.h>
61 #include <linux/udp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h> /* for Unix socket types */
64 #include <net/af_unix.h> /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
79 #include "selinux_netlabel.h"
81 #define XATTR_SELINUX_SUFFIX "selinux"
82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84 extern unsigned int policydb_loaded_version;
85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
86 extern int selinux_compat_net;
88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
89 int selinux_enforcing = 0;
91 static int __init enforcing_setup(char *str)
93 selinux_enforcing = simple_strtol(str,NULL,0);
96 __setup("enforcing=", enforcing_setup);
99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102 static int __init selinux_enabled_setup(char *str)
104 selinux_enabled = simple_strtol(str, NULL, 0);
107 __setup("selinux=", selinux_enabled_setup);
109 int selinux_enabled = 1;
112 /* Original (dummy) security module. */
113 static struct security_operations *original_ops = NULL;
115 /* Minimal support for a secondary security module,
116 just to allow the use of the dummy or capability modules.
117 The owlsm module can alternatively be used as a secondary
118 module as long as CONFIG_OWLSM_FD is not enabled. */
119 static struct security_operations *secondary_ops = NULL;
121 /* Lists of inode and superblock security structures initialized
122 before the policy was loaded. */
123 static LIST_HEAD(superblock_security_head);
124 static DEFINE_SPINLOCK(sb_security_lock);
126 static kmem_cache_t *sel_inode_cache;
128 /* Return security context for a given sid or just the context
129 length if the buffer is null or length is 0 */
130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
136 rc = security_sid_to_context(sid, &context, &len);
140 if (!buffer || !size)
141 goto getsecurity_exit;
145 goto getsecurity_exit;
147 memcpy(buffer, context, len);
154 /* Allocate and free functions for each kind of security blob. */
156 static int task_alloc_security(struct task_struct *task)
158 struct task_security_struct *tsec;
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
165 tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
166 task->security = tsec;
171 static void task_free_security(struct task_struct *task)
173 struct task_security_struct *tsec = task->security;
174 task->security = NULL;
178 static int inode_alloc_security(struct inode *inode)
180 struct task_security_struct *tsec = current->security;
181 struct inode_security_struct *isec;
183 isec = kmem_cache_alloc(sel_inode_cache, SLAB_KERNEL);
187 memset(isec, 0, sizeof(*isec));
188 init_MUTEX(&isec->sem);
189 INIT_LIST_HEAD(&isec->list);
191 isec->sid = SECINITSID_UNLABELED;
192 isec->sclass = SECCLASS_FILE;
193 isec->task_sid = tsec->sid;
194 inode->i_security = isec;
199 static void inode_free_security(struct inode *inode)
201 struct inode_security_struct *isec = inode->i_security;
202 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
204 spin_lock(&sbsec->isec_lock);
205 if (!list_empty(&isec->list))
206 list_del_init(&isec->list);
207 spin_unlock(&sbsec->isec_lock);
209 inode->i_security = NULL;
210 kmem_cache_free(sel_inode_cache, isec);
213 static int file_alloc_security(struct file *file)
215 struct task_security_struct *tsec = current->security;
216 struct file_security_struct *fsec;
218 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
223 fsec->sid = tsec->sid;
224 fsec->fown_sid = tsec->sid;
225 file->f_security = fsec;
230 static void file_free_security(struct file *file)
232 struct file_security_struct *fsec = file->f_security;
233 file->f_security = NULL;
237 static int superblock_alloc_security(struct super_block *sb)
239 struct superblock_security_struct *sbsec;
241 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
245 init_MUTEX(&sbsec->sem);
246 INIT_LIST_HEAD(&sbsec->list);
247 INIT_LIST_HEAD(&sbsec->isec_head);
248 spin_lock_init(&sbsec->isec_lock);
250 sbsec->sid = SECINITSID_UNLABELED;
251 sbsec->def_sid = SECINITSID_FILE;
252 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253 sb->s_security = sbsec;
258 static void superblock_free_security(struct super_block *sb)
260 struct superblock_security_struct *sbsec = sb->s_security;
262 spin_lock(&sb_security_lock);
263 if (!list_empty(&sbsec->list))
264 list_del_init(&sbsec->list);
265 spin_unlock(&sb_security_lock);
267 sb->s_security = NULL;
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
273 struct sk_security_struct *ssec;
275 ssec = kzalloc(sizeof(*ssec), priority);
280 ssec->peer_sid = SECINITSID_UNLABELED;
281 ssec->sid = SECINITSID_UNLABELED;
282 sk->sk_security = ssec;
287 static void sk_free_security(struct sock *sk)
289 struct sk_security_struct *ssec = sk->sk_security;
291 sk->sk_security = NULL;
295 /* The security server must be initialized before
296 any labeling or access decisions can be provided. */
297 extern int ss_initialized;
299 /* The file system's label must be initialized prior to use. */
301 static char *labeling_behaviors[6] = {
303 "uses transition SIDs",
305 "uses genfs_contexts",
306 "not configured for labeling",
307 "uses mountpoint labeling",
310 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
312 static inline int inode_doinit(struct inode *inode)
314 return inode_doinit_with_dentry(inode, NULL);
324 static match_table_t tokens = {
325 {Opt_context, "context=%s"},
326 {Opt_fscontext, "fscontext=%s"},
327 {Opt_defcontext, "defcontext=%s"},
328 {Opt_rootcontext, "rootcontext=%s"},
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333 static int may_context_mount_sb_relabel(u32 sid,
334 struct superblock_security_struct *sbsec,
335 struct task_security_struct *tsec)
339 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
340 FILESYSTEM__RELABELFROM, NULL);
344 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
345 FILESYSTEM__RELABELTO, NULL);
349 static int may_context_mount_inode_relabel(u32 sid,
350 struct superblock_security_struct *sbsec,
351 struct task_security_struct *tsec)
354 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
355 FILESYSTEM__RELABELFROM, NULL);
359 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
360 FILESYSTEM__ASSOCIATE, NULL);
364 static int try_context_mount(struct super_block *sb, void *data)
366 char *context = NULL, *defcontext = NULL;
367 char *fscontext = NULL, *rootcontext = NULL;
370 int alloc = 0, rc = 0, seen = 0;
371 struct task_security_struct *tsec = current->security;
372 struct superblock_security_struct *sbsec = sb->s_security;
377 name = sb->s_type->name;
379 if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
381 /* NFS we understand. */
382 if (!strcmp(name, "nfs")) {
383 struct nfs_mount_data *d = data;
385 if (d->version < NFS_MOUNT_VERSION)
389 context = d->context;
396 /* Standard string-based options. */
397 char *p, *options = data;
399 while ((p = strsep(&options, ",")) != NULL) {
401 substring_t args[MAX_OPT_ARGS];
406 token = match_token(p, tokens, args);
410 if (seen & (Opt_context|Opt_defcontext)) {
412 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415 context = match_strdup(&args[0]);
426 if (seen & Opt_fscontext) {
428 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431 fscontext = match_strdup(&args[0]);
438 seen |= Opt_fscontext;
441 case Opt_rootcontext:
442 if (seen & Opt_rootcontext) {
444 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447 rootcontext = match_strdup(&args[0]);
454 seen |= Opt_rootcontext;
458 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
460 printk(KERN_WARNING "SELinux: "
461 "defcontext option is invalid "
462 "for this filesystem type\n");
465 if (seen & (Opt_context|Opt_defcontext)) {
467 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470 defcontext = match_strdup(&args[0]);
477 seen |= Opt_defcontext;
482 printk(KERN_WARNING "SELinux: unknown mount "
493 /* sets the context of the superblock for the fs being mounted. */
495 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
497 printk(KERN_WARNING "SELinux: security_context_to_sid"
498 "(%s) failed for (dev %s, type %s) errno=%d\n",
499 fscontext, sb->s_id, name, rc);
503 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
511 * Switch to using mount point labeling behavior.
512 * sets the label used on all file below the mountpoint, and will set
513 * the superblock context if not already set.
516 rc = security_context_to_sid(context, strlen(context), &sid);
518 printk(KERN_WARNING "SELinux: security_context_to_sid"
519 "(%s) failed for (dev %s, type %s) errno=%d\n",
520 context, sb->s_id, name, rc);
525 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
530 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
534 sbsec->mntpoint_sid = sid;
536 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
540 struct inode *inode = sb->s_root->d_inode;
541 struct inode_security_struct *isec = inode->i_security;
542 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
544 printk(KERN_WARNING "SELinux: security_context_to_sid"
545 "(%s) failed for (dev %s, type %s) errno=%d\n",
546 rootcontext, sb->s_id, name, rc);
550 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
555 isec->initialized = 1;
559 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
561 printk(KERN_WARNING "SELinux: security_context_to_sid"
562 "(%s) failed for (dev %s, type %s) errno=%d\n",
563 defcontext, sb->s_id, name, rc);
567 if (sid == sbsec->def_sid)
570 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
574 sbsec->def_sid = sid;
588 static int superblock_doinit(struct super_block *sb, void *data)
590 struct superblock_security_struct *sbsec = sb->s_security;
591 struct dentry *root = sb->s_root;
592 struct inode *inode = root->d_inode;
596 if (sbsec->initialized)
599 if (!ss_initialized) {
600 /* Defer initialization until selinux_complete_init,
601 after the initial policy is loaded and the security
602 server is ready to handle calls. */
603 spin_lock(&sb_security_lock);
604 if (list_empty(&sbsec->list))
605 list_add(&sbsec->list, &superblock_security_head);
606 spin_unlock(&sb_security_lock);
610 /* Determine the labeling behavior to use for this filesystem type. */
611 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
613 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
614 __FUNCTION__, sb->s_type->name, rc);
618 rc = try_context_mount(sb, data);
622 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
623 /* Make sure that the xattr handler exists and that no
624 error other than -ENODATA is returned by getxattr on
625 the root directory. -ENODATA is ok, as this may be
626 the first boot of the SELinux kernel before we have
627 assigned xattr values to the filesystem. */
628 if (!inode->i_op->getxattr) {
629 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
630 "xattr support\n", sb->s_id, sb->s_type->name);
634 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
635 if (rc < 0 && rc != -ENODATA) {
636 if (rc == -EOPNOTSUPP)
637 printk(KERN_WARNING "SELinux: (dev %s, type "
638 "%s) has no security xattr handler\n",
639 sb->s_id, sb->s_type->name);
641 printk(KERN_WARNING "SELinux: (dev %s, type "
642 "%s) getxattr errno %d\n", sb->s_id,
643 sb->s_type->name, -rc);
648 if (strcmp(sb->s_type->name, "proc") == 0)
651 sbsec->initialized = 1;
653 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
654 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
655 sb->s_id, sb->s_type->name);
658 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
659 sb->s_id, sb->s_type->name,
660 labeling_behaviors[sbsec->behavior-1]);
663 /* Initialize the root inode. */
664 rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
666 /* Initialize any other inodes associated with the superblock, e.g.
