1 // SPDX-License-Identifier: GPL-2.0-only
3 * Security-Enhanced Linux (SELinux) security module
5 * This file contains the SELinux hook function implementations.
7 * Authors: Stephen Smalley, <stephen.smalley.work@gmail.com>
8 * Chris Vance, <cvance@nai.com>
9 * Wayne Salamon, <wsalamon@nai.com>
10 * James Morris <jmorris@redhat.com>
12 * Copyright (C) 2001,2002 Networks Associates Technology, Inc.
13 * Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
14 * Eric Paris <eparis@redhat.com>
15 * Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
16 * <dgoeddel@trustedcs.com>
17 * Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
18 * Paul Moore <paul@paul-moore.com>
19 * Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
20 * Yuichi Nakamura <ynakam@hitachisoft.jp>
21 * Copyright (C) 2016 Mellanox Technologies
24 #include <linux/init.h>
26 #include <linux/kernel.h>
27 #include <linux/kernel_read_file.h>
28 #include <linux/errno.h>
29 #include <linux/sched/signal.h>
30 #include <linux/sched/task.h>
31 #include <linux/lsm_hooks.h>
32 #include <linux/xattr.h>
33 #include <linux/capability.h>
34 #include <linux/unistd.h>
36 #include <linux/mman.h>
37 #include <linux/slab.h>
38 #include <linux/pagemap.h>
39 #include <linux/proc_fs.h>
40 #include <linux/swap.h>
41 #include <linux/spinlock.h>
42 #include <linux/syscalls.h>
43 #include <linux/dcache.h>
44 #include <linux/file.h>
45 #include <linux/fdtable.h>
46 #include <linux/namei.h>
47 #include <linux/mount.h>
48 #include <linux/fs_context.h>
49 #include <linux/fs_parser.h>
50 #include <linux/netfilter_ipv4.h>
51 #include <linux/netfilter_ipv6.h>
52 #include <linux/tty.h>
54 #include <net/ip.h> /* for local_port_range[] */
55 #include <net/tcp.h> /* struct or_callable used in sock_rcv_skb */
56 #include <net/inet_connection_sock.h>
57 #include <net/net_namespace.h>
58 #include <net/netlabel.h>
59 #include <linux/uaccess.h>
60 #include <asm/ioctls.h>
61 #include <linux/atomic.h>
62 #include <linux/bitops.h>
63 #include <linux/interrupt.h>
64 #include <linux/netdevice.h> /* for network interface checks */
65 #include <net/netlink.h>
66 #include <linux/tcp.h>
67 #include <linux/udp.h>
68 #include <linux/dccp.h>
69 #include <linux/sctp.h>
70 #include <net/sctp/structs.h>
71 #include <linux/quota.h>
72 #include <linux/un.h> /* for Unix socket types */
73 #include <net/af_unix.h> /* for Unix socket types */
74 #include <linux/parser.h>
75 #include <linux/nfs_mount.h>
77 #include <linux/hugetlb.h>
78 #include <linux/personality.h>
79 #include <linux/audit.h>
80 #include <linux/string.h>
81 #include <linux/mutex.h>
82 #include <linux/posix-timers.h>
83 #include <linux/syslog.h>
84 #include <linux/user_namespace.h>
85 #include <linux/export.h>
86 #include <linux/msg.h>
87 #include <linux/shm.h>
88 #include <uapi/linux/shm.h>
89 #include <linux/bpf.h>
90 #include <linux/kernfs.h>
91 #include <linux/stringhash.h> /* for hashlen_string() */
92 #include <uapi/linux/mount.h>
93 #include <linux/fsnotify.h>
94 #include <linux/fanotify.h>
95 #include <linux/io_uring/cmd.h>
96 #include <uapi/linux/lsm.h>
105 #include "netlabel.h"
109 #define SELINUX_INODE_INIT_XATTRS 1
111 struct selinux_state selinux_state;
113 /* SECMARK reference count */
114 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
116 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
117 static int selinux_enforcing_boot __initdata;
119 static int __init enforcing_setup(char *str)
121 unsigned long enforcing;
122 if (!kstrtoul(str, 0, &enforcing))
123 selinux_enforcing_boot = enforcing ? 1 : 0;
126 __setup("enforcing=", enforcing_setup);
128 #define selinux_enforcing_boot 1
131 int selinux_enabled_boot __initdata = 1;
132 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
133 static int __init selinux_enabled_setup(char *str)
135 unsigned long enabled;
136 if (!kstrtoul(str, 0, &enabled))
137 selinux_enabled_boot = enabled ? 1 : 0;
140 __setup("selinux=", selinux_enabled_setup);
143 static int __init checkreqprot_setup(char *str)
145 unsigned long checkreqprot;
147 if (!kstrtoul(str, 0, &checkreqprot)) {
149 pr_err("SELinux: checkreqprot set to 1 via kernel parameter. This is no longer supported.\n");
153 __setup("checkreqprot=", checkreqprot_setup);
156 * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
159 * This function checks the SECMARK reference counter to see if any SECMARK
160 * targets are currently configured, if the reference counter is greater than
161 * zero SECMARK is considered to be enabled. Returns true (1) if SECMARK is
162 * enabled, false (0) if SECMARK is disabled. If the always_check_network
163 * policy capability is enabled, SECMARK is always considered enabled.
166 static int selinux_secmark_enabled(void)
168 return (selinux_policycap_alwaysnetwork() ||
169 atomic_read(&selinux_secmark_refcount));
173 * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
176 * This function checks if NetLabel or labeled IPSEC is enabled. Returns true
177 * (1) if any are enabled or false (0) if neither are enabled. If the
178 * always_check_network policy capability is enabled, peer labeling
179 * is always considered enabled.
182 static int selinux_peerlbl_enabled(void)
184 return (selinux_policycap_alwaysnetwork() ||
185 netlbl_enabled() || selinux_xfrm_enabled());
188 static int selinux_netcache_avc_callback(u32 event)
190 if (event == AVC_CALLBACK_RESET) {
199 static int selinux_lsm_notifier_avc_callback(u32 event)
201 if (event == AVC_CALLBACK_RESET) {
203 call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
210 * initialise the security for the init task
212 static void cred_init_security(void)
214 struct task_security_struct *tsec;
216 tsec = selinux_cred(unrcu_pointer(current->real_cred));
217 tsec->osid = tsec->sid = SECINITSID_KERNEL;
221 * get the security ID of a set of credentials
223 static inline u32 cred_sid(const struct cred *cred)
225 const struct task_security_struct *tsec;
227 tsec = selinux_cred(cred);
231 static void __ad_net_init(struct common_audit_data *ad,
232 struct lsm_network_audit *net,
233 int ifindex, struct sock *sk, u16 family)
235 ad->type = LSM_AUDIT_DATA_NET;
237 net->netif = ifindex;
239 net->family = family;
242 static void ad_net_init_from_sk(struct common_audit_data *ad,
243 struct lsm_network_audit *net,
246 __ad_net_init(ad, net, 0, sk, 0);
249 static void ad_net_init_from_iif(struct common_audit_data *ad,
250 struct lsm_network_audit *net,
251 int ifindex, u16 family)
253 __ad_net_init(ad, net, ifindex, NULL, family);
257 * get the objective security ID of a task
259 static inline u32 task_sid_obj(const struct task_struct *task)
264 sid = cred_sid(__task_cred(task));
269 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
272 * Try reloading inode security labels that have been marked as invalid. The
273 * @may_sleep parameter indicates when sleeping and thus reloading labels is
274 * allowed; when set to false, returns -ECHILD when the label is
275 * invalid. The @dentry parameter should be set to a dentry of the inode.
277 static int __inode_security_revalidate(struct inode *inode,
278 struct dentry *dentry,
281 struct inode_security_struct *isec = selinux_inode(inode);
283 might_sleep_if(may_sleep);
285 if (selinux_initialized() &&
286 isec->initialized != LABEL_INITIALIZED) {
291 * Try reloading the inode security label. This will fail if
292 * @opt_dentry is NULL and no dentry for this inode can be
293 * found; in that case, continue using the old label.
295 inode_doinit_with_dentry(inode, dentry);
300 static struct inode_security_struct *inode_security_novalidate(struct inode *inode)
302 return selinux_inode(inode);
305 static struct inode_security_struct *inode_security_rcu(struct inode *inode, bool rcu)
309 error = __inode_security_revalidate(inode, NULL, !rcu);
311 return ERR_PTR(error);
312 return selinux_inode(inode);
316 * Get the security label of an inode.
318 static struct inode_security_struct *inode_security(struct inode *inode)
320 __inode_security_revalidate(inode, NULL, true);
321 return selinux_inode(inode);
324 static struct inode_security_struct *backing_inode_security_novalidate(struct dentry *dentry)
326 struct inode *inode = d_backing_inode(dentry);
328 return selinux_inode(inode);
332 * Get the security label of a dentry's backing inode.
334 static struct inode_security_struct *backing_inode_security(struct dentry *dentry)
336 struct inode *inode = d_backing_inode(dentry);
338 __inode_security_revalidate(inode, dentry, true);
339 return selinux_inode(inode);
342 static void inode_free_security(struct inode *inode)
344 struct inode_security_struct *isec = selinux_inode(inode);
345 struct superblock_security_struct *sbsec;
349 sbsec = selinux_superblock(inode->i_sb);
351 * As not all inode security structures are in a list, we check for
352 * empty list outside of the lock to make sure that we won't waste
353 * time taking a lock doing nothing.
355 * The list_del_init() function can be safely called more than once.
356 * It should not be possible for this function to be called with
357 * concurrent list_add(), but for better safety against future changes
358 * in the code, we use list_empty_careful() here.
360 if (!list_empty_careful(&isec->list)) {
361 spin_lock(&sbsec->isec_lock);
362 list_del_init(&isec->list);
363 spin_unlock(&sbsec->isec_lock);
367 struct selinux_mnt_opts {
374 static void selinux_free_mnt_opts(void *mnt_opts)
388 #define A(s, has_arg) {#s, sizeof(#s) - 1, Opt_##s, has_arg}
389 static const struct {
398 A(rootcontext, true),
403 static int match_opt_prefix(char *s, int l, char **arg)
407 for (i = 0; i < ARRAY_SIZE(tokens); i++) {
408 size_t len = tokens[i].len;
409 if (len > l || memcmp(s, tokens[i].name, len))
411 if (tokens[i].has_arg) {
412 if (len == l || s[len] != '=')
417 return tokens[i].opt;
422 #define SEL_MOUNT_FAIL_MSG "SELinux: duplicate or incompatible mount options\n"
424 static int may_context_mount_sb_relabel(u32 sid,
425 struct superblock_security_struct *sbsec,
426 const struct cred *cred)
428 const struct task_security_struct *tsec = selinux_cred(cred);
431 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
432 FILESYSTEM__RELABELFROM, NULL);
436 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
437 FILESYSTEM__RELABELTO, NULL);
441 static int may_context_mount_inode_relabel(u32 sid,
442 struct superblock_security_struct *sbsec,
443 const struct cred *cred)
445 const struct task_security_struct *tsec = selinux_cred(cred);
447 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
448 FILESYSTEM__RELABELFROM, NULL);
452 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
453 FILESYSTEM__ASSOCIATE, NULL);
457 static int selinux_is_genfs_special_handling(struct super_block *sb)
459 /* Special handling. Genfs but also in-core setxattr handler */
460 return !strcmp(sb->s_type->name, "sysfs") ||
461 !strcmp(sb->s_type->name, "pstore") ||
462 !strcmp(sb->s_type->name, "debugfs") ||
463 !strcmp(sb->s_type->name, "tracefs") ||
464 !strcmp(sb->s_type->name, "rootfs") ||
465 (selinux_policycap_cgroupseclabel() &&
466 (!strcmp(sb->s_type->name, "cgroup") ||
467 !strcmp(sb->s_type->name, "cgroup2")));
470 static int selinux_is_sblabel_mnt(struct super_block *sb)
472 struct superblock_security_struct *sbsec = selinux_superblock(sb);
475 * IMPORTANT: Double-check logic in this function when adding a new
476 * SECURITY_FS_USE_* definition!
478 BUILD_BUG_ON(SECURITY_FS_USE_MAX != 7);
480 switch (sbsec->behavior) {
481 case SECURITY_FS_USE_XATTR:
482 case SECURITY_FS_USE_TRANS:
483 case SECURITY_FS_USE_TASK:
484 case SECURITY_FS_USE_NATIVE:
487 case SECURITY_FS_USE_GENFS:
488 return selinux_is_genfs_special_handling(sb);
490 /* Never allow relabeling on context mounts */
491 case SECURITY_FS_USE_MNTPOINT:
492 case SECURITY_FS_USE_NONE:
498 static int sb_check_xattr_support(struct super_block *sb)
500 struct superblock_security_struct *sbsec = selinux_superblock(sb);
501 struct dentry *root = sb->s_root;
502 struct inode *root_inode = d_backing_inode(root);
507 * Make sure that the xattr handler exists and that no
508 * error other than -ENODATA is returned by getxattr on
509 * the root directory. -ENODATA is ok, as this may be
510 * the first boot of the SELinux kernel before we have
511 * assigned xattr values to the filesystem.
513 if (!(root_inode->i_opflags & IOP_XATTR)) {
514 pr_warn("SELinux: (dev %s, type %s) has no xattr support\n",
515 sb->s_id, sb->s_type->name);
519 rc = __vfs_getxattr(root, root_inode, XATTR_NAME_SELINUX, NULL, 0);
520 if (rc < 0 && rc != -ENODATA) {
521 if (rc == -EOPNOTSUPP) {
522 pr_warn("SELinux: (dev %s, type %s) has no security xattr handler\n",
523 sb->s_id, sb->s_type->name);
526 pr_warn("SELinux: (dev %s, type %s) getxattr errno %d\n",
527 sb->s_id, sb->s_type->name, -rc);
534 /* No xattr support - try to fallback to genfs if possible. */
535 rc = security_genfs_sid(sb->s_type->name, "/",
540 pr_warn("SELinux: (dev %s, type %s) falling back to genfs\n",
541 sb->s_id, sb->s_type->name);
542 sbsec->behavior = SECURITY_FS_USE_GENFS;
547 static int sb_finish_set_opts(struct super_block *sb)
549 struct superblock_security_struct *sbsec = selinux_superblock(sb);
550 struct dentry *root = sb->s_root;
551 struct inode *root_inode = d_backing_inode(root);
554 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
555 rc = sb_check_xattr_support(sb);
560 sbsec->flags |= SE_SBINITIALIZED;
563 * Explicitly set or clear SBLABEL_MNT. It's not sufficient to simply
564 * leave the flag untouched because sb_clone_mnt_opts might be handing
565 * us a superblock that needs the flag to be cleared.
567 if (selinux_is_sblabel_mnt(sb))
568 sbsec->flags |= SBLABEL_MNT;
570 sbsec->flags &= ~SBLABEL_MNT;
572 /* Initialize the root inode. */
573 rc = inode_doinit_with_dentry(root_inode, root);
575 /* Initialize any other inodes associated with the superblock, e.g.
576 inodes created prior to initial policy load or inodes created
577 during get_sb by a pseudo filesystem that directly
579 spin_lock(&sbsec->isec_lock);
580 while (!list_empty(&sbsec->isec_head)) {
581 struct inode_security_struct *isec =
582 list_first_entry(&sbsec->isec_head,
583 struct inode_security_struct, list);
584 struct inode *inode = isec->inode;
585 list_del_init(&isec->list);
586 spin_unlock(&sbsec->isec_lock);
587 inode = igrab(inode);
589 if (!IS_PRIVATE(inode))
590 inode_doinit_with_dentry(inode, NULL);
593 spin_lock(&sbsec->isec_lock);
595 spin_unlock(&sbsec->isec_lock);
599 static int bad_option(struct superblock_security_struct *sbsec, char flag,
600 u32 old_sid, u32 new_sid)
602 char mnt_flags = sbsec->flags & SE_MNTMASK;
604 /* check if the old mount command had the same options */
605 if (sbsec->flags & SE_SBINITIALIZED)
606 if (!(sbsec->flags & flag) ||
607 (old_sid != new_sid))
610 /* check if we were passed the same options twice,
611 * aka someone passed context=a,context=b
613 if (!(sbsec->flags & SE_SBINITIALIZED))
614 if (mnt_flags & flag)
620 * Allow filesystems with binary mount data to explicitly set mount point
621 * labeling information.
623 static int selinux_set_mnt_opts(struct super_block *sb,
625 unsigned long kern_flags,
626 unsigned long *set_kern_flags)
628 const struct cred *cred = current_cred();
629 struct superblock_security_struct *sbsec = selinux_superblock(sb);
630 struct dentry *root = sb->s_root;
631 struct selinux_mnt_opts *opts = mnt_opts;
632 struct inode_security_struct *root_isec;
633 u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
634 u32 defcontext_sid = 0;
638 * Specifying internal flags without providing a place to
639 * place the results is not allowed
641 if (kern_flags && !set_kern_flags)
644 mutex_lock(&sbsec->lock);
646 if (!selinux_initialized()) {
648 /* Defer initialization until selinux_complete_init,
649 after the initial policy is loaded and the security
650 server is ready to handle calls. */
651 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
652 sbsec->flags |= SE_SBNATIVE;
653 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
658 pr_warn("SELinux: Unable to set superblock options "
659 "before the security server is initialized\n");
664 * Binary mount data FS will come through this function twice. Once
665 * from an explicit call and once from the generic calls from the vfs.
666 * Since the generic VFS calls will not contain any security mount data
667 * we need to skip the double mount verification.
669 * This does open a hole in which we will not notice if the first
670 * mount using this sb set explicit options and a second mount using
671 * this sb does not set any security options. (The first options
672 * will be used for both mounts)
674 if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
678 root_isec = backing_inode_security_novalidate(root);
681 * parse the mount options, check if they are valid sids.
682 * also check if someone is trying to mount the same sb more
683 * than once with different security options.
686 if (opts->fscontext_sid) {
687 fscontext_sid = opts->fscontext_sid;
688 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
690 goto out_double_mount;
691 sbsec->flags |= FSCONTEXT_MNT;
693 if (opts->context_sid) {
694 context_sid = opts->context_sid;
695 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
697 goto out_double_mount;
698 sbsec->flags |= CONTEXT_MNT;
700 if (opts->rootcontext_sid) {
701 rootcontext_sid = opts->rootcontext_sid;
702 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
704 goto out_double_mount;
705 sbsec->flags |= ROOTCONTEXT_MNT;
707 if (opts->defcontext_sid) {
708 defcontext_sid = opts->defcontext_sid;
709 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
711 goto out_double_mount;
712 sbsec->flags |= DEFCONTEXT_MNT;
716 if (sbsec->flags & SE_SBINITIALIZED) {
717 /* previously mounted with options, but not on this attempt? */
718 if ((sbsec->flags & SE_MNTMASK) && !opts)
719 goto out_double_mount;
724 if (strcmp(sb->s_type->name, "proc") == 0)
725 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
727 if (!strcmp(sb->s_type->name, "debugfs") ||
728 !strcmp(sb->s_type->name, "tracefs") ||
729 !strcmp(sb->s_type->name, "binder") ||
730 !strcmp(sb->s_type->name, "bpf") ||
731 !strcmp(sb->s_type->name, "pstore") ||
732 !strcmp(sb->s_type->name, "securityfs"))
733 sbsec->flags |= SE_SBGENFS;
735 if (!strcmp(sb->s_type->name, "sysfs") ||
736 !strcmp(sb->s_type->name, "cgroup") ||
737 !strcmp(sb->s_type->name, "cgroup2"))
738 sbsec->flags |= SE_SBGENFS | SE_SBGENFS_XATTR;
740 if (!sbsec->behavior) {
742 * Determine the labeling behavior to use for this
745 rc = security_fs_use(sb);
747 pr_warn("%s: security_fs_use(%s) returned %d\n",
748 __func__, sb->s_type->name, rc);
754 * If this is a user namespace mount and the filesystem type is not
755 * explicitly whitelisted, then no contexts are allowed on the command
756 * line and security labels must be ignored.
758 if (sb->s_user_ns != &init_user_ns &&
759 strcmp(sb->s_type->name, "tmpfs") &&
760 strcmp(sb->s_type->name, "ramfs") &&
761 strcmp(sb->s_type->name, "devpts") &&
762 strcmp(sb->s_type->name, "overlay")) {
763 if (context_sid || fscontext_sid || rootcontext_sid ||
768 if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
769 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
770 rc = security_transition_sid(current_sid(),
773 &sbsec->mntpoint_sid);
780 /* sets the context of the superblock for the fs being mounted. */
782 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
786 sbsec->sid = fscontext_sid;
790 * Switch to using mount point labeling behavior.
791 * sets the label used on all file below the mountpoint, and will set
792 * the superblock context if not already set.
794 if (sbsec->flags & SE_SBNATIVE) {
796 * This means we are initializing a superblock that has been
797 * mounted before the SELinux was initialized and the
798 * filesystem requested native labeling. We had already
799 * returned SECURITY_LSM_NATIVE_LABELS in *set_kern_flags
800 * in the original mount attempt, so now we just need to set
801 * the SECURITY_FS_USE_NATIVE behavior.
803 sbsec->behavior = SECURITY_FS_USE_NATIVE;
804 } else if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
805 sbsec->behavior = SECURITY_FS_USE_NATIVE;
806 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
810 if (!fscontext_sid) {
811 rc = may_context_mount_sb_relabel(context_sid, sbsec,
815 sbsec->sid = context_sid;
817 rc = may_context_mount_inode_relabel(context_sid, sbsec,
822 if (!rootcontext_sid)
823 rootcontext_sid = context_sid;
825 sbsec->mntpoint_sid = context_sid;
826 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
829 if (rootcontext_sid) {
830 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
835 root_isec->sid = rootcontext_sid;
836 root_isec->initialized = LABEL_INITIALIZED;
839 if (defcontext_sid) {
840 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
841 sbsec->behavior != SECURITY_FS_USE_NATIVE) {
843 pr_warn("SELinux: defcontext option is "
844 "invalid for this filesystem type\n");
848 if (defcontext_sid != sbsec->def_sid) {
849 rc = may_context_mount_inode_relabel(defcontext_sid,
855 sbsec->def_sid = defcontext_sid;
859 rc = sb_finish_set_opts(sb);
861 mutex_unlock(&sbsec->lock);
865 pr_warn("SELinux: mount invalid. Same superblock, different "
866 "security settings for (dev %s, type %s)\n", sb->s_id,
871 static int selinux_cmp_sb_context(const struct super_block *oldsb,
872 const struct super_block *newsb)
874 struct superblock_security_struct *old = selinux_superblock(oldsb);
875 struct superblock_security_struct *new = selinux_superblock(newsb);
876 char oldflags = old->flags & SE_MNTMASK;
877 char newflags = new->flags & SE_MNTMASK;
879 if (oldflags != newflags)
881 if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
883 if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
885 if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
887 if (oldflags & ROOTCONTEXT_MNT) {
888 struct inode_security_struct *oldroot = backing_inode_security(oldsb->s_root);
889 struct inode_security_struct *newroot = backing_inode_security(newsb->s_root);
890 if (oldroot->sid != newroot->sid)
895 pr_warn("SELinux: mount invalid. Same superblock, "
896 "different security settings for (dev %s, "
897 "type %s)\n", newsb->s_id, newsb->s_type->name);
901 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
902 struct super_block *newsb,
903 unsigned long kern_flags,
904 unsigned long *set_kern_flags)
907 const struct superblock_security_struct *oldsbsec =
908 selinux_superblock(oldsb);
909 struct superblock_security_struct *newsbsec = selinux_superblock(newsb);
911 int set_fscontext = (oldsbsec->flags & FSCONTEXT_MNT);
912 int set_context = (oldsbsec->flags & CONTEXT_MNT);
913 int set_rootcontext = (oldsbsec->flags & ROOTCONTEXT_MNT);
916 * Specifying internal flags without providing a place to
917 * place the results is not allowed.
