1 // SPDX-License-Identifier: GPL-2.0-only
3 * NSA Security-Enhanced Linux (SELinux) security module
5 * This file contains the SELinux hook function implementations.
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
24 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
55 #include <net/ip.h> /* for local_port_range[] */
56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h> /* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h> /* for Unix socket types */
74 #include <net/af_unix.h> /* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
103 #include "netlabel.h"
107 struct selinux_state selinux_state;
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
115 static int __init enforcing_setup(char *str)
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
122 __setup("enforcing=", enforcing_setup);
124 #define selinux_enforcing_boot 1
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled_boot = enabled ? 1 : 0;
136 __setup("selinux=", selinux_enabled_setup);
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
142 static int __init checkreqprot_setup(char *str)
144 unsigned long checkreqprot;
146 if (!kstrtoul(str, 0, &checkreqprot)) {
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
149 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n");
153 __setup("checkreqprot=", checkreqprot_setup);
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
166 static int selinux_secmark_enabled(void)
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
182 static int selinux_peerlbl_enabled(void)
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
188 static int selinux_netcache_avc_callback(u32 event)
190 if (event == AVC_CALLBACK_RESET) {
199 static int selinux_lsm_notifier_avc_callback(u32 event)
201 if (event == AVC_CALLBACK_RESET) {
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
210 * initialise the security for the init task
212 static void cred_init_security(void)
214 struct cred *cred = (struct cred *) current->real_cred;
215 struct task_security_struct *tsec;
217 tsec = selinux_cred(cred);
218 tsec->osid = tsec->sid = SECINITSID_KERNEL;
222 * get the security ID of a set of credentials
224 static inline u32 cred_sid(const struct cred *cred)
226 const struct task_security_struct *tsec;
228 tsec = selinux_cred(cred);
233 * get the subjective security ID of a task
235 static inline u32 task_sid_subj(const struct task_struct *task)
240 sid = cred_sid(rcu_dereference(task->cred));
246 * get the objective security ID of a task
248 static inline u32 task_sid_obj(const struct task_struct *task)
253 sid = cred_sid(__task_cred(task));
259 * get the security ID of a task for use with binder
261 static inline u32 task_sid_binder(const struct task_struct *task)
264 * In many case where this function is used we should be using the
265 * task's subjective SID, but we can't reliably access the subjective
266 * creds of a task other than our own so we must use the objective
267 * creds/SID, which are safe to access. The downside is that if a task
268 * is temporarily overriding it's creds it will not be reflected here;
269 * however, it isn't clear that binder would handle that case well
272 * If this ever changes and we can safely reference the subjective
273 * creds/SID of another task, this function will make it easier to
274 * identify the various places where we make use of the task SIDs in
275 * the binder code. It is also likely that we will need to adjust
276 * the main drivers/android binder code as well.
278 return task_sid_obj(task);
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
284 * Try reloading inode security labels that have been marked as invalid. The
285 * @may_sleep parameter indicates when sleeping and thus reloading labels is
286 * allowed; when set to false, returns -ECHILD when the label is
287 * invalid. The @dentry parameter should be set to a dentry of the inode.
289 static int __inode_security_revalidate(struct inode *inode,
290 struct dentry *dentry,
293 struct inode_security_struct *isec = selinux_inode(inode);
295 might_sleep_if(may_sleep);
297 if (selinux_initialized(&selinux_state) &&
298 isec->initialized != LABEL_INITIALIZED) {
303 * Try reloading the inode security label. This will fail if
304 * @opt_dentry is NULL and no dentry for this inode can be
305 * found; in that case, continue using the old label.
307 inode_doinit_with_dentry(inode, dentry);
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
314 return selinux_inode(inode);
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
321 error = __inode_security_revalidate(inode, NULL, !rcu);
323 return ERR_PTR(error);
324 return selinux_inode(inode);
328 * Get the security label of an inode.
330 static struct inode_security_struct *inode_security(struct inode *inode)
332 __inode_security_revalidate(inode, NULL, true);
333 return selinux_inode(inode);
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
338 struct inode *inode = d_backing_inode(dentry);
340 return selinux_inode(inode);
344 * Get the security label of a dentry's backing inode.
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
348 struct inode *inode = d_backing_inode(dentry);
350 __inode_security_revalidate(inode, dentry, true);
351 return selinux_inode(inode);
354 static void inode_free_security(struct inode *inode)
356 struct inode_security_struct *isec = selinux_inode(inode);
357 struct superblock_security_struct *sbsec;
361 sbsec = selinux_superblock(inode->i_sb);
363 * As not all inode security structures are in a list, we check for
364 * empty list outside of the lock to make sure that we won't waste
365 * time taking a lock doing nothing.
367 * The list_del_init() function can be safely called more than once.
368 * It should not be possible for this function to be called with
369 * concurrent list_add(), but for better safety against future changes
370 * in the code, we use list_empty_careful() here.
372 if (!list_empty_careful(&isec->list)) {
373 spin_lock(&sbsec->isec_lock);
374 list_del_init(&isec->list);
375 spin_unlock(&sbsec->isec_lock);
379 struct selinux_mnt_opts {
380 const char *fscontext, *context, *rootcontext, *defcontext;
383 static void selinux_free_mnt_opts(void *mnt_opts)
385 struct selinux_mnt_opts *opts = mnt_opts;
386 kfree(opts->fscontext);
387 kfree(opts->context);
388 kfree(opts->rootcontext);
389 kfree(opts->defcontext);
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
412 A(rootcontext, true),
417 static int match_opt_prefix(char *s, int l, char **arg)
421 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 size_t len = tokens[i].len;
423 if (len > l || memcmp(s, tokens[i].name, len))
425 if (tokens[i].has_arg) {
426 if (len == l || s[len] != '=')
431 return tokens[i].opt;
436 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
438 static int may_context_mount_sb_relabel(u32 sid,
439 struct superblock_security_struct *sbsec,
440 const struct cred *cred)
442 const struct task_security_struct *tsec = selinux_cred(cred);
445 rc = avc_has_perm(&selinux_state,
446 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 FILESYSTEM__RELABELFROM, NULL);
451 rc = avc_has_perm(&selinux_state,
452 tsec->sid, sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELTO, NULL);
457 static int may_context_mount_inode_relabel(u32 sid,
458 struct superblock_security_struct *sbsec,
459 const struct cred *cred)
461 const struct task_security_struct *tsec = selinux_cred(cred);
463 rc = avc_has_perm(&selinux_state,
464 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
469 rc = avc_has_perm(&selinux_state,
470 sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 FILESYSTEM__ASSOCIATE, NULL);
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
477 /* Special handling. Genfs but also in-core setxattr handler */
478 return !strcmp(sb->s_type->name, "sysfs") ||
479 !strcmp(sb->s_type->name, "pstore") ||
480 !strcmp(sb->s_type->name, "debugfs") ||
481 !strcmp(sb->s_type->name, "tracefs") ||
482 !strcmp(sb->s_type->name, "rootfs") ||
483 (selinux_policycap_cgroupseclabel() &&
484 (!strcmp(sb->s_type->name, "cgroup") ||
485 !strcmp(sb->s_type->name, "cgroup2")));
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
490 struct superblock_security_struct *sbsec = selinux_superblock(sb);
493 * IMPORTANT: Double-check logic in this function when adding a new
494 * SECURITY_FS_USE_* definition!
496 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
498 switch (sbsec->behavior) {
499 case SECURITY_FS_USE_XATTR:
500 case SECURITY_FS_USE_TRANS:
501 case SECURITY_FS_USE_TASK:
502 case SECURITY_FS_USE_NATIVE:
505 case SECURITY_FS_USE_GENFS:
506 return selinux_is_genfs_special_handling(sb);
508 /* Never allow relabeling on context mounts */
509 case SECURITY_FS_USE_MNTPOINT:
510 case SECURITY_FS_USE_NONE:
516 static int sb_check_xattr_support(struct super_block *sb)
518 struct superblock_security_struct *sbsec = sb->s_security;
519 struct dentry *root = sb->s_root;
520 struct inode *root_inode = d_backing_inode(root);
525 * Make sure that the xattr handler exists and that no
526 * error other than -ENODATA is returned by getxattr on
527 * the root directory. -ENODATA is ok, as this may be
528 * the first boot of the SELinux kernel before we have
529 * assigned xattr values to the filesystem.
531 if (!(root_inode->i_opflags & IOP_XATTR)) {
532 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 sb->s_id, sb->s_type->name);
537 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 if (rc < 0 && rc != -ENODATA) {
539 if (rc == -EOPNOTSUPP) {
540 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 sb->s_id, sb->s_type->name);
544 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 sb->s_id, sb->s_type->name, -rc);
552 /* No xattr support - try to fallback to genfs if possible. */
553 rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
558 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 sb->s_id, sb->s_type->name);
560 sbsec->behavior = SECURITY_FS_USE_GENFS;
565 static int sb_finish_set_opts(struct super_block *sb)
567 struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 struct dentry *root = sb->s_root;
569 struct inode *root_inode = d_backing_inode(root);
572 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 rc = sb_check_xattr_support(sb);
578 sbsec->flags |= SE_SBINITIALIZED;
581 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
582 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 * us a superblock that needs the flag to be cleared.
585 if (selinux_is_sblabel_mnt(sb))
586 sbsec->flags |= SBLABEL_MNT;
588 sbsec->flags &= ~SBLABEL_MNT;
590 /* Initialize the root inode. */
591 rc = inode_doinit_with_dentry(root_inode, root);
593 /* Initialize any other inodes associated with the superblock, e.g.
594 inodes created prior to initial policy load or inodes created
595 during get_sb by a pseudo filesystem that directly
597 spin_lock(&sbsec->isec_lock);
598 while (!list_empty(&sbsec->isec_head)) {
599 struct inode_security_struct *isec =
600 list_first_entry(&sbsec->isec_head,
601 struct inode_security_struct, list);
602 struct inode *inode = isec->inode;
603 list_del_init(&isec->list);
604 spin_unlock(&sbsec->isec_lock);
605 inode = igrab(inode);
607 if (!IS_PRIVATE(inode))
608 inode_doinit_with_dentry(inode, NULL);
611 spin_lock(&sbsec->isec_lock);
613 spin_unlock(&sbsec->isec_lock);
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 u32 old_sid, u32 new_sid)
620 char mnt_flags = sbsec->flags & SE_MNTMASK;
622 /* check if the old mount command had the same options */
623 if (sbsec->flags & SE_SBINITIALIZED)
624 if (!(sbsec->flags & flag) ||
625 (old_sid != new_sid))
628 /* check if we were passed the same options twice,
629 * aka someone passed context=a,context=b
631 if (!(sbsec->flags & SE_SBINITIALIZED))
632 if (mnt_flags & flag)
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
639 int rc = security_context_str_to_sid(&selinux_state, s,
642 pr_warn("SELinux: security_context_str_to_sid"
643 "(%s) failed for (dev %s, type %s) errno=%d\n",
644 s, sb->s_id, sb->s_type->name, rc);
649 * Allow filesystems with binary mount data to explicitly set mount point
650 * labeling information.
652 static int selinux_set_mnt_opts(struct super_block *sb,
654 unsigned long kern_flags,
655 unsigned long *set_kern_flags)
657 const struct cred *cred = current_cred();
658 struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 struct dentry *root = sb->s_root;
660 struct selinux_mnt_opts *opts = mnt_opts;
661 struct inode_security_struct *root_isec;
662 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 u32 defcontext_sid = 0;
666 mutex_lock(&sbsec->lock);
668 if (!selinux_initialized(&selinux_state)) {
670 /* Defer initialization until selinux_complete_init,
671 after the initial policy is loaded and the security
672 server is ready to handle calls. */
676 pr_warn("SELinux: Unable to set superblock options "
677 "before the security server is initialized\n");
680 if (kern_flags && !set_kern_flags) {
681 /* Specifying internal flags without providing a place to
682 * place the results is not allowed */
688 * Binary mount data FS will come through this function twice. Once
689 * from an explicit call and once from the generic calls from the vfs.
690 * Since the generic VFS calls will not contain any security mount data
691 * we need to skip the double mount verification.
693 * This does open a hole in which we will not notice if the first
694 * mount using this sb set explict options and a second mount using
695 * this sb does not set any security options. (The first options
696 * will be used for both mounts)
698 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
702 root_isec = backing_inode_security_novalidate(root);
705 * parse the mount options, check if they are valid sids.
706 * also check if someone is trying to mount the same sb more
707 * than once with different security options.
710 if (opts->fscontext) {
711 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
714 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
716 goto out_double_mount;
717 sbsec->flags |= FSCONTEXT_MNT;
720 rc = parse_sid(sb, opts->context, &context_sid);
723 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
725 goto out_double_mount;
726 sbsec->flags |= CONTEXT_MNT;
728 if (opts->rootcontext) {
729 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
732 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
734 goto out_double_mount;
735 sbsec->flags |= ROOTCONTEXT_MNT;
737 if (opts->defcontext) {
738 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
741 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
743 goto out_double_mount;
744 sbsec->flags |= DEFCONTEXT_MNT;
748 if (sbsec->flags & SE_SBINITIALIZED) {
749 /* previously mounted with options, but not on this attempt? */
750 if ((sbsec->flags & SE_MNTMASK) && !opts)
751 goto out_double_mount;
756 if (strcmp(sb->s_type->name, "proc") == 0)
757 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
759 if (!strcmp(sb->s_type->name, "debugfs") ||
760 !strcmp(sb->s_type->name, "tracefs") ||
761 !strcmp(sb->s_type->name, "binder") ||
762 !strcmp(sb->s_type->name, "bpf") ||
763 !strcmp(sb->s_type->name, "pstore"))
764 sbsec->flags |= SE_SBGENFS;
766 if (!strcmp(sb->s_type->name, "sysfs") ||
767 !strcmp(sb->s_type->name, "cgroup") ||
768 !strcmp(sb->s_type->name, "cgroup2"))
769 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
771 if (!sbsec->behavior) {
773 * Determine the labeling behavior to use for this
776 rc = security_fs_use(&selinux_state, sb);
778 pr_warn("%s: security_fs_use(%s) returned %d\n",
779 __func__, sb->s_type->name, rc);
785 * If this is a user namespace mount and the filesystem type is not
786 * explicitly whitelisted, then no contexts are allowed on the command
787 * line and security labels must be ignored.
789 if (sb->s_user_ns != &init_user_ns &&
790 strcmp(sb->s_type->name, "tmpfs") &&
791 strcmp(sb->s_type->name, "ramfs") &&
792 strcmp(sb->s_type->name, "devpts") &&
793 strcmp(sb->s_type->name, "overlay")) {
794 if (context_sid || fscontext_sid || rootcontext_sid ||
799 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 rc = security_transition_sid(&selinux_state,
805 &sbsec->mntpoint_sid);
812 /* sets the context of the superblock for the fs being mounted. */
814 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
818 sbsec->sid = fscontext_sid;
822 * Switch to using mount point labeling behavior.
823 * sets the label used on all file below the mountpoint, and will set
824 * the superblock context if not already set.
826 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
832 if (!fscontext_sid) {
833 rc = may_context_mount_sb_relabel(context_sid, sbsec,
837 sbsec->sid = context_sid;
839 rc = may_context_mount_inode_relabel(context_sid, sbsec,
844 if (!rootcontext_sid)
845 rootcontext_sid = context_sid;
847 sbsec->mntpoint_sid = context_sid;
848 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
851 if (rootcontext_sid) {
852 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
857 root_isec->sid = rootcontext_sid;
858 root_isec->initialized = LABEL_INITIALIZED;
861 if (defcontext_sid) {
862 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
865 pr_warn("SELinux: defcontext option is "
866 "invalid for this filesystem type\n");
870 if (defcontext_sid != sbsec->def_sid) {
871 rc = may_context_mount_inode_relabel(defcontext_sid,
877 sbsec->def_sid = defcontext_sid;
881 rc = sb_finish_set_opts(sb);
883 mutex_unlock(&sbsec->lock);
887 pr_warn("SELinux: mount invalid. Same superblock, different "
888 "security settings for (dev %s, type %s)\n", sb->s_id,
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 const struct super_block *newsb)
896 struct superblock_security_struct *old = selinux_superblock(oldsb);
897 struct superblock_security_struct *new = selinux_superblock(newsb);
898 char oldflags = old->flags & SE_MNTMASK;
899 char newflags = new->flags & SE_MNTMASK;
901 if (oldflags != newflags)
903 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
905 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
907 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
909 if (oldflags & ROOTCONTEXT_MNT) {
910 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 if (oldroot->sid != newroot->sid)
917 pr_warn("SELinux: mount invalid. Same superblock, "
918 "different security settings for (dev %s, "
919 "type %s)\n", newsb->s_id, newsb->s_type->name);
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 struct super_block *newsb,
925 unsigned long kern_flags,
926 unsigned long *set_kern_flags)
929 const struct superblock_security_struct *oldsbsec =
930 selinux_superblock(oldsb);
931 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
933 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
934 int set_context = (oldsbsec->flags & CONTEXT_MNT);
935 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
938 * if the parent was able to be mounted it clearly had no special lsm
939 * mount options. thus we can safely deal with this superblock later
941 if (!selinux_initialized(&selinux_state))
945 * Specifying internal flags without providing a place to
946 * place the results is not allowed.