667 inodes created prior to initial policy load or inodes created
668 during get_sb by a pseudo filesystem that directly
670 spin_lock(&sbsec->isec_lock);
672 if (!list_empty(&sbsec->isec_head)) {
673 struct inode_security_struct *isec =
674 list_entry(sbsec->isec_head.next,
675 struct inode_security_struct, list);
676 struct inode *inode = isec->inode;
677 spin_unlock(&sbsec->isec_lock);
678 inode = igrab(inode);
680 if (!IS_PRIVATE (inode))
684 spin_lock(&sbsec->isec_lock);
685 list_del_init(&isec->list);
688 spin_unlock(&sbsec->isec_lock);
694 static inline u16 inode_mode_to_security_class(umode_t mode)
696 switch (mode & S_IFMT) {
698 return SECCLASS_SOCK_FILE;
700 return SECCLASS_LNK_FILE;
702 return SECCLASS_FILE;
704 return SECCLASS_BLK_FILE;
708 return SECCLASS_CHR_FILE;
710 return SECCLASS_FIFO_FILE;
714 return SECCLASS_FILE;
717 static inline int default_protocol_stream(int protocol)
719 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722 static inline int default_protocol_dgram(int protocol)
724 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
734 return SECCLASS_UNIX_STREAM_SOCKET;
736 return SECCLASS_UNIX_DGRAM_SOCKET;
743 if (default_protocol_stream(protocol))
744 return SECCLASS_TCP_SOCKET;
746 return SECCLASS_RAWIP_SOCKET;
748 if (default_protocol_dgram(protocol))
749 return SECCLASS_UDP_SOCKET;
751 return SECCLASS_RAWIP_SOCKET;
753 return SECCLASS_RAWIP_SOCKET;
759 return SECCLASS_NETLINK_ROUTE_SOCKET;
760 case NETLINK_FIREWALL:
761 return SECCLASS_NETLINK_FIREWALL_SOCKET;
762 case NETLINK_INET_DIAG:
763 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
765 return SECCLASS_NETLINK_NFLOG_SOCKET;
767 return SECCLASS_NETLINK_XFRM_SOCKET;
768 case NETLINK_SELINUX:
769 return SECCLASS_NETLINK_SELINUX_SOCKET;
771 return SECCLASS_NETLINK_AUDIT_SOCKET;
773 return SECCLASS_NETLINK_IP6FW_SOCKET;
774 case NETLINK_DNRTMSG:
775 return SECCLASS_NETLINK_DNRT_SOCKET;
776 case NETLINK_KOBJECT_UEVENT:
777 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
779 return SECCLASS_NETLINK_SOCKET;
782 return SECCLASS_PACKET_SOCKET;
784 return SECCLASS_KEY_SOCKET;
786 return SECCLASS_APPLETALK_SOCKET;
789 return SECCLASS_SOCKET;
792 #ifdef CONFIG_PROC_FS
793 static int selinux_proc_get_sid(struct proc_dir_entry *de,
798 char *buffer, *path, *end;
800 buffer = (char*)__get_free_page(GFP_KERNEL);
810 while (de && de != de->parent) {
811 buflen -= de->namelen + 1;
815 memcpy(end, de->name, de->namelen);
820 rc = security_genfs_sid("proc", path, tclass, sid);
821 free_page((unsigned long)buffer);
825 static int selinux_proc_get_sid(struct proc_dir_entry *de,
833 /* The inode's security attributes must be initialized before first use. */
834 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
836 struct superblock_security_struct *sbsec = NULL;
837 struct inode_security_struct *isec = inode->i_security;
839 struct dentry *dentry;
840 #define INITCONTEXTLEN 255
841 char *context = NULL;
846 if (isec->initialized)
851 if (isec->initialized)
854 sbsec = inode->i_sb->s_security;
855 if (!sbsec->initialized) {
856 /* Defer initialization until selinux_complete_init,
857 after the initial policy is loaded and the security
858 server is ready to handle calls. */
859 spin_lock(&sbsec->isec_lock);
860 if (list_empty(&isec->list))
861 list_add(&isec->list, &sbsec->isec_head);
862 spin_unlock(&sbsec->isec_lock);
866 switch (sbsec->behavior) {
867 case SECURITY_FS_USE_XATTR:
868 if (!inode->i_op->getxattr) {
869 isec->sid = sbsec->def_sid;
873 /* Need a dentry, since the xattr API requires one.
874 Life would be simpler if we could just pass the inode. */
876 /* Called from d_instantiate or d_splice_alias. */
877 dentry = dget(opt_dentry);
879 /* Called from selinux_complete_init, try to find a dentry. */
880 dentry = d_find_alias(inode);
883 printk(KERN_WARNING "%s: no dentry for dev=%s "
884 "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
889 len = INITCONTEXTLEN;
890 context = kmalloc(len, GFP_KERNEL);
896 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899 /* Need a larger buffer. Query for the right size. */
900 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
908 context = kmalloc(len, GFP_KERNEL);
914 rc = inode->i_op->getxattr(dentry,
920 if (rc != -ENODATA) {
921 printk(KERN_WARNING "%s: getxattr returned "
922 "%d for dev=%s ino=%ld\n", __FUNCTION__,
923 -rc, inode->i_sb->s_id, inode->i_ino);
927 /* Map ENODATA to the default file SID */
928 sid = sbsec->def_sid;
931 rc = security_context_to_sid_default(context, rc, &sid,
934 printk(KERN_WARNING "%s: context_to_sid(%s) "
935 "returned %d for dev=%s ino=%ld\n",
936 __FUNCTION__, context, -rc,
937 inode->i_sb->s_id, inode->i_ino);
939 /* Leave with the unlabeled SID */
947 case SECURITY_FS_USE_TASK:
948 isec->sid = isec->task_sid;
950 case SECURITY_FS_USE_TRANS:
951 /* Default to the fs SID. */
952 isec->sid = sbsec->sid;
954 /* Try to obtain a transition SID. */
955 isec->sclass = inode_mode_to_security_class(inode->i_mode);
956 rc = security_transition_sid(isec->task_sid,
964 case SECURITY_FS_USE_MNTPOINT:
965 isec->sid = sbsec->mntpoint_sid;
968 /* Default to the fs superblock SID. */
969 isec->sid = sbsec->sid;
972 struct proc_inode *proci = PROC_I(inode);
974 isec->sclass = inode_mode_to_security_class(inode->i_mode);
975 rc = selinux_proc_get_sid(proci->pde,
986 isec->initialized = 1;
989 if (isec->sclass == SECCLASS_FILE)
990 isec->sclass = inode_mode_to_security_class(inode->i_mode);
997 /* Convert a Linux signal to an access vector. */
998 static inline u32 signal_to_av(int sig)
1004 /* Commonly granted from child to parent. */
1005 perm = PROCESS__SIGCHLD;
1008 /* Cannot be caught or ignored */
1009 perm = PROCESS__SIGKILL;
1012 /* Cannot be caught or ignored */
1013 perm = PROCESS__SIGSTOP;
1016 /* All other signals. */
1017 perm = PROCESS__SIGNAL;
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025 fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct *tsk1,
1027 struct task_struct *tsk2,
1030 struct task_security_struct *tsec1, *tsec2;
1032 tsec1 = tsk1->security;
1033 tsec2 = tsk2->security;
1034 return avc_has_perm(tsec1->sid, tsec2->sid,
1035 SECCLASS_PROCESS, perms, NULL);
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct *tsk,
1042 struct task_security_struct *tsec;
1043 struct avc_audit_data ad;
1045 tsec = tsk->security;
1047 AVC_AUDIT_DATA_INIT(&ad,CAP);
1051 return avc_has_perm(tsec->sid, tsec->sid,
1052 SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct *tsk,
1059 struct task_security_struct *tsec;
1061 tsec = tsk->security;
1063 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064 SECCLASS_SYSTEM, perms, NULL);
1067 /* Check whether a task has a particular permission to an inode.
1068 The 'adp' parameter is optional and allows other audit
1069 data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct *tsk,
1071 struct inode *inode,
1073 struct avc_audit_data *adp)
1075 struct task_security_struct *tsec;
1076 struct inode_security_struct *isec;
1077 struct avc_audit_data ad;
1079 tsec = tsk->security;
1080 isec = inode->i_security;
1084 AVC_AUDIT_DATA_INIT(&ad, FS);
1085 ad.u.fs.inode = inode;
1088 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1091 /* Same as inode_has_perm, but pass explicit audit data containing
1092 the dentry to help the auditing code to more easily generate the
1093 pathname if needed. */
1094 static inline int dentry_has_perm(struct task_struct *tsk,
1095 struct vfsmount *mnt,
1096 struct dentry *dentry,
1099 struct inode *inode = dentry->d_inode;
1100 struct avc_audit_data ad;
1101 AVC_AUDIT_DATA_INIT(&ad,FS);
1103 ad.u.fs.dentry = dentry;
1104 return inode_has_perm(tsk, inode, av, &ad);
1107 /* Check whether a task can use an open file descriptor to
1108 access an inode in a given way. Check access to the
1109 descriptor itself, and then use dentry_has_perm to
1110 check a particular permission to the file.
1111 Access to the descriptor is implicitly granted if it
1112 has the same SID as the process. If av is zero, then
1113 access to the file is not checked, e.g. for cases
1114 where only the descriptor is affected like seek. */
1115 static int file_has_perm(struct task_struct *tsk,
1119 struct task_security_struct *tsec = tsk->security;
1120 struct file_security_struct *fsec = file->f_security;
1121 struct vfsmount *mnt = file->f_vfsmnt;
1122 struct dentry *dentry = file->f_dentry;
1123 struct inode *inode = dentry->d_inode;
1124 struct avc_audit_data ad;
1127 AVC_AUDIT_DATA_INIT(&ad, FS);
1129 ad.u.fs.dentry = dentry;
1131 if (tsec->sid != fsec->sid) {
1132 rc = avc_has_perm(tsec->sid, fsec->sid,
1140 /* av is zero if only checking access to the descriptor. */
1142 return inode_has_perm(tsk, inode, av, &ad);
1147 /* Check whether a task can create a file. */
1148 static int may_create(struct inode *dir,
1149 struct dentry *dentry,
1152 struct task_security_struct *tsec;
1153 struct inode_security_struct *dsec;
1154 struct superblock_security_struct *sbsec;
1156 struct avc_audit_data ad;
1159 tsec = current->security;
1160 dsec = dir->i_security;
1161 sbsec = dir->i_sb->s_security;
1163 AVC_AUDIT_DATA_INIT(&ad, FS);
1164 ad.u.fs.dentry = dentry;
1166 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1167 DIR__ADD_NAME | DIR__SEARCH,
1172 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1173 newsid = tsec->create_sid;
1175 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1181 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185 return avc_has_perm(newsid, sbsec->sid,
1186 SECCLASS_FILESYSTEM,
1187 FILESYSTEM__ASSOCIATE, &ad);
1190 /* Check whether a task can create a key. */
1191 static int may_create_key(u32 ksid,
1192 struct task_struct *ctx)
1194 struct task_security_struct *tsec;
1196 tsec = ctx->security;
1198 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202 #define MAY_UNLINK 1
1205 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1206 static int may_link(struct inode *dir,
1207 struct dentry *dentry,
1211 struct task_security_struct *tsec;
1212 struct inode_security_struct *dsec, *isec;
1213 struct avc_audit_data ad;
1217 tsec = current->security;
1218 dsec = dir->i_security;
1219 isec = dentry->d_inode->i_security;
1221 AVC_AUDIT_DATA_INIT(&ad, FS);
1222 ad.u.fs.dentry = dentry;
1225 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1226 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1241 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1245 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249 static inline int may_rename(struct inode *old_dir,
1250 struct dentry *old_dentry,
1251 struct inode *new_dir,
1252 struct dentry *new_dentry)
1254 struct task_security_struct *tsec;
1255 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1256 struct avc_audit_data ad;
1258 int old_is_dir, new_is_dir;
1261 tsec = current->security;
1262 old_dsec = old_dir->i_security;
1263 old_isec = old_dentry->d_inode->i_security;
1264 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1265 new_dsec = new_dir->i_security;
1267 AVC_AUDIT_DATA_INIT(&ad, FS);
1269 ad.u.fs.dentry = old_dentry;
1270 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1271 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1274 rc = avc_has_perm(tsec->sid, old_isec->sid,
1275 old_isec->sclass, FILE__RENAME, &ad);
1278 if (old_is_dir && new_dir != old_dir) {
1279 rc = avc_has_perm(tsec->sid, old_isec->sid,
1280 old_isec->sclass, DIR__REPARENT, &ad);
1285 ad.u.fs.dentry = new_dentry;
1286 av = DIR__ADD_NAME | DIR__SEARCH;
1287 if (new_dentry->d_inode)
1288 av |= DIR__REMOVE_NAME;
1289 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1292 if (new_dentry->d_inode) {
1293 new_isec = new_dentry->d_inode->i_security;
1294 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1295 rc = avc_has_perm(tsec->sid, new_isec->sid,
1297 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1305 /* Check whether a task can perform a filesystem operation. */
1306 static int superblock_has_perm(struct task_struct *tsk,
1307 struct super_block *sb,
1309 struct avc_audit_data *ad)
1311 struct task_security_struct *tsec;
1312 struct superblock_security_struct *sbsec;
1314 tsec = tsk->security;
1315 sbsec = sb->s_security;
1316 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320 /* Convert a Linux mode and permission mask to an access vector. */
1321 static inline u32 file_mask_to_av(int mode, int mask)
1325 if ((mode & S_IFMT) != S_IFDIR) {
1326 if (mask & MAY_EXEC)
1327 av |= FILE__EXECUTE;
1328 if (mask & MAY_READ)
1331 if (mask & MAY_APPEND)
1333 else if (mask & MAY_WRITE)
1337 if (mask & MAY_EXEC)
1339 if (mask & MAY_WRITE)
1341 if (mask & MAY_READ)
1348 /* Convert a Linux file to an access vector. */
1349 static inline u32 file_to_av(struct file *file)
1353 if (file->f_mode & FMODE_READ)
1355 if (file->f_mode & FMODE_WRITE) {
1356 if (file->f_flags & O_APPEND)
1365 /* Set an inode's SID to a specified value. */
1366 static int inode_security_set_sid(struct inode *inode, u32 sid)
1368 struct inode_security_struct *isec = inode->i_security;
1369 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1371 if (!sbsec->initialized) {
1372 /* Defer initialization to selinux_complete_init. */
1377 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1379 isec->initialized = 1;
1384 /* Hook functions begin here. */
1386 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1388 struct task_security_struct *psec = parent->security;
1389 struct task_security_struct *csec = child->security;
1392 rc = secondary_ops->ptrace(parent,child);
1396 rc = task_has_perm(parent, child, PROCESS__PTRACE);
1397 /* Save the SID of the tracing process for later use in apply_creds. */
1398 if (!(child->ptrace & PT_PTRACED) && !rc)
1399 csec->ptrace_sid = psec->sid;
1403 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1404 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1408 error = task_has_perm(current, target, PROCESS__GETCAP);
1412 return secondary_ops->capget(target, effective, inheritable, permitted);
1415 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1416 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1420 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1424 return task_has_perm(current, target, PROCESS__SETCAP);
1427 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1428 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1430 secondary_ops->capset_set(target, effective, inheritable, permitted);
1433 static int selinux_capable(struct task_struct *tsk, int cap)
1437 rc = secondary_ops->capable(tsk, cap);
1441 return task_has_capability(tsk,cap);
1444 static int selinux_sysctl(ctl_table *table, int op)
1448 struct task_security_struct *tsec;
1452 rc = secondary_ops->sysctl(table, op);
1456 tsec = current->security;
1458 rc = selinux_proc_get_sid(table->de, (op == 001) ?