919 if (kern_flags && !set_kern_flags)
922 mutex_lock(&newsbsec->lock);
925 * if the parent was able to be mounted it clearly had no special lsm
926 * mount options. thus we can safely deal with this superblock later
928 if (!selinux_initialized()) {
929 if (kern_flags & SECURITY_LSM_NATIVE_LABELS) {
930 newsbsec->flags |= SE_SBNATIVE;
931 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
936 /* how can we clone if the old one wasn't set up?? */
937 BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
939 /* if fs is reusing a sb, make sure that the contexts match */
940 if (newsbsec->flags & SE_SBINITIALIZED) {
941 mutex_unlock(&newsbsec->lock);
942 if ((kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context)
943 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
944 return selinux_cmp_sb_context(oldsb, newsb);
947 newsbsec->flags = oldsbsec->flags;
949 newsbsec->sid = oldsbsec->sid;
950 newsbsec->def_sid = oldsbsec->def_sid;
951 newsbsec->behavior = oldsbsec->behavior;
953 if (newsbsec->behavior == SECURITY_FS_USE_NATIVE &&
954 !(kern_flags & SECURITY_LSM_NATIVE_LABELS) && !set_context) {
955 rc = security_fs_use(newsb);
960 if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !set_context) {
961 newsbsec->behavior = SECURITY_FS_USE_NATIVE;
962 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
966 u32 sid = oldsbsec->mntpoint_sid;
970 if (!set_rootcontext) {
971 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
974 newsbsec->mntpoint_sid = sid;
976 if (set_rootcontext) {
977 const struct inode_security_struct *oldisec = backing_inode_security(oldsb->s_root);
978 struct inode_security_struct *newisec = backing_inode_security(newsb->s_root);
980 newisec->sid = oldisec->sid;
983 sb_finish_set_opts(newsb);
985 mutex_unlock(&newsbsec->lock);
990 * NOTE: the caller is responsible for freeing the memory even if on error.
992 static int selinux_add_opt(int token, const char *s, void **mnt_opts)
994 struct selinux_mnt_opts *opts = *mnt_opts;
998 if (token == Opt_seclabel)
999 /* eaten and completely ignored */
1004 if (!selinux_initialized()) {
1005 pr_warn("SELinux: Unable to set superblock options before the security server is initialized\n");
1010 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
1018 if (opts->context_sid || opts->defcontext_sid)
1020 dst_sid = &opts->context_sid;
1023 if (opts->fscontext_sid)
1025 dst_sid = &opts->fscontext_sid;
1027 case Opt_rootcontext:
1028 if (opts->rootcontext_sid)
1030 dst_sid = &opts->rootcontext_sid;
1032 case Opt_defcontext:
1033 if (opts->context_sid || opts->defcontext_sid)
1035 dst_sid = &opts->defcontext_sid;
1041 rc = security_context_str_to_sid(s, dst_sid, GFP_KERNEL);
1043 pr_warn("SELinux: security_context_str_to_sid (%s) failed with errno=%d\n",
1048 pr_warn(SEL_MOUNT_FAIL_MSG);
1052 static int show_sid(struct seq_file *m, u32 sid)
1054 char *context = NULL;
1058 rc = security_sid_to_context(sid, &context, &len);
1060 bool has_comma = strchr(context, ',');
1065 seq_escape(m, context, "\"\n\\");
1073 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1075 struct superblock_security_struct *sbsec = selinux_superblock(sb);
1078 if (!(sbsec->flags & SE_SBINITIALIZED))
1081 if (!selinux_initialized())
1084 if (sbsec->flags & FSCONTEXT_MNT) {
1086 seq_puts(m, FSCONTEXT_STR);
1087 rc = show_sid(m, sbsec->sid);
1091 if (sbsec->flags & CONTEXT_MNT) {
1093 seq_puts(m, CONTEXT_STR);
1094 rc = show_sid(m, sbsec->mntpoint_sid);
1098 if (sbsec->flags & DEFCONTEXT_MNT) {
1100 seq_puts(m, DEFCONTEXT_STR);
1101 rc = show_sid(m, sbsec->def_sid);
1105 if (sbsec->flags & ROOTCONTEXT_MNT) {
1106 struct dentry *root = sb->s_root;
1107 struct inode_security_struct *isec = backing_inode_security(root);
1109 seq_puts(m, ROOTCONTEXT_STR);
1110 rc = show_sid(m, isec->sid);
1114 if (sbsec->flags & SBLABEL_MNT) {
1116 seq_puts(m, SECLABEL_STR);
1121 static inline u16 inode_mode_to_security_class(umode_t mode)
1123 switch (mode & S_IFMT) {
1125 return SECCLASS_SOCK_FILE;
1127 return SECCLASS_LNK_FILE;
1129 return SECCLASS_FILE;
1131 return SECCLASS_BLK_FILE;
1133 return SECCLASS_DIR;
1135 return SECCLASS_CHR_FILE;
1137 return SECCLASS_FIFO_FILE;
1141 return SECCLASS_FILE;
1144 static inline int default_protocol_stream(int protocol)
1146 return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP ||
1147 protocol == IPPROTO_MPTCP);
1150 static inline int default_protocol_dgram(int protocol)
1152 return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1155 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 bool extsockclass = selinux_policycap_extsockclass();
1163 case SOCK_SEQPACKET:
1164 return SECCLASS_UNIX_STREAM_SOCKET;
1167 return SECCLASS_UNIX_DGRAM_SOCKET;
1174 case SOCK_SEQPACKET:
1175 if (default_protocol_stream(protocol))
1176 return SECCLASS_TCP_SOCKET;
1177 else if (extsockclass && protocol == IPPROTO_SCTP)
1178 return SECCLASS_SCTP_SOCKET;
1180 return SECCLASS_RAWIP_SOCKET;
1182 if (default_protocol_dgram(protocol))
1183 return SECCLASS_UDP_SOCKET;
1184 else if (extsockclass && (protocol == IPPROTO_ICMP ||
1185 protocol == IPPROTO_ICMPV6))
1186 return SECCLASS_ICMP_SOCKET;
1188 return SECCLASS_RAWIP_SOCKET;
1190 return SECCLASS_DCCP_SOCKET;
1192 return SECCLASS_RAWIP_SOCKET;
1198 return SECCLASS_NETLINK_ROUTE_SOCKET;
1199 case NETLINK_SOCK_DIAG:
1200 return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1202 return SECCLASS_NETLINK_NFLOG_SOCKET;
1204 return SECCLASS_NETLINK_XFRM_SOCKET;
1205 case NETLINK_SELINUX:
1206 return SECCLASS_NETLINK_SELINUX_SOCKET;
1208 return SECCLASS_NETLINK_ISCSI_SOCKET;
1210 return SECCLASS_NETLINK_AUDIT_SOCKET;
1211 case NETLINK_FIB_LOOKUP:
1212 return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1213 case NETLINK_CONNECTOR:
1214 return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1215 case NETLINK_NETFILTER:
1216 return SECCLASS_NETLINK_NETFILTER_SOCKET;
1217 case NETLINK_DNRTMSG:
1218 return SECCLASS_NETLINK_DNRT_SOCKET;
1219 case NETLINK_KOBJECT_UEVENT:
1220 return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1221 case NETLINK_GENERIC:
1222 return SECCLASS_NETLINK_GENERIC_SOCKET;
1223 case NETLINK_SCSITRANSPORT:
1224 return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1226 return SECCLASS_NETLINK_RDMA_SOCKET;
1227 case NETLINK_CRYPTO:
1228 return SECCLASS_NETLINK_CRYPTO_SOCKET;
1230 return SECCLASS_NETLINK_SOCKET;
1233 return SECCLASS_PACKET_SOCKET;
1235 return SECCLASS_KEY_SOCKET;
1237 return SECCLASS_APPLETALK_SOCKET;
1243 return SECCLASS_AX25_SOCKET;
1245 return SECCLASS_IPX_SOCKET;
1247 return SECCLASS_NETROM_SOCKET;
1249 return SECCLASS_ATMPVC_SOCKET;
1251 return SECCLASS_X25_SOCKET;
1253 return SECCLASS_ROSE_SOCKET;
1255 return SECCLASS_DECNET_SOCKET;
1257 return SECCLASS_ATMSVC_SOCKET;
1259 return SECCLASS_RDS_SOCKET;
1261 return SECCLASS_IRDA_SOCKET;
1263 return SECCLASS_PPPOX_SOCKET;
1265 return SECCLASS_LLC_SOCKET;
1267 return SECCLASS_CAN_SOCKET;
1269 return SECCLASS_TIPC_SOCKET;
1271 return SECCLASS_BLUETOOTH_SOCKET;
1273 return SECCLASS_IUCV_SOCKET;
1275 return SECCLASS_RXRPC_SOCKET;
1277 return SECCLASS_ISDN_SOCKET;
1279 return SECCLASS_PHONET_SOCKET;
1281 return SECCLASS_IEEE802154_SOCKET;
1283 return SECCLASS_CAIF_SOCKET;
1285 return SECCLASS_ALG_SOCKET;
1287 return SECCLASS_NFC_SOCKET;
1289 return SECCLASS_VSOCK_SOCKET;
1291 return SECCLASS_KCM_SOCKET;
1293 return SECCLASS_QIPCRTR_SOCKET;
1295 return SECCLASS_SMC_SOCKET;
1297 return SECCLASS_XDP_SOCKET;
1299 return SECCLASS_MCTP_SOCKET;
1301 #error New address family defined, please update this function.
1306 return SECCLASS_SOCKET;
1309 static int selinux_genfs_get_sid(struct dentry *dentry,
1315 struct super_block *sb = dentry->d_sb;
1316 char *buffer, *path;
1318 buffer = (char *)__get_free_page(GFP_KERNEL);
1322 path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1326 if (flags & SE_SBPROC) {
1327 /* each process gets a /proc/PID/ entry. Strip off the
1328 * PID part to get a valid selinux labeling.
1329 * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1330 while (path[1] >= '0' && path[1] <= '9') {
1335 rc = security_genfs_sid(sb->s_type->name,
1337 if (rc == -ENOENT) {
1338 /* No match in policy, mark as unlabeled. */
1339 *sid = SECINITSID_UNLABELED;
1343 free_page((unsigned long)buffer);
1347 static int inode_doinit_use_xattr(struct inode *inode, struct dentry *dentry,
1348 u32 def_sid, u32 *sid)
1350 #define INITCONTEXTLEN 255
1355 len = INITCONTEXTLEN;
1356 context = kmalloc(len + 1, GFP_NOFS);
1360 context[len] = '\0';
1361 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, context, len);
1362 if (rc == -ERANGE) {
1365 /* Need a larger buffer. Query for the right size. */
1366 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX, NULL, 0);
1371 context = kmalloc(len + 1, GFP_NOFS);
1375 context[len] = '\0';
1376 rc = __vfs_getxattr(dentry, inode, XATTR_NAME_SELINUX,
1381 if (rc != -ENODATA) {
1382 pr_warn("SELinux: %s: getxattr returned %d for dev=%s ino=%ld\n",
1383 __func__, -rc, inode->i_sb->s_id, inode->i_ino);
1390 rc = security_context_to_sid_default(context, rc, sid,
1393 char *dev = inode->i_sb->s_id;
1394 unsigned long ino = inode->i_ino;
1396 if (rc == -EINVAL) {
1397 pr_notice_ratelimited("SELinux: inode=%lu on dev=%s was found to have an invalid context=%s. This indicates you may need to relabel the inode or the filesystem in question.\n",
1400 pr_warn("SELinux: %s: context_to_sid(%s) returned %d for dev=%s ino=%ld\n",
1401 __func__, context, -rc, dev, ino);
1408 /* The inode's security attributes must be initialized before first use. */
1409 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1411 struct superblock_security_struct *sbsec = NULL;
1412 struct inode_security_struct *isec = selinux_inode(inode);
1413 u32 task_sid, sid = 0;
1415 struct dentry *dentry;
1418 if (isec->initialized == LABEL_INITIALIZED)
1421 spin_lock(&isec->lock);
1422 if (isec->initialized == LABEL_INITIALIZED)
1425 if (isec->sclass == SECCLASS_FILE)
1426 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1428 sbsec = selinux_superblock(inode->i_sb);
1429 if (!(sbsec->flags & SE_SBINITIALIZED)) {
1430 /* Defer initialization until selinux_complete_init,
1431 after the initial policy is loaded and the security
1432 server is ready to handle calls. */
1433 spin_lock(&sbsec->isec_lock);
1434 if (list_empty(&isec->list))
1435 list_add(&isec->list, &sbsec->isec_head);
1436 spin_unlock(&sbsec->isec_lock);
1440 sclass = isec->sclass;
1441 task_sid = isec->task_sid;
1443 isec->initialized = LABEL_PENDING;
1444 spin_unlock(&isec->lock);
1446 switch (sbsec->behavior) {
1448 * In case of SECURITY_FS_USE_NATIVE we need to re-fetch the labels
1449 * via xattr when called from delayed_superblock_init().
1451 case SECURITY_FS_USE_NATIVE:
1452 case SECURITY_FS_USE_XATTR:
1453 if (!(inode->i_opflags & IOP_XATTR)) {
1454 sid = sbsec->def_sid;
1457 /* Need a dentry, since the xattr API requires one.
1458 Life would be simpler if we could just pass the inode. */
1460 /* Called from d_instantiate or d_splice_alias. */
1461 dentry = dget(opt_dentry);
1464 * Called from selinux_complete_init, try to find a dentry.
1465 * Some filesystems really want a connected one, so try
1466 * that first. We could split SECURITY_FS_USE_XATTR in
1467 * two, depending upon that...
1469 dentry = d_find_alias(inode);
1471 dentry = d_find_any_alias(inode);
1475 * this is can be hit on boot when a file is accessed
1476 * before the policy is loaded. When we load policy we
1477 * may find inodes that have no dentry on the
1478 * sbsec->isec_head list. No reason to complain as these
1479 * will get fixed up the next time we go through
1480 * inode_doinit with a dentry, before these inodes could
1481 * be used again by userspace.
1486 rc = inode_doinit_use_xattr(inode, dentry, sbsec->def_sid,
1492 case SECURITY_FS_USE_TASK:
1495 case SECURITY_FS_USE_TRANS:
1496 /* Default to the fs SID. */
1499 /* Try to obtain a transition SID. */
1500 rc = security_transition_sid(task_sid, sid,
1501 sclass, NULL, &sid);
1505 case SECURITY_FS_USE_MNTPOINT:
1506 sid = sbsec->mntpoint_sid;
1509 /* Default to the fs superblock SID. */
1512 if ((sbsec->flags & SE_SBGENFS) &&
1513 (!S_ISLNK(inode->i_mode) ||
1514 selinux_policycap_genfs_seclabel_symlinks())) {
1515 /* We must have a dentry to determine the label on
1518 /* Called from d_instantiate or
1519 * d_splice_alias. */
1520 dentry = dget(opt_dentry);
1522 /* Called from selinux_complete_init, try to
1523 * find a dentry. Some filesystems really want
1524 * a connected one, so try that first.
1526 dentry = d_find_alias(inode);
1528 dentry = d_find_any_alias(inode);
1531 * This can be hit on boot when a file is accessed
1532 * before the policy is loaded. When we load policy we
1533 * may find inodes that have no dentry on the
1534 * sbsec->isec_head list. No reason to complain as
1535 * these will get fixed up the next time we go through
1536 * inode_doinit() with a dentry, before these inodes
1537 * could be used again by userspace.
1541 rc = selinux_genfs_get_sid(dentry, sclass,
1542 sbsec->flags, &sid);
1548 if ((sbsec->flags & SE_SBGENFS_XATTR) &&
1549 (inode->i_opflags & IOP_XATTR)) {
1550 rc = inode_doinit_use_xattr(inode, dentry,
1563 spin_lock(&isec->lock);
1564 if (isec->initialized == LABEL_PENDING) {
1566 isec->initialized = LABEL_INVALID;
1569 isec->initialized = LABEL_INITIALIZED;
1574 spin_unlock(&isec->lock);
1578 spin_lock(&isec->lock);
1579 if (isec->initialized == LABEL_PENDING) {
1580 isec->initialized = LABEL_INVALID;
1583 spin_unlock(&isec->lock);
1587 /* Convert a Linux signal to an access vector. */
1588 static inline u32 signal_to_av(int sig)
1594 /* Commonly granted from child to parent. */
1595 perm = PROCESS__SIGCHLD;
1598 /* Cannot be caught or ignored */
1599 perm = PROCESS__SIGKILL;
1602 /* Cannot be caught or ignored */
1603 perm = PROCESS__SIGSTOP;
1606 /* All other signals. */
1607 perm = PROCESS__SIGNAL;
1614 #if CAP_LAST_CAP > 63
1615 #error Fix SELinux to handle capabilities > 63.
1618 /* Check whether a task is allowed to use a capability. */
1619 static int cred_has_capability(const struct cred *cred,
1620 int cap, unsigned int opts, bool initns)
1622 struct common_audit_data ad;
1623 struct av_decision avd;
1625 u32 sid = cred_sid(cred);
1626 u32 av = CAP_TO_MASK(cap);
1629 ad.type = LSM_AUDIT_DATA_CAP;
1632 switch (CAP_TO_INDEX(cap)) {
1634 sclass = initns ? SECCLASS_CAPABILITY : SECCLASS_CAP_USERNS;
1637 sclass = initns ? SECCLASS_CAPABILITY2 : SECCLASS_CAP2_USERNS;
1640 pr_err("SELinux: out of range capability %d\n", cap);
1645 rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1646 if (!(opts & CAP_OPT_NOAUDIT)) {
1647 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1654 /* Check whether a task has a particular permission to an inode.
1655 The 'adp' parameter is optional and allows other audit
1656 data to be passed (e.g. the dentry). */
1657 static int inode_has_perm(const struct cred *cred,
1658 struct inode *inode,
1660 struct common_audit_data *adp)
1662 struct inode_security_struct *isec;
1665 if (unlikely(IS_PRIVATE(inode)))
1668 sid = cred_sid(cred);
1669 isec = selinux_inode(inode);
1671 return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1674 /* Same as inode_has_perm, but pass explicit audit data containing
1675 the dentry to help the auditing code to more easily generate the
1676 pathname if needed. */
1677 static inline int dentry_has_perm(const struct cred *cred,
1678 struct dentry *dentry,
1681 struct inode *inode = d_backing_inode(dentry);
1682 struct common_audit_data ad;
1684 ad.type = LSM_AUDIT_DATA_DENTRY;
1685 ad.u.dentry = dentry;
1686 __inode_security_revalidate(inode, dentry, true);
1687 return inode_has_perm(cred, inode, av, &ad);
1690 /* Same as inode_has_perm, but pass explicit audit data containing
1691 the path to help the auditing code to more easily generate the
1692 pathname if needed. */
1693 static inline int path_has_perm(const struct cred *cred,
1694 const struct path *path,
1697 struct inode *inode = d_backing_inode(path->dentry);
1698 struct common_audit_data ad;
1700 ad.type = LSM_AUDIT_DATA_PATH;
1702 __inode_security_revalidate(inode, path->dentry, true);
1703 return inode_has_perm(cred, inode, av, &ad);
1706 /* Same as path_has_perm, but uses the inode from the file struct. */
1707 static inline int file_path_has_perm(const struct cred *cred,
1711 struct common_audit_data ad;
1713 ad.type = LSM_AUDIT_DATA_FILE;
1715 return inode_has_perm(cred, file_inode(file), av, &ad);
1718 #ifdef CONFIG_BPF_SYSCALL
1719 static int bpf_fd_pass(const struct file *file, u32 sid);
1722 /* Check whether a task can use an open file descriptor to
1723 access an inode in a given way. Check access to the
1724 descriptor itself, and then use dentry_has_perm to
1725 check a particular permission to the file.
1726 Access to the descriptor is implicitly granted if it
1727 has the same SID as the process. If av is zero, then
1728 access to the file is not checked, e.g. for cases
1729 where only the descriptor is affected like seek. */
1730 static int file_has_perm(const struct cred *cred,
1734 struct file_security_struct *fsec = selinux_file(file);
1735 struct inode *inode = file_inode(file);
1736 struct common_audit_data ad;
1737 u32 sid = cred_sid(cred);
1740 ad.type = LSM_AUDIT_DATA_FILE;
1743 if (sid != fsec->sid) {
1744 rc = avc_has_perm(sid, fsec->sid,
1752 #ifdef CONFIG_BPF_SYSCALL
1753 rc = bpf_fd_pass(file, cred_sid(cred));
1758 /* av is zero if only checking access to the descriptor. */
1761 rc = inode_has_perm(cred, inode, av, &ad);
1768 * Determine the label for an inode that might be unioned.
