1 // SPDX-License-Identifier: GPL-2.0-only
3 * Security-Enhanced Linux (SELinux) security module
5 * This file contains the SELinux hook function implementations.
7 * Authors: Stephen Smalley, <stephen.smalley.work@gmail.com>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
24 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/errno.h>
29 #include <linux/sched/signal.h>
30 #include <linux/sched/task.h>
31 #include <linux/lsm_hooks.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/proc_fs.h>
40 #include <linux/swap.h>
41 #include <linux/spinlock.h>
42 #include <linux/syscalls.h>
43 #include <linux/dcache.h>
44 #include <linux/file.h>
45 #include <linux/fdtable.h>
46 #include <linux/namei.h>
47 #include <linux/mount.h>
48 #include <linux/fs_context.h>
49 #include <linux/fs_parser.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/sctp.h>
70 #include <net/sctp/structs.h>
71 #include <linux/quota.h>
72 #include <linux/un.h> /* for Unix socket types */
73 #include <net/af_unix.h> /* for Unix socket types */
74 #include <linux/parser.h>
75 #include <linux/nfs_mount.h>
77 #include <linux/hugetlb.h>
78 #include <linux/personality.h>
79 #include <linux/audit.h>
80 #include <linux/string.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88 #include <uapi/linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95 #include <linux/io_uring/cmd.h>
96 #include <uapi/linux/lsm.h>
105 #include "netlabel.h"
109 #define SELINUX_INODE_INIT_XATTRS 1
111 struct selinux_state selinux_state;
113 /* SECMARK reference count */
114 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
116 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
117 static int selinux_enforcing_boot __initdata;
119 static int __init enforcing_setup(char *str)
121 unsigned long enforcing;
122 if (!kstrtoul(str, 0, &enforcing))
123 selinux_enforcing_boot = enforcing ? 1 : 0;
126 __setup("enforcing=", enforcing_setup);
128 #define selinux_enforcing_boot 1
131 int selinux_enabled_boot __initdata = 1;
132 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
133 static int __init selinux_enabled_setup(char *str)
135 unsigned long enabled;
136 if (!kstrtoul(str, 0, &enabled))
137 selinux_enabled_boot = enabled ? 1 : 0;
140 __setup("selinux=", selinux_enabled_setup);
143 static int __init checkreqprot_setup(char *str)
145 unsigned long checkreqprot;
147 if (!kstrtoul(str, 0, &checkreqprot)) {
149 pr_err("SELinux: checkreqprot set to 1 via kernel parameter. This is no longer supported.\n");
153 __setup("checkreqprot=", checkreqprot_setup);
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
166 static int selinux_secmark_enabled(void)
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
182 static int selinux_peerlbl_enabled(void)
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
188 static int selinux_netcache_avc_callback(u32 event)
190 if (event == AVC_CALLBACK_RESET) {
199 static int selinux_lsm_notifier_avc_callback(u32 event)
201 if (event == AVC_CALLBACK_RESET) {
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
210 * initialise the security for the init task
212 static void cred_init_security(void)
214 struct task_security_struct *tsec;
216 tsec = selinux_cred(unrcu_pointer(current->real_cred));
217 tsec->osid = tsec->sid = SECINITSID_KERNEL;
221 * get the security ID of a set of credentials
223 static inline u32 cred_sid(const struct cred *cred)
225 const struct task_security_struct *tsec;
227 tsec = selinux_cred(cred);
231 static void __ad_net_init(struct common_audit_data *ad,
232 struct lsm_network_audit *net,
233 int ifindex, struct sock *sk, u16 family)
235 ad->type = LSM_AUDIT_DATA_NET;
237 net->netif = ifindex;
239 net->family = family;
242 static void ad_net_init_from_sk(struct common_audit_data *ad,
243 struct lsm_network_audit *net,
246 __ad_net_init(ad, net, 0, sk, 0);
249 static void ad_net_init_from_iif(struct common_audit_data *ad,
250 struct lsm_network_audit *net,
251 int ifindex, u16 family)
253 __ad_net_init(ad, net, ifindex, NULL, family);
257 * get the objective security ID of a task
259 static inline u32 task_sid_obj(const struct task_struct *task)
264 sid = cred_sid(__task_cred(task));
269 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272 * Try reloading inode security labels that have been marked as invalid. The
273 * @may_sleep parameter indicates when sleeping and thus reloading labels is
274 * allowed; when set to false, returns -ECHILD when the label is
275 * invalid. The @dentry parameter should be set to a dentry of the inode.
277 static int __inode_security_revalidate(struct inode *inode,
278 struct dentry *dentry,
281 struct inode_security_struct *isec = selinux_inode(inode);
283 might_sleep_if(may_sleep);
285 if (selinux_initialized() &&
286 isec->initialized != LABEL_INITIALIZED) {
291 * Try reloading the inode security label. This will fail if
292 * @opt_dentry is NULL and no dentry for this inode can be
293 * found; in that case, continue using the old label.
295 inode_doinit_with_dentry(inode, dentry);
300 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
302 return selinux_inode(inode);
305 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309 error = __inode_security_revalidate(inode, NULL, !rcu);
311 return ERR_PTR(error);
312 return selinux_inode(inode);
316 * Get the security label of an inode.
318 static struct inode_security_struct *inode_security(struct inode *inode)
320 __inode_security_revalidate(inode, NULL, true);
321 return selinux_inode(inode);
324 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
326 struct inode *inode = d_backing_inode(dentry);
328 return selinux_inode(inode);
332 * Get the security label of a dentry's backing inode.
334 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
336 struct inode *inode = d_backing_inode(dentry);
338 __inode_security_revalidate(inode, dentry, true);
339 return selinux_inode(inode);
342 static void inode_free_security(struct inode *inode)
344 struct inode_security_struct *isec = selinux_inode(inode);
345 struct superblock_security_struct *sbsec;
349 sbsec = selinux_superblock(inode->i_sb);
351 * As not all inode security structures are in a list, we check for
352 * empty list outside of the lock to make sure that we won't waste
353 * time taking a lock doing nothing.
355 * The list_del_init() function can be safely called more than once.
356 * It should not be possible for this function to be called with
357 * concurrent list_add(), but for better safety against future changes
358 * in the code, we use list_empty_careful() here.
360 if (!list_empty_careful(&isec->list)) {
361 spin_lock(&sbsec->isec_lock);
362 list_del_init(&isec->list);
363 spin_unlock(&sbsec->isec_lock);
367 struct selinux_mnt_opts {
374 static void selinux_free_mnt_opts(void *mnt_opts)
388 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
389 static const struct {
398 A(rootcontext, true),
403 static int match_opt_prefix(char *s, int l, char **arg)
407 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
408 size_t len = tokens[i].len;
409 if (len > l || memcmp(s, tokens[i].name, len))
411 if (tokens[i].has_arg) {
412 if (len == l || s[len] != '=')
417 return tokens[i].opt;
422 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
424 static int may_context_mount_sb_relabel(u32 sid,
425 struct superblock_security_struct *sbsec,
426 const struct cred *cred)
428 const struct task_security_struct *tsec = selinux_cred(cred);
431 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
432 FILESYSTEM__RELABELFROM, NULL);
436 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
437 FILESYSTEM__RELABELTO, NULL);
441 static int may_context_mount_inode_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
445 const struct task_security_struct *tsec = selinux_cred(cred);
447 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
448 FILESYSTEM__RELABELFROM, NULL);
452 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__ASSOCIATE, NULL);
457 static int selinux_is_genfs_special_handling(struct super_block *sb)
459 /* Special handling. Genfs but also in-core setxattr handler */
460 return !strcmp(sb->s_type->name, "sysfs") ||
461 !strcmp(sb->s_type->name, "pstore") ||
462 !strcmp(sb->s_type->name, "debugfs") ||
463 !strcmp(sb->s_type->name, "tracefs") ||
464 !strcmp(sb->s_type->name, "rootfs") ||
465 (selinux_policycap_cgroupseclabel() &&
466 (!strcmp(sb->s_type->name, "cgroup") ||
467 !strcmp(sb->s_type->name, "cgroup2")));
470 static int selinux_is_sblabel_mnt(struct super_block *sb)
472 struct superblock_security_struct *sbsec = selinux_superblock(sb);
475 * IMPORTANT: Double-check logic in this function when adding a new
476 * SECURITY_FS_USE_* definition!
478 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
480 switch (sbsec->behavior) {
481 case SECURITY_FS_USE_XATTR:
482 case SECURITY_FS_USE_TRANS:
483 case SECURITY_FS_USE_TASK:
484 case SECURITY_FS_USE_NATIVE:
487 case SECURITY_FS_USE_GENFS:
488 return selinux_is_genfs_special_handling(sb);
490 /* Never allow relabeling on context mounts */
491 case SECURITY_FS_USE_MNTPOINT:
492 case SECURITY_FS_USE_NONE:
498 static int sb_check_xattr_support(struct super_block *sb)
500 struct superblock_security_struct *sbsec = selinux_superblock(sb);
501 struct dentry *root = sb->s_root;
502 struct inode *root_inode = d_backing_inode(root);
507 * Make sure that the xattr handler exists and that no
508 * error other than -ENODATA is returned by getxattr on
509 * the root directory. -ENODATA is ok, as this may be
510 * the first boot of the SELinux kernel before we have
511 * assigned xattr values to the filesystem.
513 if (!(root_inode->i_opflags & IOP_XATTR)) {
514 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
515 sb->s_id, sb->s_type->name);
519 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
520 if (rc < 0 && rc != -ENODATA) {
521 if (rc == -EOPNOTSUPP) {
522 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
523 sb->s_id, sb->s_type->name);
526 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
527 sb->s_id, sb->s_type->name, -rc);
534 /* No xattr support - try to fallback to genfs if possible. */
535 rc = security_genfs_sid(sb->s_type->name, "/",
540 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
541 sb->s_id, sb->s_type->name);
542 sbsec->behavior = SECURITY_FS_USE_GENFS;
547 static int sb_finish_set_opts(struct super_block *sb)
549 struct superblock_security_struct *sbsec = selinux_superblock(sb);
550 struct dentry *root = sb->s_root;
551 struct inode *root_inode = d_backing_inode(root);
554 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
555 rc = sb_check_xattr_support(sb);
560 sbsec->flags |= SE_SBINITIALIZED;
563 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
564 * leave the flag untouched because sb_clone_mnt_opts might be handing
565 * us a superblock that needs the flag to be cleared.
567 if (selinux_is_sblabel_mnt(sb))
568 sbsec->flags |= SBLABEL_MNT;
570 sbsec->flags &= ~SBLABEL_MNT;
572 /* Initialize the root inode. */
573 rc = inode_doinit_with_dentry(root_inode, root);
575 /* Initialize any other inodes associated with the superblock, e.g.
576 inodes created prior to initial policy load or inodes created
577 during get_sb by a pseudo filesystem that directly
579 spin_lock(&sbsec->isec_lock);
580 while (!list_empty(&sbsec->isec_head)) {
581 struct inode_security_struct *isec =
582 list_first_entry(&sbsec->isec_head,
583 struct inode_security_struct, list);
584 struct inode *inode = isec->inode;
585 list_del_init(&isec->list);
586 spin_unlock(&sbsec->isec_lock);
587 inode = igrab(inode);
589 if (!IS_PRIVATE(inode))
590 inode_doinit_with_dentry(inode, NULL);
593 spin_lock(&sbsec->isec_lock);
595 spin_unlock(&sbsec->isec_lock);
599 static int bad_option(struct superblock_security_struct *sbsec, char flag,
600 u32 old_sid, u32 new_sid)
602 char mnt_flags = sbsec->flags & SE_MNTMASK;
604 /* check if the old mount command had the same options */
605 if (sbsec->flags & SE_SBINITIALIZED)
606 if (!(sbsec->flags & flag) ||
607 (old_sid != new_sid))
610 /* check if we were passed the same options twice,
611 * aka someone passed context=a,context=b
613 if (!(sbsec->flags & SE_SBINITIALIZED))
614 if (mnt_flags & flag)
620 * Allow filesystems with binary mount data to explicitly set mount point
621 * labeling information.
623 static int selinux_set_mnt_opts(struct super_block *sb,
625 unsigned long kern_flags,
626 unsigned long *set_kern_flags)
628 const struct cred *cred = current_cred();
629 struct superblock_security_struct *sbsec = selinux_superblock(sb);
630 struct dentry *root = sb->s_root;
631 struct selinux_mnt_opts *opts = mnt_opts;
632 struct inode_security_struct *root_isec;
633 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
634 u32 defcontext_sid = 0;
638 * Specifying internal flags without providing a place to
639 * place the results is not allowed
641 if (kern_flags && !set_kern_flags)
644 mutex_lock(&sbsec->lock);
646 if (!selinux_initialized()) {
648 /* Defer initialization until selinux_complete_init,
649 after the initial policy is loaded and the security
650 server is ready to handle calls. */
651 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
652 sbsec->flags |= SE_SBNATIVE;
653 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
658 pr_warn("SELinux: Unable to set superblock options "
659 "before the security server is initialized\n");
664 * Binary mount data FS will come through this function twice. Once
665 * from an explicit call and once from the generic calls from the vfs.
666 * Since the generic VFS calls will not contain any security mount data
667 * we need to skip the double mount verification.
669 * This does open a hole in which we will not notice if the first
670 * mount using this sb set explicit options and a second mount using
671 * this sb does not set any security options. (The first options
672 * will be used for both mounts)
674 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
678 root_isec = backing_inode_security_novalidate(root);
681 * parse the mount options, check if they are valid sids.
682 * also check if someone is trying to mount the same sb more
683 * than once with different security options.
686 if (opts->fscontext_sid) {
687 fscontext_sid = opts->fscontext_sid;
688 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
690 goto out_double_mount;
691 sbsec->flags |= FSCONTEXT_MNT;
693 if (opts->context_sid) {
694 context_sid = opts->context_sid;
695 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
697 goto out_double_mount;
698 sbsec->flags |= CONTEXT_MNT;
700 if (opts->rootcontext_sid) {
701 rootcontext_sid = opts->rootcontext_sid;
702 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
704 goto out_double_mount;
705 sbsec->flags |= ROOTCONTEXT_MNT;
707 if (opts->defcontext_sid) {
708 defcontext_sid = opts->defcontext_sid;
709 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 goto out_double_mount;
712 sbsec->flags |= DEFCONTEXT_MNT;
716 if (sbsec->flags & SE_SBINITIALIZED) {
717 /* previously mounted with options, but not on this attempt? */
718 if ((sbsec->flags & SE_MNTMASK) && !opts)
719 goto out_double_mount;
724 if (strcmp(sb->s_type->name, "proc") == 0)
725 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
727 if (!strcmp(sb->s_type->name, "debugfs") ||
728 !strcmp(sb->s_type->name, "tracefs") ||
729 !strcmp(sb->s_type->name, "binder") ||
730 !strcmp(sb->s_type->name, "bpf") ||
731 !strcmp(sb->s_type->name, "pstore") ||
732 !strcmp(sb->s_type->name, "securityfs"))
733 sbsec->flags |= SE_SBGENFS;
735 if (!strcmp(sb->s_type->name, "sysfs") ||
736 !strcmp(sb->s_type->name, "cgroup") ||
737 !strcmp(sb->s_type->name, "cgroup2"))
738 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
740 if (!sbsec->behavior) {
742 * Determine the labeling behavior to use for this
745 rc = security_fs_use(sb);
747 pr_warn("%s: security_fs_use(%s) returned %d\n",
748 __func__, sb->s_type->name, rc);
754 * If this is a user namespace mount and the filesystem type is not
755 * explicitly whitelisted, then no contexts are allowed on the command
756 * line and security labels must be ignored.
758 if (sb->s_user_ns != &init_user_ns &&
759 strcmp(sb->s_type->name, "tmpfs") &&
760 strcmp(sb->s_type->name, "ramfs") &&
761 strcmp(sb->s_type->name, "devpts") &&
762 strcmp(sb->s_type->name, "overlay")) {
763 if (context_sid || fscontext_sid || rootcontext_sid ||
768 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
769 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
770 rc = security_transition_sid(current_sid(),
773 &sbsec->mntpoint_sid);
780 /* sets the context of the superblock for the fs being mounted. */
782 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
786 sbsec->sid = fscontext_sid;
790 * Switch to using mount point labeling behavior.
791 * sets the label used on all file below the mountpoint, and will set
792 * the superblock context if not already set.
794 if (sbsec->flags & SE_SBNATIVE) {
796 * This means we are initializing a superblock that has been
797 * mounted before the SELinux was initialized and the
798 * filesystem requested native labeling. We had already
799 * returned SECURITY_LSM_NATIVE_LABELS in *set_kern_flags
800 * in the original mount attempt, so now we just need to set
801 * the SECURITY_FS_USE_NATIVE behavior.
803 sbsec->behavior = SECURITY_FS_USE_NATIVE;
804 } else if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
805 sbsec->behavior = SECURITY_FS_USE_NATIVE;
806 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
810 if (!fscontext_sid) {
811 rc = may_context_mount_sb_relabel(context_sid, sbsec,
815 sbsec->sid = context_sid;
817 rc = may_context_mount_inode_relabel(context_sid, sbsec,
822 if (!rootcontext_sid)
823 rootcontext_sid = context_sid;
825 sbsec->mntpoint_sid = context_sid;
826 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
829 if (rootcontext_sid) {
830 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
835 root_isec->sid = rootcontext_sid;
836 root_isec->initialized = LABEL_INITIALIZED;
839 if (defcontext_sid) {
840 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
841 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
843 pr_warn("SELinux: defcontext option is "
844 "invalid for this filesystem type\n");
848 if (defcontext_sid != sbsec->def_sid) {
849 rc = may_context_mount_inode_relabel(defcontext_sid,
855 sbsec->def_sid = defcontext_sid;
859 rc = sb_finish_set_opts(sb);
861 mutex_unlock(&sbsec->lock);
865 pr_warn("SELinux: mount invalid. Same superblock, different "
866 "security settings for (dev %s, type %s)\n", sb->s_id,
871 static int selinux_cmp_sb_context(const struct super_block *oldsb,
872 const struct super_block *newsb)
874 struct superblock_security_struct *old = selinux_superblock(oldsb);
875 struct superblock_security_struct *new = selinux_superblock(newsb);
876 char oldflags = old->flags & SE_MNTMASK;
877 char newflags = new->flags & SE_MNTMASK;
879 if (oldflags != newflags)
881 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
883 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
885 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
887 if (oldflags & ROOTCONTEXT_MNT) {
888 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
889 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
890 if (oldroot->sid != newroot->sid)
895 pr_warn("SELinux: mount invalid. Same superblock, "
896 "different security settings for (dev %s, "
897 "type %s)\n", newsb->s_id, newsb->s_type->name);
901 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
902 struct super_block *newsb,
903 unsigned long kern_flags,
904 unsigned long *set_kern_flags)
907 const struct superblock_security_struct *oldsbsec =
908 selinux_superblock(oldsb);
909 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
911 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
912 int set_context = (oldsbsec->flags & CONTEXT_MNT);
913 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
916 * Specifying internal flags without providing a place to
917 * place the results is not allowed.