1459 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1461 /* Default to the well-defined sysctl SID. */
1462 tsid = SECINITSID_SYSCTL;
1465 /* The op values are "defined" in sysctl.c, thereby creating
1466 * a bad coupling between this module and sysctl.c */
1468 error = avc_has_perm(tsec->sid, tsid,
1469 SECCLASS_DIR, DIR__SEARCH, NULL);
1477 error = avc_has_perm(tsec->sid, tsid,
1478 SECCLASS_FILE, av, NULL);
1484 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1497 rc = superblock_has_perm(current,
1499 FILESYSTEM__QUOTAMOD, NULL);
1504 rc = superblock_has_perm(current,
1506 FILESYSTEM__QUOTAGET, NULL);
1509 rc = 0; /* let the kernel handle invalid cmds */
1515 static int selinux_quota_on(struct dentry *dentry)
1517 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1520 static int selinux_syslog(int type)
1524 rc = secondary_ops->syslog(type);
1529 case 3: /* Read last kernel messages */
1530 case 10: /* Return size of the log buffer */
1531 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1533 case 6: /* Disable logging to console */
1534 case 7: /* Enable logging to console */
1535 case 8: /* Set level of messages printed to console */
1536 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1538 case 0: /* Close log */
1539 case 1: /* Open log */
1540 case 2: /* Read from log */
1541 case 4: /* Read/clear last kernel messages */
1542 case 5: /* Clear ring buffer */
1544 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1551 * Check that a process has enough memory to allocate a new virtual
1552 * mapping. 0 means there is enough memory for the allocation to
1553 * succeed and -ENOMEM implies there is not.
1555 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1556 * if the capability is granted, but __vm_enough_memory requires 1 if
1557 * the capability is granted.
1559 * Do not audit the selinux permission check, as this is applied to all
1560 * processes that allocate mappings.
1562 static int selinux_vm_enough_memory(long pages)
1564 int rc, cap_sys_admin = 0;
1565 struct task_security_struct *tsec = current->security;
1567 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1569 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1570 SECCLASS_CAPABILITY,
1571 CAP_TO_MASK(CAP_SYS_ADMIN),
1577 return __vm_enough_memory(pages, cap_sys_admin);
1580 /* binprm security operations */
1582 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1584 struct bprm_security_struct *bsec;
1586 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1591 bsec->sid = SECINITSID_UNLABELED;
1594 bprm->security = bsec;
1598 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1600 struct task_security_struct *tsec;
1601 struct inode *inode = bprm->file->f_dentry->d_inode;
1602 struct inode_security_struct *isec;
1603 struct bprm_security_struct *bsec;
1605 struct avc_audit_data ad;
1608 rc = secondary_ops->bprm_set_security(bprm);
1612 bsec = bprm->security;
1617 tsec = current->security;
1618 isec = inode->i_security;
1620 /* Default to the current task SID. */
1621 bsec->sid = tsec->sid;
1623 /* Reset fs, key, and sock SIDs on execve. */
1624 tsec->create_sid = 0;
1625 tsec->keycreate_sid = 0;
1626 tsec->sockcreate_sid = 0;
1628 if (tsec->exec_sid) {
1629 newsid = tsec->exec_sid;
1630 /* Reset exec SID on execve. */
1633 /* Check for a default transition on this program. */
1634 rc = security_transition_sid(tsec->sid, isec->sid,
1635 SECCLASS_PROCESS, &newsid);
1640 AVC_AUDIT_DATA_INIT(&ad, FS);
1641 ad.u.fs.mnt = bprm->file->f_vfsmnt;
1642 ad.u.fs.dentry = bprm->file->f_dentry;
1644 if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1647 if (tsec->sid == newsid) {
1648 rc = avc_has_perm(tsec->sid, isec->sid,
1649 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1653 /* Check permissions for the transition. */
1654 rc = avc_has_perm(tsec->sid, newsid,
1655 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1659 rc = avc_has_perm(newsid, isec->sid,
1660 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1664 /* Clear any possibly unsafe personality bits on exec: */
1665 current->personality &= ~PER_CLEAR_ON_SETID;
1667 /* Set the security field to the new SID. */
1675 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1677 return secondary_ops->bprm_check_security(bprm);
1681 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1683 struct task_security_struct *tsec = current->security;
1686 if (tsec->osid != tsec->sid) {
1687 /* Enable secure mode for SIDs transitions unless
1688 the noatsecure permission is granted between
1689 the two SIDs, i.e. ahp returns 0. */
1690 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1692 PROCESS__NOATSECURE, NULL);
1695 return (atsecure || secondary_ops->bprm_secureexec(bprm));
1698 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1700 kfree(bprm->security);
1701 bprm->security = NULL;
1704 extern struct vfsmount *selinuxfs_mount;
1705 extern struct dentry *selinux_null;
1707 /* Derived from fs/exec.c:flush_old_files. */
1708 static inline void flush_unauthorized_files(struct files_struct * files)
1710 struct avc_audit_data ad;
1711 struct file *file, *devnull = NULL;
1712 struct tty_struct *tty = current->signal->tty;
1713 struct fdtable *fdt;
1718 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1720 /* Revalidate access to controlling tty.
1721 Use inode_has_perm on the tty inode directly rather
1722 than using file_has_perm, as this particular open
1723 file may belong to another process and we are only
1724 interested in the inode-based check here. */
1725 struct inode *inode = file->f_dentry->d_inode;
1726 if (inode_has_perm(current, inode,
1727 FILE__READ | FILE__WRITE, NULL)) {
1728 /* Reset controlling tty. */
1729 current->signal->tty = NULL;
1730 current->signal->tty_old_pgrp = 0;
1736 /* Revalidate access to inherited open files. */
1738 AVC_AUDIT_DATA_INIT(&ad,FS);
1740 spin_lock(&files->file_lock);
1742 unsigned long set, i;
1747 fdt = files_fdtable(files);
1748 if (i >= fdt->max_fds || i >= fdt->max_fdset)
1750 set = fdt->open_fds->fds_bits[j];
1753 spin_unlock(&files->file_lock);
1754 for ( ; set ; i++,set >>= 1) {
1759 if (file_has_perm(current,
1761 file_to_av(file))) {
1763 fd = get_unused_fd();
1773 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1780 fd_install(fd, devnull);
1785 spin_lock(&files->file_lock);
1788 spin_unlock(&files->file_lock);
1791 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1793 struct task_security_struct *tsec;
1794 struct bprm_security_struct *bsec;
1798 secondary_ops->bprm_apply_creds(bprm, unsafe);
1800 tsec = current->security;
1802 bsec = bprm->security;
1805 tsec->osid = tsec->sid;
1807 if (tsec->sid != sid) {
1808 /* Check for shared state. If not ok, leave SID
1809 unchanged and kill. */
1810 if (unsafe & LSM_UNSAFE_SHARE) {
1811 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1812 PROCESS__SHARE, NULL);
1819 /* Check for ptracing, and update the task SID if ok.
