1 // SPDX-License-Identifier: GPL-2.0-only
3 * NSA Security-Enhanced Linux (SELinux) security module
5 * This file contains the SELinux hook function implementations.
7 * Authors: Stephen Smalley, <sds@tycho.nsa.gov>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
24 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/tracehook.h>
29 #include <linux/errno.h>
30 #include <linux/sched/signal.h>
31 #include <linux/sched/task.h>
32 #include <linux/lsm_hooks.h>
33 #include <linux/xattr.h>
34 #include <linux/capability.h>
35 #include <linux/unistd.h>
37 #include <linux/mman.h>
38 #include <linux/slab.h>
39 #include <linux/pagemap.h>
40 #include <linux/proc_fs.h>
41 #include <linux/swap.h>
42 #include <linux/spinlock.h>
43 #include <linux/syscalls.h>
44 #include <linux/dcache.h>
45 #include <linux/file.h>
46 #include <linux/fdtable.h>
47 #include <linux/namei.h>
48 #include <linux/mount.h>
49 #include <linux/fs_context.h>
50 #include <linux/fs_parser.h>
51 #include <linux/netfilter_ipv4.h>
52 #include <linux/netfilter_ipv6.h>
53 #include <linux/tty.h>
55 #include <net/ip.h> /* for local_port_range[] */
56 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
57 #include <net/inet_connection_sock.h>
58 #include <net/net_namespace.h>
59 #include <net/netlabel.h>
60 #include <linux/uaccess.h>
61 #include <asm/ioctls.h>
62 #include <linux/atomic.h>
63 #include <linux/bitops.h>
64 #include <linux/interrupt.h>
65 #include <linux/netdevice.h> /* for network interface checks */
66 #include <net/netlink.h>
67 #include <linux/tcp.h>
68 #include <linux/udp.h>
69 #include <linux/dccp.h>
70 #include <linux/sctp.h>
71 #include <net/sctp/structs.h>
72 #include <linux/quota.h>
73 #include <linux/un.h> /* for Unix socket types */
74 #include <net/af_unix.h> /* for Unix socket types */
75 #include <linux/parser.h>
76 #include <linux/nfs_mount.h>
78 #include <linux/hugetlb.h>
79 #include <linux/personality.h>
80 #include <linux/audit.h>
81 #include <linux/string.h>
82 #include <linux/mutex.h>
83 #include <linux/posix-timers.h>
84 #include <linux/syslog.h>
85 #include <linux/user_namespace.h>
86 #include <linux/export.h>
87 #include <linux/msg.h>
88 #include <linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
103 #include "netlabel.h"
107 struct selinux_state selinux_state;
109 /* SECMARK reference count */
110 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
112 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
113 static int selinux_enforcing_boot __initdata;
115 static int __init enforcing_setup(char *str)
117 unsigned long enforcing;
118 if (!kstrtoul(str, 0, &enforcing))
119 selinux_enforcing_boot = enforcing ? 1 : 0;
122 __setup("enforcing=", enforcing_setup);
124 #define selinux_enforcing_boot 1
127 int selinux_enabled_boot __initdata = 1;
128 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
129 static int __init selinux_enabled_setup(char *str)
131 unsigned long enabled;
132 if (!kstrtoul(str, 0, &enabled))
133 selinux_enabled_boot = enabled ? 1 : 0;
136 __setup("selinux=", selinux_enabled_setup);
139 static unsigned int selinux_checkreqprot_boot =
140 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE;
142 static int __init checkreqprot_setup(char *str)
144 unsigned long checkreqprot;
146 if (!kstrtoul(str, 0, &checkreqprot)) {
147 selinux_checkreqprot_boot = checkreqprot ? 1 : 0;
149 pr_warn("SELinux: checkreqprot set to 1 via kernel parameter. This is deprecated and will be rejected in a future kernel release.\n");
153 __setup("checkreqprot=", checkreqprot_setup);
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
166 static int selinux_secmark_enabled(void)
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
182 static int selinux_peerlbl_enabled(void)
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
188 static int selinux_netcache_avc_callback(u32 event)
190 if (event == AVC_CALLBACK_RESET) {
199 static int selinux_lsm_notifier_avc_callback(u32 event)
201 if (event == AVC_CALLBACK_RESET) {
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
210 * initialise the security for the init task
212 static void cred_init_security(void)
214 struct cred *cred = (struct cred *) current->real_cred;
215 struct task_security_struct *tsec;
217 tsec = selinux_cred(cred);
218 tsec->osid = tsec->sid = SECINITSID_KERNEL;
222 * get the security ID of a set of credentials
224 static inline u32 cred_sid(const struct cred *cred)
226 const struct task_security_struct *tsec;
228 tsec = selinux_cred(cred);
233 * get the subjective security ID of a task
235 static inline u32 task_sid_subj(const struct task_struct *task)
240 sid = cred_sid(rcu_dereference(task->cred));
246 * get the objective security ID of a task
248 static inline u32 task_sid_obj(const struct task_struct *task)
253 sid = cred_sid(__task_cred(task));
259 * get the security ID of a task for use with binder
261 static inline u32 task_sid_binder(const struct task_struct *task)
264 * In many case where this function is used we should be using the
265 * task's subjective SID, but we can't reliably access the subjective
266 * creds of a task other than our own so we must use the objective
267 * creds/SID, which are safe to access. The downside is that if a task
268 * is temporarily overriding it's creds it will not be reflected here;
269 * however, it isn't clear that binder would handle that case well
272 * If this ever changes and we can safely reference the subjective
273 * creds/SID of another task, this function will make it easier to
274 * identify the various places where we make use of the task SIDs in
275 * the binder code. It is also likely that we will need to adjust
276 * the main drivers/android binder code as well.
278 return task_sid_obj(task);
281 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
284 * Try reloading inode security labels that have been marked as invalid. The
285 * @may_sleep parameter indicates when sleeping and thus reloading labels is
286 * allowed; when set to false, returns -ECHILD when the label is
287 * invalid. The @dentry parameter should be set to a dentry of the inode.
289 static int __inode_security_revalidate(struct inode *inode,
290 struct dentry *dentry,
293 struct inode_security_struct *isec = selinux_inode(inode);
295 might_sleep_if(may_sleep);
297 if (selinux_initialized(&selinux_state) &&
298 isec->initialized != LABEL_INITIALIZED) {
303 * Try reloading the inode security label. This will fail if
304 * @opt_dentry is NULL and no dentry for this inode can be
305 * found; in that case, continue using the old label.
307 inode_doinit_with_dentry(inode, dentry);
312 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
314 return selinux_inode(inode);
317 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
321 error = __inode_security_revalidate(inode, NULL, !rcu);
323 return ERR_PTR(error);
324 return selinux_inode(inode);
328 * Get the security label of an inode.
330 static struct inode_security_struct *inode_security(struct inode *inode)
332 __inode_security_revalidate(inode, NULL, true);
333 return selinux_inode(inode);
336 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
338 struct inode *inode = d_backing_inode(dentry);
340 return selinux_inode(inode);
344 * Get the security label of a dentry's backing inode.
346 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
348 struct inode *inode = d_backing_inode(dentry);
350 __inode_security_revalidate(inode, dentry, true);
351 return selinux_inode(inode);
354 static void inode_free_security(struct inode *inode)
356 struct inode_security_struct *isec = selinux_inode(inode);
357 struct superblock_security_struct *sbsec;
361 sbsec = selinux_superblock(inode->i_sb);
363 * As not all inode security structures are in a list, we check for
364 * empty list outside of the lock to make sure that we won't waste
365 * time taking a lock doing nothing.
367 * The list_del_init() function can be safely called more than once.
368 * It should not be possible for this function to be called with
369 * concurrent list_add(), but for better safety against future changes
370 * in the code, we use list_empty_careful() here.
372 if (!list_empty_careful(&isec->list)) {
373 spin_lock(&sbsec->isec_lock);
374 list_del_init(&isec->list);
375 spin_unlock(&sbsec->isec_lock);
379 struct selinux_mnt_opts {
380 const char *fscontext, *context, *rootcontext, *defcontext;
383 static void selinux_free_mnt_opts(void *mnt_opts)
385 struct selinux_mnt_opts *opts = mnt_opts;
386 kfree(opts->fscontext);
387 kfree(opts->context);
388 kfree(opts->rootcontext);
389 kfree(opts->defcontext);
402 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
412 A(rootcontext, true),
417 static int match_opt_prefix(char *s, int l, char **arg)
421 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
422 size_t len = tokens[i].len;
423 if (len > l || memcmp(s, tokens[i].name, len))
425 if (tokens[i].has_arg) {
426 if (len == l || s[len] != '=')
431 return tokens[i].opt;
436 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
438 static int may_context_mount_sb_relabel(u32 sid,
439 struct superblock_security_struct *sbsec,
440 const struct cred *cred)
442 const struct task_security_struct *tsec = selinux_cred(cred);
445 rc = avc_has_perm(&selinux_state,
446 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
447 FILESYSTEM__RELABELFROM, NULL);
451 rc = avc_has_perm(&selinux_state,
452 tsec->sid, sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__RELABELTO, NULL);
457 static int may_context_mount_inode_relabel(u32 sid,
458 struct superblock_security_struct *sbsec,
459 const struct cred *cred)
461 const struct task_security_struct *tsec = selinux_cred(cred);
463 rc = avc_has_perm(&selinux_state,
464 tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
465 FILESYSTEM__RELABELFROM, NULL);
469 rc = avc_has_perm(&selinux_state,
470 sid, sbsec->sid, SECCLASS_FILESYSTEM,
471 FILESYSTEM__ASSOCIATE, NULL);
475 static int selinux_is_genfs_special_handling(struct super_block *sb)
477 /* Special handling. Genfs but also in-core setxattr handler */
478 return !strcmp(sb->s_type->name, "sysfs") ||
479 !strcmp(sb->s_type->name, "pstore") ||
480 !strcmp(sb->s_type->name, "debugfs") ||
481 !strcmp(sb->s_type->name, "tracefs") ||
482 !strcmp(sb->s_type->name, "rootfs") ||
483 (selinux_policycap_cgroupseclabel() &&
484 (!strcmp(sb->s_type->name, "cgroup") ||
485 !strcmp(sb->s_type->name, "cgroup2")));
488 static int selinux_is_sblabel_mnt(struct super_block *sb)
490 struct superblock_security_struct *sbsec = selinux_superblock(sb);
493 * IMPORTANT: Double-check logic in this function when adding a new
494 * SECURITY_FS_USE_* definition!
496 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
498 switch (sbsec->behavior) {
499 case SECURITY_FS_USE_XATTR:
500 case SECURITY_FS_USE_TRANS:
501 case SECURITY_FS_USE_TASK:
502 case SECURITY_FS_USE_NATIVE:
505 case SECURITY_FS_USE_GENFS:
506 return selinux_is_genfs_special_handling(sb);
508 /* Never allow relabeling on context mounts */
509 case SECURITY_FS_USE_MNTPOINT:
510 case SECURITY_FS_USE_NONE:
516 static int sb_check_xattr_support(struct super_block *sb)
518 struct superblock_security_struct *sbsec = sb->s_security;
519 struct dentry *root = sb->s_root;
520 struct inode *root_inode = d_backing_inode(root);
525 * Make sure that the xattr handler exists and that no
526 * error other than -ENODATA is returned by getxattr on
527 * the root directory. -ENODATA is ok, as this may be
528 * the first boot of the SELinux kernel before we have
529 * assigned xattr values to the filesystem.
531 if (!(root_inode->i_opflags & IOP_XATTR)) {
532 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
533 sb->s_id, sb->s_type->name);
537 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
538 if (rc < 0 && rc != -ENODATA) {
539 if (rc == -EOPNOTSUPP) {
540 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
541 sb->s_id, sb->s_type->name);
544 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
545 sb->s_id, sb->s_type->name, -rc);
552 /* No xattr support - try to fallback to genfs if possible. */
553 rc = security_genfs_sid(&selinux_state, sb->s_type->name, "/",
558 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
559 sb->s_id, sb->s_type->name);
560 sbsec->behavior = SECURITY_FS_USE_GENFS;
565 static int sb_finish_set_opts(struct super_block *sb)
567 struct superblock_security_struct *sbsec = selinux_superblock(sb);
568 struct dentry *root = sb->s_root;
569 struct inode *root_inode = d_backing_inode(root);
572 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
573 rc = sb_check_xattr_support(sb);
578 sbsec->flags |= SE_SBINITIALIZED;
581 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
582 * leave the flag untouched because sb_clone_mnt_opts might be handing
583 * us a superblock that needs the flag to be cleared.
585 if (selinux_is_sblabel_mnt(sb))
586 sbsec->flags |= SBLABEL_MNT;
588 sbsec->flags &= ~SBLABEL_MNT;
590 /* Initialize the root inode. */
591 rc = inode_doinit_with_dentry(root_inode, root);
593 /* Initialize any other inodes associated with the superblock, e.g.
594 inodes created prior to initial policy load or inodes created
595 during get_sb by a pseudo filesystem that directly
597 spin_lock(&sbsec->isec_lock);
598 while (!list_empty(&sbsec->isec_head)) {
599 struct inode_security_struct *isec =
600 list_first_entry(&sbsec->isec_head,
601 struct inode_security_struct, list);
602 struct inode *inode = isec->inode;
603 list_del_init(&isec->list);
604 spin_unlock(&sbsec->isec_lock);
605 inode = igrab(inode);
607 if (!IS_PRIVATE(inode))
608 inode_doinit_with_dentry(inode, NULL);
611 spin_lock(&sbsec->isec_lock);
613 spin_unlock(&sbsec->isec_lock);
617 static int bad_option(struct superblock_security_struct *sbsec, char flag,
618 u32 old_sid, u32 new_sid)
620 char mnt_flags = sbsec->flags & SE_MNTMASK;
622 /* check if the old mount command had the same options */
623 if (sbsec->flags & SE_SBINITIALIZED)
624 if (!(sbsec->flags & flag) ||
625 (old_sid != new_sid))
628 /* check if we were passed the same options twice,
629 * aka someone passed context=a,context=b
631 if (!(sbsec->flags & SE_SBINITIALIZED))
632 if (mnt_flags & flag)
637 static int parse_sid(struct super_block *sb, const char *s, u32 *sid)
639 int rc = security_context_str_to_sid(&selinux_state, s,
642 pr_warn("SELinux: security_context_str_to_sid"
643 "(%s) failed for (dev %s, type %s) errno=%d\n",
644 s, sb->s_id, sb->s_type->name, rc);
649 * Allow filesystems with binary mount data to explicitly set mount point
650 * labeling information.
652 static int selinux_set_mnt_opts(struct super_block *sb,
654 unsigned long kern_flags,
655 unsigned long *set_kern_flags)
657 const struct cred *cred = current_cred();
658 struct superblock_security_struct *sbsec = selinux_superblock(sb);
659 struct dentry *root = sb->s_root;
660 struct selinux_mnt_opts *opts = mnt_opts;
661 struct inode_security_struct *root_isec;
662 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
663 u32 defcontext_sid = 0;
666 mutex_lock(&sbsec->lock);
668 if (!selinux_initialized(&selinux_state)) {
670 /* Defer initialization until selinux_complete_init,
671 after the initial policy is loaded and the security
672 server is ready to handle calls. */
676 pr_warn("SELinux: Unable to set superblock options "
677 "before the security server is initialized\n");
680 if (kern_flags && !set_kern_flags) {
681 /* Specifying internal flags without providing a place to
682 * place the results is not allowed */
688 * Binary mount data FS will come through this function twice. Once
689 * from an explicit call and once from the generic calls from the vfs.
690 * Since the generic VFS calls will not contain any security mount data
691 * we need to skip the double mount verification.
693 * This does open a hole in which we will not notice if the first
694 * mount using this sb set explict options and a second mount using
695 * this sb does not set any security options. (The first options
696 * will be used for both mounts)
698 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
702 root_isec = backing_inode_security_novalidate(root);
705 * parse the mount options, check if they are valid sids.
706 * also check if someone is trying to mount the same sb more
707 * than once with different security options.
710 if (opts->fscontext) {
711 rc = parse_sid(sb, opts->fscontext, &fscontext_sid);
714 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
716 goto out_double_mount;
717 sbsec->flags |= FSCONTEXT_MNT;
720 rc = parse_sid(sb, opts->context, &context_sid);
723 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
725 goto out_double_mount;
726 sbsec->flags |= CONTEXT_MNT;
728 if (opts->rootcontext) {
729 rc = parse_sid(sb, opts->rootcontext, &rootcontext_sid);
732 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
734 goto out_double_mount;
735 sbsec->flags |= ROOTCONTEXT_MNT;
737 if (opts->defcontext) {
738 rc = parse_sid(sb, opts->defcontext, &defcontext_sid);
741 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
743 goto out_double_mount;
744 sbsec->flags |= DEFCONTEXT_MNT;
748 if (sbsec->flags & SE_SBINITIALIZED) {
749 /* previously mounted with options, but not on this attempt? */
750 if ((sbsec->flags & SE_MNTMASK) && !opts)
751 goto out_double_mount;
756 if (strcmp(sb->s_type->name, "proc") == 0)
757 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
759 if (!strcmp(sb->s_type->name, "debugfs") ||
760 !strcmp(sb->s_type->name, "tracefs") ||
761 !strcmp(sb->s_type->name, "binder") ||
762 !strcmp(sb->s_type->name, "bpf") ||
763 !strcmp(sb->s_type->name, "pstore"))
764 sbsec->flags |= SE_SBGENFS;
766 if (!strcmp(sb->s_type->name, "sysfs") ||
767 !strcmp(sb->s_type->name, "cgroup") ||
768 !strcmp(sb->s_type->name, "cgroup2"))
769 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
771 if (!sbsec->behavior) {
773 * Determine the labeling behavior to use for this
776 rc = security_fs_use(&selinux_state, sb);
778 pr_warn("%s: security_fs_use(%s) returned %d\n",
779 __func__, sb->s_type->name, rc);
785 * If this is a user namespace mount and the filesystem type is not
786 * explicitly whitelisted, then no contexts are allowed on the command
787 * line and security labels must be ignored.
789 if (sb->s_user_ns != &init_user_ns &&
790 strcmp(sb->s_type->name, "tmpfs") &&
791 strcmp(sb->s_type->name, "ramfs") &&
792 strcmp(sb->s_type->name, "devpts") &&
793 strcmp(sb->s_type->name, "overlay")) {
794 if (context_sid || fscontext_sid || rootcontext_sid ||
799 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
800 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
801 rc = security_transition_sid(&selinux_state,
805 &sbsec->mntpoint_sid);
812 /* sets the context of the superblock for the fs being mounted. */
814 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
818 sbsec->sid = fscontext_sid;
822 * Switch to using mount point labeling behavior.
823 * sets the label used on all file below the mountpoint, and will set
824 * the superblock context if not already set.
826 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
827 sbsec->behavior = SECURITY_FS_USE_NATIVE;
828 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
832 if (!fscontext_sid) {
833 rc = may_context_mount_sb_relabel(context_sid, sbsec,
837 sbsec->sid = context_sid;
839 rc = may_context_mount_inode_relabel(context_sid, sbsec,
844 if (!rootcontext_sid)
845 rootcontext_sid = context_sid;
847 sbsec->mntpoint_sid = context_sid;
848 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
851 if (rootcontext_sid) {
852 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
857 root_isec->sid = rootcontext_sid;
858 root_isec->initialized = LABEL_INITIALIZED;
861 if (defcontext_sid) {
862 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
863 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
865 pr_warn("SELinux: defcontext option is "
866 "invalid for this filesystem type\n");
870 if (defcontext_sid != sbsec->def_sid) {
871 rc = may_context_mount_inode_relabel(defcontext_sid,
877 sbsec->def_sid = defcontext_sid;
881 rc = sb_finish_set_opts(sb);
883 mutex_unlock(&sbsec->lock);
887 pr_warn("SELinux: mount invalid. Same superblock, different "
888 "security settings for (dev %s, type %s)\n", sb->s_id,
893 static int selinux_cmp_sb_context(const struct super_block *oldsb,
894 const struct super_block *newsb)
896 struct superblock_security_struct *old = selinux_superblock(oldsb);
897 struct superblock_security_struct *new = selinux_superblock(newsb);
898 char oldflags = old->flags & SE_MNTMASK;
899 char newflags = new->flags & SE_MNTMASK;
901 if (oldflags != newflags)
903 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
905 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
907 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
909 if (oldflags & ROOTCONTEXT_MNT) {
910 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
911 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
912 if (oldroot->sid != newroot->sid)
917 pr_warn("SELinux: mount invalid. Same superblock, "
918 "different security settings for (dev %s, "
919 "type %s)\n", newsb->s_id, newsb->s_type->name);
923 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
924 struct super_block *newsb,
925 unsigned long kern_flags,
926 unsigned long *set_kern_flags)
929 const struct superblock_security_struct *oldsbsec =
930 selinux_superblock(oldsb);
931 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
933 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
934 int set_context = (oldsbsec->flags & CONTEXT_MNT);
935 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
938 * if the parent was able to be mounted it clearly had no special lsm
939 * mount options. thus we can safely deal with this superblock later
941 if (!selinux_initialized(&selinux_state))
945 * Specifying internal flags without providing a place to
946 * place the results is not allowed.