919 if (kern_flags && !set_kern_flags)
922 mutex_lock(&newsbsec->lock);
925 * if the parent was able to be mounted it clearly had no special lsm
926 * mount options. thus we can safely deal with this superblock later
928 if (!selinux_initialized()) {
929 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
930 newsbsec->flags |= SE_SBNATIVE;
931 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
936 /* how can we clone if the old one wasn't set up?? */
937 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
939 /* if fs is reusing a sb, make sure that the contexts match */
940 if (newsbsec->flags & SE_SBINITIALIZED) {
941 mutex_unlock(&newsbsec->lock);
942 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
943 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
944 return selinux_cmp_sb_context(oldsb, newsb);
947 newsbsec->flags = oldsbsec->flags;
949 newsbsec->sid = oldsbsec->sid;
950 newsbsec->def_sid = oldsbsec->def_sid;
951 newsbsec->behavior = oldsbsec->behavior;
953 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
954 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
955 rc = security_fs_use(newsb);
960 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
961 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
962 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
966 u32 sid = oldsbsec->mntpoint_sid;
970 if (!set_rootcontext) {
971 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
974 newsbsec->mntpoint_sid = sid;
976 if (set_rootcontext) {
977 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
980 newisec->sid = oldisec->sid;
983 sb_finish_set_opts(newsb);
985 mutex_unlock(&newsbsec->lock);
990 * NOTE: the caller is responsible for freeing the memory even if on error.
992 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
994 struct selinux_mnt_opts *opts = *mnt_opts;
998 if (token == Opt_seclabel)
999 /* eaten and completely ignored */
1004 if (!selinux_initialized()) {
1005 pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
1010 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1018 if (opts->context_sid || opts->defcontext_sid)
1020 dst_sid = &opts->context_sid;
1023 if (opts->fscontext_sid)
1025 dst_sid = &opts->fscontext_sid;
1027 case Opt_rootcontext:
1028 if (opts->rootcontext_sid)
1030 dst_sid = &opts->rootcontext_sid;
1032 case Opt_defcontext:
1033 if (opts->context_sid || opts->defcontext_sid)
1035 dst_sid = &opts->defcontext_sid;
1041 rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
1043 pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1048 pr_warn(SEL_MOUNT_FAIL_MSG);
1052 static int show_sid(struct seq_file *m, u32 sid)
1054 char *context = NULL;
1058 rc = security_sid_to_context(sid, &context, &len);
1060 bool has_comma = strchr(context, ',');
1065 seq_escape(m, context, "\"\n\\");
1073 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1075 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1078 if (!(sbsec->flags & SE_SBINITIALIZED))
1081 if (!selinux_initialized())
1084 if (sbsec->flags & FSCONTEXT_MNT) {
1086 seq_puts(m, FSCONTEXT_STR);
1087 rc = show_sid(m, sbsec->sid);
1091 if (sbsec->flags & CONTEXT_MNT) {
1093 seq_puts(m, CONTEXT_STR);
1094 rc = show_sid(m, sbsec->mntpoint_sid);
1098 if (sbsec->flags & DEFCONTEXT_MNT) {
1100 seq_puts(m, DEFCONTEXT_STR);
1101 rc = show_sid(m, sbsec->def_sid);
1105 if (sbsec->flags & ROOTCONTEXT_MNT) {
1106 struct dentry *root = sb->s_root;
1107 struct inode_security_struct *isec = backing_inode_security(root);
1109 seq_puts(m, ROOTCONTEXT_STR);
1110 rc = show_sid(m, isec->sid);
1114 if (sbsec->flags & SBLABEL_MNT) {
1116 seq_puts(m, SECLABEL_STR);
1121 static inline u16 inode_mode_to_security_class(umode_t mode)
1123 switch (mode & S_IFMT) {
1125 return SECCLASS_SOCK_FILE;
1127 return SECCLASS_LNK_FILE;
1129 return SECCLASS_FILE;
1131 return SECCLASS_BLK_FILE;
1133 return SECCLASS_DIR;
1135 return SECCLASS_CHR_FILE;
1137 return SECCLASS_FIFO_FILE;
1141 return SECCLASS_FILE;
1144 static inline int default_protocol_stream(int protocol)
1146 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1147 protocol == IPPROTO_MPTCP);
1150 static inline int default_protocol_dgram(int protocol)
1152 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1155 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 bool extsockclass = selinux_policycap_extsockclass();
1163 case SOCK_SEQPACKET:
1164 return SECCLASS_UNIX_STREAM_SOCKET;
1167 return SECCLASS_UNIX_DGRAM_SOCKET;
1174 case SOCK_SEQPACKET:
1175 if (default_protocol_stream(protocol))
1176 return SECCLASS_TCP_SOCKET;
1177 else if (extsockclass && protocol == IPPROTO_SCTP)
1178 return SECCLASS_SCTP_SOCKET;
1180 return SECCLASS_RAWIP_SOCKET;
1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1185 protocol == IPPROTO_ICMPV6))
1186 return SECCLASS_ICMP_SOCKET;
1188 return SECCLASS_RAWIP_SOCKET;
1190 return SECCLASS_DCCP_SOCKET;
1192 return SECCLASS_RAWIP_SOCKET;
1198 return SECCLASS_NETLINK_ROUTE_SOCKET;
1199 case NETLINK_SOCK_DIAG:
1200 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1202 return SECCLASS_NETLINK_NFLOG_SOCKET;
1204 return SECCLASS_NETLINK_XFRM_SOCKET;
1205 case NETLINK_SELINUX:
1206 return SECCLASS_NETLINK_SELINUX_SOCKET;
1208 return SECCLASS_NETLINK_ISCSI_SOCKET;
1210 return SECCLASS_NETLINK_AUDIT_SOCKET;
1211 case NETLINK_FIB_LOOKUP:
1212 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1213 case NETLINK_CONNECTOR:
1214 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1215 case NETLINK_NETFILTER:
1216 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1217 case NETLINK_DNRTMSG:
1218 return SECCLASS_NETLINK_DNRT_SOCKET;
1219 case NETLINK_KOBJECT_UEVENT:
1220 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1221 case NETLINK_GENERIC:
1222 return SECCLASS_NETLINK_GENERIC_SOCKET;
1223 case NETLINK_SCSITRANSPORT:
1224 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1226 return SECCLASS_NETLINK_RDMA_SOCKET;
1227 case NETLINK_CRYPTO:
1228 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1230 return SECCLASS_NETLINK_SOCKET;
1233 return SECCLASS_PACKET_SOCKET;
1235 return SECCLASS_KEY_SOCKET;
1237 return SECCLASS_APPLETALK_SOCKET;
1243 return SECCLASS_AX25_SOCKET;
1245 return SECCLASS_IPX_SOCKET;
1247 return SECCLASS_NETROM_SOCKET;
1249 return SECCLASS_ATMPVC_SOCKET;
1251 return SECCLASS_X25_SOCKET;
1253 return SECCLASS_ROSE_SOCKET;
1255 return SECCLASS_DECNET_SOCKET;
1257 return SECCLASS_ATMSVC_SOCKET;
1259 return SECCLASS_RDS_SOCKET;
1261 return SECCLASS_IRDA_SOCKET;
1263 return SECCLASS_PPPOX_SOCKET;
1265 return SECCLASS_LLC_SOCKET;
1267 return SECCLASS_CAN_SOCKET;
1269 return SECCLASS_TIPC_SOCKET;
1271 return SECCLASS_BLUETOOTH_SOCKET;
1273 return SECCLASS_IUCV_SOCKET;
1275 return SECCLASS_RXRPC_SOCKET;
1277 return SECCLASS_ISDN_SOCKET;
1279 return SECCLASS_PHONET_SOCKET;
1281 return SECCLASS_IEEE802154_SOCKET;
1283 return SECCLASS_CAIF_SOCKET;
1285 return SECCLASS_ALG_SOCKET;
1287 return SECCLASS_NFC_SOCKET;
1289 return SECCLASS_VSOCK_SOCKET;
1291 return SECCLASS_KCM_SOCKET;
1293 return SECCLASS_QIPCRTR_SOCKET;
1295 return SECCLASS_SMC_SOCKET;
1297 return SECCLASS_XDP_SOCKET;
1299 return SECCLASS_MCTP_SOCKET;
1301 #error New address family defined, please update this function.
1306 return SECCLASS_SOCKET;
1309 static int selinux_genfs_get_sid(struct dentry *dentry,
1315 struct super_block *sb = dentry->d_sb;
1316 char *buffer, *path;
1318 buffer = (char *)__get_free_page(GFP_KERNEL);
1322 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1326 if (flags & SE_SBPROC) {
1327 /* each process gets a /proc/PID/ entry. Strip off the
1328 * PID part to get a valid selinux labeling.
1329 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1330 while (path[1] >= '0' && path[1] <= '9') {
1335 rc = security_genfs_sid(sb->s_type->name,
1337 if (rc == -ENOENT) {
1338 /* No match in policy, mark as unlabeled. */
1339 *sid = SECINITSID_UNLABELED;
1343 free_page((unsigned long)buffer);
1347 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1348 u32 def_sid, u32 *sid)
1350 #define INITCONTEXTLEN 255
1355 len = INITCONTEXTLEN;
1356 context = kmalloc(len + 1, GFP_NOFS);
1360 context[len] = '\0';
1361 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1362 if (rc == -ERANGE) {
1365 /* Need a larger buffer. Query for the right size. */
1366 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1371 context = kmalloc(len + 1, GFP_NOFS);
1375 context[len] = '\0';
1376 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1381 if (rc != -ENODATA) {
1382 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1383 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1390 rc = security_context_to_sid_default(context, rc, sid,
1393 char *dev = inode->i_sb->s_id;
1394 unsigned long ino = inode->i_ino;
1396 if (rc == -EINVAL) {
1397 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1400 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1401 __func__, context, -rc, dev, ino);
1408 /* The inode's security attributes must be initialized before first use. */
1409 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1411 struct superblock_security_struct *sbsec = NULL;
1412 struct inode_security_struct *isec = selinux_inode(inode);
1413 u32 task_sid, sid = 0;
1415 struct dentry *dentry;
1418 if (isec->initialized == LABEL_INITIALIZED)
1421 spin_lock(&isec->lock);
1422 if (isec->initialized == LABEL_INITIALIZED)
1425 if (isec->sclass == SECCLASS_FILE)
1426 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1428 sbsec = selinux_superblock(inode->i_sb);
1429 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1430 /* Defer initialization until selinux_complete_init,
1431 after the initial policy is loaded and the security
1432 server is ready to handle calls. */
1433 spin_lock(&sbsec->isec_lock);
1434 if (list_empty(&isec->list))
1435 list_add(&isec->list, &sbsec->isec_head);
1436 spin_unlock(&sbsec->isec_lock);
1440 sclass = isec->sclass;
1441 task_sid = isec->task_sid;
1443 isec->initialized = LABEL_PENDING;
1444 spin_unlock(&isec->lock);
1446 switch (sbsec->behavior) {
1448 * In case of SECURITY_FS_USE_NATIVE we need to re-fetch the labels
1449 * via xattr when called from delayed_superblock_init().
1451 case SECURITY_FS_USE_NATIVE:
1452 case SECURITY_FS_USE_XATTR:
1453 if (!(inode->i_opflags & IOP_XATTR)) {
1454 sid = sbsec->def_sid;
1457 /* Need a dentry, since the xattr API requires one.
1458 Life would be simpler if we could just pass the inode. */
1460 /* Called from d_instantiate or d_splice_alias. */
1461 dentry = dget(opt_dentry);
1464 * Called from selinux_complete_init, try to find a dentry.
1465 * Some filesystems really want a connected one, so try
1466 * that first. We could split SECURITY_FS_USE_XATTR in
1467 * two, depending upon that...
1469 dentry = d_find_alias(inode);
1471 dentry = d_find_any_alias(inode);
1475 * this is can be hit on boot when a file is accessed
1476 * before the policy is loaded. When we load policy we
1477 * may find inodes that have no dentry on the
1478 * sbsec->isec_head list. No reason to complain as these
1479 * will get fixed up the next time we go through
1480 * inode_doinit with a dentry, before these inodes could
1481 * be used again by userspace.
1486 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1492 case SECURITY_FS_USE_TASK:
1495 case SECURITY_FS_USE_TRANS:
1496 /* Default to the fs SID. */
1499 /* Try to obtain a transition SID. */
1500 rc = security_transition_sid(task_sid, sid,
1501 sclass, NULL, &sid);
1505 case SECURITY_FS_USE_MNTPOINT:
1506 sid = sbsec->mntpoint_sid;
1509 /* Default to the fs superblock SID. */
1512 if ((sbsec->flags & SE_SBGENFS) &&
1513 (!S_ISLNK(inode->i_mode) ||
1514 selinux_policycap_genfs_seclabel_symlinks())) {
1515 /* We must have a dentry to determine the label on
1518 /* Called from d_instantiate or
1519 * d_splice_alias. */
1520 dentry = dget(opt_dentry);
1522 /* Called from selinux_complete_init, try to
1523 * find a dentry. Some filesystems really want
1524 * a connected one, so try that first.
1526 dentry = d_find_alias(inode);
1528 dentry = d_find_any_alias(inode);
1531 * This can be hit on boot when a file is accessed
1532 * before the policy is loaded. When we load policy we
1533 * may find inodes that have no dentry on the
1534 * sbsec->isec_head list. No reason to complain as
1535 * these will get fixed up the next time we go through
1536 * inode_doinit() with a dentry, before these inodes
1537 * could be used again by userspace.
1541 rc = selinux_genfs_get_sid(dentry, sclass,
1542 sbsec->flags, &sid);
1548 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1549 (inode->i_opflags & IOP_XATTR)) {
1550 rc = inode_doinit_use_xattr(inode, dentry,
1563 spin_lock(&isec->lock);
1564 if (isec->initialized == LABEL_PENDING) {
1566 isec->initialized = LABEL_INVALID;
1569 isec->initialized = LABEL_INITIALIZED;
1574 spin_unlock(&isec->lock);
1578 spin_lock(&isec->lock);
1579 if (isec->initialized == LABEL_PENDING) {
1580 isec->initialized = LABEL_INVALID;
1583 spin_unlock(&isec->lock);
1587 /* Convert a Linux signal to an access vector. */
1588 static inline u32 signal_to_av(int sig)
1594 /* Commonly granted from child to parent. */
1595 perm = PROCESS__SIGCHLD;
1598 /* Cannot be caught or ignored */
1599 perm = PROCESS__SIGKILL;
1602 /* Cannot be caught or ignored */
1603 perm = PROCESS__SIGSTOP;
1606 /* All other signals. */
1607 perm = PROCESS__SIGNAL;
1614 #if CAP_LAST_CAP > 63
1615 #error Fix SELinux to handle capabilities > 63.
1618 /* Check whether a task is allowed to use a capability. */
1619 static int cred_has_capability(const struct cred *cred,
1620 int cap, unsigned int opts, bool initns)
1622 struct common_audit_data ad;
1623 struct av_decision avd;
1625 u32 sid = cred_sid(cred);
1626 u32 av = CAP_TO_MASK(cap);
1629 ad.type = LSM_AUDIT_DATA_CAP;
1632 switch (CAP_TO_INDEX(cap)) {
1634 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1637 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1640 pr_err("SELinux: out of range capability %d\n", cap);
1645 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1646 if (!(opts & CAP_OPT_NOAUDIT)) {
1647 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1654 /* Check whether a task has a particular permission to an inode.
1655 The 'adp' parameter is optional and allows other audit
1656 data to be passed (e.g. the dentry). */
1657 static int inode_has_perm(const struct cred *cred,
1658 struct inode *inode,
1660 struct common_audit_data *adp)
1662 struct inode_security_struct *isec;
1665 if (unlikely(IS_PRIVATE(inode)))
1668 sid = cred_sid(cred);
1669 isec = selinux_inode(inode);
1671 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1674 /* Same as inode_has_perm, but pass explicit audit data containing
1675 the dentry to help the auditing code to more easily generate the
1676 pathname if needed. */
1677 static inline int dentry_has_perm(const struct cred *cred,
1678 struct dentry *dentry,
1681 struct inode *inode = d_backing_inode(dentry);
1682 struct common_audit_data ad;
1684 ad.type = LSM_AUDIT_DATA_DENTRY;
1685 ad.u.dentry = dentry;
1686 __inode_security_revalidate(inode, dentry, true);
1687 return inode_has_perm(cred, inode, av, &ad);
1690 /* Same as inode_has_perm, but pass explicit audit data containing
1691 the path to help the auditing code to more easily generate the
1692 pathname if needed. */
1693 static inline int path_has_perm(const struct cred *cred,
1694 const struct path *path,
1697 struct inode *inode = d_backing_inode(path->dentry);
1698 struct common_audit_data ad;
1700 ad.type = LSM_AUDIT_DATA_PATH;
1702 __inode_security_revalidate(inode, path->dentry, true);
1703 return inode_has_perm(cred, inode, av, &ad);
1706 /* Same as path_has_perm, but uses the inode from the file struct. */
1707 static inline int file_path_has_perm(const struct cred *cred,
1711 struct common_audit_data ad;
1713 ad.type = LSM_AUDIT_DATA_FILE;
1715 return inode_has_perm(cred, file_inode(file), av, &ad);
1718 #ifdef CONFIG_BPF_SYSCALL
1719 static int bpf_fd_pass(const struct file *file, u32 sid);
1722 /* Check whether a task can use an open file descriptor to
1723 access an inode in a given way. Check access to the
1724 descriptor itself, and then use dentry_has_perm to
1725 check a particular permission to the file.
1726 Access to the descriptor is implicitly granted if it
1727 has the same SID as the process. If av is zero, then
1728 access to the file is not checked, e.g. for cases
1729 where only the descriptor is affected like seek. */
1730 static int file_has_perm(const struct cred *cred,
1734 struct file_security_struct *fsec = selinux_file(file);
1735 struct inode *inode = file_inode(file);
1736 struct common_audit_data ad;
1737 u32 sid = cred_sid(cred);
1740 ad.type = LSM_AUDIT_DATA_FILE;
1743 if (sid != fsec->sid) {
1744 rc = avc_has_perm(sid, fsec->sid,
1752 #ifdef CONFIG_BPF_SYSCALL
1753 rc = bpf_fd_pass(file, cred_sid(cred));
1758 /* av is zero if only checking access to the descriptor. */
1761 rc = inode_has_perm(cred, inode, av, &ad);
1768 * Determine the label for an inode that might be unioned.