1771 selinux_determine_inode_label(const struct task_security_struct *tsec,
1773 const struct qstr *name, u16 tclass,
1776 const struct superblock_security_struct *sbsec =
1777 selinux_superblock(dir->i_sb);
1779 if ((sbsec->flags & SE_SBINITIALIZED) &&
1780 (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1781 *_new_isid = sbsec->mntpoint_sid;
1782 } else if ((sbsec->flags & SBLABEL_MNT) &&
1784 *_new_isid = tsec->create_sid;
1786 const struct inode_security_struct *dsec = inode_security(dir);
1787 return security_transition_sid(tsec->sid,
1795 /* Check whether a task can create a file. */
1796 static int may_create(struct inode *dir,
1797 struct dentry *dentry,
1800 const struct task_security_struct *tsec = selinux_cred(current_cred());
1801 struct inode_security_struct *dsec;
1802 struct superblock_security_struct *sbsec;
1804 struct common_audit_data ad;
1807 dsec = inode_security(dir);
1808 sbsec = selinux_superblock(dir->i_sb);
1812 ad.type = LSM_AUDIT_DATA_DENTRY;
1813 ad.u.dentry = dentry;
1815 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1816 DIR__ADD_NAME | DIR__SEARCH,
1821 rc = selinux_determine_inode_label(tsec, dir, &dentry->d_name, tclass,
1826 rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1830 return avc_has_perm(newsid, sbsec->sid,
1831 SECCLASS_FILESYSTEM,
1832 FILESYSTEM__ASSOCIATE, &ad);
1836 #define MAY_UNLINK 1
1839 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1840 static int may_link(struct inode *dir,
1841 struct dentry *dentry,
1845 struct inode_security_struct *dsec, *isec;
1846 struct common_audit_data ad;
1847 u32 sid = current_sid();
1851 dsec = inode_security(dir);
1852 isec = backing_inode_security(dentry);
1854 ad.type = LSM_AUDIT_DATA_DENTRY;
1855 ad.u.dentry = dentry;
1858 av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1859 rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1874 pr_warn("SELinux: %s: unrecognized kind %d\n",
1879 rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1883 static inline int may_rename(struct inode *old_dir,
1884 struct dentry *old_dentry,
1885 struct inode *new_dir,
1886 struct dentry *new_dentry)
1888 struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1889 struct common_audit_data ad;
1890 u32 sid = current_sid();
1892 int old_is_dir, new_is_dir;
1895 old_dsec = inode_security(old_dir);
1896 old_isec = backing_inode_security(old_dentry);
1897 old_is_dir = d_is_dir(old_dentry);
1898 new_dsec = inode_security(new_dir);
1900 ad.type = LSM_AUDIT_DATA_DENTRY;
1902 ad.u.dentry = old_dentry;
1903 rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1904 DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1907 rc = avc_has_perm(sid, old_isec->sid,
1908 old_isec->sclass, FILE__RENAME, &ad);
1911 if (old_is_dir && new_dir != old_dir) {
1912 rc = avc_has_perm(sid, old_isec->sid,
1913 old_isec->sclass, DIR__REPARENT, &ad);
1918 ad.u.dentry = new_dentry;
1919 av = DIR__ADD_NAME | DIR__SEARCH;
1920 if (d_is_positive(new_dentry))
1921 av |= DIR__REMOVE_NAME;
1922 rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1925 if (d_is_positive(new_dentry)) {
1926 new_isec = backing_inode_security(new_dentry);
1927 new_is_dir = d_is_dir(new_dentry);
1928 rc = avc_has_perm(sid, new_isec->sid,
1930 (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1938 /* Check whether a task can perform a filesystem operation. */
1939 static int superblock_has_perm(const struct cred *cred,
1940 const struct super_block *sb,
1942 struct common_audit_data *ad)
1944 struct superblock_security_struct *sbsec;
1945 u32 sid = cred_sid(cred);
1947 sbsec = selinux_superblock(sb);
1948 return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1951 /* Convert a Linux mode and permission mask to an access vector. */
1952 static inline u32 file_mask_to_av(int mode, int mask)
1956 if (!S_ISDIR(mode)) {
1957 if (mask & MAY_EXEC)
1958 av |= FILE__EXECUTE;
1959 if (mask & MAY_READ)
1962 if (mask & MAY_APPEND)
1964 else if (mask & MAY_WRITE)
1968 if (mask & MAY_EXEC)
1970 if (mask & MAY_WRITE)
1972 if (mask & MAY_READ)
1979 /* Convert a Linux file to an access vector. */
1980 static inline u32 file_to_av(const struct file *file)
1984 if (file->f_mode & FMODE_READ)
1986 if (file->f_mode & FMODE_WRITE) {
1987 if (file->f_flags & O_APPEND)
1994 * Special file opened with flags 3 for ioctl-only use.
2003 * Convert a file to an access vector and include the correct
2006 static inline u32 open_file_to_av(struct file *file)
2008 u32 av = file_to_av(file);
2009 struct inode *inode = file_inode(file);
2011 if (selinux_policycap_openperm() &&
2012 inode->i_sb->s_magic != SOCKFS_MAGIC)
2018 /* Hook functions begin here. */
2020 static int selinux_binder_set_context_mgr(const struct cred *mgr)
2022 return avc_has_perm(current_sid(), cred_sid(mgr), SECCLASS_BINDER,
2023 BINDER__SET_CONTEXT_MGR, NULL);
2026 static int selinux_binder_transaction(const struct cred *from,
2027 const struct cred *to)
2029 u32 mysid = current_sid();
2030 u32 fromsid = cred_sid(from);
2031 u32 tosid = cred_sid(to);
2034 if (mysid != fromsid) {
2035 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
2036 BINDER__IMPERSONATE, NULL);
2041 return avc_has_perm(fromsid, tosid,
2042 SECCLASS_BINDER, BINDER__CALL, NULL);
2045 static int selinux_binder_transfer_binder(const struct cred *from,
2046 const struct cred *to)
2048 return avc_has_perm(cred_sid(from), cred_sid(to),
2049 SECCLASS_BINDER, BINDER__TRANSFER,
2053 static int selinux_binder_transfer_file(const struct cred *from,
2054 const struct cred *to,
2055 const struct file *file)
2057 u32 sid = cred_sid(to);
2058 struct file_security_struct *fsec = selinux_file(file);
2059 struct dentry *dentry = file->f_path.dentry;
2060 struct inode_security_struct *isec;
2061 struct common_audit_data ad;
2064 ad.type = LSM_AUDIT_DATA_PATH;
2065 ad.u.path = file->f_path;
2067 if (sid != fsec->sid) {
2068 rc = avc_has_perm(sid, fsec->sid,
2076 #ifdef CONFIG_BPF_SYSCALL
2077 rc = bpf_fd_pass(file, sid);
2082 if (unlikely(IS_PRIVATE(d_backing_inode(dentry))))
2085 isec = backing_inode_security(dentry);
2086 return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2090 static int selinux_ptrace_access_check(struct task_struct *child,
2093 u32 sid = current_sid();
2094 u32 csid = task_sid_obj(child);
2096 if (mode & PTRACE_MODE_READ)
2097 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ,
2100 return avc_has_perm(sid, csid, SECCLASS_PROCESS, PROCESS__PTRACE,
2104 static int selinux_ptrace_traceme(struct task_struct *parent)
2106 return avc_has_perm(task_sid_obj(parent), task_sid_obj(current),
2107 SECCLASS_PROCESS, PROCESS__PTRACE, NULL);
2110 static int selinux_capget(const struct task_struct *target, kernel_cap_t *effective,
2111 kernel_cap_t *inheritable, kernel_cap_t *permitted)
2113 return avc_has_perm(current_sid(), task_sid_obj(target),
2114 SECCLASS_PROCESS, PROCESS__GETCAP, NULL);
2117 static int selinux_capset(struct cred *new, const struct cred *old,
2118 const kernel_cap_t *effective,
2119 const kernel_cap_t *inheritable,
2120 const kernel_cap_t *permitted)
2122 return avc_has_perm(cred_sid(old), cred_sid(new), SECCLASS_PROCESS,
2123 PROCESS__SETCAP, NULL);
2127 * (This comment used to live with the selinux_task_setuid hook,
2128 * which was removed).
2130 * Since setuid only affects the current process, and since the SELinux
2131 * controls are not based on the Linux identity attributes, SELinux does not
2132 * need to control this operation. However, SELinux does control the use of
2133 * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2136 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2137 int cap, unsigned int opts)
2139 return cred_has_capability(cred, cap, opts, ns == &init_user_ns);
2142 static int selinux_quotactl(int cmds, int type, int id, const struct super_block *sb)
2144 const struct cred *cred = current_cred();
2159 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2167 case Q_XGETNEXTQUOTA:
2168 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2171 rc = 0; /* let the kernel handle invalid cmds */
2177 static int selinux_quota_on(struct dentry *dentry)
2179 const struct cred *cred = current_cred();
2181 return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2184 static int selinux_syslog(int type)
2187 case SYSLOG_ACTION_READ_ALL: /* Read last kernel messages */
2188 case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2189 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2190 SECCLASS_SYSTEM, SYSTEM__SYSLOG_READ, NULL);
2191 case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2192 case SYSLOG_ACTION_CONSOLE_ON: /* Enable logging to console */
2193 /* Set level of messages printed to console */
2194 case SYSLOG_ACTION_CONSOLE_LEVEL:
2195 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2196 SECCLASS_SYSTEM, SYSTEM__SYSLOG_CONSOLE,
2199 /* All other syslog types */
2200 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
2201 SECCLASS_SYSTEM, SYSTEM__SYSLOG_MOD, NULL);
2205 * Check that a process has enough memory to allocate a new virtual
2206 * mapping. 0 means there is enough memory for the allocation to
2207 * succeed and -ENOMEM implies there is not.
2209 * Do not audit the selinux permission check, as this is applied to all
2210 * processes that allocate mappings.
2212 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2214 int rc, cap_sys_admin = 0;
2216 rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2217 CAP_OPT_NOAUDIT, true);
2221 return cap_sys_admin;
2224 /* binprm security operations */
2226 static u32 ptrace_parent_sid(void)
2229 struct task_struct *tracer;
2232 tracer = ptrace_parent(current);
2234 sid = task_sid_obj(tracer);
2240 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2241 const struct task_security_struct *old_tsec,
2242 const struct task_security_struct *new_tsec)
2244 int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2245 int nosuid = !mnt_may_suid(bprm->file->f_path.mnt);
2249 if (!nnp && !nosuid)
2250 return 0; /* neither NNP nor nosuid */
2252 if (new_tsec->sid == old_tsec->sid)
2253 return 0; /* No change in credentials */
2256 * If the policy enables the nnp_nosuid_transition policy capability,
2257 * then we permit transitions under NNP or nosuid if the
2258 * policy allows the corresponding permission between
2259 * the old and new contexts.
2261 if (selinux_policycap_nnp_nosuid_transition()) {
2264 av |= PROCESS2__NNP_TRANSITION;
2266 av |= PROCESS2__NOSUID_TRANSITION;
2267 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268 SECCLASS_PROCESS2, av, NULL);
2274 * We also permit NNP or nosuid transitions to bounded SIDs,
2275 * i.e. SIDs that are guaranteed to only be allowed a subset
2276 * of the permissions of the current SID.
2278 rc = security_bounded_transition(old_tsec->sid,
2284 * On failure, preserve the errno values for NNP vs nosuid.
2285 * NNP: Operation not permitted for caller.
2286 * nosuid: Permission denied to file.
2293 static int selinux_bprm_creds_for_exec(struct linux_binprm *bprm)
2295 const struct task_security_struct *old_tsec;
2296 struct task_security_struct *new_tsec;
2297 struct inode_security_struct *isec;
2298 struct common_audit_data ad;
2299 struct inode *inode = file_inode(bprm->file);
2302 /* SELinux context only depends on initial program or script and not
2303 * the script interpreter */
2305 old_tsec = selinux_cred(current_cred());
2306 new_tsec = selinux_cred(bprm->cred);
2307 isec = inode_security(inode);
2309 /* Default to the current task SID. */
2310 new_tsec->sid = old_tsec->sid;
2311 new_tsec->osid = old_tsec->sid;
2313 /* Reset fs, key, and sock SIDs on execve. */
2314 new_tsec->create_sid = 0;
2315 new_tsec->keycreate_sid = 0;
2316 new_tsec->sockcreate_sid = 0;
2319 * Before policy is loaded, label any task outside kernel space
2320 * as SECINITSID_INIT, so that any userspace tasks surviving from
2321 * early boot end up with a label different from SECINITSID_KERNEL
2322 * (if the policy chooses to set SECINITSID_INIT != SECINITSID_KERNEL).
2324 if (!selinux_initialized()) {
2325 new_tsec->sid = SECINITSID_INIT;
2326 /* also clear the exec_sid just in case */
2327 new_tsec->exec_sid = 0;
2331 if (old_tsec->exec_sid) {
2332 new_tsec->sid = old_tsec->exec_sid;
2333 /* Reset exec SID on execve. */
2334 new_tsec->exec_sid = 0;
2336 /* Fail on NNP or nosuid if not an allowed transition. */
2337 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2341 /* Check for a default transition on this program. */
2342 rc = security_transition_sid(old_tsec->sid,
2343 isec->sid, SECCLASS_PROCESS, NULL,
2349 * Fallback to old SID on NNP or nosuid if not an allowed
2352 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2354 new_tsec->sid = old_tsec->sid;
2357 ad.type = LSM_AUDIT_DATA_FILE;
2358 ad.u.file = bprm->file;
2360 if (new_tsec->sid == old_tsec->sid) {
2361 rc = avc_has_perm(old_tsec->sid, isec->sid,
2362 SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2366 /* Check permissions for the transition. */
2367 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2368 SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2372 rc = avc_has_perm(new_tsec->sid, isec->sid,
2373 SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2377 /* Check for shared state */
2378 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2379 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2380 SECCLASS_PROCESS, PROCESS__SHARE,
2386 /* Make sure that anyone attempting to ptrace over a task that
2387 * changes its SID has the appropriate permit */
2388 if (bprm->unsafe & LSM_UNSAFE_PTRACE) {
2389 u32 ptsid = ptrace_parent_sid();
2391 rc = avc_has_perm(ptsid, new_tsec->sid,
2393 PROCESS__PTRACE, NULL);
2399 /* Clear any possibly unsafe personality bits on exec: */
2400 bprm->per_clear |= PER_CLEAR_ON_SETID;
2402 /* Enable secure mode for SIDs transitions unless
2403 the noatsecure permission is granted between
2404 the two SIDs, i.e. ahp returns 0. */
2405 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2406 SECCLASS_PROCESS, PROCESS__NOATSECURE,
2408 bprm->secureexec |= !!rc;
2414 static int match_file(const void *p, struct file *file, unsigned fd)
2416 return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2419 /* Derived from fs/exec.c:flush_old_files. */
2420 static inline void flush_unauthorized_files(const struct cred *cred,
2421 struct files_struct *files)
2423 struct file *file, *devnull = NULL;
2424 struct tty_struct *tty;
2428 tty = get_current_tty();
2430 spin_lock(&tty->files_lock);
2431 if (!list_empty(&tty->tty_files)) {
2432 struct tty_file_private *file_priv;
2434 /* Revalidate access to controlling tty.
2435 Use file_path_has_perm on the tty path directly
2436 rather than using file_has_perm, as this particular
2437 open file may belong to another process and we are
2438 only interested in the inode-based check here. */
2439 file_priv = list_first_entry(&tty->tty_files,
2440 struct tty_file_private, list);
2441 file = file_priv->file;
2442 if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2445 spin_unlock(&tty->files_lock);
2448 /* Reset controlling tty. */
2452 /* Revalidate access to inherited open files. */
2453 n = iterate_fd(files, 0, match_file, cred);
2454 if (!n) /* none found? */
2457 devnull = dentry_open(&selinux_null, O_RDWR, cred);
2458 if (IS_ERR(devnull))
2460 /* replace all the matching ones with this */
2462 replace_fd(n - 1, devnull, 0);
2463 } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2469 * Prepare a process for imminent new credential changes due to exec
2471 static void selinux_bprm_committing_creds(const struct linux_binprm *bprm)
2473 struct task_security_struct *new_tsec;
2474 struct rlimit *rlim, *initrlim;
2477 new_tsec = selinux_cred(bprm->cred);
2478 if (new_tsec->sid == new_tsec->osid)
2481 /* Close files for which the new task SID is not authorized. */
2482 flush_unauthorized_files(bprm->cred, current->files);
2484 /* Always clear parent death signal on SID transitions. */
2485 current->pdeath_signal = 0;
2487 /* Check whether the new SID can inherit resource limits from the old
2488 * SID. If not, reset all soft limits to the lower of the current
2489 * task's hard limit and the init task's soft limit.
2491 * Note that the setting of hard limits (even to lower them) can be
2492 * controlled by the setrlimit check. The inclusion of the init task's
2493 * soft limit into the computation is to avoid resetting soft limits
2494 * higher than the default soft limit for cases where the default is
2495 * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2497 rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2498 PROCESS__RLIMITINH, NULL);
2500 /* protect against do_prlimit() */
2502 for (i = 0; i < RLIM_NLIMITS; i++) {
2503 rlim = current->signal->rlim + i;
2504 initrlim = init_task.signal->rlim + i;
2505 rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2507 task_unlock(current);
2508 if (IS_ENABLED(CONFIG_POSIX_TIMERS))
2509 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2514 * Clean up the process immediately after the installation of new credentials
2517 static void selinux_bprm_committed_creds(const struct linux_binprm *bprm)
2519 const struct task_security_struct *tsec = selinux_cred(current_cred());
2529 /* Check whether the new SID can inherit signal state from the old SID.
2530 * If not, clear itimers to avoid subsequent signal generation and
2531 * flush and unblock signals.
2533 * This must occur _after_ the task SID has been updated so that any
2534 * kill done after the flush will be checked against the new SID.
2536 rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2540 spin_lock_irq(&unrcu_pointer(current->sighand)->siglock);
2541 if (!fatal_signal_pending(current)) {
2542 flush_sigqueue(¤t->pending);
2543 flush_sigqueue(¤t->signal->shared_pending);
2544 flush_signal_handlers(current, 1);
2545 sigemptyset(¤t->blocked);
2546 recalc_sigpending();
2548 spin_unlock_irq(&unrcu_pointer(current->sighand)->siglock);
2551 /* Wake up the parent if it is waiting so that it can recheck
2552 * wait permission to the new task SID. */
2553 read_lock(&tasklist_lock);
2554 __wake_up_parent(current, unrcu_pointer(current->real_parent));
2555 read_unlock(&tasklist_lock);
2558 /* superblock security operations */
2560 static int selinux_sb_alloc_security(struct super_block *sb)
2562 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2564 mutex_init(&sbsec->lock);
2565 INIT_LIST_HEAD(&sbsec->isec_head);
2566 spin_lock_init(&sbsec->isec_lock);
2567 sbsec->sid = SECINITSID_UNLABELED;
2568 sbsec->def_sid = SECINITSID_FILE;
2569 sbsec->mntpoint_sid = SECINITSID_UNLABELED;
2574 static inline int opt_len(const char *s)
2576 bool open_quote = false;
2580 for (len = 0; (c = s[len]) != '\0'; len++) {
2582 open_quote = !open_quote;
2583 if (c == ',' && !open_quote)
2589 static int selinux_sb_eat_lsm_opts(char *options, void **mnt_opts)
2591 char *from = options;
2597 int len = opt_len(from);
2601 token = match_opt_prefix(from, len, &arg);
2603 if (token != Opt_error) {
2608 for (p = q = arg; p < from + len; p++) {
2613 arg = kmemdup_nul(arg, q - arg, GFP_KERNEL);
2619 rc = selinux_add_opt(token, arg, mnt_opts);
2626 if (!first) { // copy with preceding comma
2631 memmove(to, from, len);
2644 selinux_free_mnt_opts(*mnt_opts);
2650 static int selinux_sb_mnt_opts_compat(struct super_block *sb, void *mnt_opts)
2652 struct selinux_mnt_opts *opts = mnt_opts;
2653 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2656 * Superblock not initialized (i.e. no options) - reject if any
2657 * options specified, otherwise accept.
2659 if (!(sbsec->flags & SE_SBINITIALIZED))
2660 return opts ? 1 : 0;
2663 * Superblock initialized and no options specified - reject if
2664 * superblock has any options set, otherwise accept.
2667 return (sbsec->flags & SE_MNTMASK) ? 1 : 0;
2669 if (opts->fscontext_sid) {
2670 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2671 opts->fscontext_sid))
2674 if (opts->context_sid) {
2675 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2679 if (opts->rootcontext_sid) {
2680 struct inode_security_struct *root_isec;
2682 root_isec = backing_inode_security(sb->s_root);
2683 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2684 opts->rootcontext_sid))
2687 if (opts->defcontext_sid) {
2688 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2689 opts->defcontext_sid))
2695 static int selinux_sb_remount(struct super_block *sb, void *mnt_opts)
2697 struct selinux_mnt_opts *opts = mnt_opts;
2698 struct superblock_security_struct *sbsec = selinux_superblock(sb);
2700 if (!(sbsec->flags & SE_SBINITIALIZED))
2706 if (opts->fscontext_sid) {
2707 if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
2708 opts->fscontext_sid))
2709 goto out_bad_option;
2711 if (opts->context_sid) {
2712 if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
2714 goto out_bad_option;
2716 if (opts->rootcontext_sid) {
2717 struct inode_security_struct *root_isec;
2718 root_isec = backing_inode_security(sb->s_root);
2719 if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
2720 opts->rootcontext_sid))
2721 goto out_bad_option;
2723 if (opts->defcontext_sid) {
2724 if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
2725 opts->defcontext_sid))
2726 goto out_bad_option;
2731 pr_warn("SELinux: unable to change security options "
2732 "during remount (dev %s, type=%s)\n", sb->s_id,
2737 static int selinux_sb_kern_mount(const struct super_block *sb)
2739 const struct cred *cred = current_cred();
2740 struct common_audit_data ad;
2742 ad.type = LSM_AUDIT_DATA_DENTRY;
2743 ad.u.dentry = sb->s_root;
2744 return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2747 static int selinux_sb_statfs(struct dentry *dentry)
2749 const struct cred *cred = current_cred();
2750 struct common_audit_data ad;
2752 ad.type = LSM_AUDIT_DATA_DENTRY;
2753 ad.u.dentry = dentry->d_sb->s_root;
2754 return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2757 static int selinux_mount(const char *dev_name,
2758 const struct path *path,
2760 unsigned long flags,
2763 const struct cred *cred = current_cred();
2765 if (flags & MS_REMOUNT)
2766 return superblock_has_perm(cred, path->dentry->d_sb,
2767 FILESYSTEM__REMOUNT, NULL);
2769 return path_has_perm(cred, path, FILE__MOUNTON);
2772 static int selinux_move_mount(const struct path *from_path,
2773 const struct path *to_path)
2775 const struct cred *cred = current_cred();
2777 return path_has_perm(cred, to_path, FILE__MOUNTON);
2780 static int selinux_umount(struct vfsmount *mnt, int flags)
2782 const struct cred *cred = current_cred();
2784 return superblock_has_perm(cred, mnt->mnt_sb,
2785 FILESYSTEM__UNMOUNT, NULL);
2788 static int selinux_fs_context_submount(struct fs_context *fc,
2789 struct super_block *reference)
2791 const struct superblock_security_struct *sbsec = selinux_superblock(reference);
2792 struct selinux_mnt_opts *opts;
2795 * Ensure that fc->security remains NULL when no options are set
2796 * as expected by selinux_set_mnt_opts().