948 if (kern_flags && !set_kern_flags)
951 /* how can we clone if the old one wasn't set up?? */
952 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
954 /* if fs is reusing a sb, make sure that the contexts match */
955 if (newsbsec->flags & SE_SBINITIALIZED) {
956 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
957 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
958 return selinux_cmp_sb_context(oldsb, newsb);
961 mutex_lock(&newsbsec->lock);
963 newsbsec->flags = oldsbsec->flags;
965 newsbsec->sid = oldsbsec->sid;
966 newsbsec->def_sid = oldsbsec->def_sid;
967 newsbsec->behavior = oldsbsec->behavior;
969 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
970 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
971 rc = security_fs_use(&selinux_state, newsb);
976 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
977 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
978 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
982 u32 sid = oldsbsec->mntpoint_sid;
986 if (!set_rootcontext) {
987 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
990 newsbsec->mntpoint_sid = sid;
992 if (set_rootcontext) {
993 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
994 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
996 newisec->sid = oldisec->sid;
999 sb_finish_set_opts(newsb);
1001 mutex_unlock(&newsbsec->lock);
1005 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
1007 struct selinux_mnt_opts *opts = *mnt_opts;
1009 if (token == Opt_seclabel) /* eaten and completely ignored */
1013 opts = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
1022 if (opts->context || opts->defcontext)
1027 if (opts->fscontext)
1029 opts->fscontext = s;
1031 case Opt_rootcontext:
1032 if (opts->rootcontext)
1034 opts->rootcontext = s;
1036 case Opt_defcontext:
1037 if (opts->context || opts->defcontext)
1039 opts->defcontext = s;
1044 pr_warn(SEL_MOUNT_FAIL_MSG);
1048 static int selinux_add_mnt_opt(const char *option, const char *val, int len,
1051 int token = Opt_error;
1054 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
1055 if (strcmp(option, tokens[i].name) == 0) {
1056 token = tokens[i].opt;
1061 if (token == Opt_error)
1064 if (token != Opt_seclabel) {
1065 val = kmemdup_nul(val, len, GFP_KERNEL);
1071 rc = selinux_add_opt(token, val, mnt_opts);
1080 selinux_free_mnt_opts(*mnt_opts);
1086 static int show_sid(struct seq_file *m, u32 sid)
1088 char *context = NULL;
1092 rc = security_sid_to_context(&selinux_state, sid,
1095 bool has_comma = context && strchr(context, ',');
1100 seq_escape(m, context, "\"\n\\");
1108 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1110 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1113 if (!(sbsec->flags & SE_SBINITIALIZED))
1116 if (!selinux_initialized(&selinux_state))
1119 if (sbsec->flags & FSCONTEXT_MNT) {
1121 seq_puts(m, FSCONTEXT_STR);
1122 rc = show_sid(m, sbsec->sid);
1126 if (sbsec->flags & CONTEXT_MNT) {
1128 seq_puts(m, CONTEXT_STR);
1129 rc = show_sid(m, sbsec->mntpoint_sid);
1133 if (sbsec->flags & DEFCONTEXT_MNT) {
1135 seq_puts(m, DEFCONTEXT_STR);
1136 rc = show_sid(m, sbsec->def_sid);
1140 if (sbsec->flags & ROOTCONTEXT_MNT) {
1141 struct dentry *root = sb->s_root;
1142 struct inode_security_struct *isec = backing_inode_security(root);
1144 seq_puts(m, ROOTCONTEXT_STR);
1145 rc = show_sid(m, isec->sid);
1149 if (sbsec->flags & SBLABEL_MNT) {
1151 seq_puts(m, SECLABEL_STR);
1156 static inline u16 inode_mode_to_security_class(umode_t mode)
1158 switch (mode & S_IFMT) {
1160 return SECCLASS_SOCK_FILE;
1162 return SECCLASS_LNK_FILE;
1164 return SECCLASS_FILE;
1166 return SECCLASS_BLK_FILE;
1168 return SECCLASS_DIR;
1170 return SECCLASS_CHR_FILE;
1172 return SECCLASS_FIFO_FILE;
1176 return SECCLASS_FILE;
1179 static inline int default_protocol_stream(int protocol)
1181 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1182 protocol == IPPROTO_MPTCP);
1185 static inline int default_protocol_dgram(int protocol)
1187 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1190 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1192 int extsockclass = selinux_policycap_extsockclass();
1198 case SOCK_SEQPACKET:
1199 return SECCLASS_UNIX_STREAM_SOCKET;
1202 return SECCLASS_UNIX_DGRAM_SOCKET;
1209 case SOCK_SEQPACKET:
1210 if (default_protocol_stream(protocol))
1211 return SECCLASS_TCP_SOCKET;
1212 else if (extsockclass && protocol == IPPROTO_SCTP)
1213 return SECCLASS_SCTP_SOCKET;
1215 return SECCLASS_RAWIP_SOCKET;
1217 if (default_protocol_dgram(protocol))
1218 return SECCLASS_UDP_SOCKET;
1219 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1220 protocol == IPPROTO_ICMPV6))
1221 return SECCLASS_ICMP_SOCKET;
1223 return SECCLASS_RAWIP_SOCKET;
1225 return SECCLASS_DCCP_SOCKET;
1227 return SECCLASS_RAWIP_SOCKET;
1233 return SECCLASS_NETLINK_ROUTE_SOCKET;
1234 case NETLINK_SOCK_DIAG:
1235 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1237 return SECCLASS_NETLINK_NFLOG_SOCKET;
1239 return SECCLASS_NETLINK_XFRM_SOCKET;
1240 case NETLINK_SELINUX:
1241 return SECCLASS_NETLINK_SELINUX_SOCKET;
1243 return SECCLASS_NETLINK_ISCSI_SOCKET;
1245 return SECCLASS_NETLINK_AUDIT_SOCKET;
1246 case NETLINK_FIB_LOOKUP:
1247 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1248 case NETLINK_CONNECTOR:
1249 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1250 case NETLINK_NETFILTER:
1251 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1252 case NETLINK_DNRTMSG:
1253 return SECCLASS_NETLINK_DNRT_SOCKET;
1254 case NETLINK_KOBJECT_UEVENT:
1255 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1256 case NETLINK_GENERIC:
1257 return SECCLASS_NETLINK_GENERIC_SOCKET;
1258 case NETLINK_SCSITRANSPORT:
1259 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1261 return SECCLASS_NETLINK_RDMA_SOCKET;
1262 case NETLINK_CRYPTO:
1263 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1265 return SECCLASS_NETLINK_SOCKET;
1268 return SECCLASS_PACKET_SOCKET;
1270 return SECCLASS_KEY_SOCKET;
1272 return SECCLASS_APPLETALK_SOCKET;
1278 return SECCLASS_AX25_SOCKET;
1280 return SECCLASS_IPX_SOCKET;
1282 return SECCLASS_NETROM_SOCKET;
1284 return SECCLASS_ATMPVC_SOCKET;
1286 return SECCLASS_X25_SOCKET;
1288 return SECCLASS_ROSE_SOCKET;
1290 return SECCLASS_DECNET_SOCKET;
1292 return SECCLASS_ATMSVC_SOCKET;
1294 return SECCLASS_RDS_SOCKET;
1296 return SECCLASS_IRDA_SOCKET;
1298 return SECCLASS_PPPOX_SOCKET;
1300 return SECCLASS_LLC_SOCKET;
1302 return SECCLASS_CAN_SOCKET;
1304 return SECCLASS_TIPC_SOCKET;
1306 return SECCLASS_BLUETOOTH_SOCKET;
1308 return SECCLASS_IUCV_SOCKET;
1310 return SECCLASS_RXRPC_SOCKET;
1312 return SECCLASS_ISDN_SOCKET;
1314 return SECCLASS_PHONET_SOCKET;
1316 return SECCLASS_IEEE802154_SOCKET;
1318 return SECCLASS_CAIF_SOCKET;
1320 return SECCLASS_ALG_SOCKET;
1322 return SECCLASS_NFC_SOCKET;
1324 return SECCLASS_VSOCK_SOCKET;
1326 return SECCLASS_KCM_SOCKET;
1328 return SECCLASS_QIPCRTR_SOCKET;
1330 return SECCLASS_SMC_SOCKET;
1332 return SECCLASS_XDP_SOCKET;
1334 #error New address family defined, please update this function.
1339 return SECCLASS_SOCKET;
1342 static int selinux_genfs_get_sid(struct dentry *dentry,
1348 struct super_block *sb = dentry->d_sb;
1349 char *buffer, *path;
1351 buffer = (char *)__get_free_page(GFP_KERNEL);
1355 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1359 if (flags & SE_SBPROC) {
1360 /* each process gets a /proc/PID/ entry. Strip off the
1361 * PID part to get a valid selinux labeling.
1362 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1363 while (path[1] >= '0' && path[1] <= '9') {
1368 rc = security_genfs_sid(&selinux_state, sb->s_type->name,
1370 if (rc == -ENOENT) {
1371 /* No match in policy, mark as unlabeled. */
1372 *sid = SECINITSID_UNLABELED;
1376 free_page((unsigned long)buffer);
1380 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1381 u32 def_sid, u32 *sid)
1383 #define INITCONTEXTLEN 255
1388 len = INITCONTEXTLEN;
1389 context = kmalloc(len + 1, GFP_NOFS);
1393 context[len] = '\0';
1394 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1395 if (rc == -ERANGE) {
1398 /* Need a larger buffer. Query for the right size. */
1399 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1404 context = kmalloc(len + 1, GFP_NOFS);
1408 context[len] = '\0';
1409 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1414 if (rc != -ENODATA) {
1415 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1416 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1423 rc = security_context_to_sid_default(&selinux_state, context, rc, sid,
1426 char *dev = inode->i_sb->s_id;
1427 unsigned long ino = inode->i_ino;
1429 if (rc == -EINVAL) {
1430 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1433 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1434 __func__, context, -rc, dev, ino);
1441 /* The inode's security attributes must be initialized before first use. */
1442 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1444 struct superblock_security_struct *sbsec = NULL;
1445 struct inode_security_struct *isec = selinux_inode(inode);
1446 u32 task_sid, sid = 0;
1448 struct dentry *dentry;
1451 if (isec->initialized == LABEL_INITIALIZED)
1454 spin_lock(&isec->lock);
1455 if (isec->initialized == LABEL_INITIALIZED)
1458 if (isec->sclass == SECCLASS_FILE)
1459 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1461 sbsec = selinux_superblock(inode->i_sb);
1462 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1463 /* Defer initialization until selinux_complete_init,
1464 after the initial policy is loaded and the security
1465 server is ready to handle calls. */
1466 spin_lock(&sbsec->isec_lock);
1467 if (list_empty(&isec->list))
1468 list_add(&isec->list, &sbsec->isec_head);
1469 spin_unlock(&sbsec->isec_lock);
1473 sclass = isec->sclass;
1474 task_sid = isec->task_sid;
1476 isec->initialized = LABEL_PENDING;
1477 spin_unlock(&isec->lock);
1479 switch (sbsec->behavior) {
1480 case SECURITY_FS_USE_NATIVE:
1482 case SECURITY_FS_USE_XATTR:
1483 if (!(inode->i_opflags & IOP_XATTR)) {
1484 sid = sbsec->def_sid;
1487 /* Need a dentry, since the xattr API requires one.
1488 Life would be simpler if we could just pass the inode. */
1490 /* Called from d_instantiate or d_splice_alias. */
1491 dentry = dget(opt_dentry);
1494 * Called from selinux_complete_init, try to find a dentry.
1495 * Some filesystems really want a connected one, so try
1496 * that first. We could split SECURITY_FS_USE_XATTR in
1497 * two, depending upon that...
1499 dentry = d_find_alias(inode);
1501 dentry = d_find_any_alias(inode);
1505 * this is can be hit on boot when a file is accessed
1506 * before the policy is loaded. When we load policy we
1507 * may find inodes that have no dentry on the
1508 * sbsec->isec_head list. No reason to complain as these
1509 * will get fixed up the next time we go through
1510 * inode_doinit with a dentry, before these inodes could
1511 * be used again by userspace.
1516 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1522 case SECURITY_FS_USE_TASK:
1525 case SECURITY_FS_USE_TRANS:
1526 /* Default to the fs SID. */
1529 /* Try to obtain a transition SID. */
1530 rc = security_transition_sid(&selinux_state, task_sid, sid,
1531 sclass, NULL, &sid);
1535 case SECURITY_FS_USE_MNTPOINT:
1536 sid = sbsec->mntpoint_sid;
1539 /* Default to the fs superblock SID. */
1542 if ((sbsec->flags & SE_SBGENFS) &&
1543 (!S_ISLNK(inode->i_mode) ||
1544 selinux_policycap_genfs_seclabel_symlinks())) {
1545 /* We must have a dentry to determine the label on
1548 /* Called from d_instantiate or
1549 * d_splice_alias. */
1550 dentry = dget(opt_dentry);
1552 /* Called from selinux_complete_init, try to
1553 * find a dentry. Some filesystems really want
1554 * a connected one, so try that first.
1556 dentry = d_find_alias(inode);
1558 dentry = d_find_any_alias(inode);
1561 * This can be hit on boot when a file is accessed
1562 * before the policy is loaded. When we load policy we
1563 * may find inodes that have no dentry on the
1564 * sbsec->isec_head list. No reason to complain as
1565 * these will get fixed up the next time we go through
1566 * inode_doinit() with a dentry, before these inodes
1567 * could be used again by userspace.
1571 rc = selinux_genfs_get_sid(dentry, sclass,
1572 sbsec->flags, &sid);
1578 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1579 (inode->i_opflags & IOP_XATTR)) {
1580 rc = inode_doinit_use_xattr(inode, dentry,
1593 spin_lock(&isec->lock);
1594 if (isec->initialized == LABEL_PENDING) {
1596 isec->initialized = LABEL_INVALID;
1599 isec->initialized = LABEL_INITIALIZED;
1604 spin_unlock(&isec->lock);
1608 spin_lock(&isec->lock);
1609 if (isec->initialized == LABEL_PENDING) {
1610 isec->initialized = LABEL_INVALID;
1613 spin_unlock(&isec->lock);
1617 /* Convert a Linux signal to an access vector. */
1618 static inline u32 signal_to_av(int sig)
1624 /* Commonly granted from child to parent. */
1625 perm = PROCESS__SIGCHLD;
1628 /* Cannot be caught or ignored */
1629 perm = PROCESS__SIGKILL;
1632 /* Cannot be caught or ignored */
1633 perm = PROCESS__SIGSTOP;
1636 /* All other signals. */
1637 perm = PROCESS__SIGNAL;
1644 #if CAP_LAST_CAP > 63
1645 #error Fix SELinux to handle capabilities > 63.
1648 /* Check whether a task is allowed to use a capability. */
1649 static int cred_has_capability(const struct cred *cred,
1650 int cap, unsigned int opts, bool initns)
1652 struct common_audit_data ad;
1653 struct av_decision avd;
1655 u32 sid = cred_sid(cred);
1656 u32 av = CAP_TO_MASK(cap);
1659 ad.type = LSM_AUDIT_DATA_CAP;
1662 switch (CAP_TO_INDEX(cap)) {
1664 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1667 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1670 pr_err("SELinux: out of range capability %d\n", cap);
1675 rc = avc_has_perm_noaudit(&selinux_state,
1676 sid, sid, sclass, av, 0, &avd);
1677 if (!(opts & CAP_OPT_NOAUDIT)) {
1678 int rc2 = avc_audit(&selinux_state,
1679 sid, sid, sclass, av, &avd, rc, &ad);
1686 /* Check whether a task has a particular permission to an inode.
1687 The 'adp' parameter is optional and allows other audit
1688 data to be passed (e.g. the dentry). */
1689 static int inode_has_perm(const struct cred *cred,
1690 struct inode *inode,
1692 struct common_audit_data *adp)
1694 struct inode_security_struct *isec;
1697 validate_creds(cred);
1699 if (unlikely(IS_PRIVATE(inode)))
1702 sid = cred_sid(cred);
1703 isec = selinux_inode(inode);
1705 return avc_has_perm(&selinux_state,
1706 sid, isec->sid, isec->sclass, perms, adp);
1709 /* Same as inode_has_perm, but pass explicit audit data containing
1710 the dentry to help the auditing code to more easily generate the
1711 pathname if needed. */
1712 static inline int dentry_has_perm(const struct cred *cred,
1713 struct dentry *dentry,
1716 struct inode *inode = d_backing_inode(dentry);
1717 struct common_audit_data ad;
1719 ad.type = LSM_AUDIT_DATA_DENTRY;
1720 ad.u.dentry = dentry;
1721 __inode_security_revalidate(inode, dentry, true);
1722 return inode_has_perm(cred, inode, av, &ad);
1725 /* Same as inode_has_perm, but pass explicit audit data containing
1726 the path to help the auditing code to more easily generate the
1727 pathname if needed. */
1728 static inline int path_has_perm(const struct cred *cred,
1729 const struct path *path,
1732 struct inode *inode = d_backing_inode(path->dentry);
1733 struct common_audit_data ad;
1735 ad.type = LSM_AUDIT_DATA_PATH;
1737 __inode_security_revalidate(inode, path->dentry, true);
1738 return inode_has_perm(cred, inode, av, &ad);
1741 /* Same as path_has_perm, but uses the inode from the file struct. */
1742 static inline int file_path_has_perm(const struct cred *cred,
1746 struct common_audit_data ad;
1748 ad.type = LSM_AUDIT_DATA_FILE;
1750 return inode_has_perm(cred, file_inode(file), av, &ad);
1753 #ifdef CONFIG_BPF_SYSCALL
1754 static int bpf_fd_pass(struct file *file, u32 sid);
1757 /* Check whether a task can use an open file descriptor to
1758 access an inode in a given way. Check access to the
1759 descriptor itself, and then use dentry_has_perm to
1760 check a particular permission to the file.
1761 Access to the descriptor is implicitly granted if it
1762 has the same SID as the process. If av is zero, then
1763 access to the file is not checked, e.g. for cases
1764 where only the descriptor is affected like seek. */
1765 static int file_has_perm(const struct cred *cred,
1769 struct file_security_struct *fsec = selinux_file(file);
1770 struct inode *inode = file_inode(file);
1771 struct common_audit_data ad;
1772 u32 sid = cred_sid(cred);
1775 ad.type = LSM_AUDIT_DATA_FILE;
1778 if (sid != fsec->sid) {
1779 rc = avc_has_perm(&selinux_state,
1788 #ifdef CONFIG_BPF_SYSCALL
1789 rc = bpf_fd_pass(file, cred_sid(cred));
1794 /* av is zero if only checking access to the descriptor. */
1797 rc = inode_has_perm(cred, inode, av, &ad);
1804 * Determine the label for an inode that might be unioned.