1820 Otherwise, leave SID unchanged and kill. */
1821 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1822 rc = avc_has_perm(tsec->ptrace_sid, sid,
1823 SECCLASS_PROCESS, PROCESS__PTRACE,
1835 * called after apply_creds without the task lock held
1837 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1839 struct task_security_struct *tsec;
1840 struct rlimit *rlim, *initrlim;
1841 struct itimerval itimer;
1842 struct bprm_security_struct *bsec;
1845 tsec = current->security;
1846 bsec = bprm->security;
1849 force_sig_specific(SIGKILL, current);
1852 if (tsec->osid == tsec->sid)
1855 /* Close files for which the new task SID is not authorized. */
1856 flush_unauthorized_files(current->files);
1858 /* Check whether the new SID can inherit signal state
1859 from the old SID. If not, clear itimers to avoid
1860 subsequent signal generation and flush and unblock
1861 signals. This must occur _after_ the task SID has
1862 been updated so that any kill done after the flush
1863 will be checked against the new SID. */
1864 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1865 PROCESS__SIGINH, NULL);
1867 memset(&itimer, 0, sizeof itimer);
1868 for (i = 0; i < 3; i++)
1869 do_setitimer(i, &itimer, NULL);
1870 flush_signals(current);
1871 spin_lock_irq(¤t->sighand->siglock);
1872 flush_signal_handlers(current, 1);
1873 sigemptyset(¤t->blocked);
1874 recalc_sigpending();
1875 spin_unlock_irq(¤t->sighand->siglock);
1878 /* Check whether the new SID can inherit resource limits
1879 from the old SID. If not, reset all soft limits to
1880 the lower of the current task's hard limit and the init
1881 task's soft limit. Note that the setting of hard limits
1882 (even to lower them) can be controlled by the setrlimit
1883 check. The inclusion of the init task's soft limit into
1884 the computation is to avoid resetting soft limits higher
1885 than the default soft limit for cases where the default
1886 is lower than the hard limit, e.g. RLIMIT_CORE or
1888 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1889 PROCESS__RLIMITINH, NULL);
1891 for (i = 0; i < RLIM_NLIMITS; i++) {
1892 rlim = current->signal->rlim + i;
1893 initrlim = init_task.signal->rlim+i;
1894 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1896 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1898 * This will cause RLIMIT_CPU calculations
1901 current->it_prof_expires = jiffies_to_cputime(1);
1905 /* Wake up the parent if it is waiting so that it can
1906 recheck wait permission to the new task SID. */
1907 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
1910 /* superblock security operations */
1912 static int selinux_sb_alloc_security(struct super_block *sb)
1914 return superblock_alloc_security(sb);
1917 static void selinux_sb_free_security(struct super_block *sb)
1919 superblock_free_security(sb);
1922 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1927 return !memcmp(prefix, option, plen);
1930 static inline int selinux_option(char *option, int len)
1932 return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1933 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1934 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1935 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1938 static inline void take_option(char **to, char *from, int *first, int len)
1946 memcpy(*to, from, len);
1950 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1952 int fnosec, fsec, rc = 0;
1953 char *in_save, *in_curr, *in_end;
1954 char *sec_curr, *nosec_save, *nosec;
1959 /* Binary mount data: just copy */
1960 if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1961 copy_page(sec_curr, in_curr);
1965 nosec = (char *)get_zeroed_page(GFP_KERNEL);
1973 in_save = in_end = orig;
1976 if (*in_end == ',' || *in_end == '\0') {
1977 int len = in_end - in_curr;
1979 if (selinux_option(in_curr, len))
1980 take_option(&sec_curr, in_curr, &fsec, len);
1982 take_option(&nosec, in_curr, &fnosec, len);
1984 in_curr = in_end + 1;
1986 } while (*in_end++);
1988 strcpy(in_save, nosec_save);
1989 free_page((unsigned long)nosec_save);
1994 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1996 struct avc_audit_data ad;
1999 rc = superblock_doinit(sb, data);
2003 AVC_AUDIT_DATA_INIT(&ad,FS);
2004 ad.u.fs.dentry = sb->s_root;
2005 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2008 static int selinux_sb_statfs(struct dentry *dentry)
2010 struct avc_audit_data ad;
2012 AVC_AUDIT_DATA_INIT(&ad,FS);
2013 ad.u.fs.dentry = dentry->d_sb->s_root;
2014 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2017 static int selinux_mount(char * dev_name,
2018 struct nameidata *nd,
2020 unsigned long flags,
2025 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2029 if (flags & MS_REMOUNT)
2030 return superblock_has_perm(current, nd->mnt->mnt_sb,
2031 FILESYSTEM__REMOUNT, NULL);
2033 return dentry_has_perm(current, nd->mnt, nd->dentry,
2037 static int selinux_umount(struct vfsmount *mnt, int flags)
2041 rc = secondary_ops->sb_umount(mnt, flags);
2045 return superblock_has_perm(current,mnt->mnt_sb,
2046 FILESYSTEM__UNMOUNT,NULL);
2049 /* inode security operations */
2051 static int selinux_inode_alloc_security(struct inode *inode)
2053 return inode_alloc_security(inode);
2056 static void selinux_inode_free_security(struct inode *inode)
2058 inode_free_security(inode);
2061 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2062 char **name, void **value,
2065 struct task_security_struct *tsec;
2066 struct inode_security_struct *dsec;
2067 struct superblock_security_struct *sbsec;
2070 char *namep = NULL, *context;
2072 tsec = current->security;
2073 dsec = dir->i_security;
2074 sbsec = dir->i_sb->s_security;
2076 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2077 newsid = tsec->create_sid;
2079 rc = security_transition_sid(tsec->sid, dsec->sid,
2080 inode_mode_to_security_class(inode->i_mode),
2083 printk(KERN_WARNING "%s: "
2084 "security_transition_sid failed, rc=%d (dev=%s "
2087 -rc, inode->i_sb->s_id, inode->i_ino);
2092 inode_security_set_sid(inode, newsid);
2094 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2098 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2105 rc = security_sid_to_context(newsid, &context, &clen);
2117 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2119 return may_create(dir, dentry, SECCLASS_FILE);
2122 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2126 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2129 return may_link(dir, old_dentry, MAY_LINK);
2132 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2136 rc = secondary_ops->inode_unlink(dir, dentry);
2139 return may_link(dir, dentry, MAY_UNLINK);
2142 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2144 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2147 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2149 return may_create(dir, dentry, SECCLASS_DIR);
2152 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2154 return may_link(dir, dentry, MAY_RMDIR);
2157 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2161 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2165 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2168 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2169 struct inode *new_inode, struct dentry *new_dentry)
2171 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2174 static int selinux_inode_readlink(struct dentry *dentry)
2176 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2179 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2183 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2186 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2189 static int selinux_inode_permission(struct inode *inode, int mask,
2190 struct nameidata *nd)
2194 rc = secondary_ops->inode_permission(inode, mask, nd);
2199 /* No permission to check. Existence test. */
2203 return inode_has_perm(current, inode,
2204 file_mask_to_av(inode->i_mode, mask), NULL);
2207 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2211 rc = secondary_ops->inode_setattr(dentry, iattr);
2215 if (iattr->ia_valid & ATTR_FORCE)
2218 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2219 ATTR_ATIME_SET | ATTR_MTIME_SET))
2220 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2222 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2225 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2227 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2230 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2232 struct task_security_struct *tsec = current->security;
2233 struct inode *inode = dentry->d_inode;
2234 struct inode_security_struct *isec = inode->i_security;
2235 struct superblock_security_struct *sbsec;
2236 struct avc_audit_data ad;
2240 if (strcmp(name, XATTR_NAME_SELINUX)) {
2241 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2242 sizeof XATTR_SECURITY_PREFIX - 1) &&
2243 !capable(CAP_SYS_ADMIN)) {
2244 /* A different attribute in the security namespace.
2245 Restrict to administrator. */
2249 /* Not an attribute we recognize, so just check the
2250 ordinary setattr permission. */
2251 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2254 sbsec = inode->i_sb->s_security;
2255 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2258 if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2261 AVC_AUDIT_DATA_INIT(&ad,FS);
2262 ad.u.fs.dentry = dentry;
2264 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2265 FILE__RELABELFROM, &ad);
2269 rc = security_context_to_sid(value, size, &newsid);
2273 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2274 FILE__RELABELTO, &ad);
2278 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2283 return avc_has_perm(newsid,
2285 SECCLASS_FILESYSTEM,
2286 FILESYSTEM__ASSOCIATE,
2290 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2291 void *value, size_t size, int flags)
2293 struct inode *inode = dentry->d_inode;
2294 struct inode_security_struct *isec = inode->i_security;
2298 if (strcmp(name, XATTR_NAME_SELINUX)) {
2299 /* Not an attribute we recognize, so nothing to do. */
2303 rc = security_context_to_sid(value, size, &newsid);
2305 printk(KERN_WARNING "%s: unable to obtain SID for context "
2306 "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2314 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2316 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2319 static int selinux_inode_listxattr (struct dentry *dentry)
2321 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2324 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2326 if (strcmp(name, XATTR_NAME_SELINUX)) {
2327 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2328 sizeof XATTR_SECURITY_PREFIX - 1) &&
2329 !capable(CAP_SYS_ADMIN)) {
2330 /* A different attribute in the security namespace.
2331 Restrict to administrator. */
2335 /* Not an attribute we recognize, so just check the
2336 ordinary setattr permission. Might want a separate
2337 permission for removexattr. */
2338 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2341 /* No one is allowed to remove a SELinux security label.
2342 You can change the label, but all data must be labeled. */
2346 static const char *selinux_inode_xattr_getsuffix(void)
2348 return XATTR_SELINUX_SUFFIX;
2352 * Copy the in-core inode security context value to the user. If the
2353 * getxattr() prior to this succeeded, check to see if we need to
2354 * canonicalize the value to be finally returned to the user.
2356 * Permission check is handled by selinux_inode_getxattr hook.
2358 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2360 struct inode_security_struct *isec = inode->i_security;
2362 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2365 return selinux_getsecurity(isec->sid, buffer, size);
2368 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2369 const void *value, size_t size, int flags)
2371 struct inode_security_struct *isec = inode->i_security;
2375 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2378 if (!value || !size)
2381 rc = security_context_to_sid((void*)value, size, &newsid);
2389 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2391 const int len = sizeof(XATTR_NAME_SELINUX);
2392 if (buffer && len <= buffer_size)
2393 memcpy(buffer, XATTR_NAME_SELINUX, len);
2397 /* file security operations */
2399 static int selinux_file_permission(struct file *file, int mask)
2402 struct inode *inode = file->f_dentry->d_inode;
2405 /* No permission to check. Existence test. */
2409 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2410 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2413 rc = file_has_perm(current, file,
2414 file_mask_to_av(inode->i_mode, mask));
2418 return selinux_netlbl_inode_permission(inode, mask);
2421 static int selinux_file_alloc_security(struct file *file)
2423 return file_alloc_security(file);
2426 static void selinux_file_free_security(struct file *file)
2428 file_free_security(file);
2431 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2443 case EXT2_IOC_GETFLAGS:
2445 case EXT2_IOC_GETVERSION:
2446 error = file_has_perm(current, file, FILE__GETATTR);
2449 case EXT2_IOC_SETFLAGS:
2451 case EXT2_IOC_SETVERSION:
2452 error = file_has_perm(current, file, FILE__SETATTR);
2455 /* sys_ioctl() checks */
2459 error = file_has_perm(current, file, 0);
2464 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2467 /* default case assumes that the command will go
2468 * to the file's ioctl() function.
2471 error = file_has_perm(current, file, FILE__IOCTL);
2477 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2479 #ifndef CONFIG_PPC32
2480 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2482 * We are making executable an anonymous mapping or a
2483 * private file mapping that will also be writable.
2484 * This has an additional check.
2486 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2493 /* read access is always possible with a mapping */
2494 u32 av = FILE__READ;
2496 /* write access only matters if the mapping is shared */
2497 if (shared && (prot & PROT_WRITE))
2500 if (prot & PROT_EXEC)
2501 av |= FILE__EXECUTE;
2503 return file_has_perm(current, file, av);
2508 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2509 unsigned long prot, unsigned long flags)
2513 rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2517 if (selinux_checkreqprot)
2520 return file_map_prot_check(file, prot,
2521 (flags & MAP_TYPE) == MAP_SHARED);
2524 static int selinux_file_mprotect(struct vm_area_struct *vma,
2525 unsigned long reqprot,
2530 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2534 if (selinux_checkreqprot)
2537 #ifndef CONFIG_PPC32
2538 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2540 if (vma->vm_start >= vma->vm_mm->start_brk &&
2541 vma->vm_end <= vma->vm_mm->brk) {
2542 rc = task_has_perm(current, current,
2544 } else if (!vma->vm_file &&
2545 vma->vm_start <= vma->vm_mm->start_stack &&
2546 vma->vm_end >= vma->vm_mm->start_stack) {
2547 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2548 } else if (vma->vm_file && vma->anon_vma) {
2550 * We are making executable a file mapping that has
2551 * had some COW done. Since pages might have been
2552 * written, check ability to execute the possibly
2553 * modified content. This typically should only
2554 * occur for text relocations.
2556 rc = file_has_perm(current, vma->vm_file,
2564 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2567 static int selinux_file_lock(struct file *file, unsigned int cmd)
2569 return file_has_perm(current, file, FILE__LOCK);
2572 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2579 if (!file->f_dentry || !file->f_dentry->d_inode) {
2584 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2585 err = file_has_perm(current, file,FILE__WRITE);
2594 /* Just check FD__USE permission */
2595 err = file_has_perm(current, file, 0);
2600 #if BITS_PER_LONG == 32
2605 if (!file->f_dentry || !file->f_dentry->d_inode) {
2609 err = file_has_perm(current, file, FILE__LOCK);
2616 static int selinux_file_set_fowner(struct file *file)
2618 struct task_security_struct *tsec;
2619 struct file_security_struct *fsec;
2621 tsec = current->security;
2622 fsec = file->f_security;
2623 fsec->fown_sid = tsec->sid;
2628 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2629 struct fown_struct *fown, int signum)
2633 struct task_security_struct *tsec;
2634 struct file_security_struct *fsec;
2636 /* struct fown_struct is never outside the context of a struct file */
2637 file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2639 tsec = tsk->security;
2640 fsec = file->f_security;
2643 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2645 perm = signal_to_av(signum);
2647 return avc_has_perm(fsec->fown_sid, tsec->sid,
2648 SECCLASS_PROCESS, perm, NULL);
2651 static int selinux_file_receive(struct file *file)
2653 return file_has_perm(current, file, file_to_av(file));
2656 /* task security operations */
2658 static int selinux_task_create(unsigned long clone_flags)
2662 rc = secondary_ops->task_create(clone_flags);
2666 return task_has_perm(current, current, PROCESS__FORK);
2669 static int selinux_task_alloc_security(struct task_struct *tsk)
2671 struct task_security_struct *tsec1, *tsec2;
2674 tsec1 = current->security;
2676 rc = task_alloc_security(tsk);
2679 tsec2 = tsk->security;
2681 tsec2->osid = tsec1->osid;
2682 tsec2->sid = tsec1->sid;
2684 /* Retain the exec, fs, key, and sock SIDs across fork */
2685 tsec2->exec_sid = tsec1->exec_sid;
2686 tsec2->create_sid = tsec1->create_sid;
2687 tsec2->keycreate_sid = tsec1->keycreate_sid;
2688 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2690 /* Retain ptracer SID across fork, if any.