2798 if (!(sbsec->flags & (FSCONTEXT_MNT|CONTEXT_MNT|DEFCONTEXT_MNT)))
2801 opts = kzalloc(sizeof(*opts), GFP_KERNEL);
2805 if (sbsec->flags & FSCONTEXT_MNT)
2806 opts->fscontext_sid = sbsec->sid;
2807 if (sbsec->flags & CONTEXT_MNT)
2808 opts->context_sid = sbsec->mntpoint_sid;
2809 if (sbsec->flags & DEFCONTEXT_MNT)
2810 opts->defcontext_sid = sbsec->def_sid;
2811 fc->security = opts;
2815 static int selinux_fs_context_dup(struct fs_context *fc,
2816 struct fs_context *src_fc)
2818 const struct selinux_mnt_opts *src = src_fc->security;
2823 fc->security = kmemdup(src, sizeof(*src), GFP_KERNEL);
2824 return fc->security ? 0 : -ENOMEM;
2827 static const struct fs_parameter_spec selinux_fs_parameters[] = {
2828 fsparam_string(CONTEXT_STR, Opt_context),
2829 fsparam_string(DEFCONTEXT_STR, Opt_defcontext),
2830 fsparam_string(FSCONTEXT_STR, Opt_fscontext),
2831 fsparam_string(ROOTCONTEXT_STR, Opt_rootcontext),
2832 fsparam_flag (SECLABEL_STR, Opt_seclabel),
2836 static int selinux_fs_context_parse_param(struct fs_context *fc,
2837 struct fs_parameter *param)
2839 struct fs_parse_result result;
2842 opt = fs_parse(fc, selinux_fs_parameters, param, &result);
2846 return selinux_add_opt(opt, param->string, &fc->security);
2849 /* inode security operations */
2851 static int selinux_inode_alloc_security(struct inode *inode)
2853 struct inode_security_struct *isec = selinux_inode(inode);
2854 u32 sid = current_sid();
2856 spin_lock_init(&isec->lock);
2857 INIT_LIST_HEAD(&isec->list);
2858 isec->inode = inode;
2859 isec->sid = SECINITSID_UNLABELED;
2860 isec->sclass = SECCLASS_FILE;
2861 isec->task_sid = sid;
2862 isec->initialized = LABEL_INVALID;
2867 static void selinux_inode_free_security(struct inode *inode)
2869 inode_free_security(inode);
2872 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2873 const struct qstr *name,
2874 const char **xattr_name, void **ctx,
2880 rc = selinux_determine_inode_label(selinux_cred(current_cred()),
2881 d_inode(dentry->d_parent), name,
2882 inode_mode_to_security_class(mode),
2888 *xattr_name = XATTR_NAME_SELINUX;
2890 return security_sid_to_context(newsid, (char **)ctx,
2894 static int selinux_dentry_create_files_as(struct dentry *dentry, int mode,
2896 const struct cred *old,
2901 struct task_security_struct *tsec;
2903 rc = selinux_determine_inode_label(selinux_cred(old),
2904 d_inode(dentry->d_parent), name,
2905 inode_mode_to_security_class(mode),
2910 tsec = selinux_cred(new);
2911 tsec->create_sid = newsid;
2915 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2916 const struct qstr *qstr,
2917 struct xattr *xattrs, int *xattr_count)
2919 const struct task_security_struct *tsec = selinux_cred(current_cred());
2920 struct superblock_security_struct *sbsec;
2921 struct xattr *xattr = lsm_get_xattr_slot(xattrs, xattr_count);
2927 sbsec = selinux_superblock(dir->i_sb);
2929 newsid = tsec->create_sid;
2930 newsclass = inode_mode_to_security_class(inode->i_mode);
2931 rc = selinux_determine_inode_label(tsec, dir, qstr, newsclass, &newsid);
2935 /* Possibly defer initialization to selinux_complete_init. */
2936 if (sbsec->flags & SE_SBINITIALIZED) {
2937 struct inode_security_struct *isec = selinux_inode(inode);
2938 isec->sclass = newsclass;
2940 isec->initialized = LABEL_INITIALIZED;
2943 if (!selinux_initialized() ||
2944 !(sbsec->flags & SBLABEL_MNT))
2948 rc = security_sid_to_context_force(newsid,
2952 xattr->value = context;
2953 xattr->value_len = clen;
2954 xattr->name = XATTR_SELINUX_SUFFIX;
2960 static int selinux_inode_init_security_anon(struct inode *inode,
2961 const struct qstr *name,
2962 const struct inode *context_inode)
2964 u32 sid = current_sid();
2965 struct common_audit_data ad;
2966 struct inode_security_struct *isec;
2969 if (unlikely(!selinux_initialized()))
2972 isec = selinux_inode(inode);
2975 * We only get here once per ephemeral inode. The inode has
2976 * been initialized via inode_alloc_security but is otherwise
2980 if (context_inode) {
2981 struct inode_security_struct *context_isec =
2982 selinux_inode(context_inode);
2983 if (context_isec->initialized != LABEL_INITIALIZED) {
2984 pr_err("SELinux: context_inode is not initialized\n");
2988 isec->sclass = context_isec->sclass;
2989 isec->sid = context_isec->sid;
2991 isec->sclass = SECCLASS_ANON_INODE;
2992 rc = security_transition_sid(
2994 isec->sclass, name, &isec->sid);
2999 isec->initialized = LABEL_INITIALIZED;
3001 * Now that we've initialized security, check whether we're
3002 * allowed to actually create this type of anonymous inode.
3005 ad.type = LSM_AUDIT_DATA_ANONINODE;
3006 ad.u.anonclass = name ? (const char *)name->name : "?";
3008 return avc_has_perm(sid,
3015 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
3017 return may_create(dir, dentry, SECCLASS_FILE);
3020 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
3022 return may_link(dir, old_dentry, MAY_LINK);
3025 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
3027 return may_link(dir, dentry, MAY_UNLINK);
3030 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
3032 return may_create(dir, dentry, SECCLASS_LNK_FILE);
3035 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
3037 return may_create(dir, dentry, SECCLASS_DIR);
3040 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
3042 return may_link(dir, dentry, MAY_RMDIR);
3045 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
3047 return may_create(dir, dentry, inode_mode_to_security_class(mode));
3050 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
3051 struct inode *new_inode, struct dentry *new_dentry)
3053 return may_rename(old_inode, old_dentry, new_inode, new_dentry);
3056 static int selinux_inode_readlink(struct dentry *dentry)
3058 const struct cred *cred = current_cred();
3060 return dentry_has_perm(cred, dentry, FILE__READ);
3063 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
3066 struct common_audit_data ad;
3067 struct inode_security_struct *isec;
3068 u32 sid = current_sid();
3070 ad.type = LSM_AUDIT_DATA_DENTRY;
3071 ad.u.dentry = dentry;
3072 isec = inode_security_rcu(inode, rcu);
3074 return PTR_ERR(isec);
3076 return avc_has_perm(sid, isec->sid, isec->sclass, FILE__READ, &ad);
3079 static noinline int audit_inode_permission(struct inode *inode,
3080 u32 perms, u32 audited, u32 denied,
3083 struct common_audit_data ad;
3084 struct inode_security_struct *isec = selinux_inode(inode);
3086 ad.type = LSM_AUDIT_DATA_INODE;
3089 return slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
3090 audited, denied, result, &ad);
3093 static int selinux_inode_permission(struct inode *inode, int mask)
3097 bool no_block = mask & MAY_NOT_BLOCK;
3098 struct inode_security_struct *isec;
3099 u32 sid = current_sid();
3100 struct av_decision avd;
3102 u32 audited, denied;
3104 from_access = mask & MAY_ACCESS;
3105 mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
3107 /* No permission to check. Existence test. */
3111 if (unlikely(IS_PRIVATE(inode)))
3114 perms = file_mask_to_av(inode->i_mode, mask);
3116 isec = inode_security_rcu(inode, no_block);
3118 return PTR_ERR(isec);
3120 rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0,
3122 audited = avc_audit_required(perms, &avd, rc,
3123 from_access ? FILE__AUDIT_ACCESS : 0,
3125 if (likely(!audited))
3128 rc2 = audit_inode_permission(inode, perms, audited, denied, rc);
3134 static int selinux_inode_setattr(struct mnt_idmap *idmap, struct dentry *dentry,
3135 struct iattr *iattr)
3137 const struct cred *cred = current_cred();
3138 struct inode *inode = d_backing_inode(dentry);
3139 unsigned int ia_valid = iattr->ia_valid;
3140 __u32 av = FILE__WRITE;
3142 /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
3143 if (ia_valid & ATTR_FORCE) {
3144 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
3150 if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
3151 ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
3152 return dentry_has_perm(cred, dentry, FILE__SETATTR);
3154 if (selinux_policycap_openperm() &&
3155 inode->i_sb->s_magic != SOCKFS_MAGIC &&
3156 (ia_valid & ATTR_SIZE) &&
3157 !(ia_valid & ATTR_FILE))
3160 return dentry_has_perm(cred, dentry, av);
3163 static int selinux_inode_getattr(const struct path *path)
3165 return path_has_perm(current_cred(), path, FILE__GETATTR);
3168 static bool has_cap_mac_admin(bool audit)
3170 const struct cred *cred = current_cred();
3171 unsigned int opts = audit ? CAP_OPT_NONE : CAP_OPT_NOAUDIT;
3173 if (cap_capable(cred, &init_user_ns, CAP_MAC_ADMIN, opts))
3175 if (cred_has_capability(cred, CAP_MAC_ADMIN, opts, true))
3180 static int selinux_inode_setxattr(struct mnt_idmap *idmap,
3181 struct dentry *dentry, const char *name,
3182 const void *value, size_t size, int flags)
3184 struct inode *inode = d_backing_inode(dentry);
3185 struct inode_security_struct *isec;
3186 struct superblock_security_struct *sbsec;
3187 struct common_audit_data ad;
3188 u32 newsid, sid = current_sid();
3191 if (strcmp(name, XATTR_NAME_SELINUX)) {
3192 rc = cap_inode_setxattr(dentry, name, value, size, flags);
3196 /* Not an attribute we recognize, so just check the
3197 ordinary setattr permission. */
3198 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3201 if (!selinux_initialized())
3202 return (inode_owner_or_capable(idmap, inode) ? 0 : -EPERM);
3204 sbsec = selinux_superblock(inode->i_sb);
3205 if (!(sbsec->flags & SBLABEL_MNT))
3208 if (!inode_owner_or_capable(idmap, inode))
3211 ad.type = LSM_AUDIT_DATA_DENTRY;
3212 ad.u.dentry = dentry;
3214 isec = backing_inode_security(dentry);
3215 rc = avc_has_perm(sid, isec->sid, isec->sclass,
3216 FILE__RELABELFROM, &ad);
3220 rc = security_context_to_sid(value, size, &newsid,
3222 if (rc == -EINVAL) {
3223 if (!has_cap_mac_admin(true)) {
3224 struct audit_buffer *ab;
3227 /* We strip a nul only if it is at the end, otherwise the
3228 * context contains a nul and we should audit that */
3230 const char *str = value;
3232 if (str[size - 1] == '\0')
3233 audit_size = size - 1;
3239 ab = audit_log_start(audit_context(),
3240 GFP_ATOMIC, AUDIT_SELINUX_ERR);
3243 audit_log_format(ab, "op=setxattr invalid_context=");
3244 audit_log_n_untrustedstring(ab, value, audit_size);
3249 rc = security_context_to_sid_force(value,
3255 rc = avc_has_perm(sid, newsid, isec->sclass,
3256 FILE__RELABELTO, &ad);
3260 rc = security_validate_transition(isec->sid, newsid,
3265 return avc_has_perm(newsid,
3267 SECCLASS_FILESYSTEM,
3268 FILESYSTEM__ASSOCIATE,
3272 static int selinux_inode_set_acl(struct mnt_idmap *idmap,
3273 struct dentry *dentry, const char *acl_name,
3274 struct posix_acl *kacl)
3276 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3279 static int selinux_inode_get_acl(struct mnt_idmap *idmap,
3280 struct dentry *dentry, const char *acl_name)
3282 return dentry_has_perm(current_cred(), dentry, FILE__GETATTR);
3285 static int selinux_inode_remove_acl(struct mnt_idmap *idmap,
3286 struct dentry *dentry, const char *acl_name)
3288 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3291 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3292 const void *value, size_t size,
3295 struct inode *inode = d_backing_inode(dentry);
3296 struct inode_security_struct *isec;
3300 if (strcmp(name, XATTR_NAME_SELINUX)) {
3301 /* Not an attribute we recognize, so nothing to do. */
3305 if (!selinux_initialized()) {
3306 /* If we haven't even been initialized, then we can't validate
3307 * against a policy, so leave the label as invalid. It may
3308 * resolve to a valid label on the next revalidation try if
3309 * we've since initialized.
3314 rc = security_context_to_sid_force(value, size,
3317 pr_err("SELinux: unable to map context to SID"
3318 "for (%s, %lu), rc=%d\n",
3319 inode->i_sb->s_id, inode->i_ino, -rc);
3323 isec = backing_inode_security(dentry);
3324 spin_lock(&isec->lock);
3325 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3327 isec->initialized = LABEL_INITIALIZED;
3328 spin_unlock(&isec->lock);
3331 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3333 const struct cred *cred = current_cred();
3335 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3338 static int selinux_inode_listxattr(struct dentry *dentry)
3340 const struct cred *cred = current_cred();
3342 return dentry_has_perm(cred, dentry, FILE__GETATTR);
3345 static int selinux_inode_removexattr(struct mnt_idmap *idmap,
3346 struct dentry *dentry, const char *name)
3348 if (strcmp(name, XATTR_NAME_SELINUX)) {
3349 int rc = cap_inode_removexattr(idmap, dentry, name);
3353 /* Not an attribute we recognize, so just check the
3354 ordinary setattr permission. */
3355 return dentry_has_perm(current_cred(), dentry, FILE__SETATTR);
3358 if (!selinux_initialized())
3361 /* No one is allowed to remove a SELinux security label.
3362 You can change the label, but all data must be labeled. */
3366 static int selinux_path_notify(const struct path *path, u64 mask,
3367 unsigned int obj_type)
3372 struct common_audit_data ad;
3374 ad.type = LSM_AUDIT_DATA_PATH;
3378 * Set permission needed based on the type of mark being set.
3379 * Performs an additional check for sb watches.
3382 case FSNOTIFY_OBJ_TYPE_VFSMOUNT:
3383 perm = FILE__WATCH_MOUNT;
3385 case FSNOTIFY_OBJ_TYPE_SB:
3386 perm = FILE__WATCH_SB;
3387 ret = superblock_has_perm(current_cred(), path->dentry->d_sb,
3388 FILESYSTEM__WATCH, &ad);
3392 case FSNOTIFY_OBJ_TYPE_INODE:
3399 /* blocking watches require the file:watch_with_perm permission */
3400 if (mask & (ALL_FSNOTIFY_PERM_EVENTS))
3401 perm |= FILE__WATCH_WITH_PERM;
3403 /* watches on read-like events need the file:watch_reads permission */
3404 if (mask & (FS_ACCESS | FS_ACCESS_PERM | FS_CLOSE_NOWRITE))
3405 perm |= FILE__WATCH_READS;
3407 return path_has_perm(current_cred(), path, perm);
3411 * Copy the inode security context value to the user.
3413 * Permission check is handled by selinux_inode_getxattr hook.
3415 static int selinux_inode_getsecurity(struct mnt_idmap *idmap,
3416 struct inode *inode, const char *name,
3417 void **buffer, bool alloc)
3421 char *context = NULL;
3422 struct inode_security_struct *isec;
3425 * If we're not initialized yet, then we can't validate contexts, so
3426 * just let vfs_getxattr fall back to using the on-disk xattr.
3428 if (!selinux_initialized() ||
3429 strcmp(name, XATTR_SELINUX_SUFFIX))
3433 * If the caller has CAP_MAC_ADMIN, then get the raw context
3434 * value even if it is not defined by current policy; otherwise,
3435 * use the in-core value under current policy.
3436 * Use the non-auditing forms of the permission checks since
3437 * getxattr may be called by unprivileged processes commonly
3438 * and lack of permission just means that we fall back to the
3439 * in-core context value, not a denial.
3441 isec = inode_security(inode);
3442 if (has_cap_mac_admin(false))
3443 error = security_sid_to_context_force(isec->sid, &context,
3446 error = security_sid_to_context(isec->sid,
3460 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3461 const void *value, size_t size, int flags)
3463 struct inode_security_struct *isec = inode_security_novalidate(inode);
3464 struct superblock_security_struct *sbsec;
3468 if (strcmp(name, XATTR_SELINUX_SUFFIX))
3471 sbsec = selinux_superblock(inode->i_sb);
3472 if (!(sbsec->flags & SBLABEL_MNT))
3475 if (!value || !size)
3478 rc = security_context_to_sid(value, size, &newsid,
3483 spin_lock(&isec->lock);
3484 isec->sclass = inode_mode_to_security_class(inode->i_mode);
3486 isec->initialized = LABEL_INITIALIZED;
3487 spin_unlock(&isec->lock);
3491 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3493 const int len = sizeof(XATTR_NAME_SELINUX);
3495 if (!selinux_initialized())
3498 if (buffer && len <= buffer_size)
3499 memcpy(buffer, XATTR_NAME_SELINUX, len);
3503 static void selinux_inode_getsecid(struct inode *inode, u32 *secid)
3505 struct inode_security_struct *isec = inode_security_novalidate(inode);
3509 static int selinux_inode_copy_up(struct dentry *src, struct cred **new)
3512 struct task_security_struct *tsec;
3513 struct cred *new_creds = *new;
3515 if (new_creds == NULL) {
3516 new_creds = prepare_creds();
3521 tsec = selinux_cred(new_creds);
3522 /* Get label from overlay inode and set it in create_sid */
3523 selinux_inode_getsecid(d_inode(src), &sid);
3524 tsec->create_sid = sid;
3529 static int selinux_inode_copy_up_xattr(struct dentry *dentry, const char *name)
3531 /* The copy_up hook above sets the initial context on an inode, but we
3532 * don't then want to overwrite it by blindly copying all the lower
3533 * xattrs up. Instead, filter out SELinux-related xattrs following
3536 if (selinux_initialized() && strcmp(name, XATTR_NAME_SELINUX) == 0)
3537 return 1; /* Discard */
3539 * Any other attribute apart from SELINUX is not claimed, supported
3545 /* kernfs node operations */
3547 static int selinux_kernfs_init_security(struct kernfs_node *kn_dir,
3548 struct kernfs_node *kn)
3550 const struct task_security_struct *tsec = selinux_cred(current_cred());
3551 u32 parent_sid, newsid, clen;
3555 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, NULL, 0);
3562 context = kmalloc(clen, GFP_KERNEL);
3566 rc = kernfs_xattr_get(kn_dir, XATTR_NAME_SELINUX, context, clen);
3572 rc = security_context_to_sid(context, clen, &parent_sid,
3578 if (tsec->create_sid) {
3579 newsid = tsec->create_sid;
3581 u16 secclass = inode_mode_to_security_class(kn->mode);
3585 q.hash_len = hashlen_string(kn_dir, kn->name);
3587 rc = security_transition_sid(tsec->sid,
3588 parent_sid, secclass, &q,
3594 rc = security_sid_to_context_force(newsid,
3599 rc = kernfs_xattr_set(kn, XATTR_NAME_SELINUX, context, clen,
3606 /* file security operations */
3608 static int selinux_revalidate_file_permission(struct file *file, int mask)
3610 const struct cred *cred = current_cred();
3611 struct inode *inode = file_inode(file);
3613 /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3614 if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3617 return file_has_perm(cred, file,
3618 file_mask_to_av(inode->i_mode, mask));
3621 static int selinux_file_permission(struct file *file, int mask)
3623 struct inode *inode = file_inode(file);
3624 struct file_security_struct *fsec = selinux_file(file);
3625 struct inode_security_struct *isec;
3626 u32 sid = current_sid();
3629 /* No permission to check. Existence test. */
3632 isec = inode_security(inode);
3633 if (sid == fsec->sid && fsec->isid == isec->sid &&
3634 fsec->pseqno == avc_policy_seqno())
3635 /* No change since file_open check. */
3638 return selinux_revalidate_file_permission(file, mask);
3641 static int selinux_file_alloc_security(struct file *file)
3643 struct file_security_struct *fsec = selinux_file(file);
3644 u32 sid = current_sid();
3647 fsec->fown_sid = sid;
3653 * Check whether a task has the ioctl permission and cmd
3654 * operation to an inode.
3656 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3657 u32 requested, u16 cmd)
3659 struct common_audit_data ad;
3660 struct file_security_struct *fsec = selinux_file(file);
3661 struct inode *inode = file_inode(file);
3662 struct inode_security_struct *isec;
3663 struct lsm_ioctlop_audit ioctl;
3664 u32 ssid = cred_sid(cred);
3666 u8 driver = cmd >> 8;
3667 u8 xperm = cmd & 0xff;
3669 ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3672 ad.u.op->path = file->f_path;
3674 if (ssid != fsec->sid) {
3675 rc = avc_has_perm(ssid, fsec->sid,
3683 if (unlikely(IS_PRIVATE(inode)))
3686 isec = inode_security(inode);
3687 rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3688 requested, driver, xperm, &ad);
3693 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3696 const struct cred *cred = current_cred();
3703 case FS_IOC_GETFLAGS:
3704 case FS_IOC_GETVERSION:
3705 error = file_has_perm(cred, file, FILE__GETATTR);
3708 case FS_IOC_SETFLAGS:
3709 case FS_IOC_SETVERSION:
3710 error = file_has_perm(cred, file, FILE__SETATTR);
3713 /* sys_ioctl() checks */
3716 error = file_has_perm(cred, file, 0);
3721 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3722 CAP_OPT_NONE, true);
3727 if (!selinux_policycap_ioctl_skip_cloexec())
3728 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3731 /* default case assumes that the command will go
3732 * to the file's ioctl() function.
3735 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3740 static int selinux_file_ioctl_compat(struct file *file, unsigned int cmd,
3744 * If we are in a 64-bit kernel running 32-bit userspace, we need to
3745 * make sure we don't compare 32-bit flags to 64-bit flags.
