2 * NSA Security-Enhanced Linux (SELinux) security module
4 * This file contains the SELinux hook function implementations.
6 * Authors: Stephen Smalley, <sds@epoch.ncsc.mil>
7 * Chris Vance, <cvance@nai.com>
8 * Wayne Salamon, <wsalamon@nai.com>
9 * James Morris <jmorris@redhat.com>
11 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12 * Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14 * <dgoeddel@trustedcs.com>
15 * Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
16 * Paul Moore <paul.moore@hp.com>
17 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
18 * Yuichi Nakamura <ynakam@hitachisoft.jp>
20 * This program is free software; you can redistribute it and/or modify
21 * it under the terms of the GNU General Public License version 2,
22 * as published by the Free Software Foundation.
25 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/ptrace.h>
28 #include <linux/errno.h>
29 #include <linux/sched.h>
30 #include <linux/security.h>
31 #include <linux/xattr.h>
32 #include <linux/capability.h>
33 #include <linux/unistd.h>
35 #include <linux/mman.h>
36 #include <linux/slab.h>
37 #include <linux/pagemap.h>
38 #include <linux/swap.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
51 #include <net/ip.h> /* for local_port_range[] */
52 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
53 #include <net/net_namespace.h>
54 #include <net/netlabel.h>
55 #include <asm/uaccess.h>
56 #include <asm/ioctls.h>
57 #include <asm/atomic.h>
58 #include <linux/bitops.h>
59 #include <linux/interrupt.h>
60 #include <linux/netdevice.h> /* for network interface checks */
61 #include <linux/netlink.h>
62 #include <linux/tcp.h>
63 #include <linux/udp.h>
64 #include <linux/dccp.h>
65 #include <linux/quota.h>
66 #include <linux/un.h> /* for Unix socket types */
67 #include <net/af_unix.h> /* for Unix socket types */
68 #include <linux/parser.h>
69 #include <linux/nfs_mount.h>
71 #include <linux/hugetlb.h>
72 #include <linux/personality.h>
73 #include <linux/sysctl.h>
74 #include <linux/audit.h>
75 #include <linux/string.h>
76 #include <linux/selinux.h>
77 #include <linux/mutex.h>
86 #define XATTR_SELINUX_SUFFIX "selinux"
87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
89 #define NUM_SEL_MNT_OPTS 4
91 extern unsigned int policydb_loaded_version;
92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
93 extern int selinux_compat_net;
94 extern struct security_operations *security_ops;
96 /* SECMARK reference count */
97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
100 int selinux_enforcing = 0;
102 static int __init enforcing_setup(char *str)
104 selinux_enforcing = simple_strtol(str,NULL,0);
107 __setup("enforcing=", enforcing_setup);
110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
113 static int __init selinux_enabled_setup(char *str)
115 selinux_enabled = simple_strtol(str, NULL, 0);
118 __setup("selinux=", selinux_enabled_setup);
120 int selinux_enabled = 1;
123 /* Original (dummy) security module. */
124 static struct security_operations *original_ops = NULL;
126 /* Minimal support for a secondary security module,
127 just to allow the use of the dummy or capability modules.
128 The owlsm module can alternatively be used as a secondary
129 module as long as CONFIG_OWLSM_FD is not enabled. */
130 static struct security_operations *secondary_ops = NULL;
132 /* Lists of inode and superblock security structures initialized
133 before the policy was loaded. */
134 static LIST_HEAD(superblock_security_head);
135 static DEFINE_SPINLOCK(sb_security_lock);
137 static struct kmem_cache *sel_inode_cache;
140 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
143 * This function checks the SECMARK reference counter to see if any SECMARK
144 * targets are currently configured, if the reference counter is greater than
145 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
146 * enabled, false (0) if SECMARK is disabled.
149 static int selinux_secmark_enabled(void)
151 return (atomic_read(&selinux_secmark_refcount) > 0);
154 /* Allocate and free functions for each kind of security blob. */
156 static int task_alloc_security(struct task_struct *task)
158 struct task_security_struct *tsec;
160 tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
164 tsec->osid = tsec->sid = SECINITSID_UNLABELED;
165 task->security = tsec;
170 static void task_free_security(struct task_struct *task)
172 struct task_security_struct *tsec = task->security;
173 task->security = NULL;
177 static int inode_alloc_security(struct inode *inode)
179 struct task_security_struct *tsec = current->security;
180 struct inode_security_struct *isec;
182 isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
186 mutex_init(&isec->lock);
187 INIT_LIST_HEAD(&isec->list);
189 isec->sid = SECINITSID_UNLABELED;
190 isec->sclass = SECCLASS_FILE;
191 isec->task_sid = tsec->sid;
192 inode->i_security = isec;
197 static void inode_free_security(struct inode *inode)
199 struct inode_security_struct *isec = inode->i_security;
200 struct superblock_security_struct *sbsec = inode->i_sb->s_security;
202 spin_lock(&sbsec->isec_lock);
203 if (!list_empty(&isec->list))
204 list_del_init(&isec->list);
205 spin_unlock(&sbsec->isec_lock);
207 inode->i_security = NULL;
208 kmem_cache_free(sel_inode_cache, isec);
211 static int file_alloc_security(struct file *file)
213 struct task_security_struct *tsec = current->security;
214 struct file_security_struct *fsec;
216 fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
220 fsec->sid = tsec->sid;
221 fsec->fown_sid = tsec->sid;
222 file->f_security = fsec;
227 static void file_free_security(struct file *file)
229 struct file_security_struct *fsec = file->f_security;
230 file->f_security = NULL;
234 static int superblock_alloc_security(struct super_block *sb)
236 struct superblock_security_struct *sbsec;
238 sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242 mutex_init(&sbsec->lock);
243 INIT_LIST_HEAD(&sbsec->list);
244 INIT_LIST_HEAD(&sbsec->isec_head);
245 spin_lock_init(&sbsec->isec_lock);
247 sbsec->sid = SECINITSID_UNLABELED;
248 sbsec->def_sid = SECINITSID_FILE;
249 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
250 sb->s_security = sbsec;
255 static void superblock_free_security(struct super_block *sb)
257 struct superblock_security_struct *sbsec = sb->s_security;
259 spin_lock(&sb_security_lock);
260 if (!list_empty(&sbsec->list))
261 list_del_init(&sbsec->list);
262 spin_unlock(&sb_security_lock);
264 sb->s_security = NULL;
268 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
270 struct sk_security_struct *ssec;
272 ssec = kzalloc(sizeof(*ssec), priority);
276 ssec->peer_sid = SECINITSID_UNLABELED;
277 ssec->sid = SECINITSID_UNLABELED;
278 sk->sk_security = ssec;
280 selinux_netlbl_sk_security_reset(ssec, family);
285 static void sk_free_security(struct sock *sk)
287 struct sk_security_struct *ssec = sk->sk_security;
289 sk->sk_security = NULL;
293 /* The security server must be initialized before
294 any labeling or access decisions can be provided. */
295 extern int ss_initialized;
297 /* The file system's label must be initialized prior to use. */
299 static char *labeling_behaviors[6] = {
301 "uses transition SIDs",
303 "uses genfs_contexts",
304 "not configured for labeling",
305 "uses mountpoint labeling",
308 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
310 static inline int inode_doinit(struct inode *inode)
312 return inode_doinit_with_dentry(inode, NULL);
323 static match_table_t tokens = {
324 {Opt_context, CONTEXT_STR "%s"},
325 {Opt_fscontext, FSCONTEXT_STR "%s"},
326 {Opt_defcontext, DEFCONTEXT_STR "%s"},
327 {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
331 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
333 static int may_context_mount_sb_relabel(u32 sid,
334 struct superblock_security_struct *sbsec,
335 struct task_security_struct *tsec)
339 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
340 FILESYSTEM__RELABELFROM, NULL);
344 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
345 FILESYSTEM__RELABELTO, NULL);
349 static int may_context_mount_inode_relabel(u32 sid,
350 struct superblock_security_struct *sbsec,
351 struct task_security_struct *tsec)
354 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
355 FILESYSTEM__RELABELFROM, NULL);
359 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
360 FILESYSTEM__ASSOCIATE, NULL);
364 static int sb_finish_set_opts(struct super_block *sb)
366 struct superblock_security_struct *sbsec = sb->s_security;
367 struct dentry *root = sb->s_root;
368 struct inode *root_inode = root->d_inode;
371 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
372 /* Make sure that the xattr handler exists and that no
373 error other than -ENODATA is returned by getxattr on
374 the root directory. -ENODATA is ok, as this may be
375 the first boot of the SELinux kernel before we have
376 assigned xattr values to the filesystem. */
377 if (!root_inode->i_op->getxattr) {
378 printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
379 "xattr support\n", sb->s_id, sb->s_type->name);
383 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
384 if (rc < 0 && rc != -ENODATA) {
385 if (rc == -EOPNOTSUPP)
386 printk(KERN_WARNING "SELinux: (dev %s, type "
387 "%s) has no security xattr handler\n",
388 sb->s_id, sb->s_type->name);
390 printk(KERN_WARNING "SELinux: (dev %s, type "
391 "%s) getxattr errno %d\n", sb->s_id,
392 sb->s_type->name, -rc);
397 sbsec->initialized = 1;
399 if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
400 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
401 sb->s_id, sb->s_type->name);
403 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
404 sb->s_id, sb->s_type->name,
405 labeling_behaviors[sbsec->behavior-1]);
407 /* Initialize the root inode. */
408 rc = inode_doinit_with_dentry(root_inode, root);
410 /* Initialize any other inodes associated with the superblock, e.g.
411 inodes created prior to initial policy load or inodes created
412 during get_sb by a pseudo filesystem that directly
414 spin_lock(&sbsec->isec_lock);
416 if (!list_empty(&sbsec->isec_head)) {
417 struct inode_security_struct *isec =
418 list_entry(sbsec->isec_head.next,
419 struct inode_security_struct, list);
420 struct inode *inode = isec->inode;
421 spin_unlock(&sbsec->isec_lock);
422 inode = igrab(inode);
424 if (!IS_PRIVATE(inode))
428 spin_lock(&sbsec->isec_lock);
429 list_del_init(&isec->list);
432 spin_unlock(&sbsec->isec_lock);
438 * This function should allow an FS to ask what it's mount security
439 * options were so it can use those later for submounts, displaying
440 * mount options, or whatever.
442 static int selinux_get_mnt_opts(const struct super_block *sb,
443 struct security_mnt_opts *opts)
446 struct superblock_security_struct *sbsec = sb->s_security;
447 char *context = NULL;
451 security_init_mnt_opts(opts);
453 if (!sbsec->initialized)
460 * if we ever use sbsec flags for anything other than tracking mount
461 * settings this is going to need a mask
464 /* count the number of mount options for this sb */
465 for (i = 0; i < 8; i++) {
467 opts->num_mnt_opts++;
471 opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
472 if (!opts->mnt_opts) {
477 opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
478 if (!opts->mnt_opts_flags) {
484 if (sbsec->flags & FSCONTEXT_MNT) {
485 rc = security_sid_to_context(sbsec->sid, &context, &len);
488 opts->mnt_opts[i] = context;
489 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
491 if (sbsec->flags & CONTEXT_MNT) {
492 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
495 opts->mnt_opts[i] = context;
496 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
498 if (sbsec->flags & DEFCONTEXT_MNT) {
499 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
502 opts->mnt_opts[i] = context;
503 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
505 if (sbsec->flags & ROOTCONTEXT_MNT) {
506 struct inode *root = sbsec->sb->s_root->d_inode;
507 struct inode_security_struct *isec = root->i_security;
509 rc = security_sid_to_context(isec->sid, &context, &len);
512 opts->mnt_opts[i] = context;
513 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
516 BUG_ON(i != opts->num_mnt_opts);
521 security_free_mnt_opts(opts);
525 static int bad_option(struct superblock_security_struct *sbsec, char flag,
526 u32 old_sid, u32 new_sid)
528 /* check if the old mount command had the same options */
529 if (sbsec->initialized)
530 if (!(sbsec->flags & flag) ||
531 (old_sid != new_sid))
534 /* check if we were passed the same options twice,
535 * aka someone passed context=a,context=b
537 if (!sbsec->initialized)
538 if (sbsec->flags & flag)
544 * Allow filesystems with binary mount data to explicitly set mount point
545 * labeling information.
547 static int selinux_set_mnt_opts(struct super_block *sb,
548 struct security_mnt_opts *opts)
551 struct task_security_struct *tsec = current->security;
552 struct superblock_security_struct *sbsec = sb->s_security;
553 const char *name = sb->s_type->name;
554 struct inode *inode = sbsec->sb->s_root->d_inode;
555 struct inode_security_struct *root_isec = inode->i_security;
556 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
557 u32 defcontext_sid = 0;
558 char **mount_options = opts->mnt_opts;
559 int *flags = opts->mnt_opts_flags;
560 int num_opts = opts->num_mnt_opts;
562 mutex_lock(&sbsec->lock);
564 if (!ss_initialized) {
566 /* Defer initialization until selinux_complete_init,
567 after the initial policy is loaded and the security
568 server is ready to handle calls. */
569 spin_lock(&sb_security_lock);
570 if (list_empty(&sbsec->list))
571 list_add(&sbsec->list, &superblock_security_head);
572 spin_unlock(&sb_security_lock);
576 printk(KERN_WARNING "Unable to set superblock options before "
577 "the security server is initialized\n");
582 * Binary mount data FS will come through this function twice. Once
583 * from an explicit call and once from the generic calls from the vfs.
584 * Since the generic VFS calls will not contain any security mount data
585 * we need to skip the double mount verification.
587 * This does open a hole in which we will not notice if the first
588 * mount using this sb set explict options and a second mount using
589 * this sb does not set any security options. (The first options
590 * will be used for both mounts)
592 if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
597 * parse the mount options, check if they are valid sids.
598 * also check if someone is trying to mount the same sb more
599 * than once with different security options.
601 for (i = 0; i < num_opts; i++) {
603 rc = security_context_to_sid(mount_options[i],
604 strlen(mount_options[i]), &sid);
606 printk(KERN_WARNING "SELinux: security_context_to_sid"
607 "(%s) failed for (dev %s, type %s) errno=%d\n",
608 mount_options[i], sb->s_id, name, rc);
615 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
617 goto out_double_mount;
619 sbsec->flags |= FSCONTEXT_MNT;
624 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
626 goto out_double_mount;
628 sbsec->flags |= CONTEXT_MNT;
630 case ROOTCONTEXT_MNT:
631 rootcontext_sid = sid;
633 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
635 goto out_double_mount;
637 sbsec->flags |= ROOTCONTEXT_MNT;
641 defcontext_sid = sid;
643 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
645 goto out_double_mount;
647 sbsec->flags |= DEFCONTEXT_MNT;
656 if (sbsec->initialized) {
657 /* previously mounted with options, but not on this attempt? */
658 if (sbsec->flags && !num_opts)
659 goto out_double_mount;
664 if (strcmp(sb->s_type->name, "proc") == 0)
667 /* Determine the labeling behavior to use for this filesystem type. */
668 rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
670 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
671 __func__, sb->s_type->name, rc);
675 /* sets the context of the superblock for the fs being mounted. */
678 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
682 sbsec->sid = fscontext_sid;
686 * Switch to using mount point labeling behavior.