948 if (kern_flags && !set_kern_flags)
951 /* how can we clone if the old one wasn't set up?? */
952 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
954 /* if fs is reusing a sb, make sure that the contexts match */
955 if (newsbsec->flags & SE_SBINITIALIZED) {
956 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 return selinux_cmp_sb_context(oldsb, newsb);
961 mutex_lock(&newsbsec->lock);
963 newsbsec->flags = oldsbsec->flags;
965 newsbsec->sid = oldsbsec->sid;
966 newsbsec->def_sid = oldsbsec->def_sid;
967 newsbsec->behavior = oldsbsec->behavior;
969 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 rc = security_fs_use(&selinux_state, newsb);
976 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
982 u32 sid = oldsbsec->mntpoint_sid;
986 if (!set_rootcontext) {
987 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
990 newsbsec->mntpoint_sid = sid;
992 if (set_rootcontext) {
993 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
996 newisec->sid = oldisec->sid;
999 sb_finish_set_opts(newsb);
1001 mutex_unlock(&newsbsec->lock);
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1007 struct selinux_mnt_opts *opts = *mnt_opts;
1009 if (token == Opt_seclabel) /* eaten and completely ignored */
1013 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1022 if (opts->context || opts->defcontext)
1027 if (opts->fscontext)
1029 opts->fscontext = s;
1031 case Opt_rootcontext:
1032 if (opts->rootcontext)
1034 opts->rootcontext = s;
1036 case Opt_defcontext:
1037 if (opts->context || opts->defcontext)
1039 opts->defcontext = s;
1044 pr_warn(SEL_MOUNT_FAIL_MSG);
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1051 int token = Opt_error;
1054 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 if (strcmp(option, tokens[i].name) == 0) {
1056 token = tokens[i].opt;
1061 if (token == Opt_error)
1064 if (token != Opt_seclabel) {
1065 val = kmemdup_nul(val, len, GFP_KERNEL);
1071 rc = selinux_add_opt(token, val, mnt_opts);
1080 selinux_free_mnt_opts(*mnt_opts);
1086 static int show_sid(struct seq_file *m, u32 sid)
1088 char *context = NULL;
1092 rc = security_sid_to_context(&selinux_state, sid,
1095 bool has_comma = context && strchr(context, ',');
1100 seq_escape(m, context, "\"\n\\");
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1110 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1113 if (!(sbsec->flags & SE_SBINITIALIZED))
1116 if (!selinux_initialized(&selinux_state))
1119 if (sbsec->flags & FSCONTEXT_MNT) {
1121 seq_puts(m, FSCONTEXT_STR);
1122 rc = show_sid(m, sbsec->sid);
1126 if (sbsec->flags & CONTEXT_MNT) {
1128 seq_puts(m, CONTEXT_STR);
1129 rc = show_sid(m, sbsec->mntpoint_sid);
1133 if (sbsec->flags & DEFCONTEXT_MNT) {
1135 seq_puts(m, DEFCONTEXT_STR);
1136 rc = show_sid(m, sbsec->def_sid);
1140 if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 struct dentry *root = sb->s_root;
1142 struct inode_security_struct *isec = backing_inode_security(root);
1144 seq_puts(m, ROOTCONTEXT_STR);
1145 rc = show_sid(m, isec->sid);
1149 if (sbsec->flags & SBLABEL_MNT) {
1151 seq_puts(m, SECLABEL_STR);
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1158 switch (mode & S_IFMT) {
1160 return SECCLASS_SOCK_FILE;
1162 return SECCLASS_LNK_FILE;
1164 return SECCLASS_FILE;
1166 return SECCLASS_BLK_FILE;
1168 return SECCLASS_DIR;
1170 return SECCLASS_CHR_FILE;
1172 return SECCLASS_FIFO_FILE;
1176 return SECCLASS_FILE;
1179 static inline int default_protocol_stream(int protocol)
1181 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 protocol == IPPROTO_MPTCP);
1185 static inline int default_protocol_dgram(int protocol)
1187 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1192 int extsockclass = selinux_policycap_extsockclass();
1198 case SOCK_SEQPACKET:
1199 return SECCLASS_UNIX_STREAM_SOCKET;
1202 return SECCLASS_UNIX_DGRAM_SOCKET;
1209 case SOCK_SEQPACKET:
1210 if (default_protocol_stream(protocol))
1211 return SECCLASS_TCP_SOCKET;
1212 else if (extsockclass && protocol == IPPROTO_SCTP)
1213 return SECCLASS_SCTP_SOCKET;
1215 return SECCLASS_RAWIP_SOCKET;
1217 if (default_protocol_dgram(protocol))
1218 return SECCLASS_UDP_SOCKET;
1219 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 protocol == IPPROTO_ICMPV6))
1221 return SECCLASS_ICMP_SOCKET;
1223 return SECCLASS_RAWIP_SOCKET;
1225 return SECCLASS_DCCP_SOCKET;
1227 return SECCLASS_RAWIP_SOCKET;
1233 return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 case NETLINK_SOCK_DIAG:
1235 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1237 return SECCLASS_NETLINK_NFLOG_SOCKET;
1239 return SECCLASS_NETLINK_XFRM_SOCKET;
1240 case NETLINK_SELINUX:
1241 return SECCLASS_NETLINK_SELINUX_SOCKET;
1243 return SECCLASS_NETLINK_ISCSI_SOCKET;
1245 return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 case NETLINK_FIB_LOOKUP:
1247 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 case NETLINK_CONNECTOR:
1249 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 case NETLINK_NETFILTER:
1251 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 case NETLINK_DNRTMSG:
1253 return SECCLASS_NETLINK_DNRT_SOCKET;
1254 case NETLINK_KOBJECT_UEVENT:
1255 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 case NETLINK_GENERIC:
1257 return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 case NETLINK_SCSITRANSPORT:
1259 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1261 return SECCLASS_NETLINK_RDMA_SOCKET;
1262 case NETLINK_CRYPTO:
1263 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1265 return SECCLASS_NETLINK_SOCKET;
1268 return SECCLASS_PACKET_SOCKET;
1270 return SECCLASS_KEY_SOCKET;
1272 return SECCLASS_APPLETALK_SOCKET;
1278 return SECCLASS_AX25_SOCKET;
1280 return SECCLASS_IPX_SOCKET;
1282 return SECCLASS_NETROM_SOCKET;
1284 return SECCLASS_ATMPVC_SOCKET;
1286 return SECCLASS_X25_SOCKET;
1288 return SECCLASS_ROSE_SOCKET;
1290 return SECCLASS_DECNET_SOCKET;
1292 return SECCLASS_ATMSVC_SOCKET;
1294 return SECCLASS_RDS_SOCKET;
1296 return SECCLASS_IRDA_SOCKET;
1298 return SECCLASS_PPPOX_SOCKET;
1300 return SECCLASS_LLC_SOCKET;
1302 return SECCLASS_CAN_SOCKET;
1304 return SECCLASS_TIPC_SOCKET;
1306 return SECCLASS_BLUETOOTH_SOCKET;
1308 return SECCLASS_IUCV_SOCKET;
1310 return SECCLASS_RXRPC_SOCKET;
1312 return SECCLASS_ISDN_SOCKET;
1314 return SECCLASS_PHONET_SOCKET;
1316 return SECCLASS_IEEE802154_SOCKET;
1318 return SECCLASS_CAIF_SOCKET;
1320 return SECCLASS_ALG_SOCKET;
1322 return SECCLASS_NFC_SOCKET;
1324 return SECCLASS_VSOCK_SOCKET;
1326 return SECCLASS_KCM_SOCKET;
1328 return SECCLASS_QIPCRTR_SOCKET;
1330 return SECCLASS_SMC_SOCKET;
1332 return SECCLASS_XDP_SOCKET;
1334 #error New address family defined, please update this function.
1339 return SECCLASS_SOCKET;
1342 static int selinux_genfs_get_sid(struct dentry *dentry,
1348 struct super_block *sb = dentry->d_sb;
1349 char *buffer, *path;
1351 buffer = (char *)__get_free_page(GFP_KERNEL);
1355 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1359 if (flags & SE_SBPROC) {
1360 /* each process gets a /proc/PID/ entry. Strip off the
1361 * PID part to get a valid selinux labeling.
1362 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1363 while (path[1] >= '0' && path[1] <= '9') {
1368 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1370 if (rc == -ENOENT) {
1371 /* No match in policy, mark as unlabeled. */
1372 *sid = SECINITSID_UNLABELED;
1376 free_page((unsigned long)buffer);
1380 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1381 u32 def_sid, u32 *sid)
1383 #define INITCONTEXTLEN 255
1388 len = INITCONTEXTLEN;
1389 context = kmalloc(len + 1, GFP_NOFS);
1393 context[len] = '\0';
1394 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1395 if (rc == -ERANGE) {
1398 /* Need a larger buffer. Query for the right size. */
1399 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1404 context = kmalloc(len + 1, GFP_NOFS);
1408 context[len] = '\0';
1409 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1414 if (rc != -ENODATA) {
1415 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1416 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1423 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1426 char *dev = inode->i_sb->s_id;
1427 unsigned long ino = inode->i_ino;
1429 if (rc == -EINVAL) {
1430 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1433 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1434 __func__, context, -rc, dev, ino);
1441 /* The inode's security attributes must be initialized before first use. */
1442 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1444 struct superblock_security_struct *sbsec = NULL;
1445 struct inode_security_struct *isec = selinux_inode(inode);
1446 u32 task_sid, sid = 0;
1448 struct dentry *dentry;
1451 if (isec->initialized == LABEL_INITIALIZED)
1454 spin_lock(&isec->lock);
1455 if (isec->initialized == LABEL_INITIALIZED)
1458 if (isec->sclass == SECCLASS_FILE)
1459 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1461 sbsec = selinux_superblock(inode->i_sb);
1462 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1463 /* Defer initialization until selinux_complete_init,
1464 after the initial policy is loaded and the security
1465 server is ready to handle calls. */
1466 spin_lock(&sbsec->isec_lock);
1467 if (list_empty(&isec->list))
1468 list_add(&isec->list, &sbsec->isec_head);
1469 spin_unlock(&sbsec->isec_lock);
1473 sclass = isec->sclass;
1474 task_sid = isec->task_sid;
1476 isec->initialized = LABEL_PENDING;
1477 spin_unlock(&isec->lock);
1479 switch (sbsec->behavior) {
1480 case SECURITY_FS_USE_NATIVE:
1482 case SECURITY_FS_USE_XATTR:
1483 if (!(inode->i_opflags & IOP_XATTR)) {
1484 sid = sbsec->def_sid;
1487 /* Need a dentry, since the xattr API requires one.
1488 Life would be simpler if we could just pass the inode. */
1490 /* Called from d_instantiate or d_splice_alias. */
1491 dentry = dget(opt_dentry);
1494 * Called from selinux_complete_init, try to find a dentry.
1495 * Some filesystems really want a connected one, so try
1496 * that first. We could split SECURITY_FS_USE_XATTR in
1497 * two, depending upon that...
1499 dentry = d_find_alias(inode);
1501 dentry = d_find_any_alias(inode);
1505 * this is can be hit on boot when a file is accessed
1506 * before the policy is loaded. When we load policy we
1507 * may find inodes that have no dentry on the
1508 * sbsec->isec_head list. No reason to complain as these
1509 * will get fixed up the next time we go through
1510 * inode_doinit with a dentry, before these inodes could
1511 * be used again by userspace.
1516 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1522 case SECURITY_FS_USE_TASK:
1525 case SECURITY_FS_USE_TRANS:
1526 /* Default to the fs SID. */
1529 /* Try to obtain a transition SID. */
1530 rc = security_transition_sid(&selinux_state, task_sid, sid,
1531 sclass, NULL, &sid);
1535 case SECURITY_FS_USE_MNTPOINT:
1536 sid = sbsec->mntpoint_sid;
1539 /* Default to the fs superblock SID. */
1542 if ((sbsec->flags & SE_SBGENFS) &&
1543 (!S_ISLNK(inode->i_mode) ||
1544 selinux_policycap_genfs_seclabel_symlinks())) {
1545 /* We must have a dentry to determine the label on
1548 /* Called from d_instantiate or
1549 * d_splice_alias. */
1550 dentry = dget(opt_dentry);
1552 /* Called from selinux_complete_init, try to
1553 * find a dentry. Some filesystems really want
1554 * a connected one, so try that first.
1556 dentry = d_find_alias(inode);
1558 dentry = d_find_any_alias(inode);
1561 * This can be hit on boot when a file is accessed
1562 * before the policy is loaded. When we load policy we
1563 * may find inodes that have no dentry on the
1564 * sbsec->isec_head list. No reason to complain as
1565 * these will get fixed up the next time we go through
1566 * inode_doinit() with a dentry, before these inodes
1567 * could be used again by userspace.
1571 rc = selinux_genfs_get_sid(dentry, sclass,
1572 sbsec->flags, &sid);
1578 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1579 (inode->i_opflags & IOP_XATTR)) {
1580 rc = inode_doinit_use_xattr(inode, dentry,
1593 spin_lock(&isec->lock);
1594 if (isec->initialized == LABEL_PENDING) {
1596 isec->initialized = LABEL_INVALID;
1599 isec->initialized = LABEL_INITIALIZED;
1604 spin_unlock(&isec->lock);
1608 spin_lock(&isec->lock);
1609 if (isec->initialized == LABEL_PENDING) {
1610 isec->initialized = LABEL_INVALID;
1613 spin_unlock(&isec->lock);
1617 /* Convert a Linux signal to an access vector. */
1618 static inline u32 signal_to_av(int sig)
1624 /* Commonly granted from child to parent. */
1625 perm = PROCESS__SIGCHLD;
1628 /* Cannot be caught or ignored */
1629 perm = PROCESS__SIGKILL;
1632 /* Cannot be caught or ignored */
1633 perm = PROCESS__SIGSTOP;
1636 /* All other signals. */
1637 perm = PROCESS__SIGNAL;
1644 #if CAP_LAST_CAP > 63
1645 #error Fix SELinux to handle capabilities > 63.
1648 /* Check whether a task is allowed to use a capability. */
1649 static int cred_has_capability(const struct cred *cred,
1650 int cap, unsigned int opts, bool initns)
1652 struct common_audit_data ad;
1653 struct av_decision avd;
1655 u32 sid = cred_sid(cred);
1656 u32 av = CAP_TO_MASK(cap);
1659 ad.type = LSM_AUDIT_DATA_CAP;
1662 switch (CAP_TO_INDEX(cap)) {
1664 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1667 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1670 pr_err("SELinux: out of range capability %d\n", cap);
1675 rc = avc_has_perm_noaudit(&selinux_state,
1676 sid, sid, sclass, av, 0, &avd);
1677 if (!(opts & CAP_OPT_NOAUDIT)) {
1678 int rc2 = avc_audit(&selinux_state,
1679 sid, sid, sclass, av, &avd, rc, &ad, 0);
1686 /* Check whether a task has a particular permission to an inode.
1687 The 'adp' parameter is optional and allows other audit
1688 data to be passed (e.g. the dentry). */
1689 static int inode_has_perm(const struct cred *cred,
1690 struct inode *inode,
1692 struct common_audit_data *adp)
1694 struct inode_security_struct *isec;
1697 validate_creds(cred);
1699 if (unlikely(IS_PRIVATE(inode)))
1702 sid = cred_sid(cred);
1703 isec = selinux_inode(inode);
1705 return avc_has_perm(&selinux_state,
1706 sid, isec->sid, isec->sclass, perms, adp);
1709 /* Same as inode_has_perm, but pass explicit audit data containing
1710 the dentry to help the auditing code to more easily generate the
1711 pathname if needed. */
1712 static inline int dentry_has_perm(const struct cred *cred,
1713 struct dentry *dentry,
1716 struct inode *inode = d_backing_inode(dentry);
1717 struct common_audit_data ad;
1719 ad.type = LSM_AUDIT_DATA_DENTRY;
1720 ad.u.dentry = dentry;
1721 __inode_security_revalidate(inode, dentry, true);
1722 return inode_has_perm(cred, inode, av, &ad);
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726 the path to help the auditing code to more easily generate the
1727 pathname if needed. */
1728 static inline int path_has_perm(const struct cred *cred,
1729 const struct path *path,
1732 struct inode *inode = d_backing_inode(path->dentry);
1733 struct common_audit_data ad;
1735 ad.type = LSM_AUDIT_DATA_PATH;
1737 __inode_security_revalidate(inode, path->dentry, true);
1738 return inode_has_perm(cred, inode, av, &ad);
1741 /* Same as path_has_perm, but uses the inode from the file struct. */
1742 static inline int file_path_has_perm(const struct cred *cred,
1746 struct common_audit_data ad;
1748 ad.type = LSM_AUDIT_DATA_FILE;
1750 return inode_has_perm(cred, file_inode(file), av, &ad);
1753 #ifdef CONFIG_BPF_SYSCALL
1754 static int bpf_fd_pass(struct file *file, u32 sid);
1757 /* Check whether a task can use an open file descriptor to
1758 access an inode in a given way. Check access to the
1759 descriptor itself, and then use dentry_has_perm to
1760 check a particular permission to the file.
1761 Access to the descriptor is implicitly granted if it
1762 has the same SID as the process. If av is zero, then
1763 access to the file is not checked, e.g. for cases
1764 where only the descriptor is affected like seek. */
1765 static int file_has_perm(const struct cred *cred,
1769 struct file_security_struct *fsec = selinux_file(file);
1770 struct inode *inode = file_inode(file);
1771 struct common_audit_data ad;
1772 u32 sid = cred_sid(cred);
1775 ad.type = LSM_AUDIT_DATA_FILE;
1778 if (sid != fsec->sid) {
1779 rc = avc_has_perm(&selinux_state,
1788 #ifdef CONFIG_BPF_SYSCALL
1789 rc = bpf_fd_pass(file, cred_sid(cred));
1794 /* av is zero if only checking access to the descriptor. */
1797 rc = inode_has_perm(cred, inode, av, &ad);
1804 * Determine the label for an inode that might be unioned.
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1809 const struct qstr *name, u16 tclass,
1812 const struct superblock_security_struct *sbsec =
1813 selinux_superblock(dir->i_sb);
1815 if ((sbsec->flags & SE_SBINITIALIZED) &&
1816 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1817 *_new_isid = sbsec->mntpoint_sid;
1818 } else if ((sbsec->flags & SBLABEL_MNT) &&
1820 *_new_isid = tsec->create_sid;
1822 const struct inode_security_struct *dsec = inode_security(dir);
1823 return security_transition_sid(&selinux_state, tsec->sid,
1831 /* Check whether a task can create a file. */
1832 static int may_create(struct inode *dir,
1833 struct dentry *dentry,
1836 const struct task_security_struct *tsec = selinux_cred(current_cred());
1837 struct inode_security_struct *dsec;
1838 struct superblock_security_struct *sbsec;
1840 struct common_audit_data ad;
1843 dsec = inode_security(dir);
1844 sbsec = selinux_superblock(dir->i_sb);
1848 ad.type = LSM_AUDIT_DATA_DENTRY;
1849 ad.u.dentry = dentry;
1851 rc = avc_has_perm(&selinux_state,
1852 sid, dsec->sid, SECCLASS_DIR,
1853 DIR__ADD_NAME | DIR__SEARCH,
1858 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1863 rc = avc_has_perm(&selinux_state,
1864 sid, newsid, tclass, FILE__CREATE, &ad);
1868 return avc_has_perm(&selinux_state,
1870 SECCLASS_FILESYSTEM,
1871 FILESYSTEM__ASSOCIATE, &ad);
1875 #define MAY_UNLINK 1
1878 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1879 static int may_link(struct inode *dir,
1880 struct dentry *dentry,
1884 struct inode_security_struct *dsec, *isec;
1885 struct common_audit_data ad;
1886 u32 sid = current_sid();
1890 dsec = inode_security(dir);
1891 isec = backing_inode_security(dentry);
1893 ad.type = LSM_AUDIT_DATA_DENTRY;
1894 ad.u.dentry = dentry;
1897 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1898 rc = avc_has_perm(&selinux_state,
1899 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1914 pr_warn("SELinux: %s: unrecognized kind %d\n",
1919 rc = avc_has_perm(&selinux_state,
1920 sid, isec->sid, isec->sclass, av, &ad);
1924 static inline int may_rename(struct inode *old_dir,
1925 struct dentry *old_dentry,
1926 struct inode *new_dir,
1927 struct dentry *new_dentry)
1929 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1930 struct common_audit_data ad;
1931 u32 sid = current_sid();
1933 int old_is_dir, new_is_dir;
1936 old_dsec = inode_security(old_dir);
1937 old_isec = backing_inode_security(old_dentry);
1938 old_is_dir = d_is_dir(old_dentry);
1939 new_dsec = inode_security(new_dir);
1941 ad.type = LSM_AUDIT_DATA_DENTRY;
1943 ad.u.dentry = old_dentry;
1944 rc = avc_has_perm(&selinux_state,
1945 sid, old_dsec->sid, SECCLASS_DIR,
1946 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1949 rc = avc_has_perm(&selinux_state,
1951 old_isec->sclass, FILE__RENAME, &ad);
1954 if (old_is_dir && new_dir != old_dir) {
1955 rc = avc_has_perm(&selinux_state,
1957 old_isec->sclass, DIR__REPARENT, &ad);
1962 ad.u.dentry = new_dentry;
1963 av = DIR__ADD_NAME | DIR__SEARCH;
1964 if (d_is_positive(new_dentry))
1965 av |= DIR__REMOVE_NAME;
1966 rc = avc_has_perm(&selinux_state,
1967 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1970 if (d_is_positive(new_dentry)) {
1971 new_isec = backing_inode_security(new_dentry);
1972 new_is_dir = d_is_dir(new_dentry);
1973 rc = avc_has_perm(&selinux_state,
1976 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1984 /* Check whether a task can perform a filesystem operation. */
1985 static int superblock_has_perm(const struct cred *cred,
1986 struct super_block *sb,
1988 struct common_audit_data *ad)
1990 struct superblock_security_struct *sbsec;
1991 u32 sid = cred_sid(cred);
1993 sbsec = selinux_superblock(sb);
1994 return avc_has_perm(&selinux_state,
1995 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 /* Convert a Linux mode and permission mask to an access vector. */
1999 static inline u32 file_mask_to_av(int mode, int mask)
2003 if (!S_ISDIR(mode)) {
2004 if (mask & MAY_EXEC)
2005 av |= FILE__EXECUTE;
2006 if (mask & MAY_READ)
2009 if (mask & MAY_APPEND)
2011 else if (mask & MAY_WRITE)
2015 if (mask & MAY_EXEC)
2017 if (mask & MAY_WRITE)
2019 if (mask & MAY_READ)
2026 /* Convert a Linux file to an access vector. */
2027 static inline u32 file_to_av(struct file *file)
2031 if (file->f_mode & FMODE_READ)
2033 if (file->f_mode & FMODE_WRITE) {
2034 if (file->f_flags & O_APPEND)
2041 * Special file opened with flags 3 for ioctl-only use.