2691 This will be reset by the ptrace hook upon any
2692 subsequent ptrace_attach operations. */
2693 tsec2->ptrace_sid = tsec1->ptrace_sid;
2698 static void selinux_task_free_security(struct task_struct *tsk)
2700 task_free_security(tsk);
2703 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2705 /* Since setuid only affects the current process, and
2706 since the SELinux controls are not based on the Linux
2707 identity attributes, SELinux does not need to control
2708 this operation. However, SELinux does control the use
2709 of the CAP_SETUID and CAP_SETGID capabilities using the
2714 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2716 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2719 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2721 /* See the comment for setuid above. */
2725 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2727 return task_has_perm(current, p, PROCESS__SETPGID);
2730 static int selinux_task_getpgid(struct task_struct *p)
2732 return task_has_perm(current, p, PROCESS__GETPGID);
2735 static int selinux_task_getsid(struct task_struct *p)
2737 return task_has_perm(current, p, PROCESS__GETSESSION);
2740 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2742 selinux_get_task_sid(p, secid);
2745 static int selinux_task_setgroups(struct group_info *group_info)
2747 /* See the comment for setuid above. */
2751 static int selinux_task_setnice(struct task_struct *p, int nice)
2755 rc = secondary_ops->task_setnice(p, nice);
2759 return task_has_perm(current,p, PROCESS__SETSCHED);
2762 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2764 return task_has_perm(current, p, PROCESS__SETSCHED);
2767 static int selinux_task_getioprio(struct task_struct *p)
2769 return task_has_perm(current, p, PROCESS__GETSCHED);
2772 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2774 struct rlimit *old_rlim = current->signal->rlim + resource;
2777 rc = secondary_ops->task_setrlimit(resource, new_rlim);
2781 /* Control the ability to change the hard limit (whether
2782 lowering or raising it), so that the hard limit can
2783 later be used as a safe reset point for the soft limit
2784 upon context transitions. See selinux_bprm_apply_creds. */
2785 if (old_rlim->rlim_max != new_rlim->rlim_max)
2786 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2791 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2793 return task_has_perm(current, p, PROCESS__SETSCHED);
2796 static int selinux_task_getscheduler(struct task_struct *p)
2798 return task_has_perm(current, p, PROCESS__GETSCHED);
2801 static int selinux_task_movememory(struct task_struct *p)
2803 return task_has_perm(current, p, PROCESS__SETSCHED);
2806 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2811 struct task_security_struct *tsec;
2813 rc = secondary_ops->task_kill(p, info, sig, secid);
2817 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2821 perm = PROCESS__SIGNULL; /* null signal; existence test */
2823 perm = signal_to_av(sig);
2826 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2828 rc = task_has_perm(current, p, perm);
2832 static int selinux_task_prctl(int option,
2838 /* The current prctl operations do not appear to require
2839 any SELinux controls since they merely observe or modify
2840 the state of the current process. */
2844 static int selinux_task_wait(struct task_struct *p)
2848 perm = signal_to_av(p->exit_signal);
2850 return task_has_perm(p, current, perm);
2853 static void selinux_task_reparent_to_init(struct task_struct *p)
2855 struct task_security_struct *tsec;
2857 secondary_ops->task_reparent_to_init(p);
2860 tsec->osid = tsec->sid;
2861 tsec->sid = SECINITSID_KERNEL;
2865 static void selinux_task_to_inode(struct task_struct *p,
2866 struct inode *inode)
2868 struct task_security_struct *tsec = p->security;
2869 struct inode_security_struct *isec = inode->i_security;
2871 isec->sid = tsec->sid;
2872 isec->initialized = 1;
2876 /* Returns error only if unable to parse addresses */
2877 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2879 int offset, ihlen, ret = -EINVAL;
2880 struct iphdr _iph, *ih;
2882 offset = skb->nh.raw - skb->data;
2883 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2887 ihlen = ih->ihl * 4;
2888 if (ihlen < sizeof(_iph))
2891 ad->u.net.v4info.saddr = ih->saddr;
2892 ad->u.net.v4info.daddr = ih->daddr;
2895 switch (ih->protocol) {
2897 struct tcphdr _tcph, *th;
2899 if (ntohs(ih->frag_off) & IP_OFFSET)
2903 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2907 ad->u.net.sport = th->source;
2908 ad->u.net.dport = th->dest;
2913 struct udphdr _udph, *uh;
2915 if (ntohs(ih->frag_off) & IP_OFFSET)
2919 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2923 ad->u.net.sport = uh->source;
2924 ad->u.net.dport = uh->dest;
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2937 /* Returns error only if unable to parse addresses */
2938 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2941 int ret = -EINVAL, offset;
2942 struct ipv6hdr _ipv6h, *ip6;
2944 offset = skb->nh.raw - skb->data;
2945 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2949 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2950 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2953 nexthdr = ip6->nexthdr;
2954 offset += sizeof(_ipv6h);
2955 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2961 struct tcphdr _tcph, *th;
2963 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2967 ad->u.net.sport = th->source;
2968 ad->u.net.dport = th->dest;
2973 struct udphdr _udph, *uh;
2975 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2979 ad->u.net.sport = uh->source;
2980 ad->u.net.dport = uh->dest;
2984 /* includes fragments */
2994 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2995 char **addrp, int *len, int src)
2999 switch (ad->u.net.family) {
3001 ret = selinux_parse_skb_ipv4(skb, ad);
3005 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3006 &ad->u.net.v4info.daddr);
3009 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3011 ret = selinux_parse_skb_ipv6(skb, ad);
3015 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3016 &ad->u.net.v6info.daddr);
3026 /* socket security operations */
3027 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3030 struct inode_security_struct *isec;
3031 struct task_security_struct *tsec;
3032 struct avc_audit_data ad;
3035 tsec = task->security;
3036 isec = SOCK_INODE(sock)->i_security;
3038 if (isec->sid == SECINITSID_KERNEL)
3041 AVC_AUDIT_DATA_INIT(&ad,NET);
3042 ad.u.net.sk = sock->sk;
3043 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3049 static int selinux_socket_create(int family, int type,
3050 int protocol, int kern)
3053 struct task_security_struct *tsec;
3059 tsec = current->security;
3060 newsid = tsec->sockcreate_sid ? : tsec->sid;
3061 err = avc_has_perm(tsec->sid, newsid,
3062 socket_type_to_security_class(family, type,
3063 protocol), SOCKET__CREATE, NULL);
3069 static int selinux_socket_post_create(struct socket *sock, int family,
3070 int type, int protocol, int kern)
3073 struct inode_security_struct *isec;
3074 struct task_security_struct *tsec;
3075 struct sk_security_struct *sksec;
3078 isec = SOCK_INODE(sock)->i_security;
3080 tsec = current->security;
3081 newsid = tsec->sockcreate_sid ? : tsec->sid;
3082 isec->sclass = socket_type_to_security_class(family, type, protocol);
3083 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3084 isec->initialized = 1;
3087 sksec = sock->sk->sk_security;
3088 sksec->sid = isec->sid;
3089 err = selinux_netlbl_socket_post_create(sock,
3097 /* Range of port numbers used to automatically bind.
3098 Need to determine whether we should perform a name_bind
3099 permission check between the socket and the port number. */
3100 #define ip_local_port_range_0 sysctl_local_port_range[0]
3101 #define ip_local_port_range_1 sysctl_local_port_range[1]
3103 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3108 err = socket_has_perm(current, sock, SOCKET__BIND);
3113 * If PF_INET or PF_INET6, check name_bind permission for the port.
3114 * Multiple address binding for SCTP is not supported yet: we just
3115 * check the first address now.
3117 family = sock->sk->sk_family;
3118 if (family == PF_INET || family == PF_INET6) {
3120 struct inode_security_struct *isec;
3121 struct task_security_struct *tsec;
3122 struct avc_audit_data ad;
3123 struct sockaddr_in *addr4 = NULL;
3124 struct sockaddr_in6 *addr6 = NULL;
3125 unsigned short snum;
3126 struct sock *sk = sock->sk;
3127 u32 sid, node_perm, addrlen;
3129 tsec = current->security;
3130 isec = SOCK_INODE(sock)->i_security;
3132 if (family == PF_INET) {
3133 addr4 = (struct sockaddr_in *)address;
3134 snum = ntohs(addr4->sin_port);
3135 addrlen = sizeof(addr4->sin_addr.s_addr);
3136 addrp = (char *)&addr4->sin_addr.s_addr;
3138 addr6 = (struct sockaddr_in6 *)address;
3139 snum = ntohs(addr6->sin6_port);
3140 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3141 addrp = (char *)&addr6->sin6_addr.s6_addr;
3144 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3145 snum > ip_local_port_range_1)) {
3146 err = security_port_sid(sk->sk_family, sk->sk_type,
3147 sk->sk_protocol, snum, &sid);
3150 AVC_AUDIT_DATA_INIT(&ad,NET);
3151 ad.u.net.sport = htons(snum);
3152 ad.u.net.family = family;
3153 err = avc_has_perm(isec->sid, sid,
3155 SOCKET__NAME_BIND, &ad);
3160 switch(isec->sclass) {
3161 case SECCLASS_TCP_SOCKET:
3162 node_perm = TCP_SOCKET__NODE_BIND;
3165 case SECCLASS_UDP_SOCKET:
3166 node_perm = UDP_SOCKET__NODE_BIND;
3170 node_perm = RAWIP_SOCKET__NODE_BIND;
3174 err = security_node_sid(family, addrp, addrlen, &sid);
3178 AVC_AUDIT_DATA_INIT(&ad,NET);
3179 ad.u.net.sport = htons(snum);
3180 ad.u.net.family = family;
3182 if (family == PF_INET)
3183 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3185 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3187 err = avc_has_perm(isec->sid, sid,
3188 isec->sclass, node_perm, &ad);
3196 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3198 struct inode_security_struct *isec;
3201 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3206 * If a TCP socket, check name_connect permission for the port.