687 * sets the label used on all file below the mountpoint, and will set
688 * the superblock context if not already set.
691 if (!fscontext_sid) {
692 rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
695 sbsec->sid = context_sid;
697 rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
701 if (!rootcontext_sid)
702 rootcontext_sid = context_sid;
704 sbsec->mntpoint_sid = context_sid;
705 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
708 if (rootcontext_sid) {
709 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
713 root_isec->sid = rootcontext_sid;
714 root_isec->initialized = 1;
717 if (defcontext_sid) {
718 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
720 printk(KERN_WARNING "SELinux: defcontext option is "
721 "invalid for this filesystem type\n");
725 if (defcontext_sid != sbsec->def_sid) {
726 rc = may_context_mount_inode_relabel(defcontext_sid,
732 sbsec->def_sid = defcontext_sid;
735 rc = sb_finish_set_opts(sb);
737 mutex_unlock(&sbsec->lock);
741 printk(KERN_WARNING "SELinux: mount invalid. Same superblock, different "
742 "security settings for (dev %s, type %s)\n", sb->s_id, name);
746 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
747 struct super_block *newsb)
749 const struct superblock_security_struct *oldsbsec = oldsb->s_security;
750 struct superblock_security_struct *newsbsec = newsb->s_security;
752 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
753 int set_context = (oldsbsec->flags & CONTEXT_MNT);
754 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
756 /* we can't error, we can't save the info, this shouldn't get called
757 * this early in the boot process. */
758 BUG_ON(!ss_initialized);
760 /* how can we clone if the old one wasn't set up?? */
761 BUG_ON(!oldsbsec->initialized);
763 /* if fs is reusing a sb, just let its options stand... */
764 if (newsbsec->initialized)
767 mutex_lock(&newsbsec->lock);
769 newsbsec->flags = oldsbsec->flags;
771 newsbsec->sid = oldsbsec->sid;
772 newsbsec->def_sid = oldsbsec->def_sid;
773 newsbsec->behavior = oldsbsec->behavior;
776 u32 sid = oldsbsec->mntpoint_sid;
780 if (!set_rootcontext) {
781 struct inode *newinode = newsb->s_root->d_inode;
782 struct inode_security_struct *newisec = newinode->i_security;
785 newsbsec->mntpoint_sid = sid;
787 if (set_rootcontext) {
788 const struct inode *oldinode = oldsb->s_root->d_inode;
789 const struct inode_security_struct *oldisec = oldinode->i_security;
790 struct inode *newinode = newsb->s_root->d_inode;
791 struct inode_security_struct *newisec = newinode->i_security;
793 newisec->sid = oldisec->sid;
796 sb_finish_set_opts(newsb);
797 mutex_unlock(&newsbsec->lock);
800 static int selinux_parse_opts_str(char *options,
801 struct security_mnt_opts *opts)
804 char *context = NULL, *defcontext = NULL;
805 char *fscontext = NULL, *rootcontext = NULL;
806 int rc, num_mnt_opts = 0;
808 opts->num_mnt_opts = 0;
810 /* Standard string-based options. */
811 while ((p = strsep(&options, "|")) != NULL) {
813 substring_t args[MAX_OPT_ARGS];
818 token = match_token(p, tokens, args);
822 if (context || defcontext) {
824 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
827 context = match_strdup(&args[0]);
837 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
840 fscontext = match_strdup(&args[0]);
847 case Opt_rootcontext:
850 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
853 rootcontext = match_strdup(&args[0]);
861 if (context || defcontext) {
863 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
866 defcontext = match_strdup(&args[0]);
875 printk(KERN_WARNING "SELinux: unknown mount option\n");
882 opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
886 opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
887 if (!opts->mnt_opts_flags) {
888 kfree(opts->mnt_opts);
893 opts->mnt_opts[num_mnt_opts] = fscontext;
894 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
897 opts->mnt_opts[num_mnt_opts] = context;
898 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
901 opts->mnt_opts[num_mnt_opts] = rootcontext;
902 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
905 opts->mnt_opts[num_mnt_opts] = defcontext;
906 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
909 opts->num_mnt_opts = num_mnt_opts;
920 * string mount options parsing and call set the sbsec
922 static int superblock_doinit(struct super_block *sb, void *data)
925 char *options = data;
926 struct security_mnt_opts opts;
928 security_init_mnt_opts(&opts);
933 BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
935 rc = selinux_parse_opts_str(options, &opts);
940 rc = selinux_set_mnt_opts(sb, &opts);
943 security_free_mnt_opts(&opts);
947 static inline u16 inode_mode_to_security_class(umode_t mode)
949 switch (mode & S_IFMT) {
951 return SECCLASS_SOCK_FILE;
953 return SECCLASS_LNK_FILE;
955 return SECCLASS_FILE;
957 return SECCLASS_BLK_FILE;
961 return SECCLASS_CHR_FILE;
963 return SECCLASS_FIFO_FILE;
967 return SECCLASS_FILE;
970 static inline int default_protocol_stream(int protocol)
972 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
975 static inline int default_protocol_dgram(int protocol)
977 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
980 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
987 return SECCLASS_UNIX_STREAM_SOCKET;
989 return SECCLASS_UNIX_DGRAM_SOCKET;
996 if (default_protocol_stream(protocol))
997 return SECCLASS_TCP_SOCKET;
999 return SECCLASS_RAWIP_SOCKET;
1001 if (default_protocol_dgram(protocol))
1002 return SECCLASS_UDP_SOCKET;
1004 return SECCLASS_RAWIP_SOCKET;
1006 return SECCLASS_DCCP_SOCKET;
1008 return SECCLASS_RAWIP_SOCKET;
1014 return SECCLASS_NETLINK_ROUTE_SOCKET;
1015 case NETLINK_FIREWALL:
1016 return SECCLASS_NETLINK_FIREWALL_SOCKET;
1017 case NETLINK_INET_DIAG:
1018 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1020 return SECCLASS_NETLINK_NFLOG_SOCKET;
1022 return SECCLASS_NETLINK_XFRM_SOCKET;
1023 case NETLINK_SELINUX:
1024 return SECCLASS_NETLINK_SELINUX_SOCKET;
1026 return SECCLASS_NETLINK_AUDIT_SOCKET;
1027 case NETLINK_IP6_FW:
1028 return SECCLASS_NETLINK_IP6FW_SOCKET;
1029 case NETLINK_DNRTMSG:
1030 return SECCLASS_NETLINK_DNRT_SOCKET;
1031 case NETLINK_KOBJECT_UEVENT:
1032 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1034 return SECCLASS_NETLINK_SOCKET;
1037 return SECCLASS_PACKET_SOCKET;
1039 return SECCLASS_KEY_SOCKET;
1041 return SECCLASS_APPLETALK_SOCKET;
1044 return SECCLASS_SOCKET;
1047 #ifdef CONFIG_PROC_FS
1048 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1053 char *buffer, *path, *end;
1055 buffer = (char*)__get_free_page(GFP_KERNEL);
1060 end = buffer+buflen;
1065 while (de && de != de->parent) {
1066 buflen -= de->namelen + 1;
1070 memcpy(end, de->name, de->namelen);
1075 rc = security_genfs_sid("proc", path, tclass, sid);
1076 free_page((unsigned long)buffer);
1080 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1088 /* The inode's security attributes must be initialized before first use. */
1089 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1091 struct superblock_security_struct *sbsec = NULL;
1092 struct inode_security_struct *isec = inode->i_security;
1094 struct dentry *dentry;
1095 #define INITCONTEXTLEN 255
1096 char *context = NULL;
1100 if (isec->initialized)
1103 mutex_lock(&isec->lock);
1104 if (isec->initialized)
1107 sbsec = inode->i_sb->s_security;
1108 if (!sbsec->initialized) {
1109 /* Defer initialization until selinux_complete_init,
1110 after the initial policy is loaded and the security
1111 server is ready to handle calls. */
1112 spin_lock(&sbsec->isec_lock);
1113 if (list_empty(&isec->list))
1114 list_add(&isec->list, &sbsec->isec_head);
1115 spin_unlock(&sbsec->isec_lock);
1119 switch (sbsec->behavior) {
1120 case SECURITY_FS_USE_XATTR:
1121 if (!inode->i_op->getxattr) {
1122 isec->sid = sbsec->def_sid;
1126 /* Need a dentry, since the xattr API requires one.
1127 Life would be simpler if we could just pass the inode. */
1129 /* Called from d_instantiate or d_splice_alias. */
1130 dentry = dget(opt_dentry);
1132 /* Called from selinux_complete_init, try to find a dentry. */
1133 dentry = d_find_alias(inode);
1136 printk(KERN_WARNING "%s: no dentry for dev=%s "
1137 "ino=%ld\n", __func__, inode->i_sb->s_id,
1142 len = INITCONTEXTLEN;
1143 context = kmalloc(len, GFP_NOFS);
1149 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1151 if (rc == -ERANGE) {
1152 /* Need a larger buffer. Query for the right size. */
1153 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1161 context = kmalloc(len, GFP_NOFS);
1167 rc = inode->i_op->getxattr(dentry,
1173 if (rc != -ENODATA) {
1174 printk(KERN_WARNING "%s: getxattr returned "
1175 "%d for dev=%s ino=%ld\n", __func__,
1176 -rc, inode->i_sb->s_id, inode->i_ino);
1180 /* Map ENODATA to the default file SID */
1181 sid = sbsec->def_sid;
1184 rc = security_context_to_sid_default(context, rc, &sid,
1188 printk(KERN_WARNING "%s: context_to_sid(%s) "
1189 "returned %d for dev=%s ino=%ld\n",
1190 __func__, context, -rc,
1191 inode->i_sb->s_id, inode->i_ino);
1193 /* Leave with the unlabeled SID */
1201 case SECURITY_FS_USE_TASK:
1202 isec->sid = isec->task_sid;
1204 case SECURITY_FS_USE_TRANS:
1205 /* Default to the fs SID. */
1206 isec->sid = sbsec->sid;
1208 /* Try to obtain a transition SID. */
1209 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1210 rc = security_transition_sid(isec->task_sid,
1218 case SECURITY_FS_USE_MNTPOINT:
1219 isec->sid = sbsec->mntpoint_sid;
1222 /* Default to the fs superblock SID. */
1223 isec->sid = sbsec->sid;
1226 struct proc_inode *proci = PROC_I(inode);
1228 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1229 rc = selinux_proc_get_sid(proci->pde,
1240 isec->initialized = 1;
1243 mutex_unlock(&isec->lock);
1245 if (isec->sclass == SECCLASS_FILE)
1246 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1250 /* Convert a Linux signal to an access vector. */
1251 static inline u32 signal_to_av(int sig)
1257 /* Commonly granted from child to parent. */
1258 perm = PROCESS__SIGCHLD;
1261 /* Cannot be caught or ignored */
1262 perm = PROCESS__SIGKILL;
1265 /* Cannot be caught or ignored */
1266 perm = PROCESS__SIGSTOP;
1269 /* All other signals. */
1270 perm = PROCESS__SIGNAL;
1277 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1278 fork check, ptrace check, etc. */
1279 static int task_has_perm(struct task_struct *tsk1,
1280 struct task_struct *tsk2,
1283 struct task_security_struct *tsec1, *tsec2;
1285 tsec1 = tsk1->security;
1286 tsec2 = tsk2->security;
1287 return avc_has_perm(tsec1->sid, tsec2->sid,
1288 SECCLASS_PROCESS, perms, NULL);
1291 #if CAP_LAST_CAP > 63
1292 #error Fix SELinux to handle capabilities > 63.
1295 /* Check whether a task is allowed to use a capability. */
1296 static int task_has_capability(struct task_struct *tsk,
1299 struct task_security_struct *tsec;
1300 struct avc_audit_data ad;
1302 u32 av = CAP_TO_MASK(cap);
1304 tsec = tsk->security;
1306 AVC_AUDIT_DATA_INIT(&ad,CAP);
1310 switch (CAP_TO_INDEX(cap)) {
1312 sclass = SECCLASS_CAPABILITY;
1315 sclass = SECCLASS_CAPABILITY2;
1319 "SELinux: out of range capability %d\n", cap);
1322 return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1325 /* Check whether a task is allowed to use a system operation. */
1326 static int task_has_system(struct task_struct *tsk,
1329 struct task_security_struct *tsec;
1331 tsec = tsk->security;
1333 return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1334 SECCLASS_SYSTEM, perms, NULL);
1337 /* Check whether a task has a particular permission to an inode.
1338 The 'adp' parameter is optional and allows other audit
1339 data to be passed (e.g. the dentry). */
1340 static int inode_has_perm(struct task_struct *tsk,
1341 struct inode *inode,
1343 struct avc_audit_data *adp)
1345 struct task_security_struct *tsec;
1346 struct inode_security_struct *isec;
1347 struct avc_audit_data ad;
1349 if (unlikely (IS_PRIVATE (inode)))
1352 tsec = tsk->security;
1353 isec = inode->i_security;
1357 AVC_AUDIT_DATA_INIT(&ad, FS);
1358 ad.u.fs.inode = inode;
1361 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1364 /* Same as inode_has_perm, but pass explicit audit data containing
1365 the dentry to help the auditing code to more easily generate the
1366 pathname if needed. */
1367 static inline int dentry_has_perm(struct task_struct *tsk,
1368 struct vfsmount *mnt,
1369 struct dentry *dentry,
1372 struct inode *inode = dentry->d_inode;
1373 struct avc_audit_data ad;
1374 AVC_AUDIT_DATA_INIT(&ad,FS);
1375 ad.u.fs.path.mnt = mnt;
1376 ad.u.fs.path.dentry = dentry;
1377 return inode_has_perm(tsk, inode, av, &ad);
1380 /* Check whether a task can use an open file descriptor to
1381 access an inode in a given way. Check access to the
1382 descriptor itself, and then use dentry_has_perm to
1383 check a particular permission to the file.