1807 selinux_determine_inode_label(const struct task_security_struct *tsec,
1809 const struct qstr *name, u16 tclass,
1812 const struct superblock_security_struct *sbsec =
1813 selinux_superblock(dir->i_sb);
1815 if ((sbsec->flags & SE_SBINITIALIZED) &&
1816 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1817 *_new_isid = sbsec->mntpoint_sid;
1818 } else if ((sbsec->flags & SBLABEL_MNT) &&
1820 *_new_isid = tsec->create_sid;
1822 const struct inode_security_struct *dsec = inode_security(dir);
1823 return security_transition_sid(&selinux_state, tsec->sid,
1831 /* Check whether a task can create a file. */
1832 static int may_create(struct inode *dir,
1833 struct dentry *dentry,
1836 const struct task_security_struct *tsec = selinux_cred(current_cred());
1837 struct inode_security_struct *dsec;
1838 struct superblock_security_struct *sbsec;
1840 struct common_audit_data ad;
1843 dsec = inode_security(dir);
1844 sbsec = selinux_superblock(dir->i_sb);
1848 ad.type = LSM_AUDIT_DATA_DENTRY;
1849 ad.u.dentry = dentry;
1851 rc = avc_has_perm(&selinux_state,
1852 sid, dsec->sid, SECCLASS_DIR,
1853 DIR__ADD_NAME | DIR__SEARCH,
1858 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1863 rc = avc_has_perm(&selinux_state,
1864 sid, newsid, tclass, FILE__CREATE, &ad);
1868 return avc_has_perm(&selinux_state,
1870 SECCLASS_FILESYSTEM,
1871 FILESYSTEM__ASSOCIATE, &ad);
1875 #define MAY_UNLINK 1
1878 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1879 static int may_link(struct inode *dir,
1880 struct dentry *dentry,
1884 struct inode_security_struct *dsec, *isec;
1885 struct common_audit_data ad;
1886 u32 sid = current_sid();
1890 dsec = inode_security(dir);
1891 isec = backing_inode_security(dentry);
1893 ad.type = LSM_AUDIT_DATA_DENTRY;
1894 ad.u.dentry = dentry;
1897 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1898 rc = avc_has_perm(&selinux_state,
1899 sid, dsec->sid, SECCLASS_DIR, av, &ad);
1914 pr_warn("SELinux: %s: unrecognized kind %d\n",
1919 rc = avc_has_perm(&selinux_state,
1920 sid, isec->sid, isec->sclass, av, &ad);
1924 static inline int may_rename(struct inode *old_dir,
1925 struct dentry *old_dentry,
1926 struct inode *new_dir,
1927 struct dentry *new_dentry)
1929 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1930 struct common_audit_data ad;
1931 u32 sid = current_sid();
1933 int old_is_dir, new_is_dir;
1936 old_dsec = inode_security(old_dir);
1937 old_isec = backing_inode_security(old_dentry);
1938 old_is_dir = d_is_dir(old_dentry);
1939 new_dsec = inode_security(new_dir);
1941 ad.type = LSM_AUDIT_DATA_DENTRY;
1943 ad.u.dentry = old_dentry;
1944 rc = avc_has_perm(&selinux_state,
1945 sid, old_dsec->sid, SECCLASS_DIR,
1946 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1949 rc = avc_has_perm(&selinux_state,
1951 old_isec->sclass, FILE__RENAME, &ad);
1954 if (old_is_dir && new_dir != old_dir) {
1955 rc = avc_has_perm(&selinux_state,
1957 old_isec->sclass, DIR__REPARENT, &ad);
1962 ad.u.dentry = new_dentry;
1963 av = DIR__ADD_NAME | DIR__SEARCH;
1964 if (d_is_positive(new_dentry))
1965 av |= DIR__REMOVE_NAME;
1966 rc = avc_has_perm(&selinux_state,
1967 sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1970 if (d_is_positive(new_dentry)) {
1971 new_isec = backing_inode_security(new_dentry);
1972 new_is_dir = d_is_dir(new_dentry);
1973 rc = avc_has_perm(&selinux_state,
1976 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1984 /* Check whether a task can perform a filesystem operation. */
1985 static int superblock_has_perm(const struct cred *cred,
1986 struct super_block *sb,
1988 struct common_audit_data *ad)
1990 struct superblock_security_struct *sbsec;
1991 u32 sid = cred_sid(cred);
1993 sbsec = selinux_superblock(sb);
1994 return avc_has_perm(&selinux_state,
1995 sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1998 /* Convert a Linux mode and permission mask to an access vector. */
1999 static inline u32 file_mask_to_av(int mode, int mask)
2003 if (!S_ISDIR(mode)) {
2004 if (mask & MAY_EXEC)
2005 av |= FILE__EXECUTE;
2006 if (mask & MAY_READ)
2009 if (mask & MAY_APPEND)
2011 else if (mask & MAY_WRITE)
2015 if (mask & MAY_EXEC)
2017 if (mask & MAY_WRITE)
2019 if (mask & MAY_READ)
2026 /* Convert a Linux file to an access vector. */
2027 static inline u32 file_to_av(struct file *file)
2031 if (file->f_mode & FMODE_READ)
2033 if (file->f_mode & FMODE_WRITE) {
2034 if (file->f_flags & O_APPEND)
2041 * Special file opened with flags 3 for ioctl-only use.
2050 * Convert a file to an access vector and include the correct
2053 static inline u32 open_file_to_av(struct file *file)
2055 u32 av = file_to_av(file);
2056 struct inode *inode = file_inode(file);
2058 if (selinux_policycap_openperm() &&
2059 inode->i_sb->s_magic != SOCKFS_MAGIC)
2065 /* Hook functions begin here. */
2067 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
2069 return avc_has_perm(&selinux_state,
2070 current_sid(), task_sid_binder(mgr), SECCLASS_BINDER,
2071 BINDER__SET_CONTEXT_MGR, NULL);
2074 static int selinux_binder_transaction(struct task_struct *from,
2075 struct task_struct *to)
2077 u32 mysid = current_sid();
2078 u32 fromsid = task_sid_binder(from);
2081 if (mysid != fromsid) {
2082 rc = avc_has_perm(&selinux_state,
2083 mysid, fromsid, SECCLASS_BINDER,
2084 BINDER__IMPERSONATE, NULL);
2089 return avc_has_perm(&selinux_state, fromsid, task_sid_binder(to),
2090 SECCLASS_BINDER, BINDER__CALL, NULL);
2093 static int selinux_binder_transfer_binder(struct task_struct *from,
2094 struct task_struct *to)
2096 return avc_has_perm(&selinux_state,
2097 task_sid_binder(from), task_sid_binder(to),
2098 SECCLASS_BINDER, BINDER__TRANSFER,
2102 static int selinux_binder_transfer_file(struct task_struct *from,
2103 struct task_struct *to,
2106 u32 sid = task_sid_binder(to);
2107 struct file_security_struct *fsec = selinux_file(file);
2108 struct dentry *dentry = file->f_path.dentry;
2109 struct inode_security_struct *isec;
2110 struct common_audit_data ad;
2113 ad.type = LSM_AUDIT_DATA_PATH;
2114 ad.u.path = file->f_path;
2116 if (sid != fsec->sid) {
2117 rc = avc_has_perm(&selinux_state,
2126 #ifdef CONFIG_BPF_SYSCALL
2127 rc = bpf_fd_pass(file, sid);
2132 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2135 isec = backing_inode_security(dentry);
2136 return avc_has_perm(&selinux_state,
2137 sid, isec->sid, isec->sclass, file_to_av(file),
2141 static int selinux_ptrace_access_check(struct task_struct *child,
2144 u32 sid = current_sid();
2145 u32 csid = task_sid_obj(child);
2147 if (mode & PTRACE_MODE_READ)
2148 return avc_has_perm(&selinux_state,
2149 sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2151 return avc_has_perm(&selinux_state,
2152 sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2155 static int selinux_ptrace_traceme(struct task_struct *parent)
2157 return avc_has_perm(&selinux_state,
2158 task_sid_subj(parent), task_sid_obj(current),
2159 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2162 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2163 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2165 return avc_has_perm(&selinux_state,
2166 current_sid(), task_sid_obj(target), SECCLASS_PROCESS,
2167 PROCESS__GETCAP, NULL);
2170 static int selinux_capset(struct cred *new, const struct cred *old,
2171 const kernel_cap_t *effective,
2172 const kernel_cap_t *inheritable,
2173 const kernel_cap_t *permitted)
2175 return avc_has_perm(&selinux_state,
2176 cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2177 PROCESS__SETCAP, NULL);
2181 * (This comment used to live with the selinux_task_setuid hook,
2182 * which was removed).
2184 * Since setuid only affects the current process, and since the SELinux
2185 * controls are not based on the Linux identity attributes, SELinux does not
2186 * need to control this operation. However, SELinux does control the use of
2187 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2190 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2191 int cap, unsigned int opts)
2193 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2196 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2198 const struct cred *cred = current_cred();
2213 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2221 case Q_XGETNEXTQUOTA:
2222 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2225 rc = 0; /* let the kernel handle invalid cmds */
2231 static int selinux_quota_on(struct dentry *dentry)
2233 const struct cred *cred = current_cred();
2235 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2238 static int selinux_syslog(int type)
2241 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2242 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2243 return avc_has_perm(&selinux_state,
2244 current_sid(), SECINITSID_KERNEL,
2245 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2246 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2247 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2248 /* Set level of messages printed to console */
2249 case SYSLOG_ACTION_CONSOLE_LEVEL:
2250 return avc_has_perm(&selinux_state,
2251 current_sid(), SECINITSID_KERNEL,
2252 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2255 /* All other syslog types */
2256 return avc_has_perm(&selinux_state,
2257 current_sid(), SECINITSID_KERNEL,
2258 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2262 * Check that a process has enough memory to allocate a new virtual
2263 * mapping. 0 means there is enough memory for the allocation to
2264 * succeed and -ENOMEM implies there is not.
2266 * Do not audit the selinux permission check, as this is applied to all
2267 * processes that allocate mappings.
2269 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2271 int rc, cap_sys_admin = 0;
2273 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2274 CAP_OPT_NOAUDIT, true);
2278 return cap_sys_admin;
2281 /* binprm security operations */
2283 static u32 ptrace_parent_sid(void)
2286 struct task_struct *tracer;
2289 tracer = ptrace_parent(current);
2291 sid = task_sid_obj(tracer);
2297 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2298 const struct task_security_struct *old_tsec,
2299 const struct task_security_struct *new_tsec)
2301 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2302 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2306 if (!nnp && !nosuid)
2307 return 0; /* neither NNP nor nosuid */
2309 if (new_tsec->sid == old_tsec->sid)
2310 return 0; /* No change in credentials */
2313 * If the policy enables the nnp_nosuid_transition policy capability,
2314 * then we permit transitions under NNP or nosuid if the
2315 * policy allows the corresponding permission between
2316 * the old and new contexts.
2318 if (selinux_policycap_nnp_nosuid_transition()) {
2321 av |= PROCESS2__NNP_TRANSITION;
2323 av |= PROCESS2__NOSUID_TRANSITION;
2324 rc = avc_has_perm(&selinux_state,
2325 old_tsec->sid, new_tsec->sid,
2326 SECCLASS_PROCESS2, av, NULL);
2332 * We also permit NNP or nosuid transitions to bounded SIDs,
2333 * i.e. SIDs that are guaranteed to only be allowed a subset
2334 * of the permissions of the current SID.
2336 rc = security_bounded_transition(&selinux_state, old_tsec->sid,
2342 * On failure, preserve the errno values for NNP vs nosuid.
2343 * NNP: Operation not permitted for caller.
2344 * nosuid: Permission denied to file.
2351 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2353 const struct task_security_struct *old_tsec;
2354 struct task_security_struct *new_tsec;
2355 struct inode_security_struct *isec;
2356 struct common_audit_data ad;
2357 struct inode *inode = file_inode(bprm->file);
2360 /* SELinux context only depends on initial program or script and not
2361 * the script interpreter */
2363 old_tsec = selinux_cred(current_cred());
2364 new_tsec = selinux_cred(bprm->cred);
2365 isec = inode_security(inode);
2367 /* Default to the current task SID. */
2368 new_tsec->sid = old_tsec->sid;
2369 new_tsec->osid = old_tsec->sid;
2371 /* Reset fs, key, and sock SIDs on execve. */
2372 new_tsec->create_sid = 0;
2373 new_tsec->keycreate_sid = 0;
2374 new_tsec->sockcreate_sid = 0;
2376 if (old_tsec->exec_sid) {
2377 new_tsec->sid = old_tsec->exec_sid;
2378 /* Reset exec SID on execve. */
2379 new_tsec->exec_sid = 0;
2381 /* Fail on NNP or nosuid if not an allowed transition. */
2382 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2386 /* Check for a default transition on this program. */
2387 rc = security_transition_sid(&selinux_state, old_tsec->sid,
2388 isec->sid, SECCLASS_PROCESS, NULL,
2394 * Fallback to old SID on NNP or nosuid if not an allowed
2397 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2399 new_tsec->sid = old_tsec->sid;
2402 ad.type = LSM_AUDIT_DATA_FILE;
2403 ad.u.file = bprm->file;
2405 if (new_tsec->sid == old_tsec->sid) {
2406 rc = avc_has_perm(&selinux_state,
2407 old_tsec->sid, isec->sid,
2408 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2412 /* Check permissions for the transition. */
2413 rc = avc_has_perm(&selinux_state,
2414 old_tsec->sid, new_tsec->sid,
2415 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2419 rc = avc_has_perm(&selinux_state,
2420 new_tsec->sid, isec->sid,
2421 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2425 /* Check for shared state */
2426 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2427 rc = avc_has_perm(&selinux_state,
2428 old_tsec->sid, new_tsec->sid,
2429 SECCLASS_PROCESS, PROCESS__SHARE,
2435 /* Make sure that anyone attempting to ptrace over a task that
2436 * changes its SID has the appropriate permit */
2437 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2438 u32 ptsid = ptrace_parent_sid();
2440 rc = avc_has_perm(&selinux_state,
2441 ptsid, new_tsec->sid,
2443 PROCESS__PTRACE, NULL);
2449 /* Clear any possibly unsafe personality bits on exec: */
2450 bprm->per_clear |= PER_CLEAR_ON_SETID;
2452 /* Enable secure mode for SIDs transitions unless
2453 the noatsecure permission is granted between
2454 the two SIDs, i.e. ahp returns 0. */
2455 rc = avc_has_perm(&selinux_state,
2456 old_tsec->sid, new_tsec->sid,
2457 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2459 bprm->secureexec |= !!rc;
2465 static int match_file(const void *p, struct file *file, unsigned fd)
2467 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2470 /* Derived from fs/exec.c:flush_old_files. */
2471 static inline void flush_unauthorized_files(const struct cred *cred,
2472 struct files_struct *files)
2474 struct file *file, *devnull = NULL;
2475 struct tty_struct *tty;
2479 tty = get_current_tty();
2481 spin_lock(&tty->files_lock);
2482 if (!list_empty(&tty->tty_files)) {
2483 struct tty_file_private *file_priv;
2485 /* Revalidate access to controlling tty.
2486 Use file_path_has_perm on the tty path directly
2487 rather than using file_has_perm, as this particular
2488 open file may belong to another process and we are
2489 only interested in the inode-based check here. */
2490 file_priv = list_first_entry(&tty->tty_files,
2491 struct tty_file_private, list);
2492 file = file_priv->file;
2493 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2496 spin_unlock(&tty->files_lock);
2499 /* Reset controlling tty. */
2503 /* Revalidate access to inherited open files. */
2504 n = iterate_fd(files, 0, match_file, cred);
2505 if (!n) /* none found? */
2508 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2509 if (IS_ERR(devnull))
2511 /* replace all the matching ones with this */
2513 replace_fd(n - 1, devnull, 0);
2514 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2520 * Prepare a process for imminent new credential changes due to exec
2522 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2524 struct task_security_struct *new_tsec;
2525 struct rlimit *rlim, *initrlim;
2528 new_tsec = selinux_cred(bprm->cred);
2529 if (new_tsec->sid == new_tsec->osid)
2532 /* Close files for which the new task SID is not authorized. */
2533 flush_unauthorized_files(bprm->cred, current->files);
2535 /* Always clear parent death signal on SID transitions. */
2536 current->pdeath_signal = 0;
2538 /* Check whether the new SID can inherit resource limits from the old
2539 * SID. If not, reset all soft limits to the lower of the current
2540 * task's hard limit and the init task's soft limit.
2542 * Note that the setting of hard limits (even to lower them) can be
2543 * controlled by the setrlimit check. The inclusion of the init task's
2544 * soft limit into the computation is to avoid resetting soft limits
2545 * higher than the default soft limit for cases where the default is
2546 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2548 rc = avc_has_perm(&selinux_state,
2549 new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2550 PROCESS__RLIMITINH, NULL);
2552 /* protect against do_prlimit() */
2554 for (i = 0; i < RLIM_NLIMITS; i++) {
2555 rlim = current->signal->rlim + i;
2556 initrlim = init_task.signal->rlim + i;
2557 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2559 task_unlock(current);
2560 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2561 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2566 * Clean up the process immediately after the installation of new credentials
2569 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2571 const struct task_security_struct *tsec = selinux_cred(current_cred());
2581 /* Check whether the new SID can inherit signal state from the old SID.
2582 * If not, clear itimers to avoid subsequent signal generation and
2583 * flush and unblock signals.
2585 * This must occur _after_ the task SID has been updated so that any
2586 * kill done after the flush will be checked against the new SID.
2588 rc = avc_has_perm(&selinux_state,
2589 osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2593 spin_lock_irq(¤t->sighand->siglock);
2594 if (!fatal_signal_pending(current)) {
2595 flush_sigqueue(¤t->pending);
2596 flush_sigqueue(¤t->signal->shared_pending);
2597 flush_signal_handlers(current, 1);
2598 sigemptyset(¤t->blocked);
2599 recalc_sigpending();
2601 spin_unlock_irq(¤t->sighand->siglock);
2604 /* Wake up the parent if it is waiting so that it can recheck
2605 * wait permission to the new task SID. */
2606 read_lock(&tasklist_lock);
2607 __wake_up_parent(current, current->real_parent);
2608 read_unlock(&tasklist_lock);
2611 /* superblock security operations */
2613 static int selinux_sb_alloc_security(struct super_block *sb)
2615 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2617 mutex_init(&sbsec->lock);
2618 INIT_LIST_HEAD(&sbsec->isec_head);
2619 spin_lock_init(&sbsec->isec_lock);
2620 sbsec->sid = SECINITSID_UNLABELED;
2621 sbsec->def_sid = SECINITSID_FILE;
2622 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2627 static inline int opt_len(const char *s)
2629 bool open_quote = false;
2633 for (len = 0; (c = s[len]) != '\0'; len++) {
2635 open_quote = !open_quote;
2636 if (c == ',' && !open_quote)
2642 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2644 char *from = options;
2650 int len = opt_len(from);
2654 token = match_opt_prefix(from, len, &arg);
2656 if (token != Opt_error) {
2661 for (p = q = arg; p < from + len; p++) {
2666 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2672 rc = selinux_add_opt(token, arg, mnt_opts);
2678 if (!first) { // copy with preceding comma
2683 memmove(to, from, len);
2696 selinux_free_mnt_opts(*mnt_opts);
2702 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2704 struct selinux_mnt_opts *opts = mnt_opts;
2705 struct superblock_security_struct *sbsec = sb->s_security;
2710 * Superblock not initialized (i.e. no options) - reject if any
2711 * options specified, otherwise accept.
2713 if (!(sbsec->flags & SE_SBINITIALIZED))
2714 return opts ? 1 : 0;
2717 * Superblock initialized and no options specified - reject if
2718 * superblock has any options set, otherwise accept.