3208 isec = SOCK_INODE(sock)->i_security;
3209 if (isec->sclass == SECCLASS_TCP_SOCKET) {
3210 struct sock *sk = sock->sk;
3211 struct avc_audit_data ad;
3212 struct sockaddr_in *addr4 = NULL;
3213 struct sockaddr_in6 *addr6 = NULL;
3214 unsigned short snum;
3217 if (sk->sk_family == PF_INET) {
3218 addr4 = (struct sockaddr_in *)address;
3219 if (addrlen < sizeof(struct sockaddr_in))
3221 snum = ntohs(addr4->sin_port);
3223 addr6 = (struct sockaddr_in6 *)address;
3224 if (addrlen < SIN6_LEN_RFC2133)
3226 snum = ntohs(addr6->sin6_port);
3229 err = security_port_sid(sk->sk_family, sk->sk_type,
3230 sk->sk_protocol, snum, &sid);
3234 AVC_AUDIT_DATA_INIT(&ad,NET);
3235 ad.u.net.dport = htons(snum);
3236 ad.u.net.family = sk->sk_family;
3237 err = avc_has_perm(isec->sid, sid, isec->sclass,
3238 TCP_SOCKET__NAME_CONNECT, &ad);
3247 static int selinux_socket_listen(struct socket *sock, int backlog)
3249 return socket_has_perm(current, sock, SOCKET__LISTEN);
3252 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3255 struct inode_security_struct *isec;
3256 struct inode_security_struct *newisec;
3258 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3262 newisec = SOCK_INODE(newsock)->i_security;
3264 isec = SOCK_INODE(sock)->i_security;
3265 newisec->sclass = isec->sclass;
3266 newisec->sid = isec->sid;
3267 newisec->initialized = 1;
3272 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3277 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3281 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3284 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3285 int size, int flags)
3287 return socket_has_perm(current, sock, SOCKET__READ);
3290 static int selinux_socket_getsockname(struct socket *sock)
3292 return socket_has_perm(current, sock, SOCKET__GETATTR);
3295 static int selinux_socket_getpeername(struct socket *sock)
3297 return socket_has_perm(current, sock, SOCKET__GETATTR);
3300 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3302 return socket_has_perm(current, sock, SOCKET__SETOPT);
3305 static int selinux_socket_getsockopt(struct socket *sock, int level,
3308 return socket_has_perm(current, sock, SOCKET__GETOPT);
3311 static int selinux_socket_shutdown(struct socket *sock, int how)
3313 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3316 static int selinux_socket_unix_stream_connect(struct socket *sock,
3317 struct socket *other,
3320 struct sk_security_struct *ssec;
3321 struct inode_security_struct *isec;
3322 struct inode_security_struct *other_isec;
3323 struct avc_audit_data ad;
3326 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3330 isec = SOCK_INODE(sock)->i_security;
3331 other_isec = SOCK_INODE(other)->i_security;
3333 AVC_AUDIT_DATA_INIT(&ad,NET);
3334 ad.u.net.sk = other->sk;
3336 err = avc_has_perm(isec->sid, other_isec->sid,
3338 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3342 /* connecting socket */
3343 ssec = sock->sk->sk_security;
3344 ssec->peer_sid = other_isec->sid;
3346 /* server child socket */
3347 ssec = newsk->sk_security;
3348 ssec->peer_sid = isec->sid;
3349 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3354 static int selinux_socket_unix_may_send(struct socket *sock,
3355 struct socket *other)
3357 struct inode_security_struct *isec;
3358 struct inode_security_struct *other_isec;
3359 struct avc_audit_data ad;
3362 isec = SOCK_INODE(sock)->i_security;
3363 other_isec = SOCK_INODE(other)->i_security;
3365 AVC_AUDIT_DATA_INIT(&ad,NET);
3366 ad.u.net.sk = other->sk;
3368 err = avc_has_perm(isec->sid, other_isec->sid,
3369 isec->sclass, SOCKET__SENDTO, &ad);
3376 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3377 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3380 u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3381 struct socket *sock;
3385 read_lock_bh(&sk->sk_callback_lock);
3386 sock = sk->sk_socket;
3388 struct inode *inode;
3389 inode = SOCK_INODE(sock);
3391 struct inode_security_struct *isec;
3392 isec = inode->i_security;
3393 sock_sid = isec->sid;
3394 sock_class = isec->sclass;
3397 read_unlock_bh(&sk->sk_callback_lock);
3404 err = sel_netif_sids(skb->dev, &if_sid, NULL);
3408 switch (sock_class) {
3409 case SECCLASS_UDP_SOCKET:
3410 netif_perm = NETIF__UDP_RECV;
3411 node_perm = NODE__UDP_RECV;
3412 recv_perm = UDP_SOCKET__RECV_MSG;
3415 case SECCLASS_TCP_SOCKET:
3416 netif_perm = NETIF__TCP_RECV;
3417 node_perm = NODE__TCP_RECV;
3418 recv_perm = TCP_SOCKET__RECV_MSG;
3422 netif_perm = NETIF__RAWIP_RECV;
3423 node_perm = NODE__RAWIP_RECV;
3427 err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3431 err = security_node_sid(family, addrp, len, &node_sid);
3435 err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3442 err = security_port_sid(sk->sk_family, sk->sk_type,
3443 sk->sk_protocol, ntohs(ad->u.net.sport),
3448 err = avc_has_perm(sock_sid, port_sid,
3449 sock_class, recv_perm, ad);
3456 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3461 struct avc_audit_data ad;
3462 struct sk_security_struct *sksec = sk->sk_security;
3464 family = sk->sk_family;
3465 if (family != PF_INET && family != PF_INET6)
3468 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3469 if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3472 AVC_AUDIT_DATA_INIT(&ad, NET);
3473 ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3474 ad.u.net.family = family;
3476 err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3480 if (selinux_compat_net)
3481 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3484 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3489 err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3493 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3498 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3499 int __user *optlen, unsigned len)
3504 struct sk_security_struct *ssec;
3505 struct inode_security_struct *isec;
3508 isec = SOCK_INODE(sock)->i_security;
3510 /* if UNIX_STREAM check peer_sid, if TCP check dst for labelled sa */
3511 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET) {
3512 ssec = sock->sk->sk_security;
3513 peer_sid = ssec->peer_sid;
3515 else if (isec->sclass == SECCLASS_TCP_SOCKET) {
3516 peer_sid = selinux_netlbl_socket_getpeersec_stream(sock);
3517 if (peer_sid == SECSID_NULL)
3518 peer_sid = selinux_socket_getpeer_stream(sock->sk);
3519 if (peer_sid == SECSID_NULL) {
3529 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3534 if (scontext_len > len) {
3539 if (copy_to_user(optval, scontext, scontext_len))
3543 if (put_user(scontext_len, optlen))
3551 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3553 u32 peer_secid = SECSID_NULL;
3556 if (sock && (sock->sk->sk_family == PF_UNIX))
3557 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3559 peer_secid = selinux_netlbl_socket_getpeersec_dgram(skb);
3560 if (peer_secid == SECSID_NULL)
3561 peer_secid = selinux_socket_getpeer_dgram(skb);
3564 if (peer_secid == SECSID_NULL)
3566 *secid = peer_secid;
3571 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3573 return sk_alloc_security(sk, family, priority);
3576 static void selinux_sk_free_security(struct sock *sk)
3578 sk_free_security(sk);
3581 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3583 struct sk_security_struct *ssec = sk->sk_security;
3584 struct sk_security_struct *newssec = newsk->sk_security;
3586 newssec->sid = ssec->sid;
3587 newssec->peer_sid = ssec->peer_sid;
3590 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3593 *secid = SECINITSID_ANY_SOCKET;
3595 struct sk_security_struct *sksec = sk->sk_security;
3597 *secid = sksec->sid;
3601 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3603 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3604 struct sk_security_struct *sksec = sk->sk_security;
3606 isec->sid = sksec->sid;
3608 selinux_netlbl_sock_graft(sk, parent);
3611 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3612 struct request_sock *req)
3614 struct sk_security_struct *sksec = sk->sk_security;
3619 newsid = selinux_netlbl_inet_conn_request(skb, sksec->sid);
3620 if (newsid != SECSID_NULL) {
3621 req->secid = newsid;
3625 err = selinux_xfrm_decode_session(skb, &peersid, 0);
3628 if (peersid == SECSID_NULL) {
3629 req->secid = sksec->sid;
3633 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3637 req->secid = newsid;
3641 static void selinux_inet_csk_clone(struct sock *newsk,
3642 const struct request_sock *req)
3644 struct sk_security_struct *newsksec = newsk->sk_security;
3646 newsksec->sid = req->secid;
3647 /* NOTE: Ideally, we should also get the isec->sid for the
3648 new socket in sync, but we don't have the isec available yet.
3649 So we will wait until sock_graft to do it, by which
3650 time it will have been created and available. */
3653 static void selinux_req_classify_flow(const struct request_sock *req,
3656 fl->secid = req->secid;
3659 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3663 struct nlmsghdr *nlh;
3664 struct socket *sock = sk->sk_socket;
3665 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3667 if (skb->len < NLMSG_SPACE(0)) {
3671 nlh = (struct nlmsghdr *)skb->data;
3673 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3675 if (err == -EINVAL) {
3676 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3677 "SELinux: unrecognized netlink message"
3678 " type=%hu for sclass=%hu\n",
3679 nlh->nlmsg_type, isec->sclass);
3680 if (!selinux_enforcing)
3690 err = socket_has_perm(current, sock, perm);
3695 #ifdef CONFIG_NETFILTER
3697 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3698 struct avc_audit_data *ad,
3699 u16 family, char *addrp, int len)
3702 u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3703 struct socket *sock;
3704 struct inode *inode;
3705 struct inode_security_struct *isec;
3707 sock = sk->sk_socket;
3711 inode = SOCK_INODE(sock);
3715 isec = inode->i_security;
3717 err = sel_netif_sids(dev, &if_sid, NULL);
3721 switch (isec->sclass) {
3722 case SECCLASS_UDP_SOCKET:
3723 netif_perm = NETIF__UDP_SEND;
3724 node_perm = NODE__UDP_SEND;
3725 send_perm = UDP_SOCKET__SEND_MSG;
3728 case SECCLASS_TCP_SOCKET:
3729 netif_perm = NETIF__TCP_SEND;
3730 node_perm = NODE__TCP_SEND;
3731 send_perm = TCP_SOCKET__SEND_MSG;
3735 netif_perm = NETIF__RAWIP_SEND;
3736 node_perm = NODE__RAWIP_SEND;
3740 err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3744 err = security_node_sid(family, addrp, len, &node_sid);
3748 err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3755 err = security_port_sid(sk->sk_family,
3758 ntohs(ad->u.net.dport),
3763 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3770 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3771 struct sk_buff **pskb,
3772 const struct net_device *in,
3773 const struct net_device *out,
3774 int (*okfn)(struct sk_buff *),
3780 struct sk_buff *skb = *pskb;
3781 struct avc_audit_data ad;
3782 struct net_device *dev = (struct net_device *)out;
3783 struct sk_security_struct *sksec;
3789 sksec = sk->sk_security;
3791 AVC_AUDIT_DATA_INIT(&ad, NET);
3792 ad.u.net.netif = dev->name;
3793 ad.u.net.family = family;
3795 err = selinux_parse_skb(skb, &ad, &addrp, &len, 0);
3799 if (selinux_compat_net)
3800 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3801 family, addrp, len);
3803 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3809 err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad);
3811 return err ? NF_DROP : NF_ACCEPT;
3814 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3815 struct sk_buff **pskb,
3816 const struct net_device *in,
3817 const struct net_device *out,
3818 int (*okfn)(struct sk_buff *))
3820 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3823 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3825 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3826 struct sk_buff **pskb,
3827 const struct net_device *in,
3828 const struct net_device *out,
3829 int (*okfn)(struct sk_buff *))
3831 return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3836 #endif /* CONFIG_NETFILTER */