1384 Access to the descriptor is implicitly granted if it
1385 has the same SID as the process. If av is zero, then
1386 access to the file is not checked, e.g. for cases
1387 where only the descriptor is affected like seek. */
1388 static int file_has_perm(struct task_struct *tsk,
1392 struct task_security_struct *tsec = tsk->security;
1393 struct file_security_struct *fsec = file->f_security;
1394 struct inode *inode = file->f_path.dentry->d_inode;
1395 struct avc_audit_data ad;
1398 AVC_AUDIT_DATA_INIT(&ad, FS);
1399 ad.u.fs.path = file->f_path;
1401 if (tsec->sid != fsec->sid) {
1402 rc = avc_has_perm(tsec->sid, fsec->sid,
1410 /* av is zero if only checking access to the descriptor. */
1412 return inode_has_perm(tsk, inode, av, &ad);
1417 /* Check whether a task can create a file. */
1418 static int may_create(struct inode *dir,
1419 struct dentry *dentry,
1422 struct task_security_struct *tsec;
1423 struct inode_security_struct *dsec;
1424 struct superblock_security_struct *sbsec;
1426 struct avc_audit_data ad;
1429 tsec = current->security;
1430 dsec = dir->i_security;
1431 sbsec = dir->i_sb->s_security;
1433 AVC_AUDIT_DATA_INIT(&ad, FS);
1434 ad.u.fs.path.dentry = dentry;
1436 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1437 DIR__ADD_NAME | DIR__SEARCH,
1442 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1443 newsid = tsec->create_sid;
1445 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1451 rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1455 return avc_has_perm(newsid, sbsec->sid,
1456 SECCLASS_FILESYSTEM,
1457 FILESYSTEM__ASSOCIATE, &ad);
1460 /* Check whether a task can create a key. */
1461 static int may_create_key(u32 ksid,
1462 struct task_struct *ctx)
1464 struct task_security_struct *tsec;
1466 tsec = ctx->security;
1468 return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1472 #define MAY_UNLINK 1
1475 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1476 static int may_link(struct inode *dir,
1477 struct dentry *dentry,
1481 struct task_security_struct *tsec;
1482 struct inode_security_struct *dsec, *isec;
1483 struct avc_audit_data ad;
1487 tsec = current->security;
1488 dsec = dir->i_security;
1489 isec = dentry->d_inode->i_security;
1491 AVC_AUDIT_DATA_INIT(&ad, FS);
1492 ad.u.fs.path.dentry = dentry;
1495 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1496 rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1511 printk(KERN_WARNING "may_link: unrecognized kind %d\n", kind);
1515 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1519 static inline int may_rename(struct inode *old_dir,
1520 struct dentry *old_dentry,
1521 struct inode *new_dir,
1522 struct dentry *new_dentry)
1524 struct task_security_struct *tsec;
1525 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1526 struct avc_audit_data ad;
1528 int old_is_dir, new_is_dir;
1531 tsec = current->security;
1532 old_dsec = old_dir->i_security;
1533 old_isec = old_dentry->d_inode->i_security;
1534 old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1535 new_dsec = new_dir->i_security;
1537 AVC_AUDIT_DATA_INIT(&ad, FS);
1539 ad.u.fs.path.dentry = old_dentry;
1540 rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1541 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1544 rc = avc_has_perm(tsec->sid, old_isec->sid,
1545 old_isec->sclass, FILE__RENAME, &ad);
1548 if (old_is_dir && new_dir != old_dir) {
1549 rc = avc_has_perm(tsec->sid, old_isec->sid,
1550 old_isec->sclass, DIR__REPARENT, &ad);
1555 ad.u.fs.path.dentry = new_dentry;
1556 av = DIR__ADD_NAME | DIR__SEARCH;
1557 if (new_dentry->d_inode)
1558 av |= DIR__REMOVE_NAME;
1559 rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1562 if (new_dentry->d_inode) {
1563 new_isec = new_dentry->d_inode->i_security;
1564 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1565 rc = avc_has_perm(tsec->sid, new_isec->sid,
1567 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1575 /* Check whether a task can perform a filesystem operation. */
1576 static int superblock_has_perm(struct task_struct *tsk,
1577 struct super_block *sb,
1579 struct avc_audit_data *ad)
1581 struct task_security_struct *tsec;
1582 struct superblock_security_struct *sbsec;
1584 tsec = tsk->security;
1585 sbsec = sb->s_security;
1586 return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1590 /* Convert a Linux mode and permission mask to an access vector. */
1591 static inline u32 file_mask_to_av(int mode, int mask)
1595 if ((mode & S_IFMT) != S_IFDIR) {
1596 if (mask & MAY_EXEC)
1597 av |= FILE__EXECUTE;
1598 if (mask & MAY_READ)
1601 if (mask & MAY_APPEND)
1603 else if (mask & MAY_WRITE)
1607 if (mask & MAY_EXEC)
1609 if (mask & MAY_WRITE)
1611 if (mask & MAY_READ)
1619 * Convert a file mask to an access vector and include the correct open
1622 static inline u32 open_file_mask_to_av(int mode, int mask)
1624 u32 av = file_mask_to_av(mode, mask);
1626 if (selinux_policycap_openperm) {
1628 * lnk files and socks do not really have an 'open'
1632 else if (S_ISCHR(mode))
1633 av |= CHR_FILE__OPEN;
1634 else if (S_ISBLK(mode))
1635 av |= BLK_FILE__OPEN;
1636 else if (S_ISFIFO(mode))
1637 av |= FIFO_FILE__OPEN;
1638 else if (S_ISDIR(mode))
1641 printk(KERN_ERR "SELinux: WARNING: inside open_file_to_av "
1642 "with unknown mode:%x\n", mode);
1647 /* Convert a Linux file to an access vector. */
1648 static inline u32 file_to_av(struct file *file)
1652 if (file->f_mode & FMODE_READ)
1654 if (file->f_mode & FMODE_WRITE) {
1655 if (file->f_flags & O_APPEND)
1662 * Special file opened with flags 3 for ioctl-only use.
1670 /* Hook functions begin here. */
1672 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1676 rc = secondary_ops->ptrace(parent,child);
1680 return task_has_perm(parent, child, PROCESS__PTRACE);
1683 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1684 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1688 error = task_has_perm(current, target, PROCESS__GETCAP);
1692 return secondary_ops->capget(target, effective, inheritable, permitted);
1695 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1696 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1700 error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1704 return task_has_perm(current, target, PROCESS__SETCAP);
1707 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1708 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1710 secondary_ops->capset_set(target, effective, inheritable, permitted);
1713 static int selinux_capable(struct task_struct *tsk, int cap)
1717 rc = secondary_ops->capable(tsk, cap);
1721 return task_has_capability(tsk,cap);
1724 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1727 char *buffer, *path, *end;
1730 buffer = (char*)__get_free_page(GFP_KERNEL);
1735 end = buffer+buflen;
1741 const char *name = table->procname;
1742 size_t namelen = strlen(name);
1743 buflen -= namelen + 1;
1747 memcpy(end, name, namelen);
1750 table = table->parent;
1756 memcpy(end, "/sys", 4);
1758 rc = security_genfs_sid("proc", path, tclass, sid);
1760 free_page((unsigned long)buffer);
1765 static int selinux_sysctl(ctl_table *table, int op)
1769 struct task_security_struct *tsec;
1773 rc = secondary_ops->sysctl(table, op);
1777 tsec = current->security;
1779 rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1780 SECCLASS_DIR : SECCLASS_FILE, &tsid);
1782 /* Default to the well-defined sysctl SID. */
1783 tsid = SECINITSID_SYSCTL;
1786 /* The op values are "defined" in sysctl.c, thereby creating
1787 * a bad coupling between this module and sysctl.c */
1789 error = avc_has_perm(tsec->sid, tsid,
1790 SECCLASS_DIR, DIR__SEARCH, NULL);
1798 error = avc_has_perm(tsec->sid, tsid,
1799 SECCLASS_FILE, av, NULL);
1805 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1818 rc = superblock_has_perm(current,
1820 FILESYSTEM__QUOTAMOD, NULL);
1825 rc = superblock_has_perm(current,
1827 FILESYSTEM__QUOTAGET, NULL);
1830 rc = 0; /* let the kernel handle invalid cmds */
1836 static int selinux_quota_on(struct dentry *dentry)
1838 return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1841 static int selinux_syslog(int type)
1845 rc = secondary_ops->syslog(type);
1850 case 3: /* Read last kernel messages */
1851 case 10: /* Return size of the log buffer */
1852 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1854 case 6: /* Disable logging to console */
1855 case 7: /* Enable logging to console */
1856 case 8: /* Set level of messages printed to console */
1857 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1859 case 0: /* Close log */
1860 case 1: /* Open log */
1861 case 2: /* Read from log */
1862 case 4: /* Read/clear last kernel messages */
1863 case 5: /* Clear ring buffer */
1865 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1872 * Check that a process has enough memory to allocate a new virtual
1873 * mapping. 0 means there is enough memory for the allocation to
1874 * succeed and -ENOMEM implies there is not.
1876 * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1877 * if the capability is granted, but __vm_enough_memory requires 1 if
1878 * the capability is granted.
1880 * Do not audit the selinux permission check, as this is applied to all
1881 * processes that allocate mappings.
1883 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1885 int rc, cap_sys_admin = 0;
1886 struct task_security_struct *tsec = current->security;
1888 rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1890 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1891 SECCLASS_CAPABILITY,
1892 CAP_TO_MASK(CAP_SYS_ADMIN),
1899 return __vm_enough_memory(mm, pages, cap_sys_admin);
1903 * task_tracer_task - return the task that is tracing the given task
1904 * @task: task to consider
1906 * Returns NULL if noone is tracing @task, or the &struct task_struct
1907 * pointer to its tracer.
1909 * Must be called under rcu_read_lock().
1911 static struct task_struct *task_tracer_task(struct task_struct *task)
1913 if (task->ptrace & PT_PTRACED)
1914 return rcu_dereference(task->parent);
1918 /* binprm security operations */
1920 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1922 struct bprm_security_struct *bsec;
1924 bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1928 bsec->sid = SECINITSID_UNLABELED;
1931 bprm->security = bsec;
1935 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1937 struct task_security_struct *tsec;
1938 struct inode *inode = bprm->file->f_path.dentry->d_inode;
1939 struct inode_security_struct *isec;
1940 struct bprm_security_struct *bsec;
1942 struct avc_audit_data ad;
1945 rc = secondary_ops->bprm_set_security(bprm);
1949 bsec = bprm->security;
1954 tsec = current->security;
1955 isec = inode->i_security;
1957 /* Default to the current task SID. */
1958 bsec->sid = tsec->sid;
1960 /* Reset fs, key, and sock SIDs on execve. */
1961 tsec->create_sid = 0;
1962 tsec->keycreate_sid = 0;
1963 tsec->sockcreate_sid = 0;
1965 if (tsec->exec_sid) {
1966 newsid = tsec->exec_sid;
1967 /* Reset exec SID on execve. */
1970 /* Check for a default transition on this program. */
1971 rc = security_transition_sid(tsec->sid, isec->sid,
1972 SECCLASS_PROCESS, &newsid);
1977 AVC_AUDIT_DATA_INIT(&ad, FS);
1978 ad.u.fs.path = bprm->file->f_path;
1980 if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1983 if (tsec->sid == newsid) {
1984 rc = avc_has_perm(tsec->sid, isec->sid,
1985 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1989 /* Check permissions for the transition. */
1990 rc = avc_has_perm(tsec->sid, newsid,
1991 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1995 rc = avc_has_perm(newsid, isec->sid,
1996 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2000 /* Clear any possibly unsafe personality bits on exec: */
2001 current->personality &= ~PER_CLEAR_ON_SETID;
2003 /* Set the security field to the new SID. */
2011 static int selinux_bprm_check_security (struct linux_binprm *bprm)
2013 return secondary_ops->bprm_check_security(bprm);
2017 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
2019 struct task_security_struct *tsec = current->security;
2022 if (tsec->osid != tsec->sid) {
2023 /* Enable secure mode for SIDs transitions unless
2024 the noatsecure permission is granted between
2025 the two SIDs, i.e. ahp returns 0. */
2026 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2028 PROCESS__NOATSECURE, NULL);
2031 return (atsecure || secondary_ops->bprm_secureexec(bprm));
2034 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2036 kfree(bprm->security);
2037 bprm->security = NULL;
2040 extern struct vfsmount *selinuxfs_mount;
2041 extern struct dentry *selinux_null;
2043 /* Derived from fs/exec.c:flush_old_files. */
2044 static inline void flush_unauthorized_files(struct files_struct * files)
2046 struct avc_audit_data ad;
2047 struct file *file, *devnull = NULL;
2048 struct tty_struct *tty;
2049 struct fdtable *fdt;
2053 mutex_lock(&tty_mutex);
2054 tty = get_current_tty();
2057 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2059 /* Revalidate access to controlling tty.
2060 Use inode_has_perm on the tty inode directly rather
2061 than using file_has_perm, as this particular open
2062 file may belong to another process and we are only
2063 interested in the inode-based check here. */
2064 struct inode *inode = file->f_path.dentry->d_inode;
2065 if (inode_has_perm(current, inode,
2066 FILE__READ | FILE__WRITE, NULL)) {
2072 mutex_unlock(&tty_mutex);
2073 /* Reset controlling tty. */
2077 /* Revalidate access to inherited open files. */
2079 AVC_AUDIT_DATA_INIT(&ad,FS);
2081 spin_lock(&files->file_lock);
2083 unsigned long set, i;
2088 fdt = files_fdtable(files);
2089 if (i >= fdt->max_fds)
2091 set = fdt->open_fds->fds_bits[j];
2094 spin_unlock(&files->file_lock);
2095 for ( ; set ; i++,set >>= 1) {
2100 if (file_has_perm(current,
2102 file_to_av(file))) {
2104 fd = get_unused_fd();
2114 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2115 if (IS_ERR(devnull)) {
2122 fd_install(fd, devnull);
2127 spin_lock(&files->file_lock);
2130 spin_unlock(&files->file_lock);
2133 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2135 struct task_security_struct *tsec;
2136 struct bprm_security_struct *bsec;
2140 secondary_ops->bprm_apply_creds(bprm, unsafe);
2142 tsec = current->security;
2144 bsec = bprm->security;
2147 tsec->osid = tsec->sid;
2149 if (tsec->sid != sid) {
2150 /* Check for shared state. If not ok, leave SID
2151 unchanged and kill. */
2152 if (unsafe & LSM_UNSAFE_SHARE) {
2153 rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2154 PROCESS__SHARE, NULL);
2161 /* Check for ptracing, and update the task SID if ok.