2050 * Convert a file to an access vector and include the correct
2053 static inline u32 open_file_to_av(struct file *file)
2055 u32 av = file_to_av(file);
2056 struct inode *inode = file_inode(file);
2058 if (selinux_policycap_openperm() &&
2059 inode->i_sb->s_magic != SOCKFS_MAGIC)
2065 /* Hook functions begin here. */
2067 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2069 return avc_has_perm(&selinux_state,
2070 current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2071 BINDER__SET_CONTEXT_MGR, NULL);
2074 static int selinux_binder_transaction(struct task_struct *from,
2075 struct task_struct *to)
2077 u32 mysid = current_sid();
2078 u32 fromsid = task_sid_binder(from);
2081 if (mysid != fromsid) {
2082 rc = avc_has_perm(&selinux_state,
2083 mysid, fromsid, SECCLASS_BINDER,
2084 BINDER__IMPERSONATE, NULL);
2089 return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2090 SECCLASS_BINDER, BINDER__CALL, NULL);
2093 static int selinux_binder_transfer_binder(struct task_struct *from,
2094 struct task_struct *to)
2096 return avc_has_perm(&selinux_state,
2097 task_sid_binder(from), task_sid_binder(to),
2098 SECCLASS_BINDER, BINDER__TRANSFER,
2102 static int selinux_binder_transfer_file(struct task_struct *from,
2103 struct task_struct *to,
2106 u32 sid = task_sid_binder(to);
2107 struct file_security_struct *fsec = selinux_file(file);
2108 struct dentry *dentry = file->f_path.dentry;
2109 struct inode_security_struct *isec;
2110 struct common_audit_data ad;
2113 ad.type = LSM_AUDIT_DATA_PATH;
2114 ad.u.path = file->f_path;
2116 if (sid != fsec->sid) {
2117 rc = avc_has_perm(&selinux_state,
2126 #ifdef CONFIG_BPF_SYSCALL
2127 rc = bpf_fd_pass(file, sid);
2132 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 isec = backing_inode_security(dentry);
2136 return avc_has_perm(&selinux_state,
2137 sid, isec->sid, isec->sclass, file_to_av(file),
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2144 u32 sid = current_sid();
2145 u32 csid = task_sid_obj(child);
2147 if (mode & PTRACE_MODE_READ)
2148 return avc_has_perm(&selinux_state,
2149 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151 return avc_has_perm(&selinux_state,
2152 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2157 return avc_has_perm(&selinux_state,
2158 task_sid_subj(parent), task_sid_obj(current),
2159 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2165 return avc_has_perm(&selinux_state,
2166 current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2167 PROCESS__GETCAP, NULL);
2170 static int selinux_capset(struct cred *new, const struct cred *old,
2171 const kernel_cap_t *effective,
2172 const kernel_cap_t *inheritable,
2173 const kernel_cap_t *permitted)
2175 return avc_has_perm(&selinux_state,
2176 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2177 PROCESS__SETCAP, NULL);
2181 * (This comment used to live with the selinux_task_setuid hook,
2182 * which was removed).
2184 * Since setuid only affects the current process, and since the SELinux
2185 * controls are not based on the Linux identity attributes, SELinux does not
2186 * need to control this operation. However, SELinux does control the use of
2187 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2190 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191 int cap, unsigned int opts)
2193 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2196 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2198 const struct cred *cred = current_cred();
2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2221 case Q_XGETNEXTQUOTA:
2222 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2225 rc = 0; /* let the kernel handle invalid cmds */
2231 static int selinux_quota_on(struct dentry *dentry)
2233 const struct cred *cred = current_cred();
2235 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2238 static int selinux_syslog(int type)
2241 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2242 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2243 return avc_has_perm(&selinux_state,
2244 current_sid(), SECINITSID_KERNEL,
2245 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2246 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2247 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2248 /* Set level of messages printed to console */
2249 case SYSLOG_ACTION_CONSOLE_LEVEL:
2250 return avc_has_perm(&selinux_state,
2251 current_sid(), SECINITSID_KERNEL,
2252 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2255 /* All other syslog types */
2256 return avc_has_perm(&selinux_state,
2257 current_sid(), SECINITSID_KERNEL,
2258 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2262 * Check that a process has enough memory to allocate a new virtual
2263 * mapping. 0 means there is enough memory for the allocation to
2264 * succeed and -ENOMEM implies there is not.
2266 * Do not audit the selinux permission check, as this is applied to all
2267 * processes that allocate mappings.
2269 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2271 int rc, cap_sys_admin = 0;
2273 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2274 CAP_OPT_NOAUDIT, true);
2278 return cap_sys_admin;
2281 /* binprm security operations */
2283 static u32 ptrace_parent_sid(void)
2286 struct task_struct *tracer;
2289 tracer = ptrace_parent(current);
2291 sid = task_sid_obj(tracer);
2297 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2298 const struct task_security_struct *old_tsec,
2299 const struct task_security_struct *new_tsec)
2301 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2302 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2306 if (!nnp && !nosuid)
2307 return 0; /* neither NNP nor nosuid */
2309 if (new_tsec->sid == old_tsec->sid)
2310 return 0; /* No change in credentials */
2313 * If the policy enables the nnp_nosuid_transition policy capability,
2314 * then we permit transitions under NNP or nosuid if the
2315 * policy allows the corresponding permission between
2316 * the old and new contexts.
2318 if (selinux_policycap_nnp_nosuid_transition()) {
2321 av |= PROCESS2__NNP_TRANSITION;
2323 av |= PROCESS2__NOSUID_TRANSITION;
2324 rc = avc_has_perm(&selinux_state,
2325 old_tsec->sid, new_tsec->sid,
2326 SECCLASS_PROCESS2, av, NULL);
2332 * We also permit NNP or nosuid transitions to bounded SIDs,
2333 * i.e. SIDs that are guaranteed to only be allowed a subset
2334 * of the permissions of the current SID.
2336 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2342 * On failure, preserve the errno values for NNP vs nosuid.
2343 * NNP: Operation not permitted for caller.
2344 * nosuid: Permission denied to file.
2351 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2353 const struct task_security_struct *old_tsec;
2354 struct task_security_struct *new_tsec;
2355 struct inode_security_struct *isec;
2356 struct common_audit_data ad;
2357 struct inode *inode = file_inode(bprm->file);
2360 /* SELinux context only depends on initial program or script and not
2361 * the script interpreter */
2363 old_tsec = selinux_cred(current_cred());
2364 new_tsec = selinux_cred(bprm->cred);
2365 isec = inode_security(inode);
2367 /* Default to the current task SID. */
2368 new_tsec->sid = old_tsec->sid;
2369 new_tsec->osid = old_tsec->sid;
2371 /* Reset fs, key, and sock SIDs on execve. */
2372 new_tsec->create_sid = 0;
2373 new_tsec->keycreate_sid = 0;
2374 new_tsec->sockcreate_sid = 0;
2376 if (old_tsec->exec_sid) {
2377 new_tsec->sid = old_tsec->exec_sid;
2378 /* Reset exec SID on execve. */
2379 new_tsec->exec_sid = 0;
2381 /* Fail on NNP or nosuid if not an allowed transition. */
2382 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2386 /* Check for a default transition on this program. */
2387 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2388 isec->sid, SECCLASS_PROCESS, NULL,
2394 * Fallback to old SID on NNP or nosuid if not an allowed
2397 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2399 new_tsec->sid = old_tsec->sid;
2402 ad.type = LSM_AUDIT_DATA_FILE;
2403 ad.u.file = bprm->file;
2405 if (new_tsec->sid == old_tsec->sid) {
2406 rc = avc_has_perm(&selinux_state,
2407 old_tsec->sid, isec->sid,
2408 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2412 /* Check permissions for the transition. */
2413 rc = avc_has_perm(&selinux_state,
2414 old_tsec->sid, new_tsec->sid,
2415 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2419 rc = avc_has_perm(&selinux_state,
2420 new_tsec->sid, isec->sid,
2421 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2425 /* Check for shared state */
2426 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2427 rc = avc_has_perm(&selinux_state,
2428 old_tsec->sid, new_tsec->sid,
2429 SECCLASS_PROCESS, PROCESS__SHARE,
2435 /* Make sure that anyone attempting to ptrace over a task that
2436 * changes its SID has the appropriate permit */
2437 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2438 u32 ptsid = ptrace_parent_sid();
2440 rc = avc_has_perm(&selinux_state,
2441 ptsid, new_tsec->sid,
2443 PROCESS__PTRACE, NULL);
2449 /* Clear any possibly unsafe personality bits on exec: */
2450 bprm->per_clear |= PER_CLEAR_ON_SETID;
2452 /* Enable secure mode for SIDs transitions unless
2453 the noatsecure permission is granted between
2454 the two SIDs, i.e. ahp returns 0. */
2455 rc = avc_has_perm(&selinux_state,
2456 old_tsec->sid, new_tsec->sid,
2457 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2459 bprm->secureexec |= !!rc;
2465 static int match_file(const void *p, struct file *file, unsigned fd)
2467 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2470 /* Derived from fs/exec.c:flush_old_files. */
2471 static inline void flush_unauthorized_files(const struct cred *cred,
2472 struct files_struct *files)
2474 struct file *file, *devnull = NULL;
2475 struct tty_struct *tty;
2479 tty = get_current_tty();
2481 spin_lock(&tty->files_lock);
2482 if (!list_empty(&tty->tty_files)) {
2483 struct tty_file_private *file_priv;
2485 /* Revalidate access to controlling tty.
2486 Use file_path_has_perm on the tty path directly
2487 rather than using file_has_perm, as this particular
2488 open file may belong to another process and we are
2489 only interested in the inode-based check here. */
2490 file_priv = list_first_entry(&tty->tty_files,
2491 struct tty_file_private, list);
2492 file = file_priv->file;
2493 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2496 spin_unlock(&tty->files_lock);
2499 /* Reset controlling tty. */
2503 /* Revalidate access to inherited open files. */
2504 n = iterate_fd(files, 0, match_file, cred);
2505 if (!n) /* none found? */
2508 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2509 if (IS_ERR(devnull))
2511 /* replace all the matching ones with this */
2513 replace_fd(n - 1, devnull, 0);
2514 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2520 * Prepare a process for imminent new credential changes due to exec
2522 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2524 struct task_security_struct *new_tsec;
2525 struct rlimit *rlim, *initrlim;
2528 new_tsec = selinux_cred(bprm->cred);
2529 if (new_tsec->sid == new_tsec->osid)
2532 /* Close files for which the new task SID is not authorized. */
2533 flush_unauthorized_files(bprm->cred, current->files);
2535 /* Always clear parent death signal on SID transitions. */
2536 current->pdeath_signal = 0;
2538 /* Check whether the new SID can inherit resource limits from the old
2539 * SID. If not, reset all soft limits to the lower of the current
2540 * task's hard limit and the init task's soft limit.
2542 * Note that the setting of hard limits (even to lower them) can be
2543 * controlled by the setrlimit check. The inclusion of the init task's
2544 * soft limit into the computation is to avoid resetting soft limits
2545 * higher than the default soft limit for cases where the default is
2546 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2548 rc = avc_has_perm(&selinux_state,
2549 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2550 PROCESS__RLIMITINH, NULL);
2552 /* protect against do_prlimit() */
2554 for (i = 0; i < RLIM_NLIMITS; i++) {
2555 rlim = current->signal->rlim + i;
2556 initrlim = init_task.signal->rlim + i;
2557 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2559 task_unlock(current);
2560 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2561 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2566 * Clean up the process immediately after the installation of new credentials
2569 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2571 const struct task_security_struct *tsec = selinux_cred(current_cred());
2581 /* Check whether the new SID can inherit signal state from the old SID.
2582 * If not, clear itimers to avoid subsequent signal generation and
2583 * flush and unblock signals.
2585 * This must occur _after_ the task SID has been updated so that any
2586 * kill done after the flush will be checked against the new SID.
2588 rc = avc_has_perm(&selinux_state,
2589 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2593 spin_lock_irq(¤t->sighand->siglock);
2594 if (!fatal_signal_pending(current)) {
2595 flush_sigqueue(¤t->pending);
2596 flush_sigqueue(¤t->signal->shared_pending);
2597 flush_signal_handlers(current, 1);
2598 sigemptyset(¤t->blocked);
2599 recalc_sigpending();
2601 spin_unlock_irq(¤t->sighand->siglock);
2604 /* Wake up the parent if it is waiting so that it can recheck
2605 * wait permission to the new task SID. */
2606 read_lock(&tasklist_lock);
2607 __wake_up_parent(current, current->real_parent);
2608 read_unlock(&tasklist_lock);
2611 /* superblock security operations */
2613 static int selinux_sb_alloc_security(struct super_block *sb)
2615 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2617 mutex_init(&sbsec->lock);
2618 INIT_LIST_HEAD(&sbsec->isec_head);
2619 spin_lock_init(&sbsec->isec_lock);
2620 sbsec->sid = SECINITSID_UNLABELED;
2621 sbsec->def_sid = SECINITSID_FILE;
2622 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2627 static inline int opt_len(const char *s)
2629 bool open_quote = false;
2633 for (len = 0; (c = s[len]) != '\0'; len++) {
2635 open_quote = !open_quote;
2636 if (c == ',' && !open_quote)
2642 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2644 char *from = options;
2650 int len = opt_len(from);
2654 token = match_opt_prefix(from, len, &arg);
2656 if (token != Opt_error) {
2661 for (p = q = arg; p < from + len; p++) {
2666 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2672 rc = selinux_add_opt(token, arg, mnt_opts);
2678 if (!first) { // copy with preceding comma
2683 memmove(to, from, len);
2696 selinux_free_mnt_opts(*mnt_opts);
2702 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2704 struct selinux_mnt_opts *opts = mnt_opts;
2705 struct superblock_security_struct *sbsec = sb->s_security;
2710 * Superblock not initialized (i.e. no options) - reject if any
2711 * options specified, otherwise accept.
2713 if (!(sbsec->flags & SE_SBINITIALIZED))
2714 return opts ? 1 : 0;
2717 * Superblock initialized and no options specified - reject if
2718 * superblock has any options set, otherwise accept.