3838 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3842 err = secondary_ops->netlink_send(sk, skb);
3846 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3847 err = selinux_nlmsg_perm(sk, skb);
3852 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
3855 struct avc_audit_data ad;
3857 err = secondary_ops->netlink_recv(skb, capability);
3861 AVC_AUDIT_DATA_INIT(&ad, CAP);
3862 ad.u.cap = capability;
3864 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
3865 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
3868 static int ipc_alloc_security(struct task_struct *task,
3869 struct kern_ipc_perm *perm,
3872 struct task_security_struct *tsec = task->security;
3873 struct ipc_security_struct *isec;
3875 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3879 isec->sclass = sclass;
3880 isec->ipc_perm = perm;
3881 isec->sid = tsec->sid;
3882 perm->security = isec;
3887 static void ipc_free_security(struct kern_ipc_perm *perm)
3889 struct ipc_security_struct *isec = perm->security;
3890 perm->security = NULL;
3894 static int msg_msg_alloc_security(struct msg_msg *msg)
3896 struct msg_security_struct *msec;
3898 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3903 msec->sid = SECINITSID_UNLABELED;
3904 msg->security = msec;
3909 static void msg_msg_free_security(struct msg_msg *msg)
3911 struct msg_security_struct *msec = msg->security;
3913 msg->security = NULL;
3917 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3920 struct task_security_struct *tsec;
3921 struct ipc_security_struct *isec;
3922 struct avc_audit_data ad;
3924 tsec = current->security;
3925 isec = ipc_perms->security;
3927 AVC_AUDIT_DATA_INIT(&ad, IPC);
3928 ad.u.ipc_id = ipc_perms->key;
3930 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3933 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3935 return msg_msg_alloc_security(msg);
3938 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3940 msg_msg_free_security(msg);
3943 /* message queue security operations */
3944 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3946 struct task_security_struct *tsec;
3947 struct ipc_security_struct *isec;
3948 struct avc_audit_data ad;
3951 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3955 tsec = current->security;
3956 isec = msq->q_perm.security;
3958 AVC_AUDIT_DATA_INIT(&ad, IPC);
3959 ad.u.ipc_id = msq->q_perm.key;
3961 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3964 ipc_free_security(&msq->q_perm);
3970 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3972 ipc_free_security(&msq->q_perm);
3975 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3977 struct task_security_struct *tsec;
3978 struct ipc_security_struct *isec;
3979 struct avc_audit_data ad;
3981 tsec = current->security;
3982 isec = msq->q_perm.security;
3984 AVC_AUDIT_DATA_INIT(&ad, IPC);
3985 ad.u.ipc_id = msq->q_perm.key;
3987 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3988 MSGQ__ASSOCIATE, &ad);
3991 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3999 /* No specific object, just general system-wide information. */
4000 return task_has_system(current, SYSTEM__IPC_INFO);
4003 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4006 perms = MSGQ__SETATTR;
4009 perms = MSGQ__DESTROY;
4015 err = ipc_has_perm(&msq->q_perm, perms);
4019 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4021 struct task_security_struct *tsec;
4022 struct ipc_security_struct *isec;
4023 struct msg_security_struct *msec;
4024 struct avc_audit_data ad;
4027 tsec = current->security;
4028 isec = msq->q_perm.security;
4029 msec = msg->security;
4032 * First time through, need to assign label to the message
4034 if (msec->sid == SECINITSID_UNLABELED) {
4036 * Compute new sid based on current process and
4037 * message queue this message will be stored in
4039 rc = security_transition_sid(tsec->sid,
4047 AVC_AUDIT_DATA_INIT(&ad, IPC);
4048 ad.u.ipc_id = msq->q_perm.key;
4050 /* Can this process write to the queue? */
4051 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4054 /* Can this process send the message */
4055 rc = avc_has_perm(tsec->sid, msec->sid,
4056 SECCLASS_MSG, MSG__SEND, &ad);
4058 /* Can the message be put in the queue? */
4059 rc = avc_has_perm(msec->sid, isec->sid,
4060 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4065 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4066 struct task_struct *target,
4067 long type, int mode)
4069 struct task_security_struct *tsec;
4070 struct ipc_security_struct *isec;
4071 struct msg_security_struct *msec;
4072 struct avc_audit_data ad;
4075 tsec = target->security;
4076 isec = msq->q_perm.security;
4077 msec = msg->security;
4079 AVC_AUDIT_DATA_INIT(&ad, IPC);
4080 ad.u.ipc_id = msq->q_perm.key;
4082 rc = avc_has_perm(tsec->sid, isec->sid,
4083 SECCLASS_MSGQ, MSGQ__READ, &ad);
4085 rc = avc_has_perm(tsec->sid, msec->sid,
4086 SECCLASS_MSG, MSG__RECEIVE, &ad);
4090 /* Shared Memory security operations */
4091 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4093 struct task_security_struct *tsec;
4094 struct ipc_security_struct *isec;
4095 struct avc_audit_data ad;
4098 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4102 tsec = current->security;
4103 isec = shp->shm_perm.security;
4105 AVC_AUDIT_DATA_INIT(&ad, IPC);
4106 ad.u.ipc_id = shp->shm_perm.key;
4108 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4111 ipc_free_security(&shp->shm_perm);
4117 static void selinux_shm_free_security(struct shmid_kernel *shp)
4119 ipc_free_security(&shp->shm_perm);
4122 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4124 struct task_security_struct *tsec;
4125 struct ipc_security_struct *isec;
4126 struct avc_audit_data ad;
4128 tsec = current->security;
4129 isec = shp->shm_perm.security;
4131 AVC_AUDIT_DATA_INIT(&ad, IPC);
4132 ad.u.ipc_id = shp->shm_perm.key;
4134 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4135 SHM__ASSOCIATE, &ad);
4138 /* Note, at this point, shp is locked down */
4139 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4147 /* No specific object, just general system-wide information. */
4148 return task_has_system(current, SYSTEM__IPC_INFO);
4151 perms = SHM__GETATTR | SHM__ASSOCIATE;
4154 perms = SHM__SETATTR;
4161 perms = SHM__DESTROY;
4167 err = ipc_has_perm(&shp->shm_perm, perms);
4171 static int selinux_shm_shmat(struct shmid_kernel *shp,
4172 char __user *shmaddr, int shmflg)
4177 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4181 if (shmflg & SHM_RDONLY)
4184 perms = SHM__READ | SHM__WRITE;
4186 return ipc_has_perm(&shp->shm_perm, perms);
4189 /* Semaphore security operations */
4190 static int selinux_sem_alloc_security(struct sem_array *sma)
4192 struct task_security_struct *tsec;
4193 struct ipc_security_struct *isec;
4194 struct avc_audit_data ad;
4197 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4201 tsec = current->security;
4202 isec = sma->sem_perm.security;
4204 AVC_AUDIT_DATA_INIT(&ad, IPC);
4205 ad.u.ipc_id = sma->sem_perm.key;
4207 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4210 ipc_free_security(&sma->sem_perm);
4216 static void selinux_sem_free_security(struct sem_array *sma)
4218 ipc_free_security(&sma->sem_perm);
4221 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4223 struct task_security_struct *tsec;
4224 struct ipc_security_struct *isec;
4225 struct avc_audit_data ad;
4227 tsec = current->security;
4228 isec = sma->sem_perm.security;
4230 AVC_AUDIT_DATA_INIT(&ad, IPC);
4231 ad.u.ipc_id = sma->sem_perm.key;
4233 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4234 SEM__ASSOCIATE, &ad);
4237 /* Note, at this point, sma is locked down */
4238 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4246 /* No specific object, just general system-wide information. */
4247 return task_has_system(current, SYSTEM__IPC_INFO);
4251 perms = SEM__GETATTR;
4262 perms = SEM__DESTROY;
4265 perms = SEM__SETATTR;
4269 perms = SEM__GETATTR | SEM__ASSOCIATE;
4275 err = ipc_has_perm(&sma->sem_perm, perms);
4279 static int selinux_sem_semop(struct sem_array *sma,
4280 struct sembuf *sops, unsigned nsops, int alter)
4285 perms = SEM__READ | SEM__WRITE;
4289 return ipc_has_perm(&sma->sem_perm, perms);
4292 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4298 av |= IPC__UNIX_READ;
4300 av |= IPC__UNIX_WRITE;
4305 return ipc_has_perm(ipcp, av);
4308 /* module stacking operations */
4309 static int selinux_register_security (const char *name, struct security_operations *ops)
4311 if (secondary_ops != original_ops) {
4312 printk(KERN_INFO "%s: There is already a secondary security "
4313 "module registered.\n", __FUNCTION__);
4317 secondary_ops = ops;
4319 printk(KERN_INFO "%s: Registering secondary module %s\n",
4326 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4328 if (ops != secondary_ops) {
4329 printk (KERN_INFO "%s: trying to unregister a security module "
4330 "that is not registered.\n", __FUNCTION__);
4334 secondary_ops = original_ops;
4339 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4342 inode_doinit_with_dentry(inode, dentry);
4345 static int selinux_getprocattr(struct task_struct *p,
4346 char *name, void *value, size_t size)
4348 struct task_security_struct *tsec;
4353 error = task_has_perm(current, p, PROCESS__GETATTR);
4360 if (!strcmp(name, "current"))
4362 else if (!strcmp(name, "prev"))
4364 else if (!strcmp(name, "exec"))
4365 sid = tsec->exec_sid;
4366 else if (!strcmp(name, "fscreate"))
4367 sid = tsec->create_sid;
4368 else if (!strcmp(name, "keycreate"))
4369 sid = tsec->keycreate_sid;
4370 else if (!strcmp(name, "sockcreate"))
4371 sid = tsec->sockcreate_sid;
4378 return selinux_getsecurity(sid, value, size);
4381 static int selinux_setprocattr(struct task_struct *p,
4382 char *name, void *value, size_t size)
4384 struct task_security_struct *tsec;
4390 /* SELinux only allows a process to change its own
4391 security attributes. */
4396 * Basic control over ability to set these attributes at all.
4397 * current == p, but we'll pass them separately in case the
4398 * above restriction is ever removed.
4400 if (!strcmp(name, "exec"))
4401 error = task_has_perm(current, p, PROCESS__SETEXEC);
4402 else if (!strcmp(name, "fscreate"))
4403 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4404 else if (!strcmp(name, "keycreate"))
4405 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4406 else if (!strcmp(name, "sockcreate"))
4407 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4408 else if (!strcmp(name, "current"))
4409 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4415 /* Obtain a SID for the context, if one was specified. */
4416 if (size && str[1] && str[1] != '\n') {
4417 if (str[size-1] == '\n') {
4421 error = security_context_to_sid(value, size, &sid);
4426 /* Permission checking based on the specified context is
4427 performed during the actual operation (execve,
4428 open/mkdir/...), when we know the full context of the
4429 operation. See selinux_bprm_set_security for the execve
4430 checks and may_create for the file creation checks. The
4431 operation will then fail if the context is not permitted. */
4433 if (!strcmp(name, "exec"))
4434 tsec->exec_sid = sid;
4435 else if (!strcmp(name, "fscreate"))
4436 tsec->create_sid = sid;
4437 else if (!strcmp(name, "keycreate")) {
4438 error = may_create_key(sid, p);
4441 tsec->keycreate_sid = sid;
4442 } else if (!strcmp(name, "sockcreate"))
4443 tsec->sockcreate_sid = sid;
4444 else if (!strcmp(name, "current")) {
4445 struct av_decision avd;
4450 /* Only allow single threaded processes to change context */
4451 if (atomic_read(&p->mm->mm_users) != 1) {
4452 struct task_struct *g, *t;
4453 struct mm_struct *mm = p->mm;
4454 read_lock(&tasklist_lock);
4455 do_each_thread(g, t)
4456 if (t->mm == mm && t != p) {
4457 read_unlock(&tasklist_lock);
4460 while_each_thread(g, t);
4461 read_unlock(&tasklist_lock);
4464 /* Check permissions for the transition. */
4465 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4466 PROCESS__DYNTRANSITION, NULL);
4470 /* Check for ptracing, and update the task SID if ok.