2162 Otherwise, leave SID unchanged and kill. */
2163 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2164 struct task_struct *tracer;
2165 struct task_security_struct *sec;
2169 tracer = task_tracer_task(current);
2170 if (likely(tracer != NULL)) {
2171 sec = tracer->security;
2177 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2178 PROCESS__PTRACE, NULL);
2190 * called after apply_creds without the task lock held
2192 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2194 struct task_security_struct *tsec;
2195 struct rlimit *rlim, *initrlim;
2196 struct itimerval itimer;
2197 struct bprm_security_struct *bsec;
2200 tsec = current->security;
2201 bsec = bprm->security;
2204 force_sig_specific(SIGKILL, current);
2207 if (tsec->osid == tsec->sid)
2210 /* Close files for which the new task SID is not authorized. */
2211 flush_unauthorized_files(current->files);
2213 /* Check whether the new SID can inherit signal state
2214 from the old SID. If not, clear itimers to avoid
2215 subsequent signal generation and flush and unblock
2216 signals. This must occur _after_ the task SID has
2217 been updated so that any kill done after the flush
2218 will be checked against the new SID. */
2219 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2220 PROCESS__SIGINH, NULL);
2222 memset(&itimer, 0, sizeof itimer);
2223 for (i = 0; i < 3; i++)
2224 do_setitimer(i, &itimer, NULL);
2225 flush_signals(current);
2226 spin_lock_irq(¤t->sighand->siglock);
2227 flush_signal_handlers(current, 1);
2228 sigemptyset(¤t->blocked);
2229 recalc_sigpending();
2230 spin_unlock_irq(¤t->sighand->siglock);
2233 /* Always clear parent death signal on SID transitions. */
2234 current->pdeath_signal = 0;
2236 /* Check whether the new SID can inherit resource limits
2237 from the old SID. If not, reset all soft limits to
2238 the lower of the current task's hard limit and the init
2239 task's soft limit. Note that the setting of hard limits
2240 (even to lower them) can be controlled by the setrlimit
2241 check. The inclusion of the init task's soft limit into
2242 the computation is to avoid resetting soft limits higher
2243 than the default soft limit for cases where the default
2244 is lower than the hard limit, e.g. RLIMIT_CORE or
2246 rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2247 PROCESS__RLIMITINH, NULL);
2249 for (i = 0; i < RLIM_NLIMITS; i++) {
2250 rlim = current->signal->rlim + i;
2251 initrlim = init_task.signal->rlim+i;
2252 rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2254 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2256 * This will cause RLIMIT_CPU calculations
2259 current->it_prof_expires = jiffies_to_cputime(1);
2263 /* Wake up the parent if it is waiting so that it can
2264 recheck wait permission to the new task SID. */
2265 wake_up_interruptible(¤t->parent->signal->wait_chldexit);
2268 /* superblock security operations */
2270 static int selinux_sb_alloc_security(struct super_block *sb)
2272 return superblock_alloc_security(sb);
2275 static void selinux_sb_free_security(struct super_block *sb)
2277 superblock_free_security(sb);
2280 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2285 return !memcmp(prefix, option, plen);
2288 static inline int selinux_option(char *option, int len)
2290 return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2291 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2292 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2293 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2296 static inline void take_option(char **to, char *from, int *first, int len)
2303 memcpy(*to, from, len);
2307 static inline void take_selinux_option(char **to, char *from, int *first,
2310 int current_size = 0;
2319 while (current_size < len) {
2329 static int selinux_sb_copy_data(char *orig, char *copy)
2331 int fnosec, fsec, rc = 0;
2332 char *in_save, *in_curr, *in_end;
2333 char *sec_curr, *nosec_save, *nosec;
2339 nosec = (char *)get_zeroed_page(GFP_KERNEL);
2347 in_save = in_end = orig;
2351 open_quote = !open_quote;
2352 if ((*in_end == ',' && open_quote == 0) ||
2354 int len = in_end - in_curr;
2356 if (selinux_option(in_curr, len))
2357 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2359 take_option(&nosec, in_curr, &fnosec, len);
2361 in_curr = in_end + 1;
2363 } while (*in_end++);
2365 strcpy(in_save, nosec_save);
2366 free_page((unsigned long)nosec_save);
2371 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2373 struct avc_audit_data ad;
2376 rc = superblock_doinit(sb, data);
2380 AVC_AUDIT_DATA_INIT(&ad,FS);
2381 ad.u.fs.path.dentry = sb->s_root;
2382 return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2385 static int selinux_sb_statfs(struct dentry *dentry)
2387 struct avc_audit_data ad;
2389 AVC_AUDIT_DATA_INIT(&ad,FS);
2390 ad.u.fs.path.dentry = dentry->d_sb->s_root;
2391 return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2394 static int selinux_mount(char * dev_name,
2395 struct nameidata *nd,
2397 unsigned long flags,
2402 rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2406 if (flags & MS_REMOUNT)
2407 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2408 FILESYSTEM__REMOUNT, NULL);
2410 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2414 static int selinux_umount(struct vfsmount *mnt, int flags)
2418 rc = secondary_ops->sb_umount(mnt, flags);
2422 return superblock_has_perm(current,mnt->mnt_sb,
2423 FILESYSTEM__UNMOUNT,NULL);
2426 /* inode security operations */
2428 static int selinux_inode_alloc_security(struct inode *inode)
2430 return inode_alloc_security(inode);
2433 static void selinux_inode_free_security(struct inode *inode)
2435 inode_free_security(inode);
2438 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2439 char **name, void **value,
2442 struct task_security_struct *tsec;
2443 struct inode_security_struct *dsec;
2444 struct superblock_security_struct *sbsec;
2447 char *namep = NULL, *context;
2449 tsec = current->security;
2450 dsec = dir->i_security;
2451 sbsec = dir->i_sb->s_security;
2453 if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2454 newsid = tsec->create_sid;
2456 rc = security_transition_sid(tsec->sid, dsec->sid,
2457 inode_mode_to_security_class(inode->i_mode),
2460 printk(KERN_WARNING "%s: "
2461 "security_transition_sid failed, rc=%d (dev=%s "
2464 -rc, inode->i_sb->s_id, inode->i_ino);
2469 /* Possibly defer initialization to selinux_complete_init. */
2470 if (sbsec->initialized) {
2471 struct inode_security_struct *isec = inode->i_security;
2472 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2474 isec->initialized = 1;
2477 if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2481 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2488 rc = security_sid_to_context(newsid, &context, &clen);
2500 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2502 return may_create(dir, dentry, SECCLASS_FILE);
2505 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2509 rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2512 return may_link(dir, old_dentry, MAY_LINK);
2515 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2519 rc = secondary_ops->inode_unlink(dir, dentry);
2522 return may_link(dir, dentry, MAY_UNLINK);
2525 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2527 return may_create(dir, dentry, SECCLASS_LNK_FILE);
2530 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2532 return may_create(dir, dentry, SECCLASS_DIR);
2535 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2537 return may_link(dir, dentry, MAY_RMDIR);
2540 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2544 rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2548 return may_create(dir, dentry, inode_mode_to_security_class(mode));
2551 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2552 struct inode *new_inode, struct dentry *new_dentry)
2554 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2557 static int selinux_inode_readlink(struct dentry *dentry)
2559 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2562 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2566 rc = secondary_ops->inode_follow_link(dentry,nameidata);
2569 return dentry_has_perm(current, NULL, dentry, FILE__READ);
2572 static int selinux_inode_permission(struct inode *inode, int mask,
2573 struct nameidata *nd)
2577 rc = secondary_ops->inode_permission(inode, mask, nd);
2582 /* No permission to check. Existence test. */
2586 return inode_has_perm(current, inode,
2587 open_file_mask_to_av(inode->i_mode, mask), NULL);
2590 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2594 rc = secondary_ops->inode_setattr(dentry, iattr);
2598 if (iattr->ia_valid & ATTR_FORCE)
2601 if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2602 ATTR_ATIME_SET | ATTR_MTIME_SET))
2603 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2605 return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2608 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2610 return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2613 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2615 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2616 sizeof XATTR_SECURITY_PREFIX - 1)) {
2617 if (!strcmp(name, XATTR_NAME_CAPS)) {
2618 if (!capable(CAP_SETFCAP))
2620 } else if (!capable(CAP_SYS_ADMIN)) {
2621 /* A different attribute in the security namespace.
2622 Restrict to administrator. */
2627 /* Not an attribute we recognize, so just check the
2628 ordinary setattr permission. */
2629 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2632 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2634 struct task_security_struct *tsec = current->security;
2635 struct inode *inode = dentry->d_inode;
2636 struct inode_security_struct *isec = inode->i_security;
2637 struct superblock_security_struct *sbsec;
2638 struct avc_audit_data ad;
2642 if (strcmp(name, XATTR_NAME_SELINUX))
2643 return selinux_inode_setotherxattr(dentry, name);
2645 sbsec = inode->i_sb->s_security;
2646 if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2649 if (!is_owner_or_cap(inode))
2652 AVC_AUDIT_DATA_INIT(&ad,FS);
2653 ad.u.fs.path.dentry = dentry;
2655 rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2656 FILE__RELABELFROM, &ad);
2660 rc = security_context_to_sid(value, size, &newsid);
2664 rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2665 FILE__RELABELTO, &ad);
2669 rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2674 return avc_has_perm(newsid,
2676 SECCLASS_FILESYSTEM,
2677 FILESYSTEM__ASSOCIATE,
2681 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2682 void *value, size_t size, int flags)
2684 struct inode *inode = dentry->d_inode;
2685 struct inode_security_struct *isec = inode->i_security;
2689 if (strcmp(name, XATTR_NAME_SELINUX)) {
2690 /* Not an attribute we recognize, so nothing to do. */
2694 rc = security_context_to_sid(value, size, &newsid);
2696 printk(KERN_WARNING "%s: unable to obtain SID for context "
2697 "%s, rc=%d\n", __func__, (char *)value, -rc);
2705 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2707 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2710 static int selinux_inode_listxattr (struct dentry *dentry)
2712 return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2715 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2717 if (strcmp(name, XATTR_NAME_SELINUX))
2718 return selinux_inode_setotherxattr(dentry, name);
2720 /* No one is allowed to remove a SELinux security label.
2721 You can change the label, but all data must be labeled. */
2726 * Copy the in-core inode security context value to the user. If the
2727 * getxattr() prior to this succeeded, check to see if we need to
2728 * canonicalize the value to be finally returned to the user.
2730 * Permission check is handled by selinux_inode_getxattr hook.
2732 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2736 char *context = NULL;
2737 struct inode_security_struct *isec = inode->i_security;
2739 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2742 error = security_sid_to_context(isec->sid, &context, &size);
2755 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2756 const void *value, size_t size, int flags)
2758 struct inode_security_struct *isec = inode->i_security;
2762 if (strcmp(name, XATTR_SELINUX_SUFFIX))
2765 if (!value || !size)
2768 rc = security_context_to_sid((void*)value, size, &newsid);
2776 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2778 const int len = sizeof(XATTR_NAME_SELINUX);
2779 if (buffer && len <= buffer_size)
2780 memcpy(buffer, XATTR_NAME_SELINUX, len);
2784 static int selinux_inode_need_killpriv(struct dentry *dentry)
2786 return secondary_ops->inode_need_killpriv(dentry);
2789 static int selinux_inode_killpriv(struct dentry *dentry)
2791 return secondary_ops->inode_killpriv(dentry);
2794 /* file security operations */
2796 static int selinux_revalidate_file_permission(struct file *file, int mask)
2799 struct inode *inode = file->f_path.dentry->d_inode;
2802 /* No permission to check. Existence test. */
2806 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2807 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2810 rc = file_has_perm(current, file,
2811 file_mask_to_av(inode->i_mode, mask));
2815 return selinux_netlbl_inode_permission(inode, mask);
2818 static int selinux_file_permission(struct file *file, int mask)
2820 struct inode *inode = file->f_path.dentry->d_inode;
2821 struct task_security_struct *tsec = current->security;
2822 struct file_security_struct *fsec = file->f_security;
2823 struct inode_security_struct *isec = inode->i_security;
2826 /* No permission to check. Existence test. */
2830 if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2831 && fsec->pseqno == avc_policy_seqno())
2832 return selinux_netlbl_inode_permission(inode, mask);
2834 return selinux_revalidate_file_permission(file, mask);
2837 static int selinux_file_alloc_security(struct file *file)
2839 return file_alloc_security(file);
2842 static void selinux_file_free_security(struct file *file)
2844 file_free_security(file);
2847 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2859 case EXT2_IOC_GETFLAGS:
2861 case EXT2_IOC_GETVERSION:
2862 error = file_has_perm(current, file, FILE__GETATTR);
2865 case EXT2_IOC_SETFLAGS:
2867 case EXT2_IOC_SETVERSION:
2868 error = file_has_perm(current, file, FILE__SETATTR);
2871 /* sys_ioctl() checks */
2875 error = file_has_perm(current, file, 0);
2880 error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2883 /* default case assumes that the command will go
2884 * to the file's ioctl() function.
2887 error = file_has_perm(current, file, FILE__IOCTL);
2893 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2895 #ifndef CONFIG_PPC32
2896 if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2898 * We are making executable an anonymous mapping or a
2899 * private file mapping that will also be writable.
2900 * This has an additional check.
2902 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2909 /* read access is always possible with a mapping */
2910 u32 av = FILE__READ;
2912 /* write access only matters if the mapping is shared */
2913 if (shared && (prot & PROT_WRITE))
2916 if (prot & PROT_EXEC)
2917 av |= FILE__EXECUTE;
2919 return file_has_perm(current, file, av);
2924 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2925 unsigned long prot, unsigned long flags,
2926 unsigned long addr, unsigned long addr_only)
2929 u32 sid = ((struct task_security_struct*)(current->security))->sid;
2931 if (addr < mmap_min_addr)
2932 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2933 MEMPROTECT__MMAP_ZERO, NULL);
2934 if (rc || addr_only)
2937 if (selinux_checkreqprot)
2940 return file_map_prot_check(file, prot,
2941 (flags & MAP_TYPE) == MAP_SHARED);
2944 static int selinux_file_mprotect(struct vm_area_struct *vma,
2945 unsigned long reqprot,
2950 rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2954 if (selinux_checkreqprot)
2957 #ifndef CONFIG_PPC32
2958 if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2960 if (vma->vm_start >= vma->vm_mm->start_brk &&
2961 vma->vm_end <= vma->vm_mm->brk) {
2962 rc = task_has_perm(current, current,
2964 } else if (!vma->vm_file &&
2965 vma->vm_start <= vma->vm_mm->start_stack &&
2966 vma->vm_end >= vma->vm_mm->start_stack) {
2967 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2968 } else if (vma->vm_file && vma->anon_vma) {
2970 * We are making executable a file mapping that has
2971 * had some COW done. Since pages might have been
2972 * written, check ability to execute the possibly
2973 * modified content. This typically should only
2974 * occur for text relocations.