2721 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2723 if (opts->fscontext) {
2724 rc = parse_sid(sb, opts->fscontext, &sid);
2727 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2730 if (opts->context) {
2731 rc = parse_sid(sb, opts->context, &sid);
2734 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2737 if (opts->rootcontext) {
2738 struct inode_security_struct *root_isec;
2740 root_isec = backing_inode_security(sb->s_root);
2741 rc = parse_sid(sb, opts->rootcontext, &sid);
2744 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2747 if (opts->defcontext) {
2748 rc = parse_sid(sb, opts->defcontext, &sid);
2751 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2757 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2759 struct selinux_mnt_opts *opts = mnt_opts;
2760 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2764 if (!(sbsec->flags & SE_SBINITIALIZED))
2770 if (opts->fscontext) {
2771 rc = parse_sid(sb, opts->fscontext, &sid);
2774 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2775 goto out_bad_option;
2777 if (opts->context) {
2778 rc = parse_sid(sb, opts->context, &sid);
2781 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2782 goto out_bad_option;
2784 if (opts->rootcontext) {
2785 struct inode_security_struct *root_isec;
2786 root_isec = backing_inode_security(sb->s_root);
2787 rc = parse_sid(sb, opts->rootcontext, &sid);
2790 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2791 goto out_bad_option;
2793 if (opts->defcontext) {
2794 rc = parse_sid(sb, opts->defcontext, &sid);
2797 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2798 goto out_bad_option;
2803 pr_warn("SELinux: unable to change security options "
2804 "during remount (dev %s, type=%s)\n", sb->s_id,
2809 static int selinux_sb_kern_mount(struct super_block *sb)
2811 const struct cred *cred = current_cred();
2812 struct common_audit_data ad;
2814 ad.type = LSM_AUDIT_DATA_DENTRY;
2815 ad.u.dentry = sb->s_root;
2816 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2819 static int selinux_sb_statfs(struct dentry *dentry)
2821 const struct cred *cred = current_cred();
2822 struct common_audit_data ad;
2824 ad.type = LSM_AUDIT_DATA_DENTRY;
2825 ad.u.dentry = dentry->d_sb->s_root;
2826 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2829 static int selinux_mount(const char *dev_name,
2830 const struct path *path,
2832 unsigned long flags,
2835 const struct cred *cred = current_cred();
2837 if (flags & MS_REMOUNT)
2838 return superblock_has_perm(cred, path->dentry->d_sb,
2839 FILESYSTEM__REMOUNT, NULL);
2841 return path_has_perm(cred, path, FILE__MOUNTON);
2844 static int selinux_move_mount(const struct path *from_path,
2845 const struct path *to_path)
2847 const struct cred *cred = current_cred();
2849 return path_has_perm(cred, to_path, FILE__MOUNTON);
2852 static int selinux_umount(struct vfsmount *mnt, int flags)
2854 const struct cred *cred = current_cred();
2856 return superblock_has_perm(cred, mnt->mnt_sb,
2857 FILESYSTEM__UNMOUNT, NULL);
2860 static int selinux_fs_context_dup(struct fs_context *fc,
2861 struct fs_context *src_fc)
2863 const struct selinux_mnt_opts *src = src_fc->security;
2864 struct selinux_mnt_opts *opts;
2869 fc->security = kzalloc(sizeof(struct selinux_mnt_opts), GFP_KERNEL);
2873 opts = fc->security;
2875 if (src->fscontext) {
2876 opts->fscontext = kstrdup(src->fscontext, GFP_KERNEL);
2877 if (!opts->fscontext)
2881 opts->context = kstrdup(src->context, GFP_KERNEL);
2885 if (src->rootcontext) {
2886 opts->rootcontext = kstrdup(src->rootcontext, GFP_KERNEL);
2887 if (!opts->rootcontext)
2890 if (src->defcontext) {
2891 opts->defcontext = kstrdup(src->defcontext, GFP_KERNEL);
2892 if (!opts->defcontext)
2898 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2899 fsparam_string(CONTEXT_STR, Opt_context),
2900 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2901 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2902 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2903 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2907 static int selinux_fs_context_parse_param(struct fs_context *fc,
2908 struct fs_parameter *param)
2910 struct fs_parse_result result;
2913 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2917 rc = selinux_add_opt(opt, param->string, &fc->security);
2919 param->string = NULL;
2925 /* inode security operations */
2927 static int selinux_inode_alloc_security(struct inode *inode)
2929 struct inode_security_struct *isec = selinux_inode(inode);
2930 u32 sid = current_sid();
2932 spin_lock_init(&isec->lock);
2933 INIT_LIST_HEAD(&isec->list);
2934 isec->inode = inode;
2935 isec->sid = SECINITSID_UNLABELED;
2936 isec->sclass = SECCLASS_FILE;
2937 isec->task_sid = sid;
2938 isec->initialized = LABEL_INVALID;
2943 static void selinux_inode_free_security(struct inode *inode)
2945 inode_free_security(inode);
2948 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2949 const struct qstr *name, void **ctx,
2955 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2956 d_inode(dentry->d_parent), name,
2957 inode_mode_to_security_class(mode),
2962 return security_sid_to_context(&selinux_state, newsid, (char **)ctx,
2966 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2968 const struct cred *old,
2973 struct task_security_struct *tsec;
2975 rc = selinux_determine_inode_label(selinux_cred(old),
2976 d_inode(dentry->d_parent), name,
2977 inode_mode_to_security_class(mode),
2982 tsec = selinux_cred(new);
2983 tsec->create_sid = newsid;
2987 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2988 const struct qstr *qstr,
2990 void **value, size_t *len)
2992 const struct task_security_struct *tsec = selinux_cred(current_cred());
2993 struct superblock_security_struct *sbsec;
2998 sbsec = selinux_superblock(dir->i_sb);
3000 newsid = tsec->create_sid;
3002 rc = selinux_determine_inode_label(tsec, dir, qstr,
3003 inode_mode_to_security_class(inode->i_mode),
3008 /* Possibly defer initialization to selinux_complete_init. */
3009 if (sbsec->flags & SE_SBINITIALIZED) {
3010 struct inode_security_struct *isec = selinux_inode(inode);
3011 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3013 isec->initialized = LABEL_INITIALIZED;
3016 if (!selinux_initialized(&selinux_state) ||
3017 !(sbsec->flags & SBLABEL_MNT))
3021 *name = XATTR_SELINUX_SUFFIX;
3024 rc = security_sid_to_context_force(&selinux_state, newsid,
3035 static int selinux_inode_init_security_anon(struct inode *inode,
3036 const struct qstr *name,
3037 const struct inode *context_inode)
3039 const struct task_security_struct *tsec = selinux_cred(current_cred());
3040 struct common_audit_data ad;
3041 struct inode_security_struct *isec;
3044 if (unlikely(!selinux_initialized(&selinux_state)))
3047 isec = selinux_inode(inode);
3050 * We only get here once per ephemeral inode. The inode has
3051 * been initialized via inode_alloc_security but is otherwise
3055 if (context_inode) {
3056 struct inode_security_struct *context_isec =
3057 selinux_inode(context_inode);
3058 if (context_isec->initialized != LABEL_INITIALIZED) {
3059 pr_err("SELinux: context_inode is not initialized");
3063 isec->sclass = context_isec->sclass;
3064 isec->sid = context_isec->sid;
3066 isec->sclass = SECCLASS_ANON_INODE;
3067 rc = security_transition_sid(
3068 &selinux_state, tsec->sid, tsec->sid,
3069 isec->sclass, name, &isec->sid);
3074 isec->initialized = LABEL_INITIALIZED;
3076 * Now that we've initialized security, check whether we're
3077 * allowed to actually create this type of anonymous inode.
3080 ad.type = LSM_AUDIT_DATA_INODE;
3083 return avc_has_perm(&selinux_state,
3091 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3093 return may_create(dir, dentry, SECCLASS_FILE);
3096 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3098 return may_link(dir, old_dentry, MAY_LINK);
3101 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3103 return may_link(dir, dentry, MAY_UNLINK);
3106 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3108 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3111 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3113 return may_create(dir, dentry, SECCLASS_DIR);
3116 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3118 return may_link(dir, dentry, MAY_RMDIR);
3121 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3123 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3126 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3127 struct inode *new_inode, struct dentry *new_dentry)
3129 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3132 static int selinux_inode_readlink(struct dentry *dentry)
3134 const struct cred *cred = current_cred();
3136 return dentry_has_perm(cred, dentry, FILE__READ);
3139 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3142 const struct cred *cred = current_cred();
3143 struct common_audit_data ad;
3144 struct inode_security_struct *isec;
3147 validate_creds(cred);
3149 ad.type = LSM_AUDIT_DATA_DENTRY;
3150 ad.u.dentry = dentry;
3151 sid = cred_sid(cred);
3152 isec = inode_security_rcu(inode, rcu);
3154 return PTR_ERR(isec);
3156 return avc_has_perm(&selinux_state,
3157 sid, isec->sid, isec->sclass, FILE__READ, &ad);
3160 static noinline int audit_inode_permission(struct inode *inode,
3161 u32 perms, u32 audited, u32 denied,
3164 struct common_audit_data ad;
3165 struct inode_security_struct *isec = selinux_inode(inode);
3167 ad.type = LSM_AUDIT_DATA_INODE;
3170 return slow_avc_audit(&selinux_state,
3171 current_sid(), isec->sid, isec->sclass, perms,
3172 audited, denied, result, &ad);
3175 static int selinux_inode_permission(struct inode *inode, int mask)
3177 const struct cred *cred = current_cred();
3180 bool no_block = mask & MAY_NOT_BLOCK;
3181 struct inode_security_struct *isec;
3183 struct av_decision avd;
3185 u32 audited, denied;
3187 from_access = mask & MAY_ACCESS;
3188 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3190 /* No permission to check. Existence test. */
3194 validate_creds(cred);
3196 if (unlikely(IS_PRIVATE(inode)))
3199 perms = file_mask_to_av(inode->i_mode, mask);
3201 sid = cred_sid(cred);
3202 isec = inode_security_rcu(inode, no_block);
3204 return PTR_ERR(isec);
3206 rc = avc_has_perm_noaudit(&selinux_state,
3207 sid, isec->sid, isec->sclass, perms, 0,
3209 audited = avc_audit_required(perms, &avd, rc,
3210 from_access ? FILE__AUDIT_ACCESS : 0,
3212 if (likely(!audited))
3215 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3221 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3223 const struct cred *cred = current_cred();
3224 struct inode *inode = d_backing_inode(dentry);
3225 unsigned int ia_valid = iattr->ia_valid;
3226 __u32 av = FILE__WRITE;
3228 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3229 if (ia_valid & ATTR_FORCE) {
3230 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3236 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3237 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3238 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3240 if (selinux_policycap_openperm() &&
3241 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3242 (ia_valid & ATTR_SIZE) &&
3243 !(ia_valid & ATTR_FILE))
3246 return dentry_has_perm(cred, dentry, av);
3249 static int selinux_inode_getattr(const struct path *path)
3251 return path_has_perm(current_cred(), path, FILE__GETATTR);
3254 static bool has_cap_mac_admin(bool audit)
3256 const struct cred *cred = current_cred();
3257 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3259 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3261 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3266 static int selinux_inode_setxattr(struct user_namespace *mnt_userns,
3267 struct dentry *dentry, const char *name,
3268 const void *value, size_t size, int flags)
3270 struct inode *inode = d_backing_inode(dentry);
3271 struct inode_security_struct *isec;
3272 struct superblock_security_struct *sbsec;
3273 struct common_audit_data ad;
3274 u32 newsid, sid = current_sid();
3277 if (strcmp(name, XATTR_NAME_SELINUX)) {
3278 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3282 /* Not an attribute we recognize, so just check the
3283 ordinary setattr permission. */
3284 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3287 if (!selinux_initialized(&selinux_state))
3288 return (inode_owner_or_capable(mnt_userns, inode) ? 0 : -EPERM);
3290 sbsec = selinux_superblock(inode->i_sb);
3291 if (!(sbsec->flags & SBLABEL_MNT))
3294 if (!inode_owner_or_capable(mnt_userns, inode))
3297 ad.type = LSM_AUDIT_DATA_DENTRY;
3298 ad.u.dentry = dentry;
3300 isec = backing_inode_security(dentry);
3301 rc = avc_has_perm(&selinux_state,
3302 sid, isec->sid, isec->sclass,
3303 FILE__RELABELFROM, &ad);
3307 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3309 if (rc == -EINVAL) {
3310 if (!has_cap_mac_admin(true)) {
3311 struct audit_buffer *ab;
3314 /* We strip a nul only if it is at the end, otherwise the
3315 * context contains a nul and we should audit that */
3317 const char *str = value;
3319 if (str[size - 1] == '\0')
3320 audit_size = size - 1;
3326 ab = audit_log_start(audit_context(),
3327 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3330 audit_log_format(ab, "op=setxattr invalid_context=");
3331 audit_log_n_untrustedstring(ab, value, audit_size);
3336 rc = security_context_to_sid_force(&selinux_state, value,
3342 rc = avc_has_perm(&selinux_state,
3343 sid, newsid, isec->sclass,
3344 FILE__RELABELTO, &ad);
3348 rc = security_validate_transition(&selinux_state, isec->sid, newsid,
3353 return avc_has_perm(&selinux_state,
3356 SECCLASS_FILESYSTEM,
3357 FILESYSTEM__ASSOCIATE,
3361 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3362 const void *value, size_t size,
3365 struct inode *inode = d_backing_inode(dentry);
3366 struct inode_security_struct *isec;
3370 if (strcmp(name, XATTR_NAME_SELINUX)) {
3371 /* Not an attribute we recognize, so nothing to do. */
3375 if (!selinux_initialized(&selinux_state)) {
3376 /* If we haven't even been initialized, then we can't validate
3377 * against a policy, so leave the label as invalid. It may
3378 * resolve to a valid label on the next revalidation try if
3379 * we've since initialized.
3384 rc = security_context_to_sid_force(&selinux_state, value, size,
3387 pr_err("SELinux: unable to map context to SID"
3388 "for (%s, %lu), rc=%d\n",
3389 inode->i_sb->s_id, inode->i_ino, -rc);
3393 isec = backing_inode_security(dentry);
3394 spin_lock(&isec->lock);
3395 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3397 isec->initialized = LABEL_INITIALIZED;
3398 spin_unlock(&isec->lock);
3403 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3405 const struct cred *cred = current_cred();
3407 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3410 static int selinux_inode_listxattr(struct dentry *dentry)
3412 const struct cred *cred = current_cred();
3414 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3417 static int selinux_inode_removexattr(struct user_namespace *mnt_userns,
3418 struct dentry *dentry, const char *name)
3420 if (strcmp(name, XATTR_NAME_SELINUX)) {
3421 int rc = cap_inode_removexattr(mnt_userns, dentry, name);
3425 /* Not an attribute we recognize, so just check the
3426 ordinary setattr permission. */
3427 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3430 if (!selinux_initialized(&selinux_state))
3433 /* No one is allowed to remove a SELinux security label.
3434 You can change the label, but all data must be labeled. */
3438 static int selinux_path_notify(const struct path *path, u64 mask,
3439 unsigned int obj_type)
3444 struct common_audit_data ad;
3446 ad.type = LSM_AUDIT_DATA_PATH;
3450 * Set permission needed based on the type of mark being set.
3451 * Performs an additional check for sb watches.
3454 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3455 perm = FILE__WATCH_MOUNT;
3457 case FSNOTIFY_OBJ_TYPE_SB:
3458 perm = FILE__WATCH_SB;
3459 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3460 FILESYSTEM__WATCH, &ad);
3464 case FSNOTIFY_OBJ_TYPE_INODE:
3471 /* blocking watches require the file:watch_with_perm permission */
3472 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3473 perm |= FILE__WATCH_WITH_PERM;
3475 /* watches on read-like events need the file:watch_reads permission */
3476 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3477 perm |= FILE__WATCH_READS;
3479 return path_has_perm(current_cred(), path, perm);
3483 * Copy the inode security context value to the user.
3485 * Permission check is handled by selinux_inode_getxattr hook.
3487 static int selinux_inode_getsecurity(struct user_namespace *mnt_userns,
3488 struct inode *inode, const char *name,
3489 void **buffer, bool alloc)
3493 char *context = NULL;
3494 struct inode_security_struct *isec;
3497 * If we're not initialized yet, then we can't validate contexts, so
3498 * just let vfs_getxattr fall back to using the on-disk xattr.
3500 if (!selinux_initialized(&selinux_state) ||
3501 strcmp(name, XATTR_SELINUX_SUFFIX))
3505 * If the caller has CAP_MAC_ADMIN, then get the raw context
3506 * value even if it is not defined by current policy; otherwise,
3507 * use the in-core value under current policy.
3508 * Use the non-auditing forms of the permission checks since
3509 * getxattr may be called by unprivileged processes commonly
3510 * and lack of permission just means that we fall back to the
3511 * in-core context value, not a denial.
3513 isec = inode_security(inode);
3514 if (has_cap_mac_admin(false))
3515 error = security_sid_to_context_force(&selinux_state,
3516 isec->sid, &context,
3519 error = security_sid_to_context(&selinux_state, isec->sid,
3533 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3534 const void *value, size_t size, int flags)
3536 struct inode_security_struct *isec = inode_security_novalidate(inode);
3537 struct superblock_security_struct *sbsec;
3541 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3544 sbsec = selinux_superblock(inode->i_sb);
3545 if (!(sbsec->flags & SBLABEL_MNT))
3548 if (!value || !size)
3551 rc = security_context_to_sid(&selinux_state, value, size, &newsid,
3556 spin_lock(&isec->lock);
3557 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3559 isec->initialized = LABEL_INITIALIZED;
3560 spin_unlock(&isec->lock);
3564 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3566 const int len = sizeof(XATTR_NAME_SELINUX);
3568 if (!selinux_initialized(&selinux_state))
3571 if (buffer && len <= buffer_size)
3572 memcpy(buffer, XATTR_NAME_SELINUX, len);
3576 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3578 struct inode_security_struct *isec = inode_security_novalidate(inode);
3582 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3585 struct task_security_struct *tsec;
3586 struct cred *new_creds = *new;
3588 if (new_creds == NULL) {
3589 new_creds = prepare_creds();
3594 tsec = selinux_cred(new_creds);
3595 /* Get label from overlay inode and set it in create_sid */
3596 selinux_inode_getsecid(d_inode(src), &sid);
3597 tsec->create_sid = sid;
3602 static int selinux_inode_copy_up_xattr(const char *name)
3604 /* The copy_up hook above sets the initial context on an inode, but we
3605 * don't then want to overwrite it by blindly copying all the lower
3606 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3608 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3609 return 1; /* Discard */
3611 * Any other attribute apart from SELINUX is not claimed, supported
3617 /* kernfs node operations */
3619 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3620 struct kernfs_node *kn)
3622 const struct task_security_struct *tsec = selinux_cred(current_cred());
3623 u32 parent_sid, newsid, clen;
3627 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3634 context = kmalloc(clen, GFP_KERNEL);
3638 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3644 rc = security_context_to_sid(&selinux_state, context, clen, &parent_sid,
3650 if (tsec->create_sid) {
3651 newsid = tsec->create_sid;
3653 u16 secclass = inode_mode_to_security_class(kn->mode);
3657 q.hash_len = hashlen_string(kn_dir, kn->name);
3659 rc = security_transition_sid(&selinux_state, tsec->sid,
3660 parent_sid, secclass, &q,
3666 rc = security_sid_to_context_force(&selinux_state, newsid,
3671 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3678 /* file security operations */
3680 static int selinux_revalidate_file_permission(struct file *file, int mask)
3682 const struct cred *cred = current_cred();
3683 struct inode *inode = file_inode(file);
3685 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3686 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3689 return file_has_perm(cred, file,
3690 file_mask_to_av(inode->i_mode, mask));
3693 static int selinux_file_permission(struct file *file, int mask)
3695 struct inode *inode = file_inode(file);
3696 struct file_security_struct *fsec = selinux_file(file);
3697 struct inode_security_struct *isec;
3698 u32 sid = current_sid();
3701 /* No permission to check. Existence test. */
3704 isec = inode_security(inode);
3705 if (sid == fsec->sid && fsec->isid == isec->sid &&
3706 fsec->pseqno == avc_policy_seqno(&selinux_state))
3707 /* No change since file_open check. */
3710 return selinux_revalidate_file_permission(file, mask);
3713 static int selinux_file_alloc_security(struct file *file)
3715 struct file_security_struct *fsec = selinux_file(file);
3716 u32 sid = current_sid();
3719 fsec->fown_sid = sid;
3725 * Check whether a task has the ioctl permission and cmd
3726 * operation to an inode.