1771 selinux_determine_inode_label(const struct task_security_struct *tsec,
1773 const struct qstr *name, u16 tclass,
1776 const struct superblock_security_struct *sbsec =
1777 selinux_superblock(dir->i_sb);
1779 if ((sbsec->flags & SE_SBINITIALIZED) &&
1780 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1781 *_new_isid = sbsec->mntpoint_sid;
1782 } else if ((sbsec->flags & SBLABEL_MNT) &&
1784 *_new_isid = tsec->create_sid;
1786 const struct inode_security_struct *dsec = inode_security(dir);
1787 return security_transition_sid(tsec->sid,
1795 /* Check whether a task can create a file. */
1796 static int may_create(struct inode *dir,
1797 struct dentry *dentry,
1800 const struct task_security_struct *tsec = selinux_cred(current_cred());
1801 struct inode_security_struct *dsec;
1802 struct superblock_security_struct *sbsec;
1804 struct common_audit_data ad;
1807 dsec = inode_security(dir);
1808 sbsec = selinux_superblock(dir->i_sb);
1812 ad.type = LSM_AUDIT_DATA_DENTRY;
1813 ad.u.dentry = dentry;
1815 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1816 DIR__ADD_NAME | DIR__SEARCH,
1821 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1826 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1830 return avc_has_perm(newsid, sbsec->sid,
1831 SECCLASS_FILESYSTEM,
1832 FILESYSTEM__ASSOCIATE, &ad);
1836 #define MAY_UNLINK 1
1839 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1840 static int may_link(struct inode *dir,
1841 struct dentry *dentry,
1845 struct inode_security_struct *dsec, *isec;
1846 struct common_audit_data ad;
1847 u32 sid = current_sid();
1851 dsec = inode_security(dir);
1852 isec = backing_inode_security(dentry);
1854 ad.type = LSM_AUDIT_DATA_DENTRY;
1855 ad.u.dentry = dentry;
1858 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1859 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1874 pr_warn("SELinux: %s: unrecognized kind %d\n",
1879 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1883 static inline int may_rename(struct inode *old_dir,
1884 struct dentry *old_dentry,
1885 struct inode *new_dir,
1886 struct dentry *new_dentry)
1888 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1889 struct common_audit_data ad;
1890 u32 sid = current_sid();
1892 int old_is_dir, new_is_dir;
1895 old_dsec = inode_security(old_dir);
1896 old_isec = backing_inode_security(old_dentry);
1897 old_is_dir = d_is_dir(old_dentry);
1898 new_dsec = inode_security(new_dir);
1900 ad.type = LSM_AUDIT_DATA_DENTRY;
1902 ad.u.dentry = old_dentry;
1903 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1904 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1907 rc = avc_has_perm(sid, old_isec->sid,
1908 old_isec->sclass, FILE__RENAME, &ad);
1911 if (old_is_dir && new_dir != old_dir) {
1912 rc = avc_has_perm(sid, old_isec->sid,
1913 old_isec->sclass, DIR__REPARENT, &ad);
1918 ad.u.dentry = new_dentry;
1919 av = DIR__ADD_NAME | DIR__SEARCH;
1920 if (d_is_positive(new_dentry))
1921 av |= DIR__REMOVE_NAME;
1922 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1925 if (d_is_positive(new_dentry)) {
1926 new_isec = backing_inode_security(new_dentry);
1927 new_is_dir = d_is_dir(new_dentry);
1928 rc = avc_has_perm(sid, new_isec->sid,
1930 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1938 /* Check whether a task can perform a filesystem operation. */
1939 static int superblock_has_perm(const struct cred *cred,
1940 const struct super_block *sb,
1942 struct common_audit_data *ad)
1944 struct superblock_security_struct *sbsec;
1945 u32 sid = cred_sid(cred);
1947 sbsec = selinux_superblock(sb);
1948 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1951 /* Convert a Linux mode and permission mask to an access vector. */
1952 static inline u32 file_mask_to_av(int mode, int mask)
1956 if (!S_ISDIR(mode)) {
1957 if (mask & MAY_EXEC)
1958 av |= FILE__EXECUTE;
1959 if (mask & MAY_READ)
1962 if (mask & MAY_APPEND)
1964 else if (mask & MAY_WRITE)
1968 if (mask & MAY_EXEC)
1970 if (mask & MAY_WRITE)
1972 if (mask & MAY_READ)
1979 /* Convert a Linux file to an access vector. */
1980 static inline u32 file_to_av(const struct file *file)
1984 if (file->f_mode & FMODE_READ)
1986 if (file->f_mode & FMODE_WRITE) {
1987 if (file->f_flags & O_APPEND)
1994 * Special file opened with flags 3 for ioctl-only use.
2003 * Convert a file to an access vector and include the correct
2006 static inline u32 open_file_to_av(struct file *file)
2008 u32 av = file_to_av(file);
2009 struct inode *inode = file_inode(file);
2011 if (selinux_policycap_openperm() &&
2012 inode->i_sb->s_magic != SOCKFS_MAGIC)
2018 /* Hook functions begin here. */
2020 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2022 return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2023 BINDER__SET_CONTEXT_MGR, NULL);
2026 static int selinux_binder_transaction(const struct cred *from,
2027 const struct cred *to)
2029 u32 mysid = current_sid();
2030 u32 fromsid = cred_sid(from);
2031 u32 tosid = cred_sid(to);
2034 if (mysid != fromsid) {
2035 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2036 BINDER__IMPERSONATE, NULL);
2041 return avc_has_perm(fromsid, tosid,
2042 SECCLASS_BINDER, BINDER__CALL, NULL);
2045 static int selinux_binder_transfer_binder(const struct cred *from,
2046 const struct cred *to)
2048 return avc_has_perm(cred_sid(from), cred_sid(to),
2049 SECCLASS_BINDER, BINDER__TRANSFER,
2053 static int selinux_binder_transfer_file(const struct cred *from,
2054 const struct cred *to,
2055 const struct file *file)
2057 u32 sid = cred_sid(to);
2058 struct file_security_struct *fsec = selinux_file(file);
2059 struct dentry *dentry = file->f_path.dentry;
2060 struct inode_security_struct *isec;
2061 struct common_audit_data ad;
2064 ad.type = LSM_AUDIT_DATA_PATH;
2065 ad.u.path = file->f_path;
2067 if (sid != fsec->sid) {
2068 rc = avc_has_perm(sid, fsec->sid,
2076 #ifdef CONFIG_BPF_SYSCALL
2077 rc = bpf_fd_pass(file, sid);
2082 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2085 isec = backing_inode_security(dentry);
2086 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2090 static int selinux_ptrace_access_check(struct task_struct *child,
2093 u32 sid = current_sid();
2094 u32 csid = task_sid_obj(child);
2096 if (mode & PTRACE_MODE_READ)
2097 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
2100 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
2104 static int selinux_ptrace_traceme(struct task_struct *parent)
2106 return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
2107 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2110 static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
2111 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2113 return avc_has_perm(current_sid(), task_sid_obj(target),
2114 SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
2117 static int selinux_capset(struct cred *new, const struct cred *old,
2118 const kernel_cap_t *effective,
2119 const kernel_cap_t *inheritable,
2120 const kernel_cap_t *permitted)
2122 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2123 PROCESS__SETCAP, NULL);
2127 * (This comment used to live with the selinux_task_setuid hook,
2128 * which was removed).
2130 * Since setuid only affects the current process, and since the SELinux
2131 * controls are not based on the Linux identity attributes, SELinux does not
2132 * need to control this operation. However, SELinux does control the use of
2133 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2136 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2137 int cap, unsigned int opts)
2139 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2142 static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb)
2144 const struct cred *cred = current_cred();
2159 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2167 case Q_XGETNEXTQUOTA:
2168 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2171 rc = 0; /* let the kernel handle invalid cmds */
2177 static int selinux_quota_on(struct dentry *dentry)
2179 const struct cred *cred = current_cred();
2181 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2184 static int selinux_syslog(int type)
2187 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2188 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2189 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2190 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2191 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2192 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2193 /* Set level of messages printed to console */
2194 case SYSLOG_ACTION_CONSOLE_LEVEL:
2195 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2196 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2199 /* All other syslog types */
2200 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2201 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2205 * Check that a process has enough memory to allocate a new virtual
2206 * mapping. 0 means there is enough memory for the allocation to
2207 * succeed and -ENOMEM implies there is not.
2209 * Do not audit the selinux permission check, as this is applied to all
2210 * processes that allocate mappings.
2212 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2214 int rc, cap_sys_admin = 0;
2216 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2217 CAP_OPT_NOAUDIT, true);
2221 return cap_sys_admin;
2224 /* binprm security operations */
2226 static u32 ptrace_parent_sid(void)
2229 struct task_struct *tracer;
2232 tracer = ptrace_parent(current);
2234 sid = task_sid_obj(tracer);
2240 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2241 const struct task_security_struct *old_tsec,
2242 const struct task_security_struct *new_tsec)
2244 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2245 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2249 if (!nnp && !nosuid)
2250 return 0; /* neither NNP nor nosuid */
2252 if (new_tsec->sid == old_tsec->sid)
2253 return 0; /* No change in credentials */
2256 * If the policy enables the nnp_nosuid_transition policy capability,
2257 * then we permit transitions under NNP or nosuid if the
2258 * policy allows the corresponding permission between
2259 * the old and new contexts.
2261 if (selinux_policycap_nnp_nosuid_transition()) {
2264 av |= PROCESS2__NNP_TRANSITION;
2266 av |= PROCESS2__NOSUID_TRANSITION;
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268 SECCLASS_PROCESS2, av, NULL);
2274 * We also permit NNP or nosuid transitions to bounded SIDs,
2275 * i.e. SIDs that are guaranteed to only be allowed a subset
2276 * of the permissions of the current SID.
2278 rc = security_bounded_transition(old_tsec->sid,
2284 * On failure, preserve the errno values for NNP vs nosuid.
2285 * NNP: Operation not permitted for caller.
2286 * nosuid: Permission denied to file.
2293 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2295 const struct task_security_struct *old_tsec;
2296 struct task_security_struct *new_tsec;
2297 struct inode_security_struct *isec;
2298 struct common_audit_data ad;
2299 struct inode *inode = file_inode(bprm->file);
2302 /* SELinux context only depends on initial program or script and not
2303 * the script interpreter */
2305 old_tsec = selinux_cred(current_cred());
2306 new_tsec = selinux_cred(bprm->cred);
2307 isec = inode_security(inode);
2309 /* Default to the current task SID. */
2310 new_tsec->sid = old_tsec->sid;
2311 new_tsec->osid = old_tsec->sid;
2313 /* Reset fs, key, and sock SIDs on execve. */
2314 new_tsec->create_sid = 0;
2315 new_tsec->keycreate_sid = 0;
2316 new_tsec->sockcreate_sid = 0;
2319 * Before policy is loaded, label any task outside kernel space
2320 * as SECINITSID_INIT, so that any userspace tasks surviving from
2321 * early boot end up with a label different from SECINITSID_KERNEL
2322 * (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
2324 if (!selinux_initialized()) {
2325 new_tsec->sid = SECINITSID_INIT;
2326 /* also clear the exec_sid just in case */
2327 new_tsec->exec_sid = 0;
2331 if (old_tsec->exec_sid) {
2332 new_tsec->sid = old_tsec->exec_sid;
2333 /* Reset exec SID on execve. */
2334 new_tsec->exec_sid = 0;
2336 /* Fail on NNP or nosuid if not an allowed transition. */
2337 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2341 /* Check for a default transition on this program. */
2342 rc = security_transition_sid(old_tsec->sid,
2343 isec->sid, SECCLASS_PROCESS, NULL,
2349 * Fallback to old SID on NNP or nosuid if not an allowed
2352 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2354 new_tsec->sid = old_tsec->sid;
2357 ad.type = LSM_AUDIT_DATA_FILE;
2358 ad.u.file = bprm->file;
2360 if (new_tsec->sid == old_tsec->sid) {
2361 rc = avc_has_perm(old_tsec->sid, isec->sid,
2362 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2366 /* Check permissions for the transition. */
2367 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2368 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2372 rc = avc_has_perm(new_tsec->sid, isec->sid,
2373 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2377 /* Check for shared state */
2378 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2379 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2380 SECCLASS_PROCESS, PROCESS__SHARE,
2386 /* Make sure that anyone attempting to ptrace over a task that
2387 * changes its SID has the appropriate permit */
2388 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2389 u32 ptsid = ptrace_parent_sid();
2391 rc = avc_has_perm(ptsid, new_tsec->sid,
2393 PROCESS__PTRACE, NULL);
2399 /* Clear any possibly unsafe personality bits on exec: */
2400 bprm->per_clear |= PER_CLEAR_ON_SETID;
2402 /* Enable secure mode for SIDs transitions unless
2403 the noatsecure permission is granted between
2404 the two SIDs, i.e. ahp returns 0. */
2405 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2406 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2408 bprm->secureexec |= !!rc;
2414 static int match_file(const void *p, struct file *file, unsigned fd)
2416 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2419 /* Derived from fs/exec.c:flush_old_files. */
2420 static inline void flush_unauthorized_files(const struct cred *cred,
2421 struct files_struct *files)
2423 struct file *file, *devnull = NULL;
2424 struct tty_struct *tty;
2428 tty = get_current_tty();
2430 spin_lock(&tty->files_lock);
2431 if (!list_empty(&tty->tty_files)) {
2432 struct tty_file_private *file_priv;
2434 /* Revalidate access to controlling tty.
2435 Use file_path_has_perm on the tty path directly
2436 rather than using file_has_perm, as this particular
2437 open file may belong to another process and we are
2438 only interested in the inode-based check here. */
2439 file_priv = list_first_entry(&tty->tty_files,
2440 struct tty_file_private, list);
2441 file = file_priv->file;
2442 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2445 spin_unlock(&tty->files_lock);
2448 /* Reset controlling tty. */
2452 /* Revalidate access to inherited open files. */
2453 n = iterate_fd(files, 0, match_file, cred);
2454 if (!n) /* none found? */
2457 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2458 if (IS_ERR(devnull))
2460 /* replace all the matching ones with this */
2462 replace_fd(n - 1, devnull, 0);
2463 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2469 * Prepare a process for imminent new credential changes due to exec
2471 static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
2473 struct task_security_struct *new_tsec;
2474 struct rlimit *rlim, *initrlim;
2477 new_tsec = selinux_cred(bprm->cred);
2478 if (new_tsec->sid == new_tsec->osid)
2481 /* Close files for which the new task SID is not authorized. */
2482 flush_unauthorized_files(bprm->cred, current->files);
2484 /* Always clear parent death signal on SID transitions. */
2485 current->pdeath_signal = 0;
2487 /* Check whether the new SID can inherit resource limits from the old
2488 * SID. If not, reset all soft limits to the lower of the current
2489 * task's hard limit and the init task's soft limit.
2491 * Note that the setting of hard limits (even to lower them) can be
2492 * controlled by the setrlimit check. The inclusion of the init task's
2493 * soft limit into the computation is to avoid resetting soft limits
2494 * higher than the default soft limit for cases where the default is
2495 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2497 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2498 PROCESS__RLIMITINH, NULL);
2500 /* protect against do_prlimit() */
2502 for (i = 0; i < RLIM_NLIMITS; i++) {
2503 rlim = current->signal->rlim + i;
2504 initrlim = init_task.signal->rlim + i;
2505 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2507 task_unlock(current);
2508 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2509 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2514 * Clean up the process immediately after the installation of new credentials
2517 static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
2519 const struct task_security_struct *tsec = selinux_cred(current_cred());
2529 /* Check whether the new SID can inherit signal state from the old SID.
2530 * If not, clear itimers to avoid subsequent signal generation and
2531 * flush and unblock signals.
2533 * This must occur _after_ the task SID has been updated so that any
2534 * kill done after the flush will be checked against the new SID.
2536 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2540 spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2541 if (!fatal_signal_pending(current)) {
2542 flush_sigqueue(¤t->pending);
2543 flush_sigqueue(¤t->signal->shared_pending);
2544 flush_signal_handlers(current, 1);
2545 sigemptyset(¤t->blocked);
2546 recalc_sigpending();
2548 spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2551 /* Wake up the parent if it is waiting so that it can recheck
2552 * wait permission to the new task SID. */
2553 read_lock(&tasklist_lock);
2554 __wake_up_parent(current, unrcu_pointer(current->real_parent));
2555 read_unlock(&tasklist_lock);
2558 /* superblock security operations */
2560 static int selinux_sb_alloc_security(struct super_block *sb)
2562 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2564 mutex_init(&sbsec->lock);
2565 INIT_LIST_HEAD(&sbsec->isec_head);
2566 spin_lock_init(&sbsec->isec_lock);
2567 sbsec->sid = SECINITSID_UNLABELED;
2568 sbsec->def_sid = SECINITSID_FILE;
2569 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2574 static inline int opt_len(const char *s)
2576 bool open_quote = false;
2580 for (len = 0; (c = s[len]) != '\0'; len++) {
2582 open_quote = !open_quote;
2583 if (c == ',' && !open_quote)
2589 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2591 char *from = options;
2597 int len = opt_len(from);
2601 token = match_opt_prefix(from, len, &arg);
2603 if (token != Opt_error) {
2608 for (p = q = arg; p < from + len; p++) {
2613 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2619 rc = selinux_add_opt(token, arg, mnt_opts);
2626 if (!first) { // copy with preceding comma
2631 memmove(to, from, len);
2644 selinux_free_mnt_opts(*mnt_opts);
2650 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2652 struct selinux_mnt_opts *opts = mnt_opts;
2653 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2656 * Superblock not initialized (i.e. no options) - reject if any
2657 * options specified, otherwise accept.
2659 if (!(sbsec->flags & SE_SBINITIALIZED))
2660 return opts ? 1 : 0;
2663 * Superblock initialized and no options specified - reject if
2664 * superblock has any options set, otherwise accept.
2667 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2669 if (opts->fscontext_sid) {
2670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2671 opts->fscontext_sid))
2674 if (opts->context_sid) {
2675 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2679 if (opts->rootcontext_sid) {
2680 struct inode_security_struct *root_isec;
2682 root_isec = backing_inode_security(sb->s_root);
2683 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2684 opts->rootcontext_sid))
2687 if (opts->defcontext_sid) {
2688 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2689 opts->defcontext_sid))
2695 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2697 struct selinux_mnt_opts *opts = mnt_opts;
2698 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2700 if (!(sbsec->flags & SE_SBINITIALIZED))
2706 if (opts->fscontext_sid) {
2707 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2708 opts->fscontext_sid))
2709 goto out_bad_option;
2711 if (opts->context_sid) {
2712 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2714 goto out_bad_option;
2716 if (opts->rootcontext_sid) {
2717 struct inode_security_struct *root_isec;
2718 root_isec = backing_inode_security(sb->s_root);
2719 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2720 opts->rootcontext_sid))
2721 goto out_bad_option;
2723 if (opts->defcontext_sid) {
2724 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2725 opts->defcontext_sid))
2726 goto out_bad_option;
2731 pr_warn("SELinux: unable to change security options "
2732 "during remount (dev %s, type=%s)\n", sb->s_id,
2737 static int selinux_sb_kern_mount(const struct super_block *sb)
2739 const struct cred *cred = current_cred();
2740 struct common_audit_data ad;
2742 ad.type = LSM_AUDIT_DATA_DENTRY;
2743 ad.u.dentry = sb->s_root;
2744 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2747 static int selinux_sb_statfs(struct dentry *dentry)
2749 const struct cred *cred = current_cred();
2750 struct common_audit_data ad;
2752 ad.type = LSM_AUDIT_DATA_DENTRY;
2753 ad.u.dentry = dentry->d_sb->s_root;
2754 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2757 static int selinux_mount(const char *dev_name,
2758 const struct path *path,
2760 unsigned long flags,
2763 const struct cred *cred = current_cred();
2765 if (flags & MS_REMOUNT)
2766 return superblock_has_perm(cred, path->dentry->d_sb,
2767 FILESYSTEM__REMOUNT, NULL);
2769 return path_has_perm(cred, path, FILE__MOUNTON);
2772 static int selinux_move_mount(const struct path *from_path,
2773 const struct path *to_path)
2775 const struct cred *cred = current_cred();
2777 return path_has_perm(cred, to_path, FILE__MOUNTON);
2780 static int selinux_umount(struct vfsmount *mnt, int flags)
2782 const struct cred *cred = current_cred();
2784 return superblock_has_perm(cred, mnt->mnt_sb,
2785 FILESYSTEM__UNMOUNT, NULL);
2788 static int selinux_fs_context_submount(struct fs_context *fc,
2789 struct super_block *reference)
2791 const struct superblock_security_struct *sbsec = selinux_superblock(reference);
2792 struct selinux_mnt_opts *opts;
2795 * Ensure that fc->security remains NULL when no options are set
2796 * as expected by selinux_set_mnt_opts().