2976 rc = file_has_perm(current, vma->vm_file,
2984 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2987 static int selinux_file_lock(struct file *file, unsigned int cmd)
2989 return file_has_perm(current, file, FILE__LOCK);
2992 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2999 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3004 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3005 err = file_has_perm(current, file,FILE__WRITE);
3014 /* Just check FD__USE permission */
3015 err = file_has_perm(current, file, 0);
3020 #if BITS_PER_LONG == 32
3025 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3029 err = file_has_perm(current, file, FILE__LOCK);
3036 static int selinux_file_set_fowner(struct file *file)
3038 struct task_security_struct *tsec;
3039 struct file_security_struct *fsec;
3041 tsec = current->security;
3042 fsec = file->f_security;
3043 fsec->fown_sid = tsec->sid;
3048 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3049 struct fown_struct *fown, int signum)
3053 struct task_security_struct *tsec;
3054 struct file_security_struct *fsec;
3056 /* struct fown_struct is never outside the context of a struct file */
3057 file = container_of(fown, struct file, f_owner);
3059 tsec = tsk->security;
3060 fsec = file->f_security;
3063 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3065 perm = signal_to_av(signum);
3067 return avc_has_perm(fsec->fown_sid, tsec->sid,
3068 SECCLASS_PROCESS, perm, NULL);
3071 static int selinux_file_receive(struct file *file)
3073 return file_has_perm(current, file, file_to_av(file));
3076 static int selinux_dentry_open(struct file *file)
3078 struct file_security_struct *fsec;
3079 struct inode *inode;
3080 struct inode_security_struct *isec;
3081 inode = file->f_path.dentry->d_inode;
3082 fsec = file->f_security;
3083 isec = inode->i_security;
3085 * Save inode label and policy sequence number
3086 * at open-time so that selinux_file_permission
3087 * can determine whether revalidation is necessary.
3088 * Task label is already saved in the file security
3089 * struct as its SID.
3091 fsec->isid = isec->sid;
3092 fsec->pseqno = avc_policy_seqno();
3094 * Since the inode label or policy seqno may have changed
3095 * between the selinux_inode_permission check and the saving
3096 * of state above, recheck that access is still permitted.
3097 * Otherwise, access might never be revalidated against the
3098 * new inode label or new policy.
3099 * This check is not redundant - do not remove.
3101 return inode_has_perm(current, inode, file_to_av(file), NULL);
3104 /* task security operations */
3106 static int selinux_task_create(unsigned long clone_flags)
3110 rc = secondary_ops->task_create(clone_flags);
3114 return task_has_perm(current, current, PROCESS__FORK);
3117 static int selinux_task_alloc_security(struct task_struct *tsk)
3119 struct task_security_struct *tsec1, *tsec2;
3122 tsec1 = current->security;
3124 rc = task_alloc_security(tsk);
3127 tsec2 = tsk->security;
3129 tsec2->osid = tsec1->osid;
3130 tsec2->sid = tsec1->sid;
3132 /* Retain the exec, fs, key, and sock SIDs across fork */
3133 tsec2->exec_sid = tsec1->exec_sid;
3134 tsec2->create_sid = tsec1->create_sid;
3135 tsec2->keycreate_sid = tsec1->keycreate_sid;
3136 tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3141 static void selinux_task_free_security(struct task_struct *tsk)
3143 task_free_security(tsk);
3146 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3148 /* Since setuid only affects the current process, and
3149 since the SELinux controls are not based on the Linux
3150 identity attributes, SELinux does not need to control
3151 this operation. However, SELinux does control the use
3152 of the CAP_SETUID and CAP_SETGID capabilities using the
3157 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3159 return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3162 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3164 /* See the comment for setuid above. */
3168 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3170 return task_has_perm(current, p, PROCESS__SETPGID);
3173 static int selinux_task_getpgid(struct task_struct *p)
3175 return task_has_perm(current, p, PROCESS__GETPGID);
3178 static int selinux_task_getsid(struct task_struct *p)
3180 return task_has_perm(current, p, PROCESS__GETSESSION);
3183 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3185 selinux_get_task_sid(p, secid);
3188 static int selinux_task_setgroups(struct group_info *group_info)
3190 /* See the comment for setuid above. */
3194 static int selinux_task_setnice(struct task_struct *p, int nice)
3198 rc = secondary_ops->task_setnice(p, nice);
3202 return task_has_perm(current,p, PROCESS__SETSCHED);
3205 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3209 rc = secondary_ops->task_setioprio(p, ioprio);
3213 return task_has_perm(current, p, PROCESS__SETSCHED);
3216 static int selinux_task_getioprio(struct task_struct *p)
3218 return task_has_perm(current, p, PROCESS__GETSCHED);
3221 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3223 struct rlimit *old_rlim = current->signal->rlim + resource;
3226 rc = secondary_ops->task_setrlimit(resource, new_rlim);
3230 /* Control the ability to change the hard limit (whether
3231 lowering or raising it), so that the hard limit can
3232 later be used as a safe reset point for the soft limit
3233 upon context transitions. See selinux_bprm_apply_creds. */
3234 if (old_rlim->rlim_max != new_rlim->rlim_max)
3235 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3240 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3244 rc = secondary_ops->task_setscheduler(p, policy, lp);
3248 return task_has_perm(current, p, PROCESS__SETSCHED);
3251 static int selinux_task_getscheduler(struct task_struct *p)
3253 return task_has_perm(current, p, PROCESS__GETSCHED);
3256 static int selinux_task_movememory(struct task_struct *p)
3258 return task_has_perm(current, p, PROCESS__SETSCHED);
3261 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3266 struct task_security_struct *tsec;
3268 rc = secondary_ops->task_kill(p, info, sig, secid);
3272 if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3276 perm = PROCESS__SIGNULL; /* null signal; existence test */
3278 perm = signal_to_av(sig);
3281 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3283 rc = task_has_perm(current, p, perm);
3287 static int selinux_task_prctl(int option,
3293 /* The current prctl operations do not appear to require
3294 any SELinux controls since they merely observe or modify
3295 the state of the current process. */
3299 static int selinux_task_wait(struct task_struct *p)
3301 return task_has_perm(p, current, PROCESS__SIGCHLD);
3304 static void selinux_task_reparent_to_init(struct task_struct *p)
3306 struct task_security_struct *tsec;
3308 secondary_ops->task_reparent_to_init(p);
3311 tsec->osid = tsec->sid;
3312 tsec->sid = SECINITSID_KERNEL;
3316 static void selinux_task_to_inode(struct task_struct *p,
3317 struct inode *inode)
3319 struct task_security_struct *tsec = p->security;
3320 struct inode_security_struct *isec = inode->i_security;
3322 isec->sid = tsec->sid;
3323 isec->initialized = 1;
3327 /* Returns error only if unable to parse addresses */
3328 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3329 struct avc_audit_data *ad, u8 *proto)
3331 int offset, ihlen, ret = -EINVAL;
3332 struct iphdr _iph, *ih;
3334 offset = skb_network_offset(skb);
3335 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3339 ihlen = ih->ihl * 4;
3340 if (ihlen < sizeof(_iph))
3343 ad->u.net.v4info.saddr = ih->saddr;
3344 ad->u.net.v4info.daddr = ih->daddr;
3348 *proto = ih->protocol;
3350 switch (ih->protocol) {
3352 struct tcphdr _tcph, *th;
3354 if (ntohs(ih->frag_off) & IP_OFFSET)
3358 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3362 ad->u.net.sport = th->source;
3363 ad->u.net.dport = th->dest;
3368 struct udphdr _udph, *uh;
3370 if (ntohs(ih->frag_off) & IP_OFFSET)
3374 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3378 ad->u.net.sport = uh->source;
3379 ad->u.net.dport = uh->dest;
3383 case IPPROTO_DCCP: {
3384 struct dccp_hdr _dccph, *dh;
3386 if (ntohs(ih->frag_off) & IP_OFFSET)
3390 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3394 ad->u.net.sport = dh->dccph_sport;
3395 ad->u.net.dport = dh->dccph_dport;
3406 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3408 /* Returns error only if unable to parse addresses */
3409 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3410 struct avc_audit_data *ad, u8 *proto)
3413 int ret = -EINVAL, offset;
3414 struct ipv6hdr _ipv6h, *ip6;
3416 offset = skb_network_offset(skb);
3417 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3421 ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3422 ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3425 nexthdr = ip6->nexthdr;
3426 offset += sizeof(_ipv6h);
3427 offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3436 struct tcphdr _tcph, *th;
3438 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3442 ad->u.net.sport = th->source;
3443 ad->u.net.dport = th->dest;
3448 struct udphdr _udph, *uh;
3450 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3454 ad->u.net.sport = uh->source;
3455 ad->u.net.dport = uh->dest;
3459 case IPPROTO_DCCP: {
3460 struct dccp_hdr _dccph, *dh;
3462 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3466 ad->u.net.sport = dh->dccph_sport;
3467 ad->u.net.dport = dh->dccph_dport;
3471 /* includes fragments */
3481 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3482 char **addrp, int src, u8 *proto)
3486 switch (ad->u.net.family) {
3488 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3491 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3492 &ad->u.net.v4info.daddr);
3495 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3497 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3500 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3501 &ad->u.net.v6info.daddr);
3510 "SELinux: failure in selinux_parse_skb(),"
3511 " unable to parse packet\n");
3517 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3519 * @family: protocol family
3520 * @sid: the packet's peer label SID
3523 * Check the various different forms of network peer labeling and determine
3524 * the peer label/SID for the packet; most of the magic actually occurs in
3525 * the security server function security_net_peersid_cmp(). The function
3526 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3527 * or -EACCES if @sid is invalid due to inconsistencies with the different
3531 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3538 selinux_skb_xfrm_sid(skb, &xfrm_sid);
3539 selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3541 err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3542 if (unlikely(err)) {
3544 "SELinux: failure in selinux_skb_peerlbl_sid(),"
3545 " unable to determine packet's peer label\n");
3552 /* socket security operations */
3553 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3556 struct inode_security_struct *isec;
3557 struct task_security_struct *tsec;
3558 struct avc_audit_data ad;
3561 tsec = task->security;
3562 isec = SOCK_INODE(sock)->i_security;
3564 if (isec->sid == SECINITSID_KERNEL)
3567 AVC_AUDIT_DATA_INIT(&ad,NET);
3568 ad.u.net.sk = sock->sk;
3569 err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3575 static int selinux_socket_create(int family, int type,
3576 int protocol, int kern)
3579 struct task_security_struct *tsec;
3585 tsec = current->security;
3586 newsid = tsec->sockcreate_sid ? : tsec->sid;
3587 err = avc_has_perm(tsec->sid, newsid,
3588 socket_type_to_security_class(family, type,
3589 protocol), SOCKET__CREATE, NULL);
3595 static int selinux_socket_post_create(struct socket *sock, int family,
3596 int type, int protocol, int kern)
3599 struct inode_security_struct *isec;
3600 struct task_security_struct *tsec;
3601 struct sk_security_struct *sksec;
3604 isec = SOCK_INODE(sock)->i_security;
3606 tsec = current->security;
3607 newsid = tsec->sockcreate_sid ? : tsec->sid;
3608 isec->sclass = socket_type_to_security_class(family, type, protocol);
3609 isec->sid = kern ? SECINITSID_KERNEL : newsid;
3610 isec->initialized = 1;
3613 sksec = sock->sk->sk_security;
3614 sksec->sid = isec->sid;
3615 sksec->sclass = isec->sclass;
3616 err = selinux_netlbl_socket_post_create(sock);
3622 /* Range of port numbers used to automatically bind.
3623 Need to determine whether we should perform a name_bind
3624 permission check between the socket and the port number. */
3626 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3631 err = socket_has_perm(current, sock, SOCKET__BIND);
3636 * If PF_INET or PF_INET6, check name_bind permission for the port.
3637 * Multiple address binding for SCTP is not supported yet: we just
3638 * check the first address now.
3640 family = sock->sk->sk_family;
3641 if (family == PF_INET || family == PF_INET6) {
3643 struct inode_security_struct *isec;
3644 struct task_security_struct *tsec;
3645 struct avc_audit_data ad;
3646 struct sockaddr_in *addr4 = NULL;
3647 struct sockaddr_in6 *addr6 = NULL;
3648 unsigned short snum;
3649 struct sock *sk = sock->sk;
3650 u32 sid, node_perm, addrlen;
3652 tsec = current->security;
3653 isec = SOCK_INODE(sock)->i_security;
3655 if (family == PF_INET) {
3656 addr4 = (struct sockaddr_in *)address;
3657 snum = ntohs(addr4->sin_port);
3658 addrlen = sizeof(addr4->sin_addr.s_addr);
3659 addrp = (char *)&addr4->sin_addr.s_addr;
3661 addr6 = (struct sockaddr_in6 *)address;
3662 snum = ntohs(addr6->sin6_port);
3663 addrlen = sizeof(addr6->sin6_addr.s6_addr);
3664 addrp = (char *)&addr6->sin6_addr.s6_addr;
3670 inet_get_local_port_range(&low, &high);
3672 if (snum < max(PROT_SOCK, low) || snum > high) {
3673 err = security_port_sid(sk->sk_family,
3675 sk->sk_protocol, snum,
3679 AVC_AUDIT_DATA_INIT(&ad,NET);
3680 ad.u.net.sport = htons(snum);
3681 ad.u.net.family = family;
3682 err = avc_has_perm(isec->sid, sid,
3684 SOCKET__NAME_BIND, &ad);
3690 switch(isec->sclass) {
3691 case SECCLASS_TCP_SOCKET:
3692 node_perm = TCP_SOCKET__NODE_BIND;
3695 case SECCLASS_UDP_SOCKET:
3696 node_perm = UDP_SOCKET__NODE_BIND;
3699 case SECCLASS_DCCP_SOCKET:
3700 node_perm = DCCP_SOCKET__NODE_BIND;
3704 node_perm = RAWIP_SOCKET__NODE_BIND;
3708 err = sel_netnode_sid(addrp, family, &sid);
3712 AVC_AUDIT_DATA_INIT(&ad,NET);
3713 ad.u.net.sport = htons(snum);
3714 ad.u.net.family = family;
3716 if (family == PF_INET)
3717 ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3719 ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3721 err = avc_has_perm(isec->sid, sid,
3722 isec->sclass, node_perm, &ad);
3730 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3732 struct inode_security_struct *isec;
3735 err = socket_has_perm(current, sock, SOCKET__CONNECT);
3740 * If a TCP or DCCP socket, check name_connect permission for the port.