3728 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3729 u32 requested, u16 cmd)
3731 struct common_audit_data ad;
3732 struct file_security_struct *fsec = selinux_file(file);
3733 struct inode *inode = file_inode(file);
3734 struct inode_security_struct *isec;
3735 struct lsm_ioctlop_audit ioctl;
3736 u32 ssid = cred_sid(cred);
3738 u8 driver = cmd >> 8;
3739 u8 xperm = cmd & 0xff;
3741 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3744 ad.u.op->path = file->f_path;
3746 if (ssid != fsec->sid) {
3747 rc = avc_has_perm(&selinux_state,
3756 if (unlikely(IS_PRIVATE(inode)))
3759 isec = inode_security(inode);
3760 rc = avc_has_extended_perms(&selinux_state,
3761 ssid, isec->sid, isec->sclass,
3762 requested, driver, xperm, &ad);
3767 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3770 const struct cred *cred = current_cred();
3777 case FS_IOC_GETFLAGS:
3778 case FS_IOC_GETVERSION:
3779 error = file_has_perm(cred, file, FILE__GETATTR);
3782 case FS_IOC_SETFLAGS:
3783 case FS_IOC_SETVERSION:
3784 error = file_has_perm(cred, file, FILE__SETATTR);
3787 /* sys_ioctl() checks */
3790 error = file_has_perm(cred, file, 0);
3795 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3796 CAP_OPT_NONE, true);
3799 /* default case assumes that the command will go
3800 * to the file's ioctl() function.
3803 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3808 static int default_noexec __ro_after_init;
3810 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3812 const struct cred *cred = current_cred();
3813 u32 sid = cred_sid(cred);
3816 if (default_noexec &&
3817 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3818 (!shared && (prot & PROT_WRITE)))) {
3820 * We are making executable an anonymous mapping or a
3821 * private file mapping that will also be writable.
3822 * This has an additional check.
3824 rc = avc_has_perm(&selinux_state,
3825 sid, sid, SECCLASS_PROCESS,
3826 PROCESS__EXECMEM, NULL);
3832 /* read access is always possible with a mapping */
3833 u32 av = FILE__READ;
3835 /* write access only matters if the mapping is shared */
3836 if (shared && (prot & PROT_WRITE))
3839 if (prot & PROT_EXEC)
3840 av |= FILE__EXECUTE;
3842 return file_has_perm(cred, file, av);
3849 static int selinux_mmap_addr(unsigned long addr)
3853 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3854 u32 sid = current_sid();
3855 rc = avc_has_perm(&selinux_state,
3856 sid, sid, SECCLASS_MEMPROTECT,
3857 MEMPROTECT__MMAP_ZERO, NULL);
3863 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3864 unsigned long prot, unsigned long flags)
3866 struct common_audit_data ad;
3870 ad.type = LSM_AUDIT_DATA_FILE;
3872 rc = inode_has_perm(current_cred(), file_inode(file),
3878 if (checkreqprot_get(&selinux_state))
3881 return file_map_prot_check(file, prot,
3882 (flags & MAP_TYPE) == MAP_SHARED);
3885 static int selinux_file_mprotect(struct vm_area_struct *vma,
3886 unsigned long reqprot,
3889 const struct cred *cred = current_cred();
3890 u32 sid = cred_sid(cred);
3892 if (checkreqprot_get(&selinux_state))
3895 if (default_noexec &&
3896 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3898 if (vma->vm_start >= vma->vm_mm->start_brk &&
3899 vma->vm_end <= vma->vm_mm->brk) {
3900 rc = avc_has_perm(&selinux_state,
3901 sid, sid, SECCLASS_PROCESS,
3902 PROCESS__EXECHEAP, NULL);
3903 } else if (!vma->vm_file &&
3904 ((vma->vm_start <= vma->vm_mm->start_stack &&
3905 vma->vm_end >= vma->vm_mm->start_stack) ||
3906 vma_is_stack_for_current(vma))) {
3907 rc = avc_has_perm(&selinux_state,
3908 sid, sid, SECCLASS_PROCESS,
3909 PROCESS__EXECSTACK, NULL);
3910 } else if (vma->vm_file && vma->anon_vma) {
3912 * We are making executable a file mapping that has
3913 * had some COW done. Since pages might have been
3914 * written, check ability to execute the possibly
3915 * modified content. This typically should only
3916 * occur for text relocations.
3918 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3924 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3927 static int selinux_file_lock(struct file *file, unsigned int cmd)
3929 const struct cred *cred = current_cred();
3931 return file_has_perm(cred, file, FILE__LOCK);
3934 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3937 const struct cred *cred = current_cred();
3942 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3943 err = file_has_perm(cred, file, FILE__WRITE);
3952 case F_GETOWNER_UIDS:
3953 /* Just check FD__USE permission */
3954 err = file_has_perm(cred, file, 0);
3962 #if BITS_PER_LONG == 32
3967 err = file_has_perm(cred, file, FILE__LOCK);
3974 static void selinux_file_set_fowner(struct file *file)
3976 struct file_security_struct *fsec;
3978 fsec = selinux_file(file);
3979 fsec->fown_sid = current_sid();
3982 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3983 struct fown_struct *fown, int signum)
3986 u32 sid = task_sid_obj(tsk);
3988 struct file_security_struct *fsec;
3990 /* struct fown_struct is never outside the context of a struct file */
3991 file = container_of(fown, struct file, f_owner);
3993 fsec = selinux_file(file);
3996 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3998 perm = signal_to_av(signum);
4000 return avc_has_perm(&selinux_state,
4001 fsec->fown_sid, sid,
4002 SECCLASS_PROCESS, perm, NULL);
4005 static int selinux_file_receive(struct file *file)
4007 const struct cred *cred = current_cred();
4009 return file_has_perm(cred, file, file_to_av(file));
4012 static int selinux_file_open(struct file *file)
4014 struct file_security_struct *fsec;
4015 struct inode_security_struct *isec;
4017 fsec = selinux_file(file);
4018 isec = inode_security(file_inode(file));
4020 * Save inode label and policy sequence number
4021 * at open-time so that selinux_file_permission
4022 * can determine whether revalidation is necessary.
4023 * Task label is already saved in the file security
4024 * struct as its SID.
4026 fsec->isid = isec->sid;
4027 fsec->pseqno = avc_policy_seqno(&selinux_state);
4029 * Since the inode label or policy seqno may have changed
4030 * between the selinux_inode_permission check and the saving
4031 * of state above, recheck that access is still permitted.
4032 * Otherwise, access might never be revalidated against the
4033 * new inode label or new policy.
4034 * This check is not redundant - do not remove.
4036 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
4039 /* task security operations */
4041 static int selinux_task_alloc(struct task_struct *task,
4042 unsigned long clone_flags)
4044 u32 sid = current_sid();
4046 return avc_has_perm(&selinux_state,
4047 sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
4051 * prepare a new set of credentials for modification
4053 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4056 const struct task_security_struct *old_tsec = selinux_cred(old);
4057 struct task_security_struct *tsec = selinux_cred(new);
4064 * transfer the SELinux data to a blank set of creds
4066 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4068 const struct task_security_struct *old_tsec = selinux_cred(old);
4069 struct task_security_struct *tsec = selinux_cred(new);
4074 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4076 *secid = cred_sid(c);
4080 * set the security data for a kernel service
4081 * - all the creation contexts are set to unlabelled
4083 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4085 struct task_security_struct *tsec = selinux_cred(new);
4086 u32 sid = current_sid();
4089 ret = avc_has_perm(&selinux_state,
4091 SECCLASS_KERNEL_SERVICE,
4092 KERNEL_SERVICE__USE_AS_OVERRIDE,
4096 tsec->create_sid = 0;
4097 tsec->keycreate_sid = 0;
4098 tsec->sockcreate_sid = 0;
4104 * set the file creation context in a security record to the same as the
4105 * objective context of the specified inode
4107 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4109 struct inode_security_struct *isec = inode_security(inode);
4110 struct task_security_struct *tsec = selinux_cred(new);
4111 u32 sid = current_sid();
4114 ret = avc_has_perm(&selinux_state,
4116 SECCLASS_KERNEL_SERVICE,
4117 KERNEL_SERVICE__CREATE_FILES_AS,
4121 tsec->create_sid = isec->sid;
4125 static int selinux_kernel_module_request(char *kmod_name)
4127 struct common_audit_data ad;
4129 ad.type = LSM_AUDIT_DATA_KMOD;
4130 ad.u.kmod_name = kmod_name;
4132 return avc_has_perm(&selinux_state,
4133 current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4134 SYSTEM__MODULE_REQUEST, &ad);
4137 static int selinux_kernel_module_from_file(struct file *file)
4139 struct common_audit_data ad;
4140 struct inode_security_struct *isec;
4141 struct file_security_struct *fsec;
4142 u32 sid = current_sid();
4147 return avc_has_perm(&selinux_state,
4148 sid, sid, SECCLASS_SYSTEM,
4149 SYSTEM__MODULE_LOAD, NULL);
4153 ad.type = LSM_AUDIT_DATA_FILE;
4156 fsec = selinux_file(file);
4157 if (sid != fsec->sid) {
4158 rc = avc_has_perm(&selinux_state,
4159 sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4164 isec = inode_security(file_inode(file));
4165 return avc_has_perm(&selinux_state,
4166 sid, isec->sid, SECCLASS_SYSTEM,
4167 SYSTEM__MODULE_LOAD, &ad);
4170 static int selinux_kernel_read_file(struct file *file,
4171 enum kernel_read_file_id id,
4177 case READING_MODULE:
4178 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4187 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4192 case LOADING_MODULE:
4193 rc = selinux_kernel_module_from_file(NULL);
4202 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4204 return avc_has_perm(&selinux_state,
4205 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4206 PROCESS__SETPGID, NULL);
4209 static int selinux_task_getpgid(struct task_struct *p)
4211 return avc_has_perm(&selinux_state,
4212 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4213 PROCESS__GETPGID, NULL);
4216 static int selinux_task_getsid(struct task_struct *p)
4218 return avc_has_perm(&selinux_state,
4219 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4220 PROCESS__GETSESSION, NULL);
4223 static void selinux_task_getsecid_subj(struct task_struct *p, u32 *secid)
4225 *secid = task_sid_subj(p);
4228 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4230 *secid = task_sid_obj(p);
4233 static int selinux_task_setnice(struct task_struct *p, int nice)
4235 return avc_has_perm(&selinux_state,
4236 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4237 PROCESS__SETSCHED, NULL);
4240 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4242 return avc_has_perm(&selinux_state,
4243 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4244 PROCESS__SETSCHED, NULL);
4247 static int selinux_task_getioprio(struct task_struct *p)
4249 return avc_has_perm(&selinux_state,
4250 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4251 PROCESS__GETSCHED, NULL);
4254 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4261 if (flags & LSM_PRLIMIT_WRITE)
4262 av |= PROCESS__SETRLIMIT;
4263 if (flags & LSM_PRLIMIT_READ)
4264 av |= PROCESS__GETRLIMIT;
4265 return avc_has_perm(&selinux_state,
4266 cred_sid(cred), cred_sid(tcred),
4267 SECCLASS_PROCESS, av, NULL);
4270 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4271 struct rlimit *new_rlim)
4273 struct rlimit *old_rlim = p->signal->rlim + resource;
4275 /* Control the ability to change the hard limit (whether
4276 lowering or raising it), so that the hard limit can
4277 later be used as a safe reset point for the soft limit
4278 upon context transitions. See selinux_bprm_committing_creds. */
4279 if (old_rlim->rlim_max != new_rlim->rlim_max)
4280 return avc_has_perm(&selinux_state,
4281 current_sid(), task_sid_obj(p),
4282 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4287 static int selinux_task_setscheduler(struct task_struct *p)
4289 return avc_has_perm(&selinux_state,
4290 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4291 PROCESS__SETSCHED, NULL);
4294 static int selinux_task_getscheduler(struct task_struct *p)
4296 return avc_has_perm(&selinux_state,
4297 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4298 PROCESS__GETSCHED, NULL);
4301 static int selinux_task_movememory(struct task_struct *p)
4303 return avc_has_perm(&selinux_state,
4304 current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4305 PROCESS__SETSCHED, NULL);
4308 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4309 int sig, const struct cred *cred)
4315 perm = PROCESS__SIGNULL; /* null signal; existence test */
4317 perm = signal_to_av(sig);
4319 secid = current_sid();
4321 secid = cred_sid(cred);
4322 return avc_has_perm(&selinux_state,
4323 secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4326 static void selinux_task_to_inode(struct task_struct *p,
4327 struct inode *inode)
4329 struct inode_security_struct *isec = selinux_inode(inode);
4330 u32 sid = task_sid_obj(p);
4332 spin_lock(&isec->lock);
4333 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4335 isec->initialized = LABEL_INITIALIZED;
4336 spin_unlock(&isec->lock);
4339 /* Returns error only if unable to parse addresses */
4340 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4341 struct common_audit_data *ad, u8 *proto)
4343 int offset, ihlen, ret = -EINVAL;
4344 struct iphdr _iph, *ih;
4346 offset = skb_network_offset(skb);
4347 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4351 ihlen = ih->ihl * 4;
4352 if (ihlen < sizeof(_iph))
4355 ad->u.net->v4info.saddr = ih->saddr;
4356 ad->u.net->v4info.daddr = ih->daddr;
4360 *proto = ih->protocol;
4362 switch (ih->protocol) {
4364 struct tcphdr _tcph, *th;
4366 if (ntohs(ih->frag_off) & IP_OFFSET)
4370 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4374 ad->u.net->sport = th->source;
4375 ad->u.net->dport = th->dest;
4380 struct udphdr _udph, *uh;
4382 if (ntohs(ih->frag_off) & IP_OFFSET)
4386 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4390 ad->u.net->sport = uh->source;
4391 ad->u.net->dport = uh->dest;
4395 case IPPROTO_DCCP: {
4396 struct dccp_hdr _dccph, *dh;
4398 if (ntohs(ih->frag_off) & IP_OFFSET)
4402 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4406 ad->u.net->sport = dh->dccph_sport;
4407 ad->u.net->dport = dh->dccph_dport;
4411 #if IS_ENABLED(CONFIG_IP_SCTP)
4412 case IPPROTO_SCTP: {
4413 struct sctphdr _sctph, *sh;
4415 if (ntohs(ih->frag_off) & IP_OFFSET)
4419 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4423 ad->u.net->sport = sh->source;
4424 ad->u.net->dport = sh->dest;
4435 #if IS_ENABLED(CONFIG_IPV6)
4437 /* Returns error only if unable to parse addresses */
4438 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4439 struct common_audit_data *ad, u8 *proto)
4442 int ret = -EINVAL, offset;
4443 struct ipv6hdr _ipv6h, *ip6;
4446 offset = skb_network_offset(skb);
4447 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4451 ad->u.net->v6info.saddr = ip6->saddr;
4452 ad->u.net->v6info.daddr = ip6->daddr;
4455 nexthdr = ip6->nexthdr;
4456 offset += sizeof(_ipv6h);
4457 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4466 struct tcphdr _tcph, *th;
4468 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4472 ad->u.net->sport = th->source;
4473 ad->u.net->dport = th->dest;
4478 struct udphdr _udph, *uh;
4480 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4484 ad->u.net->sport = uh->source;
4485 ad->u.net->dport = uh->dest;
4489 case IPPROTO_DCCP: {
4490 struct dccp_hdr _dccph, *dh;
4492 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4496 ad->u.net->sport = dh->dccph_sport;
4497 ad->u.net->dport = dh->dccph_dport;
4501 #if IS_ENABLED(CONFIG_IP_SCTP)
4502 case IPPROTO_SCTP: {
4503 struct sctphdr _sctph, *sh;
4505 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4509 ad->u.net->sport = sh->source;
4510 ad->u.net->dport = sh->dest;
4514 /* includes fragments */
4524 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4525 char **_addrp, int src, u8 *proto)
4530 switch (ad->u.net->family) {
4532 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4535 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4536 &ad->u.net->v4info.daddr);
4539 #if IS_ENABLED(CONFIG_IPV6)
4541 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4544 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4545 &ad->u.net->v6info.daddr);
4555 "SELinux: failure in selinux_parse_skb(),"
4556 " unable to parse packet\n");
4566 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4568 * @family: protocol family
4569 * @sid: the packet's peer label SID
4572 * Check the various different forms of network peer labeling and determine
4573 * the peer label/SID for the packet; most of the magic actually occurs in
4574 * the security server function security_net_peersid_cmp(). The function
4575 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4576 * or -EACCES if @sid is invalid due to inconsistencies with the different
4580 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4587 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4590 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4594 err = security_net_peersid_resolve(&selinux_state, nlbl_sid,
4595 nlbl_type, xfrm_sid, sid);
4596 if (unlikely(err)) {
4598 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4599 " unable to determine packet's peer label\n");
4607 * selinux_conn_sid - Determine the child socket label for a connection
4608 * @sk_sid: the parent socket's SID
4609 * @skb_sid: the packet's SID
4610 * @conn_sid: the resulting connection SID
4612 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4613 * combined with the MLS information from @skb_sid in order to create
4614 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4615 * of @sk_sid. Returns zero on success, negative values on failure.
4618 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4622 if (skb_sid != SECSID_NULL)
4623 err = security_sid_mls_copy(&selinux_state, sk_sid, skb_sid,
4631 /* socket security operations */
4633 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4634 u16 secclass, u32 *socksid)
4636 if (tsec->sockcreate_sid > SECSID_NULL) {
4637 *socksid = tsec->sockcreate_sid;
4641 return security_transition_sid(&selinux_state, tsec->sid, tsec->sid,
4642 secclass, NULL, socksid);
4645 static int sock_has_perm(struct sock *sk, u32 perms)
4647 struct sk_security_struct *sksec = sk->sk_security;
4648 struct common_audit_data ad;
4649 struct lsm_network_audit net = {0,};
4651 if (sksec->sid == SECINITSID_KERNEL)
4654 ad.type = LSM_AUDIT_DATA_NET;
4658 return avc_has_perm(&selinux_state,
4659 current_sid(), sksec->sid, sksec->sclass, perms,
4663 static int selinux_socket_create(int family, int type,
4664 int protocol, int kern)
4666 const struct task_security_struct *tsec = selinux_cred(current_cred());
4674 secclass = socket_type_to_security_class(family, type, protocol);
4675 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4679 return avc_has_perm(&selinux_state,
4680 tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4683 static int selinux_socket_post_create(struct socket *sock, int family,
4684 int type, int protocol, int kern)
4686 const struct task_security_struct *tsec = selinux_cred(current_cred());
4687 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4688 struct sk_security_struct *sksec;
4689 u16 sclass = socket_type_to_security_class(family, type, protocol);
4690 u32 sid = SECINITSID_KERNEL;
4694 err = socket_sockcreate_sid(tsec, sclass, &sid);
4699 isec->sclass = sclass;
4701 isec->initialized = LABEL_INITIALIZED;
4704 sksec = sock->sk->sk_security;
4705 sksec->sclass = sclass;
4707 /* Allows detection of the first association on this socket */
4708 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4709 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4711 err = selinux_netlbl_socket_post_create(sock->sk, family);
4717 static int selinux_socket_socketpair(struct socket *socka,
4718 struct socket *sockb)
4720 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4721 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4723 sksec_a->peer_sid = sksec_b->sid;
4724 sksec_b->peer_sid = sksec_a->sid;
4729 /* Range of port numbers used to automatically bind.