3748 case FS_IOC32_GETFLAGS:
3749 cmd = FS_IOC_GETFLAGS;
3751 case FS_IOC32_SETFLAGS:
3752 cmd = FS_IOC_SETFLAGS;
3754 case FS_IOC32_GETVERSION:
3755 cmd = FS_IOC_GETVERSION;
3757 case FS_IOC32_SETVERSION:
3758 cmd = FS_IOC_SETVERSION;
3764 return selinux_file_ioctl(file, cmd, arg);
3767 static int default_noexec __ro_after_init;
3769 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3771 const struct cred *cred = current_cred();
3772 u32 sid = cred_sid(cred);
3775 if (default_noexec &&
3776 (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3777 (!shared && (prot & PROT_WRITE)))) {
3779 * We are making executable an anonymous mapping or a
3780 * private file mapping that will also be writable.
3781 * This has an additional check.
3783 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3784 PROCESS__EXECMEM, NULL);
3790 /* read access is always possible with a mapping */
3791 u32 av = FILE__READ;
3793 /* write access only matters if the mapping is shared */
3794 if (shared && (prot & PROT_WRITE))
3797 if (prot & PROT_EXEC)
3798 av |= FILE__EXECUTE;
3800 return file_has_perm(cred, file, av);
3807 static int selinux_mmap_addr(unsigned long addr)
3811 if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3812 u32 sid = current_sid();
3813 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3814 MEMPROTECT__MMAP_ZERO, NULL);
3820 static int selinux_mmap_file(struct file *file,
3821 unsigned long reqprot __always_unused,
3822 unsigned long prot, unsigned long flags)
3824 struct common_audit_data ad;
3828 ad.type = LSM_AUDIT_DATA_FILE;
3830 rc = inode_has_perm(current_cred(), file_inode(file),
3836 return file_map_prot_check(file, prot,
3837 (flags & MAP_TYPE) == MAP_SHARED);
3840 static int selinux_file_mprotect(struct vm_area_struct *vma,
3841 unsigned long reqprot __always_unused,
3844 const struct cred *cred = current_cred();
3845 u32 sid = cred_sid(cred);
3847 if (default_noexec &&
3848 (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3850 if (vma_is_initial_heap(vma)) {
3851 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3852 PROCESS__EXECHEAP, NULL);
3853 } else if (!vma->vm_file && (vma_is_initial_stack(vma) ||
3854 vma_is_stack_for_current(vma))) {
3855 rc = avc_has_perm(sid, sid, SECCLASS_PROCESS,
3856 PROCESS__EXECSTACK, NULL);
3857 } else if (vma->vm_file && vma->anon_vma) {
3859 * We are making executable a file mapping that has
3860 * had some COW done. Since pages might have been
3861 * written, check ability to execute the possibly
3862 * modified content. This typically should only
3863 * occur for text relocations.
3865 rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3871 return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3874 static int selinux_file_lock(struct file *file, unsigned int cmd)
3876 const struct cred *cred = current_cred();
3878 return file_has_perm(cred, file, FILE__LOCK);
3881 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3884 const struct cred *cred = current_cred();
3889 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3890 err = file_has_perm(cred, file, FILE__WRITE);
3899 case F_GETOWNER_UIDS:
3900 /* Just check FD__USE permission */
3901 err = file_has_perm(cred, file, 0);
3909 #if BITS_PER_LONG == 32
3914 err = file_has_perm(cred, file, FILE__LOCK);
3921 static void selinux_file_set_fowner(struct file *file)
3923 struct file_security_struct *fsec;
3925 fsec = selinux_file(file);
3926 fsec->fown_sid = current_sid();
3929 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3930 struct fown_struct *fown, int signum)
3933 u32 sid = task_sid_obj(tsk);
3935 struct file_security_struct *fsec;
3937 /* struct fown_struct is never outside the context of a struct file */
3938 file = container_of(fown, struct file, f_owner);
3940 fsec = selinux_file(file);
3943 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3945 perm = signal_to_av(signum);
3947 return avc_has_perm(fsec->fown_sid, sid,
3948 SECCLASS_PROCESS, perm, NULL);
3951 static int selinux_file_receive(struct file *file)
3953 const struct cred *cred = current_cred();
3955 return file_has_perm(cred, file, file_to_av(file));
3958 static int selinux_file_open(struct file *file)
3960 struct file_security_struct *fsec;
3961 struct inode_security_struct *isec;
3963 fsec = selinux_file(file);
3964 isec = inode_security(file_inode(file));
3966 * Save inode label and policy sequence number
3967 * at open-time so that selinux_file_permission
3968 * can determine whether revalidation is necessary.
3969 * Task label is already saved in the file security
3970 * struct as its SID.
3972 fsec->isid = isec->sid;
3973 fsec->pseqno = avc_policy_seqno();
3975 * Since the inode label or policy seqno may have changed
3976 * between the selinux_inode_permission check and the saving
3977 * of state above, recheck that access is still permitted.
3978 * Otherwise, access might never be revalidated against the
3979 * new inode label or new policy.
3980 * This check is not redundant - do not remove.
3982 return file_path_has_perm(file->f_cred, file, open_file_to_av(file));
3985 /* task security operations */
3987 static int selinux_task_alloc(struct task_struct *task,
3988 unsigned long clone_flags)
3990 u32 sid = current_sid();
3992 return avc_has_perm(sid, sid, SECCLASS_PROCESS, PROCESS__FORK, NULL);
3996 * prepare a new set of credentials for modification
3998 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
4001 const struct task_security_struct *old_tsec = selinux_cred(old);
4002 struct task_security_struct *tsec = selinux_cred(new);
4009 * transfer the SELinux data to a blank set of creds
4011 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
4013 const struct task_security_struct *old_tsec = selinux_cred(old);
4014 struct task_security_struct *tsec = selinux_cred(new);
4019 static void selinux_cred_getsecid(const struct cred *c, u32 *secid)
4021 *secid = cred_sid(c);
4025 * set the security data for a kernel service
4026 * - all the creation contexts are set to unlabelled
4028 static int selinux_kernel_act_as(struct cred *new, u32 secid)
4030 struct task_security_struct *tsec = selinux_cred(new);
4031 u32 sid = current_sid();
4034 ret = avc_has_perm(sid, secid,
4035 SECCLASS_KERNEL_SERVICE,
4036 KERNEL_SERVICE__USE_AS_OVERRIDE,
4040 tsec->create_sid = 0;
4041 tsec->keycreate_sid = 0;
4042 tsec->sockcreate_sid = 0;
4048 * set the file creation context in a security record to the same as the
4049 * objective context of the specified inode
4051 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
4053 struct inode_security_struct *isec = inode_security(inode);
4054 struct task_security_struct *tsec = selinux_cred(new);
4055 u32 sid = current_sid();
4058 ret = avc_has_perm(sid, isec->sid,
4059 SECCLASS_KERNEL_SERVICE,
4060 KERNEL_SERVICE__CREATE_FILES_AS,
4064 tsec->create_sid = isec->sid;
4068 static int selinux_kernel_module_request(char *kmod_name)
4070 struct common_audit_data ad;
4072 ad.type = LSM_AUDIT_DATA_KMOD;
4073 ad.u.kmod_name = kmod_name;
4075 return avc_has_perm(current_sid(), SECINITSID_KERNEL, SECCLASS_SYSTEM,
4076 SYSTEM__MODULE_REQUEST, &ad);
4079 static int selinux_kernel_module_from_file(struct file *file)
4081 struct common_audit_data ad;
4082 struct inode_security_struct *isec;
4083 struct file_security_struct *fsec;
4084 u32 sid = current_sid();
4089 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
4090 SYSTEM__MODULE_LOAD, NULL);
4094 ad.type = LSM_AUDIT_DATA_FILE;
4097 fsec = selinux_file(file);
4098 if (sid != fsec->sid) {
4099 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
4104 isec = inode_security(file_inode(file));
4105 return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
4106 SYSTEM__MODULE_LOAD, &ad);
4109 static int selinux_kernel_read_file(struct file *file,
4110 enum kernel_read_file_id id,
4116 case READING_MODULE:
4117 rc = selinux_kernel_module_from_file(contents ? file : NULL);
4126 static int selinux_kernel_load_data(enum kernel_load_data_id id, bool contents)
4131 case LOADING_MODULE:
4132 rc = selinux_kernel_module_from_file(NULL);
4141 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
4143 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4144 PROCESS__SETPGID, NULL);
4147 static int selinux_task_getpgid(struct task_struct *p)
4149 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4150 PROCESS__GETPGID, NULL);
4153 static int selinux_task_getsid(struct task_struct *p)
4155 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4156 PROCESS__GETSESSION, NULL);
4159 static void selinux_current_getsecid_subj(u32 *secid)
4161 *secid = current_sid();
4164 static void selinux_task_getsecid_obj(struct task_struct *p, u32 *secid)
4166 *secid = task_sid_obj(p);
4169 static int selinux_task_setnice(struct task_struct *p, int nice)
4171 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4172 PROCESS__SETSCHED, NULL);
4175 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
4177 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4178 PROCESS__SETSCHED, NULL);
4181 static int selinux_task_getioprio(struct task_struct *p)
4183 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4184 PROCESS__GETSCHED, NULL);
4187 static int selinux_task_prlimit(const struct cred *cred, const struct cred *tcred,
4194 if (flags & LSM_PRLIMIT_WRITE)
4195 av |= PROCESS__SETRLIMIT;
4196 if (flags & LSM_PRLIMIT_READ)
4197 av |= PROCESS__GETRLIMIT;
4198 return avc_has_perm(cred_sid(cred), cred_sid(tcred),
4199 SECCLASS_PROCESS, av, NULL);
4202 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
4203 struct rlimit *new_rlim)
4205 struct rlimit *old_rlim = p->signal->rlim + resource;
4207 /* Control the ability to change the hard limit (whether
4208 lowering or raising it), so that the hard limit can
4209 later be used as a safe reset point for the soft limit
4210 upon context transitions. See selinux_bprm_committing_creds. */
4211 if (old_rlim->rlim_max != new_rlim->rlim_max)
4212 return avc_has_perm(current_sid(), task_sid_obj(p),
4213 SECCLASS_PROCESS, PROCESS__SETRLIMIT, NULL);
4218 static int selinux_task_setscheduler(struct task_struct *p)
4220 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4221 PROCESS__SETSCHED, NULL);
4224 static int selinux_task_getscheduler(struct task_struct *p)
4226 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4227 PROCESS__GETSCHED, NULL);
4230 static int selinux_task_movememory(struct task_struct *p)
4232 return avc_has_perm(current_sid(), task_sid_obj(p), SECCLASS_PROCESS,
4233 PROCESS__SETSCHED, NULL);
4236 static int selinux_task_kill(struct task_struct *p, struct kernel_siginfo *info,
4237 int sig, const struct cred *cred)
4243 perm = PROCESS__SIGNULL; /* null signal; existence test */
4245 perm = signal_to_av(sig);
4247 secid = current_sid();
4249 secid = cred_sid(cred);
4250 return avc_has_perm(secid, task_sid_obj(p), SECCLASS_PROCESS, perm, NULL);
4253 static void selinux_task_to_inode(struct task_struct *p,
4254 struct inode *inode)
4256 struct inode_security_struct *isec = selinux_inode(inode);
4257 u32 sid = task_sid_obj(p);
4259 spin_lock(&isec->lock);
4260 isec->sclass = inode_mode_to_security_class(inode->i_mode);
4262 isec->initialized = LABEL_INITIALIZED;
4263 spin_unlock(&isec->lock);
4266 static int selinux_userns_create(const struct cred *cred)
4268 u32 sid = current_sid();
4270 return avc_has_perm(sid, sid, SECCLASS_USER_NAMESPACE,
4271 USER_NAMESPACE__CREATE, NULL);
4274 /* Returns error only if unable to parse addresses */
4275 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
4276 struct common_audit_data *ad, u8 *proto)
4278 int offset, ihlen, ret = -EINVAL;
4279 struct iphdr _iph, *ih;
4281 offset = skb_network_offset(skb);
4282 ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
4286 ihlen = ih->ihl * 4;
4287 if (ihlen < sizeof(_iph))
4290 ad->u.net->v4info.saddr = ih->saddr;
4291 ad->u.net->v4info.daddr = ih->daddr;
4295 *proto = ih->protocol;
4297 switch (ih->protocol) {
4299 struct tcphdr _tcph, *th;
4301 if (ntohs(ih->frag_off) & IP_OFFSET)
4305 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4309 ad->u.net->sport = th->source;
4310 ad->u.net->dport = th->dest;
4315 struct udphdr _udph, *uh;
4317 if (ntohs(ih->frag_off) & IP_OFFSET)
4321 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4325 ad->u.net->sport = uh->source;
4326 ad->u.net->dport = uh->dest;
4330 case IPPROTO_DCCP: {
4331 struct dccp_hdr _dccph, *dh;
4333 if (ntohs(ih->frag_off) & IP_OFFSET)
4337 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4341 ad->u.net->sport = dh->dccph_sport;
4342 ad->u.net->dport = dh->dccph_dport;
4346 #if IS_ENABLED(CONFIG_IP_SCTP)
4347 case IPPROTO_SCTP: {
4348 struct sctphdr _sctph, *sh;
4350 if (ntohs(ih->frag_off) & IP_OFFSET)
4354 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4358 ad->u.net->sport = sh->source;
4359 ad->u.net->dport = sh->dest;
4370 #if IS_ENABLED(CONFIG_IPV6)
4372 /* Returns error only if unable to parse addresses */
4373 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
4374 struct common_audit_data *ad, u8 *proto)
4377 int ret = -EINVAL, offset;
4378 struct ipv6hdr _ipv6h, *ip6;
4381 offset = skb_network_offset(skb);
4382 ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
4386 ad->u.net->v6info.saddr = ip6->saddr;
4387 ad->u.net->v6info.daddr = ip6->daddr;
4390 nexthdr = ip6->nexthdr;
4391 offset += sizeof(_ipv6h);
4392 offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
4401 struct tcphdr _tcph, *th;
4403 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
4407 ad->u.net->sport = th->source;
4408 ad->u.net->dport = th->dest;
4413 struct udphdr _udph, *uh;
4415 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
4419 ad->u.net->sport = uh->source;
4420 ad->u.net->dport = uh->dest;
4424 case IPPROTO_DCCP: {
4425 struct dccp_hdr _dccph, *dh;
4427 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
4431 ad->u.net->sport = dh->dccph_sport;
4432 ad->u.net->dport = dh->dccph_dport;
4436 #if IS_ENABLED(CONFIG_IP_SCTP)
4437 case IPPROTO_SCTP: {
4438 struct sctphdr _sctph, *sh;
4440 sh = skb_header_pointer(skb, offset, sizeof(_sctph), &_sctph);
4444 ad->u.net->sport = sh->source;
4445 ad->u.net->dport = sh->dest;
4449 /* includes fragments */
4459 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
4460 char **_addrp, int src, u8 *proto)
4465 switch (ad->u.net->family) {
4467 ret = selinux_parse_skb_ipv4(skb, ad, proto);
4470 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
4471 &ad->u.net->v4info.daddr);
4474 #if IS_ENABLED(CONFIG_IPV6)
4476 ret = selinux_parse_skb_ipv6(skb, ad, proto);
4479 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
4480 &ad->u.net->v6info.daddr);
4490 "SELinux: failure in selinux_parse_skb(),"
4491 " unable to parse packet\n");
4501 * selinux_skb_peerlbl_sid - Determine the peer label of a packet
4503 * @family: protocol family
4504 * @sid: the packet's peer label SID
4507 * Check the various different forms of network peer labeling and determine
4508 * the peer label/SID for the packet; most of the magic actually occurs in
4509 * the security server function security_net_peersid_cmp(). The function
4510 * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4511 * or -EACCES if @sid is invalid due to inconsistencies with the different
4515 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4522 err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4525 err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4529 err = security_net_peersid_resolve(nlbl_sid,
4530 nlbl_type, xfrm_sid, sid);
4531 if (unlikely(err)) {
4533 "SELinux: failure in selinux_skb_peerlbl_sid(),"
4534 " unable to determine packet's peer label\n");
4542 * selinux_conn_sid - Determine the child socket label for a connection
4543 * @sk_sid: the parent socket's SID
4544 * @skb_sid: the packet's SID
4545 * @conn_sid: the resulting connection SID
4547 * If @skb_sid is valid then the user:role:type information from @sk_sid is
4548 * combined with the MLS information from @skb_sid in order to create
4549 * @conn_sid. If @skb_sid is not valid then @conn_sid is simply a copy
4550 * of @sk_sid. Returns zero on success, negative values on failure.
4553 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4557 if (skb_sid != SECSID_NULL)
4558 err = security_sid_mls_copy(sk_sid, skb_sid,
4566 /* socket security operations */
4568 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4569 u16 secclass, u32 *socksid)
4571 if (tsec->sockcreate_sid > SECSID_NULL) {
4572 *socksid = tsec->sockcreate_sid;
4576 return security_transition_sid(tsec->sid, tsec->sid,
4577 secclass, NULL, socksid);
4580 static int sock_has_perm(struct sock *sk, u32 perms)
4582 struct sk_security_struct *sksec = sk->sk_security;
4583 struct common_audit_data ad;
4584 struct lsm_network_audit net;
4586 if (sksec->sid == SECINITSID_KERNEL)
4590 * Before POLICYDB_CAP_USERSPACE_INITIAL_CONTEXT, sockets that
4591 * inherited the kernel context from early boot used to be skipped
4592 * here, so preserve that behavior unless the capability is set.
4594 * By setting the capability the policy signals that it is ready
4595 * for this quirk to be fixed. Note that sockets created by a kernel
4596 * thread or a usermode helper executed without a transition will
4597 * still be skipped in this check regardless of the policycap
4600 if (!selinux_policycap_userspace_initial_context() &&
4601 sksec->sid == SECINITSID_INIT)
4604 ad_net_init_from_sk(&ad, &net, sk);
4606 return avc_has_perm(current_sid(), sksec->sid, sksec->sclass, perms,
4610 static int selinux_socket_create(int family, int type,
4611 int protocol, int kern)
4613 const struct task_security_struct *tsec = selinux_cred(current_cred());
4621 secclass = socket_type_to_security_class(family, type, protocol);
4622 rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4626 return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4629 static int selinux_socket_post_create(struct socket *sock, int family,
4630 int type, int protocol, int kern)
4632 const struct task_security_struct *tsec = selinux_cred(current_cred());
4633 struct inode_security_struct *isec = inode_security_novalidate(SOCK_INODE(sock));
4634 struct sk_security_struct *sksec;
4635 u16 sclass = socket_type_to_security_class(family, type, protocol);
4636 u32 sid = SECINITSID_KERNEL;
4640 err = socket_sockcreate_sid(tsec, sclass, &sid);
4645 isec->sclass = sclass;
4647 isec->initialized = LABEL_INITIALIZED;
4650 sksec = sock->sk->sk_security;
4651 sksec->sclass = sclass;
4653 /* Allows detection of the first association on this socket */
4654 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4655 sksec->sctp_assoc_state = SCTP_ASSOC_UNSET;
4657 err = selinux_netlbl_socket_post_create(sock->sk, family);
4663 static int selinux_socket_socketpair(struct socket *socka,
4664 struct socket *sockb)
4666 struct sk_security_struct *sksec_a = socka->sk->sk_security;
4667 struct sk_security_struct *sksec_b = sockb->sk->sk_security;
4669 sksec_a->peer_sid = sksec_b->sid;
4670 sksec_b->peer_sid = sksec_a->sid;
4675 /* Range of port numbers used to automatically bind.
4676 Need to determine whether we should perform a name_bind
4677 permission check between the socket and the port number. */
4679 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4681 struct sock *sk = sock->sk;
4682 struct sk_security_struct *sksec = sk->sk_security;
4686 err = sock_has_perm(sk, SOCKET__BIND);
4690 /* If PF_INET or PF_INET6, check name_bind permission for the port. */
4691 family = sk->sk_family;
4692 if (family == PF_INET || family == PF_INET6) {
4694 struct common_audit_data ad;
4695 struct lsm_network_audit net = {0,};
4696 struct sockaddr_in *addr4 = NULL;
4697 struct sockaddr_in6 *addr6 = NULL;
4699 unsigned short snum;
4703 * sctp_bindx(3) calls via selinux_sctp_bind_connect()
4704 * that validates multiple binding addresses. Because of this
4705 * need to check address->sa_family as it is possible to have
4706 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4708 if (addrlen < offsetofend(struct sockaddr, sa_family))
4710 family_sa = address->sa_family;
4711 switch (family_sa) {
4714 if (addrlen < sizeof(struct sockaddr_in))
4716 addr4 = (struct sockaddr_in *)address;
4717 if (family_sa == AF_UNSPEC) {
4718 if (family == PF_INET6) {
4719 /* Length check from inet6_bind_sk() */
4720 if (addrlen < SIN6_LEN_RFC2133)
4722 /* Family check from __inet6_bind() */
4725 /* see __inet_bind(), we only want to allow
4726 * AF_UNSPEC if the address is INADDR_ANY
4728 if (addr4->sin_addr.s_addr != htonl(INADDR_ANY))
4730 family_sa = AF_INET;
4732 snum = ntohs(addr4->sin_port);
4733 addrp = (char *)&addr4->sin_addr.s_addr;
4736 if (addrlen < SIN6_LEN_RFC2133)
4738 addr6 = (struct sockaddr_in6 *)address;
4739 snum = ntohs(addr6->sin6_port);
4740 addrp = (char *)&addr6->sin6_addr.s6_addr;
4746 ad.type = LSM_AUDIT_DATA_NET;
4748 ad.u.net->sport = htons(snum);
4749 ad.u.net->family = family_sa;
4754 inet_get_local_port_range(sock_net(sk), &low, &high);
4756 if (inet_port_requires_bind_service(sock_net(sk), snum) ||
4757 snum < low || snum > high) {
4758 err = sel_netport_sid(sk->sk_protocol,
4762 err = avc_has_perm(sksec->sid, sid,
4764 SOCKET__NAME_BIND, &ad);
4770 switch (sksec->sclass) {
4771 case SECCLASS_TCP_SOCKET:
4772 node_perm = TCP_SOCKET__NODE_BIND;
4775 case SECCLASS_UDP_SOCKET:
4776 node_perm = UDP_SOCKET__NODE_BIND;
4779 case SECCLASS_DCCP_SOCKET:
4780 node_perm = DCCP_SOCKET__NODE_BIND;
4783 case SECCLASS_SCTP_SOCKET:
4784 node_perm = SCTP_SOCKET__NODE_BIND;
4788 node_perm = RAWIP_SOCKET__NODE_BIND;
4792 err = sel_netnode_sid(addrp, family_sa, &sid);
4796 if (family_sa == AF_INET)
4797 ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4799 ad.u.net->v6info.saddr = addr6->sin6_addr;
4801 err = avc_has_perm(sksec->sid, sid,
4802 sksec->sclass, node_perm, &ad);
4809 /* Note that SCTP services expect -EINVAL, others -EAFNOSUPPORT. */
4810 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4812 return -EAFNOSUPPORT;
4815 /* This supports connect(2) and SCTP connect services such as sctp_connectx(3)
4816 * and sctp_sendmsg(3) as described in Documentation/security/SCTP.rst
4818 static int selinux_socket_connect_helper(struct socket *sock,
4819 struct sockaddr *address, int addrlen)
4821 struct sock *sk = sock->sk;
4822 struct sk_security_struct *sksec = sk->sk_security;
4825 err = sock_has_perm(sk, SOCKET__CONNECT);
4828 if (addrlen < offsetofend(struct sockaddr, sa_family))
4831 /* connect(AF_UNSPEC) has special handling, as it is a documented
4832 * way to disconnect the socket
4834 if (address->sa_family == AF_UNSPEC)
4838 * If a TCP, DCCP or SCTP socket, check name_connect permission
4841 if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4842 sksec->sclass == SECCLASS_DCCP_SOCKET ||
4843 sksec->sclass == SECCLASS_SCTP_SOCKET) {
4844 struct common_audit_data ad;
4845 struct lsm_network_audit net = {0,};
4846 struct sockaddr_in *addr4 = NULL;
4847 struct sockaddr_in6 *addr6 = NULL;
4848 unsigned short snum;
4851 /* sctp_connectx(3) calls via selinux_sctp_bind_connect()
4852 * that validates multiple connect addresses. Because of this
4853 * need to check address->sa_family as it is possible to have
4854 * sk->sk_family = PF_INET6 with addr->sa_family = AF_INET.