3742 isec = SOCK_INODE(sock)->i_security;
3743 if (isec->sclass == SECCLASS_TCP_SOCKET ||
3744 isec->sclass == SECCLASS_DCCP_SOCKET) {
3745 struct sock *sk = sock->sk;
3746 struct avc_audit_data ad;
3747 struct sockaddr_in *addr4 = NULL;
3748 struct sockaddr_in6 *addr6 = NULL;
3749 unsigned short snum;
3752 if (sk->sk_family == PF_INET) {
3753 addr4 = (struct sockaddr_in *)address;
3754 if (addrlen < sizeof(struct sockaddr_in))
3756 snum = ntohs(addr4->sin_port);
3758 addr6 = (struct sockaddr_in6 *)address;
3759 if (addrlen < SIN6_LEN_RFC2133)
3761 snum = ntohs(addr6->sin6_port);
3764 err = security_port_sid(sk->sk_family, sk->sk_type,
3765 sk->sk_protocol, snum, &sid);
3769 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3770 TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3772 AVC_AUDIT_DATA_INIT(&ad,NET);
3773 ad.u.net.dport = htons(snum);
3774 ad.u.net.family = sk->sk_family;
3775 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3784 static int selinux_socket_listen(struct socket *sock, int backlog)
3786 return socket_has_perm(current, sock, SOCKET__LISTEN);
3789 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3792 struct inode_security_struct *isec;
3793 struct inode_security_struct *newisec;
3795 err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3799 newisec = SOCK_INODE(newsock)->i_security;
3801 isec = SOCK_INODE(sock)->i_security;
3802 newisec->sclass = isec->sclass;
3803 newisec->sid = isec->sid;
3804 newisec->initialized = 1;
3809 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3814 rc = socket_has_perm(current, sock, SOCKET__WRITE);
3818 return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3821 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3822 int size, int flags)
3824 return socket_has_perm(current, sock, SOCKET__READ);
3827 static int selinux_socket_getsockname(struct socket *sock)
3829 return socket_has_perm(current, sock, SOCKET__GETATTR);
3832 static int selinux_socket_getpeername(struct socket *sock)
3834 return socket_has_perm(current, sock, SOCKET__GETATTR);
3837 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3841 err = socket_has_perm(current, sock, SOCKET__SETOPT);
3845 return selinux_netlbl_socket_setsockopt(sock, level, optname);
3848 static int selinux_socket_getsockopt(struct socket *sock, int level,
3851 return socket_has_perm(current, sock, SOCKET__GETOPT);
3854 static int selinux_socket_shutdown(struct socket *sock, int how)
3856 return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3859 static int selinux_socket_unix_stream_connect(struct socket *sock,
3860 struct socket *other,
3863 struct sk_security_struct *ssec;
3864 struct inode_security_struct *isec;
3865 struct inode_security_struct *other_isec;
3866 struct avc_audit_data ad;
3869 err = secondary_ops->unix_stream_connect(sock, other, newsk);
3873 isec = SOCK_INODE(sock)->i_security;
3874 other_isec = SOCK_INODE(other)->i_security;
3876 AVC_AUDIT_DATA_INIT(&ad,NET);
3877 ad.u.net.sk = other->sk;
3879 err = avc_has_perm(isec->sid, other_isec->sid,
3881 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3885 /* connecting socket */
3886 ssec = sock->sk->sk_security;
3887 ssec->peer_sid = other_isec->sid;
3889 /* server child socket */
3890 ssec = newsk->sk_security;
3891 ssec->peer_sid = isec->sid;
3892 err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3897 static int selinux_socket_unix_may_send(struct socket *sock,
3898 struct socket *other)
3900 struct inode_security_struct *isec;
3901 struct inode_security_struct *other_isec;
3902 struct avc_audit_data ad;
3905 isec = SOCK_INODE(sock)->i_security;
3906 other_isec = SOCK_INODE(other)->i_security;
3908 AVC_AUDIT_DATA_INIT(&ad,NET);
3909 ad.u.net.sk = other->sk;
3911 err = avc_has_perm(isec->sid, other_isec->sid,
3912 isec->sclass, SOCKET__SENDTO, &ad);
3919 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3921 struct avc_audit_data *ad)
3927 err = sel_netif_sid(ifindex, &if_sid);
3930 err = avc_has_perm(peer_sid, if_sid,
3931 SECCLASS_NETIF, NETIF__INGRESS, ad);
3935 err = sel_netnode_sid(addrp, family, &node_sid);
3938 return avc_has_perm(peer_sid, node_sid,
3939 SECCLASS_NODE, NODE__RECVFROM, ad);
3942 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3943 struct sk_buff *skb,
3944 struct avc_audit_data *ad,
3949 struct sk_security_struct *sksec = sk->sk_security;
3951 u32 netif_perm, node_perm, recv_perm;
3952 u32 port_sid, node_sid, if_sid, sk_sid;
3954 sk_sid = sksec->sid;
3955 sk_class = sksec->sclass;
3958 case SECCLASS_UDP_SOCKET:
3959 netif_perm = NETIF__UDP_RECV;
3960 node_perm = NODE__UDP_RECV;
3961 recv_perm = UDP_SOCKET__RECV_MSG;
3963 case SECCLASS_TCP_SOCKET:
3964 netif_perm = NETIF__TCP_RECV;
3965 node_perm = NODE__TCP_RECV;
3966 recv_perm = TCP_SOCKET__RECV_MSG;
3968 case SECCLASS_DCCP_SOCKET:
3969 netif_perm = NETIF__DCCP_RECV;
3970 node_perm = NODE__DCCP_RECV;
3971 recv_perm = DCCP_SOCKET__RECV_MSG;
3974 netif_perm = NETIF__RAWIP_RECV;
3975 node_perm = NODE__RAWIP_RECV;
3980 err = sel_netif_sid(skb->iif, &if_sid);
3983 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3987 err = sel_netnode_sid(addrp, family, &node_sid);
3990 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3996 err = security_port_sid(sk->sk_family, sk->sk_type,
3997 sk->sk_protocol, ntohs(ad->u.net.sport),
3999 if (unlikely(err)) {
4001 "SELinux: failure in"
4002 " selinux_sock_rcv_skb_iptables_compat(),"
4003 " network port label not found\n");
4006 return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4009 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4010 struct avc_audit_data *ad,
4011 u16 family, char *addrp)
4014 struct sk_security_struct *sksec = sk->sk_security;
4016 u32 sk_sid = sksec->sid;
4018 if (selinux_compat_net)
4019 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4022 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4027 if (selinux_policycap_netpeer) {
4028 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4031 err = avc_has_perm(sk_sid, peer_sid,
4032 SECCLASS_PEER, PEER__RECV, ad);
4034 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4037 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4043 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4046 struct sk_security_struct *sksec = sk->sk_security;
4047 u16 family = sk->sk_family;
4048 u32 sk_sid = sksec->sid;
4049 struct avc_audit_data ad;
4052 if (family != PF_INET && family != PF_INET6)
4055 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4056 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4059 AVC_AUDIT_DATA_INIT(&ad, NET);
4060 ad.u.net.netif = skb->iif;
4061 ad.u.net.family = family;
4062 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4066 /* If any sort of compatibility mode is enabled then handoff processing
4067 * to the selinux_sock_rcv_skb_compat() function to deal with the
4068 * special handling. We do this in an attempt to keep this function
4069 * as fast and as clean as possible. */
4070 if (selinux_compat_net || !selinux_policycap_netpeer)
4071 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4074 if (netlbl_enabled() || selinux_xfrm_enabled()) {
4077 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4080 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4084 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4088 if (selinux_secmark_enabled()) {
4089 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4098 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4099 int __user *optlen, unsigned len)
4104 struct sk_security_struct *ssec;
4105 struct inode_security_struct *isec;
4106 u32 peer_sid = SECSID_NULL;
4108 isec = SOCK_INODE(sock)->i_security;
4110 if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4111 isec->sclass == SECCLASS_TCP_SOCKET) {
4112 ssec = sock->sk->sk_security;
4113 peer_sid = ssec->peer_sid;
4115 if (peer_sid == SECSID_NULL) {
4120 err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4125 if (scontext_len > len) {
4130 if (copy_to_user(optval, scontext, scontext_len))
4134 if (put_user(scontext_len, optlen))
4142 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4144 u32 peer_secid = SECSID_NULL;
4148 family = sock->sk->sk_family;
4149 else if (skb && skb->sk)
4150 family = skb->sk->sk_family;
4154 if (sock && family == PF_UNIX)
4155 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4157 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4160 *secid = peer_secid;
4161 if (peer_secid == SECSID_NULL)
4166 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4168 return sk_alloc_security(sk, family, priority);
4171 static void selinux_sk_free_security(struct sock *sk)
4173 sk_free_security(sk);
4176 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4178 struct sk_security_struct *ssec = sk->sk_security;
4179 struct sk_security_struct *newssec = newsk->sk_security;
4181 newssec->sid = ssec->sid;
4182 newssec->peer_sid = ssec->peer_sid;
4183 newssec->sclass = ssec->sclass;
4185 selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4188 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4191 *secid = SECINITSID_ANY_SOCKET;
4193 struct sk_security_struct *sksec = sk->sk_security;
4195 *secid = sksec->sid;
4199 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4201 struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4202 struct sk_security_struct *sksec = sk->sk_security;
4204 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4205 sk->sk_family == PF_UNIX)
4206 isec->sid = sksec->sid;
4207 sksec->sclass = isec->sclass;
4209 selinux_netlbl_sock_graft(sk, parent);
4212 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4213 struct request_sock *req)
4215 struct sk_security_struct *sksec = sk->sk_security;
4220 err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4223 if (peersid == SECSID_NULL) {
4224 req->secid = sksec->sid;
4225 req->peer_secid = SECSID_NULL;
4229 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4233 req->secid = newsid;
4234 req->peer_secid = peersid;
4238 static void selinux_inet_csk_clone(struct sock *newsk,
4239 const struct request_sock *req)
4241 struct sk_security_struct *newsksec = newsk->sk_security;
4243 newsksec->sid = req->secid;
4244 newsksec->peer_sid = req->peer_secid;
4245 /* NOTE: Ideally, we should also get the isec->sid for the
4246 new socket in sync, but we don't have the isec available yet.
4247 So we will wait until sock_graft to do it, by which
4248 time it will have been created and available. */
4250 /* We don't need to take any sort of lock here as we are the only
4251 * thread with access to newsksec */
4252 selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4255 static void selinux_inet_conn_established(struct sock *sk,
4256 struct sk_buff *skb)
4258 struct sk_security_struct *sksec = sk->sk_security;
4260 selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4263 static void selinux_req_classify_flow(const struct request_sock *req,
4266 fl->secid = req->secid;
4269 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4273 struct nlmsghdr *nlh;
4274 struct socket *sock = sk->sk_socket;
4275 struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4277 if (skb->len < NLMSG_SPACE(0)) {
4281 nlh = nlmsg_hdr(skb);
4283 err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4285 if (err == -EINVAL) {
4286 audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4287 "SELinux: unrecognized netlink message"
4288 " type=%hu for sclass=%hu\n",
4289 nlh->nlmsg_type, isec->sclass);
4290 if (!selinux_enforcing)
4300 err = socket_has_perm(current, sock, perm);
4305 #ifdef CONFIG_NETFILTER
4307 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4312 struct avc_audit_data ad;
4316 if (!selinux_policycap_netpeer)
4319 secmark_active = selinux_secmark_enabled();
4320 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4321 if (!secmark_active && !peerlbl_active)
4324 AVC_AUDIT_DATA_INIT(&ad, NET);
4325 ad.u.net.netif = ifindex;
4326 ad.u.net.family = family;
4327 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4330 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4334 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4335 peer_sid, &ad) != 0)
4339 if (avc_has_perm(peer_sid, skb->secmark,
4340 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4346 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4347 struct sk_buff *skb,
4348 const struct net_device *in,
4349 const struct net_device *out,
4350 int (*okfn)(struct sk_buff *))
4352 return selinux_ip_forward(skb, in->ifindex, PF_INET);
4355 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4356 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4357 struct sk_buff *skb,
4358 const struct net_device *in,
4359 const struct net_device *out,
4360 int (*okfn)(struct sk_buff *))
4362 return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4366 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4368 struct avc_audit_data *ad,
4369 u16 family, char *addrp)
4372 struct sk_security_struct *sksec = sk->sk_security;
4374 u32 netif_perm, node_perm, send_perm;
4375 u32 port_sid, node_sid, if_sid, sk_sid;
4377 sk_sid = sksec->sid;
4378 sk_class = sksec->sclass;
4381 case SECCLASS_UDP_SOCKET:
4382 netif_perm = NETIF__UDP_SEND;
4383 node_perm = NODE__UDP_SEND;
4384 send_perm = UDP_SOCKET__SEND_MSG;
4386 case SECCLASS_TCP_SOCKET:
4387 netif_perm = NETIF__TCP_SEND;
4388 node_perm = NODE__TCP_SEND;
4389 send_perm = TCP_SOCKET__SEND_MSG;
4391 case SECCLASS_DCCP_SOCKET:
4392 netif_perm = NETIF__DCCP_SEND;
4393 node_perm = NODE__DCCP_SEND;
4394 send_perm = DCCP_SOCKET__SEND_MSG;
4397 netif_perm = NETIF__RAWIP_SEND;
4398 node_perm = NODE__RAWIP_SEND;
4403 err = sel_netif_sid(ifindex, &if_sid);
4406 err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4409 err = sel_netnode_sid(addrp, family, &node_sid);
4412 err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4419 err = security_port_sid(sk->sk_family, sk->sk_type,
4420 sk->sk_protocol, ntohs(ad->u.net.dport),
4422 if (unlikely(err)) {
4424 "SELinux: failure in"
4425 " selinux_ip_postroute_iptables_compat(),"
4426 " network port label not found\n");
4429 return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4432 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4434 struct avc_audit_data *ad,
4439 struct sock *sk = skb->sk;
4440 struct sk_security_struct *sksec;
4444 sksec = sk->sk_security;
4446 if (selinux_compat_net) {
4447 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4451 if (avc_has_perm(sksec->sid, skb->secmark,
4452 SECCLASS_PACKET, PACKET__SEND, ad))
4456 if (selinux_policycap_netpeer)
4457 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4463 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4469 struct avc_audit_data ad;
4475 AVC_AUDIT_DATA_INIT(&ad, NET);
4476 ad.u.net.netif = ifindex;
4477 ad.u.net.family = family;
4478 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4481 /* If any sort of compatibility mode is enabled then handoff processing
4482 * to the selinux_ip_postroute_compat() function to deal with the
4483 * special handling. We do this in an attempt to keep this function
4484 * as fast and as clean as possible. */
4485 if (selinux_compat_net || !selinux_policycap_netpeer)
4486 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4487 family, addrp, proto);
4489 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4490 * packet transformation so allow the packet to pass without any checks
4491 * since we'll have another chance to perform access control checks
4492 * when the packet is on it's final way out.