4730 Need to determine whether we should perform a name_bind
4731 permission check between the socket and the port number. */
4733 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4735 struct sock *sk = sock->sk;
4736 struct sk_security_struct *sksec = sk->sk_security;
4740 err = sock_has_perm(sk, SOCKET__BIND);
4744 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4745 family = sk->sk_family;
4746 if (family == PF_INET || family == PF_INET6) {
4748 struct common_audit_data ad;
4749 struct lsm_network_audit net = {0,};
4750 struct sockaddr_in *addr4 = NULL;
4751 struct sockaddr_in6 *addr6 = NULL;
4753 unsigned short snum;
4757 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4758 * that validates multiple binding addresses. Because of this
4759 * need to check address->sa_family as it is possible to have
4760 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4762 if (addrlen < offsetofend(struct sockaddr, sa_family))
4764 family_sa = address->sa_family;
4765 switch (family_sa) {
4768 if (addrlen < sizeof(struct sockaddr_in))
4770 addr4 = (struct sockaddr_in *)address;
4771 if (family_sa == AF_UNSPEC) {
4772 /* see __inet_bind(), we only want to allow
4773 * AF_UNSPEC if the address is INADDR_ANY
4775 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4777 family_sa = AF_INET;
4779 snum = ntohs(addr4->sin_port);
4780 addrp = (char *)&addr4->sin_addr.s_addr;
4783 if (addrlen < SIN6_LEN_RFC2133)
4785 addr6 = (struct sockaddr_in6 *)address;
4786 snum = ntohs(addr6->sin6_port);
4787 addrp = (char *)&addr6->sin6_addr.s6_addr;
4793 ad.type = LSM_AUDIT_DATA_NET;
4795 ad.u.net->sport = htons(snum);
4796 ad.u.net->family = family_sa;
4801 inet_get_local_port_range(sock_net(sk), &low, &high);
4803 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4804 snum < low || snum > high) {
4805 err = sel_netport_sid(sk->sk_protocol,
4809 err = avc_has_perm(&selinux_state,
4812 SOCKET__NAME_BIND, &ad);
4818 switch (sksec->sclass) {
4819 case SECCLASS_TCP_SOCKET:
4820 node_perm = TCP_SOCKET__NODE_BIND;
4823 case SECCLASS_UDP_SOCKET:
4824 node_perm = UDP_SOCKET__NODE_BIND;
4827 case SECCLASS_DCCP_SOCKET:
4828 node_perm = DCCP_SOCKET__NODE_BIND;
4831 case SECCLASS_SCTP_SOCKET:
4832 node_perm = SCTP_SOCKET__NODE_BIND;
4836 node_perm = RAWIP_SOCKET__NODE_BIND;
4840 err = sel_netnode_sid(addrp, family_sa, &sid);
4844 if (family_sa == AF_INET)
4845 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4847 ad.u.net->v6info.saddr = addr6->sin6_addr;
4849 err = avc_has_perm(&selinux_state,
4851 sksec->sclass, node_perm, &ad);
4858 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4859 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4861 return -EAFNOSUPPORT;
4864 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4865 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4867 static int selinux_socket_connect_helper(struct socket *sock,
4868 struct sockaddr *address, int addrlen)
4870 struct sock *sk = sock->sk;
4871 struct sk_security_struct *sksec = sk->sk_security;
4874 err = sock_has_perm(sk, SOCKET__CONNECT);
4877 if (addrlen < offsetofend(struct sockaddr, sa_family))
4880 /* connect(AF_UNSPEC) has special handling, as it is a documented
4881 * way to disconnect the socket
4883 if (address->sa_family == AF_UNSPEC)
4887 * If a TCP, DCCP or SCTP socket, check name_connect permission
4890 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4891 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4892 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4893 struct common_audit_data ad;
4894 struct lsm_network_audit net = {0,};
4895 struct sockaddr_in *addr4 = NULL;
4896 struct sockaddr_in6 *addr6 = NULL;
4897 unsigned short snum;
4900 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4901 * that validates multiple connect addresses. Because of this
4902 * need to check address->sa_family as it is possible to have
4903 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4905 switch (address->sa_family) {
4907 addr4 = (struct sockaddr_in *)address;
4908 if (addrlen < sizeof(struct sockaddr_in))
4910 snum = ntohs(addr4->sin_port);
4913 addr6 = (struct sockaddr_in6 *)address;
4914 if (addrlen < SIN6_LEN_RFC2133)
4916 snum = ntohs(addr6->sin6_port);
4919 /* Note that SCTP services expect -EINVAL, whereas
4920 * others expect -EAFNOSUPPORT.
4922 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4925 return -EAFNOSUPPORT;
4928 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4932 switch (sksec->sclass) {
4933 case SECCLASS_TCP_SOCKET:
4934 perm = TCP_SOCKET__NAME_CONNECT;
4936 case SECCLASS_DCCP_SOCKET:
4937 perm = DCCP_SOCKET__NAME_CONNECT;
4939 case SECCLASS_SCTP_SOCKET:
4940 perm = SCTP_SOCKET__NAME_CONNECT;
4944 ad.type = LSM_AUDIT_DATA_NET;
4946 ad.u.net->dport = htons(snum);
4947 ad.u.net->family = address->sa_family;
4948 err = avc_has_perm(&selinux_state,
4949 sksec->sid, sid, sksec->sclass, perm, &ad);
4957 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4958 static int selinux_socket_connect(struct socket *sock,
4959 struct sockaddr *address, int addrlen)
4962 struct sock *sk = sock->sk;
4964 err = selinux_socket_connect_helper(sock, address, addrlen);
4968 return selinux_netlbl_socket_connect(sk, address);
4971 static int selinux_socket_listen(struct socket *sock, int backlog)
4973 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4976 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4979 struct inode_security_struct *isec;
4980 struct inode_security_struct *newisec;
4984 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4988 isec = inode_security_novalidate(SOCK_INODE(sock));
4989 spin_lock(&isec->lock);
4990 sclass = isec->sclass;
4992 spin_unlock(&isec->lock);
4994 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4995 newisec->sclass = sclass;
4997 newisec->initialized = LABEL_INITIALIZED;
5002 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
5005 return sock_has_perm(sock->sk, SOCKET__WRITE);
5008 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
5009 int size, int flags)
5011 return sock_has_perm(sock->sk, SOCKET__READ);
5014 static int selinux_socket_getsockname(struct socket *sock)
5016 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5019 static int selinux_socket_getpeername(struct socket *sock)
5021 return sock_has_perm(sock->sk, SOCKET__GETATTR);
5024 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
5028 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
5032 return selinux_netlbl_socket_setsockopt(sock, level, optname);
5035 static int selinux_socket_getsockopt(struct socket *sock, int level,
5038 return sock_has_perm(sock->sk, SOCKET__GETOPT);
5041 static int selinux_socket_shutdown(struct socket *sock, int how)
5043 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
5046 static int selinux_socket_unix_stream_connect(struct sock *sock,
5050 struct sk_security_struct *sksec_sock = sock->sk_security;
5051 struct sk_security_struct *sksec_other = other->sk_security;
5052 struct sk_security_struct *sksec_new = newsk->sk_security;
5053 struct common_audit_data ad;
5054 struct lsm_network_audit net = {0,};
5057 ad.type = LSM_AUDIT_DATA_NET;
5059 ad.u.net->sk = other;
5061 err = avc_has_perm(&selinux_state,
5062 sksec_sock->sid, sksec_other->sid,
5063 sksec_other->sclass,
5064 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5068 /* server child socket */
5069 sksec_new->peer_sid = sksec_sock->sid;
5070 err = security_sid_mls_copy(&selinux_state, sksec_other->sid,
5071 sksec_sock->sid, &sksec_new->sid);
5075 /* connecting socket */
5076 sksec_sock->peer_sid = sksec_new->sid;
5081 static int selinux_socket_unix_may_send(struct socket *sock,
5082 struct socket *other)
5084 struct sk_security_struct *ssec = sock->sk->sk_security;
5085 struct sk_security_struct *osec = other->sk->sk_security;
5086 struct common_audit_data ad;
5087 struct lsm_network_audit net = {0,};
5089 ad.type = LSM_AUDIT_DATA_NET;
5091 ad.u.net->sk = other->sk;
5093 return avc_has_perm(&selinux_state,
5094 ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5098 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5099 char *addrp, u16 family, u32 peer_sid,
5100 struct common_audit_data *ad)
5106 err = sel_netif_sid(ns, ifindex, &if_sid);
5109 err = avc_has_perm(&selinux_state,
5111 SECCLASS_NETIF, NETIF__INGRESS, ad);
5115 err = sel_netnode_sid(addrp, family, &node_sid);
5118 return avc_has_perm(&selinux_state,
5120 SECCLASS_NODE, NODE__RECVFROM, ad);
5123 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5127 struct sk_security_struct *sksec = sk->sk_security;
5128 u32 sk_sid = sksec->sid;
5129 struct common_audit_data ad;
5130 struct lsm_network_audit net = {0,};
5133 ad.type = LSM_AUDIT_DATA_NET;
5135 ad.u.net->netif = skb->skb_iif;
5136 ad.u.net->family = family;
5137 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5141 if (selinux_secmark_enabled()) {
5142 err = avc_has_perm(&selinux_state,
5143 sk_sid, skb->secmark, SECCLASS_PACKET,
5149 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5152 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5157 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5160 struct sk_security_struct *sksec = sk->sk_security;
5161 u16 family = sk->sk_family;
5162 u32 sk_sid = sksec->sid;
5163 struct common_audit_data ad;
5164 struct lsm_network_audit net = {0,};
5169 if (family != PF_INET && family != PF_INET6)
5172 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5173 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5176 /* If any sort of compatibility mode is enabled then handoff processing
5177 * to the selinux_sock_rcv_skb_compat() function to deal with the
5178 * special handling. We do this in an attempt to keep this function
5179 * as fast and as clean as possible. */
5180 if (!selinux_policycap_netpeer())
5181 return selinux_sock_rcv_skb_compat(sk, skb, family);
5183 secmark_active = selinux_secmark_enabled();
5184 peerlbl_active = selinux_peerlbl_enabled();
5185 if (!secmark_active && !peerlbl_active)
5188 ad.type = LSM_AUDIT_DATA_NET;
5190 ad.u.net->netif = skb->skb_iif;
5191 ad.u.net->family = family;
5192 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5196 if (peerlbl_active) {
5199 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5202 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5203 addrp, family, peer_sid, &ad);
5205 selinux_netlbl_err(skb, family, err, 0);
5208 err = avc_has_perm(&selinux_state,
5209 sk_sid, peer_sid, SECCLASS_PEER,
5212 selinux_netlbl_err(skb, family, err, 0);
5217 if (secmark_active) {
5218 err = avc_has_perm(&selinux_state,
5219 sk_sid, skb->secmark, SECCLASS_PACKET,
5228 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
5229 int __user *optlen, unsigned len)
5234 struct sk_security_struct *sksec = sock->sk->sk_security;
5235 u32 peer_sid = SECSID_NULL;
5237 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5238 sksec->sclass == SECCLASS_TCP_SOCKET ||
5239 sksec->sclass == SECCLASS_SCTP_SOCKET)
5240 peer_sid = sksec->peer_sid;
5241 if (peer_sid == SECSID_NULL)
5242 return -ENOPROTOOPT;
5244 err = security_sid_to_context(&selinux_state, peer_sid, &scontext,
5249 if (scontext_len > len) {
5254 if (copy_to_user(optval, scontext, scontext_len))
5258 if (put_user(scontext_len, optlen))
5264 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5266 u32 peer_secid = SECSID_NULL;
5268 struct inode_security_struct *isec;
5270 if (skb && skb->protocol == htons(ETH_P_IP))
5272 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5275 family = sock->sk->sk_family;
5279 if (sock && family == PF_UNIX) {
5280 isec = inode_security_novalidate(SOCK_INODE(sock));
5281 peer_secid = isec->sid;
5283 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5286 *secid = peer_secid;
5287 if (peer_secid == SECSID_NULL)
5292 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5294 struct sk_security_struct *sksec;
5296 sksec = kzalloc(sizeof(*sksec), priority);
5300 sksec->peer_sid = SECINITSID_UNLABELED;
5301 sksec->sid = SECINITSID_UNLABELED;
5302 sksec->sclass = SECCLASS_SOCKET;
5303 selinux_netlbl_sk_security_reset(sksec);
5304 sk->sk_security = sksec;
5309 static void selinux_sk_free_security(struct sock *sk)
5311 struct sk_security_struct *sksec = sk->sk_security;
5313 sk->sk_security = NULL;
5314 selinux_netlbl_sk_security_free(sksec);
5318 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5320 struct sk_security_struct *sksec = sk->sk_security;
5321 struct sk_security_struct *newsksec = newsk->sk_security;
5323 newsksec->sid = sksec->sid;
5324 newsksec->peer_sid = sksec->peer_sid;
5325 newsksec->sclass = sksec->sclass;
5327 selinux_netlbl_sk_security_reset(newsksec);
5330 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
5333 *secid = SECINITSID_ANY_SOCKET;
5335 struct sk_security_struct *sksec = sk->sk_security;
5337 *secid = sksec->sid;
5341 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5343 struct inode_security_struct *isec =
5344 inode_security_novalidate(SOCK_INODE(parent));
5345 struct sk_security_struct *sksec = sk->sk_security;
5347 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5348 sk->sk_family == PF_UNIX)
5349 isec->sid = sksec->sid;
5350 sksec->sclass = isec->sclass;
5353 /* Called whenever SCTP receives an INIT chunk. This happens when an incoming
5354 * connect(2), sctp_connectx(3) or sctp_sendmsg(3) (with no association
5357 static int selinux_sctp_assoc_request(struct sctp_endpoint *ep,
5358 struct sk_buff *skb)
5360 struct sk_security_struct *sksec = ep->base.sk->sk_security;
5361 struct common_audit_data ad;
5362 struct lsm_network_audit net = {0,};
5364 u32 peer_sid = SECINITSID_UNLABELED;
5368 if (!selinux_policycap_extsockclass())
5371 peerlbl_active = selinux_peerlbl_enabled();
5373 if (peerlbl_active) {
5374 /* This will return peer_sid = SECSID_NULL if there are
5375 * no peer labels, see security_net_peersid_resolve().
5377 err = selinux_skb_peerlbl_sid(skb, ep->base.sk->sk_family,
5382 if (peer_sid == SECSID_NULL)
5383 peer_sid = SECINITSID_UNLABELED;
5386 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5387 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5389 /* Here as first association on socket. As the peer SID
5390 * was allowed by peer recv (and the netif/node checks),
5391 * then it is approved by policy and used as the primary
5392 * peer SID for getpeercon(3).
5394 sksec->peer_sid = peer_sid;
5395 } else if (sksec->peer_sid != peer_sid) {
5396 /* Other association peer SIDs are checked to enforce
5397 * consistency among the peer SIDs.
5399 ad.type = LSM_AUDIT_DATA_NET;
5401 ad.u.net->sk = ep->base.sk;
5402 err = avc_has_perm(&selinux_state,
5403 sksec->peer_sid, peer_sid, sksec->sclass,
5404 SCTP_SOCKET__ASSOCIATION, &ad);
5409 /* Compute the MLS component for the connection and store
5410 * the information in ep. This will be used by SCTP TCP type
5411 * sockets and peeled off connections as they cause a new
5412 * socket to be generated. selinux_sctp_sk_clone() will then
5413 * plug this into the new socket.
5415 err = selinux_conn_sid(sksec->sid, peer_sid, &conn_sid);
5419 ep->secid = conn_sid;
5420 ep->peer_secid = peer_sid;
5422 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5423 return selinux_netlbl_sctp_assoc_request(ep, skb);
5426 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5427 * based on their @optname.
5429 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5430 struct sockaddr *address,
5433 int len, err = 0, walk_size = 0;
5435 struct sockaddr *addr;
5436 struct socket *sock;
5438 if (!selinux_policycap_extsockclass())
5441 /* Process one or more addresses that may be IPv4 or IPv6 */
5442 sock = sk->sk_socket;
5445 while (walk_size < addrlen) {
5446 if (walk_size + sizeof(sa_family_t) > addrlen)
5450 switch (addr->sa_family) {
5453 len = sizeof(struct sockaddr_in);
5456 len = sizeof(struct sockaddr_in6);
5462 if (walk_size + len > addrlen)
5468 case SCTP_PRIMARY_ADDR:
5469 case SCTP_SET_PEER_PRIMARY_ADDR:
5470 case SCTP_SOCKOPT_BINDX_ADD:
5471 err = selinux_socket_bind(sock, addr, len);
5473 /* Connect checks */
5474 case SCTP_SOCKOPT_CONNECTX:
5475 case SCTP_PARAM_SET_PRIMARY:
5476 case SCTP_PARAM_ADD_IP:
5477 case SCTP_SENDMSG_CONNECT:
5478 err = selinux_socket_connect_helper(sock, addr, len);
5482 /* As selinux_sctp_bind_connect() is called by the
5483 * SCTP protocol layer, the socket is already locked,
5484 * therefore selinux_netlbl_socket_connect_locked()
5485 * is called here. The situations handled are:
5486 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5487 * whenever a new IP address is added or when a new
5488 * primary address is selected.
5489 * Note that an SCTP connect(2) call happens before
5490 * the SCTP protocol layer and is handled via
5491 * selinux_socket_connect().
5493 err = selinux_netlbl_socket_connect_locked(sk, addr);
5507 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5508 static void selinux_sctp_sk_clone(struct sctp_endpoint *ep, struct sock *sk,
5511 struct sk_security_struct *sksec = sk->sk_security;
5512 struct sk_security_struct *newsksec = newsk->sk_security;
5514 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5515 * the non-sctp clone version.
5517 if (!selinux_policycap_extsockclass())
5518 return selinux_sk_clone_security(sk, newsk);
5520 newsksec->sid = ep->secid;
5521 newsksec->peer_sid = ep->peer_secid;
5522 newsksec->sclass = sksec->sclass;
5523 selinux_netlbl_sctp_sk_clone(sk, newsk);
5526 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5527 struct request_sock *req)
5529 struct sk_security_struct *sksec = sk->sk_security;
5531 u16 family = req->rsk_ops->family;
5535 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5538 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5541 req->secid = connsid;
5542 req->peer_secid = peersid;
5544 return selinux_netlbl_inet_conn_request(req, family);
5547 static void selinux_inet_csk_clone(struct sock *newsk,
5548 const struct request_sock *req)
5550 struct sk_security_struct *newsksec = newsk->sk_security;
5552 newsksec->sid = req->secid;
5553 newsksec->peer_sid = req->peer_secid;
5554 /* NOTE: Ideally, we should also get the isec->sid for the
5555 new socket in sync, but we don't have the isec available yet.
5556 So we will wait until sock_graft to do it, by which
5557 time it will have been created and available. */
5559 /* We don't need to take any sort of lock here as we are the only
5560 * thread with access to newsksec */
5561 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5564 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5566 u16 family = sk->sk_family;
5567 struct sk_security_struct *sksec = sk->sk_security;
5569 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5570 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5573 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5576 static int selinux_secmark_relabel_packet(u32 sid)
5578 const struct task_security_struct *__tsec;
5581 __tsec = selinux_cred(current_cred());
5584 return avc_has_perm(&selinux_state,
5585 tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5589 static void selinux_secmark_refcount_inc(void)
5591 atomic_inc(&selinux_secmark_refcount);
5594 static void selinux_secmark_refcount_dec(void)
5596 atomic_dec(&selinux_secmark_refcount);
5599 static void selinux_req_classify_flow(const struct request_sock *req,
5600 struct flowi_common *flic)
5602 flic->flowic_secid = req->secid;
5605 static int selinux_tun_dev_alloc_security(void **security)
5607 struct tun_security_struct *tunsec;
5609 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5612 tunsec->sid = current_sid();
5618 static void selinux_tun_dev_free_security(void *security)
5623 static int selinux_tun_dev_create(void)
5625 u32 sid = current_sid();
5627 /* we aren't taking into account the "sockcreate" SID since the socket
5628 * that is being created here is not a socket in the traditional sense,
5629 * instead it is a private sock, accessible only to the kernel, and
5630 * representing a wide range of network traffic spanning multiple
5631 * connections unlike traditional sockets - check the TUN driver to
5632 * get a better understanding of why this socket is special */
5634 return avc_has_perm(&selinux_state,
5635 sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5639 static int selinux_tun_dev_attach_queue(void *security)
5641 struct tun_security_struct *tunsec = security;
5643 return avc_has_perm(&selinux_state,
5644 current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5645 TUN_SOCKET__ATTACH_QUEUE, NULL);
5648 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5650 struct tun_security_struct *tunsec = security;
5651 struct sk_security_struct *sksec = sk->sk_security;
5653 /* we don't currently perform any NetLabel based labeling here and it
5654 * isn't clear that we would want to do so anyway; while we could apply
5655 * labeling without the support of the TUN user the resulting labeled
5656 * traffic from the other end of the connection would almost certainly
5657 * cause confusion to the TUN user that had no idea network labeling
5658 * protocols were being used */
5660 sksec->sid = tunsec->sid;
5661 sksec->sclass = SECCLASS_TUN_SOCKET;
5666 static int selinux_tun_dev_open(void *security)
5668 struct tun_security_struct *tunsec = security;
5669 u32 sid = current_sid();
5672 err = avc_has_perm(&selinux_state,
5673 sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5674 TUN_SOCKET__RELABELFROM, NULL);
5677 err = avc_has_perm(&selinux_state,
5678 sid, sid, SECCLASS_TUN_SOCKET,
5679 TUN_SOCKET__RELABELTO, NULL);
5687 #ifdef CONFIG_NETFILTER
5689 static unsigned int selinux_ip_forward(struct sk_buff *skb,
5690 const struct net_device *indev,
5696 struct common_audit_data ad;
5697 struct lsm_network_audit net = {0,};
5702 if (!selinux_policycap_netpeer())
5705 secmark_active = selinux_secmark_enabled();
5706 netlbl_active = netlbl_enabled();
5707 peerlbl_active = selinux_peerlbl_enabled();
5708 if (!secmark_active && !peerlbl_active)
5711 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5714 ad.type = LSM_AUDIT_DATA_NET;
5716 ad.u.net->netif = indev->ifindex;
5717 ad.u.net->family = family;
5718 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5721 if (peerlbl_active) {
5722 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
5723 addrp, family, peer_sid, &ad);
5725 selinux_netlbl_err(skb, family, err, 1);
5731 if (avc_has_perm(&selinux_state,
5732 peer_sid, skb->secmark,
5733 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5737 /* we do this in the FORWARD path and not the POST_ROUTING
5738 * path because we want to make sure we apply the necessary
5739 * labeling before IPsec is applied so we can leverage AH
5741 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5747 static unsigned int selinux_ipv4_forward(void *priv,
5748 struct sk_buff *skb,
5749 const struct nf_hook_state *state)
5751 return selinux_ip_forward(skb, state->in, PF_INET);
5754 #if IS_ENABLED(CONFIG_IPV6)
5755 static unsigned int selinux_ipv6_forward(void *priv,
5756 struct sk_buff *skb,
5757 const struct nf_hook_state *state)
5759 return selinux_ip_forward(skb, state->in, PF_INET6);
5763 static unsigned int selinux_ip_output(struct sk_buff *skb,
5769 if (!netlbl_enabled())
5772 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5773 * because we want to make sure we apply the necessary labeling
5774 * before IPsec is applied so we can leverage AH protection */
5777 struct sk_security_struct *sksec;
5779 if (sk_listener(sk))
5780 /* if the socket is the listening state then this
5781 * packet is a SYN-ACK packet which means it needs to
5782 * be labeled based on the connection/request_sock and
5783 * not the parent socket. unfortunately, we can't
5784 * lookup the request_sock yet as it isn't queued on
5785 * the parent socket until after the SYN-ACK is sent.