2721 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2723 if (opts->fscontext) {
2724 rc = parse_sid(sb, opts->fscontext, &sid);
2727 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2730 if (opts->context) {
2731 rc = parse_sid(sb, opts->context, &sid);
2734 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2737 if (opts->rootcontext) {
2738 struct inode_security_struct *root_isec;
2740 root_isec = backing_inode_security(sb->s_root);
2741 rc = parse_sid(sb, opts->rootcontext, &sid);
2744 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2747 if (opts->defcontext) {
2748 rc = parse_sid(sb, opts->defcontext, &sid);
2751 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2759 struct selinux_mnt_opts *opts = mnt_opts;
2760 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2764 if (!(sbsec->flags & SE_SBINITIALIZED))
2770 if (opts->fscontext) {
2771 rc = parse_sid(sb, opts->fscontext, &sid);
2774 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2775 goto out_bad_option;
2777 if (opts->context) {
2778 rc = parse_sid(sb, opts->context, &sid);
2781 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2782 goto out_bad_option;
2784 if (opts->rootcontext) {
2785 struct inode_security_struct *root_isec;
2786 root_isec = backing_inode_security(sb->s_root);
2787 rc = parse_sid(sb, opts->rootcontext, &sid);
2790 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2791 goto out_bad_option;
2793 if (opts->defcontext) {
2794 rc = parse_sid(sb, opts->defcontext, &sid);
2797 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2798 goto out_bad_option;
2803 pr_warn("SELinux: unable to change security options "
2804 "during remount (dev %s, type=%s)\n", sb->s_id,
2809 static int selinux_sb_kern_mount(struct super_block *sb)
2811 const struct cred *cred = current_cred();
2812 struct common_audit_data ad;
2814 ad.type = LSM_AUDIT_DATA_DENTRY;
2815 ad.u.dentry = sb->s_root;
2816 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2819 static int selinux_sb_statfs(struct dentry *dentry)
2821 const struct cred *cred = current_cred();
2822 struct common_audit_data ad;
2824 ad.type = LSM_AUDIT_DATA_DENTRY;
2825 ad.u.dentry = dentry->d_sb->s_root;
2826 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2829 static int selinux_mount(const char *dev_name,
2830 const struct path *path,
2832 unsigned long flags,
2835 const struct cred *cred = current_cred();
2837 if (flags & MS_REMOUNT)
2838 return superblock_has_perm(cred, path->dentry->d_sb,
2839 FILESYSTEM__REMOUNT, NULL);
2841 return path_has_perm(cred, path, FILE__MOUNTON);
2844 static int selinux_move_mount(const struct path *from_path,
2845 const struct path *to_path)
2847 const struct cred *cred = current_cred();
2849 return path_has_perm(cred, to_path, FILE__MOUNTON);
2852 static int selinux_umount(struct vfsmount *mnt, int flags)
2854 const struct cred *cred = current_cred();
2856 return superblock_has_perm(cred, mnt->mnt_sb,
2857 FILESYSTEM__UNMOUNT, NULL);
2860 static int selinux_fs_context_dup(struct fs_context *fc,
2861 struct fs_context *src_fc)
2863 const struct selinux_mnt_opts *src = src_fc->security;
2864 struct selinux_mnt_opts *opts;
2869 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2873 opts = fc->security;
2875 if (src->fscontext) {
2876 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2877 if (!opts->fscontext)
2881 opts->context = kstrdup(src->context, GFP_KERNEL);
2885 if (src->rootcontext) {
2886 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2887 if (!opts->rootcontext)
2890 if (src->defcontext) {
2891 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2892 if (!opts->defcontext)
2898 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2899 fsparam_string(CONTEXT_STR, Opt_context),
2900 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2901 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2902 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2903 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2907 static int selinux_fs_context_parse_param(struct fs_context *fc,
2908 struct fs_parameter *param)
2910 struct fs_parse_result result;
2913 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2917 rc = selinux_add_opt(opt, param->string, &fc->security);
2919 param->string = NULL;
2925 /* inode security operations */
2927 static int selinux_inode_alloc_security(struct inode *inode)
2929 struct inode_security_struct *isec = selinux_inode(inode);
2930 u32 sid = current_sid();
2932 spin_lock_init(&isec->lock);
2933 INIT_LIST_HEAD(&isec->list);
2934 isec->inode = inode;
2935 isec->sid = SECINITSID_UNLABELED;
2936 isec->sclass = SECCLASS_FILE;
2937 isec->task_sid = sid;
2938 isec->initialized = LABEL_INVALID;
2943 static void selinux_inode_free_security(struct inode *inode)
2945 inode_free_security(inode);
2948 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2949 const struct qstr *name, void **ctx,
2955 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2956 d_inode(dentry->d_parent), name,
2957 inode_mode_to_security_class(mode),
2962 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2966 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2968 const struct cred *old,
2973 struct task_security_struct *tsec;
2975 rc = selinux_determine_inode_label(selinux_cred(old),
2976 d_inode(dentry->d_parent), name,
2977 inode_mode_to_security_class(mode),
2982 tsec = selinux_cred(new);
2983 tsec->create_sid = newsid;
2987 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2988 const struct qstr *qstr,
2990 void **value, size_t *len)
2992 const struct task_security_struct *tsec = selinux_cred(current_cred());
2993 struct superblock_security_struct *sbsec;
2998 sbsec = selinux_superblock(dir->i_sb);
3000 newsid = tsec->create_sid;
3002 rc = selinux_determine_inode_label(tsec, dir, qstr,
3003 inode_mode_to_security_class(inode->i_mode),
3008 /* Possibly defer initialization to selinux_complete_init. */
3009 if (sbsec->flags & SE_SBINITIALIZED) {
3010 struct inode_security_struct *isec = selinux_inode(inode);
3011 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3013 isec->initialized = LABEL_INITIALIZED;
3016 if (!selinux_initialized(&selinux_state) ||
3017 !(sbsec->flags & SBLABEL_MNT))
3021 *name = XATTR_SELINUX_SUFFIX;
3024 rc = security_sid_to_context_force(&selinux_state, newsid,
3035 static int selinux_inode_init_security_anon(struct inode *inode,
3036 const struct qstr *name,
3037 const struct inode *context_inode)
3039 const struct task_security_struct *tsec = selinux_cred(current_cred());
3040 struct common_audit_data ad;
3041 struct inode_security_struct *isec;
3044 if (unlikely(!selinux_initialized(&selinux_state)))
3047 isec = selinux_inode(inode);
3050 * We only get here once per ephemeral inode. The inode has
3051 * been initialized via inode_alloc_security but is otherwise
3055 if (context_inode) {
3056 struct inode_security_struct *context_isec =
3057 selinux_inode(context_inode);
3058 if (context_isec->initialized != LABEL_INITIALIZED) {
3059 pr_err("SELinux: context_inode is not initialized");
3063 isec->sclass = context_isec->sclass;
3064 isec->sid = context_isec->sid;
3066 isec->sclass = SECCLASS_ANON_INODE;
3067 rc = security_transition_sid(
3068 &selinux_state, tsec->sid, tsec->sid,
3069 isec->sclass, name, &isec->sid);
3074 isec->initialized = LABEL_INITIALIZED;
3076 * Now that we've initialized security, check whether we're
3077 * allowed to actually create this type of anonymous inode.
3080 ad.type = LSM_AUDIT_DATA_INODE;
3083 return avc_has_perm(&selinux_state,
3091 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3093 return may_create(dir, dentry, SECCLASS_FILE);
3096 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3098 return may_link(dir, old_dentry, MAY_LINK);
3101 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3103 return may_link(dir, dentry, MAY_UNLINK);
3106 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3108 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3111 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3113 return may_create(dir, dentry, SECCLASS_DIR);
3116 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3118 return may_link(dir, dentry, MAY_RMDIR);
3121 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3123 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3126 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3127 struct inode *new_inode, struct dentry *new_dentry)
3129 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3132 static int selinux_inode_readlink(struct dentry *dentry)
3134 const struct cred *cred = current_cred();
3136 return dentry_has_perm(cred, dentry, FILE__READ);
3139 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3142 const struct cred *cred = current_cred();
3143 struct common_audit_data ad;
3144 struct inode_security_struct *isec;
3147 validate_creds(cred);
3149 ad.type = LSM_AUDIT_DATA_DENTRY;
3150 ad.u.dentry = dentry;
3151 sid = cred_sid(cred);
3152 isec = inode_security_rcu(inode, rcu);
3154 return PTR_ERR(isec);
3156 return avc_has_perm_flags(&selinux_state,
3157 sid, isec->sid, isec->sclass, FILE__READ, &ad,
3158 rcu ? MAY_NOT_BLOCK : 0);
3161 static noinline int audit_inode_permission(struct inode *inode,
3162 u32 perms, u32 audited, u32 denied,
3165 struct common_audit_data ad;
3166 struct inode_security_struct *isec = selinux_inode(inode);
3169 ad.type = LSM_AUDIT_DATA_INODE;
3172 rc = slow_avc_audit(&selinux_state,
3173 current_sid(), isec->sid, isec->sclass, perms,
3174 audited, denied, result, &ad);
3180 static int selinux_inode_permission(struct inode *inode, int mask)
3182 const struct cred *cred = current_cred();
3185 bool no_block = mask & MAY_NOT_BLOCK;
3186 struct inode_security_struct *isec;
3188 struct av_decision avd;
3190 u32 audited, denied;
3192 from_access = mask & MAY_ACCESS;
3193 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3195 /* No permission to check. Existence test. */
3199 validate_creds(cred);
3201 if (unlikely(IS_PRIVATE(inode)))
3204 perms = file_mask_to_av(inode->i_mode, mask);
3206 sid = cred_sid(cred);
3207 isec = inode_security_rcu(inode, no_block);
3209 return PTR_ERR(isec);
3211 rc = avc_has_perm_noaudit(&selinux_state,
3212 sid, isec->sid, isec->sclass, perms,
3213 no_block ? AVC_NONBLOCKING : 0,
3215 audited = avc_audit_required(perms, &avd, rc,
3216 from_access ? FILE__AUDIT_ACCESS : 0,
3218 if (likely(!audited))
3221 /* fall back to ref-walk if we have to generate audit */
3225 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3231 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3233 const struct cred *cred = current_cred();
3234 struct inode *inode = d_backing_inode(dentry);
3235 unsigned int ia_valid = iattr->ia_valid;
3236 __u32 av = FILE__WRITE;
3238 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3239 if (ia_valid & ATTR_FORCE) {
3240 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3246 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3247 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3248 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3250 if (selinux_policycap_openperm() &&
3251 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3252 (ia_valid & ATTR_SIZE) &&
3253 !(ia_valid & ATTR_FILE))
3256 return dentry_has_perm(cred, dentry, av);
3259 static int selinux_inode_getattr(const struct path *path)
3261 return path_has_perm(current_cred(), path, FILE__GETATTR);
3264 static bool has_cap_mac_admin(bool audit)
3266 const struct cred *cred = current_cred();
3267 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3269 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3271 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3276 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3277 struct dentry *dentry, const char *name,
3278 const void *value, size_t size, int flags)
3280 struct inode *inode = d_backing_inode(dentry);
3281 struct inode_security_struct *isec;
3282 struct superblock_security_struct *sbsec;
3283 struct common_audit_data ad;
3284 u32 newsid, sid = current_sid();
3287 if (strcmp(name, XATTR_NAME_SELINUX)) {
3288 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3292 /* Not an attribute we recognize, so just check the
3293 ordinary setattr permission. */
3294 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3297 if (!selinux_initialized(&selinux_state))
3298 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3300 sbsec = selinux_superblock(inode->i_sb);
3301 if (!(sbsec->flags & SBLABEL_MNT))
3304 if (!inode_owner_or_capable(mnt_userns, inode))
3307 ad.type = LSM_AUDIT_DATA_DENTRY;
3308 ad.u.dentry = dentry;
3310 isec = backing_inode_security(dentry);
3311 rc = avc_has_perm(&selinux_state,
3312 sid, isec->sid, isec->sclass,
3313 FILE__RELABELFROM, &ad);
3317 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3319 if (rc == -EINVAL) {
3320 if (!has_cap_mac_admin(true)) {
3321 struct audit_buffer *ab;
3324 /* We strip a nul only if it is at the end, otherwise the
3325 * context contains a nul and we should audit that */
3327 const char *str = value;
3329 if (str[size - 1] == '\0')
3330 audit_size = size - 1;
3336 ab = audit_log_start(audit_context(),
3337 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3338 audit_log_format(ab, "op=setxattr invalid_context=");
3339 audit_log_n_untrustedstring(ab, value, audit_size);
3344 rc = security_context_to_sid_force(&selinux_state, value,
3350 rc = avc_has_perm(&selinux_state,
3351 sid, newsid, isec->sclass,
3352 FILE__RELABELTO, &ad);
3356 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3361 return avc_has_perm(&selinux_state,
3364 SECCLASS_FILESYSTEM,
3365 FILESYSTEM__ASSOCIATE,
3369 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3370 const void *value, size_t size,
3373 struct inode *inode = d_backing_inode(dentry);
3374 struct inode_security_struct *isec;
3378 if (strcmp(name, XATTR_NAME_SELINUX)) {
3379 /* Not an attribute we recognize, so nothing to do. */
3383 if (!selinux_initialized(&selinux_state)) {
3384 /* If we haven't even been initialized, then we can't validate
3385 * against a policy, so leave the label as invalid. It may
3386 * resolve to a valid label on the next revalidation try if
3387 * we've since initialized.
3392 rc = security_context_to_sid_force(&selinux_state, value, size,
3395 pr_err("SELinux: unable to map context to SID"
3396 "for (%s, %lu), rc=%d\n",
3397 inode->i_sb->s_id, inode->i_ino, -rc);
3401 isec = backing_inode_security(dentry);
3402 spin_lock(&isec->lock);
3403 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3405 isec->initialized = LABEL_INITIALIZED;
3406 spin_unlock(&isec->lock);
3411 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3413 const struct cred *cred = current_cred();
3415 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3418 static int selinux_inode_listxattr(struct dentry *dentry)
3420 const struct cred *cred = current_cred();
3422 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3425 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3426 struct dentry *dentry, const char *name)
3428 if (strcmp(name, XATTR_NAME_SELINUX)) {
3429 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3433 /* Not an attribute we recognize, so just check the
3434 ordinary setattr permission. */
3435 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3438 if (!selinux_initialized(&selinux_state))
3441 /* No one is allowed to remove a SELinux security label.
3442 You can change the label, but all data must be labeled. */
3446 static int selinux_path_notify(const struct path *path, u64 mask,
3447 unsigned int obj_type)
3452 struct common_audit_data ad;
3454 ad.type = LSM_AUDIT_DATA_PATH;
3458 * Set permission needed based on the type of mark being set.
3459 * Performs an additional check for sb watches.
3462 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3463 perm = FILE__WATCH_MOUNT;
3465 case FSNOTIFY_OBJ_TYPE_SB:
3466 perm = FILE__WATCH_SB;
3467 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3468 FILESYSTEM__WATCH, &ad);
3472 case FSNOTIFY_OBJ_TYPE_INODE:
3479 /* blocking watches require the file:watch_with_perm permission */
3480 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3481 perm |= FILE__WATCH_WITH_PERM;
3483 /* watches on read-like events need the file:watch_reads permission */
3484 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3485 perm |= FILE__WATCH_READS;
3487 return path_has_perm(current_cred(), path, perm);
3491 * Copy the inode security context value to the user.
3493 * Permission check is handled by selinux_inode_getxattr hook.
3495 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3496 struct inode *inode, const char *name,
3497 void **buffer, bool alloc)
3501 char *context = NULL;
3502 struct inode_security_struct *isec;
3505 * If we're not initialized yet, then we can't validate contexts, so
3506 * just let vfs_getxattr fall back to using the on-disk xattr.
3508 if (!selinux_initialized(&selinux_state) ||
3509 strcmp(name, XATTR_SELINUX_SUFFIX))
3513 * If the caller has CAP_MAC_ADMIN, then get the raw context
3514 * value even if it is not defined by current policy; otherwise,
3515 * use the in-core value under current policy.
3516 * Use the non-auditing forms of the permission checks since
3517 * getxattr may be called by unprivileged processes commonly
3518 * and lack of permission just means that we fall back to the
3519 * in-core context value, not a denial.
3521 isec = inode_security(inode);
3522 if (has_cap_mac_admin(false))
3523 error = security_sid_to_context_force(&selinux_state,
3524 isec->sid, &context,
3527 error = security_sid_to_context(&selinux_state, isec->sid,
3541 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3542 const void *value, size_t size, int flags)
3544 struct inode_security_struct *isec = inode_security_novalidate(inode);
3545 struct superblock_security_struct *sbsec;
3549 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3552 sbsec = selinux_superblock(inode->i_sb);
3553 if (!(sbsec->flags & SBLABEL_MNT))
3556 if (!value || !size)
3559 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3564 spin_lock(&isec->lock);
3565 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3567 isec->initialized = LABEL_INITIALIZED;
3568 spin_unlock(&isec->lock);
3572 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3574 const int len = sizeof(XATTR_NAME_SELINUX);
3576 if (!selinux_initialized(&selinux_state))
3579 if (buffer && len <= buffer_size)
3580 memcpy(buffer, XATTR_NAME_SELINUX, len);
3584 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3586 struct inode_security_struct *isec = inode_security_novalidate(inode);
3590 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3593 struct task_security_struct *tsec;
3594 struct cred *new_creds = *new;
3596 if (new_creds == NULL) {
3597 new_creds = prepare_creds();
3602 tsec = selinux_cred(new_creds);
3603 /* Get label from overlay inode and set it in create_sid */
3604 selinux_inode_getsecid(d_inode(src), &sid);
3605 tsec->create_sid = sid;
3610 static int selinux_inode_copy_up_xattr(const char *name)
3612 /* The copy_up hook above sets the initial context on an inode, but we
3613 * don't then want to overwrite it by blindly copying all the lower
3614 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3616 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3617 return 1; /* Discard */
3619 * Any other attribute apart from SELINUX is not claimed, supported
3625 /* kernfs node operations */
3627 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3628 struct kernfs_node *kn)
3630 const struct task_security_struct *tsec = selinux_cred(current_cred());
3631 u32 parent_sid, newsid, clen;
3635 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3642 context = kmalloc(clen, GFP_KERNEL);
3646 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3652 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3658 if (tsec->create_sid) {
3659 newsid = tsec->create_sid;
3661 u16 secclass = inode_mode_to_security_class(kn->mode);
3665 q.hash_len = hashlen_string(kn_dir, kn->name);
3667 rc = security_transition_sid(&selinux_state, tsec->sid,
3668 parent_sid, secclass, &q,
3674 rc = security_sid_to_context_force(&selinux_state, newsid,
3679 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3686 /* file security operations */
3688 static int selinux_revalidate_file_permission(struct file *file, int mask)
3690 const struct cred *cred = current_cred();
3691 struct inode *inode = file_inode(file);
3693 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3694 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3697 return file_has_perm(cred, file,
3698 file_mask_to_av(inode->i_mode, mask));
3701 static int selinux_file_permission(struct file *file, int mask)
3703 struct inode *inode = file_inode(file);
3704 struct file_security_struct *fsec = selinux_file(file);
3705 struct inode_security_struct *isec;
3706 u32 sid = current_sid();
3709 /* No permission to check. Existence test. */
3712 isec = inode_security(inode);
3713 if (sid == fsec->sid && fsec->isid == isec->sid &&
3714 fsec->pseqno == avc_policy_seqno(&selinux_state))
3715 /* No change since file_open check. */
3718 return selinux_revalidate_file_permission(file, mask);
3721 static int selinux_file_alloc_security(struct file *file)
3723 struct file_security_struct *fsec = selinux_file(file);
3724 u32 sid = current_sid();
3727 fsec->fown_sid = sid;
3733 * Check whether a task has the ioctl permission and cmd
3734 * operation to an inode.
3736 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3737 u32 requested, u16 cmd)
3739 struct common_audit_data ad;
3740 struct file_security_struct *fsec = selinux_file(file);
3741 struct inode *inode = file_inode(file);
3742 struct inode_security_struct *isec;
3743 struct lsm_ioctlop_audit ioctl;
3744 u32 ssid = cred_sid(cred);
3746 u8 driver = cmd >> 8;
3747 u8 xperm = cmd & 0xff;
3749 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3752 ad.u.op->path = file->f_path;
3754 if (ssid != fsec->sid) {
3755 rc = avc_has_perm(&selinux_state,
3764 if (unlikely(IS_PRIVATE(inode)))
3767 isec = inode_security(inode);
3768 rc = avc_has_extended_perms(&selinux_state,
3769 ssid, isec->sid, isec->sclass,
3770 requested, driver, xperm, &ad);
3775 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3778 const struct cred *cred = current_cred();
3785 case FS_IOC_GETFLAGS:
3786 case FS_IOC_GETVERSION:
3787 error = file_has_perm(cred, file, FILE__GETATTR);
3790 case FS_IOC_SETFLAGS:
3791 case FS_IOC_SETVERSION:
3792 error = file_has_perm(cred, file, FILE__SETATTR);
3795 /* sys_ioctl() checks */
3798 error = file_has_perm(cred, file, 0);
3803 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3804 CAP_OPT_NONE, true);
3807 /* default case assumes that the command will go
3808 * to the file's ioctl() function.
3811 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3816 static int default_noexec __ro_after_init;
3818 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3820 const struct cred *cred = current_cred();
3821 u32 sid = cred_sid(cred);
3824 if (default_noexec &&
3825 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3826 (!shared && (prot & PROT_WRITE)))) {
3828 * We are making executable an anonymous mapping or a
3829 * private file mapping that will also be writable.
3830 * This has an additional check.