4493 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4494 * is NULL, in this case go ahead and apply access control. */
4495 if (skb->dst != NULL && skb->dst->xfrm != NULL)
4498 secmark_active = selinux_secmark_enabled();
4499 peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4500 if (!secmark_active && !peerlbl_active)
4503 /* if the packet is locally generated (skb->sk != NULL) then use the
4504 * socket's label as the peer label, otherwise the packet is being
4505 * forwarded through this system and we need to fetch the peer label
4506 * directly from the packet */
4509 struct sk_security_struct *sksec = sk->sk_security;
4510 peer_sid = sksec->sid;
4511 secmark_perm = PACKET__SEND;
4513 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4515 secmark_perm = PACKET__FORWARD_OUT;
4519 if (avc_has_perm(peer_sid, skb->secmark,
4520 SECCLASS_PACKET, secmark_perm, &ad))
4523 if (peerlbl_active) {
4527 if (sel_netif_sid(ifindex, &if_sid))
4529 if (avc_has_perm(peer_sid, if_sid,
4530 SECCLASS_NETIF, NETIF__EGRESS, &ad))
4533 if (sel_netnode_sid(addrp, family, &node_sid))
4535 if (avc_has_perm(peer_sid, node_sid,
4536 SECCLASS_NODE, NODE__SENDTO, &ad))
4543 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4544 struct sk_buff *skb,
4545 const struct net_device *in,
4546 const struct net_device *out,
4547 int (*okfn)(struct sk_buff *))
4549 return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4552 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4553 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4554 struct sk_buff *skb,
4555 const struct net_device *in,
4556 const struct net_device *out,
4557 int (*okfn)(struct sk_buff *))
4559 return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4563 #endif /* CONFIG_NETFILTER */
4565 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4569 err = secondary_ops->netlink_send(sk, skb);
4573 if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4574 err = selinux_nlmsg_perm(sk, skb);
4579 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4582 struct avc_audit_data ad;
4584 err = secondary_ops->netlink_recv(skb, capability);
4588 AVC_AUDIT_DATA_INIT(&ad, CAP);
4589 ad.u.cap = capability;
4591 return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4592 SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4595 static int ipc_alloc_security(struct task_struct *task,
4596 struct kern_ipc_perm *perm,
4599 struct task_security_struct *tsec = task->security;
4600 struct ipc_security_struct *isec;
4602 isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4606 isec->sclass = sclass;
4607 isec->sid = tsec->sid;
4608 perm->security = isec;
4613 static void ipc_free_security(struct kern_ipc_perm *perm)
4615 struct ipc_security_struct *isec = perm->security;
4616 perm->security = NULL;
4620 static int msg_msg_alloc_security(struct msg_msg *msg)
4622 struct msg_security_struct *msec;
4624 msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4628 msec->sid = SECINITSID_UNLABELED;
4629 msg->security = msec;
4634 static void msg_msg_free_security(struct msg_msg *msg)
4636 struct msg_security_struct *msec = msg->security;
4638 msg->security = NULL;
4642 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4645 struct task_security_struct *tsec;
4646 struct ipc_security_struct *isec;
4647 struct avc_audit_data ad;
4649 tsec = current->security;
4650 isec = ipc_perms->security;
4652 AVC_AUDIT_DATA_INIT(&ad, IPC);
4653 ad.u.ipc_id = ipc_perms->key;
4655 return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4658 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4660 return msg_msg_alloc_security(msg);
4663 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4665 msg_msg_free_security(msg);
4668 /* message queue security operations */
4669 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4671 struct task_security_struct *tsec;
4672 struct ipc_security_struct *isec;
4673 struct avc_audit_data ad;
4676 rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4680 tsec = current->security;
4681 isec = msq->q_perm.security;
4683 AVC_AUDIT_DATA_INIT(&ad, IPC);
4684 ad.u.ipc_id = msq->q_perm.key;
4686 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4689 ipc_free_security(&msq->q_perm);
4695 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4697 ipc_free_security(&msq->q_perm);
4700 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4702 struct task_security_struct *tsec;
4703 struct ipc_security_struct *isec;
4704 struct avc_audit_data ad;
4706 tsec = current->security;
4707 isec = msq->q_perm.security;
4709 AVC_AUDIT_DATA_INIT(&ad, IPC);
4710 ad.u.ipc_id = msq->q_perm.key;
4712 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4713 MSGQ__ASSOCIATE, &ad);
4716 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4724 /* No specific object, just general system-wide information. */
4725 return task_has_system(current, SYSTEM__IPC_INFO);
4728 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4731 perms = MSGQ__SETATTR;
4734 perms = MSGQ__DESTROY;
4740 err = ipc_has_perm(&msq->q_perm, perms);
4744 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4746 struct task_security_struct *tsec;
4747 struct ipc_security_struct *isec;
4748 struct msg_security_struct *msec;
4749 struct avc_audit_data ad;
4752 tsec = current->security;
4753 isec = msq->q_perm.security;
4754 msec = msg->security;
4757 * First time through, need to assign label to the message
4759 if (msec->sid == SECINITSID_UNLABELED) {
4761 * Compute new sid based on current process and
4762 * message queue this message will be stored in
4764 rc = security_transition_sid(tsec->sid,
4772 AVC_AUDIT_DATA_INIT(&ad, IPC);
4773 ad.u.ipc_id = msq->q_perm.key;
4775 /* Can this process write to the queue? */
4776 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4779 /* Can this process send the message */
4780 rc = avc_has_perm(tsec->sid, msec->sid,
4781 SECCLASS_MSG, MSG__SEND, &ad);
4783 /* Can the message be put in the queue? */
4784 rc = avc_has_perm(msec->sid, isec->sid,
4785 SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4790 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4791 struct task_struct *target,
4792 long type, int mode)
4794 struct task_security_struct *tsec;
4795 struct ipc_security_struct *isec;
4796 struct msg_security_struct *msec;
4797 struct avc_audit_data ad;
4800 tsec = target->security;
4801 isec = msq->q_perm.security;
4802 msec = msg->security;
4804 AVC_AUDIT_DATA_INIT(&ad, IPC);
4805 ad.u.ipc_id = msq->q_perm.key;
4807 rc = avc_has_perm(tsec->sid, isec->sid,
4808 SECCLASS_MSGQ, MSGQ__READ, &ad);
4810 rc = avc_has_perm(tsec->sid, msec->sid,
4811 SECCLASS_MSG, MSG__RECEIVE, &ad);
4815 /* Shared Memory security operations */
4816 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4818 struct task_security_struct *tsec;
4819 struct ipc_security_struct *isec;
4820 struct avc_audit_data ad;
4823 rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4827 tsec = current->security;
4828 isec = shp->shm_perm.security;
4830 AVC_AUDIT_DATA_INIT(&ad, IPC);
4831 ad.u.ipc_id = shp->shm_perm.key;
4833 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4836 ipc_free_security(&shp->shm_perm);
4842 static void selinux_shm_free_security(struct shmid_kernel *shp)
4844 ipc_free_security(&shp->shm_perm);
4847 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4849 struct task_security_struct *tsec;
4850 struct ipc_security_struct *isec;
4851 struct avc_audit_data ad;
4853 tsec = current->security;
4854 isec = shp->shm_perm.security;
4856 AVC_AUDIT_DATA_INIT(&ad, IPC);
4857 ad.u.ipc_id = shp->shm_perm.key;
4859 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4860 SHM__ASSOCIATE, &ad);
4863 /* Note, at this point, shp is locked down */
4864 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4872 /* No specific object, just general system-wide information. */
4873 return task_has_system(current, SYSTEM__IPC_INFO);
4876 perms = SHM__GETATTR | SHM__ASSOCIATE;
4879 perms = SHM__SETATTR;
4886 perms = SHM__DESTROY;
4892 err = ipc_has_perm(&shp->shm_perm, perms);
4896 static int selinux_shm_shmat(struct shmid_kernel *shp,
4897 char __user *shmaddr, int shmflg)
4902 rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4906 if (shmflg & SHM_RDONLY)
4909 perms = SHM__READ | SHM__WRITE;
4911 return ipc_has_perm(&shp->shm_perm, perms);
4914 /* Semaphore security operations */
4915 static int selinux_sem_alloc_security(struct sem_array *sma)
4917 struct task_security_struct *tsec;
4918 struct ipc_security_struct *isec;
4919 struct avc_audit_data ad;
4922 rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4926 tsec = current->security;
4927 isec = sma->sem_perm.security;
4929 AVC_AUDIT_DATA_INIT(&ad, IPC);
4930 ad.u.ipc_id = sma->sem_perm.key;
4932 rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4935 ipc_free_security(&sma->sem_perm);
4941 static void selinux_sem_free_security(struct sem_array *sma)
4943 ipc_free_security(&sma->sem_perm);
4946 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4948 struct task_security_struct *tsec;
4949 struct ipc_security_struct *isec;
4950 struct avc_audit_data ad;
4952 tsec = current->security;
4953 isec = sma->sem_perm.security;
4955 AVC_AUDIT_DATA_INIT(&ad, IPC);
4956 ad.u.ipc_id = sma->sem_perm.key;
4958 return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4959 SEM__ASSOCIATE, &ad);
4962 /* Note, at this point, sma is locked down */
4963 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4971 /* No specific object, just general system-wide information. */
4972 return task_has_system(current, SYSTEM__IPC_INFO);
4976 perms = SEM__GETATTR;
4987 perms = SEM__DESTROY;
4990 perms = SEM__SETATTR;
4994 perms = SEM__GETATTR | SEM__ASSOCIATE;
5000 err = ipc_has_perm(&sma->sem_perm, perms);
5004 static int selinux_sem_semop(struct sem_array *sma,
5005 struct sembuf *sops, unsigned nsops, int alter)
5010 perms = SEM__READ | SEM__WRITE;
5014 return ipc_has_perm(&sma->sem_perm, perms);
5017 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5023 av |= IPC__UNIX_READ;
5025 av |= IPC__UNIX_WRITE;
5030 return ipc_has_perm(ipcp, av);
5033 /* module stacking operations */
5034 static int selinux_register_security (const char *name, struct security_operations *ops)
5036 if (secondary_ops != original_ops) {
5037 printk(KERN_ERR "%s: There is already a secondary security "
5038 "module registered.\n", __func__);
5042 secondary_ops = ops;
5044 printk(KERN_INFO "%s: Registering secondary module %s\n",
5051 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5054 inode_doinit_with_dentry(inode, dentry);
5057 static int selinux_getprocattr(struct task_struct *p,
5058 char *name, char **value)
5060 struct task_security_struct *tsec;
5066 error = task_has_perm(current, p, PROCESS__GETATTR);
5073 if (!strcmp(name, "current"))
5075 else if (!strcmp(name, "prev"))
5077 else if (!strcmp(name, "exec"))
5078 sid = tsec->exec_sid;
5079 else if (!strcmp(name, "fscreate"))
5080 sid = tsec->create_sid;
5081 else if (!strcmp(name, "keycreate"))
5082 sid = tsec->keycreate_sid;
5083 else if (!strcmp(name, "sockcreate"))
5084 sid = tsec->sockcreate_sid;
5091 error = security_sid_to_context(sid, value, &len);
5097 static int selinux_setprocattr(struct task_struct *p,
5098 char *name, void *value, size_t size)
5100 struct task_security_struct *tsec;
5101 struct task_struct *tracer;
5107 /* SELinux only allows a process to change its own
5108 security attributes. */
5113 * Basic control over ability to set these attributes at all.
5114 * current == p, but we'll pass them separately in case the
5115 * above restriction is ever removed.
5117 if (!strcmp(name, "exec"))
5118 error = task_has_perm(current, p, PROCESS__SETEXEC);
5119 else if (!strcmp(name, "fscreate"))
5120 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5121 else if (!strcmp(name, "keycreate"))
5122 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5123 else if (!strcmp(name, "sockcreate"))
5124 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5125 else if (!strcmp(name, "current"))
5126 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5132 /* Obtain a SID for the context, if one was specified. */
5133 if (size && str[1] && str[1] != '\n') {
5134 if (str[size-1] == '\n') {
5138 error = security_context_to_sid(value, size, &sid);
5143 /* Permission checking based on the specified context is
5144 performed during the actual operation (execve,
5145 open/mkdir/...), when we know the full context of the
5146 operation. See selinux_bprm_set_security for the execve
5147 checks and may_create for the file creation checks. The
5148 operation will then fail if the context is not permitted. */
5150 if (!strcmp(name, "exec"))
5151 tsec->exec_sid = sid;
5152 else if (!strcmp(name, "fscreate"))
5153 tsec->create_sid = sid;
5154 else if (!strcmp(name, "keycreate")) {
5155 error = may_create_key(sid, p);
5158 tsec->keycreate_sid = sid;
5159 } else if (!strcmp(name, "sockcreate"))
5160 tsec->sockcreate_sid = sid;
5161 else if (!strcmp(name, "current")) {
5162 struct av_decision avd;
5167 /* Only allow single threaded processes to change context */
5168 if (atomic_read(&p->mm->mm_users) != 1) {
5169 struct task_struct *g, *t;
5170 struct mm_struct *mm = p->mm;
5171 read_lock(&tasklist_lock);
5172 do_each_thread(g, t)
5173 if (t->mm == mm && t != p) {
5174 read_unlock(&tasklist_lock);
5177 while_each_thread(g, t);
5178 read_unlock(&tasklist_lock);
5181 /* Check permissions for the transition. */
5182 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5183 PROCESS__DYNTRANSITION, NULL);
5187 /* Check for ptracing, and update the task SID if ok.