4856 switch (address->sa_family) {
4858 addr4 = (struct sockaddr_in *)address;
4859 if (addrlen < sizeof(struct sockaddr_in))
4861 snum = ntohs(addr4->sin_port);
4864 addr6 = (struct sockaddr_in6 *)address;
4865 if (addrlen < SIN6_LEN_RFC2133)
4867 snum = ntohs(addr6->sin6_port);
4870 /* Note that SCTP services expect -EINVAL, whereas
4871 * others expect -EAFNOSUPPORT.
4873 if (sksec->sclass == SECCLASS_SCTP_SOCKET)
4876 return -EAFNOSUPPORT;
4879 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4883 switch (sksec->sclass) {
4884 case SECCLASS_TCP_SOCKET:
4885 perm = TCP_SOCKET__NAME_CONNECT;
4887 case SECCLASS_DCCP_SOCKET:
4888 perm = DCCP_SOCKET__NAME_CONNECT;
4890 case SECCLASS_SCTP_SOCKET:
4891 perm = SCTP_SOCKET__NAME_CONNECT;
4895 ad.type = LSM_AUDIT_DATA_NET;
4897 ad.u.net->dport = htons(snum);
4898 ad.u.net->family = address->sa_family;
4899 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4907 /* Supports connect(2), see comments in selinux_socket_connect_helper() */
4908 static int selinux_socket_connect(struct socket *sock,
4909 struct sockaddr *address, int addrlen)
4912 struct sock *sk = sock->sk;
4914 err = selinux_socket_connect_helper(sock, address, addrlen);
4918 return selinux_netlbl_socket_connect(sk, address);
4921 static int selinux_socket_listen(struct socket *sock, int backlog)
4923 return sock_has_perm(sock->sk, SOCKET__LISTEN);
4926 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4929 struct inode_security_struct *isec;
4930 struct inode_security_struct *newisec;
4934 err = sock_has_perm(sock->sk, SOCKET__ACCEPT);
4938 isec = inode_security_novalidate(SOCK_INODE(sock));
4939 spin_lock(&isec->lock);
4940 sclass = isec->sclass;
4942 spin_unlock(&isec->lock);
4944 newisec = inode_security_novalidate(SOCK_INODE(newsock));
4945 newisec->sclass = sclass;
4947 newisec->initialized = LABEL_INITIALIZED;
4952 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4955 return sock_has_perm(sock->sk, SOCKET__WRITE);
4958 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4959 int size, int flags)
4961 return sock_has_perm(sock->sk, SOCKET__READ);
4964 static int selinux_socket_getsockname(struct socket *sock)
4966 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4969 static int selinux_socket_getpeername(struct socket *sock)
4971 return sock_has_perm(sock->sk, SOCKET__GETATTR);
4974 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4978 err = sock_has_perm(sock->sk, SOCKET__SETOPT);
4982 return selinux_netlbl_socket_setsockopt(sock, level, optname);
4985 static int selinux_socket_getsockopt(struct socket *sock, int level,
4988 return sock_has_perm(sock->sk, SOCKET__GETOPT);
4991 static int selinux_socket_shutdown(struct socket *sock, int how)
4993 return sock_has_perm(sock->sk, SOCKET__SHUTDOWN);
4996 static int selinux_socket_unix_stream_connect(struct sock *sock,
5000 struct sk_security_struct *sksec_sock = sock->sk_security;
5001 struct sk_security_struct *sksec_other = other->sk_security;
5002 struct sk_security_struct *sksec_new = newsk->sk_security;
5003 struct common_audit_data ad;
5004 struct lsm_network_audit net;
5007 ad_net_init_from_sk(&ad, &net, other);
5009 err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
5010 sksec_other->sclass,
5011 UNIX_STREAM_SOCKET__CONNECTTO, &ad);
5015 /* server child socket */
5016 sksec_new->peer_sid = sksec_sock->sid;
5017 err = security_sid_mls_copy(sksec_other->sid,
5018 sksec_sock->sid, &sksec_new->sid);
5022 /* connecting socket */
5023 sksec_sock->peer_sid = sksec_new->sid;
5028 static int selinux_socket_unix_may_send(struct socket *sock,
5029 struct socket *other)
5031 struct sk_security_struct *ssec = sock->sk->sk_security;
5032 struct sk_security_struct *osec = other->sk->sk_security;
5033 struct common_audit_data ad;
5034 struct lsm_network_audit net;
5036 ad_net_init_from_sk(&ad, &net, other->sk);
5038 return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
5042 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
5043 char *addrp, u16 family, u32 peer_sid,
5044 struct common_audit_data *ad)
5050 err = sel_netif_sid(ns, ifindex, &if_sid);
5053 err = avc_has_perm(peer_sid, if_sid,
5054 SECCLASS_NETIF, NETIF__INGRESS, ad);
5058 err = sel_netnode_sid(addrp, family, &node_sid);
5061 return avc_has_perm(peer_sid, node_sid,
5062 SECCLASS_NODE, NODE__RECVFROM, ad);
5065 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
5069 struct sk_security_struct *sksec = sk->sk_security;
5070 u32 sk_sid = sksec->sid;
5071 struct common_audit_data ad;
5072 struct lsm_network_audit net;
5075 ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
5076 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5080 if (selinux_secmark_enabled()) {
5081 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5087 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
5090 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
5095 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
5097 int err, peerlbl_active, secmark_active;
5098 struct sk_security_struct *sksec = sk->sk_security;
5099 u16 family = sk->sk_family;
5100 u32 sk_sid = sksec->sid;
5101 struct common_audit_data ad;
5102 struct lsm_network_audit net;
5105 if (family != PF_INET && family != PF_INET6)
5108 /* Handle mapped IPv4 packets arriving via IPv6 sockets */
5109 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5112 /* If any sort of compatibility mode is enabled then handoff processing
5113 * to the selinux_sock_rcv_skb_compat() function to deal with the
5114 * special handling. We do this in an attempt to keep this function
5115 * as fast and as clean as possible. */
5116 if (!selinux_policycap_netpeer())
5117 return selinux_sock_rcv_skb_compat(sk, skb, family);
5119 secmark_active = selinux_secmark_enabled();
5120 peerlbl_active = selinux_peerlbl_enabled();
5121 if (!secmark_active && !peerlbl_active)
5124 ad_net_init_from_iif(&ad, &net, skb->skb_iif, family);
5125 err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
5129 if (peerlbl_active) {
5132 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
5135 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
5136 addrp, family, peer_sid, &ad);
5138 selinux_netlbl_err(skb, family, err, 0);
5141 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
5144 selinux_netlbl_err(skb, family, err, 0);
5149 if (secmark_active) {
5150 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
5159 static int selinux_socket_getpeersec_stream(struct socket *sock,
5160 sockptr_t optval, sockptr_t optlen,
5164 char *scontext = NULL;
5166 struct sk_security_struct *sksec = sock->sk->sk_security;
5167 u32 peer_sid = SECSID_NULL;
5169 if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
5170 sksec->sclass == SECCLASS_TCP_SOCKET ||
5171 sksec->sclass == SECCLASS_SCTP_SOCKET)
5172 peer_sid = sksec->peer_sid;
5173 if (peer_sid == SECSID_NULL)
5174 return -ENOPROTOOPT;
5176 err = security_sid_to_context(peer_sid, &scontext,
5180 if (scontext_len > len) {
5185 if (copy_to_sockptr(optval, scontext, scontext_len))
5188 if (copy_to_sockptr(optlen, &scontext_len, sizeof(scontext_len)))
5194 static int selinux_socket_getpeersec_dgram(struct socket *sock,
5195 struct sk_buff *skb, u32 *secid)
5197 u32 peer_secid = SECSID_NULL;
5200 if (skb && skb->protocol == htons(ETH_P_IP))
5202 else if (skb && skb->protocol == htons(ETH_P_IPV6))
5205 family = sock->sk->sk_family;
5207 *secid = SECSID_NULL;
5211 if (sock && family == PF_UNIX) {
5212 struct inode_security_struct *isec;
5213 isec = inode_security_novalidate(SOCK_INODE(sock));
5214 peer_secid = isec->sid;
5216 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
5218 *secid = peer_secid;
5219 if (peer_secid == SECSID_NULL)
5220 return -ENOPROTOOPT;
5224 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
5226 struct sk_security_struct *sksec;
5228 sksec = kzalloc(sizeof(*sksec), priority);
5232 sksec->peer_sid = SECINITSID_UNLABELED;
5233 sksec->sid = SECINITSID_UNLABELED;
5234 sksec->sclass = SECCLASS_SOCKET;
5235 selinux_netlbl_sk_security_reset(sksec);
5236 sk->sk_security = sksec;
5241 static void selinux_sk_free_security(struct sock *sk)
5243 struct sk_security_struct *sksec = sk->sk_security;
5245 sk->sk_security = NULL;
5246 selinux_netlbl_sk_security_free(sksec);
5250 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
5252 struct sk_security_struct *sksec = sk->sk_security;
5253 struct sk_security_struct *newsksec = newsk->sk_security;
5255 newsksec->sid = sksec->sid;
5256 newsksec->peer_sid = sksec->peer_sid;
5257 newsksec->sclass = sksec->sclass;
5259 selinux_netlbl_sk_security_reset(newsksec);
5262 static void selinux_sk_getsecid(const struct sock *sk, u32 *secid)
5265 *secid = SECINITSID_ANY_SOCKET;
5267 const struct sk_security_struct *sksec = sk->sk_security;
5269 *secid = sksec->sid;
5273 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
5275 struct inode_security_struct *isec =
5276 inode_security_novalidate(SOCK_INODE(parent));
5277 struct sk_security_struct *sksec = sk->sk_security;
5279 if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
5280 sk->sk_family == PF_UNIX)
5281 isec->sid = sksec->sid;
5282 sksec->sclass = isec->sclass;
5286 * Determines peer_secid for the asoc and updates socket's peer label
5287 * if it's the first association on the socket.
5289 static int selinux_sctp_process_new_assoc(struct sctp_association *asoc,
5290 struct sk_buff *skb)
5292 struct sock *sk = asoc->base.sk;
5293 u16 family = sk->sk_family;
5294 struct sk_security_struct *sksec = sk->sk_security;
5295 struct common_audit_data ad;
5296 struct lsm_network_audit net;
5299 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5300 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5303 if (selinux_peerlbl_enabled()) {
5304 asoc->peer_secid = SECSID_NULL;
5306 /* This will return peer_sid = SECSID_NULL if there are
5307 * no peer labels, see security_net_peersid_resolve().
5309 err = selinux_skb_peerlbl_sid(skb, family, &asoc->peer_secid);
5313 if (asoc->peer_secid == SECSID_NULL)
5314 asoc->peer_secid = SECINITSID_UNLABELED;
5316 asoc->peer_secid = SECINITSID_UNLABELED;
5319 if (sksec->sctp_assoc_state == SCTP_ASSOC_UNSET) {
5320 sksec->sctp_assoc_state = SCTP_ASSOC_SET;
5322 /* Here as first association on socket. As the peer SID
5323 * was allowed by peer recv (and the netif/node checks),
5324 * then it is approved by policy and used as the primary
5325 * peer SID for getpeercon(3).
5327 sksec->peer_sid = asoc->peer_secid;
5328 } else if (sksec->peer_sid != asoc->peer_secid) {
5329 /* Other association peer SIDs are checked to enforce
5330 * consistency among the peer SIDs.
5332 ad_net_init_from_sk(&ad, &net, asoc->base.sk);
5333 err = avc_has_perm(sksec->peer_sid, asoc->peer_secid,
5334 sksec->sclass, SCTP_SOCKET__ASSOCIATION,
5342 /* Called whenever SCTP receives an INIT or COOKIE ECHO chunk. This
5343 * happens on an incoming connect(2), sctp_connectx(3) or
5344 * sctp_sendmsg(3) (with no association already present).
5346 static int selinux_sctp_assoc_request(struct sctp_association *asoc,
5347 struct sk_buff *skb)
5349 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5353 if (!selinux_policycap_extsockclass())
5356 err = selinux_sctp_process_new_assoc(asoc, skb);
5360 /* Compute the MLS component for the connection and store
5361 * the information in asoc. This will be used by SCTP TCP type
5362 * sockets and peeled off connections as they cause a new
5363 * socket to be generated. selinux_sctp_sk_clone() will then
5364 * plug this into the new socket.
5366 err = selinux_conn_sid(sksec->sid, asoc->peer_secid, &conn_sid);
5370 asoc->secid = conn_sid;
5372 /* Set any NetLabel labels including CIPSO/CALIPSO options. */
5373 return selinux_netlbl_sctp_assoc_request(asoc, skb);
5376 /* Called when SCTP receives a COOKIE ACK chunk as the final
5377 * response to an association request (initited by us).
5379 static int selinux_sctp_assoc_established(struct sctp_association *asoc,
5380 struct sk_buff *skb)
5382 struct sk_security_struct *sksec = asoc->base.sk->sk_security;
5384 if (!selinux_policycap_extsockclass())
5387 /* Inherit secid from the parent socket - this will be picked up
5388 * by selinux_sctp_sk_clone() if the association gets peeled off
5389 * into a new socket.
5391 asoc->secid = sksec->sid;
5393 return selinux_sctp_process_new_assoc(asoc, skb);
5396 /* Check if sctp IPv4/IPv6 addresses are valid for binding or connecting
5397 * based on their @optname.
5399 static int selinux_sctp_bind_connect(struct sock *sk, int optname,
5400 struct sockaddr *address,
5403 int len, err = 0, walk_size = 0;
5405 struct sockaddr *addr;
5406 struct socket *sock;
5408 if (!selinux_policycap_extsockclass())
5411 /* Process one or more addresses that may be IPv4 or IPv6 */
5412 sock = sk->sk_socket;
5415 while (walk_size < addrlen) {
5416 if (walk_size + sizeof(sa_family_t) > addrlen)
5420 switch (addr->sa_family) {
5423 len = sizeof(struct sockaddr_in);
5426 len = sizeof(struct sockaddr_in6);
5432 if (walk_size + len > addrlen)
5438 case SCTP_PRIMARY_ADDR:
5439 case SCTP_SET_PEER_PRIMARY_ADDR:
5440 case SCTP_SOCKOPT_BINDX_ADD:
5441 err = selinux_socket_bind(sock, addr, len);
5443 /* Connect checks */
5444 case SCTP_SOCKOPT_CONNECTX:
5445 case SCTP_PARAM_SET_PRIMARY:
5446 case SCTP_PARAM_ADD_IP:
5447 case SCTP_SENDMSG_CONNECT:
5448 err = selinux_socket_connect_helper(sock, addr, len);
5452 /* As selinux_sctp_bind_connect() is called by the
5453 * SCTP protocol layer, the socket is already locked,
5454 * therefore selinux_netlbl_socket_connect_locked()
5455 * is called here. The situations handled are:
5456 * sctp_connectx(3), sctp_sendmsg(3), sendmsg(2),
5457 * whenever a new IP address is added or when a new
5458 * primary address is selected.
5459 * Note that an SCTP connect(2) call happens before
5460 * the SCTP protocol layer and is handled via
5461 * selinux_socket_connect().
5463 err = selinux_netlbl_socket_connect_locked(sk, addr);
5477 /* Called whenever a new socket is created by accept(2) or sctp_peeloff(3). */
5478 static void selinux_sctp_sk_clone(struct sctp_association *asoc, struct sock *sk,
5481 struct sk_security_struct *sksec = sk->sk_security;
5482 struct sk_security_struct *newsksec = newsk->sk_security;
5484 /* If policy does not support SECCLASS_SCTP_SOCKET then call
5485 * the non-sctp clone version.
5487 if (!selinux_policycap_extsockclass())
5488 return selinux_sk_clone_security(sk, newsk);
5490 newsksec->sid = asoc->secid;
5491 newsksec->peer_sid = asoc->peer_secid;
5492 newsksec->sclass = sksec->sclass;
5493 selinux_netlbl_sctp_sk_clone(sk, newsk);
5496 static int selinux_mptcp_add_subflow(struct sock *sk, struct sock *ssk)
5498 struct sk_security_struct *ssksec = ssk->sk_security;
5499 struct sk_security_struct *sksec = sk->sk_security;
5501 ssksec->sclass = sksec->sclass;
5502 ssksec->sid = sksec->sid;
5504 /* replace the existing subflow label deleting the existing one
5505 * and re-recreating a new label using the updated context
5507 selinux_netlbl_sk_security_free(ssksec);
5508 return selinux_netlbl_socket_post_create(ssk, ssk->sk_family);
5511 static int selinux_inet_conn_request(const struct sock *sk, struct sk_buff *skb,
5512 struct request_sock *req)
5514 struct sk_security_struct *sksec = sk->sk_security;
5516 u16 family = req->rsk_ops->family;
5520 err = selinux_skb_peerlbl_sid(skb, family, &peersid);
5523 err = selinux_conn_sid(sksec->sid, peersid, &connsid);
5526 req->secid = connsid;
5527 req->peer_secid = peersid;
5529 return selinux_netlbl_inet_conn_request(req, family);
5532 static void selinux_inet_csk_clone(struct sock *newsk,
5533 const struct request_sock *req)
5535 struct sk_security_struct *newsksec = newsk->sk_security;
5537 newsksec->sid = req->secid;
5538 newsksec->peer_sid = req->peer_secid;
5539 /* NOTE: Ideally, we should also get the isec->sid for the
5540 new socket in sync, but we don't have the isec available yet.
5541 So we will wait until sock_graft to do it, by which
5542 time it will have been created and available. */
5544 /* We don't need to take any sort of lock here as we are the only
5545 * thread with access to newsksec */
5546 selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
5549 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
5551 u16 family = sk->sk_family;
5552 struct sk_security_struct *sksec = sk->sk_security;
5554 /* handle mapped IPv4 packets arriving via IPv6 sockets */
5555 if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
5558 selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
5561 static int selinux_secmark_relabel_packet(u32 sid)
5563 return avc_has_perm(current_sid(), sid, SECCLASS_PACKET, PACKET__RELABELTO,
5567 static void selinux_secmark_refcount_inc(void)
5569 atomic_inc(&selinux_secmark_refcount);
5572 static void selinux_secmark_refcount_dec(void)
5574 atomic_dec(&selinux_secmark_refcount);
5577 static void selinux_req_classify_flow(const struct request_sock *req,
5578 struct flowi_common *flic)
5580 flic->flowic_secid = req->secid;
5583 static int selinux_tun_dev_alloc_security(void **security)
5585 struct tun_security_struct *tunsec;
5587 tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
5590 tunsec->sid = current_sid();
5596 static void selinux_tun_dev_free_security(void *security)
5601 static int selinux_tun_dev_create(void)
5603 u32 sid = current_sid();
5605 /* we aren't taking into account the "sockcreate" SID since the socket
5606 * that is being created here is not a socket in the traditional sense,
5607 * instead it is a private sock, accessible only to the kernel, and
5608 * representing a wide range of network traffic spanning multiple
5609 * connections unlike traditional sockets - check the TUN driver to
5610 * get a better understanding of why this socket is special */
5612 return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
5616 static int selinux_tun_dev_attach_queue(void *security)
5618 struct tun_security_struct *tunsec = security;
5620 return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
5621 TUN_SOCKET__ATTACH_QUEUE, NULL);
5624 static int selinux_tun_dev_attach(struct sock *sk, void *security)
5626 struct tun_security_struct *tunsec = security;
5627 struct sk_security_struct *sksec = sk->sk_security;
5629 /* we don't currently perform any NetLabel based labeling here and it
5630 * isn't clear that we would want to do so anyway; while we could apply
5631 * labeling without the support of the TUN user the resulting labeled
5632 * traffic from the other end of the connection would almost certainly
5633 * cause confusion to the TUN user that had no idea network labeling
5634 * protocols were being used */
5636 sksec->sid = tunsec->sid;
5637 sksec->sclass = SECCLASS_TUN_SOCKET;
5642 static int selinux_tun_dev_open(void *security)
5644 struct tun_security_struct *tunsec = security;
5645 u32 sid = current_sid();
5648 err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
5649 TUN_SOCKET__RELABELFROM, NULL);
5652 err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
5653 TUN_SOCKET__RELABELTO, NULL);
5661 #ifdef CONFIG_NETFILTER
5663 static unsigned int selinux_ip_forward(void *priv, struct sk_buff *skb,
5664 const struct nf_hook_state *state)
5670 struct common_audit_data ad;
5671 struct lsm_network_audit net;
5672 int secmark_active, peerlbl_active;
5674 if (!selinux_policycap_netpeer())
5677 secmark_active = selinux_secmark_enabled();
5678 peerlbl_active = selinux_peerlbl_enabled();
5679 if (!secmark_active && !peerlbl_active)
5683 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
5686 ifindex = state->in->ifindex;
5687 ad_net_init_from_iif(&ad, &net, ifindex, family);
5688 if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
5691 if (peerlbl_active) {
5694 err = selinux_inet_sys_rcv_skb(state->net, ifindex,
5695 addrp, family, peer_sid, &ad);
5697 selinux_netlbl_err(skb, family, err, 1);
5703 if (avc_has_perm(peer_sid, skb->secmark,
5704 SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
5707 if (netlbl_enabled())
5708 /* we do this in the FORWARD path and not the POST_ROUTING
5709 * path because we want to make sure we apply the necessary
5710 * labeling before IPsec is applied so we can leverage AH
5712 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
5718 static unsigned int selinux_ip_output(void *priv, struct sk_buff *skb,
5719 const struct nf_hook_state *state)
5724 if (!netlbl_enabled())
5727 /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
5728 * because we want to make sure we apply the necessary labeling
5729 * before IPsec is applied so we can leverage AH protection */
5732 struct sk_security_struct *sksec;
5734 if (sk_listener(sk))
5735 /* if the socket is the listening state then this
5736 * packet is a SYN-ACK packet which means it needs to
5737 * be labeled based on the connection/request_sock and
5738 * not the parent socket. unfortunately, we can't
5739 * lookup the request_sock yet as it isn't queued on
5740 * the parent socket until after the SYN-ACK is sent.