2798 if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
2801 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2805 if (sbsec->flags & FSCONTEXT_MNT)
2806 opts->fscontext_sid = sbsec->sid;
2807 if (sbsec->flags & CONTEXT_MNT)
2808 opts->context_sid = sbsec->mntpoint_sid;
2809 if (sbsec->flags & DEFCONTEXT_MNT)
2810 opts->defcontext_sid = sbsec->def_sid;
2811 fc->security = opts;
2815 static int selinux_fs_context_dup(struct fs_context *fc,
2816 struct fs_context *src_fc)
2818 const struct selinux_mnt_opts *src = src_fc->security;
2823 fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2824 return fc->security ? 0 : -ENOMEM;
2827 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2828 fsparam_string(CONTEXT_STR, Opt_context),
2829 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2830 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2831 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2832 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2836 static int selinux_fs_context_parse_param(struct fs_context *fc,
2837 struct fs_parameter *param)
2839 struct fs_parse_result result;
2842 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2846 return selinux_add_opt(opt, param->string, &fc->security);
2849 /* inode security operations */
2851 static int selinux_inode_alloc_security(struct inode *inode)
2853 struct inode_security_struct *isec = selinux_inode(inode);
2854 u32 sid = current_sid();
2856 spin_lock_init(&isec->lock);
2857 INIT_LIST_HEAD(&isec->list);
2858 isec->inode = inode;
2859 isec->sid = SECINITSID_UNLABELED;
2860 isec->sclass = SECCLASS_FILE;
2861 isec->task_sid = sid;
2862 isec->initialized = LABEL_INVALID;
2867 static void selinux_inode_free_security(struct inode *inode)
2869 inode_free_security(inode);
2872 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2873 const struct qstr *name,
2874 const char **xattr_name, void **ctx,
2880 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2881 d_inode(dentry->d_parent), name,
2882 inode_mode_to_security_class(mode),
2888 *xattr_name = XATTR_NAME_SELINUX;
2890 return security_sid_to_context(newsid, (char **)ctx,
2894 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2896 const struct cred *old,
2901 struct task_security_struct *tsec;
2903 rc = selinux_determine_inode_label(selinux_cred(old),
2904 d_inode(dentry->d_parent), name,
2905 inode_mode_to_security_class(mode),
2910 tsec = selinux_cred(new);
2911 tsec->create_sid = newsid;
2915 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2916 const struct qstr *qstr,
2917 struct xattr *xattrs, int *xattr_count)
2919 const struct task_security_struct *tsec = selinux_cred(current_cred());
2920 struct superblock_security_struct *sbsec;
2921 struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2926 sbsec = selinux_superblock(dir->i_sb);
2928 newsid = tsec->create_sid;
2930 rc = selinux_determine_inode_label(tsec, dir, qstr,
2931 inode_mode_to_security_class(inode->i_mode),
2936 /* Possibly defer initialization to selinux_complete_init. */
2937 if (sbsec->flags & SE_SBINITIALIZED) {
2938 struct inode_security_struct *isec = selinux_inode(inode);
2939 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2941 isec->initialized = LABEL_INITIALIZED;
2944 if (!selinux_initialized() ||
2945 !(sbsec->flags & SBLABEL_MNT))
2949 rc = security_sid_to_context_force(newsid,
2953 xattr->value = context;
2954 xattr->value_len = clen;
2955 xattr->name = XATTR_SELINUX_SUFFIX;
2961 static int selinux_inode_init_security_anon(struct inode *inode,
2962 const struct qstr *name,
2963 const struct inode *context_inode)
2965 const struct task_security_struct *tsec = selinux_cred(current_cred());
2966 struct common_audit_data ad;
2967 struct inode_security_struct *isec;
2970 if (unlikely(!selinux_initialized()))
2973 isec = selinux_inode(inode);
2976 * We only get here once per ephemeral inode. The inode has
2977 * been initialized via inode_alloc_security but is otherwise
2981 if (context_inode) {
2982 struct inode_security_struct *context_isec =
2983 selinux_inode(context_inode);
2984 if (context_isec->initialized != LABEL_INITIALIZED) {
2985 pr_err("SELinux: context_inode is not initialized\n");
2989 isec->sclass = context_isec->sclass;
2990 isec->sid = context_isec->sid;
2992 isec->sclass = SECCLASS_ANON_INODE;
2993 rc = security_transition_sid(
2994 tsec->sid, tsec->sid,
2995 isec->sclass, name, &isec->sid);
3000 isec->initialized = LABEL_INITIALIZED;
3002 * Now that we've initialized security, check whether we're
3003 * allowed to actually create this type of anonymous inode.
3006 ad.type = LSM_AUDIT_DATA_ANONINODE;
3007 ad.u.anonclass = name ? (const char *)name->name : "?";
3009 return avc_has_perm(tsec->sid,
3016 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3018 return may_create(dir, dentry, SECCLASS_FILE);
3021 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3023 return may_link(dir, old_dentry, MAY_LINK);
3026 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3028 return may_link(dir, dentry, MAY_UNLINK);
3031 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3033 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3036 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3038 return may_create(dir, dentry, SECCLASS_DIR);
3041 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3043 return may_link(dir, dentry, MAY_RMDIR);
3046 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3048 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3051 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3052 struct inode *new_inode, struct dentry *new_dentry)
3054 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3057 static int selinux_inode_readlink(struct dentry *dentry)
3059 const struct cred *cred = current_cred();
3061 return dentry_has_perm(cred, dentry, FILE__READ);
3064 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3067 const struct cred *cred = current_cred();
3068 struct common_audit_data ad;
3069 struct inode_security_struct *isec;
3072 ad.type = LSM_AUDIT_DATA_DENTRY;
3073 ad.u.dentry = dentry;
3074 sid = cred_sid(cred);
3075 isec = inode_security_rcu(inode, rcu);
3077 return PTR_ERR(isec);
3079 return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
3082 static noinline int audit_inode_permission(struct inode *inode,
3083 u32 perms, u32 audited, u32 denied,
3086 struct common_audit_data ad;
3087 struct inode_security_struct *isec = selinux_inode(inode);
3089 ad.type = LSM_AUDIT_DATA_INODE;
3092 return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3093 audited, denied, result, &ad);
3096 static int selinux_inode_permission(struct inode *inode, int mask)
3098 const struct cred *cred = current_cred();
3101 bool no_block = mask & MAY_NOT_BLOCK;
3102 struct inode_security_struct *isec;
3104 struct av_decision avd;
3106 u32 audited, denied;
3108 from_access = mask & MAY_ACCESS;
3109 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3111 /* No permission to check. Existence test. */
3115 if (unlikely(IS_PRIVATE(inode)))
3118 perms = file_mask_to_av(inode->i_mode, mask);
3120 sid = cred_sid(cred);
3121 isec = inode_security_rcu(inode, no_block);
3123 return PTR_ERR(isec);
3125 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
3127 audited = avc_audit_required(perms, &avd, rc,
3128 from_access ? FILE__AUDIT_ACCESS : 0,
3130 if (likely(!audited))
3133 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3139 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
3141 const struct cred *cred = current_cred();
3142 struct inode *inode = d_backing_inode(dentry);
3143 unsigned int ia_valid = iattr->ia_valid;
3144 __u32 av = FILE__WRITE;
3146 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3147 if (ia_valid & ATTR_FORCE) {
3148 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3154 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3155 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3156 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3158 if (selinux_policycap_openperm() &&
3159 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3160 (ia_valid & ATTR_SIZE) &&
3161 !(ia_valid & ATTR_FILE))
3164 return dentry_has_perm(cred, dentry, av);
3167 static int selinux_inode_getattr(const struct path *path)
3169 return path_has_perm(current_cred(), path, FILE__GETATTR);
3172 static bool has_cap_mac_admin(bool audit)
3174 const struct cred *cred = current_cred();
3175 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3177 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3179 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3184 static int selinux_inode_setxattr(struct mnt_idmap *idmap,
3185 struct dentry *dentry, const char *name,
3186 const void *value, size_t size, int flags)
3188 struct inode *inode = d_backing_inode(dentry);
3189 struct inode_security_struct *isec;
3190 struct superblock_security_struct *sbsec;
3191 struct common_audit_data ad;
3192 u32 newsid, sid = current_sid();
3195 if (strcmp(name, XATTR_NAME_SELINUX)) {
3196 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3200 /* Not an attribute we recognize, so just check the
3201 ordinary setattr permission. */
3202 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3205 if (!selinux_initialized())
3206 return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
3208 sbsec = selinux_superblock(inode->i_sb);
3209 if (!(sbsec->flags & SBLABEL_MNT))
3212 if (!inode_owner_or_capable(idmap, inode))
3215 ad.type = LSM_AUDIT_DATA_DENTRY;
3216 ad.u.dentry = dentry;
3218 isec = backing_inode_security(dentry);
3219 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3220 FILE__RELABELFROM, &ad);
3224 rc = security_context_to_sid(value, size, &newsid,
3226 if (rc == -EINVAL) {
3227 if (!has_cap_mac_admin(true)) {
3228 struct audit_buffer *ab;
3231 /* We strip a nul only if it is at the end, otherwise the
3232 * context contains a nul and we should audit that */
3234 const char *str = value;
3236 if (str[size - 1] == '\0')
3237 audit_size = size - 1;
3243 ab = audit_log_start(audit_context(),
3244 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3247 audit_log_format(ab, "op=setxattr invalid_context=");
3248 audit_log_n_untrustedstring(ab, value, audit_size);
3253 rc = security_context_to_sid_force(value,
3259 rc = avc_has_perm(sid, newsid, isec->sclass,
3260 FILE__RELABELTO, &ad);
3264 rc = security_validate_transition(isec->sid, newsid,
3269 return avc_has_perm(newsid,
3271 SECCLASS_FILESYSTEM,
3272 FILESYSTEM__ASSOCIATE,
3276 static int selinux_inode_set_acl(struct mnt_idmap *idmap,
3277 struct dentry *dentry, const char *acl_name,
3278 struct posix_acl *kacl)
3280 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3283 static int selinux_inode_get_acl(struct mnt_idmap *idmap,
3284 struct dentry *dentry, const char *acl_name)
3286 return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
3289 static int selinux_inode_remove_acl(struct mnt_idmap *idmap,
3290 struct dentry *dentry, const char *acl_name)
3292 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3295 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3296 const void *value, size_t size,
3299 struct inode *inode = d_backing_inode(dentry);
3300 struct inode_security_struct *isec;
3304 if (strcmp(name, XATTR_NAME_SELINUX)) {
3305 /* Not an attribute we recognize, so nothing to do. */
3309 if (!selinux_initialized()) {
3310 /* If we haven't even been initialized, then we can't validate
3311 * against a policy, so leave the label as invalid. It may
3312 * resolve to a valid label on the next revalidation try if
3313 * we've since initialized.
3318 rc = security_context_to_sid_force(value, size,
3321 pr_err("SELinux: unable to map context to SID"
3322 "for (%s, %lu), rc=%d\n",
3323 inode->i_sb->s_id, inode->i_ino, -rc);
3327 isec = backing_inode_security(dentry);
3328 spin_lock(&isec->lock);
3329 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3331 isec->initialized = LABEL_INITIALIZED;
3332 spin_unlock(&isec->lock);
3335 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3337 const struct cred *cred = current_cred();
3339 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3342 static int selinux_inode_listxattr(struct dentry *dentry)
3344 const struct cred *cred = current_cred();
3346 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3349 static int selinux_inode_removexattr(struct mnt_idmap *idmap,
3350 struct dentry *dentry, const char *name)
3352 if (strcmp(name, XATTR_NAME_SELINUX)) {
3353 int rc = cap_inode_removexattr(idmap, dentry, name);
3357 /* Not an attribute we recognize, so just check the
3358 ordinary setattr permission. */
3359 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3362 if (!selinux_initialized())
3365 /* No one is allowed to remove a SELinux security label.
3366 You can change the label, but all data must be labeled. */
3370 static int selinux_path_notify(const struct path *path, u64 mask,
3371 unsigned int obj_type)
3376 struct common_audit_data ad;
3378 ad.type = LSM_AUDIT_DATA_PATH;
3382 * Set permission needed based on the type of mark being set.
3383 * Performs an additional check for sb watches.
3386 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3387 perm = FILE__WATCH_MOUNT;
3389 case FSNOTIFY_OBJ_TYPE_SB:
3390 perm = FILE__WATCH_SB;
3391 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3392 FILESYSTEM__WATCH, &ad);
3396 case FSNOTIFY_OBJ_TYPE_INODE:
3403 /* blocking watches require the file:watch_with_perm permission */
3404 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3405 perm |= FILE__WATCH_WITH_PERM;
3407 /* watches on read-like events need the file:watch_reads permission */
3408 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3409 perm |= FILE__WATCH_READS;
3411 return path_has_perm(current_cred(), path, perm);
3415 * Copy the inode security context value to the user.
3417 * Permission check is handled by selinux_inode_getxattr hook.
3419 static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
3420 struct inode *inode, const char *name,
3421 void **buffer, bool alloc)
3425 char *context = NULL;
3426 struct inode_security_struct *isec;
3429 * If we're not initialized yet, then we can't validate contexts, so
3430 * just let vfs_getxattr fall back to using the on-disk xattr.
3432 if (!selinux_initialized() ||
3433 strcmp(name, XATTR_SELINUX_SUFFIX))
3437 * If the caller has CAP_MAC_ADMIN, then get the raw context
3438 * value even if it is not defined by current policy; otherwise,
3439 * use the in-core value under current policy.
3440 * Use the non-auditing forms of the permission checks since
3441 * getxattr may be called by unprivileged processes commonly
3442 * and lack of permission just means that we fall back to the
3443 * in-core context value, not a denial.
3445 isec = inode_security(inode);
3446 if (has_cap_mac_admin(false))
3447 error = security_sid_to_context_force(isec->sid, &context,
3450 error = security_sid_to_context(isec->sid,
3464 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3465 const void *value, size_t size, int flags)
3467 struct inode_security_struct *isec = inode_security_novalidate(inode);
3468 struct superblock_security_struct *sbsec;
3472 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3475 sbsec = selinux_superblock(inode->i_sb);
3476 if (!(sbsec->flags & SBLABEL_MNT))
3479 if (!value || !size)
3482 rc = security_context_to_sid(value, size, &newsid,
3487 spin_lock(&isec->lock);
3488 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3490 isec->initialized = LABEL_INITIALIZED;
3491 spin_unlock(&isec->lock);
3495 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3497 const int len = sizeof(XATTR_NAME_SELINUX);
3499 if (!selinux_initialized())
3502 if (buffer && len <= buffer_size)
3503 memcpy(buffer, XATTR_NAME_SELINUX, len);
3507 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3509 struct inode_security_struct *isec = inode_security_novalidate(inode);
3513 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3516 struct task_security_struct *tsec;
3517 struct cred *new_creds = *new;
3519 if (new_creds == NULL) {
3520 new_creds = prepare_creds();
3525 tsec = selinux_cred(new_creds);
3526 /* Get label from overlay inode and set it in create_sid */
3527 selinux_inode_getsecid(d_inode(src), &sid);
3528 tsec->create_sid = sid;
3533 static int selinux_inode_copy_up_xattr(const char *name)
3535 /* The copy_up hook above sets the initial context on an inode, but we
3536 * don't then want to overwrite it by blindly copying all the lower
3537 * xattrs up. Instead, we have to filter out SELinux-related xattrs.
3539 if (strcmp(name, XATTR_NAME_SELINUX) == 0)
3540 return 1; /* Discard */
3542 * Any other attribute apart from SELINUX is not claimed, supported
3548 /* kernfs node operations */
3550 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3551 struct kernfs_node *kn)
3553 const struct task_security_struct *tsec = selinux_cred(current_cred());
3554 u32 parent_sid, newsid, clen;
3558 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3565 context = kmalloc(clen, GFP_KERNEL);
3569 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3575 rc = security_context_to_sid(context, clen, &parent_sid,
3581 if (tsec->create_sid) {
3582 newsid = tsec->create_sid;
3584 u16 secclass = inode_mode_to_security_class(kn->mode);
3588 q.hash_len = hashlen_string(kn_dir, kn->name);
3590 rc = security_transition_sid(tsec->sid,
3591 parent_sid, secclass, &q,
3597 rc = security_sid_to_context_force(newsid,
3602 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3609 /* file security operations */
3611 static int selinux_revalidate_file_permission(struct file *file, int mask)
3613 const struct cred *cred = current_cred();
3614 struct inode *inode = file_inode(file);
3616 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3617 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3620 return file_has_perm(cred, file,
3621 file_mask_to_av(inode->i_mode, mask));
3624 static int selinux_file_permission(struct file *file, int mask)
3626 struct inode *inode = file_inode(file);
3627 struct file_security_struct *fsec = selinux_file(file);
3628 struct inode_security_struct *isec;
3629 u32 sid = current_sid();
3632 /* No permission to check. Existence test. */
3635 isec = inode_security(inode);
3636 if (sid == fsec->sid && fsec->isid == isec->sid &&
3637 fsec->pseqno == avc_policy_seqno())
3638 /* No change since file_open check. */
3641 return selinux_revalidate_file_permission(file, mask);
3644 static int selinux_file_alloc_security(struct file *file)
3646 struct file_security_struct *fsec = selinux_file(file);
3647 u32 sid = current_sid();
3650 fsec->fown_sid = sid;
3656 * Check whether a task has the ioctl permission and cmd
3657 * operation to an inode.