5188 Otherwise, leave SID unchanged and fail. */
5191 tracer = task_tracer_task(p);
5192 if (tracer != NULL) {
5193 struct task_security_struct *ptsec = tracer->security;
5194 u32 ptsid = ptsec->sid;
5196 error = avc_has_perm_noaudit(ptsid, sid,
5198 PROCESS__PTRACE, 0, &avd);
5202 avc_audit(ptsid, sid, SECCLASS_PROCESS,
5203 PROCESS__PTRACE, &avd, error, NULL);
5218 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5220 return security_sid_to_context(secid, secdata, seclen);
5223 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5225 return security_context_to_sid(secdata, seclen, secid);
5228 static void selinux_release_secctx(char *secdata, u32 seclen)
5235 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5236 unsigned long flags)
5238 struct task_security_struct *tsec = tsk->security;
5239 struct key_security_struct *ksec;
5241 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5245 if (tsec->keycreate_sid)
5246 ksec->sid = tsec->keycreate_sid;
5248 ksec->sid = tsec->sid;
5254 static void selinux_key_free(struct key *k)
5256 struct key_security_struct *ksec = k->security;
5262 static int selinux_key_permission(key_ref_t key_ref,
5263 struct task_struct *ctx,
5267 struct task_security_struct *tsec;
5268 struct key_security_struct *ksec;
5270 key = key_ref_to_ptr(key_ref);
5272 tsec = ctx->security;
5273 ksec = key->security;
5275 /* if no specific permissions are requested, we skip the
5276 permission check. No serious, additional covert channels
5277 appear to be created. */
5281 return avc_has_perm(tsec->sid, ksec->sid,
5282 SECCLASS_KEY, perm, NULL);
5287 static struct security_operations selinux_ops = {
5288 .ptrace = selinux_ptrace,
5289 .capget = selinux_capget,
5290 .capset_check = selinux_capset_check,
5291 .capset_set = selinux_capset_set,
5292 .sysctl = selinux_sysctl,
5293 .capable = selinux_capable,
5294 .quotactl = selinux_quotactl,
5295 .quota_on = selinux_quota_on,
5296 .syslog = selinux_syslog,
5297 .vm_enough_memory = selinux_vm_enough_memory,
5299 .netlink_send = selinux_netlink_send,
5300 .netlink_recv = selinux_netlink_recv,
5302 .bprm_alloc_security = selinux_bprm_alloc_security,
5303 .bprm_free_security = selinux_bprm_free_security,
5304 .bprm_apply_creds = selinux_bprm_apply_creds,
5305 .bprm_post_apply_creds = selinux_bprm_post_apply_creds,
5306 .bprm_set_security = selinux_bprm_set_security,
5307 .bprm_check_security = selinux_bprm_check_security,
5308 .bprm_secureexec = selinux_bprm_secureexec,
5310 .sb_alloc_security = selinux_sb_alloc_security,
5311 .sb_free_security = selinux_sb_free_security,
5312 .sb_copy_data = selinux_sb_copy_data,
5313 .sb_kern_mount = selinux_sb_kern_mount,
5314 .sb_statfs = selinux_sb_statfs,
5315 .sb_mount = selinux_mount,
5316 .sb_umount = selinux_umount,
5317 .sb_get_mnt_opts = selinux_get_mnt_opts,
5318 .sb_set_mnt_opts = selinux_set_mnt_opts,
5319 .sb_clone_mnt_opts = selinux_sb_clone_mnt_opts,
5320 .sb_parse_opts_str = selinux_parse_opts_str,
5323 .inode_alloc_security = selinux_inode_alloc_security,
5324 .inode_free_security = selinux_inode_free_security,
5325 .inode_init_security = selinux_inode_init_security,
5326 .inode_create = selinux_inode_create,
5327 .inode_link = selinux_inode_link,
5328 .inode_unlink = selinux_inode_unlink,
5329 .inode_symlink = selinux_inode_symlink,
5330 .inode_mkdir = selinux_inode_mkdir,
5331 .inode_rmdir = selinux_inode_rmdir,
5332 .inode_mknod = selinux_inode_mknod,
5333 .inode_rename = selinux_inode_rename,
5334 .inode_readlink = selinux_inode_readlink,
5335 .inode_follow_link = selinux_inode_follow_link,
5336 .inode_permission = selinux_inode_permission,
5337 .inode_setattr = selinux_inode_setattr,
5338 .inode_getattr = selinux_inode_getattr,
5339 .inode_setxattr = selinux_inode_setxattr,
5340 .inode_post_setxattr = selinux_inode_post_setxattr,
5341 .inode_getxattr = selinux_inode_getxattr,
5342 .inode_listxattr = selinux_inode_listxattr,
5343 .inode_removexattr = selinux_inode_removexattr,
5344 .inode_getsecurity = selinux_inode_getsecurity,
5345 .inode_setsecurity = selinux_inode_setsecurity,
5346 .inode_listsecurity = selinux_inode_listsecurity,
5347 .inode_need_killpriv = selinux_inode_need_killpriv,
5348 .inode_killpriv = selinux_inode_killpriv,
5350 .file_permission = selinux_file_permission,
5351 .file_alloc_security = selinux_file_alloc_security,
5352 .file_free_security = selinux_file_free_security,
5353 .file_ioctl = selinux_file_ioctl,
5354 .file_mmap = selinux_file_mmap,
5355 .file_mprotect = selinux_file_mprotect,
5356 .file_lock = selinux_file_lock,
5357 .file_fcntl = selinux_file_fcntl,
5358 .file_set_fowner = selinux_file_set_fowner,
5359 .file_send_sigiotask = selinux_file_send_sigiotask,
5360 .file_receive = selinux_file_receive,
5362 .dentry_open = selinux_dentry_open,
5364 .task_create = selinux_task_create,
5365 .task_alloc_security = selinux_task_alloc_security,
5366 .task_free_security = selinux_task_free_security,
5367 .task_setuid = selinux_task_setuid,
5368 .task_post_setuid = selinux_task_post_setuid,
5369 .task_setgid = selinux_task_setgid,
5370 .task_setpgid = selinux_task_setpgid,
5371 .task_getpgid = selinux_task_getpgid,
5372 .task_getsid = selinux_task_getsid,
5373 .task_getsecid = selinux_task_getsecid,
5374 .task_setgroups = selinux_task_setgroups,
5375 .task_setnice = selinux_task_setnice,
5376 .task_setioprio = selinux_task_setioprio,
5377 .task_getioprio = selinux_task_getioprio,
5378 .task_setrlimit = selinux_task_setrlimit,
5379 .task_setscheduler = selinux_task_setscheduler,
5380 .task_getscheduler = selinux_task_getscheduler,
5381 .task_movememory = selinux_task_movememory,
5382 .task_kill = selinux_task_kill,
5383 .task_wait = selinux_task_wait,
5384 .task_prctl = selinux_task_prctl,
5385 .task_reparent_to_init = selinux_task_reparent_to_init,
5386 .task_to_inode = selinux_task_to_inode,
5388 .ipc_permission = selinux_ipc_permission,
5390 .msg_msg_alloc_security = selinux_msg_msg_alloc_security,
5391 .msg_msg_free_security = selinux_msg_msg_free_security,
5393 .msg_queue_alloc_security = selinux_msg_queue_alloc_security,
5394 .msg_queue_free_security = selinux_msg_queue_free_security,
5395 .msg_queue_associate = selinux_msg_queue_associate,
5396 .msg_queue_msgctl = selinux_msg_queue_msgctl,
5397 .msg_queue_msgsnd = selinux_msg_queue_msgsnd,
5398 .msg_queue_msgrcv = selinux_msg_queue_msgrcv,
5400 .shm_alloc_security = selinux_shm_alloc_security,
5401 .shm_free_security = selinux_shm_free_security,
5402 .shm_associate = selinux_shm_associate,
5403 .shm_shmctl = selinux_shm_shmctl,
5404 .shm_shmat = selinux_shm_shmat,
5406 .sem_alloc_security = selinux_sem_alloc_security,
5407 .sem_free_security = selinux_sem_free_security,
5408 .sem_associate = selinux_sem_associate,
5409 .sem_semctl = selinux_sem_semctl,
5410 .sem_semop = selinux_sem_semop,
5412 .register_security = selinux_register_security,
5414 .d_instantiate = selinux_d_instantiate,
5416 .getprocattr = selinux_getprocattr,
5417 .setprocattr = selinux_setprocattr,
5419 .secid_to_secctx = selinux_secid_to_secctx,
5420 .secctx_to_secid = selinux_secctx_to_secid,
5421 .release_secctx = selinux_release_secctx,
5423 .unix_stream_connect = selinux_socket_unix_stream_connect,
5424 .unix_may_send = selinux_socket_unix_may_send,
5426 .socket_create = selinux_socket_create,
5427 .socket_post_create = selinux_socket_post_create,
5428 .socket_bind = selinux_socket_bind,
5429 .socket_connect = selinux_socket_connect,
5430 .socket_listen = selinux_socket_listen,
5431 .socket_accept = selinux_socket_accept,
5432 .socket_sendmsg = selinux_socket_sendmsg,
5433 .socket_recvmsg = selinux_socket_recvmsg,
5434 .socket_getsockname = selinux_socket_getsockname,
5435 .socket_getpeername = selinux_socket_getpeername,
5436 .socket_getsockopt = selinux_socket_getsockopt,
5437 .socket_setsockopt = selinux_socket_setsockopt,
5438 .socket_shutdown = selinux_socket_shutdown,
5439 .socket_sock_rcv_skb = selinux_socket_sock_rcv_skb,
5440 .socket_getpeersec_stream = selinux_socket_getpeersec_stream,
5441 .socket_getpeersec_dgram = selinux_socket_getpeersec_dgram,
5442 .sk_alloc_security = selinux_sk_alloc_security,
5443 .sk_free_security = selinux_sk_free_security,
5444 .sk_clone_security = selinux_sk_clone_security,
5445 .sk_getsecid = selinux_sk_getsecid,
5446 .sock_graft = selinux_sock_graft,
5447 .inet_conn_request = selinux_inet_conn_request,
5448 .inet_csk_clone = selinux_inet_csk_clone,
5449 .inet_conn_established = selinux_inet_conn_established,
5450 .req_classify_flow = selinux_req_classify_flow,
5452 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5453 .xfrm_policy_alloc_security = selinux_xfrm_policy_alloc,
5454 .xfrm_policy_clone_security = selinux_xfrm_policy_clone,
5455 .xfrm_policy_free_security = selinux_xfrm_policy_free,
5456 .xfrm_policy_delete_security = selinux_xfrm_policy_delete,
5457 .xfrm_state_alloc_security = selinux_xfrm_state_alloc,
5458 .xfrm_state_free_security = selinux_xfrm_state_free,
5459 .xfrm_state_delete_security = selinux_xfrm_state_delete,
5460 .xfrm_policy_lookup = selinux_xfrm_policy_lookup,
5461 .xfrm_state_pol_flow_match = selinux_xfrm_state_pol_flow_match,
5462 .xfrm_decode_session = selinux_xfrm_decode_session,
5466 .key_alloc = selinux_key_alloc,
5467 .key_free = selinux_key_free,
5468 .key_permission = selinux_key_permission,
5472 static __init int selinux_init(void)
5474 struct task_security_struct *tsec;
5476 if (!selinux_enabled) {
5477 printk(KERN_INFO "SELinux: Disabled at boot.\n");
5481 printk(KERN_INFO "SELinux: Initializing.\n");
5483 /* Set the security state for the initial task. */
5484 if (task_alloc_security(current))
5485 panic("SELinux: Failed to initialize initial task.\n");
5486 tsec = current->security;
5487 tsec->osid = tsec->sid = SECINITSID_KERNEL;
5489 sel_inode_cache = kmem_cache_create("selinux_inode_security",
5490 sizeof(struct inode_security_struct),
5491 0, SLAB_PANIC, NULL);
5494 original_ops = secondary_ops = security_ops;
5496 panic ("SELinux: No initial security operations\n");
5497 if (register_security (&selinux_ops))
5498 panic("SELinux: Unable to register with kernel.\n");
5500 if (selinux_enforcing) {
5501 printk(KERN_DEBUG "SELinux: Starting in enforcing mode\n");
5503 printk(KERN_DEBUG "SELinux: Starting in permissive mode\n");
5507 /* Add security information to initial keyrings */
5508 selinux_key_alloc(&root_user_keyring, current,
5509 KEY_ALLOC_NOT_IN_QUOTA);
5510 selinux_key_alloc(&root_session_keyring, current,
5511 KEY_ALLOC_NOT_IN_QUOTA);
5517 void selinux_complete_init(void)
5519 printk(KERN_DEBUG "SELinux: Completing initialization.\n");
5521 /* Set up any superblocks initialized prior to the policy load. */
5522 printk(KERN_DEBUG "SELinux: Setting up existing superblocks.\n");
5523 spin_lock(&sb_lock);
5524 spin_lock(&sb_security_lock);
5526 if (!list_empty(&superblock_security_head)) {
5527 struct superblock_security_struct *sbsec =
5528 list_entry(superblock_security_head.next,
5529 struct superblock_security_struct,
5531 struct super_block *sb = sbsec->sb;
5533 spin_unlock(&sb_security_lock);
5534 spin_unlock(&sb_lock);
5535 down_read(&sb->s_umount);
5537 superblock_doinit(sb, NULL);
5539 spin_lock(&sb_lock);
5540 spin_lock(&sb_security_lock);
5541 list_del_init(&sbsec->list);
5544 spin_unlock(&sb_security_lock);
5545 spin_unlock(&sb_lock);
5548 /* SELinux requires early initialization in order to label
5549 all processes and objects when they are created. */
5550 security_initcall(selinux_init);
5552 #if defined(CONFIG_NETFILTER)
5554 static struct nf_hook_ops selinux_ipv4_ops[] = {
5556 .hook = selinux_ipv4_postroute,
5557 .owner = THIS_MODULE,
5559 .hooknum = NF_INET_POST_ROUTING,
5560 .priority = NF_IP_PRI_SELINUX_LAST,
5563 .hook = selinux_ipv4_forward,
5564 .owner = THIS_MODULE,
5566 .hooknum = NF_INET_FORWARD,
5567 .priority = NF_IP_PRI_SELINUX_FIRST,
5571 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5573 static struct nf_hook_ops selinux_ipv6_ops[] = {
5575 .hook = selinux_ipv6_postroute,
5576 .owner = THIS_MODULE,
5578 .hooknum = NF_INET_POST_ROUTING,
5579 .priority = NF_IP6_PRI_SELINUX_LAST,
5582 .hook = selinux_ipv6_forward,
5583 .owner = THIS_MODULE,
5585 .hooknum = NF_INET_FORWARD,
5586 .priority = NF_IP6_PRI_SELINUX_FIRST,
5592 static int __init selinux_nf_ip_init(void)
5597 if (!selinux_enabled)
5600 printk(KERN_DEBUG "SELinux: Registering netfilter hooks\n");
5602 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5603 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5605 panic("SELinux: nf_register_hook for IPv4: error %d\n",
5609 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5610 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5611 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5613 panic("SELinux: nf_register_hook for IPv6: error %d\n",
5622 __initcall(selinux_nf_ip_init);
5624 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5625 static void selinux_nf_ip_exit(void)
5629 printk(KERN_DEBUG "SELinux: Unregistering netfilter hooks\n");
5631 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5632 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5633 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5634 for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5635 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5640 #else /* CONFIG_NETFILTER */
5642 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5643 #define selinux_nf_ip_exit()
5646 #endif /* CONFIG_NETFILTER */
5648 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5649 int selinux_disable(void)
5651 extern void exit_sel_fs(void);
5652 static int selinux_disabled = 0;
5654 if (ss_initialized) {
5655 /* Not permitted after initial policy load. */
5659 if (selinux_disabled) {
5660 /* Only do this once. */
5664 printk(KERN_INFO "SELinux: Disabled at runtime.\n");
5666 selinux_disabled = 1;
5667 selinux_enabled = 0;
5669 /* Reset security_ops to the secondary module, dummy or capability. */
5670 security_ops = secondary_ops;
5672 /* Unregister netfilter hooks. */
5673 selinux_nf_ip_exit();
5675 /* Unregister selinuxfs. */