4471 Otherwise, leave SID unchanged and fail. */
4473 if (p->ptrace & PT_PTRACED) {
4474 error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4476 PROCESS__PTRACE, &avd);
4480 avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4481 PROCESS__PTRACE, &avd, error, NULL);
4495 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4497 return security_sid_to_context(secid, secdata, seclen);
4500 static void selinux_release_secctx(char *secdata, u32 seclen)
4508 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4509 unsigned long flags)
4511 struct task_security_struct *tsec = tsk->security;
4512 struct key_security_struct *ksec;
4514 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4519 if (tsec->keycreate_sid)
4520 ksec->sid = tsec->keycreate_sid;
4522 ksec->sid = tsec->sid;
4528 static void selinux_key_free(struct key *k)
4530 struct key_security_struct *ksec = k->security;
4536 static int selinux_key_permission(key_ref_t key_ref,
4537 struct task_struct *ctx,
4541 struct task_security_struct *tsec;
4542 struct key_security_struct *ksec;
4544 key = key_ref_to_ptr(key_ref);
4546 tsec = ctx->security;
4547 ksec = key->security;
4549 /* if no specific permissions are requested, we skip the
4550 permission check. No serious, additional covert channels
4551 appear to be created. */
4555 return avc_has_perm(tsec->sid, ksec->sid,
4556 SECCLASS_KEY, perm, NULL);
4561 static struct security_operations selinux_ops = {
4562 .ptrace = selinux_ptrace,
4563 .capget = selinux_capget,
4564 .capset_check = selinux_capset_check,
4565 .capset_set = selinux_capset_set,
4566 .sysctl = selinux_sysctl,
4567 .capable = selinux_capable,
4568 .quotactl = selinux_quotactl,
4569 .quota_on = selinux_quota_on,
4570 .syslog = selinux_syslog,
4571 .vm_enough_memory = selinux_vm_enough_memory,
4573 .netlink_send = selinux_netlink_send,
4574 .netlink_recv = selinux_netlink_recv,
4576 .bprm_alloc_security = selinux_bprm_alloc_security,
4577 .bprm_free_security = selinux_bprm_free_security,
4578 .bprm_apply_creds = selinux_bprm_apply_creds,
4579 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
4580 .bprm_set_security = selinux_bprm_set_security,
4581 .bprm_check_security = selinux_bprm_check_security,
4582 .bprm_secureexec = selinux_bprm_secureexec,
4584 .sb_alloc_security = selinux_sb_alloc_security,
4585 .sb_free_security = selinux_sb_free_security,
4586 .sb_copy_data = selinux_sb_copy_data,
4587 .sb_kern_mount = selinux_sb_kern_mount,
4588 .sb_statfs = selinux_sb_statfs,
4589 .sb_mount = selinux_mount,
4590 .sb_umount = selinux_umount,
4592 .inode_alloc_security = selinux_inode_alloc_security,
4593 .inode_free_security = selinux_inode_free_security,
4594 .inode_init_security = selinux_inode_init_security,
4595 .inode_create = selinux_inode_create,
4596 .inode_link = selinux_inode_link,
4597 .inode_unlink = selinux_inode_unlink,
4598 .inode_symlink = selinux_inode_symlink,
4599 .inode_mkdir = selinux_inode_mkdir,
4600 .inode_rmdir = selinux_inode_rmdir,
4601 .inode_mknod = selinux_inode_mknod,
4602 .inode_rename = selinux_inode_rename,
4603 .inode_readlink = selinux_inode_readlink,
4604 .inode_follow_link = selinux_inode_follow_link,
4605 .inode_permission = selinux_inode_permission,
4606 .inode_setattr = selinux_inode_setattr,
4607 .inode_getattr = selinux_inode_getattr,
4608 .inode_setxattr = selinux_inode_setxattr,
4609 .inode_post_setxattr = selinux_inode_post_setxattr,
4610 .inode_getxattr = selinux_inode_getxattr,
4611 .inode_listxattr = selinux_inode_listxattr,
4612 .inode_removexattr = selinux_inode_removexattr,
4613 .inode_xattr_getsuffix = selinux_inode_xattr_getsuffix,
4614 .inode_getsecurity = selinux_inode_getsecurity,
4615 .inode_setsecurity = selinux_inode_setsecurity,
4616 .inode_listsecurity = selinux_inode_listsecurity,
4618 .file_permission = selinux_file_permission,
4619 .file_alloc_security = selinux_file_alloc_security,
4620 .file_free_security = selinux_file_free_security,
4621 .file_ioctl = selinux_file_ioctl,
4622 .file_mmap = selinux_file_mmap,
4623 .file_mprotect = selinux_file_mprotect,
4624 .file_lock = selinux_file_lock,
4625 .file_fcntl = selinux_file_fcntl,
4626 .file_set_fowner = selinux_file_set_fowner,
4627 .file_send_sigiotask = selinux_file_send_sigiotask,
4628 .file_receive = selinux_file_receive,
4630 .task_create = selinux_task_create,
4631 .task_alloc_security = selinux_task_alloc_security,
4632 .task_free_security = selinux_task_free_security,
4633 .task_setuid = selinux_task_setuid,
4634 .task_post_setuid = selinux_task_post_setuid,
4635 .task_setgid = selinux_task_setgid,
4636 .task_setpgid = selinux_task_setpgid,
4637 .task_getpgid = selinux_task_getpgid,
4638 .task_getsid = selinux_task_getsid,
4639 .task_getsecid = selinux_task_getsecid,
4640 .task_setgroups = selinux_task_setgroups,
4641 .task_setnice = selinux_task_setnice,
4642 .task_setioprio = selinux_task_setioprio,
4643 .task_getioprio = selinux_task_getioprio,
4644 .task_setrlimit = selinux_task_setrlimit,
4645 .task_setscheduler = selinux_task_setscheduler,
4646 .task_getscheduler = selinux_task_getscheduler,
4647 .task_movememory = selinux_task_movememory,
4648 .task_kill = selinux_task_kill,
4649 .task_wait = selinux_task_wait,
4650 .task_prctl = selinux_task_prctl,
4651 .task_reparent_to_init = selinux_task_reparent_to_init,
4652 .task_to_inode = selinux_task_to_inode,
4654 .ipc_permission = selinux_ipc_permission,
4656 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
4657 .msg_msg_free_security = selinux_msg_msg_free_security,
4659 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
4660 .msg_queue_free_security = selinux_msg_queue_free_security,
4661 .msg_queue_associate = selinux_msg_queue_associate,
4662 .msg_queue_msgctl = selinux_msg_queue_msgctl,
4663 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
4664 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
4666 .shm_alloc_security = selinux_shm_alloc_security,
4667 .shm_free_security = selinux_shm_free_security,
4668 .shm_associate = selinux_shm_associate,
4669 .shm_shmctl = selinux_shm_shmctl,
4670 .shm_shmat = selinux_shm_shmat,
4672 .sem_alloc_security = selinux_sem_alloc_security,
4673 .sem_free_security = selinux_sem_free_security,
4674 .sem_associate = selinux_sem_associate,
4675 .sem_semctl = selinux_sem_semctl,
4676 .sem_semop = selinux_sem_semop,
4678 .register_security = selinux_register_security,
4679 .unregister_security = selinux_unregister_security,
4681 .d_instantiate = selinux_d_instantiate,
4683 .getprocattr = selinux_getprocattr,
4684 .setprocattr = selinux_setprocattr,
4686 .secid_to_secctx = selinux_secid_to_secctx,
4687 .release_secctx = selinux_release_secctx,
4689 .unix_stream_connect = selinux_socket_unix_stream_connect,
4690 .unix_may_send = selinux_socket_unix_may_send,
4692 .socket_create = selinux_socket_create,
4693 .socket_post_create = selinux_socket_post_create,
4694 .socket_bind = selinux_socket_bind,
4695 .socket_connect = selinux_socket_connect,
4696 .socket_listen = selinux_socket_listen,
4697 .socket_accept = selinux_socket_accept,
4698 .socket_sendmsg = selinux_socket_sendmsg,
4699 .socket_recvmsg = selinux_socket_recvmsg,
4700 .socket_getsockname = selinux_socket_getsockname,
4701 .socket_getpeername = selinux_socket_getpeername,
4702 .socket_getsockopt = selinux_socket_getsockopt,
4703 .socket_setsockopt = selinux_socket_setsockopt,
4704 .socket_shutdown = selinux_socket_shutdown,
4705 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
4706 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
4707 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
4708 .sk_alloc_security = selinux_sk_alloc_security,
4709 .sk_free_security = selinux_sk_free_security,
4710 .sk_clone_security = selinux_sk_clone_security,
4711 .sk_getsecid = selinux_sk_getsecid,
4712 .sock_graft = selinux_sock_graft,
4713 .inet_conn_request = selinux_inet_conn_request,
4714 .inet_csk_clone = selinux_inet_csk_clone,
4715 .req_classify_flow = selinux_req_classify_flow,
4717 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4718 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
4719 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
4720 .xfrm_policy_free_security = selinux_xfrm_policy_free,
4721 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
4722 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
4723 .xfrm_state_free_security = selinux_xfrm_state_free,
4724 .xfrm_state_delete_security = selinux_xfrm_state_delete,
4725 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
4726 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
4727 .xfrm_flow_state_match = selinux_xfrm_flow_state_match,
4728 .xfrm_decode_session = selinux_xfrm_decode_session,
4732 .key_alloc = selinux_key_alloc,
4733 .key_free = selinux_key_free,
4734 .key_permission = selinux_key_permission,
4738 static __init int selinux_init(void)
4740 struct task_security_struct *tsec;
4742 if (!selinux_enabled) {
4743 printk(KERN_INFO "SELinux: Disabled at boot.\n");
4747 printk(KERN_INFO "SELinux: Initializing.\n");
4749 /* Set the security state for the initial task. */
4750 if (task_alloc_security(current))
4751 panic("SELinux: Failed to initialize initial task.\n");
4752 tsec = current->security;
4753 tsec->osid = tsec->sid = SECINITSID_KERNEL;
4755 sel_inode_cache = kmem_cache_create("selinux_inode_security",
4756 sizeof(struct inode_security_struct),
4757 0, SLAB_PANIC, NULL, NULL);
4760 original_ops = secondary_ops = security_ops;
4762 panic ("SELinux: No initial security operations\n");
4763 if (register_security (&selinux_ops))
4764 panic("SELinux: Unable to register with kernel.\n");
4766 if (selinux_enforcing) {
4767 printk(KERN_INFO "SELinux: Starting in enforcing mode\n");
4769 printk(KERN_INFO "SELinux: Starting in permissive mode\n");
4773 /* Add security information to initial keyrings */
4774 selinux_key_alloc(&root_user_keyring, current,
4775 KEY_ALLOC_NOT_IN_QUOTA);
4776 selinux_key_alloc(&root_session_keyring, current,
4777 KEY_ALLOC_NOT_IN_QUOTA);
4783 void selinux_complete_init(void)
4785 printk(KERN_INFO "SELinux: Completing initialization.\n");
4787 /* Set up any superblocks initialized prior to the policy load. */
4788 printk(KERN_INFO "SELinux: Setting up existing superblocks.\n");
4789 spin_lock(&sb_lock);
4790 spin_lock(&sb_security_lock);
4792 if (!list_empty(&superblock_security_head)) {
4793 struct superblock_security_struct *sbsec =
4794 list_entry(superblock_security_head.next,
4795 struct superblock_security_struct,
4797 struct super_block *sb = sbsec->sb;
4799 spin_unlock(&sb_security_lock);
4800 spin_unlock(&sb_lock);
4801 down_read(&sb->s_umount);
4803 superblock_doinit(sb, NULL);
4805 spin_lock(&sb_lock);
4806 spin_lock(&sb_security_lock);
4807 list_del_init(&sbsec->list);
4810 spin_unlock(&sb_security_lock);
4811 spin_unlock(&sb_lock);
4814 /* SELinux requires early initialization in order to label
4815 all processes and objects when they are created. */
4816 security_initcall(selinux_init);
4818 #if defined(CONFIG_NETFILTER)
4820 static struct nf_hook_ops selinux_ipv4_op = {
4821 .hook = selinux_ipv4_postroute_last,
4822 .owner = THIS_MODULE,
4824 .hooknum = NF_IP_POST_ROUTING,
4825 .priority = NF_IP_PRI_SELINUX_LAST,
4828 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4830 static struct nf_hook_ops selinux_ipv6_op = {
4831 .hook = selinux_ipv6_postroute_last,
4832 .owner = THIS_MODULE,
4834 .hooknum = NF_IP6_POST_ROUTING,
4835 .priority = NF_IP6_PRI_SELINUX_LAST,
4840 static int __init selinux_nf_ip_init(void)
4844 if (!selinux_enabled)
4847 printk(KERN_INFO "SELinux: Registering netfilter hooks\n");
4849 err = nf_register_hook(&selinux_ipv4_op);
4851 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4853 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4855 err = nf_register_hook(&selinux_ipv6_op);
4857 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4865 __initcall(selinux_nf_ip_init);
4867 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4868 static void selinux_nf_ip_exit(void)
4870 printk(KERN_INFO "SELinux: Unregistering netfilter hooks\n");
4872 nf_unregister_hook(&selinux_ipv4_op);
4873 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4874 nf_unregister_hook(&selinux_ipv6_op);
4879 #else /* CONFIG_NETFILTER */
4881 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4882 #define selinux_nf_ip_exit()
4885 #endif /* CONFIG_NETFILTER */
4887 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4888 int selinux_disable(void)
4890 extern void exit_sel_fs(void);
4891 static int selinux_disabled = 0;
4893 if (ss_initialized) {
4894 /* Not permitted after initial policy load. */
4898 if (selinux_disabled) {
4899 /* Only do this once. */
4903 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
4905 selinux_disabled = 1;
4906 selinux_enabled = 0;
4908 /* Reset security_ops to the secondary module, dummy or capability. */
4909 security_ops = secondary_ops;
4911 /* Unregister netfilter hooks. */
4912 selinux_nf_ip_exit();
4914 /* Unregister selinuxfs. */