5786 * the "solution" is to simply pass the packet as-is
5787 * as any IP option based labeling should be copied
5788 * from the initial connection request (in the IP
5789 * layer). it is far from ideal, but until we get a
5790 * security label in the packet itself this is the
5791 * best we can do. */
5794 /* standard practice, label using the parent socket */
5795 sksec = sk->sk_security;
5798 sid = SECINITSID_KERNEL;
5799 if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
5805 static unsigned int selinux_ipv4_output(void *priv,
5806 struct sk_buff *skb,
5807 const struct nf_hook_state *state)
5809 return selinux_ip_output(skb, PF_INET);
5812 #if IS_ENABLED(CONFIG_IPV6)
5813 static unsigned int selinux_ipv6_output(void *priv,
5814 struct sk_buff *skb,
5815 const struct nf_hook_state *state)
5817 return selinux_ip_output(skb, PF_INET6);
5821 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5825 struct sock *sk = skb_to_full_sk(skb);
5826 struct sk_security_struct *sksec;
5827 struct common_audit_data ad;
5828 struct lsm_network_audit net = {0,};
5834 sksec = sk->sk_security;
5836 ad.type = LSM_AUDIT_DATA_NET;
5838 ad.u.net->netif = ifindex;
5839 ad.u.net->family = family;
5840 if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
5843 if (selinux_secmark_enabled())
5844 if (avc_has_perm(&selinux_state,
5845 sksec->sid, skb->secmark,
5846 SECCLASS_PACKET, PACKET__SEND, &ad))
5847 return NF_DROP_ERR(-ECONNREFUSED);
5849 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5850 return NF_DROP_ERR(-ECONNREFUSED);
5855 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5856 const struct net_device *outdev,
5861 int ifindex = outdev->ifindex;
5863 struct common_audit_data ad;
5864 struct lsm_network_audit net = {0,};
5869 /* If any sort of compatibility mode is enabled then handoff processing
5870 * to the selinux_ip_postroute_compat() function to deal with the
5871 * special handling. We do this in an attempt to keep this function
5872 * as fast and as clean as possible. */
5873 if (!selinux_policycap_netpeer())
5874 return selinux_ip_postroute_compat(skb, ifindex, family);
5876 secmark_active = selinux_secmark_enabled();
5877 peerlbl_active = selinux_peerlbl_enabled();
5878 if (!secmark_active && !peerlbl_active)
5881 sk = skb_to_full_sk(skb);
5884 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5885 * packet transformation so allow the packet to pass without any checks
5886 * since we'll have another chance to perform access control checks
5887 * when the packet is on it's final way out.
5888 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5889 * is NULL, in this case go ahead and apply access control.
5890 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5891 * TCP listening state we cannot wait until the XFRM processing
5892 * is done as we will miss out on the SA label if we do;
5893 * unfortunately, this means more work, but it is only once per
5895 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5896 !(sk && sk_listener(sk)))
5901 /* Without an associated socket the packet is either coming
5902 * from the kernel or it is being forwarded; check the packet
5903 * to determine which and if the packet is being forwarded
5904 * query the packet directly to determine the security label. */
5906 secmark_perm = PACKET__FORWARD_OUT;
5907 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5910 secmark_perm = PACKET__SEND;
5911 peer_sid = SECINITSID_KERNEL;
5913 } else if (sk_listener(sk)) {
5914 /* Locally generated packet but the associated socket is in the
5915 * listening state which means this is a SYN-ACK packet. In
5916 * this particular case the correct security label is assigned
5917 * to the connection/request_sock but unfortunately we can't
5918 * query the request_sock as it isn't queued on the parent
5919 * socket until after the SYN-ACK packet is sent; the only
5920 * viable choice is to regenerate the label like we do in
5921 * selinux_inet_conn_request(). See also selinux_ip_output()
5922 * for similar problems. */
5924 struct sk_security_struct *sksec;
5926 sksec = sk->sk_security;
5927 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5929 /* At this point, if the returned skb peerlbl is SECSID_NULL
5930 * and the packet has been through at least one XFRM
5931 * transformation then we must be dealing with the "final"
5932 * form of labeled IPsec packet; since we've already applied
5933 * all of our access controls on this packet we can safely
5934 * pass the packet. */
5935 if (skb_sid == SECSID_NULL) {
5938 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5942 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5946 return NF_DROP_ERR(-ECONNREFUSED);
5949 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5951 secmark_perm = PACKET__SEND;
5953 /* Locally generated packet, fetch the security label from the
5954 * associated socket. */
5955 struct sk_security_struct *sksec = sk->sk_security;
5956 peer_sid = sksec->sid;
5957 secmark_perm = PACKET__SEND;
5960 ad.type = LSM_AUDIT_DATA_NET;
5962 ad.u.net->netif = ifindex;
5963 ad.u.net->family = family;
5964 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5968 if (avc_has_perm(&selinux_state,
5969 peer_sid, skb->secmark,
5970 SECCLASS_PACKET, secmark_perm, &ad))
5971 return NF_DROP_ERR(-ECONNREFUSED);
5973 if (peerlbl_active) {
5977 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5979 if (avc_has_perm(&selinux_state,
5981 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5982 return NF_DROP_ERR(-ECONNREFUSED);
5984 if (sel_netnode_sid(addrp, family, &node_sid))
5986 if (avc_has_perm(&selinux_state,
5988 SECCLASS_NODE, NODE__SENDTO, &ad))
5989 return NF_DROP_ERR(-ECONNREFUSED);
5995 static unsigned int selinux_ipv4_postroute(void *priv,
5996 struct sk_buff *skb,
5997 const struct nf_hook_state *state)
5999 return selinux_ip_postroute(skb, state->out, PF_INET);
6002 #if IS_ENABLED(CONFIG_IPV6)
6003 static unsigned int selinux_ipv6_postroute(void *priv,
6004 struct sk_buff *skb,
6005 const struct nf_hook_state *state)
6007 return selinux_ip_postroute(skb, state->out, PF_INET6);
6011 #endif /* CONFIG_NETFILTER */
6013 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
6016 unsigned int msg_len;
6017 unsigned int data_len = skb->len;
6018 unsigned char *data = skb->data;
6019 struct nlmsghdr *nlh;
6020 struct sk_security_struct *sksec = sk->sk_security;
6021 u16 sclass = sksec->sclass;
6024 while (data_len >= nlmsg_total_size(0)) {
6025 nlh = (struct nlmsghdr *)data;
6027 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
6028 * users which means we can't reject skb's with bogus
6029 * length fields; our solution is to follow what
6030 * netlink_rcv_skb() does and simply skip processing at
6031 * messages with length fields that are clearly junk
6033 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
6036 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
6038 rc = sock_has_perm(sk, perm);
6041 } else if (rc == -EINVAL) {
6042 /* -EINVAL is a missing msg/perm mapping */
6043 pr_warn_ratelimited("SELinux: unrecognized netlink"
6044 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
6045 " pid=%d comm=%s\n",
6046 sk->sk_protocol, nlh->nlmsg_type,
6047 secclass_map[sclass - 1].name,
6048 task_pid_nr(current), current->comm);
6049 if (enforcing_enabled(&selinux_state) &&
6050 !security_get_allow_unknown(&selinux_state))
6053 } else if (rc == -ENOENT) {
6054 /* -ENOENT is a missing socket/class mapping, ignore */
6060 /* move to the next message after applying netlink padding */
6061 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
6062 if (msg_len >= data_len)
6064 data_len -= msg_len;
6071 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
6073 isec->sclass = sclass;
6074 isec->sid = current_sid();
6077 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6080 struct ipc_security_struct *isec;
6081 struct common_audit_data ad;
6082 u32 sid = current_sid();
6084 isec = selinux_ipc(ipc_perms);
6086 ad.type = LSM_AUDIT_DATA_IPC;
6087 ad.u.ipc_id = ipc_perms->key;
6089 return avc_has_perm(&selinux_state,
6090 sid, isec->sid, isec->sclass, perms, &ad);
6093 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6095 struct msg_security_struct *msec;
6097 msec = selinux_msg_msg(msg);
6098 msec->sid = SECINITSID_UNLABELED;
6103 /* message queue security operations */
6104 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6106 struct ipc_security_struct *isec;
6107 struct common_audit_data ad;
6108 u32 sid = current_sid();
6111 isec = selinux_ipc(msq);
6112 ipc_init_security(isec, SECCLASS_MSGQ);
6114 ad.type = LSM_AUDIT_DATA_IPC;
6115 ad.u.ipc_id = msq->key;
6117 rc = avc_has_perm(&selinux_state,
6118 sid, isec->sid, SECCLASS_MSGQ,
6123 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6125 struct ipc_security_struct *isec;
6126 struct common_audit_data ad;
6127 u32 sid = current_sid();
6129 isec = selinux_ipc(msq);
6131 ad.type = LSM_AUDIT_DATA_IPC;
6132 ad.u.ipc_id = msq->key;
6134 return avc_has_perm(&selinux_state,
6135 sid, isec->sid, SECCLASS_MSGQ,
6136 MSGQ__ASSOCIATE, &ad);
6139 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6147 /* No specific object, just general system-wide information. */
6148 return avc_has_perm(&selinux_state,
6149 current_sid(), SECINITSID_KERNEL,
6150 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6154 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6157 perms = MSGQ__SETATTR;
6160 perms = MSGQ__DESTROY;
6166 err = ipc_has_perm(msq, perms);
6170 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6172 struct ipc_security_struct *isec;
6173 struct msg_security_struct *msec;
6174 struct common_audit_data ad;
6175 u32 sid = current_sid();
6178 isec = selinux_ipc(msq);
6179 msec = selinux_msg_msg(msg);
6182 * First time through, need to assign label to the message
6184 if (msec->sid == SECINITSID_UNLABELED) {
6186 * Compute new sid based on current process and
6187 * message queue this message will be stored in
6189 rc = security_transition_sid(&selinux_state, sid, isec->sid,
6190 SECCLASS_MSG, NULL, &msec->sid);
6195 ad.type = LSM_AUDIT_DATA_IPC;
6196 ad.u.ipc_id = msq->key;
6198 /* Can this process write to the queue? */
6199 rc = avc_has_perm(&selinux_state,
6200 sid, isec->sid, SECCLASS_MSGQ,
6203 /* Can this process send the message */
6204 rc = avc_has_perm(&selinux_state,
6205 sid, msec->sid, SECCLASS_MSG,
6208 /* Can the message be put in the queue? */
6209 rc = avc_has_perm(&selinux_state,
6210 msec->sid, isec->sid, SECCLASS_MSGQ,
6211 MSGQ__ENQUEUE, &ad);
6216 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6217 struct task_struct *target,
6218 long type, int mode)
6220 struct ipc_security_struct *isec;
6221 struct msg_security_struct *msec;
6222 struct common_audit_data ad;
6223 u32 sid = task_sid_subj(target);
6226 isec = selinux_ipc(msq);
6227 msec = selinux_msg_msg(msg);
6229 ad.type = LSM_AUDIT_DATA_IPC;
6230 ad.u.ipc_id = msq->key;
6232 rc = avc_has_perm(&selinux_state,
6234 SECCLASS_MSGQ, MSGQ__READ, &ad);
6236 rc = avc_has_perm(&selinux_state,
6238 SECCLASS_MSG, MSG__RECEIVE, &ad);
6242 /* Shared Memory security operations */
6243 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6245 struct ipc_security_struct *isec;
6246 struct common_audit_data ad;
6247 u32 sid = current_sid();
6250 isec = selinux_ipc(shp);
6251 ipc_init_security(isec, SECCLASS_SHM);
6253 ad.type = LSM_AUDIT_DATA_IPC;
6254 ad.u.ipc_id = shp->key;
6256 rc = avc_has_perm(&selinux_state,
6257 sid, isec->sid, SECCLASS_SHM,
6262 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6264 struct ipc_security_struct *isec;
6265 struct common_audit_data ad;
6266 u32 sid = current_sid();
6268 isec = selinux_ipc(shp);
6270 ad.type = LSM_AUDIT_DATA_IPC;
6271 ad.u.ipc_id = shp->key;
6273 return avc_has_perm(&selinux_state,
6274 sid, isec->sid, SECCLASS_SHM,
6275 SHM__ASSOCIATE, &ad);
6278 /* Note, at this point, shp is locked down */
6279 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6287 /* No specific object, just general system-wide information. */
6288 return avc_has_perm(&selinux_state,
6289 current_sid(), SECINITSID_KERNEL,
6290 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6294 perms = SHM__GETATTR | SHM__ASSOCIATE;
6297 perms = SHM__SETATTR;
6304 perms = SHM__DESTROY;
6310 err = ipc_has_perm(shp, perms);
6314 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6315 char __user *shmaddr, int shmflg)
6319 if (shmflg & SHM_RDONLY)
6322 perms = SHM__READ | SHM__WRITE;
6324 return ipc_has_perm(shp, perms);
6327 /* Semaphore security operations */
6328 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6330 struct ipc_security_struct *isec;
6331 struct common_audit_data ad;
6332 u32 sid = current_sid();
6335 isec = selinux_ipc(sma);
6336 ipc_init_security(isec, SECCLASS_SEM);
6338 ad.type = LSM_AUDIT_DATA_IPC;
6339 ad.u.ipc_id = sma->key;
6341 rc = avc_has_perm(&selinux_state,
6342 sid, isec->sid, SECCLASS_SEM,
6347 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6349 struct ipc_security_struct *isec;
6350 struct common_audit_data ad;
6351 u32 sid = current_sid();
6353 isec = selinux_ipc(sma);
6355 ad.type = LSM_AUDIT_DATA_IPC;
6356 ad.u.ipc_id = sma->key;
6358 return avc_has_perm(&selinux_state,
6359 sid, isec->sid, SECCLASS_SEM,
6360 SEM__ASSOCIATE, &ad);
6363 /* Note, at this point, sma is locked down */
6364 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6372 /* No specific object, just general system-wide information. */
6373 return avc_has_perm(&selinux_state,
6374 current_sid(), SECINITSID_KERNEL,
6375 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6379 perms = SEM__GETATTR;
6390 perms = SEM__DESTROY;
6393 perms = SEM__SETATTR;
6398 perms = SEM__GETATTR | SEM__ASSOCIATE;
6404 err = ipc_has_perm(sma, perms);
6408 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6409 struct sembuf *sops, unsigned nsops, int alter)
6414 perms = SEM__READ | SEM__WRITE;
6418 return ipc_has_perm(sma, perms);
6421 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6427 av |= IPC__UNIX_READ;
6429 av |= IPC__UNIX_WRITE;
6434 return ipc_has_perm(ipcp, av);
6437 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6439 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6443 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6446 inode_doinit_with_dentry(inode, dentry);
6449 static int selinux_getprocattr(struct task_struct *p,
6450 char *name, char **value)
6452 const struct task_security_struct *__tsec;
6458 __tsec = selinux_cred(__task_cred(p));
6461 error = avc_has_perm(&selinux_state,
6462 current_sid(), __tsec->sid,
6463 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6468 if (!strcmp(name, "current"))
6470 else if (!strcmp(name, "prev"))
6472 else if (!strcmp(name, "exec"))
6473 sid = __tsec->exec_sid;
6474 else if (!strcmp(name, "fscreate"))
6475 sid = __tsec->create_sid;
6476 else if (!strcmp(name, "keycreate"))
6477 sid = __tsec->keycreate_sid;
6478 else if (!strcmp(name, "sockcreate"))
6479 sid = __tsec->sockcreate_sid;
6489 error = security_sid_to_context(&selinux_state, sid, value, &len);
6499 static int selinux_setprocattr(const char *name, void *value, size_t size)
6501 struct task_security_struct *tsec;
6503 u32 mysid = current_sid(), sid = 0, ptsid;
6508 * Basic control over ability to set these attributes at all.
6510 if (!strcmp(name, "exec"))
6511 error = avc_has_perm(&selinux_state,
6512 mysid, mysid, SECCLASS_PROCESS,
6513 PROCESS__SETEXEC, NULL);
6514 else if (!strcmp(name, "fscreate"))
6515 error = avc_has_perm(&selinux_state,
6516 mysid, mysid, SECCLASS_PROCESS,
6517 PROCESS__SETFSCREATE, NULL);
6518 else if (!strcmp(name, "keycreate"))
6519 error = avc_has_perm(&selinux_state,
6520 mysid, mysid, SECCLASS_PROCESS,
6521 PROCESS__SETKEYCREATE, NULL);
6522 else if (!strcmp(name, "sockcreate"))
6523 error = avc_has_perm(&selinux_state,
6524 mysid, mysid, SECCLASS_PROCESS,
6525 PROCESS__SETSOCKCREATE, NULL);
6526 else if (!strcmp(name, "current"))
6527 error = avc_has_perm(&selinux_state,
6528 mysid, mysid, SECCLASS_PROCESS,
6529 PROCESS__SETCURRENT, NULL);
6535 /* Obtain a SID for the context, if one was specified. */
6536 if (size && str[0] && str[0] != '\n') {
6537 if (str[size-1] == '\n') {
6541 error = security_context_to_sid(&selinux_state, value, size,
6543 if (error == -EINVAL && !strcmp(name, "fscreate")) {
6544 if (!has_cap_mac_admin(true)) {
6545 struct audit_buffer *ab;
6548 /* We strip a nul only if it is at the end, otherwise the
6549 * context contains a nul and we should audit that */
6550 if (str[size - 1] == '\0')
6551 audit_size = size - 1;
6554 ab = audit_log_start(audit_context(),
6559 audit_log_format(ab, "op=fscreate invalid_context=");
6560 audit_log_n_untrustedstring(ab, value, audit_size);
6565 error = security_context_to_sid_force(
6573 new = prepare_creds();
6577 /* Permission checking based on the specified context is
6578 performed during the actual operation (execve,
6579 open/mkdir/...), when we know the full context of the
6580 operation. See selinux_bprm_creds_for_exec for the execve
6581 checks and may_create for the file creation checks. The
6582 operation will then fail if the context is not permitted. */
6583 tsec = selinux_cred(new);
6584 if (!strcmp(name, "exec")) {
6585 tsec->exec_sid = sid;
6586 } else if (!strcmp(name, "fscreate")) {
6587 tsec->create_sid = sid;
6588 } else if (!strcmp(name, "keycreate")) {
6590 error = avc_has_perm(&selinux_state, mysid, sid,
6591 SECCLASS_KEY, KEY__CREATE, NULL);
6595 tsec->keycreate_sid = sid;
6596 } else if (!strcmp(name, "sockcreate")) {
6597 tsec->sockcreate_sid = sid;
6598 } else if (!strcmp(name, "current")) {
6603 /* Only allow single threaded processes to change context */
6605 if (!current_is_single_threaded()) {
6606 error = security_bounded_transition(&selinux_state,
6612 /* Check permissions for the transition. */
6613 error = avc_has_perm(&selinux_state,
6614 tsec->sid, sid, SECCLASS_PROCESS,
6615 PROCESS__DYNTRANSITION, NULL);
6619 /* Check for ptracing, and update the task SID if ok.