3659 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3660 u32 requested, u16 cmd)
3662 struct common_audit_data ad;
3663 struct file_security_struct *fsec = selinux_file(file);
3664 struct inode *inode = file_inode(file);
3665 struct inode_security_struct *isec;
3666 struct lsm_ioctlop_audit ioctl;
3667 u32 ssid = cred_sid(cred);
3669 u8 driver = cmd >> 8;
3670 u8 xperm = cmd & 0xff;
3672 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3675 ad.u.op->path = file->f_path;
3677 if (ssid != fsec->sid) {
3678 rc = avc_has_perm(ssid, fsec->sid,
3686 if (unlikely(IS_PRIVATE(inode)))
3689 isec = inode_security(inode);
3690 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3691 requested, driver, xperm, &ad);
3696 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3699 const struct cred *cred = current_cred();
3706 case FS_IOC_GETFLAGS:
3707 case FS_IOC_GETVERSION:
3708 error = file_has_perm(cred, file, FILE__GETATTR);
3711 case FS_IOC_SETFLAGS:
3712 case FS_IOC_SETVERSION:
3713 error = file_has_perm(cred, file, FILE__SETATTR);
3716 /* sys_ioctl() checks */
3719 error = file_has_perm(cred, file, 0);
3724 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3725 CAP_OPT_NONE, true);
3730 if (!selinux_policycap_ioctl_skip_cloexec())
3731 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3734 /* default case assumes that the command will go
3735 * to the file's ioctl() function.
3738 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3743 static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
3747 * If we are in a 64-bit kernel running 32-bit userspace, we need to
3748 * make sure we don't compare 32-bit flags to 64-bit flags.
3751 case FS_IOC32_GETFLAGS:
3752 cmd = FS_IOC_GETFLAGS;
3754 case FS_IOC32_SETFLAGS:
3755 cmd = FS_IOC_SETFLAGS;
3757 case FS_IOC32_GETVERSION:
3758 cmd = FS_IOC_GETVERSION;
3760 case FS_IOC32_SETVERSION:
3761 cmd = FS_IOC_SETVERSION;
3767 return selinux_file_ioctl(file, cmd, arg);
3770 static int default_noexec __ro_after_init;
3772 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3774 const struct cred *cred = current_cred();
3775 u32 sid = cred_sid(cred);
3778 if (default_noexec &&
3779 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3780 (!shared && (prot & PROT_WRITE)))) {
3782 * We are making executable an anonymous mapping or a
3783 * private file mapping that will also be writable.
3784 * This has an additional check.
3786 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3787 PROCESS__EXECMEM, NULL);
3793 /* read access is always possible with a mapping */
3794 u32 av = FILE__READ;
3796 /* write access only matters if the mapping is shared */
3797 if (shared && (prot & PROT_WRITE))
3800 if (prot & PROT_EXEC)
3801 av |= FILE__EXECUTE;
3803 return file_has_perm(cred, file, av);
3810 static int selinux_mmap_addr(unsigned long addr)
3814 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3815 u32 sid = current_sid();
3816 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3817 MEMPROTECT__MMAP_ZERO, NULL);
3823 static int selinux_mmap_file(struct file *file,
3824 unsigned long reqprot __always_unused,
3825 unsigned long prot, unsigned long flags)
3827 struct common_audit_data ad;
3831 ad.type = LSM_AUDIT_DATA_FILE;
3833 rc = inode_has_perm(current_cred(), file_inode(file),
3839 return file_map_prot_check(file, prot,
3840 (flags & MAP_TYPE) == MAP_SHARED);
3843 static int selinux_file_mprotect(struct vm_area_struct *vma,
3844 unsigned long reqprot __always_unused,
3847 const struct cred *cred = current_cred();
3848 u32 sid = cred_sid(cred);
3850 if (default_noexec &&
3851 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3853 if (vma_is_initial_heap(vma)) {
3854 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3855 PROCESS__EXECHEAP, NULL);
3856 } else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
3857 vma_is_stack_for_current(vma))) {
3858 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3859 PROCESS__EXECSTACK, NULL);
3860 } else if (vma->vm_file && vma->anon_vma) {
3862 * We are making executable a file mapping that has
3863 * had some COW done. Since pages might have been
3864 * written, check ability to execute the possibly
3865 * modified content. This typically should only
3866 * occur for text relocations.
3868 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3874 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3877 static int selinux_file_lock(struct file *file, unsigned int cmd)
3879 const struct cred *cred = current_cred();
3881 return file_has_perm(cred, file, FILE__LOCK);
3884 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3887 const struct cred *cred = current_cred();
3892 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3893 err = file_has_perm(cred, file, FILE__WRITE);
3902 case F_GETOWNER_UIDS:
3903 /* Just check FD__USE permission */
3904 err = file_has_perm(cred, file, 0);
3912 #if BITS_PER_LONG == 32
3917 err = file_has_perm(cred, file, FILE__LOCK);
3924 static void selinux_file_set_fowner(struct file *file)
3926 struct file_security_struct *fsec;
3928 fsec = selinux_file(file);
3929 fsec->fown_sid = current_sid();
3932 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3933 struct fown_struct *fown, int signum)
3936 u32 sid = task_sid_obj(tsk);
3938 struct file_security_struct *fsec;
3940 /* struct fown_struct is never outside the context of a struct file */
3941 file = container_of(fown, struct file, f_owner);
3943 fsec = selinux_file(file);
3946 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3948 perm = signal_to_av(signum);
3950 return avc_has_perm(fsec->fown_sid, sid,
3951 SECCLASS_PROCESS, perm, NULL);
3954 static int selinux_file_receive(struct file *file)
3956 const struct cred *cred = current_cred();
3958 return file_has_perm(cred, file, file_to_av(file));
3961 static int selinux_file_open(struct file *file)
3963 struct file_security_struct *fsec;
3964 struct inode_security_struct *isec;
3966 fsec = selinux_file(file);
3967 isec = inode_security(file_inode(file));
3969 * Save inode label and policy sequence number
3970 * at open-time so that selinux_file_permission
3971 * can determine whether revalidation is necessary.
3972 * Task label is already saved in the file security
3973 * struct as its SID.
3975 fsec->isid = isec->sid;
3976 fsec->pseqno = avc_policy_seqno();
3978 * Since the inode label or policy seqno may have changed
3979 * between the selinux_inode_permission check and the saving
3980 * of state above, recheck that access is still permitted.
3981 * Otherwise, access might never be revalidated against the
3982 * new inode label or new policy.
3983 * This check is not redundant - do not remove.
3985 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3988 /* task security operations */
3990 static int selinux_task_alloc(struct task_struct *task,
3991 unsigned long clone_flags)
3993 u32 sid = current_sid();
3995 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3999 * prepare a new set of credentials for modification
4001 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4004 const struct task_security_struct *old_tsec = selinux_cred(old);
4005 struct task_security_struct *tsec = selinux_cred(new);
4012 * transfer the SELinux data to a blank set of creds
4014 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4016 const struct task_security_struct *old_tsec = selinux_cred(old);
4017 struct task_security_struct *tsec = selinux_cred(new);
4022 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4024 *secid = cred_sid(c);
4028 * set the security data for a kernel service
4029 * - all the creation contexts are set to unlabelled
4031 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4033 struct task_security_struct *tsec = selinux_cred(new);
4034 u32 sid = current_sid();
4037 ret = avc_has_perm(sid, secid,
4038 SECCLASS_KERNEL_SERVICE,
4039 KERNEL_SERVICE__USE_AS_OVERRIDE,
4043 tsec->create_sid = 0;
4044 tsec->keycreate_sid = 0;
4045 tsec->sockcreate_sid = 0;
4051 * set the file creation context in a security record to the same as the
4052 * objective context of the specified inode
4054 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4056 struct inode_security_struct *isec = inode_security(inode);
4057 struct task_security_struct *tsec = selinux_cred(new);
4058 u32 sid = current_sid();
4061 ret = avc_has_perm(sid, isec->sid,
4062 SECCLASS_KERNEL_SERVICE,
4063 KERNEL_SERVICE__CREATE_FILES_AS,
4067 tsec->create_sid = isec->sid;
4071 static int selinux_kernel_module_request(char *kmod_name)
4073 struct common_audit_data ad;
4075 ad.type = LSM_AUDIT_DATA_KMOD;
4076 ad.u.kmod_name = kmod_name;
4078 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4079 SYSTEM__MODULE_REQUEST, &ad);
4082 static int selinux_kernel_module_from_file(struct file *file)
4084 struct common_audit_data ad;
4085 struct inode_security_struct *isec;
4086 struct file_security_struct *fsec;
4087 u32 sid = current_sid();
4092 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
4093 SYSTEM__MODULE_LOAD, NULL);
4097 ad.type = LSM_AUDIT_DATA_FILE;
4100 fsec = selinux_file(file);
4101 if (sid != fsec->sid) {
4102 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4107 isec = inode_security(file_inode(file));
4108 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
4109 SYSTEM__MODULE_LOAD, &ad);
4112 static int selinux_kernel_read_file(struct file *file,
4113 enum kernel_read_file_id id,
4119 case READING_MODULE:
4120 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4129 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4134 case LOADING_MODULE:
4135 rc = selinux_kernel_module_from_file(NULL);
4144 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4146 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4147 PROCESS__SETPGID, NULL);
4150 static int selinux_task_getpgid(struct task_struct *p)
4152 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4153 PROCESS__GETPGID, NULL);
4156 static int selinux_task_getsid(struct task_struct *p)
4158 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4159 PROCESS__GETSESSION, NULL);
4162 static void selinux_current_getsecid_subj(u32 *secid)
4164 *secid = current_sid();
4167 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4169 *secid = task_sid_obj(p);
4172 static int selinux_task_setnice(struct task_struct *p, int nice)
4174 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4175 PROCESS__SETSCHED, NULL);
4178 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4180 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4181 PROCESS__SETSCHED, NULL);
4184 static int selinux_task_getioprio(struct task_struct *p)
4186 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4187 PROCESS__GETSCHED, NULL);
4190 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4197 if (flags & LSM_PRLIMIT_WRITE)
4198 av |= PROCESS__SETRLIMIT;
4199 if (flags & LSM_PRLIMIT_READ)
4200 av |= PROCESS__GETRLIMIT;
4201 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4202 SECCLASS_PROCESS, av, NULL);
4205 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4206 struct rlimit *new_rlim)
4208 struct rlimit *old_rlim = p->signal->rlim + resource;
4210 /* Control the ability to change the hard limit (whether
4211 lowering or raising it), so that the hard limit can
4212 later be used as a safe reset point for the soft limit
4213 upon context transitions. See selinux_bprm_committing_creds. */
4214 if (old_rlim->rlim_max != new_rlim->rlim_max)
4215 return avc_has_perm(current_sid(), task_sid_obj(p),
4216 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4221 static int selinux_task_setscheduler(struct task_struct *p)
4223 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4224 PROCESS__SETSCHED, NULL);
4227 static int selinux_task_getscheduler(struct task_struct *p)
4229 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4230 PROCESS__GETSCHED, NULL);
4233 static int selinux_task_movememory(struct task_struct *p)
4235 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4236 PROCESS__SETSCHED, NULL);
4239 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4240 int sig, const struct cred *cred)
4246 perm = PROCESS__SIGNULL; /* null signal; existence test */
4248 perm = signal_to_av(sig);
4250 secid = current_sid();
4252 secid = cred_sid(cred);
4253 return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4256 static void selinux_task_to_inode(struct task_struct *p,
4257 struct inode *inode)
4259 struct inode_security_struct *isec = selinux_inode(inode);
4260 u32 sid = task_sid_obj(p);
4262 spin_lock(&isec->lock);
4263 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4265 isec->initialized = LABEL_INITIALIZED;
4266 spin_unlock(&isec->lock);
4269 static int selinux_userns_create(const struct cred *cred)
4271 u32 sid = current_sid();
4273 return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
4274 USER_NAMESPACE__CREATE, NULL);
4277 /* Returns error only if unable to parse addresses */
4278 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4279 struct common_audit_data *ad, u8 *proto)
4281 int offset, ihlen, ret = -EINVAL;
4282 struct iphdr _iph, *ih;
4284 offset = skb_network_offset(skb);
4285 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4289 ihlen = ih->ihl * 4;
4290 if (ihlen < sizeof(_iph))
4293 ad->u.net->v4info.saddr = ih->saddr;
4294 ad->u.net->v4info.daddr = ih->daddr;
4298 *proto = ih->protocol;
4300 switch (ih->protocol) {
4302 struct tcphdr _tcph, *th;
4304 if (ntohs(ih->frag_off) & IP_OFFSET)
4308 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4312 ad->u.net->sport = th->source;
4313 ad->u.net->dport = th->dest;
4318 struct udphdr _udph, *uh;
4320 if (ntohs(ih->frag_off) & IP_OFFSET)
4324 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4328 ad->u.net->sport = uh->source;
4329 ad->u.net->dport = uh->dest;
4333 case IPPROTO_DCCP: {
4334 struct dccp_hdr _dccph, *dh;
4336 if (ntohs(ih->frag_off) & IP_OFFSET)
4340 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4344 ad->u.net->sport = dh->dccph_sport;
4345 ad->u.net->dport = dh->dccph_dport;
4349 #if IS_ENABLED(CONFIG_IP_SCTP)
4350 case IPPROTO_SCTP: {
4351 struct sctphdr _sctph, *sh;
4353 if (ntohs(ih->frag_off) & IP_OFFSET)
4357 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4361 ad->u.net->sport = sh->source;
4362 ad->u.net->dport = sh->dest;
4373 #if IS_ENABLED(CONFIG_IPV6)
4375 /* Returns error only if unable to parse addresses */
4376 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4377 struct common_audit_data *ad, u8 *proto)
4380 int ret = -EINVAL, offset;
4381 struct ipv6hdr _ipv6h, *ip6;
4384 offset = skb_network_offset(skb);
4385 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4389 ad->u.net->v6info.saddr = ip6->saddr;
4390 ad->u.net->v6info.daddr = ip6->daddr;
4393 nexthdr = ip6->nexthdr;
4394 offset += sizeof(_ipv6h);
4395 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4404 struct tcphdr _tcph, *th;
4406 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4410 ad->u.net->sport = th->source;
4411 ad->u.net->dport = th->dest;
4416 struct udphdr _udph, *uh;
4418 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4422 ad->u.net->sport = uh->source;
4423 ad->u.net->dport = uh->dest;
4427 case IPPROTO_DCCP: {
4428 struct dccp_hdr _dccph, *dh;
4430 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4434 ad->u.net->sport = dh->dccph_sport;
4435 ad->u.net->dport = dh->dccph_dport;
4439 #if IS_ENABLED(CONFIG_IP_SCTP)
4440 case IPPROTO_SCTP: {
4441 struct sctphdr _sctph, *sh;
4443 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4447 ad->u.net->sport = sh->source;
4448 ad->u.net->dport = sh->dest;
4452 /* includes fragments */
4462 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4463 char **_addrp, int src, u8 *proto)
4468 switch (ad->u.net->family) {
4470 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4473 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4474 &ad->u.net->v4info.daddr);
4477 #if IS_ENABLED(CONFIG_IPV6)
4479 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4482 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4483 &ad->u.net->v6info.daddr);
4493 "SELinux: failure in selinux_parse_skb(),"
4494 " unable to parse packet\n");
4504 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4506 * @family: protocol family
4507 * @sid: the packet's peer label SID
4510 * Check the various different forms of network peer labeling and determine
4511 * the peer label/SID for the packet; most of the magic actually occurs in
4512 * the security server function security_net_peersid_cmp(). The function
4513 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4514 * or -EACCES if @sid is invalid due to inconsistencies with the different
4518 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4525 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4528 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4532 err = security_net_peersid_resolve(nlbl_sid,
4533 nlbl_type, xfrm_sid, sid);
4534 if (unlikely(err)) {
4536 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4537 " unable to determine packet's peer label\n");
4545 * selinux_conn_sid - Determine the child socket label for a connection
4546 * @sk_sid: the parent socket's SID
4547 * @skb_sid: the packet's SID
4548 * @conn_sid: the resulting connection SID
4550 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4551 * combined with the MLS information from @skb_sid in order to create
4552 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4553 * of @sk_sid. Returns zero on success, negative values on failure.
4556 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4560 if (skb_sid != SECSID_NULL)
4561 err = security_sid_mls_copy(sk_sid, skb_sid,
4569 /* socket security operations */
4571 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4572 u16 secclass, u32 *socksid)
4574 if (tsec->sockcreate_sid > SECSID_NULL) {
4575 *socksid = tsec->sockcreate_sid;
4579 return security_transition_sid(tsec->sid, tsec->sid,
4580 secclass, NULL, socksid);
4583 static int sock_has_perm(struct sock *sk, u32 perms)
4585 struct sk_security_struct *sksec = sk->sk_security;
4586 struct common_audit_data ad;
4587 struct lsm_network_audit net;
4589 if (sksec->sid == SECINITSID_KERNEL)
4593 * Before POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, sockets that
4594 * inherited the kernel context from early boot used to be skipped
4595 * here, so preserve that behavior unless the capability is set.
4597 * By setting the capability the policy signals that it is ready
4598 * for this quirk to be fixed. Note that sockets created by a kernel
4599 * thread or a usermode helper executed without a transition will
4600 * still be skipped in this check regardless of the policycap
4603 if (!selinux_policycap_userspace_initial_context() &&
4604 sksec->sid == SECINITSID_INIT)
4607 ad_net_init_from_sk(&ad, &net, sk);
4609 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4613 static int selinux_socket_create(int family, int type,
4614 int protocol, int kern)
4616 const struct task_security_struct *tsec = selinux_cred(current_cred());
4624 secclass = socket_type_to_security_class(family, type, protocol);
4625 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4629 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4632 static int selinux_socket_post_create(struct socket *sock, int family,
4633 int type, int protocol, int kern)
4635 const struct task_security_struct *tsec = selinux_cred(current_cred());
4636 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4637 struct sk_security_struct *sksec;
4638 u16 sclass = socket_type_to_security_class(family, type, protocol);
4639 u32 sid = SECINITSID_KERNEL;
4643 err = socket_sockcreate_sid(tsec, sclass, &sid);
4648 isec->sclass = sclass;
4650 isec->initialized = LABEL_INITIALIZED;
4653 sksec = sock->sk->sk_security;
4654 sksec->sclass = sclass;
4656 /* Allows detection of the first association on this socket */
4657 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4658 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4660 err = selinux_netlbl_socket_post_create(sock->sk, family);
4666 static int selinux_socket_socketpair(struct socket *socka,
4667 struct socket *sockb)
4669 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4670 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4672 sksec_a->peer_sid = sksec_b->sid;
4673 sksec_b->peer_sid = sksec_a->sid;
4678 /* Range of port numbers used to automatically bind.