3832 rc = avc_has_perm(&selinux_state,
3833 sid, sid, SECCLASS_PROCESS,
3834 PROCESS__EXECMEM, NULL);
3840 /* read access is always possible with a mapping */
3841 u32 av = FILE__READ;
3843 /* write access only matters if the mapping is shared */
3844 if (shared && (prot & PROT_WRITE))
3847 if (prot & PROT_EXEC)
3848 av |= FILE__EXECUTE;
3850 return file_has_perm(cred, file, av);
3857 static int selinux_mmap_addr(unsigned long addr)
3861 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3862 u32 sid = current_sid();
3863 rc = avc_has_perm(&selinux_state,
3864 sid, sid, SECCLASS_MEMPROTECT,
3865 MEMPROTECT__MMAP_ZERO, NULL);
3871 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3872 unsigned long prot, unsigned long flags)
3874 struct common_audit_data ad;
3878 ad.type = LSM_AUDIT_DATA_FILE;
3880 rc = inode_has_perm(current_cred(), file_inode(file),
3886 if (checkreqprot_get(&selinux_state))
3889 return file_map_prot_check(file, prot,
3890 (flags & MAP_TYPE) == MAP_SHARED);
3893 static int selinux_file_mprotect(struct vm_area_struct *vma,
3894 unsigned long reqprot,
3897 const struct cred *cred = current_cred();
3898 u32 sid = cred_sid(cred);
3900 if (checkreqprot_get(&selinux_state))
3903 if (default_noexec &&
3904 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3906 if (vma->vm_start >= vma->vm_mm->start_brk &&
3907 vma->vm_end <= vma->vm_mm->brk) {
3908 rc = avc_has_perm(&selinux_state,
3909 sid, sid, SECCLASS_PROCESS,
3910 PROCESS__EXECHEAP, NULL);
3911 } else if (!vma->vm_file &&
3912 ((vma->vm_start <= vma->vm_mm->start_stack &&
3913 vma->vm_end >= vma->vm_mm->start_stack) ||
3914 vma_is_stack_for_current(vma))) {
3915 rc = avc_has_perm(&selinux_state,
3916 sid, sid, SECCLASS_PROCESS,
3917 PROCESS__EXECSTACK, NULL);
3918 } else if (vma->vm_file && vma->anon_vma) {
3920 * We are making executable a file mapping that has
3921 * had some COW done. Since pages might have been
3922 * written, check ability to execute the possibly
3923 * modified content. This typically should only
3924 * occur for text relocations.
3926 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3932 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3935 static int selinux_file_lock(struct file *file, unsigned int cmd)
3937 const struct cred *cred = current_cred();
3939 return file_has_perm(cred, file, FILE__LOCK);
3942 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3945 const struct cred *cred = current_cred();
3950 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3951 err = file_has_perm(cred, file, FILE__WRITE);
3960 case F_GETOWNER_UIDS:
3961 /* Just check FD__USE permission */
3962 err = file_has_perm(cred, file, 0);
3970 #if BITS_PER_LONG == 32
3975 err = file_has_perm(cred, file, FILE__LOCK);
3982 static void selinux_file_set_fowner(struct file *file)
3984 struct file_security_struct *fsec;
3986 fsec = selinux_file(file);
3987 fsec->fown_sid = current_sid();
3990 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3991 struct fown_struct *fown, int signum)
3994 u32 sid = task_sid_obj(tsk);
3996 struct file_security_struct *fsec;
3998 /* struct fown_struct is never outside the context of a struct file */
3999 file = container_of(fown, struct file, f_owner);
4001 fsec = selinux_file(file);
4004 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
4006 perm = signal_to_av(signum);
4008 return avc_has_perm(&selinux_state,
4009 fsec->fown_sid, sid,
4010 SECCLASS_PROCESS, perm, NULL);
4013 static int selinux_file_receive(struct file *file)
4015 const struct cred *cred = current_cred();
4017 return file_has_perm(cred, file, file_to_av(file));
4020 static int selinux_file_open(struct file *file)
4022 struct file_security_struct *fsec;
4023 struct inode_security_struct *isec;
4025 fsec = selinux_file(file);
4026 isec = inode_security(file_inode(file));
4028 * Save inode label and policy sequence number
4029 * at open-time so that selinux_file_permission
4030 * can determine whether revalidation is necessary.
4031 * Task label is already saved in the file security
4032 * struct as its SID.
4034 fsec->isid = isec->sid;
4035 fsec->pseqno = avc_policy_seqno(&selinux_state);
4037 * Since the inode label or policy seqno may have changed
4038 * between the selinux_inode_permission check and the saving
4039 * of state above, recheck that access is still permitted.
4040 * Otherwise, access might never be revalidated against the
4041 * new inode label or new policy.
4042 * This check is not redundant - do not remove.
4044 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4047 /* task security operations */
4049 static int selinux_task_alloc(struct task_struct *task,
4050 unsigned long clone_flags)
4052 u32 sid = current_sid();
4054 return avc_has_perm(&selinux_state,
4055 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4059 * prepare a new set of credentials for modification
4061 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4064 const struct task_security_struct *old_tsec = selinux_cred(old);
4065 struct task_security_struct *tsec = selinux_cred(new);
4072 * transfer the SELinux data to a blank set of creds
4074 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4076 const struct task_security_struct *old_tsec = selinux_cred(old);
4077 struct task_security_struct *tsec = selinux_cred(new);
4082 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4084 *secid = cred_sid(c);
4088 * set the security data for a kernel service
4089 * - all the creation contexts are set to unlabelled
4091 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4093 struct task_security_struct *tsec = selinux_cred(new);
4094 u32 sid = current_sid();
4097 ret = avc_has_perm(&selinux_state,
4099 SECCLASS_KERNEL_SERVICE,
4100 KERNEL_SERVICE__USE_AS_OVERRIDE,
4104 tsec->create_sid = 0;
4105 tsec->keycreate_sid = 0;
4106 tsec->sockcreate_sid = 0;
4112 * set the file creation context in a security record to the same as the
4113 * objective context of the specified inode
4115 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4117 struct inode_security_struct *isec = inode_security(inode);
4118 struct task_security_struct *tsec = selinux_cred(new);
4119 u32 sid = current_sid();
4122 ret = avc_has_perm(&selinux_state,
4124 SECCLASS_KERNEL_SERVICE,
4125 KERNEL_SERVICE__CREATE_FILES_AS,
4129 tsec->create_sid = isec->sid;
4133 static int selinux_kernel_module_request(char *kmod_name)
4135 struct common_audit_data ad;
4137 ad.type = LSM_AUDIT_DATA_KMOD;
4138 ad.u.kmod_name = kmod_name;
4140 return avc_has_perm(&selinux_state,
4141 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4142 SYSTEM__MODULE_REQUEST, &ad);
4145 static int selinux_kernel_module_from_file(struct file *file)
4147 struct common_audit_data ad;
4148 struct inode_security_struct *isec;
4149 struct file_security_struct *fsec;
4150 u32 sid = current_sid();
4155 return avc_has_perm(&selinux_state,
4156 sid, sid, SECCLASS_SYSTEM,
4157 SYSTEM__MODULE_LOAD, NULL);
4161 ad.type = LSM_AUDIT_DATA_FILE;
4164 fsec = selinux_file(file);
4165 if (sid != fsec->sid) {
4166 rc = avc_has_perm(&selinux_state,
4167 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4172 isec = inode_security(file_inode(file));
4173 return avc_has_perm(&selinux_state,
4174 sid, isec->sid, SECCLASS_SYSTEM,
4175 SYSTEM__MODULE_LOAD, &ad);
4178 static int selinux_kernel_read_file(struct file *file,
4179 enum kernel_read_file_id id,
4185 case READING_MODULE:
4186 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4195 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4200 case LOADING_MODULE:
4201 rc = selinux_kernel_module_from_file(NULL);
4210 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4212 return avc_has_perm(&selinux_state,
4213 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4214 PROCESS__SETPGID, NULL);
4217 static int selinux_task_getpgid(struct task_struct *p)
4219 return avc_has_perm(&selinux_state,
4220 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4221 PROCESS__GETPGID, NULL);
4224 static int selinux_task_getsid(struct task_struct *p)
4226 return avc_has_perm(&selinux_state,
4227 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4228 PROCESS__GETSESSION, NULL);
4231 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4233 *secid = task_sid_subj(p);
4236 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4238 *secid = task_sid_obj(p);
4241 static int selinux_task_setnice(struct task_struct *p, int nice)
4243 return avc_has_perm(&selinux_state,
4244 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4245 PROCESS__SETSCHED, NULL);
4248 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4250 return avc_has_perm(&selinux_state,
4251 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4252 PROCESS__SETSCHED, NULL);
4255 static int selinux_task_getioprio(struct task_struct *p)
4257 return avc_has_perm(&selinux_state,
4258 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4259 PROCESS__GETSCHED, NULL);
4262 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4269 if (flags & LSM_PRLIMIT_WRITE)
4270 av |= PROCESS__SETRLIMIT;
4271 if (flags & LSM_PRLIMIT_READ)
4272 av |= PROCESS__GETRLIMIT;
4273 return avc_has_perm(&selinux_state,
4274 cred_sid(cred), cred_sid(tcred),
4275 SECCLASS_PROCESS, av, NULL);
4278 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4279 struct rlimit *new_rlim)
4281 struct rlimit *old_rlim = p->signal->rlim + resource;
4283 /* Control the ability to change the hard limit (whether
4284 lowering or raising it), so that the hard limit can
4285 later be used as a safe reset point for the soft limit
4286 upon context transitions. See selinux_bprm_committing_creds. */
4287 if (old_rlim->rlim_max != new_rlim->rlim_max)
4288 return avc_has_perm(&selinux_state,
4289 current_sid(), task_sid_obj(p),
4290 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4295 static int selinux_task_setscheduler(struct task_struct *p)
4297 return avc_has_perm(&selinux_state,
4298 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4299 PROCESS__SETSCHED, NULL);
4302 static int selinux_task_getscheduler(struct task_struct *p)
4304 return avc_has_perm(&selinux_state,
4305 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4306 PROCESS__GETSCHED, NULL);
4309 static int selinux_task_movememory(struct task_struct *p)
4311 return avc_has_perm(&selinux_state,
4312 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4313 PROCESS__SETSCHED, NULL);
4316 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4317 int sig, const struct cred *cred)
4323 perm = PROCESS__SIGNULL; /* null signal; existence test */
4325 perm = signal_to_av(sig);
4327 secid = current_sid();
4329 secid = cred_sid(cred);
4330 return avc_has_perm(&selinux_state,
4331 secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4334 static void selinux_task_to_inode(struct task_struct *p,
4335 struct inode *inode)
4337 struct inode_security_struct *isec = selinux_inode(inode);
4338 u32 sid = task_sid_obj(p);
4340 spin_lock(&isec->lock);
4341 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4343 isec->initialized = LABEL_INITIALIZED;
4344 spin_unlock(&isec->lock);
4347 /* Returns error only if unable to parse addresses */
4348 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4349 struct common_audit_data *ad, u8 *proto)
4351 int offset, ihlen, ret = -EINVAL;
4352 struct iphdr _iph, *ih;
4354 offset = skb_network_offset(skb);
4355 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4359 ihlen = ih->ihl * 4;
4360 if (ihlen < sizeof(_iph))
4363 ad->u.net->v4info.saddr = ih->saddr;
4364 ad->u.net->v4info.daddr = ih->daddr;
4368 *proto = ih->protocol;
4370 switch (ih->protocol) {
4372 struct tcphdr _tcph, *th;
4374 if (ntohs(ih->frag_off) & IP_OFFSET)
4378 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4382 ad->u.net->sport = th->source;
4383 ad->u.net->dport = th->dest;
4388 struct udphdr _udph, *uh;
4390 if (ntohs(ih->frag_off) & IP_OFFSET)
4394 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4398 ad->u.net->sport = uh->source;
4399 ad->u.net->dport = uh->dest;
4403 case IPPROTO_DCCP: {
4404 struct dccp_hdr _dccph, *dh;
4406 if (ntohs(ih->frag_off) & IP_OFFSET)
4410 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4414 ad->u.net->sport = dh->dccph_sport;
4415 ad->u.net->dport = dh->dccph_dport;
4419 #if IS_ENABLED(CONFIG_IP_SCTP)
4420 case IPPROTO_SCTP: {
4421 struct sctphdr _sctph, *sh;
4423 if (ntohs(ih->frag_off) & IP_OFFSET)
4427 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4431 ad->u.net->sport = sh->source;
4432 ad->u.net->dport = sh->dest;
4443 #if IS_ENABLED(CONFIG_IPV6)
4445 /* Returns error only if unable to parse addresses */
4446 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4447 struct common_audit_data *ad, u8 *proto)
4450 int ret = -EINVAL, offset;
4451 struct ipv6hdr _ipv6h, *ip6;
4454 offset = skb_network_offset(skb);
4455 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4459 ad->u.net->v6info.saddr = ip6->saddr;
4460 ad->u.net->v6info.daddr = ip6->daddr;
4463 nexthdr = ip6->nexthdr;
4464 offset += sizeof(_ipv6h);
4465 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4474 struct tcphdr _tcph, *th;
4476 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4480 ad->u.net->sport = th->source;
4481 ad->u.net->dport = th->dest;
4486 struct udphdr _udph, *uh;
4488 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4492 ad->u.net->sport = uh->source;
4493 ad->u.net->dport = uh->dest;
4497 case IPPROTO_DCCP: {
4498 struct dccp_hdr _dccph, *dh;
4500 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4504 ad->u.net->sport = dh->dccph_sport;
4505 ad->u.net->dport = dh->dccph_dport;
4509 #if IS_ENABLED(CONFIG_IP_SCTP)
4510 case IPPROTO_SCTP: {
4511 struct sctphdr _sctph, *sh;
4513 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4517 ad->u.net->sport = sh->source;
4518 ad->u.net->dport = sh->dest;
4522 /* includes fragments */
4532 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4533 char **_addrp, int src, u8 *proto)
4538 switch (ad->u.net->family) {
4540 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4543 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4544 &ad->u.net->v4info.daddr);
4547 #if IS_ENABLED(CONFIG_IPV6)
4549 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4552 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4553 &ad->u.net->v6info.daddr);
4563 "SELinux: failure in selinux_parse_skb(),"
4564 " unable to parse packet\n");
4574 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4576 * @family: protocol family
4577 * @sid: the packet's peer label SID
4580 * Check the various different forms of network peer labeling and determine
4581 * the peer label/SID for the packet; most of the magic actually occurs in
4582 * the security server function security_net_peersid_cmp(). The function
4583 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4584 * or -EACCES if @sid is invalid due to inconsistencies with the different
4588 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4595 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4598 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4602 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4603 nlbl_type, xfrm_sid, sid);
4604 if (unlikely(err)) {
4606 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4607 " unable to determine packet's peer label\n");
4615 * selinux_conn_sid - Determine the child socket label for a connection
4616 * @sk_sid: the parent socket's SID
4617 * @skb_sid: the packet's SID
4618 * @conn_sid: the resulting connection SID
4620 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4621 * combined with the MLS information from @skb_sid in order to create
4622 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4623 * of @sk_sid. Returns zero on success, negative values on failure.
4626 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4630 if (skb_sid != SECSID_NULL)
4631 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4639 /* socket security operations */
4641 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4642 u16 secclass, u32 *socksid)
4644 if (tsec->sockcreate_sid > SECSID_NULL) {
4645 *socksid = tsec->sockcreate_sid;
4649 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4650 secclass, NULL, socksid);
4653 static int sock_has_perm(struct sock *sk, u32 perms)
4655 struct sk_security_struct *sksec = sk->sk_security;
4656 struct common_audit_data ad;
4657 struct lsm_network_audit net = {0,};
4659 if (sksec->sid == SECINITSID_KERNEL)
4662 ad.type = LSM_AUDIT_DATA_NET;
4666 return avc_has_perm(&selinux_state,
4667 current_sid(), sksec->sid, sksec->sclass, perms,
4671 static int selinux_socket_create(int family, int type,
4672 int protocol, int kern)
4674 const struct task_security_struct *tsec = selinux_cred(current_cred());
4682 secclass = socket_type_to_security_class(family, type, protocol);
4683 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4687 return avc_has_perm(&selinux_state,
4688 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4691 static int selinux_socket_post_create(struct socket *sock, int family,
4692 int type, int protocol, int kern)
4694 const struct task_security_struct *tsec = selinux_cred(current_cred());
4695 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4696 struct sk_security_struct *sksec;
4697 u16 sclass = socket_type_to_security_class(family, type, protocol);
4698 u32 sid = SECINITSID_KERNEL;
4702 err = socket_sockcreate_sid(tsec, sclass, &sid);
4707 isec->sclass = sclass;
4709 isec->initialized = LABEL_INITIALIZED;
4712 sksec = sock->sk->sk_security;
4713 sksec->sclass = sclass;
4715 /* Allows detection of the first association on this socket */
4716 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4717 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4719 err = selinux_netlbl_socket_post_create(sock->sk, family);
4725 static int selinux_socket_socketpair(struct socket *socka,
4726 struct socket *sockb)
4728 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4729 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4731 sksec_a->peer_sid = sksec_b->sid;
4732 sksec_b->peer_sid = sksec_a->sid;
4737 /* Range of port numbers used to automatically bind.
4738 Need to determine whether we should perform a name_bind
4739 permission check between the socket and the port number. */
4741 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4743 struct sock *sk = sock->sk;
4744 struct sk_security_struct *sksec = sk->sk_security;
4748 err = sock_has_perm(sk, SOCKET__BIND);
4752 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4753 family = sk->sk_family;
4754 if (family == PF_INET || family == PF_INET6) {
4756 struct common_audit_data ad;
4757 struct lsm_network_audit net = {0,};
4758 struct sockaddr_in *addr4 = NULL;
4759 struct sockaddr_in6 *addr6 = NULL;
4761 unsigned short snum;
4765 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4766 * that validates multiple binding addresses. Because of this
4767 * need to check address->sa_family as it is possible to have
4768 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4770 if (addrlen < offsetofend(struct sockaddr, sa_family))
4772 family_sa = address->sa_family;
4773 switch (family_sa) {
4776 if (addrlen < sizeof(struct sockaddr_in))
4778 addr4 = (struct sockaddr_in *)address;
4779 if (family_sa == AF_UNSPEC) {
4780 /* see __inet_bind(), we only want to allow
4781 * AF_UNSPEC if the address is INADDR_ANY
4783 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4785 family_sa = AF_INET;
4787 snum = ntohs(addr4->sin_port);
4788 addrp = (char *)&addr4->sin_addr.s_addr;
4791 if (addrlen < SIN6_LEN_RFC2133)
4793 addr6 = (struct sockaddr_in6 *)address;
4794 snum = ntohs(addr6->sin6_port);
4795 addrp = (char *)&addr6->sin6_addr.s6_addr;
4801 ad.type = LSM_AUDIT_DATA_NET;
4803 ad.u.net->sport = htons(snum);
4804 ad.u.net->family = family_sa;
4809 inet_get_local_port_range(sock_net(sk), &low, &high);
4811 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4812 snum < low || snum > high) {
4813 err = sel_netport_sid(sk->sk_protocol,
4817 err = avc_has_perm(&selinux_state,
4820 SOCKET__NAME_BIND, &ad);
4826 switch (sksec->sclass) {
4827 case SECCLASS_TCP_SOCKET:
4828 node_perm = TCP_SOCKET__NODE_BIND;
4831 case SECCLASS_UDP_SOCKET:
4832 node_perm = UDP_SOCKET__NODE_BIND;
4835 case SECCLASS_DCCP_SOCKET:
4836 node_perm = DCCP_SOCKET__NODE_BIND;
4839 case SECCLASS_SCTP_SOCKET:
4840 node_perm = SCTP_SOCKET__NODE_BIND;
4844 node_perm = RAWIP_SOCKET__NODE_BIND;
4848 err = sel_netnode_sid(addrp, family_sa, &sid);
4852 if (family_sa == AF_INET)
4853 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4855 ad.u.net->v6info.saddr = addr6->sin6_addr;
4857 err = avc_has_perm(&selinux_state,
4859 sksec->sclass, node_perm, &ad);
4866 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4867 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4869 return -EAFNOSUPPORT;
4872 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4873 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4875 static int selinux_socket_connect_helper(struct socket *sock,
4876 struct sockaddr *address, int addrlen)
4878 struct sock *sk = sock->sk;
4879 struct sk_security_struct *sksec = sk->sk_security;
4882 err = sock_has_perm(sk, SOCKET__CONNECT);
4885 if (addrlen < offsetofend(struct sockaddr, sa_family))
4888 /* connect(AF_UNSPEC) has special handling, as it is a documented
4889 * way to disconnect the socket
4891 if (address->sa_family == AF_UNSPEC)
4895 * If a TCP, DCCP or SCTP socket, check name_connect permission
4898 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4899 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4900 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4901 struct common_audit_data ad;
4902 struct lsm_network_audit net = {0,};
4903 struct sockaddr_in *addr4 = NULL;
4904 struct sockaddr_in6 *addr6 = NULL;
4905 unsigned short snum;
4908 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4909 * that validates multiple connect addresses. Because of this
4910 * need to check address->sa_family as it is possible to have
4911 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4913 switch (address->sa_family) {
4915 addr4 = (struct sockaddr_in *)address;
4916 if (addrlen < sizeof(struct sockaddr_in))
4918 snum = ntohs(addr4->sin_port);
4921 addr6 = (struct sockaddr_in6 *)address;
4922 if (addrlen < SIN6_LEN_RFC2133)
4924 snum = ntohs(addr6->sin6_port);
4927 /* Note that SCTP services expect -EINVAL, whereas
4928 * others expect -EAFNOSUPPORT.