6620 Otherwise, leave SID unchanged and fail. */
6621 ptsid = ptrace_parent_sid();
6623 error = avc_has_perm(&selinux_state,
6624 ptsid, sid, SECCLASS_PROCESS,
6625 PROCESS__PTRACE, NULL);
6644 static int selinux_ismaclabel(const char *name)
6646 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6649 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6651 return security_sid_to_context(&selinux_state, secid,
6655 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6657 return security_context_to_sid(&selinux_state, secdata, seclen,
6661 static void selinux_release_secctx(char *secdata, u32 seclen)
6666 static void selinux_inode_invalidate_secctx(struct inode *inode)
6668 struct inode_security_struct *isec = selinux_inode(inode);
6670 spin_lock(&isec->lock);
6671 isec->initialized = LABEL_INVALID;
6672 spin_unlock(&isec->lock);
6676 * called with inode->i_mutex locked
6678 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6680 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6682 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6683 return rc == -EOPNOTSUPP ? 0 : rc;
6687 * called with inode->i_mutex locked
6689 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6691 return __vfs_setxattr_noperm(&init_user_ns, dentry, XATTR_NAME_SELINUX,
6695 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6698 len = selinux_inode_getsecurity(&init_user_ns, inode,
6699 XATTR_SELINUX_SUFFIX, ctx, true);
6707 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6708 unsigned long flags)
6710 const struct task_security_struct *tsec;
6711 struct key_security_struct *ksec;
6713 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6717 tsec = selinux_cred(cred);
6718 if (tsec->keycreate_sid)
6719 ksec->sid = tsec->keycreate_sid;
6721 ksec->sid = tsec->sid;
6727 static void selinux_key_free(struct key *k)
6729 struct key_security_struct *ksec = k->security;
6735 static int selinux_key_permission(key_ref_t key_ref,
6736 const struct cred *cred,
6737 enum key_need_perm need_perm)
6740 struct key_security_struct *ksec;
6743 switch (need_perm) {
6750 case KEY_NEED_WRITE:
6753 case KEY_NEED_SEARCH:
6759 case KEY_NEED_SETATTR:
6760 perm = KEY__SETATTR;
6762 case KEY_NEED_UNLINK:
6763 case KEY_SYSADMIN_OVERRIDE:
6764 case KEY_AUTHTOKEN_OVERRIDE:
6765 case KEY_DEFER_PERM_CHECK:
6773 sid = cred_sid(cred);
6774 key = key_ref_to_ptr(key_ref);
6775 ksec = key->security;
6777 return avc_has_perm(&selinux_state,
6778 sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6781 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6783 struct key_security_struct *ksec = key->security;
6784 char *context = NULL;
6788 rc = security_sid_to_context(&selinux_state, ksec->sid,
6796 #ifdef CONFIG_KEY_NOTIFICATIONS
6797 static int selinux_watch_key(struct key *key)
6799 struct key_security_struct *ksec = key->security;
6800 u32 sid = current_sid();
6802 return avc_has_perm(&selinux_state,
6803 sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6808 #ifdef CONFIG_SECURITY_INFINIBAND
6809 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6811 struct common_audit_data ad;
6814 struct ib_security_struct *sec = ib_sec;
6815 struct lsm_ibpkey_audit ibpkey;
6817 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6821 ad.type = LSM_AUDIT_DATA_IBPKEY;
6822 ibpkey.subnet_prefix = subnet_prefix;
6823 ibpkey.pkey = pkey_val;
6824 ad.u.ibpkey = &ibpkey;
6825 return avc_has_perm(&selinux_state,
6827 SECCLASS_INFINIBAND_PKEY,
6828 INFINIBAND_PKEY__ACCESS, &ad);
6831 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6834 struct common_audit_data ad;
6837 struct ib_security_struct *sec = ib_sec;
6838 struct lsm_ibendport_audit ibendport;
6840 err = security_ib_endport_sid(&selinux_state, dev_name, port_num,
6846 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6847 ibendport.dev_name = dev_name;
6848 ibendport.port = port_num;
6849 ad.u.ibendport = &ibendport;
6850 return avc_has_perm(&selinux_state,
6852 SECCLASS_INFINIBAND_ENDPORT,
6853 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6856 static int selinux_ib_alloc_security(void **ib_sec)
6858 struct ib_security_struct *sec;
6860 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6863 sec->sid = current_sid();
6869 static void selinux_ib_free_security(void *ib_sec)
6875 #ifdef CONFIG_BPF_SYSCALL
6876 static int selinux_bpf(int cmd, union bpf_attr *attr,
6879 u32 sid = current_sid();
6883 case BPF_MAP_CREATE:
6884 ret = avc_has_perm(&selinux_state,
6885 sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6889 ret = avc_has_perm(&selinux_state,
6890 sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6901 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6905 if (fmode & FMODE_READ)
6906 av |= BPF__MAP_READ;
6907 if (fmode & FMODE_WRITE)
6908 av |= BPF__MAP_WRITE;
6912 /* This function will check the file pass through unix socket or binder to see
6913 * if it is a bpf related object. And apply correspinding checks on the bpf
6914 * object based on the type. The bpf maps and programs, not like other files and
6915 * socket, are using a shared anonymous inode inside the kernel as their inode.
6916 * So checking that inode cannot identify if the process have privilege to
6917 * access the bpf object and that's why we have to add this additional check in
6918 * selinux_file_receive and selinux_binder_transfer_files.
6920 static int bpf_fd_pass(struct file *file, u32 sid)
6922 struct bpf_security_struct *bpfsec;
6923 struct bpf_prog *prog;
6924 struct bpf_map *map;
6927 if (file->f_op == &bpf_map_fops) {
6928 map = file->private_data;
6929 bpfsec = map->security;
6930 ret = avc_has_perm(&selinux_state,
6931 sid, bpfsec->sid, SECCLASS_BPF,
6932 bpf_map_fmode_to_av(file->f_mode), NULL);
6935 } else if (file->f_op == &bpf_prog_fops) {
6936 prog = file->private_data;
6937 bpfsec = prog->aux->security;
6938 ret = avc_has_perm(&selinux_state,
6939 sid, bpfsec->sid, SECCLASS_BPF,
6940 BPF__PROG_RUN, NULL);
6947 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6949 u32 sid = current_sid();
6950 struct bpf_security_struct *bpfsec;
6952 bpfsec = map->security;
6953 return avc_has_perm(&selinux_state,
6954 sid, bpfsec->sid, SECCLASS_BPF,
6955 bpf_map_fmode_to_av(fmode), NULL);
6958 static int selinux_bpf_prog(struct bpf_prog *prog)
6960 u32 sid = current_sid();
6961 struct bpf_security_struct *bpfsec;
6963 bpfsec = prog->aux->security;
6964 return avc_has_perm(&selinux_state,
6965 sid, bpfsec->sid, SECCLASS_BPF,
6966 BPF__PROG_RUN, NULL);
6969 static int selinux_bpf_map_alloc(struct bpf_map *map)
6971 struct bpf_security_struct *bpfsec;
6973 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6977 bpfsec->sid = current_sid();
6978 map->security = bpfsec;
6983 static void selinux_bpf_map_free(struct bpf_map *map)
6985 struct bpf_security_struct *bpfsec = map->security;
6987 map->security = NULL;
6991 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6993 struct bpf_security_struct *bpfsec;
6995 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6999 bpfsec->sid = current_sid();
7000 aux->security = bpfsec;
7005 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
7007 struct bpf_security_struct *bpfsec = aux->security;
7009 aux->security = NULL;
7014 static int selinux_lockdown(enum lockdown_reason what)
7016 struct common_audit_data ad;
7017 u32 sid = current_sid();
7018 int invalid_reason = (what <= LOCKDOWN_NONE) ||
7019 (what == LOCKDOWN_INTEGRITY_MAX) ||
7020 (what >= LOCKDOWN_CONFIDENTIALITY_MAX);
7022 if (WARN(invalid_reason, "Invalid lockdown reason")) {
7023 audit_log(audit_context(),
7024 GFP_ATOMIC, AUDIT_SELINUX_ERR,
7025 "lockdown_reason=invalid");
7029 ad.type = LSM_AUDIT_DATA_LOCKDOWN;
7032 if (what <= LOCKDOWN_INTEGRITY_MAX)
7033 return avc_has_perm(&selinux_state,
7034 sid, sid, SECCLASS_LOCKDOWN,
7035 LOCKDOWN__INTEGRITY, &ad);
7037 return avc_has_perm(&selinux_state,
7038 sid, sid, SECCLASS_LOCKDOWN,
7039 LOCKDOWN__CONFIDENTIALITY, &ad);
7042 struct lsm_blob_sizes selinux_blob_sizes __lsm_ro_after_init = {
7043 .lbs_cred = sizeof(struct task_security_struct),
7044 .lbs_file = sizeof(struct file_security_struct),
7045 .lbs_inode = sizeof(struct inode_security_struct),
7046 .lbs_ipc = sizeof(struct ipc_security_struct),
7047 .lbs_msg_msg = sizeof(struct msg_security_struct),
7048 .lbs_superblock = sizeof(struct superblock_security_struct),
7051 #ifdef CONFIG_PERF_EVENTS
7052 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
7054 u32 requested, sid = current_sid();
7056 if (type == PERF_SECURITY_OPEN)
7057 requested = PERF_EVENT__OPEN;
7058 else if (type == PERF_SECURITY_CPU)
7059 requested = PERF_EVENT__CPU;
7060 else if (type == PERF_SECURITY_KERNEL)
7061 requested = PERF_EVENT__KERNEL;
7062 else if (type == PERF_SECURITY_TRACEPOINT)
7063 requested = PERF_EVENT__TRACEPOINT;
7067 return avc_has_perm(&selinux_state, sid, sid, SECCLASS_PERF_EVENT,
7071 static int selinux_perf_event_alloc(struct perf_event *event)
7073 struct perf_event_security_struct *perfsec;
7075 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7079 perfsec->sid = current_sid();
7080 event->security = perfsec;
7085 static void selinux_perf_event_free(struct perf_event *event)
7087 struct perf_event_security_struct *perfsec = event->security;
7089 event->security = NULL;
7093 static int selinux_perf_event_read(struct perf_event *event)
7095 struct perf_event_security_struct *perfsec = event->security;
7096 u32 sid = current_sid();
7098 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7099 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7102 static int selinux_perf_event_write(struct perf_event *event)
7104 struct perf_event_security_struct *perfsec = event->security;
7105 u32 sid = current_sid();
7107 return avc_has_perm(&selinux_state, sid, perfsec->sid,
7108 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7113 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7114 * 1. any hooks that don't belong to (2.) or (3.) below,
7115 * 2. hooks that both access structures allocated by other hooks, and allocate
7116 * structures that can be later accessed by other hooks (mostly "cloning"
7118 * 3. hooks that only allocate structures that can be later accessed by other
7119 * hooks ("allocating" hooks).
7121 * Please follow block comment delimiters in the list to keep this order.
7123 * This ordering is needed for SELinux runtime disable to work at least somewhat
7124 * safely. Breaking the ordering rules above might lead to NULL pointer derefs
7125 * when disabling SELinux at runtime.
7127 static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
7128 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7129 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7130 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7131 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7133 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7134 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7135 LSM_HOOK_INIT(capget, selinux_capget),
7136 LSM_HOOK_INIT(capset, selinux_capset),
7137 LSM_HOOK_INIT(capable, selinux_capable),
7138 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7139 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7140 LSM_HOOK_INIT(syslog, selinux_syslog),
7141 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7143 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7145 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7146 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7147 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7149 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7150 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7151 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7152 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7153 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7154 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7155 LSM_HOOK_INIT(sb_mount, selinux_mount),
7156 LSM_HOOK_INIT(sb_umount, selinux_umount),
7157 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7158 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7160 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7162 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7163 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7165 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7166 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7167 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7168 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7169 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7170 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7171 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7172 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7173 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7174 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7175 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7176 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7177 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7178 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7179 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7180 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7181 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7182 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7183 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7184 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7185 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7186 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7187 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7188 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7189 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7190 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7191 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7192 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7194 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7196 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7197 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7198 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7199 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7200 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7201 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7202 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7203 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7204 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7205 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7206 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7208 LSM_HOOK_INIT(file_open, selinux_file_open),
7210 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7211 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7212 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7213 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7214 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7215 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7216 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7217 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7218 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7219 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7220 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7221 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7222 LSM_HOOK_INIT(task_getsecid_subj, selinux_task_getsecid_subj),
7223 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7224 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7225 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7226 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7227 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7228 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7229 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7230 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7231 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7232 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7233 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7235 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7236 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7238 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7239 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7240 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7241 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7243 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7244 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7245 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7247 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7248 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7249 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7251 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7253 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7254 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7256 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7257 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7258 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7259 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7260 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7261 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7263 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7264 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7266 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7267 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7268 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7269 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7270 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7271 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7272 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7273 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7274 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7275 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7276 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7277 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7278 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7279 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7280 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7281 LSM_HOOK_INIT(socket_getpeersec_stream,
7282 selinux_socket_getpeersec_stream),
7283 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7284 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7285 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7286 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7287 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7288 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7289 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7290 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7291 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7292 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7293 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7294 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7295 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7296 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7297 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7298 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7299 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7300 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7301 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7302 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7303 #ifdef CONFIG_SECURITY_INFINIBAND
7304 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7305 LSM_HOOK_INIT(ib_endport_manage_subnet,
7306 selinux_ib_endport_manage_subnet),
7307 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7309 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7310 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7311 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7312 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7313 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7314 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7315 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7316 selinux_xfrm_state_pol_flow_match),
7317 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7321 LSM_HOOK_INIT(key_free, selinux_key_free),
7322 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7323 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7324 #ifdef CONFIG_KEY_NOTIFICATIONS
7325 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7330 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7331 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7332 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7335 #ifdef CONFIG_BPF_SYSCALL
7336 LSM_HOOK_INIT(bpf, selinux_bpf),
7337 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7338 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7339 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7340 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7343 #ifdef CONFIG_PERF_EVENTS
7344 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7345 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7346 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7347 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7350 LSM_HOOK_INIT(locked_down, selinux_lockdown),
7353 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7355 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7356 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7357 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7358 LSM_HOOK_INIT(sb_add_mnt_opt, selinux_add_mnt_opt),
7359 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7360 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7364 * PUT "ALLOCATING" HOOKS HERE
7366 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7367 LSM_HOOK_INIT(msg_queue_alloc_security,
7368 selinux_msg_queue_alloc_security),
7369 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7370 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7371 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7372 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7373 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7374 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7375 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7376 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7377 #ifdef CONFIG_SECURITY_INFINIBAND
7378 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7380 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7381 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7382 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7383 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7384 selinux_xfrm_state_alloc_acquire),
7387 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7390 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7392 #ifdef CONFIG_BPF_SYSCALL
7393 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7394 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7396 #ifdef CONFIG_PERF_EVENTS
7397 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7401 static __init int selinux_init(void)
7403 pr_info("SELinux: Initializing.\n");
7405 memset(&selinux_state, 0, sizeof(selinux_state));
7406 enforcing_set(&selinux_state, selinux_enforcing_boot);
7407 checkreqprot_set(&selinux_state, selinux_checkreqprot_boot);
7408 selinux_avc_init(&selinux_state.avc);
7409 mutex_init(&selinux_state.status_lock);
7410 mutex_init(&selinux_state.policy_mutex);
7412 /* Set the security state for the initial task. */
7413 cred_init_security();
7415 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7421 ebitmap_cache_init();
7423 hashtab_cache_init();
7425 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks), "selinux");
7427 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7428 panic("SELinux: Unable to register AVC netcache callback\n");
7430 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7431 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7433 if (selinux_enforcing_boot)
7434 pr_debug("SELinux: Starting in enforcing mode\n");
7436 pr_debug("SELinux: Starting in permissive mode\n");
7438 fs_validate_description("selinux", selinux_fs_parameters);
7443 static void delayed_superblock_init(struct super_block *sb, void *unused)
7445 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7448 void selinux_complete_init(void)
7450 pr_debug("SELinux: Completing initialization.\n");
7452 /* Set up any superblocks initialized prior to the policy load. */
7453 pr_debug("SELinux: Setting up existing superblocks.\n");
7454 iterate_supers(delayed_superblock_init, NULL);
7457 /* SELinux requires early initialization in order to label
7458 all processes and objects when they are created. */
7459 DEFINE_LSM(selinux) = {
7461 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7462 .enabled = &selinux_enabled_boot,
7463 .blobs = &selinux_blob_sizes,
7464 .init = selinux_init,
7467 #if defined(CONFIG_NETFILTER)
7469 static const struct nf_hook_ops selinux_nf_ops[] = {
7471 .hook = selinux_ipv4_postroute,
7473 .hooknum = NF_INET_POST_ROUTING,
7474 .priority = NF_IP_PRI_SELINUX_LAST,
7477 .hook = selinux_ipv4_forward,
7479 .hooknum = NF_INET_FORWARD,
7480 .priority = NF_IP_PRI_SELINUX_FIRST,
7483 .hook = selinux_ipv4_output,
7485 .hooknum = NF_INET_LOCAL_OUT,
7486 .priority = NF_IP_PRI_SELINUX_FIRST,
7488 #if IS_ENABLED(CONFIG_IPV6)
7490 .hook = selinux_ipv6_postroute,
7492 .hooknum = NF_INET_POST_ROUTING,
7493 .priority = NF_IP6_PRI_SELINUX_LAST,
7496 .hook = selinux_ipv6_forward,
7498 .hooknum = NF_INET_FORWARD,
7499 .priority = NF_IP6_PRI_SELINUX_FIRST,
7502 .hook = selinux_ipv6_output,
7504 .hooknum = NF_INET_LOCAL_OUT,
7505 .priority = NF_IP6_PRI_SELINUX_FIRST,
7510 static int __net_init selinux_nf_register(struct net *net)
7512 return nf_register_net_hooks(net, selinux_nf_ops,
7513 ARRAY_SIZE(selinux_nf_ops));
7516 static void __net_exit selinux_nf_unregister(struct net *net)
7518 nf_unregister_net_hooks(net, selinux_nf_ops,
7519 ARRAY_SIZE(selinux_nf_ops));
7522 static struct pernet_operations selinux_net_ops = {
7523 .init = selinux_nf_register,
7524 .exit = selinux_nf_unregister,
7527 static int __init selinux_nf_ip_init(void)
7531 if (!selinux_enabled_boot)
7534 pr_debug("SELinux: Registering netfilter hooks\n");
7536 err = register_pernet_subsys(&selinux_net_ops);
7538 panic("SELinux: register_pernet_subsys: error %d\n", err);
7542 __initcall(selinux_nf_ip_init);
7544 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7545 static void selinux_nf_ip_exit(void)
7547 pr_debug("SELinux: Unregistering netfilter hooks\n");
7549 unregister_pernet_subsys(&selinux_net_ops);
7553 #else /* CONFIG_NETFILTER */
7555 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7556 #define selinux_nf_ip_exit()
7559 #endif /* CONFIG_NETFILTER */
7561 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
7562 int selinux_disable(struct selinux_state *state)
7564 if (selinux_initialized(state)) {
7565 /* Not permitted after initial policy load. */
7569 if (selinux_disabled(state)) {
7570 /* Only do this once. */
7574 selinux_mark_disabled(state);
7576 pr_info("SELinux: Disabled at runtime.\n");
7579 * Unregister netfilter hooks.
7580 * Must be done before security_delete_hooks() to avoid breaking
7583 selinux_nf_ip_exit();
7585 security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
7587 /* Try to destroy the avc node cache */
7590 /* Unregister selinuxfs. */