4679 Need to determine whether we should perform a name_bind
4680 permission check between the socket and the port number. */
4682 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4684 struct sock *sk = sock->sk;
4685 struct sk_security_struct *sksec = sk->sk_security;
4689 err = sock_has_perm(sk, SOCKET__BIND);
4693 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4694 family = sk->sk_family;
4695 if (family == PF_INET || family == PF_INET6) {
4697 struct common_audit_data ad;
4698 struct lsm_network_audit net = {0,};
4699 struct sockaddr_in *addr4 = NULL;
4700 struct sockaddr_in6 *addr6 = NULL;
4702 unsigned short snum;
4706 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4707 * that validates multiple binding addresses. Because of this
4708 * need to check address->sa_family as it is possible to have
4709 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4711 if (addrlen < offsetofend(struct sockaddr, sa_family))
4713 family_sa = address->sa_family;
4714 switch (family_sa) {
4717 if (addrlen < sizeof(struct sockaddr_in))
4719 addr4 = (struct sockaddr_in *)address;
4720 if (family_sa == AF_UNSPEC) {
4721 if (family == PF_INET6) {
4722 /* Length check from inet6_bind_sk() */
4723 if (addrlen < SIN6_LEN_RFC2133)
4725 /* Family check from __inet6_bind() */
4728 /* see __inet_bind(), we only want to allow
4729 * AF_UNSPEC if the address is INADDR_ANY
4731 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4733 family_sa = AF_INET;
4735 snum = ntohs(addr4->sin_port);
4736 addrp = (char *)&addr4->sin_addr.s_addr;
4739 if (addrlen < SIN6_LEN_RFC2133)
4741 addr6 = (struct sockaddr_in6 *)address;
4742 snum = ntohs(addr6->sin6_port);
4743 addrp = (char *)&addr6->sin6_addr.s6_addr;
4749 ad.type = LSM_AUDIT_DATA_NET;
4751 ad.u.net->sport = htons(snum);
4752 ad.u.net->family = family_sa;
4757 inet_get_local_port_range(sock_net(sk), &low, &high);
4759 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4760 snum < low || snum > high) {
4761 err = sel_netport_sid(sk->sk_protocol,
4765 err = avc_has_perm(sksec->sid, sid,
4767 SOCKET__NAME_BIND, &ad);
4773 switch (sksec->sclass) {
4774 case SECCLASS_TCP_SOCKET:
4775 node_perm = TCP_SOCKET__NODE_BIND;
4778 case SECCLASS_UDP_SOCKET:
4779 node_perm = UDP_SOCKET__NODE_BIND;
4782 case SECCLASS_DCCP_SOCKET:
4783 node_perm = DCCP_SOCKET__NODE_BIND;
4786 case SECCLASS_SCTP_SOCKET:
4787 node_perm = SCTP_SOCKET__NODE_BIND;
4791 node_perm = RAWIP_SOCKET__NODE_BIND;
4795 err = sel_netnode_sid(addrp, family_sa, &sid);
4799 if (family_sa == AF_INET)
4800 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4802 ad.u.net->v6info.saddr = addr6->sin6_addr;
4804 err = avc_has_perm(sksec->sid, sid,
4805 sksec->sclass, node_perm, &ad);
4812 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4813 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4815 return -EAFNOSUPPORT;
4818 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4819 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4821 static int selinux_socket_connect_helper(struct socket *sock,
4822 struct sockaddr *address, int addrlen)
4824 struct sock *sk = sock->sk;
4825 struct sk_security_struct *sksec = sk->sk_security;
4828 err = sock_has_perm(sk, SOCKET__CONNECT);
4831 if (addrlen < offsetofend(struct sockaddr, sa_family))
4834 /* connect(AF_UNSPEC) has special handling, as it is a documented
4835 * way to disconnect the socket
4837 if (address->sa_family == AF_UNSPEC)
4841 * If a TCP, DCCP or SCTP socket, check name_connect permission
4844 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4845 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4846 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4847 struct common_audit_data ad;
4848 struct lsm_network_audit net = {0,};
4849 struct sockaddr_in *addr4 = NULL;
4850 struct sockaddr_in6 *addr6 = NULL;
4851 unsigned short snum;
4854 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4855 * that validates multiple connect addresses. Because of this
4856 * need to check address->sa_family as it is possible to have
4857 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4859 switch (address->sa_family) {
4861 addr4 = (struct sockaddr_in *)address;
4862 if (addrlen < sizeof(struct sockaddr_in))
4864 snum = ntohs(addr4->sin_port);
4867 addr6 = (struct sockaddr_in6 *)address;
4868 if (addrlen < SIN6_LEN_RFC2133)
4870 snum = ntohs(addr6->sin6_port);
4873 /* Note that SCTP services expect -EINVAL, whereas
4874 * others expect -EAFNOSUPPORT.
4876 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4879 return -EAFNOSUPPORT;
4882 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4886 switch (sksec->sclass) {
4887 case SECCLASS_TCP_SOCKET:
4888 perm = TCP_SOCKET__NAME_CONNECT;
4890 case SECCLASS_DCCP_SOCKET:
4891 perm = DCCP_SOCKET__NAME_CONNECT;
4893 case SECCLASS_SCTP_SOCKET:
4894 perm = SCTP_SOCKET__NAME_CONNECT;
4898 ad.type = LSM_AUDIT_DATA_NET;
4900 ad.u.net->dport = htons(snum);
4901 ad.u.net->family = address->sa_family;
4902 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4910 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4911 static int selinux_socket_connect(struct socket *sock,
4912 struct sockaddr *address, int addrlen)
4915 struct sock *sk = sock->sk;
4917 err = selinux_socket_connect_helper(sock, address, addrlen);
4921 return selinux_netlbl_socket_connect(sk, address);
4924 static int selinux_socket_listen(struct socket *sock, int backlog)
4926 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4929 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4932 struct inode_security_struct *isec;
4933 struct inode_security_struct *newisec;
4937 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4941 isec = inode_security_novalidate(SOCK_INODE(sock));
4942 spin_lock(&isec->lock);
4943 sclass = isec->sclass;
4945 spin_unlock(&isec->lock);
4947 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4948 newisec->sclass = sclass;
4950 newisec->initialized = LABEL_INITIALIZED;
4955 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4958 return sock_has_perm(sock->sk, SOCKET__WRITE);
4961 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4962 int size, int flags)
4964 return sock_has_perm(sock->sk, SOCKET__READ);
4967 static int selinux_socket_getsockname(struct socket *sock)
4969 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4972 static int selinux_socket_getpeername(struct socket *sock)
4974 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4977 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4981 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4985 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4988 static int selinux_socket_getsockopt(struct socket *sock, int level,
4991 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4994 static int selinux_socket_shutdown(struct socket *sock, int how)
4996 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4999 static int selinux_socket_unix_stream_connect(struct sock *sock,
5003 struct sk_security_struct *sksec_sock = sock->sk_security;
5004 struct sk_security_struct *sksec_other = other->sk_security;
5005 struct sk_security_struct *sksec_new = newsk->sk_security;
5006 struct common_audit_data ad;
5007 struct lsm_network_audit net;
5010 ad_net_init_from_sk(&ad, &net, other);
5012 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
5013 sksec_other->sclass,
5014 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5018 /* server child socket */
5019 sksec_new->peer_sid = sksec_sock->sid;
5020 err = security_sid_mls_copy(sksec_other->sid,
5021 sksec_sock->sid, &sksec_new->sid);
5025 /* connecting socket */
5026 sksec_sock->peer_sid = sksec_new->sid;
5031 static int selinux_socket_unix_may_send(struct socket *sock,
5032 struct socket *other)
5034 struct sk_security_struct *ssec = sock->sk->sk_security;
5035 struct sk_security_struct *osec = other->sk->sk_security;
5036 struct common_audit_data ad;
5037 struct lsm_network_audit net;
5039 ad_net_init_from_sk(&ad, &net, other->sk);
5041 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5045 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5046 char *addrp, u16 family, u32 peer_sid,
5047 struct common_audit_data *ad)
5053 err = sel_netif_sid(ns, ifindex, &if_sid);
5056 err = avc_has_perm(peer_sid, if_sid,
5057 SECCLASS_NETIF, NETIF__INGRESS, ad);
5061 err = sel_netnode_sid(addrp, family, &node_sid);
5064 return avc_has_perm(peer_sid, node_sid,
5065 SECCLASS_NODE, NODE__RECVFROM, ad);
5068 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5072 struct sk_security_struct *sksec = sk->sk_security;
5073 u32 sk_sid = sksec->sid;
5074 struct common_audit_data ad;
5075 struct lsm_network_audit net;
5078 ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
5079 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5083 if (selinux_secmark_enabled()) {
5084 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5090 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5093 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5098 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5100 int err, peerlbl_active, secmark_active;
5101 struct sk_security_struct *sksec = sk->sk_security;
5102 u16 family = sk->sk_family;
5103 u32 sk_sid = sksec->sid;
5104 struct common_audit_data ad;
5105 struct lsm_network_audit net;
5108 if (family != PF_INET && family != PF_INET6)
5111 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5112 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5115 /* If any sort of compatibility mode is enabled then handoff processing
5116 * to the selinux_sock_rcv_skb_compat() function to deal with the
5117 * special handling. We do this in an attempt to keep this function
5118 * as fast and as clean as possible. */
5119 if (!selinux_policycap_netpeer())
5120 return selinux_sock_rcv_skb_compat(sk, skb, family);
5122 secmark_active = selinux_secmark_enabled();
5123 peerlbl_active = selinux_peerlbl_enabled();
5124 if (!secmark_active && !peerlbl_active)
5127 ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
5128 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5132 if (peerlbl_active) {
5135 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5138 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5139 addrp, family, peer_sid, &ad);
5141 selinux_netlbl_err(skb, family, err, 0);
5144 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
5147 selinux_netlbl_err(skb, family, err, 0);
5152 if (secmark_active) {
5153 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5162 static int selinux_socket_getpeersec_stream(struct socket *sock,
5163 sockptr_t optval, sockptr_t optlen,
5167 char *scontext = NULL;
5169 struct sk_security_struct *sksec = sock->sk->sk_security;
5170 u32 peer_sid = SECSID_NULL;
5172 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5173 sksec->sclass == SECCLASS_TCP_SOCKET ||
5174 sksec->sclass == SECCLASS_SCTP_SOCKET)
5175 peer_sid = sksec->peer_sid;
5176 if (peer_sid == SECSID_NULL)
5177 return -ENOPROTOOPT;
5179 err = security_sid_to_context(peer_sid, &scontext,
5183 if (scontext_len > len) {
5188 if (copy_to_sockptr(optval, scontext, scontext_len))
5191 if (copy_to_sockptr(optlen, &scontext_len, sizeof(scontext_len)))
5197 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
5199 u32 peer_secid = SECSID_NULL;
5201 struct inode_security_struct *isec;
5203 if (skb && skb->protocol == htons(ETH_P_IP))
5205 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5208 family = sock->sk->sk_family;
5212 if (sock && family == PF_UNIX) {
5213 isec = inode_security_novalidate(SOCK_INODE(sock));
5214 peer_secid = isec->sid;
5216 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5219 *secid = peer_secid;
5220 if (peer_secid == SECSID_NULL)
5225 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5227 struct sk_security_struct *sksec;
5229 sksec = kzalloc(sizeof(*sksec), priority);
5233 sksec->peer_sid = SECINITSID_UNLABELED;
5234 sksec->sid = SECINITSID_UNLABELED;
5235 sksec->sclass = SECCLASS_SOCKET;
5236 selinux_netlbl_sk_security_reset(sksec);
5237 sk->sk_security = sksec;
5242 static void selinux_sk_free_security(struct sock *sk)
5244 struct sk_security_struct *sksec = sk->sk_security;
5246 sk->sk_security = NULL;
5247 selinux_netlbl_sk_security_free(sksec);
5251 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5253 struct sk_security_struct *sksec = sk->sk_security;
5254 struct sk_security_struct *newsksec = newsk->sk_security;
5256 newsksec->sid = sksec->sid;
5257 newsksec->peer_sid = sksec->peer_sid;
5258 newsksec->sclass = sksec->sclass;
5260 selinux_netlbl_sk_security_reset(newsksec);
5263 static void selinux_sk_getsecid(const struct sock *sk, u32 *secid)
5266 *secid = SECINITSID_ANY_SOCKET;
5268 const struct sk_security_struct *sksec = sk->sk_security;
5270 *secid = sksec->sid;
5274 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5276 struct inode_security_struct *isec =
5277 inode_security_novalidate(SOCK_INODE(parent));
5278 struct sk_security_struct *sksec = sk->sk_security;
5280 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5281 sk->sk_family == PF_UNIX)
5282 isec->sid = sksec->sid;
5283 sksec->sclass = isec->sclass;
5287 * Determines peer_secid for the asoc and updates socket's peer label
5288 * if it's the first association on the socket.
5290 static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5291 struct sk_buff *skb)
5293 struct sock *sk = asoc->base.sk;
5294 u16 family = sk->sk_family;
5295 struct sk_security_struct *sksec = sk->sk_security;
5296 struct common_audit_data ad;
5297 struct lsm_network_audit net;
5300 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5301 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5304 if (selinux_peerlbl_enabled()) {
5305 asoc->peer_secid = SECSID_NULL;
5307 /* This will return peer_sid = SECSID_NULL if there are
5308 * no peer labels, see security_net_peersid_resolve().
5310 err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
5314 if (asoc->peer_secid == SECSID_NULL)
5315 asoc->peer_secid = SECINITSID_UNLABELED;
5317 asoc->peer_secid = SECINITSID_UNLABELED;
5320 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5321 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5323 /* Here as first association on socket. As the peer SID
5324 * was allowed by peer recv (and the netif/node checks),
5325 * then it is approved by policy and used as the primary
5326 * peer SID for getpeercon(3).
5328 sksec->peer_sid = asoc->peer_secid;
5329 } else if (sksec->peer_sid != asoc->peer_secid) {
5330 /* Other association peer SIDs are checked to enforce
5331 * consistency among the peer SIDs.
5333 ad_net_init_from_sk(&ad, &net, asoc->base.sk);
5334 err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
5335 sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5343 /* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5344 * happens on an incoming connect(2), sctp_connectx(3) or
5345 * sctp_sendmsg(3) (with no association already present).
5347 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5348 struct sk_buff *skb)
5350 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5354 if (!selinux_policycap_extsockclass())
5357 err = selinux_sctp_process_new_assoc(asoc, skb);
5361 /* Compute the MLS component for the connection and store
5362 * the information in asoc. This will be used by SCTP TCP type
5363 * sockets and peeled off connections as they cause a new
5364 * socket to be generated. selinux_sctp_sk_clone() will then
5365 * plug this into the new socket.
5367 err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5371 asoc->secid = conn_sid;
5373 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5374 return selinux_netlbl_sctp_assoc_request(asoc, skb);
5377 /* Called when SCTP receives a COOKIE ACK chunk as the final
5378 * response to an association request (initited by us).
5380 static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5381 struct sk_buff *skb)
5383 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5385 if (!selinux_policycap_extsockclass())
5388 /* Inherit secid from the parent socket - this will be picked up
5389 * by selinux_sctp_sk_clone() if the association gets peeled off
5390 * into a new socket.
5392 asoc->secid = sksec->sid;
5394 return selinux_sctp_process_new_assoc(asoc, skb);
5397 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5398 * based on their @optname.
5400 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5401 struct sockaddr *address,
5404 int len, err = 0, walk_size = 0;
5406 struct sockaddr *addr;
5407 struct socket *sock;
5409 if (!selinux_policycap_extsockclass())
5412 /* Process one or more addresses that may be IPv4 or IPv6 */
5413 sock = sk->sk_socket;
5416 while (walk_size < addrlen) {
5417 if (walk_size + sizeof(sa_family_t) > addrlen)
5421 switch (addr->sa_family) {
5424 len = sizeof(struct sockaddr_in);
5427 len = sizeof(struct sockaddr_in6);
5433 if (walk_size + len > addrlen)
5439 case SCTP_PRIMARY_ADDR:
5440 case SCTP_SET_PEER_PRIMARY_ADDR:
5441 case SCTP_SOCKOPT_BINDX_ADD:
5442 err = selinux_socket_bind(sock, addr, len);
5444 /* Connect checks */
5445 case SCTP_SOCKOPT_CONNECTX:
5446 case SCTP_PARAM_SET_PRIMARY:
5447 case SCTP_PARAM_ADD_IP:
5448 case SCTP_SENDMSG_CONNECT:
5449 err = selinux_socket_connect_helper(sock, addr, len);
5453 /* As selinux_sctp_bind_connect() is called by the
5454 * SCTP protocol layer, the socket is already locked,
5455 * therefore selinux_netlbl_socket_connect_locked()
5456 * is called here. The situations handled are:
5457 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5458 * whenever a new IP address is added or when a new
5459 * primary address is selected.
5460 * Note that an SCTP connect(2) call happens before
5461 * the SCTP protocol layer and is handled via
5462 * selinux_socket_connect().
5464 err = selinux_netlbl_socket_connect_locked(sk, addr);
5478 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5479 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5482 struct sk_security_struct *sksec = sk->sk_security;
5483 struct sk_security_struct *newsksec = newsk->sk_security;
5485 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5486 * the non-sctp clone version.
5488 if (!selinux_policycap_extsockclass())
5489 return selinux_sk_clone_security(sk, newsk);
5491 newsksec->sid = asoc->secid;
5492 newsksec->peer_sid = asoc->peer_secid;
5493 newsksec->sclass = sksec->sclass;
5494 selinux_netlbl_sctp_sk_clone(sk, newsk);
5497 static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
5499 struct sk_security_struct *ssksec = ssk->sk_security;
5500 struct sk_security_struct *sksec = sk->sk_security;
5502 ssksec->sclass = sksec->sclass;
5503 ssksec->sid = sksec->sid;
5505 /* replace the existing subflow label deleting the existing one
5506 * and re-recreating a new label using the updated context
5508 selinux_netlbl_sk_security_free(ssksec);
5509 return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
5512 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5513 struct request_sock *req)
5515 struct sk_security_struct *sksec = sk->sk_security;
5517 u16 family = req->rsk_ops->family;
5521 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5524 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5527 req->secid = connsid;
5528 req->peer_secid = peersid;
5530 return selinux_netlbl_inet_conn_request(req, family);
5533 static void selinux_inet_csk_clone(struct sock *newsk,
5534 const struct request_sock *req)
5536 struct sk_security_struct *newsksec = newsk->sk_security;
5538 newsksec->sid = req->secid;
5539 newsksec->peer_sid = req->peer_secid;
5540 /* NOTE: Ideally, we should also get the isec->sid for the
5541 new socket in sync, but we don't have the isec available yet.