4930 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4933 return -EAFNOSUPPORT;
4936 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4940 switch (sksec->sclass) {
4941 case SECCLASS_TCP_SOCKET:
4942 perm = TCP_SOCKET__NAME_CONNECT;
4944 case SECCLASS_DCCP_SOCKET:
4945 perm = DCCP_SOCKET__NAME_CONNECT;
4947 case SECCLASS_SCTP_SOCKET:
4948 perm = SCTP_SOCKET__NAME_CONNECT;
4952 ad.type = LSM_AUDIT_DATA_NET;
4954 ad.u.net->dport = htons(snum);
4955 ad.u.net->family = address->sa_family;
4956 err = avc_has_perm(&selinux_state,
4957 sksec->sid, sid, sksec->sclass, perm, &ad);
4965 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4966 static int selinux_socket_connect(struct socket *sock,
4967 struct sockaddr *address, int addrlen)
4970 struct sock *sk = sock->sk;
4972 err = selinux_socket_connect_helper(sock, address, addrlen);
4976 return selinux_netlbl_socket_connect(sk, address);
4979 static int selinux_socket_listen(struct socket *sock, int backlog)
4981 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4984 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4987 struct inode_security_struct *isec;
4988 struct inode_security_struct *newisec;
4992 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4996 isec = inode_security_novalidate(SOCK_INODE(sock));
4997 spin_lock(&isec->lock);
4998 sclass = isec->sclass;
5000 spin_unlock(&isec->lock);
5002 newisec = inode_security_novalidate(SOCK_INODE(newsock));
5003 newisec->sclass = sclass;
5005 newisec->initialized = LABEL_INITIALIZED;
5010 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5013 return sock_has_perm(sock->sk, SOCKET__WRITE);
5016 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5017 int size, int flags)
5019 return sock_has_perm(sock->sk, SOCKET__READ);
5022 static int selinux_socket_getsockname(struct socket *sock)
5024 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5027 static int selinux_socket_getpeername(struct socket *sock)
5029 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5032 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5036 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5040 return selinux_netlbl_socket_setsockopt(sock, level, optname);
5043 static int selinux_socket_getsockopt(struct socket *sock, int level,
5046 return sock_has_perm(sock->sk, SOCKET__GETOPT);
5049 static int selinux_socket_shutdown(struct socket *sock, int how)
5051 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5054 static int selinux_socket_unix_stream_connect(struct sock *sock,
5058 struct sk_security_struct *sksec_sock = sock->sk_security;
5059 struct sk_security_struct *sksec_other = other->sk_security;
5060 struct sk_security_struct *sksec_new = newsk->sk_security;
5061 struct common_audit_data ad;
5062 struct lsm_network_audit net = {0,};
5065 ad.type = LSM_AUDIT_DATA_NET;
5067 ad.u.net->sk = other;
5069 err = avc_has_perm(&selinux_state,
5070 sksec_sock->sid, sksec_other->sid,
5071 sksec_other->sclass,
5072 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5076 /* server child socket */
5077 sksec_new->peer_sid = sksec_sock->sid;
5078 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5079 sksec_sock->sid, &sksec_new->sid);
5083 /* connecting socket */
5084 sksec_sock->peer_sid = sksec_new->sid;
5089 static int selinux_socket_unix_may_send(struct socket *sock,
5090 struct socket *other)
5092 struct sk_security_struct *ssec = sock->sk->sk_security;
5093 struct sk_security_struct *osec = other->sk->sk_security;
5094 struct common_audit_data ad;
5095 struct lsm_network_audit net = {0,};
5097 ad.type = LSM_AUDIT_DATA_NET;
5099 ad.u.net->sk = other->sk;
5101 return avc_has_perm(&selinux_state,
5102 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5106 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5107 char *addrp, u16 family, u32 peer_sid,
5108 struct common_audit_data *ad)
5114 err = sel_netif_sid(ns, ifindex, &if_sid);
5117 err = avc_has_perm(&selinux_state,
5119 SECCLASS_NETIF, NETIF__INGRESS, ad);
5123 err = sel_netnode_sid(addrp, family, &node_sid);
5126 return avc_has_perm(&selinux_state,
5128 SECCLASS_NODE, NODE__RECVFROM, ad);
5131 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5135 struct sk_security_struct *sksec = sk->sk_security;
5136 u32 sk_sid = sksec->sid;
5137 struct common_audit_data ad;
5138 struct lsm_network_audit net = {0,};
5141 ad.type = LSM_AUDIT_DATA_NET;
5143 ad.u.net->netif = skb->skb_iif;
5144 ad.u.net->family = family;
5145 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5149 if (selinux_secmark_enabled()) {
5150 err = avc_has_perm(&selinux_state,
5151 sk_sid, skb->secmark, SECCLASS_PACKET,
5157 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5160 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5165 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5168 struct sk_security_struct *sksec = sk->sk_security;
5169 u16 family = sk->sk_family;
5170 u32 sk_sid = sksec->sid;
5171 struct common_audit_data ad;
5172 struct lsm_network_audit net = {0,};
5177 if (family != PF_INET && family != PF_INET6)
5180 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5181 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5184 /* If any sort of compatibility mode is enabled then handoff processing
5185 * to the selinux_sock_rcv_skb_compat() function to deal with the
5186 * special handling. We do this in an attempt to keep this function
5187 * as fast and as clean as possible. */
5188 if (!selinux_policycap_netpeer())
5189 return selinux_sock_rcv_skb_compat(sk, skb, family);
5191 secmark_active = selinux_secmark_enabled();
5192 peerlbl_active = selinux_peerlbl_enabled();
5193 if (!secmark_active && !peerlbl_active)
5196 ad.type = LSM_AUDIT_DATA_NET;
5198 ad.u.net->netif = skb->skb_iif;
5199 ad.u.net->family = family;
5200 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5204 if (peerlbl_active) {
5207 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5210 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5211 addrp, family, peer_sid, &ad);
5213 selinux_netlbl_err(skb, family, err, 0);
5216 err = avc_has_perm(&selinux_state,
5217 sk_sid, peer_sid, SECCLASS_PEER,
5220 selinux_netlbl_err(skb, family, err, 0);
5225 if (secmark_active) {
5226 err = avc_has_perm(&selinux_state,
5227 sk_sid, skb->secmark, SECCLASS_PACKET,
5236 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5237 int __user *optlen, unsigned len)
5242 struct sk_security_struct *sksec = sock->sk->sk_security;
5243 u32 peer_sid = SECSID_NULL;
5245 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5246 sksec->sclass == SECCLASS_TCP_SOCKET ||
5247 sksec->sclass == SECCLASS_SCTP_SOCKET)
5248 peer_sid = sksec->peer_sid;
5249 if (peer_sid == SECSID_NULL)
5250 return -ENOPROTOOPT;
5252 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5257 if (scontext_len > len) {
5262 if (copy_to_user(optval, scontext, scontext_len))
5266 if (put_user(scontext_len, optlen))
5272 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5274 u32 peer_secid = SECSID_NULL;
5276 struct inode_security_struct *isec;
5278 if (skb && skb->protocol == htons(ETH_P_IP))
5280 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5283 family = sock->sk->sk_family;
5287 if (sock && family == PF_UNIX) {
5288 isec = inode_security_novalidate(SOCK_INODE(sock));
5289 peer_secid = isec->sid;
5291 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5294 *secid = peer_secid;
5295 if (peer_secid == SECSID_NULL)
5300 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5302 struct sk_security_struct *sksec;
5304 sksec = kzalloc(sizeof(*sksec), priority);
5308 sksec->peer_sid = SECINITSID_UNLABELED;
5309 sksec->sid = SECINITSID_UNLABELED;
5310 sksec->sclass = SECCLASS_SOCKET;
5311 selinux_netlbl_sk_security_reset(sksec);
5312 sk->sk_security = sksec;
5317 static void selinux_sk_free_security(struct sock *sk)
5319 struct sk_security_struct *sksec = sk->sk_security;
5321 sk->sk_security = NULL;
5322 selinux_netlbl_sk_security_free(sksec);
5326 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5328 struct sk_security_struct *sksec = sk->sk_security;
5329 struct sk_security_struct *newsksec = newsk->sk_security;
5331 newsksec->sid = sksec->sid;
5332 newsksec->peer_sid = sksec->peer_sid;
5333 newsksec->sclass = sksec->sclass;
5335 selinux_netlbl_sk_security_reset(newsksec);
5338 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5341 *secid = SECINITSID_ANY_SOCKET;
5343 struct sk_security_struct *sksec = sk->sk_security;
5345 *secid = sksec->sid;
5349 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5351 struct inode_security_struct *isec =
5352 inode_security_novalidate(SOCK_INODE(parent));
5353 struct sk_security_struct *sksec = sk->sk_security;
5355 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5356 sk->sk_family == PF_UNIX)
5357 isec->sid = sksec->sid;
5358 sksec->sclass = isec->sclass;
5361 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5362 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5365 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5366 struct sk_buff *skb)
5368 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5369 struct common_audit_data ad;
5370 struct lsm_network_audit net = {0,};
5372 u32 peer_sid = SECINITSID_UNLABELED;
5376 if (!selinux_policycap_extsockclass())
5379 peerlbl_active = selinux_peerlbl_enabled();
5381 if (peerlbl_active) {
5382 /* This will return peer_sid = SECSID_NULL if there are
5383 * no peer labels, see security_net_peersid_resolve().
5385 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5390 if (peer_sid == SECSID_NULL)
5391 peer_sid = SECINITSID_UNLABELED;
5394 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5395 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5397 /* Here as first association on socket. As the peer SID
5398 * was allowed by peer recv (and the netif/node checks),
5399 * then it is approved by policy and used as the primary
5400 * peer SID for getpeercon(3).
5402 sksec->peer_sid = peer_sid;
5403 } else if (sksec->peer_sid != peer_sid) {
5404 /* Other association peer SIDs are checked to enforce
5405 * consistency among the peer SIDs.
5407 ad.type = LSM_AUDIT_DATA_NET;
5409 ad.u.net->sk = ep->base.sk;
5410 err = avc_has_perm(&selinux_state,
5411 sksec->peer_sid, peer_sid, sksec->sclass,
5412 SCTP_SOCKET__ASSOCIATION, &ad);
5417 /* Compute the MLS component for the connection and store
5418 * the information in ep. This will be used by SCTP TCP type
5419 * sockets and peeled off connections as they cause a new
5420 * socket to be generated. selinux_sctp_sk_clone() will then
5421 * plug this into the new socket.
5423 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5427 ep->secid = conn_sid;
5428 ep->peer_secid = peer_sid;
5430 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5431 return selinux_netlbl_sctp_assoc_request(ep, skb);
5434 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5435 * based on their @optname.
5437 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5438 struct sockaddr *address,
5441 int len, err = 0, walk_size = 0;
5443 struct sockaddr *addr;
5444 struct socket *sock;
5446 if (!selinux_policycap_extsockclass())
5449 /* Process one or more addresses that may be IPv4 or IPv6 */
5450 sock = sk->sk_socket;
5453 while (walk_size < addrlen) {
5454 if (walk_size + sizeof(sa_family_t) > addrlen)
5458 switch (addr->sa_family) {
5461 len = sizeof(struct sockaddr_in);
5464 len = sizeof(struct sockaddr_in6);
5470 if (walk_size + len > addrlen)
5476 case SCTP_PRIMARY_ADDR:
5477 case SCTP_SET_PEER_PRIMARY_ADDR:
5478 case SCTP_SOCKOPT_BINDX_ADD:
5479 err = selinux_socket_bind(sock, addr, len);
5481 /* Connect checks */
5482 case SCTP_SOCKOPT_CONNECTX:
5483 case SCTP_PARAM_SET_PRIMARY:
5484 case SCTP_PARAM_ADD_IP:
5485 case SCTP_SENDMSG_CONNECT:
5486 err = selinux_socket_connect_helper(sock, addr, len);
5490 /* As selinux_sctp_bind_connect() is called by the
5491 * SCTP protocol layer, the socket is already locked,
5492 * therefore selinux_netlbl_socket_connect_locked()
5493 * is called here. The situations handled are:
5494 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5495 * whenever a new IP address is added or when a new
5496 * primary address is selected.
5497 * Note that an SCTP connect(2) call happens before
5498 * the SCTP protocol layer and is handled via
5499 * selinux_socket_connect().
5501 err = selinux_netlbl_socket_connect_locked(sk, addr);
5515 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5516 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5519 struct sk_security_struct *sksec = sk->sk_security;
5520 struct sk_security_struct *newsksec = newsk->sk_security;
5522 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5523 * the non-sctp clone version.
5525 if (!selinux_policycap_extsockclass())
5526 return selinux_sk_clone_security(sk, newsk);
5528 newsksec->sid = ep->secid;
5529 newsksec->peer_sid = ep->peer_secid;
5530 newsksec->sclass = sksec->sclass;
5531 selinux_netlbl_sctp_sk_clone(sk, newsk);
5534 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5535 struct request_sock *req)
5537 struct sk_security_struct *sksec = sk->sk_security;
5539 u16 family = req->rsk_ops->family;
5543 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5546 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5549 req->secid = connsid;
5550 req->peer_secid = peersid;
5552 return selinux_netlbl_inet_conn_request(req, family);
5555 static void selinux_inet_csk_clone(struct sock *newsk,
5556 const struct request_sock *req)
5558 struct sk_security_struct *newsksec = newsk->sk_security;
5560 newsksec->sid = req->secid;
5561 newsksec->peer_sid = req->peer_secid;
5562 /* NOTE: Ideally, we should also get the isec->sid for the
5563 new socket in sync, but we don't have the isec available yet.
5564 So we will wait until sock_graft to do it, by which
5565 time it will have been created and available. */
5567 /* We don't need to take any sort of lock here as we are the only
5568 * thread with access to newsksec */
5569 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5572 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5574 u16 family = sk->sk_family;
5575 struct sk_security_struct *sksec = sk->sk_security;
5577 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5578 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5581 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5584 static int selinux_secmark_relabel_packet(u32 sid)
5586 const struct task_security_struct *__tsec;
5589 __tsec = selinux_cred(current_cred());
5592 return avc_has_perm(&selinux_state,
5593 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5597 static void selinux_secmark_refcount_inc(void)
5599 atomic_inc(&selinux_secmark_refcount);
5602 static void selinux_secmark_refcount_dec(void)
5604 atomic_dec(&selinux_secmark_refcount);
5607 static void selinux_req_classify_flow(const struct request_sock *req,
5608 struct flowi_common *flic)
5610 flic->flowic_secid = req->secid;
5613 static int selinux_tun_dev_alloc_security(void **security)
5615 struct tun_security_struct *tunsec;
5617 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5620 tunsec->sid = current_sid();
5626 static void selinux_tun_dev_free_security(void *security)
5631 static int selinux_tun_dev_create(void)
5633 u32 sid = current_sid();
5635 /* we aren't taking into account the "sockcreate" SID since the socket
5636 * that is being created here is not a socket in the traditional sense,
5637 * instead it is a private sock, accessible only to the kernel, and
5638 * representing a wide range of network traffic spanning multiple
5639 * connections unlike traditional sockets - check the TUN driver to
5640 * get a better understanding of why this socket is special */
5642 return avc_has_perm(&selinux_state,
5643 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5647 static int selinux_tun_dev_attach_queue(void *security)
5649 struct tun_security_struct *tunsec = security;
5651 return avc_has_perm(&selinux_state,
5652 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5653 TUN_SOCKET__ATTACH_QUEUE, NULL);
5656 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5658 struct tun_security_struct *tunsec = security;
5659 struct sk_security_struct *sksec = sk->sk_security;
5661 /* we don't currently perform any NetLabel based labeling here and it
5662 * isn't clear that we would want to do so anyway; while we could apply
5663 * labeling without the support of the TUN user the resulting labeled
5664 * traffic from the other end of the connection would almost certainly
5665 * cause confusion to the TUN user that had no idea network labeling
5666 * protocols were being used */
5668 sksec->sid = tunsec->sid;
5669 sksec->sclass = SECCLASS_TUN_SOCKET;
5674 static int selinux_tun_dev_open(void *security)
5676 struct tun_security_struct *tunsec = security;
5677 u32 sid = current_sid();
5680 err = avc_has_perm(&selinux_state,
5681 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5682 TUN_SOCKET__RELABELFROM, NULL);
5685 err = avc_has_perm(&selinux_state,
5686 sid, sid, SECCLASS_TUN_SOCKET,
5687 TUN_SOCKET__RELABELTO, NULL);
5695 #ifdef CONFIG_NETFILTER
5697 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5698 const struct net_device *indev,
5704 struct common_audit_data ad;
5705 struct lsm_network_audit net = {0,};
5710 if (!selinux_policycap_netpeer())
5713 secmark_active = selinux_secmark_enabled();
5714 netlbl_active = netlbl_enabled();
5715 peerlbl_active = selinux_peerlbl_enabled();
5716 if (!secmark_active && !peerlbl_active)
5719 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5722 ad.type = LSM_AUDIT_DATA_NET;
5724 ad.u.net->netif = indev->ifindex;
5725 ad.u.net->family = family;
5726 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5729 if (peerlbl_active) {
5730 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5731 addrp, family, peer_sid, &ad);
5733 selinux_netlbl_err(skb, family, err, 1);
5739 if (avc_has_perm(&selinux_state,
5740 peer_sid, skb->secmark,
5741 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5745 /* we do this in the FORWARD path and not the POST_ROUTING
5746 * path because we want to make sure we apply the necessary
5747 * labeling before IPsec is applied so we can leverage AH
5749 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5755 static unsigned int selinux_ipv4_forward(void *priv,
5756 struct sk_buff *skb,
5757 const struct nf_hook_state *state)
5759 return selinux_ip_forward(skb, state->in, PF_INET);
5762 #if IS_ENABLED(CONFIG_IPV6)
5763 static unsigned int selinux_ipv6_forward(void *priv,
5764 struct sk_buff *skb,
5765 const struct nf_hook_state *state)
5767 return selinux_ip_forward(skb, state->in, PF_INET6);
5771 static unsigned int selinux_ip_output(struct sk_buff *skb,
5777 if (!netlbl_enabled())
5780 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5781 * because we want to make sure we apply the necessary labeling
5782 * before IPsec is applied so we can leverage AH protection */
5785 struct sk_security_struct *sksec;
5787 if (sk_listener(sk))
5788 /* if the socket is the listening state then this
5789 * packet is a SYN-ACK packet which means it needs to
5790 * be labeled based on the connection/request_sock and
5791 * not the parent socket. unfortunately, we can't
5792 * lookup the request_sock yet as it isn't queued on
5793 * the parent socket until after the SYN-ACK is sent.