5741 * the "solution" is to simply pass the packet as-is
5742 * as any IP option based labeling should be copied
5743 * from the initial connection request (in the IP
5744 * layer). it is far from ideal, but until we get a
5745 * security label in the packet itself this is the
5746 * best we can do. */
5749 /* standard practice, label using the parent socket */
5750 sksec = sk->sk_security;
5753 sid = SECINITSID_KERNEL;
5754 if (selinux_netlbl_skbuff_setsid(skb, state->pf, sid) != 0)
5761 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
5762 const struct nf_hook_state *state)
5765 struct sk_security_struct *sksec;
5766 struct common_audit_data ad;
5767 struct lsm_network_audit net;
5770 sk = skb_to_full_sk(skb);
5773 sksec = sk->sk_security;
5775 ad_net_init_from_iif(&ad, &net, state->out->ifindex, state->pf);
5776 if (selinux_parse_skb(skb, &ad, NULL, 0, &proto))
5779 if (selinux_secmark_enabled())
5780 if (avc_has_perm(sksec->sid, skb->secmark,
5781 SECCLASS_PACKET, PACKET__SEND, &ad))
5782 return NF_DROP_ERR(-ECONNREFUSED);
5784 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
5785 return NF_DROP_ERR(-ECONNREFUSED);
5790 static unsigned int selinux_ip_postroute(void *priv,
5791 struct sk_buff *skb,
5792 const struct nf_hook_state *state)
5799 struct common_audit_data ad;
5800 struct lsm_network_audit net;
5802 int secmark_active, peerlbl_active;
5804 /* If any sort of compatibility mode is enabled then handoff processing
5805 * to the selinux_ip_postroute_compat() function to deal with the
5806 * special handling. We do this in an attempt to keep this function
5807 * as fast and as clean as possible. */
5808 if (!selinux_policycap_netpeer())
5809 return selinux_ip_postroute_compat(skb, state);
5811 secmark_active = selinux_secmark_enabled();
5812 peerlbl_active = selinux_peerlbl_enabled();
5813 if (!secmark_active && !peerlbl_active)
5816 sk = skb_to_full_sk(skb);
5819 /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5820 * packet transformation so allow the packet to pass without any checks
5821 * since we'll have another chance to perform access control checks
5822 * when the packet is on it's final way out.
5823 * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5824 * is NULL, in this case go ahead and apply access control.
5825 * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5826 * TCP listening state we cannot wait until the XFRM processing
5827 * is done as we will miss out on the SA label if we do;
5828 * unfortunately, this means more work, but it is only once per
5830 if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5831 !(sk && sk_listener(sk)))
5837 /* Without an associated socket the packet is either coming
5838 * from the kernel or it is being forwarded; check the packet
5839 * to determine which and if the packet is being forwarded
5840 * query the packet directly to determine the security label. */
5842 secmark_perm = PACKET__FORWARD_OUT;
5843 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5846 secmark_perm = PACKET__SEND;
5847 peer_sid = SECINITSID_KERNEL;
5849 } else if (sk_listener(sk)) {
5850 /* Locally generated packet but the associated socket is in the
5851 * listening state which means this is a SYN-ACK packet. In
5852 * this particular case the correct security label is assigned
5853 * to the connection/request_sock but unfortunately we can't
5854 * query the request_sock as it isn't queued on the parent
5855 * socket until after the SYN-ACK packet is sent; the only
5856 * viable choice is to regenerate the label like we do in
5857 * selinux_inet_conn_request(). See also selinux_ip_output()
5858 * for similar problems. */
5860 struct sk_security_struct *sksec;
5862 sksec = sk->sk_security;
5863 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5865 /* At this point, if the returned skb peerlbl is SECSID_NULL
5866 * and the packet has been through at least one XFRM
5867 * transformation then we must be dealing with the "final"
5868 * form of labeled IPsec packet; since we've already applied
5869 * all of our access controls on this packet we can safely
5870 * pass the packet. */
5871 if (skb_sid == SECSID_NULL) {
5874 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5878 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5882 return NF_DROP_ERR(-ECONNREFUSED);
5885 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5887 secmark_perm = PACKET__SEND;
5889 /* Locally generated packet, fetch the security label from the
5890 * associated socket. */
5891 struct sk_security_struct *sksec = sk->sk_security;
5892 peer_sid = sksec->sid;
5893 secmark_perm = PACKET__SEND;
5896 ifindex = state->out->ifindex;
5897 ad_net_init_from_iif(&ad, &net, ifindex, family);
5898 if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5902 if (avc_has_perm(peer_sid, skb->secmark,
5903 SECCLASS_PACKET, secmark_perm, &ad))
5904 return NF_DROP_ERR(-ECONNREFUSED);
5906 if (peerlbl_active) {
5910 if (sel_netif_sid(state->net, ifindex, &if_sid))
5912 if (avc_has_perm(peer_sid, if_sid,
5913 SECCLASS_NETIF, NETIF__EGRESS, &ad))
5914 return NF_DROP_ERR(-ECONNREFUSED);
5916 if (sel_netnode_sid(addrp, family, &node_sid))
5918 if (avc_has_perm(peer_sid, node_sid,
5919 SECCLASS_NODE, NODE__SENDTO, &ad))
5920 return NF_DROP_ERR(-ECONNREFUSED);
5925 #endif /* CONFIG_NETFILTER */
5927 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5930 unsigned int msg_len;
5931 unsigned int data_len = skb->len;
5932 unsigned char *data = skb->data;
5933 struct nlmsghdr *nlh;
5934 struct sk_security_struct *sksec = sk->sk_security;
5935 u16 sclass = sksec->sclass;
5938 while (data_len >= nlmsg_total_size(0)) {
5939 nlh = (struct nlmsghdr *)data;
5941 /* NOTE: the nlmsg_len field isn't reliably set by some netlink
5942 * users which means we can't reject skb's with bogus
5943 * length fields; our solution is to follow what
5944 * netlink_rcv_skb() does and simply skip processing at
5945 * messages with length fields that are clearly junk
5947 if (nlh->nlmsg_len < NLMSG_HDRLEN || nlh->nlmsg_len > data_len)
5950 rc = selinux_nlmsg_lookup(sclass, nlh->nlmsg_type, &perm);
5952 rc = sock_has_perm(sk, perm);
5955 } else if (rc == -EINVAL) {
5956 /* -EINVAL is a missing msg/perm mapping */
5957 pr_warn_ratelimited("SELinux: unrecognized netlink"
5958 " message: protocol=%hu nlmsg_type=%hu sclass=%s"
5959 " pid=%d comm=%s\n",
5960 sk->sk_protocol, nlh->nlmsg_type,
5961 secclass_map[sclass - 1].name,
5962 task_pid_nr(current), current->comm);
5963 if (enforcing_enabled() &&
5964 !security_get_allow_unknown())
5967 } else if (rc == -ENOENT) {
5968 /* -ENOENT is a missing socket/class mapping, ignore */
5974 /* move to the next message after applying netlink padding */
5975 msg_len = NLMSG_ALIGN(nlh->nlmsg_len);
5976 if (msg_len >= data_len)
5978 data_len -= msg_len;
5985 static void ipc_init_security(struct ipc_security_struct *isec, u16 sclass)
5987 isec->sclass = sclass;
5988 isec->sid = current_sid();
5991 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5994 struct ipc_security_struct *isec;
5995 struct common_audit_data ad;
5996 u32 sid = current_sid();
5998 isec = selinux_ipc(ipc_perms);
6000 ad.type = LSM_AUDIT_DATA_IPC;
6001 ad.u.ipc_id = ipc_perms->key;
6003 return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
6006 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
6008 struct msg_security_struct *msec;
6010 msec = selinux_msg_msg(msg);
6011 msec->sid = SECINITSID_UNLABELED;
6016 /* message queue security operations */
6017 static int selinux_msg_queue_alloc_security(struct kern_ipc_perm *msq)
6019 struct ipc_security_struct *isec;
6020 struct common_audit_data ad;
6021 u32 sid = current_sid();
6023 isec = selinux_ipc(msq);
6024 ipc_init_security(isec, SECCLASS_MSGQ);
6026 ad.type = LSM_AUDIT_DATA_IPC;
6027 ad.u.ipc_id = msq->key;
6029 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6033 static int selinux_msg_queue_associate(struct kern_ipc_perm *msq, int msqflg)
6035 struct ipc_security_struct *isec;
6036 struct common_audit_data ad;
6037 u32 sid = current_sid();
6039 isec = selinux_ipc(msq);
6041 ad.type = LSM_AUDIT_DATA_IPC;
6042 ad.u.ipc_id = msq->key;
6044 return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6045 MSGQ__ASSOCIATE, &ad);
6048 static int selinux_msg_queue_msgctl(struct kern_ipc_perm *msq, int cmd)
6055 /* No specific object, just general system-wide information. */
6056 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6057 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6061 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
6064 perms = MSGQ__SETATTR;
6067 perms = MSGQ__DESTROY;
6073 return ipc_has_perm(msq, perms);
6076 static int selinux_msg_queue_msgsnd(struct kern_ipc_perm *msq, struct msg_msg *msg, int msqflg)
6078 struct ipc_security_struct *isec;
6079 struct msg_security_struct *msec;
6080 struct common_audit_data ad;
6081 u32 sid = current_sid();
6084 isec = selinux_ipc(msq);
6085 msec = selinux_msg_msg(msg);
6088 * First time through, need to assign label to the message
6090 if (msec->sid == SECINITSID_UNLABELED) {
6092 * Compute new sid based on current process and
6093 * message queue this message will be stored in
6095 rc = security_transition_sid(sid, isec->sid,
6096 SECCLASS_MSG, NULL, &msec->sid);
6101 ad.type = LSM_AUDIT_DATA_IPC;
6102 ad.u.ipc_id = msq->key;
6104 /* Can this process write to the queue? */
6105 rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
6108 /* Can this process send the message */
6109 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
6112 /* Can the message be put in the queue? */
6113 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
6114 MSGQ__ENQUEUE, &ad);
6119 static int selinux_msg_queue_msgrcv(struct kern_ipc_perm *msq, struct msg_msg *msg,
6120 struct task_struct *target,
6121 long type, int mode)
6123 struct ipc_security_struct *isec;
6124 struct msg_security_struct *msec;
6125 struct common_audit_data ad;
6126 u32 sid = task_sid_obj(target);
6129 isec = selinux_ipc(msq);
6130 msec = selinux_msg_msg(msg);
6132 ad.type = LSM_AUDIT_DATA_IPC;
6133 ad.u.ipc_id = msq->key;
6135 rc = avc_has_perm(sid, isec->sid,
6136 SECCLASS_MSGQ, MSGQ__READ, &ad);
6138 rc = avc_has_perm(sid, msec->sid,
6139 SECCLASS_MSG, MSG__RECEIVE, &ad);
6143 /* Shared Memory security operations */
6144 static int selinux_shm_alloc_security(struct kern_ipc_perm *shp)
6146 struct ipc_security_struct *isec;
6147 struct common_audit_data ad;
6148 u32 sid = current_sid();
6150 isec = selinux_ipc(shp);
6151 ipc_init_security(isec, SECCLASS_SHM);
6153 ad.type = LSM_AUDIT_DATA_IPC;
6154 ad.u.ipc_id = shp->key;
6156 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6160 static int selinux_shm_associate(struct kern_ipc_perm *shp, int shmflg)
6162 struct ipc_security_struct *isec;
6163 struct common_audit_data ad;
6164 u32 sid = current_sid();
6166 isec = selinux_ipc(shp);
6168 ad.type = LSM_AUDIT_DATA_IPC;
6169 ad.u.ipc_id = shp->key;
6171 return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
6172 SHM__ASSOCIATE, &ad);
6175 /* Note, at this point, shp is locked down */
6176 static int selinux_shm_shmctl(struct kern_ipc_perm *shp, int cmd)
6183 /* No specific object, just general system-wide information. */
6184 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6185 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6189 perms = SHM__GETATTR | SHM__ASSOCIATE;
6192 perms = SHM__SETATTR;
6199 perms = SHM__DESTROY;
6205 return ipc_has_perm(shp, perms);
6208 static int selinux_shm_shmat(struct kern_ipc_perm *shp,
6209 char __user *shmaddr, int shmflg)
6213 if (shmflg & SHM_RDONLY)
6216 perms = SHM__READ | SHM__WRITE;
6218 return ipc_has_perm(shp, perms);
6221 /* Semaphore security operations */
6222 static int selinux_sem_alloc_security(struct kern_ipc_perm *sma)
6224 struct ipc_security_struct *isec;
6225 struct common_audit_data ad;
6226 u32 sid = current_sid();
6228 isec = selinux_ipc(sma);
6229 ipc_init_security(isec, SECCLASS_SEM);
6231 ad.type = LSM_AUDIT_DATA_IPC;
6232 ad.u.ipc_id = sma->key;
6234 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6238 static int selinux_sem_associate(struct kern_ipc_perm *sma, int semflg)
6240 struct ipc_security_struct *isec;
6241 struct common_audit_data ad;
6242 u32 sid = current_sid();
6244 isec = selinux_ipc(sma);
6246 ad.type = LSM_AUDIT_DATA_IPC;
6247 ad.u.ipc_id = sma->key;
6249 return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
6250 SEM__ASSOCIATE, &ad);
6253 /* Note, at this point, sma is locked down */
6254 static int selinux_sem_semctl(struct kern_ipc_perm *sma, int cmd)
6262 /* No specific object, just general system-wide information. */
6263 return avc_has_perm(current_sid(), SECINITSID_KERNEL,
6264 SECCLASS_SYSTEM, SYSTEM__IPC_INFO, NULL);
6268 perms = SEM__GETATTR;
6279 perms = SEM__DESTROY;
6282 perms = SEM__SETATTR;
6287 perms = SEM__GETATTR | SEM__ASSOCIATE;
6293 err = ipc_has_perm(sma, perms);
6297 static int selinux_sem_semop(struct kern_ipc_perm *sma,
6298 struct sembuf *sops, unsigned nsops, int alter)
6303 perms = SEM__READ | SEM__WRITE;
6307 return ipc_has_perm(sma, perms);
6310 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
6316 av |= IPC__UNIX_READ;
6318 av |= IPC__UNIX_WRITE;
6323 return ipc_has_perm(ipcp, av);
6326 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
6328 struct ipc_security_struct *isec = selinux_ipc(ipcp);
6332 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
6335 inode_doinit_with_dentry(inode, dentry);
6338 static int selinux_lsm_getattr(unsigned int attr, struct task_struct *p,
6341 const struct task_security_struct *tsec;
6347 tsec = selinux_cred(__task_cred(p));
6349 error = avc_has_perm(current_sid(), tsec->sid,
6350 SECCLASS_PROCESS, PROCESS__GETATTR, NULL);
6355 case LSM_ATTR_CURRENT:
6362 sid = tsec->exec_sid;
6364 case LSM_ATTR_FSCREATE:
6365 sid = tsec->create_sid;
6367 case LSM_ATTR_KEYCREATE:
6368 sid = tsec->keycreate_sid;
6370 case LSM_ATTR_SOCKCREATE:
6371 sid = tsec->sockcreate_sid;
6374 error = -EOPNOTSUPP;
6379 if (sid == SECSID_NULL) {
6384 error = security_sid_to_context(sid, value, &len);
6394 static int selinux_lsm_setattr(u64 attr, void *value, size_t size)
6396 struct task_security_struct *tsec;
6398 u32 mysid = current_sid(), sid = 0, ptsid;
6403 * Basic control over ability to set these attributes at all.
6407 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6408 PROCESS__SETEXEC, NULL);
6410 case LSM_ATTR_FSCREATE:
6411 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6412 PROCESS__SETFSCREATE, NULL);
6414 case LSM_ATTR_KEYCREATE:
6415 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6416 PROCESS__SETKEYCREATE, NULL);
6418 case LSM_ATTR_SOCKCREATE:
6419 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6420 PROCESS__SETSOCKCREATE, NULL);
6422 case LSM_ATTR_CURRENT:
6423 error = avc_has_perm(mysid, mysid, SECCLASS_PROCESS,
6424 PROCESS__SETCURRENT, NULL);
6427 error = -EOPNOTSUPP;
6433 /* Obtain a SID for the context, if one was specified. */
6434 if (size && str[0] && str[0] != '\n') {
6435 if (str[size-1] == '\n') {
6439 error = security_context_to_sid(value, size,
6441 if (error == -EINVAL && attr == LSM_ATTR_FSCREATE) {
6442 if (!has_cap_mac_admin(true)) {
6443 struct audit_buffer *ab;
6446 /* We strip a nul only if it is at the end,
6447 * otherwise the context contains a nul and
6448 * we should audit that */
6449 if (str[size - 1] == '\0')
6450 audit_size = size - 1;
6453 ab = audit_log_start(audit_context(),
6458 audit_log_format(ab, "op=fscreate invalid_context=");
6459 audit_log_n_untrustedstring(ab, value,
6465 error = security_context_to_sid_force(value, size,
6472 new = prepare_creds();
6476 /* Permission checking based on the specified context is
6477 performed during the actual operation (execve,
6478 open/mkdir/...), when we know the full context of the
6479 operation. See selinux_bprm_creds_for_exec for the execve
6480 checks and may_create for the file creation checks. The
6481 operation will then fail if the context is not permitted. */
6482 tsec = selinux_cred(new);
6483 if (attr == LSM_ATTR_EXEC) {
6484 tsec->exec_sid = sid;
6485 } else if (attr == LSM_ATTR_FSCREATE) {
6486 tsec->create_sid = sid;
6487 } else if (attr == LSM_ATTR_KEYCREATE) {
6489 error = avc_has_perm(mysid, sid,
6490 SECCLASS_KEY, KEY__CREATE, NULL);
6494 tsec->keycreate_sid = sid;
6495 } else if (attr == LSM_ATTR_SOCKCREATE) {
6496 tsec->sockcreate_sid = sid;
6497 } else if (attr == LSM_ATTR_CURRENT) {
6502 if (!current_is_single_threaded()) {
6503 error = security_bounded_transition(tsec->sid, sid);
6508 /* Check permissions for the transition. */
6509 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
6510 PROCESS__DYNTRANSITION, NULL);
6514 /* Check for ptracing, and update the task SID if ok.
6515 Otherwise, leave SID unchanged and fail. */
6516 ptsid = ptrace_parent_sid();
6518 error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
6519 PROCESS__PTRACE, NULL);
6539 * selinux_getselfattr - Get SELinux current task attributes
6540 * @attr: the requested attribute
6541 * @ctx: buffer to receive the result
6542 * @size: buffer size (input), buffer size used (output)
6545 * Fill the passed user space @ctx with the details of the requested
6548 * Returns the number of attributes on success, an error code otherwise.
6549 * There will only ever be one attribute.