5542 So we will wait until sock_graft to do it, by which
5543 time it will have been created and available. */
5545 /* We don't need to take any sort of lock here as we are the only
5546 * thread with access to newsksec */
5547 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5550 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5552 u16 family = sk->sk_family;
5553 struct sk_security_struct *sksec = sk->sk_security;
5555 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5556 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5559 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5562 static int selinux_secmark_relabel_packet(u32 sid)
5564 const struct task_security_struct *tsec;
5567 tsec = selinux_cred(current_cred());
5570 return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO,
5574 static void selinux_secmark_refcount_inc(void)
5576 atomic_inc(&selinux_secmark_refcount);
5579 static void selinux_secmark_refcount_dec(void)
5581 atomic_dec(&selinux_secmark_refcount);
5584 static void selinux_req_classify_flow(const struct request_sock *req,
5585 struct flowi_common *flic)
5587 flic->flowic_secid = req->secid;
5590 static int selinux_tun_dev_alloc_security(void **security)
5592 struct tun_security_struct *tunsec;
5594 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5597 tunsec->sid = current_sid();
5603 static void selinux_tun_dev_free_security(void *security)
5608 static int selinux_tun_dev_create(void)
5610 u32 sid = current_sid();
5612 /* we aren't taking into account the "sockcreate" SID since the socket
5613 * that is being created here is not a socket in the traditional sense,
5614 * instead it is a private sock, accessible only to the kernel, and
5615 * representing a wide range of network traffic spanning multiple
5616 * connections unlike traditional sockets - check the TUN driver to
5617 * get a better understanding of why this socket is special */
5619 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5623 static int selinux_tun_dev_attach_queue(void *security)
5625 struct tun_security_struct *tunsec = security;
5627 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5628 TUN_SOCKET__ATTACH_QUEUE, NULL);
5631 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5633 struct tun_security_struct *tunsec = security;
5634 struct sk_security_struct *sksec = sk->sk_security;
5636 /* we don't currently perform any NetLabel based labeling here and it
5637 * isn't clear that we would want to do so anyway; while we could apply
5638 * labeling without the support of the TUN user the resulting labeled
5639 * traffic from the other end of the connection would almost certainly
5640 * cause confusion to the TUN user that had no idea network labeling
5641 * protocols were being used */
5643 sksec->sid = tunsec->sid;
5644 sksec->sclass = SECCLASS_TUN_SOCKET;
5649 static int selinux_tun_dev_open(void *security)
5651 struct tun_security_struct *tunsec = security;
5652 u32 sid = current_sid();
5655 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5656 TUN_SOCKET__RELABELFROM, NULL);
5659 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5660 TUN_SOCKET__RELABELTO, NULL);
5668 #ifdef CONFIG_NETFILTER
5670 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5671 const struct nf_hook_state *state)
5677 struct common_audit_data ad;
5678 struct lsm_network_audit net;
5679 int secmark_active, peerlbl_active;
5681 if (!selinux_policycap_netpeer())
5684 secmark_active = selinux_secmark_enabled();
5685 peerlbl_active = selinux_peerlbl_enabled();
5686 if (!secmark_active && !peerlbl_active)
5690 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5693 ifindex = state->in->ifindex;
5694 ad_net_init_from_iif(&ad, &net, ifindex, family);
5695 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5698 if (peerlbl_active) {
5701 err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5702 addrp, family, peer_sid, &ad);
5704 selinux_netlbl_err(skb, family, err, 1);
5710 if (avc_has_perm(peer_sid, skb->secmark,
5711 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5714 if (netlbl_enabled())
5715 /* we do this in the FORWARD path and not the POST_ROUTING
5716 * path because we want to make sure we apply the necessary
5717 * labeling before IPsec is applied so we can leverage AH
5719 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5725 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5726 const struct nf_hook_state *state)
5731 if (!netlbl_enabled())
5734 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5735 * because we want to make sure we apply the necessary labeling
5736 * before IPsec is applied so we can leverage AH protection */
5739 struct sk_security_struct *sksec;
5741 if (sk_listener(sk))
5742 /* if the socket is the listening state then this
5743 * packet is a SYN-ACK packet which means it needs to
5744 * be labeled based on the connection/request_sock and
5745 * not the parent socket. unfortunately, we can't
5746 * lookup the request_sock yet as it isn't queued on
5747 * the parent socket until after the SYN-ACK is sent.
5748 * the "solution" is to simply pass the packet as-is
5749 * as any IP option based labeling should be copied
5750 * from the initial connection request (in the IP
5751 * layer). it is far from ideal, but until we get a
5752 * security label in the packet itself this is the
5753 * best we can do. */
5756 /* standard practice, label using the parent socket */
5757 sksec = sk->sk_security;
5760 sid = SECINITSID_KERNEL;
5761 if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5768 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5769 const struct nf_hook_state *state)
5772 struct sk_security_struct *sksec;
5773 struct common_audit_data ad;
5774 struct lsm_network_audit net;
5777 sk = skb_to_full_sk(skb);
5780 sksec = sk->sk_security;
5782 ad_net_init_from_iif(&ad, &net, state->out->ifindex, state->pf);
5783 if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
5786 if (selinux_secmark_enabled())
5787 if (avc_has_perm(sksec->sid, skb->secmark,
5788 SECCLASS_PACKET, PACKET__SEND, &ad))
5789 return NF_DROP_ERR(-ECONNREFUSED);
5791 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5792 return NF_DROP_ERR(-ECONNREFUSED);
5797 static unsigned int selinux_ip_postroute(void *priv,
5798 struct sk_buff *skb,
5799 const struct nf_hook_state *state)
5806 struct common_audit_data ad;
5807 struct lsm_network_audit net;
5809 int secmark_active, peerlbl_active;
5811 /* If any sort of compatibility mode is enabled then handoff processing
5812 * to the selinux_ip_postroute_compat() function to deal with the
5813 * special handling. We do this in an attempt to keep this function
5814 * as fast and as clean as possible. */
5815 if (!selinux_policycap_netpeer())
5816 return selinux_ip_postroute_compat(skb, state);
5818 secmark_active = selinux_secmark_enabled();
5819 peerlbl_active = selinux_peerlbl_enabled();
5820 if (!secmark_active && !peerlbl_active)
5823 sk = skb_to_full_sk(skb);
5826 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5827 * packet transformation so allow the packet to pass without any checks
5828 * since we'll have another chance to perform access control checks
5829 * when the packet is on it's final way out.
5830 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5831 * is NULL, in this case go ahead and apply access control.
5832 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5833 * TCP listening state we cannot wait until the XFRM processing
5834 * is done as we will miss out on the SA label if we do;
5835 * unfortunately, this means more work, but it is only once per
5837 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5838 !(sk && sk_listener(sk)))
5844 /* Without an associated socket the packet is either coming
5845 * from the kernel or it is being forwarded; check the packet
5846 * to determine which and if the packet is being forwarded
5847 * query the packet directly to determine the security label. */
5849 secmark_perm = PACKET__FORWARD_OUT;
5850 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5853 secmark_perm = PACKET__SEND;
5854 peer_sid = SECINITSID_KERNEL;
5856 } else if (sk_listener(sk)) {
5857 /* Locally generated packet but the associated socket is in the
5858 * listening state which means this is a SYN-ACK packet. In
5859 * this particular case the correct security label is assigned
5860 * to the connection/request_sock but unfortunately we can't
5861 * query the request_sock as it isn't queued on the parent
5862 * socket until after the SYN-ACK packet is sent; the only
5863 * viable choice is to regenerate the label like we do in
5864 * selinux_inet_conn_request(). See also selinux_ip_output()
5865 * for similar problems. */
5867 struct sk_security_struct *sksec;
5869 sksec = sk->sk_security;
5870 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5872 /* At this point, if the returned skb peerlbl is SECSID_NULL
5873 * and the packet has been through at least one XFRM
5874 * transformation then we must be dealing with the "final"
5875 * form of labeled IPsec packet; since we've already applied
5876 * all of our access controls on this packet we can safely
5877 * pass the packet. */
5878 if (skb_sid == SECSID_NULL) {
5881 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5885 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5889 return NF_DROP_ERR(-ECONNREFUSED);
5892 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5894 secmark_perm = PACKET__SEND;
5896 /* Locally generated packet, fetch the security label from the
5897 * associated socket. */
5898 struct sk_security_struct *sksec = sk->sk_security;
5899 peer_sid = sksec->sid;
5900 secmark_perm = PACKET__SEND;
5903 ifindex = state->out->ifindex;
5904 ad_net_init_from_iif(&ad, &net, ifindex, family);
5905 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5909 if (avc_has_perm(peer_sid, skb->secmark,
5910 SECCLASS_PACKET, secmark_perm, &ad))
5911 return NF_DROP_ERR(-ECONNREFUSED);
5913 if (peerlbl_active) {
5917 if (sel_netif_sid(state->net, ifindex, &if_sid))
5919 if (avc_has_perm(peer_sid, if_sid,
5920 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5921 return NF_DROP_ERR(-ECONNREFUSED);
5923 if (sel_netnode_sid(addrp, family, &node_sid))
5925 if (avc_has_perm(peer_sid, node_sid,
5926 SECCLASS_NODE, NODE__SENDTO, &ad))
5927 return NF_DROP_ERR(-ECONNREFUSED);
5932 #endif /* CONFIG_NETFILTER */
5934 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5937 unsigned int msg_len;
5938 unsigned int data_len = skb->len;
5939 unsigned char *data = skb->data;
5940 struct nlmsghdr *nlh;
5941 struct sk_security_struct *sksec = sk->sk_security;
5942 u16 sclass = sksec->sclass;
5945 while (data_len >= nlmsg_total_size(0)) {
5946 nlh = (struct nlmsghdr *)data;
5948 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5949 * users which means we can't reject skb's with bogus
5950 * length fields; our solution is to follow what
5951 * netlink_rcv_skb() does and simply skip processing at
5952 * messages with length fields that are clearly junk
5954 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5957 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5959 rc = sock_has_perm(sk, perm);
5962 } else if (rc == -EINVAL) {
5963 /* -EINVAL is a missing msg/perm mapping */
5964 pr_warn_ratelimited("SELinux: unrecognized netlink"
5965 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5966 " pid=%d comm=%s\n",
5967 sk->sk_protocol, nlh->nlmsg_type,
5968 secclass_map[sclass - 1].name,
5969 task_pid_nr(current), current->comm);
5970 if (enforcing_enabled() &&
5971 !security_get_allow_unknown())
5974 } else if (rc == -ENOENT) {
5975 /* -ENOENT is a missing socket/class mapping, ignore */
5981 /* move to the next message after applying netlink padding */
5982 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5983 if (msg_len >= data_len)
5985 data_len -= msg_len;
5992 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5994 isec->sclass = sclass;
5995 isec->sid = current_sid();
5998 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
6001 struct ipc_security_struct *isec;
6002 struct common_audit_data ad;
6003 u32 sid = current_sid();
6005 isec = selinux_ipc(ipc_perms);
6007 ad.type = LSM_AUDIT_DATA_IPC;
6008 ad.u.ipc_id = ipc_perms->key;
6010 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
6013 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6015 struct msg_security_struct *msec;
6017 msec = selinux_msg_msg(msg);
6018 msec->sid = SECINITSID_UNLABELED;
6023 /* message queue security operations */
6024 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6026 struct ipc_security_struct *isec;
6027 struct common_audit_data ad;
6028 u32 sid = current_sid();
6030 isec = selinux_ipc(msq);
6031 ipc_init_security(isec, SECCLASS_MSGQ);
6033 ad.type = LSM_AUDIT_DATA_IPC;
6034 ad.u.ipc_id = msq->key;
6036 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6040 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6042 struct ipc_security_struct *isec;
6043 struct common_audit_data ad;
6044 u32 sid = current_sid();
6046 isec = selinux_ipc(msq);
6048 ad.type = LSM_AUDIT_DATA_IPC;
6049 ad.u.ipc_id = msq->key;
6051 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6052 MSGQ__ASSOCIATE, &ad);
6055 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6062 /* No specific object, just general system-wide information. */
6063 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6064 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6068 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6071 perms = MSGQ__SETATTR;
6074 perms = MSGQ__DESTROY;
6080 return ipc_has_perm(msq, perms);
6083 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6085 struct ipc_security_struct *isec;
6086 struct msg_security_struct *msec;
6087 struct common_audit_data ad;
6088 u32 sid = current_sid();
6091 isec = selinux_ipc(msq);
6092 msec = selinux_msg_msg(msg);
6095 * First time through, need to assign label to the message
6097 if (msec->sid == SECINITSID_UNLABELED) {
6099 * Compute new sid based on current process and
6100 * message queue this message will be stored in
6102 rc = security_transition_sid(sid, isec->sid,
6103 SECCLASS_MSG, NULL, &msec->sid);
6108 ad.type = LSM_AUDIT_DATA_IPC;
6109 ad.u.ipc_id = msq->key;
6111 /* Can this process write to the queue? */
6112 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6115 /* Can this process send the message */
6116 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
6119 /* Can the message be put in the queue? */
6120 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
6121 MSGQ__ENQUEUE, &ad);
6126 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6127 struct task_struct *target,
6128 long type, int mode)
6130 struct ipc_security_struct *isec;
6131 struct msg_security_struct *msec;
6132 struct common_audit_data ad;
6133 u32 sid = task_sid_obj(target);
6136 isec = selinux_ipc(msq);
6137 msec = selinux_msg_msg(msg);
6139 ad.type = LSM_AUDIT_DATA_IPC;
6140 ad.u.ipc_id = msq->key;
6142 rc = avc_has_perm(sid, isec->sid,
6143 SECCLASS_MSGQ, MSGQ__READ, &ad);
6145 rc = avc_has_perm(sid, msec->sid,
6146 SECCLASS_MSG, MSG__RECEIVE, &ad);
6150 /* Shared Memory security operations */
6151 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6153 struct ipc_security_struct *isec;
6154 struct common_audit_data ad;
6155 u32 sid = current_sid();
6157 isec = selinux_ipc(shp);
6158 ipc_init_security(isec, SECCLASS_SHM);
6160 ad.type = LSM_AUDIT_DATA_IPC;
6161 ad.u.ipc_id = shp->key;
6163 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6167 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6169 struct ipc_security_struct *isec;
6170 struct common_audit_data ad;
6171 u32 sid = current_sid();
6173 isec = selinux_ipc(shp);
6175 ad.type = LSM_AUDIT_DATA_IPC;
6176 ad.u.ipc_id = shp->key;
6178 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6179 SHM__ASSOCIATE, &ad);
6182 /* Note, at this point, shp is locked down */
6183 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6190 /* No specific object, just general system-wide information. */
6191 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6192 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6196 perms = SHM__GETATTR | SHM__ASSOCIATE;
6199 perms = SHM__SETATTR;
6206 perms = SHM__DESTROY;
6212 return ipc_has_perm(shp, perms);
6215 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6216 char __user *shmaddr, int shmflg)
6220 if (shmflg & SHM_RDONLY)
6223 perms = SHM__READ | SHM__WRITE;
6225 return ipc_has_perm(shp, perms);
6228 /* Semaphore security operations */
6229 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6231 struct ipc_security_struct *isec;
6232 struct common_audit_data ad;
6233 u32 sid = current_sid();
6235 isec = selinux_ipc(sma);
6236 ipc_init_security(isec, SECCLASS_SEM);
6238 ad.type = LSM_AUDIT_DATA_IPC;
6239 ad.u.ipc_id = sma->key;
6241 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6245 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6247 struct ipc_security_struct *isec;
6248 struct common_audit_data ad;
6249 u32 sid = current_sid();
6251 isec = selinux_ipc(sma);
6253 ad.type = LSM_AUDIT_DATA_IPC;
6254 ad.u.ipc_id = sma->key;
6256 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6257 SEM__ASSOCIATE, &ad);
6260 /* Note, at this point, sma is locked down */
6261 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6269 /* No specific object, just general system-wide information. */
6270 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6271 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6275 perms = SEM__GETATTR;
6286 perms = SEM__DESTROY;
6289 perms = SEM__SETATTR;
6294 perms = SEM__GETATTR | SEM__ASSOCIATE;
6300 err = ipc_has_perm(sma, perms);
6304 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6305 struct sembuf *sops, unsigned nsops, int alter)
6310 perms = SEM__READ | SEM__WRITE;
6314 return ipc_has_perm(sma, perms);
6317 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6323 av |= IPC__UNIX_READ;
6325 av |= IPC__UNIX_WRITE;
6330 return ipc_has_perm(ipcp, av);
6333 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6335 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6339 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6342 inode_doinit_with_dentry(inode, dentry);
6345 static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
6348 const struct task_security_struct *__tsec;
6354 __tsec = selinux_cred(__task_cred(p));
6357 error = avc_has_perm(current_sid(), __tsec->sid,
6358 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6364 case LSM_ATTR_CURRENT:
6371 sid = __tsec->exec_sid;
6373 case LSM_ATTR_FSCREATE:
6374 sid = __tsec->create_sid;
6376 case LSM_ATTR_KEYCREATE:
6377 sid = __tsec->keycreate_sid;
6379 case LSM_ATTR_SOCKCREATE:
6380 sid = __tsec->sockcreate_sid;
6383 error = -EOPNOTSUPP;
6391 error = security_sid_to_context(sid, value, &len);
6401 static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
6403 struct task_security_struct *tsec;
6405 u32 mysid = current_sid(), sid = 0, ptsid;
6410 * Basic control over ability to set these attributes at all.
6414 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6415 PROCESS__SETEXEC, NULL);
6417 case LSM_ATTR_FSCREATE:
6418 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6419 PROCESS__SETFSCREATE, NULL);
6421 case LSM_ATTR_KEYCREATE:
6422 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6423 PROCESS__SETKEYCREATE, NULL);
6425 case LSM_ATTR_SOCKCREATE:
6426 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6427 PROCESS__SETSOCKCREATE, NULL);
6429 case LSM_ATTR_CURRENT:
6430 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6431 PROCESS__SETCURRENT, NULL);
6434 error = -EOPNOTSUPP;
6440 /* Obtain a SID for the context, if one was specified. */
6441 if (size && str[0] && str[0] != '\n') {
6442 if (str[size-1] == '\n') {
6446 error = security_context_to_sid(value, size,
6448 if (error == -EINVAL && attr == LSM_ATTR_FSCREATE) {
6449 if (!has_cap_mac_admin(true)) {
6450 struct audit_buffer *ab;
6453 /* We strip a nul only if it is at the end,
6454 * otherwise the context contains a nul and
6455 * we should audit that */
6456 if (str[size - 1] == '\0')
6457 audit_size = size - 1;
6460 ab = audit_log_start(audit_context(),
6465 audit_log_format(ab, "op=fscreate invalid_context=");
6466 audit_log_n_untrustedstring(ab, value,
6472 error = security_context_to_sid_force(value, size,
6479 new = prepare_creds();
6483 /* Permission checking based on the specified context is
6484 performed during the actual operation (execve,
6485 open/mkdir/...), when we know the full context of the
6486 operation. See selinux_bprm_creds_for_exec for the execve
6487 checks and may_create for the file creation checks. The
6488 operation will then fail if the context is not permitted. */
6489 tsec = selinux_cred(new);
6490 if (attr == LSM_ATTR_EXEC) {
6491 tsec->exec_sid = sid;
6492 } else if (attr == LSM_ATTR_FSCREATE) {
6493 tsec->create_sid = sid;
6494 } else if (attr == LSM_ATTR_KEYCREATE) {
6496 error = avc_has_perm(mysid, sid,
6497 SECCLASS_KEY, KEY__CREATE, NULL);
6501 tsec->keycreate_sid = sid;
6502 } else if (attr == LSM_ATTR_SOCKCREATE) {
6503 tsec->sockcreate_sid = sid;
6504 } else if (attr == LSM_ATTR_CURRENT) {
6509 if (!current_is_single_threaded()) {
6510 error = security_bounded_transition(tsec->sid, sid);
6515 /* Check permissions for the transition. */
6516 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6517 PROCESS__DYNTRANSITION, NULL);
6521 /* Check for ptracing, and update the task SID if ok.
6522 Otherwise, leave SID unchanged and fail. */
6523 ptsid = ptrace_parent_sid();
6525 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6526 PROCESS__PTRACE, NULL);
6546 * selinux_getselfattr - Get SELinux current task attributes
6547 * @attr: the requested attribute
6548 * @ctx: buffer to receive the result
6549 * @size: buffer size (input), buffer size used (output)
6552 * Fill the passed user space @ctx with the details of the requested
6555 * Returns the number of attributes on success, an error code otherwise.