5794 * the "solution" is to simply pass the packet as-is
5795 * as any IP option based labeling should be copied
5796 * from the initial connection request (in the IP
5797 * layer). it is far from ideal, but until we get a
5798 * security label in the packet itself this is the
5799 * best we can do. */
5802 /* standard practice, label using the parent socket */
5803 sksec = sk->sk_security;
5806 sid = SECINITSID_KERNEL;
5807 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5813 static unsigned int selinux_ipv4_output(void *priv,
5814 struct sk_buff *skb,
5815 const struct nf_hook_state *state)
5817 return selinux_ip_output(skb, PF_INET);
5820 #if IS_ENABLED(CONFIG_IPV6)
5821 static unsigned int selinux_ipv6_output(void *priv,
5822 struct sk_buff *skb,
5823 const struct nf_hook_state *state)
5825 return selinux_ip_output(skb, PF_INET6);
5829 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5833 struct sock *sk = skb_to_full_sk(skb);
5834 struct sk_security_struct *sksec;
5835 struct common_audit_data ad;
5836 struct lsm_network_audit net = {0,};
5842 sksec = sk->sk_security;
5844 ad.type = LSM_AUDIT_DATA_NET;
5846 ad.u.net->netif = ifindex;
5847 ad.u.net->family = family;
5848 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5851 if (selinux_secmark_enabled())
5852 if (avc_has_perm(&selinux_state,
5853 sksec->sid, skb->secmark,
5854 SECCLASS_PACKET, PACKET__SEND, &ad))
5855 return NF_DROP_ERR(-ECONNREFUSED);
5857 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5858 return NF_DROP_ERR(-ECONNREFUSED);
5863 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5864 const struct net_device *outdev,
5869 int ifindex = outdev->ifindex;
5871 struct common_audit_data ad;
5872 struct lsm_network_audit net = {0,};
5877 /* If any sort of compatibility mode is enabled then handoff processing
5878 * to the selinux_ip_postroute_compat() function to deal with the
5879 * special handling. We do this in an attempt to keep this function
5880 * as fast and as clean as possible. */
5881 if (!selinux_policycap_netpeer())
5882 return selinux_ip_postroute_compat(skb, ifindex, family);
5884 secmark_active = selinux_secmark_enabled();
5885 peerlbl_active = selinux_peerlbl_enabled();
5886 if (!secmark_active && !peerlbl_active)
5889 sk = skb_to_full_sk(skb);
5892 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5893 * packet transformation so allow the packet to pass without any checks
5894 * since we'll have another chance to perform access control checks
5895 * when the packet is on it's final way out.
5896 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5897 * is NULL, in this case go ahead and apply access control.
5898 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5899 * TCP listening state we cannot wait until the XFRM processing
5900 * is done as we will miss out on the SA label if we do;
5901 * unfortunately, this means more work, but it is only once per
5903 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5904 !(sk && sk_listener(sk)))
5909 /* Without an associated socket the packet is either coming
5910 * from the kernel or it is being forwarded; check the packet
5911 * to determine which and if the packet is being forwarded
5912 * query the packet directly to determine the security label. */
5914 secmark_perm = PACKET__FORWARD_OUT;
5915 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5918 secmark_perm = PACKET__SEND;
5919 peer_sid = SECINITSID_KERNEL;
5921 } else if (sk_listener(sk)) {
5922 /* Locally generated packet but the associated socket is in the
5923 * listening state which means this is a SYN-ACK packet. In
5924 * this particular case the correct security label is assigned
5925 * to the connection/request_sock but unfortunately we can't
5926 * query the request_sock as it isn't queued on the parent
5927 * socket until after the SYN-ACK packet is sent; the only
5928 * viable choice is to regenerate the label like we do in
5929 * selinux_inet_conn_request(). See also selinux_ip_output()
5930 * for similar problems. */
5932 struct sk_security_struct *sksec;
5934 sksec = sk->sk_security;
5935 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5937 /* At this point, if the returned skb peerlbl is SECSID_NULL
5938 * and the packet has been through at least one XFRM
5939 * transformation then we must be dealing with the "final"
5940 * form of labeled IPsec packet; since we've already applied
5941 * all of our access controls on this packet we can safely
5942 * pass the packet. */
5943 if (skb_sid == SECSID_NULL) {
5946 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5950 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5954 return NF_DROP_ERR(-ECONNREFUSED);
5957 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5959 secmark_perm = PACKET__SEND;
5961 /* Locally generated packet, fetch the security label from the
5962 * associated socket. */
5963 struct sk_security_struct *sksec = sk->sk_security;
5964 peer_sid = sksec->sid;
5965 secmark_perm = PACKET__SEND;
5968 ad.type = LSM_AUDIT_DATA_NET;
5970 ad.u.net->netif = ifindex;
5971 ad.u.net->family = family;
5972 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5976 if (avc_has_perm(&selinux_state,
5977 peer_sid, skb->secmark,
5978 SECCLASS_PACKET, secmark_perm, &ad))
5979 return NF_DROP_ERR(-ECONNREFUSED);
5981 if (peerlbl_active) {
5985 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5987 if (avc_has_perm(&selinux_state,
5989 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5990 return NF_DROP_ERR(-ECONNREFUSED);
5992 if (sel_netnode_sid(addrp, family, &node_sid))
5994 if (avc_has_perm(&selinux_state,
5996 SECCLASS_NODE, NODE__SENDTO, &ad))
5997 return NF_DROP_ERR(-ECONNREFUSED);
6003 static unsigned int selinux_ipv4_postroute(void *priv,
6004 struct sk_buff *skb,
6005 const struct nf_hook_state *state)
6007 return selinux_ip_postroute(skb, state->out, PF_INET);
6010 #if IS_ENABLED(CONFIG_IPV6)
6011 static unsigned int selinux_ipv6_postroute(void *priv,
6012 struct sk_buff *skb,
6013 const struct nf_hook_state *state)
6015 return selinux_ip_postroute(skb, state->out, PF_INET6);
6019 #endif /* CONFIG_NETFILTER */
6021 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6024 unsigned int msg_len;
6025 unsigned int data_len = skb->len;
6026 unsigned char *data = skb->data;
6027 struct nlmsghdr *nlh;
6028 struct sk_security_struct *sksec = sk->sk_security;
6029 u16 sclass = sksec->sclass;
6032 while (data_len >= nlmsg_total_size(0)) {
6033 nlh = (struct nlmsghdr *)data;
6035 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
6036 * users which means we can't reject skb's with bogus
6037 * length fields; our solution is to follow what
6038 * netlink_rcv_skb() does and simply skip processing at
6039 * messages with length fields that are clearly junk
6041 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6044 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6046 rc = sock_has_perm(sk, perm);
6049 } else if (rc == -EINVAL) {
6050 /* -EINVAL is a missing msg/perm mapping */
6051 pr_warn_ratelimited("SELinux: unrecognized netlink"
6052 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
6053 " pid=%d comm=%s\n",
6054 sk->sk_protocol, nlh->nlmsg_type,
6055 secclass_map[sclass - 1].name,
6056 task_pid_nr(current), current->comm);
6057 if (enforcing_enabled(&selinux_state) &&
6058 !security_get_allow_unknown(&selinux_state))
6061 } else if (rc == -ENOENT) {
6062 /* -ENOENT is a missing socket/class mapping, ignore */
6068 /* move to the next message after applying netlink padding */
6069 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6070 if (msg_len >= data_len)
6072 data_len -= msg_len;
6079 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6081 isec->sclass = sclass;
6082 isec->sid = current_sid();
6085 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6088 struct ipc_security_struct *isec;
6089 struct common_audit_data ad;
6090 u32 sid = current_sid();
6092 isec = selinux_ipc(ipc_perms);
6094 ad.type = LSM_AUDIT_DATA_IPC;
6095 ad.u.ipc_id = ipc_perms->key;
6097 return avc_has_perm(&selinux_state,
6098 sid, isec->sid, isec->sclass, perms, &ad);
6101 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6103 struct msg_security_struct *msec;
6105 msec = selinux_msg_msg(msg);
6106 msec->sid = SECINITSID_UNLABELED;
6111 /* message queue security operations */
6112 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6114 struct ipc_security_struct *isec;
6115 struct common_audit_data ad;
6116 u32 sid = current_sid();
6119 isec = selinux_ipc(msq);
6120 ipc_init_security(isec, SECCLASS_MSGQ);
6122 ad.type = LSM_AUDIT_DATA_IPC;
6123 ad.u.ipc_id = msq->key;
6125 rc = avc_has_perm(&selinux_state,
6126 sid, isec->sid, SECCLASS_MSGQ,
6131 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6133 struct ipc_security_struct *isec;
6134 struct common_audit_data ad;
6135 u32 sid = current_sid();
6137 isec = selinux_ipc(msq);
6139 ad.type = LSM_AUDIT_DATA_IPC;
6140 ad.u.ipc_id = msq->key;
6142 return avc_has_perm(&selinux_state,
6143 sid, isec->sid, SECCLASS_MSGQ,
6144 MSGQ__ASSOCIATE, &ad);
6147 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6155 /* No specific object, just general system-wide information. */
6156 return avc_has_perm(&selinux_state,
6157 current_sid(), SECINITSID_KERNEL,
6158 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6162 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6165 perms = MSGQ__SETATTR;
6168 perms = MSGQ__DESTROY;
6174 err = ipc_has_perm(msq, perms);
6178 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6180 struct ipc_security_struct *isec;
6181 struct msg_security_struct *msec;
6182 struct common_audit_data ad;
6183 u32 sid = current_sid();
6186 isec = selinux_ipc(msq);
6187 msec = selinux_msg_msg(msg);
6190 * First time through, need to assign label to the message
6192 if (msec->sid == SECINITSID_UNLABELED) {
6194 * Compute new sid based on current process and
6195 * message queue this message will be stored in
6197 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6198 SECCLASS_MSG, NULL, &msec->sid);
6203 ad.type = LSM_AUDIT_DATA_IPC;
6204 ad.u.ipc_id = msq->key;
6206 /* Can this process write to the queue? */
6207 rc = avc_has_perm(&selinux_state,
6208 sid, isec->sid, SECCLASS_MSGQ,
6211 /* Can this process send the message */
6212 rc = avc_has_perm(&selinux_state,
6213 sid, msec->sid, SECCLASS_MSG,
6216 /* Can the message be put in the queue? */
6217 rc = avc_has_perm(&selinux_state,
6218 msec->sid, isec->sid, SECCLASS_MSGQ,
6219 MSGQ__ENQUEUE, &ad);
6224 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6225 struct task_struct *target,
6226 long type, int mode)
6228 struct ipc_security_struct *isec;
6229 struct msg_security_struct *msec;
6230 struct common_audit_data ad;
6231 u32 sid = task_sid_subj(target);
6234 isec = selinux_ipc(msq);
6235 msec = selinux_msg_msg(msg);
6237 ad.type = LSM_AUDIT_DATA_IPC;
6238 ad.u.ipc_id = msq->key;
6240 rc = avc_has_perm(&selinux_state,
6242 SECCLASS_MSGQ, MSGQ__READ, &ad);
6244 rc = avc_has_perm(&selinux_state,
6246 SECCLASS_MSG, MSG__RECEIVE, &ad);
6250 /* Shared Memory security operations */
6251 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6253 struct ipc_security_struct *isec;
6254 struct common_audit_data ad;
6255 u32 sid = current_sid();
6258 isec = selinux_ipc(shp);
6259 ipc_init_security(isec, SECCLASS_SHM);
6261 ad.type = LSM_AUDIT_DATA_IPC;
6262 ad.u.ipc_id = shp->key;
6264 rc = avc_has_perm(&selinux_state,
6265 sid, isec->sid, SECCLASS_SHM,
6270 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6272 struct ipc_security_struct *isec;
6273 struct common_audit_data ad;
6274 u32 sid = current_sid();
6276 isec = selinux_ipc(shp);
6278 ad.type = LSM_AUDIT_DATA_IPC;
6279 ad.u.ipc_id = shp->key;
6281 return avc_has_perm(&selinux_state,
6282 sid, isec->sid, SECCLASS_SHM,
6283 SHM__ASSOCIATE, &ad);
6286 /* Note, at this point, shp is locked down */
6287 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6295 /* No specific object, just general system-wide information. */
6296 return avc_has_perm(&selinux_state,
6297 current_sid(), SECINITSID_KERNEL,
6298 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6302 perms = SHM__GETATTR | SHM__ASSOCIATE;
6305 perms = SHM__SETATTR;
6312 perms = SHM__DESTROY;
6318 err = ipc_has_perm(shp, perms);
6322 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6323 char __user *shmaddr, int shmflg)
6327 if (shmflg & SHM_RDONLY)
6330 perms = SHM__READ | SHM__WRITE;
6332 return ipc_has_perm(shp, perms);
6335 /* Semaphore security operations */
6336 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6338 struct ipc_security_struct *isec;
6339 struct common_audit_data ad;
6340 u32 sid = current_sid();
6343 isec = selinux_ipc(sma);
6344 ipc_init_security(isec, SECCLASS_SEM);
6346 ad.type = LSM_AUDIT_DATA_IPC;
6347 ad.u.ipc_id = sma->key;
6349 rc = avc_has_perm(&selinux_state,
6350 sid, isec->sid, SECCLASS_SEM,
6355 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6357 struct ipc_security_struct *isec;
6358 struct common_audit_data ad;
6359 u32 sid = current_sid();
6361 isec = selinux_ipc(sma);
6363 ad.type = LSM_AUDIT_DATA_IPC;
6364 ad.u.ipc_id = sma->key;
6366 return avc_has_perm(&selinux_state,
6367 sid, isec->sid, SECCLASS_SEM,
6368 SEM__ASSOCIATE, &ad);
6371 /* Note, at this point, sma is locked down */
6372 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6380 /* No specific object, just general system-wide information. */
6381 return avc_has_perm(&selinux_state,
6382 current_sid(), SECINITSID_KERNEL,
6383 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6387 perms = SEM__GETATTR;
6398 perms = SEM__DESTROY;
6401 perms = SEM__SETATTR;
6406 perms = SEM__GETATTR | SEM__ASSOCIATE;
6412 err = ipc_has_perm(sma, perms);
6416 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6417 struct sembuf *sops, unsigned nsops, int alter)
6422 perms = SEM__READ | SEM__WRITE;
6426 return ipc_has_perm(sma, perms);
6429 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6435 av |= IPC__UNIX_READ;
6437 av |= IPC__UNIX_WRITE;
6442 return ipc_has_perm(ipcp, av);
6445 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6447 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6451 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6454 inode_doinit_with_dentry(inode, dentry);
6457 static int selinux_getprocattr(struct task_struct *p,
6458 char *name, char **value)
6460 const struct task_security_struct *__tsec;
6466 __tsec = selinux_cred(__task_cred(p));
6469 error = avc_has_perm(&selinux_state,
6470 current_sid(), __tsec->sid,
6471 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6476 if (!strcmp(name, "current"))
6478 else if (!strcmp(name, "prev"))
6480 else if (!strcmp(name, "exec"))
6481 sid = __tsec->exec_sid;
6482 else if (!strcmp(name, "fscreate"))
6483 sid = __tsec->create_sid;
6484 else if (!strcmp(name, "keycreate"))
6485 sid = __tsec->keycreate_sid;
6486 else if (!strcmp(name, "sockcreate"))
6487 sid = __tsec->sockcreate_sid;
6497 error = security_sid_to_context(&selinux_state, sid, value, &len);
6507 static int selinux_setprocattr(const char *name, void *value, size_t size)
6509 struct task_security_struct *tsec;
6511 u32 mysid = current_sid(), sid = 0, ptsid;
6516 * Basic control over ability to set these attributes at all.
6518 if (!strcmp(name, "exec"))
6519 error = avc_has_perm(&selinux_state,
6520 mysid, mysid, SECCLASS_PROCESS,
6521 PROCESS__SETEXEC, NULL);
6522 else if (!strcmp(name, "fscreate"))
6523 error = avc_has_perm(&selinux_state,
6524 mysid, mysid, SECCLASS_PROCESS,
6525 PROCESS__SETFSCREATE, NULL);
6526 else if (!strcmp(name, "keycreate"))
6527 error = avc_has_perm(&selinux_state,
6528 mysid, mysid, SECCLASS_PROCESS,
6529 PROCESS__SETKEYCREATE, NULL);
6530 else if (!strcmp(name, "sockcreate"))
6531 error = avc_has_perm(&selinux_state,
6532 mysid, mysid, SECCLASS_PROCESS,
6533 PROCESS__SETSOCKCREATE, NULL);
6534 else if (!strcmp(name, "current"))
6535 error = avc_has_perm(&selinux_state,
6536 mysid, mysid, SECCLASS_PROCESS,
6537 PROCESS__SETCURRENT, NULL);
6543 /* Obtain a SID for the context, if one was specified. */
6544 if (size && str[0] && str[0] != '\n') {
6545 if (str[size-1] == '\n') {
6549 error = security_context_to_sid(&selinux_state, value, size,
6551 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6552 if (!has_cap_mac_admin(true)) {
6553 struct audit_buffer *ab;
6556 /* We strip a nul only if it is at the end, otherwise the
6557 * context contains a nul and we should audit that */
6558 if (str[size - 1] == '\0')
6559 audit_size = size - 1;
6562 ab = audit_log_start(audit_context(),
6565 audit_log_format(ab, "op=fscreate invalid_context=");
6566 audit_log_n_untrustedstring(ab, value, audit_size);
6571 error = security_context_to_sid_force(
6579 new = prepare_creds();
6583 /* Permission checking based on the specified context is
6584 performed during the actual operation (execve,
6585 open/mkdir/...), when we know the full context of the
6586 operation. See selinux_bprm_creds_for_exec for the execve
6587 checks and may_create for the file creation checks. The
6588 operation will then fail if the context is not permitted. */
6589 tsec = selinux_cred(new);
6590 if (!strcmp(name, "exec")) {
6591 tsec->exec_sid = sid;
6592 } else if (!strcmp(name, "fscreate")) {
6593 tsec->create_sid = sid;
6594 } else if (!strcmp(name, "keycreate")) {
6596 error = avc_has_perm(&selinux_state, mysid, sid,
6597 SECCLASS_KEY, KEY__CREATE, NULL);
6601 tsec->keycreate_sid = sid;
6602 } else if (!strcmp(name, "sockcreate")) {
6603 tsec->sockcreate_sid = sid;
6604 } else if (!strcmp(name, "current")) {
6609 /* Only allow single threaded processes to change context */
6611 if (!current_is_single_threaded()) {
6612 error = security_bounded_transition(&selinux_state,
6618 /* Check permissions for the transition. */
6619 error = avc_has_perm(&selinux_state,
6620 tsec->sid, sid, SECCLASS_PROCESS,
6621 PROCESS__DYNTRANSITION, NULL);
6625 /* Check for ptracing, and update the task SID if ok.