6556 * There will only ever be one attribute.
6558 static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
6559 size_t *size, u32 flags)
6565 val_len = selinux_lsm_getattr(attr, current, &val);
6568 rc = lsm_fill_user_ctx(ctx, size, val, val_len, LSM_ID_SELINUX, 0);
6570 return (!rc ? 1 : rc);
6573 static int selinux_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
6574 size_t size, u32 flags)
6578 rc = selinux_lsm_setattr(attr, ctx->ctx, ctx->ctx_len);
6584 static int selinux_getprocattr(struct task_struct *p,
6585 const char *name, char **value)
6587 unsigned int attr = lsm_name_to_attr(name);
6591 rc = selinux_lsm_getattr(attr, p, value);
6592 if (rc != -EOPNOTSUPP)
6599 static int selinux_setprocattr(const char *name, void *value, size_t size)
6601 int attr = lsm_name_to_attr(name);
6604 return selinux_lsm_setattr(attr, value, size);
6608 static int selinux_ismaclabel(const char *name)
6610 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6613 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6615 return security_sid_to_context(secid,
6619 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6621 return security_context_to_sid(secdata, seclen,
6625 static void selinux_release_secctx(char *secdata, u32 seclen)
6630 static void selinux_inode_invalidate_secctx(struct inode *inode)
6632 struct inode_security_struct *isec = selinux_inode(inode);
6634 spin_lock(&isec->lock);
6635 isec->initialized = LABEL_INVALID;
6636 spin_unlock(&isec->lock);
6640 * called with inode->i_mutex locked
6642 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6644 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6646 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6647 return rc == -EOPNOTSUPP ? 0 : rc;
6651 * called with inode->i_mutex locked
6653 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6655 return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
6659 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6662 len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
6663 XATTR_SELINUX_SUFFIX, ctx, true);
6671 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6672 unsigned long flags)
6674 const struct task_security_struct *tsec;
6675 struct key_security_struct *ksec;
6677 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6681 tsec = selinux_cred(cred);
6682 if (tsec->keycreate_sid)
6683 ksec->sid = tsec->keycreate_sid;
6685 ksec->sid = tsec->sid;
6691 static void selinux_key_free(struct key *k)
6693 struct key_security_struct *ksec = k->security;
6699 static int selinux_key_permission(key_ref_t key_ref,
6700 const struct cred *cred,
6701 enum key_need_perm need_perm)
6704 struct key_security_struct *ksec;
6707 switch (need_perm) {
6714 case KEY_NEED_WRITE:
6717 case KEY_NEED_SEARCH:
6723 case KEY_NEED_SETATTR:
6724 perm = KEY__SETATTR;
6726 case KEY_NEED_UNLINK:
6727 case KEY_SYSADMIN_OVERRIDE:
6728 case KEY_AUTHTOKEN_OVERRIDE:
6729 case KEY_DEFER_PERM_CHECK:
6737 sid = cred_sid(cred);
6738 key = key_ref_to_ptr(key_ref);
6739 ksec = key->security;
6741 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6744 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6746 struct key_security_struct *ksec = key->security;
6747 char *context = NULL;
6751 rc = security_sid_to_context(ksec->sid,
6759 #ifdef CONFIG_KEY_NOTIFICATIONS
6760 static int selinux_watch_key(struct key *key)
6762 struct key_security_struct *ksec = key->security;
6763 u32 sid = current_sid();
6765 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6770 #ifdef CONFIG_SECURITY_INFINIBAND
6771 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6773 struct common_audit_data ad;
6776 struct ib_security_struct *sec = ib_sec;
6777 struct lsm_ibpkey_audit ibpkey;
6779 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6783 ad.type = LSM_AUDIT_DATA_IBPKEY;
6784 ibpkey.subnet_prefix = subnet_prefix;
6785 ibpkey.pkey = pkey_val;
6786 ad.u.ibpkey = &ibpkey;
6787 return avc_has_perm(sec->sid, sid,
6788 SECCLASS_INFINIBAND_PKEY,
6789 INFINIBAND_PKEY__ACCESS, &ad);
6792 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6795 struct common_audit_data ad;
6798 struct ib_security_struct *sec = ib_sec;
6799 struct lsm_ibendport_audit ibendport;
6801 err = security_ib_endport_sid(dev_name, port_num,
6807 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6808 ibendport.dev_name = dev_name;
6809 ibendport.port = port_num;
6810 ad.u.ibendport = &ibendport;
6811 return avc_has_perm(sec->sid, sid,
6812 SECCLASS_INFINIBAND_ENDPORT,
6813 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6816 static int selinux_ib_alloc_security(void **ib_sec)
6818 struct ib_security_struct *sec;
6820 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6823 sec->sid = current_sid();
6829 static void selinux_ib_free_security(void *ib_sec)
6835 #ifdef CONFIG_BPF_SYSCALL
6836 static int selinux_bpf(int cmd, union bpf_attr *attr,
6839 u32 sid = current_sid();
6843 case BPF_MAP_CREATE:
6844 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6848 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6859 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6863 if (fmode & FMODE_READ)
6864 av |= BPF__MAP_READ;
6865 if (fmode & FMODE_WRITE)
6866 av |= BPF__MAP_WRITE;
6870 /* This function will check the file pass through unix socket or binder to see
6871 * if it is a bpf related object. And apply corresponding checks on the bpf
6872 * object based on the type. The bpf maps and programs, not like other files and
6873 * socket, are using a shared anonymous inode inside the kernel as their inode.
6874 * So checking that inode cannot identify if the process have privilege to
6875 * access the bpf object and that's why we have to add this additional check in
6876 * selinux_file_receive and selinux_binder_transfer_files.
6878 static int bpf_fd_pass(const struct file *file, u32 sid)
6880 struct bpf_security_struct *bpfsec;
6881 struct bpf_prog *prog;
6882 struct bpf_map *map;
6885 if (file->f_op == &bpf_map_fops) {
6886 map = file->private_data;
6887 bpfsec = map->security;
6888 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6889 bpf_map_fmode_to_av(file->f_mode), NULL);
6892 } else if (file->f_op == &bpf_prog_fops) {
6893 prog = file->private_data;
6894 bpfsec = prog->aux->security;
6895 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6896 BPF__PROG_RUN, NULL);
6903 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6905 u32 sid = current_sid();
6906 struct bpf_security_struct *bpfsec;
6908 bpfsec = map->security;
6909 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6910 bpf_map_fmode_to_av(fmode), NULL);
6913 static int selinux_bpf_prog(struct bpf_prog *prog)
6915 u32 sid = current_sid();
6916 struct bpf_security_struct *bpfsec;
6918 bpfsec = prog->aux->security;
6919 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6920 BPF__PROG_RUN, NULL);
6923 static int selinux_bpf_map_alloc(struct bpf_map *map)
6925 struct bpf_security_struct *bpfsec;
6927 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6931 bpfsec->sid = current_sid();
6932 map->security = bpfsec;
6937 static void selinux_bpf_map_free(struct bpf_map *map)
6939 struct bpf_security_struct *bpfsec = map->security;
6941 map->security = NULL;
6945 static int selinux_bpf_prog_alloc(struct bpf_prog_aux *aux)
6947 struct bpf_security_struct *bpfsec;
6949 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6953 bpfsec->sid = current_sid();
6954 aux->security = bpfsec;
6959 static void selinux_bpf_prog_free(struct bpf_prog_aux *aux)
6961 struct bpf_security_struct *bpfsec = aux->security;
6963 aux->security = NULL;
6968 struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
6969 .lbs_cred = sizeof(struct task_security_struct),
6970 .lbs_file = sizeof(struct file_security_struct),
6971 .lbs_inode = sizeof(struct inode_security_struct),
6972 .lbs_ipc = sizeof(struct ipc_security_struct),
6973 .lbs_msg_msg = sizeof(struct msg_security_struct),
6974 .lbs_superblock = sizeof(struct superblock_security_struct),
6975 .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
6978 #ifdef CONFIG_PERF_EVENTS
6979 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6981 u32 requested, sid = current_sid();
6983 if (type == PERF_SECURITY_OPEN)
6984 requested = PERF_EVENT__OPEN;
6985 else if (type == PERF_SECURITY_CPU)
6986 requested = PERF_EVENT__CPU;
6987 else if (type == PERF_SECURITY_KERNEL)
6988 requested = PERF_EVENT__KERNEL;
6989 else if (type == PERF_SECURITY_TRACEPOINT)
6990 requested = PERF_EVENT__TRACEPOINT;
6994 return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
6998 static int selinux_perf_event_alloc(struct perf_event *event)
7000 struct perf_event_security_struct *perfsec;
7002 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7006 perfsec->sid = current_sid();
7007 event->security = perfsec;
7012 static void selinux_perf_event_free(struct perf_event *event)
7014 struct perf_event_security_struct *perfsec = event->security;
7016 event->security = NULL;
7020 static int selinux_perf_event_read(struct perf_event *event)
7022 struct perf_event_security_struct *perfsec = event->security;
7023 u32 sid = current_sid();
7025 return avc_has_perm(sid, perfsec->sid,
7026 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7029 static int selinux_perf_event_write(struct perf_event *event)
7031 struct perf_event_security_struct *perfsec = event->security;
7032 u32 sid = current_sid();
7034 return avc_has_perm(sid, perfsec->sid,
7035 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7039 #ifdef CONFIG_IO_URING
7041 * selinux_uring_override_creds - check the requested cred override
7042 * @new: the target creds
7044 * Check to see if the current task is allowed to override it's credentials
7045 * to service an io_uring operation.
7047 static int selinux_uring_override_creds(const struct cred *new)
7049 return avc_has_perm(current_sid(), cred_sid(new),
7050 SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
7054 * selinux_uring_sqpoll - check if a io_uring polling thread can be created
7056 * Check to see if the current task is allowed to create a new io_uring
7057 * kernel polling thread.
7059 static int selinux_uring_sqpoll(void)
7061 u32 sid = current_sid();
7063 return avc_has_perm(sid, sid,
7064 SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
7068 * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
7069 * @ioucmd: the io_uring command structure
7071 * Check to see if the current domain is allowed to execute an
7072 * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7075 static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7077 struct file *file = ioucmd->file;
7078 struct inode *inode = file_inode(file);
7079 struct inode_security_struct *isec = selinux_inode(inode);
7080 struct common_audit_data ad;
7082 ad.type = LSM_AUDIT_DATA_FILE;
7085 return avc_has_perm(current_sid(), isec->sid,
7086 SECCLASS_IO_URING, IO_URING__CMD, &ad);
7088 #endif /* CONFIG_IO_URING */
7090 static const struct lsm_id selinux_lsmid = {
7092 .id = LSM_ID_SELINUX,
7096 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7097 * 1. any hooks that don't belong to (2.) or (3.) below,
7098 * 2. hooks that both access structures allocated by other hooks, and allocate
7099 * structures that can be later accessed by other hooks (mostly "cloning"
7101 * 3. hooks that only allocate structures that can be later accessed by other
7102 * hooks ("allocating" hooks).
7104 * Please follow block comment delimiters in the list to keep this order.
7106 static struct security_hook_list selinux_hooks[] __ro_after_init = {
7107 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7108 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7109 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7110 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7112 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7113 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7114 LSM_HOOK_INIT(capget, selinux_capget),
7115 LSM_HOOK_INIT(capset, selinux_capset),
7116 LSM_HOOK_INIT(capable, selinux_capable),
7117 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7118 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7119 LSM_HOOK_INIT(syslog, selinux_syslog),
7120 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7122 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7124 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7125 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7126 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7128 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7129 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7130 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7131 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7132 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7133 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7134 LSM_HOOK_INIT(sb_mount, selinux_mount),
7135 LSM_HOOK_INIT(sb_umount, selinux_umount),
7136 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7137 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7139 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7141 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7142 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7144 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7145 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7146 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7147 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7148 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7149 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7150 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7151 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7152 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7153 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7154 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7155 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7156 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7157 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7158 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7159 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7160 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7161 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7162 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7163 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7164 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7165 LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
7166 LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
7167 LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),
7168 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7169 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7170 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7171 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7172 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7173 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7174 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7176 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7178 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7179 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7180 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7181 LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
7182 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7183 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7184 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7185 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7186 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7187 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7188 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7189 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7191 LSM_HOOK_INIT(file_open, selinux_file_open),
7193 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7194 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7195 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7196 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7197 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7198 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7199 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7200 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7201 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7202 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7203 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7204 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7205 LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7206 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7207 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7208 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7209 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7210 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7211 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7212 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7213 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7214 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7215 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7216 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7217 LSM_HOOK_INIT(userns_create, selinux_userns_create),
7219 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7220 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7222 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7223 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7224 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7225 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7227 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7228 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7229 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7231 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7232 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7233 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7235 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7237 LSM_HOOK_INIT(getselfattr, selinux_getselfattr),
7238 LSM_HOOK_INIT(setselfattr, selinux_setselfattr),
7239 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7240 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7242 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7243 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7244 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7245 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7246 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7247 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7249 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7250 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7252 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7253 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7254 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7255 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7256 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7257 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7258 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7259 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7260 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7261 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7262 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7263 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7264 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7265 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7266 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7267 LSM_HOOK_INIT(socket_getpeersec_stream,
7268 selinux_socket_getpeersec_stream),
7269 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7270 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7271 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7272 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7273 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7274 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7275 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7276 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7277 LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7278 LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
7279 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7280 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7281 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7282 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7283 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7284 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7285 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7286 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7287 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7288 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7289 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7290 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7291 #ifdef CONFIG_SECURITY_INFINIBAND
7292 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7293 LSM_HOOK_INIT(ib_endport_manage_subnet,
7294 selinux_ib_endport_manage_subnet),
7295 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7297 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7298 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7299 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7300 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7301 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7302 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7303 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7304 selinux_xfrm_state_pol_flow_match),
7305 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7309 LSM_HOOK_INIT(key_free, selinux_key_free),
7310 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7311 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7312 #ifdef CONFIG_KEY_NOTIFICATIONS
7313 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7318 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7319 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7320 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7323 #ifdef CONFIG_BPF_SYSCALL
7324 LSM_HOOK_INIT(bpf, selinux_bpf),
7325 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7326 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7327 LSM_HOOK_INIT(bpf_map_free_security, selinux_bpf_map_free),
7328 LSM_HOOK_INIT(bpf_prog_free_security, selinux_bpf_prog_free),
7331 #ifdef CONFIG_PERF_EVENTS
7332 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7333 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7334 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7335 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7338 #ifdef CONFIG_IO_URING
7339 LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7340 LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7341 LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7345 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7347 LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),
7348 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7349 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7350 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7351 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7352 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7356 * PUT "ALLOCATING" HOOKS HERE
7358 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7359 LSM_HOOK_INIT(msg_queue_alloc_security,
7360 selinux_msg_queue_alloc_security),
7361 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7362 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7363 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7364 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7365 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7366 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7367 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7368 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7369 #ifdef CONFIG_SECURITY_INFINIBAND
7370 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7372 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7373 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7374 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7375 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7376 selinux_xfrm_state_alloc_acquire),
7379 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7382 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7384 #ifdef CONFIG_BPF_SYSCALL
7385 LSM_HOOK_INIT(bpf_map_alloc_security, selinux_bpf_map_alloc),
7386 LSM_HOOK_INIT(bpf_prog_alloc_security, selinux_bpf_prog_alloc),
7388 #ifdef CONFIG_PERF_EVENTS
7389 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7393 static __init int selinux_init(void)
7395 pr_info("SELinux: Initializing.\n");
7397 memset(&selinux_state, 0, sizeof(selinux_state));
7398 enforcing_set(selinux_enforcing_boot);
7400 mutex_init(&selinux_state.status_lock);
7401 mutex_init(&selinux_state.policy_mutex);
7403 /* Set the security state for the initial task. */
7404 cred_init_security();
7406 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7407 if (!default_noexec)
7408 pr_notice("SELinux: virtual memory is executable by default\n");
7414 ebitmap_cache_init();
7416 hashtab_cache_init();
7418 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks),
7421 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7422 panic("SELinux: Unable to register AVC netcache callback\n");
7424 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7425 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7427 if (selinux_enforcing_boot)
7428 pr_debug("SELinux: Starting in enforcing mode\n");
7430 pr_debug("SELinux: Starting in permissive mode\n");
7432 fs_validate_description("selinux", selinux_fs_parameters);
7437 static void delayed_superblock_init(struct super_block *sb, void *unused)
7439 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7442 void selinux_complete_init(void)
7444 pr_debug("SELinux: Completing initialization.\n");
7446 /* Set up any superblocks initialized prior to the policy load. */
7447 pr_debug("SELinux: Setting up existing superblocks.\n");
7448 iterate_supers(delayed_superblock_init, NULL);
7451 /* SELinux requires early initialization in order to label
7452 all processes and objects when they are created. */
7453 DEFINE_LSM(selinux) = {
7455 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7456 .enabled = &selinux_enabled_boot,
7457 .blobs = &selinux_blob_sizes,
7458 .init = selinux_init,
7461 #if defined(CONFIG_NETFILTER)
7462 static const struct nf_hook_ops selinux_nf_ops[] = {
7464 .hook = selinux_ip_postroute,
7466 .hooknum = NF_INET_POST_ROUTING,
7467 .priority = NF_IP_PRI_SELINUX_LAST,
7470 .hook = selinux_ip_forward,
7472 .hooknum = NF_INET_FORWARD,
7473 .priority = NF_IP_PRI_SELINUX_FIRST,
7476 .hook = selinux_ip_output,
7478 .hooknum = NF_INET_LOCAL_OUT,
7479 .priority = NF_IP_PRI_SELINUX_FIRST,
7481 #if IS_ENABLED(CONFIG_IPV6)
7483 .hook = selinux_ip_postroute,
7485 .hooknum = NF_INET_POST_ROUTING,
7486 .priority = NF_IP6_PRI_SELINUX_LAST,
7489 .hook = selinux_ip_forward,
7491 .hooknum = NF_INET_FORWARD,
7492 .priority = NF_IP6_PRI_SELINUX_FIRST,
7495 .hook = selinux_ip_output,
7497 .hooknum = NF_INET_LOCAL_OUT,
7498 .priority = NF_IP6_PRI_SELINUX_FIRST,
7503 static int __net_init selinux_nf_register(struct net *net)
7505 return nf_register_net_hooks(net, selinux_nf_ops,
7506 ARRAY_SIZE(selinux_nf_ops));
7509 static void __net_exit selinux_nf_unregister(struct net *net)
7511 nf_unregister_net_hooks(net, selinux_nf_ops,
7512 ARRAY_SIZE(selinux_nf_ops));
7515 static struct pernet_operations selinux_net_ops = {
7516 .init = selinux_nf_register,
7517 .exit = selinux_nf_unregister,
7520 static int __init selinux_nf_ip_init(void)
7524 if (!selinux_enabled_boot)
7527 pr_debug("SELinux: Registering netfilter hooks\n");
7529 err = register_pernet_subsys(&selinux_net_ops);
7531 panic("SELinux: register_pernet_subsys: error %d\n", err);
7535 __initcall(selinux_nf_ip_init);
7536 #endif /* CONFIG_NETFILTER */