6626 Otherwise, leave SID unchanged and fail. */
6627 ptsid = ptrace_parent_sid();
6629 error = avc_has_perm(&selinux_state,
6630 ptsid, sid, SECCLASS_PROCESS,
6631 PROCESS__PTRACE, NULL);
6650 static int selinux_ismaclabel(const char *name)
6652 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6655 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6657 return security_sid_to_context(&selinux_state, secid,
6661 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6663 return security_context_to_sid(&selinux_state, secdata, seclen,
6667 static void selinux_release_secctx(char *secdata, u32 seclen)
6672 static void selinux_inode_invalidate_secctx(struct inode *inode)
6674 struct inode_security_struct *isec = selinux_inode(inode);
6676 spin_lock(&isec->lock);
6677 isec->initialized = LABEL_INVALID;
6678 spin_unlock(&isec->lock);
6682 * called with inode->i_mutex locked
6684 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6686 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6688 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6689 return rc == -EOPNOTSUPP ? 0 : rc;
6693 * called with inode->i_mutex locked
6695 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6697 return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6701 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6704 len = selinux_inode_getsecurity(&init_user_ns, inode,
6705 XATTR_SELINUX_SUFFIX, ctx, true);
6713 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6714 unsigned long flags)
6716 const struct task_security_struct *tsec;
6717 struct key_security_struct *ksec;
6719 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6723 tsec = selinux_cred(cred);
6724 if (tsec->keycreate_sid)
6725 ksec->sid = tsec->keycreate_sid;
6727 ksec->sid = tsec->sid;
6733 static void selinux_key_free(struct key *k)
6735 struct key_security_struct *ksec = k->security;
6741 static int selinux_key_permission(key_ref_t key_ref,
6742 const struct cred *cred,
6743 enum key_need_perm need_perm)
6746 struct key_security_struct *ksec;
6749 switch (need_perm) {
6756 case KEY_NEED_WRITE:
6759 case KEY_NEED_SEARCH:
6765 case KEY_NEED_SETATTR:
6766 perm = KEY__SETATTR;
6768 case KEY_NEED_UNLINK:
6769 case KEY_SYSADMIN_OVERRIDE:
6770 case KEY_AUTHTOKEN_OVERRIDE:
6771 case KEY_DEFER_PERM_CHECK:
6779 sid = cred_sid(cred);
6780 key = key_ref_to_ptr(key_ref);
6781 ksec = key->security;
6783 return avc_has_perm(&selinux_state,
6784 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6787 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6789 struct key_security_struct *ksec = key->security;
6790 char *context = NULL;
6794 rc = security_sid_to_context(&selinux_state, ksec->sid,
6802 #ifdef CONFIG_KEY_NOTIFICATIONS
6803 static int selinux_watch_key(struct key *key)
6805 struct key_security_struct *ksec = key->security;
6806 u32 sid = current_sid();
6808 return avc_has_perm(&selinux_state,
6809 sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6814 #ifdef CONFIG_SECURITY_INFINIBAND
6815 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6817 struct common_audit_data ad;
6820 struct ib_security_struct *sec = ib_sec;
6821 struct lsm_ibpkey_audit ibpkey;
6823 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6827 ad.type = LSM_AUDIT_DATA_IBPKEY;
6828 ibpkey.subnet_prefix = subnet_prefix;
6829 ibpkey.pkey = pkey_val;
6830 ad.u.ibpkey = &ibpkey;
6831 return avc_has_perm(&selinux_state,
6833 SECCLASS_INFINIBAND_PKEY,
6834 INFINIBAND_PKEY__ACCESS, &ad);
6837 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6840 struct common_audit_data ad;
6843 struct ib_security_struct *sec = ib_sec;
6844 struct lsm_ibendport_audit ibendport;
6846 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6852 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6853 strncpy(ibendport.dev_name, dev_name, sizeof(ibendport.dev_name));
6854 ibendport.port = port_num;
6855 ad.u.ibendport = &ibendport;
6856 return avc_has_perm(&selinux_state,
6858 SECCLASS_INFINIBAND_ENDPORT,
6859 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6862 static int selinux_ib_alloc_security(void **ib_sec)
6864 struct ib_security_struct *sec;
6866 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6869 sec->sid = current_sid();
6875 static void selinux_ib_free_security(void *ib_sec)
6881 #ifdef CONFIG_BPF_SYSCALL
6882 static int selinux_bpf(int cmd, union bpf_attr *attr,
6885 u32 sid = current_sid();
6889 case BPF_MAP_CREATE:
6890 ret = avc_has_perm(&selinux_state,
6891 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6895 ret = avc_has_perm(&selinux_state,
6896 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6907 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6911 if (fmode & FMODE_READ)
6912 av |= BPF__MAP_READ;
6913 if (fmode & FMODE_WRITE)
6914 av |= BPF__MAP_WRITE;
6918 /* This function will check the file pass through unix socket or binder to see
6919 * if it is a bpf related object. And apply correspinding checks on the bpf
6920 * object based on the type. The bpf maps and programs, not like other files and
6921 * socket, are using a shared anonymous inode inside the kernel as their inode.
6922 * So checking that inode cannot identify if the process have privilege to
6923 * access the bpf object and that's why we have to add this additional check in
6924 * selinux_file_receive and selinux_binder_transfer_files.
6926 static int bpf_fd_pass(struct file *file, u32 sid)
6928 struct bpf_security_struct *bpfsec;
6929 struct bpf_prog *prog;
6930 struct bpf_map *map;
6933 if (file->f_op == &bpf_map_fops) {
6934 map = file->private_data;
6935 bpfsec = map->security;
6936 ret = avc_has_perm(&selinux_state,
6937 sid, bpfsec->sid, SECCLASS_BPF,
6938 bpf_map_fmode_to_av(file->f_mode), NULL);
6941 } else if (file->f_op == &bpf_prog_fops) {
6942 prog = file->private_data;
6943 bpfsec = prog->aux->security;
6944 ret = avc_has_perm(&selinux_state,
6945 sid, bpfsec->sid, SECCLASS_BPF,
6946 BPF__PROG_RUN, NULL);
6953 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6955 u32 sid = current_sid();
6956 struct bpf_security_struct *bpfsec;
6958 bpfsec = map->security;
6959 return avc_has_perm(&selinux_state,
6960 sid, bpfsec->sid, SECCLASS_BPF,
6961 bpf_map_fmode_to_av(fmode), NULL);
6964 static int selinux_bpf_prog(struct bpf_prog *prog)
6966 u32 sid = current_sid();
6967 struct bpf_security_struct *bpfsec;
6969 bpfsec = prog->aux->security;
6970 return avc_has_perm(&selinux_state,
6971 sid, bpfsec->sid, SECCLASS_BPF,
6972 BPF__PROG_RUN, NULL);
6975 static int selinux_bpf_map_alloc(struct bpf_map *map)
6977 struct bpf_security_struct *bpfsec;
6979 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6983 bpfsec->sid = current_sid();
6984 map->security = bpfsec;
6989 static void selinux_bpf_map_free(struct bpf_map *map)
6991 struct bpf_security_struct *bpfsec = map->security;
6993 map->security = NULL;
6997 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6999 struct bpf_security_struct *bpfsec;
7001 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
7005 bpfsec->sid = current_sid();
7006 aux->security = bpfsec;
7011 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7013 struct bpf_security_struct *bpfsec = aux->security;
7015 aux->security = NULL;
7020 static int selinux_lockdown(enum lockdown_reason what)
7022 struct common_audit_data ad;
7023 u32 sid = current_sid();
7024 int invalid_reason = (what <= LOCKDOWN_NONE) ||
7025 (what == LOCKDOWN_INTEGRITY_MAX) ||
7026 (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7028 if (WARN(invalid_reason, "Invalid lockdown reason")) {
7029 audit_log(audit_context(),
7030 GFP_ATOMIC, AUDIT_SELINUX_ERR,
7031 "lockdown_reason=invalid");
7035 ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7038 if (what <= LOCKDOWN_INTEGRITY_MAX)
7039 return avc_has_perm(&selinux_state,
7040 sid, sid, SECCLASS_LOCKDOWN,
7041 LOCKDOWN__INTEGRITY, &ad);
7043 return avc_has_perm(&selinux_state,
7044 sid, sid, SECCLASS_LOCKDOWN,
7045 LOCKDOWN__CONFIDENTIALITY, &ad);
7048 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7049 .lbs_cred = sizeof(struct task_security_struct),
7050 .lbs_file = sizeof(struct file_security_struct),
7051 .lbs_inode = sizeof(struct inode_security_struct),
7052 .lbs_ipc = sizeof(struct ipc_security_struct),
7053 .lbs_msg_msg = sizeof(struct msg_security_struct),
7054 .lbs_superblock = sizeof(struct superblock_security_struct),
7057 #ifdef CONFIG_PERF_EVENTS
7058 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7060 u32 requested, sid = current_sid();
7062 if (type == PERF_SECURITY_OPEN)
7063 requested = PERF_EVENT__OPEN;
7064 else if (type == PERF_SECURITY_CPU)
7065 requested = PERF_EVENT__CPU;
7066 else if (type == PERF_SECURITY_KERNEL)
7067 requested = PERF_EVENT__KERNEL;
7068 else if (type == PERF_SECURITY_TRACEPOINT)
7069 requested = PERF_EVENT__TRACEPOINT;
7073 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7077 static int selinux_perf_event_alloc(struct perf_event *event)
7079 struct perf_event_security_struct *perfsec;
7081 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7085 perfsec->sid = current_sid();
7086 event->security = perfsec;
7091 static void selinux_perf_event_free(struct perf_event *event)
7093 struct perf_event_security_struct *perfsec = event->security;
7095 event->security = NULL;
7099 static int selinux_perf_event_read(struct perf_event *event)
7101 struct perf_event_security_struct *perfsec = event->security;
7102 u32 sid = current_sid();
7104 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7105 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7108 static int selinux_perf_event_write(struct perf_event *event)
7110 struct perf_event_security_struct *perfsec = event->security;
7111 u32 sid = current_sid();
7113 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7114 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7119 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7120 * 1. any hooks that don't belong to (2.) or (3.) below,
7121 * 2. hooks that both access structures allocated by other hooks, and allocate
7122 * structures that can be later accessed by other hooks (mostly "cloning"
7124 * 3. hooks that only allocate structures that can be later accessed by other
7125 * hooks ("allocating" hooks).
7127 * Please follow block comment delimiters in the list to keep this order.
7129 * This ordering is needed for SELinux runtime disable to work at least somewhat
7130 * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7131 * when disabling SELinux at runtime.
7133 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7134 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7135 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7136 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7137 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7139 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7140 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7141 LSM_HOOK_INIT(capget, selinux_capget),
7142 LSM_HOOK_INIT(capset, selinux_capset),
7143 LSM_HOOK_INIT(capable, selinux_capable),
7144 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7145 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7146 LSM_HOOK_INIT(syslog, selinux_syslog),
7147 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7149 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7151 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7152 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7153 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7155 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7156 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7157 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7158 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7159 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7160 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7161 LSM_HOOK_INIT(sb_mount, selinux_mount),
7162 LSM_HOOK_INIT(sb_umount, selinux_umount),
7163 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7164 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7166 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7168 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7169 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7171 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7172 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7173 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7174 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7175 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7176 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7177 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7178 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7179 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7180 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7181 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7182 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7183 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7184 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7185 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7186 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7187 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7188 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7189 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7190 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7191 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7192 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7193 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7194 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7195 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7196 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7197 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7198 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7200 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7202 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7203 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7204 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7205 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7206 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7207 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7208 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7209 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7210 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7211 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7212 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7214 LSM_HOOK_INIT(file_open, selinux_file_open),
7216 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7217 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7218 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7219 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7220 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7221 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7222 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7223 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7224 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7225 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7226 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7227 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7228 LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7229 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7230 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7231 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7232 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7233 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7234 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7235 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7236 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7237 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7238 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7239 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7241 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7242 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7244 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7245 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7246 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7247 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7249 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7250 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7251 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7253 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7254 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7255 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7257 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7259 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7260 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7262 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7263 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7264 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7265 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7266 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7267 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7269 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7270 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7272 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7273 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7274 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7275 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7276 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7277 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7278 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7279 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7280 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7281 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7282 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7283 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7284 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7285 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7286 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7287 LSM_HOOK_INIT(socket_getpeersec_stream,
7288 selinux_socket_getpeersec_stream),
7289 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7290 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7291 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7292 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7293 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7294 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7295 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7296 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7297 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7298 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7299 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7300 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7301 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7302 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7303 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7304 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7305 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7306 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7307 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7308 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7309 #ifdef CONFIG_SECURITY_INFINIBAND
7310 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7311 LSM_HOOK_INIT(ib_endport_manage_subnet,
7312 selinux_ib_endport_manage_subnet),
7313 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7315 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7316 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7317 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7318 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7319 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7320 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7321 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7322 selinux_xfrm_state_pol_flow_match),
7323 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7327 LSM_HOOK_INIT(key_free, selinux_key_free),
7328 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7329 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7330 #ifdef CONFIG_KEY_NOTIFICATIONS
7331 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7336 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7337 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7338 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7341 #ifdef CONFIG_BPF_SYSCALL
7342 LSM_HOOK_INIT(bpf, selinux_bpf),
7343 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7344 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7345 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7346 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7349 #ifdef CONFIG_PERF_EVENTS
7350 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7351 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7352 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7353 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7356 LSM_HOOK_INIT(locked_down, selinux_lockdown),
7359 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7361 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7362 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7363 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7364 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7365 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7366 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7370 * PUT "ALLOCATING" HOOKS HERE
7372 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7373 LSM_HOOK_INIT(msg_queue_alloc_security,
7374 selinux_msg_queue_alloc_security),
7375 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7376 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7377 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7378 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7379 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7380 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7381 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7382 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7383 #ifdef CONFIG_SECURITY_INFINIBAND
7384 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7386 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7387 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7388 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7389 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7390 selinux_xfrm_state_alloc_acquire),
7393 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7396 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7398 #ifdef CONFIG_BPF_SYSCALL
7399 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7400 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7402 #ifdef CONFIG_PERF_EVENTS
7403 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7407 static __init int selinux_init(void)
7409 pr_info("SELinux: Initializing.\n");
7411 memset(&selinux_state, 0, sizeof(selinux_state));
7412 enforcing_set(&selinux_state, selinux_enforcing_boot);
7413 checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7414 selinux_avc_init(&selinux_state.avc);
7415 mutex_init(&selinux_state.status_lock);
7416 mutex_init(&selinux_state.policy_mutex);
7418 /* Set the security state for the initial task. */
7419 cred_init_security();
7421 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7427 ebitmap_cache_init();
7429 hashtab_cache_init();
7431 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7433 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7434 panic("SELinux: Unable to register AVC netcache callback\n");
7436 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7437 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7439 if (selinux_enforcing_boot)
7440 pr_debug("SELinux: Starting in enforcing mode\n");
7442 pr_debug("SELinux: Starting in permissive mode\n");
7444 fs_validate_description("selinux", selinux_fs_parameters);
7449 static void delayed_superblock_init(struct super_block *sb, void *unused)
7451 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7454 void selinux_complete_init(void)
7456 pr_debug("SELinux: Completing initialization.\n");
7458 /* Set up any superblocks initialized prior to the policy load. */
7459 pr_debug("SELinux: Setting up existing superblocks.\n");
7460 iterate_supers(delayed_superblock_init, NULL);
7463 /* SELinux requires early initialization in order to label
7464 all processes and objects when they are created. */
7465 DEFINE_LSM(selinux) = {
7467 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7468 .enabled = &selinux_enabled_boot,
7469 .blobs = &selinux_blob_sizes,
7470 .init = selinux_init,
7473 #if defined(CONFIG_NETFILTER)
7475 static const struct nf_hook_ops selinux_nf_ops[] = {
7477 .hook = selinux_ipv4_postroute,
7479 .hooknum = NF_INET_POST_ROUTING,
7480 .priority = NF_IP_PRI_SELINUX_LAST,
7483 .hook = selinux_ipv4_forward,
7485 .hooknum = NF_INET_FORWARD,
7486 .priority = NF_IP_PRI_SELINUX_FIRST,
7489 .hook = selinux_ipv4_output,
7491 .hooknum = NF_INET_LOCAL_OUT,
7492 .priority = NF_IP_PRI_SELINUX_FIRST,
7494 #if IS_ENABLED(CONFIG_IPV6)
7496 .hook = selinux_ipv6_postroute,
7498 .hooknum = NF_INET_POST_ROUTING,
7499 .priority = NF_IP6_PRI_SELINUX_LAST,
7502 .hook = selinux_ipv6_forward,
7504 .hooknum = NF_INET_FORWARD,
7505 .priority = NF_IP6_PRI_SELINUX_FIRST,
7508 .hook = selinux_ipv6_output,
7510 .hooknum = NF_INET_LOCAL_OUT,
7511 .priority = NF_IP6_PRI_SELINUX_FIRST,
7516 static int __net_init selinux_nf_register(struct net *net)
7518 return nf_register_net_hooks(net, selinux_nf_ops,
7519 ARRAY_SIZE(selinux_nf_ops));
7522 static void __net_exit selinux_nf_unregister(struct net *net)
7524 nf_unregister_net_hooks(net, selinux_nf_ops,
7525 ARRAY_SIZE(selinux_nf_ops));
7528 static struct pernet_operations selinux_net_ops = {
7529 .init = selinux_nf_register,
7530 .exit = selinux_nf_unregister,
7533 static int __init selinux_nf_ip_init(void)
7537 if (!selinux_enabled_boot)
7540 pr_debug("SELinux: Registering netfilter hooks\n");
7542 err = register_pernet_subsys(&selinux_net_ops);
7544 panic("SELinux: register_pernet_subsys: error %d\n", err);
7548 __initcall(selinux_nf_ip_init);
7550 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7551 static void selinux_nf_ip_exit(void)
7553 pr_debug("SELinux: Unregistering netfilter hooks\n");
7555 unregister_pernet_subsys(&selinux_net_ops);
7559 #else /* CONFIG_NETFILTER */
7561 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7562 #define selinux_nf_ip_exit()
7565 #endif /* CONFIG_NETFILTER */
7567 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7568 int selinux_disable(struct selinux_state *state)
7570 if (selinux_initialized(state)) {
7571 /* Not permitted after initial policy load. */
7575 if (selinux_disabled(state)) {
7576 /* Only do this once. */
7580 selinux_mark_disabled(state);
7582 pr_info("SELinux: Disabled at runtime.\n");
7585 * Unregister netfilter hooks.
7586 * Must be done before security_delete_hooks() to avoid breaking
7589 selinux_nf_ip_exit();
7591 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7593 /* Try to destroy the avc node cache */
7596 /* Unregister selinuxfs. */