6551 static int selinux_getselfattr(unsigned int attr, struct lsm_ctx __user *ctx,
6552 u32 *size, u32 flags)
6558 val_len = selinux_lsm_getattr(attr, current, &val);
6561 rc = lsm_fill_user_ctx(ctx, size, val, val_len, LSM_ID_SELINUX, 0);
6563 return (!rc ? 1 : rc);
6566 static int selinux_setselfattr(unsigned int attr, struct lsm_ctx *ctx,
6567 u32 size, u32 flags)
6571 rc = selinux_lsm_setattr(attr, ctx->ctx, ctx->ctx_len);
6577 static int selinux_getprocattr(struct task_struct *p,
6578 const char *name, char **value)
6580 unsigned int attr = lsm_name_to_attr(name);
6584 rc = selinux_lsm_getattr(attr, p, value);
6585 if (rc != -EOPNOTSUPP)
6592 static int selinux_setprocattr(const char *name, void *value, size_t size)
6594 int attr = lsm_name_to_attr(name);
6597 return selinux_lsm_setattr(attr, value, size);
6601 static int selinux_ismaclabel(const char *name)
6603 return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
6606 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
6608 return security_sid_to_context(secid,
6612 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
6614 return security_context_to_sid(secdata, seclen,
6618 static void selinux_release_secctx(char *secdata, u32 seclen)
6623 static void selinux_inode_invalidate_secctx(struct inode *inode)
6625 struct inode_security_struct *isec = selinux_inode(inode);
6627 spin_lock(&isec->lock);
6628 isec->initialized = LABEL_INVALID;
6629 spin_unlock(&isec->lock);
6633 * called with inode->i_mutex locked
6635 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
6637 int rc = selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX,
6639 /* Do not return error when suppressing label (SBLABEL_MNT not set). */
6640 return rc == -EOPNOTSUPP ? 0 : rc;
6644 * called with inode->i_mutex locked
6646 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
6648 return __vfs_setxattr_noperm(&nop_mnt_idmap, dentry, XATTR_NAME_SELINUX,
6652 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
6655 len = selinux_inode_getsecurity(&nop_mnt_idmap, inode,
6656 XATTR_SELINUX_SUFFIX, ctx, true);
6664 static int selinux_key_alloc(struct key *k, const struct cred *cred,
6665 unsigned long flags)
6667 const struct task_security_struct *tsec;
6668 struct key_security_struct *ksec;
6670 ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
6674 tsec = selinux_cred(cred);
6675 if (tsec->keycreate_sid)
6676 ksec->sid = tsec->keycreate_sid;
6678 ksec->sid = tsec->sid;
6684 static void selinux_key_free(struct key *k)
6686 struct key_security_struct *ksec = k->security;
6692 static int selinux_key_permission(key_ref_t key_ref,
6693 const struct cred *cred,
6694 enum key_need_perm need_perm)
6697 struct key_security_struct *ksec;
6700 switch (need_perm) {
6707 case KEY_NEED_WRITE:
6710 case KEY_NEED_SEARCH:
6716 case KEY_NEED_SETATTR:
6717 perm = KEY__SETATTR;
6719 case KEY_NEED_UNLINK:
6720 case KEY_SYSADMIN_OVERRIDE:
6721 case KEY_AUTHTOKEN_OVERRIDE:
6722 case KEY_DEFER_PERM_CHECK:
6730 sid = cred_sid(cred);
6731 key = key_ref_to_ptr(key_ref);
6732 ksec = key->security;
6734 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
6737 static int selinux_key_getsecurity(struct key *key, char **_buffer)
6739 struct key_security_struct *ksec = key->security;
6740 char *context = NULL;
6744 rc = security_sid_to_context(ksec->sid,
6752 #ifdef CONFIG_KEY_NOTIFICATIONS
6753 static int selinux_watch_key(struct key *key)
6755 struct key_security_struct *ksec = key->security;
6756 u32 sid = current_sid();
6758 return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, KEY__VIEW, NULL);
6763 #ifdef CONFIG_SECURITY_INFINIBAND
6764 static int selinux_ib_pkey_access(void *ib_sec, u64 subnet_prefix, u16 pkey_val)
6766 struct common_audit_data ad;
6769 struct ib_security_struct *sec = ib_sec;
6770 struct lsm_ibpkey_audit ibpkey;
6772 err = sel_ib_pkey_sid(subnet_prefix, pkey_val, &sid);
6776 ad.type = LSM_AUDIT_DATA_IBPKEY;
6777 ibpkey.subnet_prefix = subnet_prefix;
6778 ibpkey.pkey = pkey_val;
6779 ad.u.ibpkey = &ibpkey;
6780 return avc_has_perm(sec->sid, sid,
6781 SECCLASS_INFINIBAND_PKEY,
6782 INFINIBAND_PKEY__ACCESS, &ad);
6785 static int selinux_ib_endport_manage_subnet(void *ib_sec, const char *dev_name,
6788 struct common_audit_data ad;
6791 struct ib_security_struct *sec = ib_sec;
6792 struct lsm_ibendport_audit ibendport;
6794 err = security_ib_endport_sid(dev_name, port_num,
6800 ad.type = LSM_AUDIT_DATA_IBENDPORT;
6801 ibendport.dev_name = dev_name;
6802 ibendport.port = port_num;
6803 ad.u.ibendport = &ibendport;
6804 return avc_has_perm(sec->sid, sid,
6805 SECCLASS_INFINIBAND_ENDPORT,
6806 INFINIBAND_ENDPORT__MANAGE_SUBNET, &ad);
6809 static int selinux_ib_alloc_security(void **ib_sec)
6811 struct ib_security_struct *sec;
6813 sec = kzalloc(sizeof(*sec), GFP_KERNEL);
6816 sec->sid = current_sid();
6822 static void selinux_ib_free_security(void *ib_sec)
6828 #ifdef CONFIG_BPF_SYSCALL
6829 static int selinux_bpf(int cmd, union bpf_attr *attr,
6832 u32 sid = current_sid();
6836 case BPF_MAP_CREATE:
6837 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__MAP_CREATE,
6841 ret = avc_has_perm(sid, sid, SECCLASS_BPF, BPF__PROG_LOAD,
6852 static u32 bpf_map_fmode_to_av(fmode_t fmode)
6856 if (fmode & FMODE_READ)
6857 av |= BPF__MAP_READ;
6858 if (fmode & FMODE_WRITE)
6859 av |= BPF__MAP_WRITE;
6863 /* This function will check the file pass through unix socket or binder to see
6864 * if it is a bpf related object. And apply corresponding checks on the bpf
6865 * object based on the type. The bpf maps and programs, not like other files and
6866 * socket, are using a shared anonymous inode inside the kernel as their inode.
6867 * So checking that inode cannot identify if the process have privilege to
6868 * access the bpf object and that's why we have to add this additional check in
6869 * selinux_file_receive and selinux_binder_transfer_files.
6871 static int bpf_fd_pass(const struct file *file, u32 sid)
6873 struct bpf_security_struct *bpfsec;
6874 struct bpf_prog *prog;
6875 struct bpf_map *map;
6878 if (file->f_op == &bpf_map_fops) {
6879 map = file->private_data;
6880 bpfsec = map->security;
6881 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6882 bpf_map_fmode_to_av(file->f_mode), NULL);
6885 } else if (file->f_op == &bpf_prog_fops) {
6886 prog = file->private_data;
6887 bpfsec = prog->aux->security;
6888 ret = avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6889 BPF__PROG_RUN, NULL);
6896 static int selinux_bpf_map(struct bpf_map *map, fmode_t fmode)
6898 u32 sid = current_sid();
6899 struct bpf_security_struct *bpfsec;
6901 bpfsec = map->security;
6902 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6903 bpf_map_fmode_to_av(fmode), NULL);
6906 static int selinux_bpf_prog(struct bpf_prog *prog)
6908 u32 sid = current_sid();
6909 struct bpf_security_struct *bpfsec;
6911 bpfsec = prog->aux->security;
6912 return avc_has_perm(sid, bpfsec->sid, SECCLASS_BPF,
6913 BPF__PROG_RUN, NULL);
6916 static int selinux_bpf_map_create(struct bpf_map *map, union bpf_attr *attr,
6917 struct bpf_token *token)
6919 struct bpf_security_struct *bpfsec;
6921 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6925 bpfsec->sid = current_sid();
6926 map->security = bpfsec;
6931 static void selinux_bpf_map_free(struct bpf_map *map)
6933 struct bpf_security_struct *bpfsec = map->security;
6935 map->security = NULL;
6939 static int selinux_bpf_prog_load(struct bpf_prog *prog, union bpf_attr *attr,
6940 struct bpf_token *token)
6942 struct bpf_security_struct *bpfsec;
6944 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6948 bpfsec->sid = current_sid();
6949 prog->aux->security = bpfsec;
6954 static void selinux_bpf_prog_free(struct bpf_prog *prog)
6956 struct bpf_security_struct *bpfsec = prog->aux->security;
6958 prog->aux->security = NULL;
6962 static int selinux_bpf_token_create(struct bpf_token *token, union bpf_attr *attr,
6965 struct bpf_security_struct *bpfsec;
6967 bpfsec = kzalloc(sizeof(*bpfsec), GFP_KERNEL);
6971 bpfsec->sid = current_sid();
6972 token->security = bpfsec;
6977 static void selinux_bpf_token_free(struct bpf_token *token)
6979 struct bpf_security_struct *bpfsec = token->security;
6981 token->security = NULL;
6986 struct lsm_blob_sizes selinux_blob_sizes __ro_after_init = {
6987 .lbs_cred = sizeof(struct task_security_struct),
6988 .lbs_file = sizeof(struct file_security_struct),
6989 .lbs_inode = sizeof(struct inode_security_struct),
6990 .lbs_ipc = sizeof(struct ipc_security_struct),
6991 .lbs_msg_msg = sizeof(struct msg_security_struct),
6992 .lbs_superblock = sizeof(struct superblock_security_struct),
6993 .lbs_xattr_count = SELINUX_INODE_INIT_XATTRS,
6996 #ifdef CONFIG_PERF_EVENTS
6997 static int selinux_perf_event_open(struct perf_event_attr *attr, int type)
6999 u32 requested, sid = current_sid();
7001 if (type == PERF_SECURITY_OPEN)
7002 requested = PERF_EVENT__OPEN;
7003 else if (type == PERF_SECURITY_CPU)
7004 requested = PERF_EVENT__CPU;
7005 else if (type == PERF_SECURITY_KERNEL)
7006 requested = PERF_EVENT__KERNEL;
7007 else if (type == PERF_SECURITY_TRACEPOINT)
7008 requested = PERF_EVENT__TRACEPOINT;
7012 return avc_has_perm(sid, sid, SECCLASS_PERF_EVENT,
7016 static int selinux_perf_event_alloc(struct perf_event *event)
7018 struct perf_event_security_struct *perfsec;
7020 perfsec = kzalloc(sizeof(*perfsec), GFP_KERNEL);
7024 perfsec->sid = current_sid();
7025 event->security = perfsec;
7030 static void selinux_perf_event_free(struct perf_event *event)
7032 struct perf_event_security_struct *perfsec = event->security;
7034 event->security = NULL;
7038 static int selinux_perf_event_read(struct perf_event *event)
7040 struct perf_event_security_struct *perfsec = event->security;
7041 u32 sid = current_sid();
7043 return avc_has_perm(sid, perfsec->sid,
7044 SECCLASS_PERF_EVENT, PERF_EVENT__READ, NULL);
7047 static int selinux_perf_event_write(struct perf_event *event)
7049 struct perf_event_security_struct *perfsec = event->security;
7050 u32 sid = current_sid();
7052 return avc_has_perm(sid, perfsec->sid,
7053 SECCLASS_PERF_EVENT, PERF_EVENT__WRITE, NULL);
7057 #ifdef CONFIG_IO_URING
7059 * selinux_uring_override_creds - check the requested cred override
7060 * @new: the target creds
7062 * Check to see if the current task is allowed to override it's credentials
7063 * to service an io_uring operation.
7065 static int selinux_uring_override_creds(const struct cred *new)
7067 return avc_has_perm(current_sid(), cred_sid(new),
7068 SECCLASS_IO_URING, IO_URING__OVERRIDE_CREDS, NULL);
7072 * selinux_uring_sqpoll - check if a io_uring polling thread can be created
7074 * Check to see if the current task is allowed to create a new io_uring
7075 * kernel polling thread.
7077 static int selinux_uring_sqpoll(void)
7079 u32 sid = current_sid();
7081 return avc_has_perm(sid, sid,
7082 SECCLASS_IO_URING, IO_URING__SQPOLL, NULL);
7086 * selinux_uring_cmd - check if IORING_OP_URING_CMD is allowed
7087 * @ioucmd: the io_uring command structure
7089 * Check to see if the current domain is allowed to execute an
7090 * IORING_OP_URING_CMD against the device/file specified in @ioucmd.
7093 static int selinux_uring_cmd(struct io_uring_cmd *ioucmd)
7095 struct file *file = ioucmd->file;
7096 struct inode *inode = file_inode(file);
7097 struct inode_security_struct *isec = selinux_inode(inode);
7098 struct common_audit_data ad;
7100 ad.type = LSM_AUDIT_DATA_FILE;
7103 return avc_has_perm(current_sid(), isec->sid,
7104 SECCLASS_IO_URING, IO_URING__CMD, &ad);
7106 #endif /* CONFIG_IO_URING */
7108 static const struct lsm_id selinux_lsmid = {
7110 .id = LSM_ID_SELINUX,
7114 * IMPORTANT NOTE: When adding new hooks, please be careful to keep this order:
7115 * 1. any hooks that don't belong to (2.) or (3.) below,
7116 * 2. hooks that both access structures allocated by other hooks, and allocate
7117 * structures that can be later accessed by other hooks (mostly "cloning"
7119 * 3. hooks that only allocate structures that can be later accessed by other
7120 * hooks ("allocating" hooks).
7122 * Please follow block comment delimiters in the list to keep this order.
7124 static struct security_hook_list selinux_hooks[] __ro_after_init = {
7125 LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
7126 LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
7127 LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
7128 LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
7130 LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
7131 LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
7132 LSM_HOOK_INIT(capget, selinux_capget),
7133 LSM_HOOK_INIT(capset, selinux_capset),
7134 LSM_HOOK_INIT(capable, selinux_capable),
7135 LSM_HOOK_INIT(quotactl, selinux_quotactl),
7136 LSM_HOOK_INIT(quota_on, selinux_quota_on),
7137 LSM_HOOK_INIT(syslog, selinux_syslog),
7138 LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
7140 LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
7142 LSM_HOOK_INIT(bprm_creds_for_exec, selinux_bprm_creds_for_exec),
7143 LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
7144 LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
7146 LSM_HOOK_INIT(sb_free_mnt_opts, selinux_free_mnt_opts),
7147 LSM_HOOK_INIT(sb_mnt_opts_compat, selinux_sb_mnt_opts_compat),
7148 LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
7149 LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
7150 LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
7151 LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
7152 LSM_HOOK_INIT(sb_mount, selinux_mount),
7153 LSM_HOOK_INIT(sb_umount, selinux_umount),
7154 LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
7155 LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
7157 LSM_HOOK_INIT(move_mount, selinux_move_mount),
7159 LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
7160 LSM_HOOK_INIT(dentry_create_files_as, selinux_dentry_create_files_as),
7162 LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
7163 LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
7164 LSM_HOOK_INIT(inode_init_security_anon, selinux_inode_init_security_anon),
7165 LSM_HOOK_INIT(inode_create, selinux_inode_create),
7166 LSM_HOOK_INIT(inode_link, selinux_inode_link),
7167 LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
7168 LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
7169 LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
7170 LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
7171 LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
7172 LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
7173 LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
7174 LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
7175 LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
7176 LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
7177 LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
7178 LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
7179 LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
7180 LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
7181 LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
7182 LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
7183 LSM_HOOK_INIT(inode_set_acl, selinux_inode_set_acl),
7184 LSM_HOOK_INIT(inode_get_acl, selinux_inode_get_acl),
7185 LSM_HOOK_INIT(inode_remove_acl, selinux_inode_remove_acl),
7186 LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
7187 LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
7188 LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
7189 LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
7190 LSM_HOOK_INIT(inode_copy_up, selinux_inode_copy_up),
7191 LSM_HOOK_INIT(inode_copy_up_xattr, selinux_inode_copy_up_xattr),
7192 LSM_HOOK_INIT(path_notify, selinux_path_notify),
7194 LSM_HOOK_INIT(kernfs_init_security, selinux_kernfs_init_security),
7196 LSM_HOOK_INIT(file_permission, selinux_file_permission),
7197 LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
7198 LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
7199 LSM_HOOK_INIT(file_ioctl_compat, selinux_file_ioctl_compat),
7200 LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
7201 LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
7202 LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
7203 LSM_HOOK_INIT(file_lock, selinux_file_lock),
7204 LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
7205 LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
7206 LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
7207 LSM_HOOK_INIT(file_receive, selinux_file_receive),
7209 LSM_HOOK_INIT(file_open, selinux_file_open),
7211 LSM_HOOK_INIT(task_alloc, selinux_task_alloc),
7212 LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
7213 LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
7214 LSM_HOOK_INIT(cred_getsecid, selinux_cred_getsecid),
7215 LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
7216 LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
7217 LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
7218 LSM_HOOK_INIT(kernel_load_data, selinux_kernel_load_data),
7219 LSM_HOOK_INIT(kernel_read_file, selinux_kernel_read_file),
7220 LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
7221 LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
7222 LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
7223 LSM_HOOK_INIT(current_getsecid_subj, selinux_current_getsecid_subj),
7224 LSM_HOOK_INIT(task_getsecid_obj, selinux_task_getsecid_obj),
7225 LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
7226 LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
7227 LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
7228 LSM_HOOK_INIT(task_prlimit, selinux_task_prlimit),
7229 LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
7230 LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
7231 LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
7232 LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
7233 LSM_HOOK_INIT(task_kill, selinux_task_kill),
7234 LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
7235 LSM_HOOK_INIT(userns_create, selinux_userns_create),
7237 LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
7238 LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
7240 LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
7241 LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
7242 LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
7243 LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
7245 LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
7246 LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
7247 LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
7249 LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
7250 LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
7251 LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
7253 LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
7255 LSM_HOOK_INIT(getselfattr, selinux_getselfattr),
7256 LSM_HOOK_INIT(setselfattr, selinux_setselfattr),
7257 LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
7258 LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
7260 LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
7261 LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
7262 LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
7263 LSM_HOOK_INIT(inode_invalidate_secctx, selinux_inode_invalidate_secctx),
7264 LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
7265 LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
7267 LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
7268 LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
7270 LSM_HOOK_INIT(socket_create, selinux_socket_create),
7271 LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
7272 LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
7273 LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
7274 LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
7275 LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
7276 LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
7277 LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
7278 LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
7279 LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
7280 LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
7281 LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
7282 LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
7283 LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
7284 LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
7285 LSM_HOOK_INIT(socket_getpeersec_stream,
7286 selinux_socket_getpeersec_stream),
7287 LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
7288 LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
7289 LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
7290 LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
7291 LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
7292 LSM_HOOK_INIT(sctp_assoc_request, selinux_sctp_assoc_request),
7293 LSM_HOOK_INIT(sctp_sk_clone, selinux_sctp_sk_clone),
7294 LSM_HOOK_INIT(sctp_bind_connect, selinux_sctp_bind_connect),
7295 LSM_HOOK_INIT(sctp_assoc_established, selinux_sctp_assoc_established),
7296 LSM_HOOK_INIT(mptcp_add_subflow, selinux_mptcp_add_subflow),
7297 LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
7298 LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
7299 LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
7300 LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
7301 LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
7302 LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
7303 LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
7304 LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
7305 LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
7306 LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
7307 LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
7308 LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
7309 #ifdef CONFIG_SECURITY_INFINIBAND
7310 LSM_HOOK_INIT(ib_pkey_access, selinux_ib_pkey_access),
7311 LSM_HOOK_INIT(ib_endport_manage_subnet,
7312 selinux_ib_endport_manage_subnet),
7313 LSM_HOOK_INIT(ib_free_security, selinux_ib_free_security),
7315 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7316 LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
7317 LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
7318 LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
7319 LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
7320 LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
7321 LSM_HOOK_INIT(xfrm_state_pol_flow_match,
7322 selinux_xfrm_state_pol_flow_match),
7323 LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
7327 LSM_HOOK_INIT(key_free, selinux_key_free),
7328 LSM_HOOK_INIT(key_permission, selinux_key_permission),
7329 LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
7330 #ifdef CONFIG_KEY_NOTIFICATIONS
7331 LSM_HOOK_INIT(watch_key, selinux_watch_key),
7336 LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
7337 LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
7338 LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
7341 #ifdef CONFIG_BPF_SYSCALL
7342 LSM_HOOK_INIT(bpf, selinux_bpf),
7343 LSM_HOOK_INIT(bpf_map, selinux_bpf_map),
7344 LSM_HOOK_INIT(bpf_prog, selinux_bpf_prog),
7345 LSM_HOOK_INIT(bpf_map_free, selinux_bpf_map_free),
7346 LSM_HOOK_INIT(bpf_prog_free, selinux_bpf_prog_free),
7347 LSM_HOOK_INIT(bpf_token_free, selinux_bpf_token_free),
7350 #ifdef CONFIG_PERF_EVENTS
7351 LSM_HOOK_INIT(perf_event_open, selinux_perf_event_open),
7352 LSM_HOOK_INIT(perf_event_free, selinux_perf_event_free),
7353 LSM_HOOK_INIT(perf_event_read, selinux_perf_event_read),
7354 LSM_HOOK_INIT(perf_event_write, selinux_perf_event_write),
7357 #ifdef CONFIG_IO_URING
7358 LSM_HOOK_INIT(uring_override_creds, selinux_uring_override_creds),
7359 LSM_HOOK_INIT(uring_sqpoll, selinux_uring_sqpoll),
7360 LSM_HOOK_INIT(uring_cmd, selinux_uring_cmd),
7364 * PUT "CLONING" (ACCESSING + ALLOCATING) HOOKS HERE
7366 LSM_HOOK_INIT(fs_context_submount, selinux_fs_context_submount),
7367 LSM_HOOK_INIT(fs_context_dup, selinux_fs_context_dup),
7368 LSM_HOOK_INIT(fs_context_parse_param, selinux_fs_context_parse_param),
7369 LSM_HOOK_INIT(sb_eat_lsm_opts, selinux_sb_eat_lsm_opts),
7370 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7371 LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
7375 * PUT "ALLOCATING" HOOKS HERE
7377 LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
7378 LSM_HOOK_INIT(msg_queue_alloc_security,
7379 selinux_msg_queue_alloc_security),
7380 LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
7381 LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
7382 LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
7383 LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
7384 LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
7385 LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
7386 LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
7387 LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
7388 #ifdef CONFIG_SECURITY_INFINIBAND
7389 LSM_HOOK_INIT(ib_alloc_security, selinux_ib_alloc_security),
7391 #ifdef CONFIG_SECURITY_NETWORK_XFRM
7392 LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
7393 LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
7394 LSM_HOOK_INIT(xfrm_state_alloc_acquire,
7395 selinux_xfrm_state_alloc_acquire),
7398 LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
7401 LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
7403 #ifdef CONFIG_BPF_SYSCALL
7404 LSM_HOOK_INIT(bpf_map_create, selinux_bpf_map_create),
7405 LSM_HOOK_INIT(bpf_prog_load, selinux_bpf_prog_load),
7406 LSM_HOOK_INIT(bpf_token_create, selinux_bpf_token_create),
7408 #ifdef CONFIG_PERF_EVENTS
7409 LSM_HOOK_INIT(perf_event_alloc, selinux_perf_event_alloc),
7413 static __init int selinux_init(void)
7415 pr_info("SELinux: Initializing.\n");
7417 memset(&selinux_state, 0, sizeof(selinux_state));
7418 enforcing_set(selinux_enforcing_boot);
7420 mutex_init(&selinux_state.status_lock);
7421 mutex_init(&selinux_state.policy_mutex);
7423 /* Set the security state for the initial task. */
7424 cred_init_security();
7426 default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
7427 if (!default_noexec)
7428 pr_notice("SELinux: virtual memory is executable by default\n");
7434 ebitmap_cache_init();
7436 hashtab_cache_init();
7438 security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks),
7441 if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
7442 panic("SELinux: Unable to register AVC netcache callback\n");
7444 if (avc_add_callback(selinux_lsm_notifier_avc_callback, AVC_CALLBACK_RESET))
7445 panic("SELinux: Unable to register AVC LSM notifier callback\n");
7447 if (selinux_enforcing_boot)
7448 pr_debug("SELinux: Starting in enforcing mode\n");
7450 pr_debug("SELinux: Starting in permissive mode\n");
7452 fs_validate_description("selinux", selinux_fs_parameters);
7457 static void delayed_superblock_init(struct super_block *sb, void *unused)
7459 selinux_set_mnt_opts(sb, NULL, 0, NULL);
7462 void selinux_complete_init(void)
7464 pr_debug("SELinux: Completing initialization.\n");
7466 /* Set up any superblocks initialized prior to the policy load. */
7467 pr_debug("SELinux: Setting up existing superblocks.\n");
7468 iterate_supers(delayed_superblock_init, NULL);
7471 /* SELinux requires early initialization in order to label
7472 all processes and objects when they are created. */
7473 DEFINE_LSM(selinux) = {
7475 .flags = LSM_FLAG_LEGACY_MAJOR | LSM_FLAG_EXCLUSIVE,
7476 .enabled = &selinux_enabled_boot,
7477 .blobs = &selinux_blob_sizes,
7478 .init = selinux_init,
7481 #if defined(CONFIG_NETFILTER)
7482 static const struct nf_hook_ops selinux_nf_ops[] = {
7484 .hook = selinux_ip_postroute,
7486 .hooknum = NF_INET_POST_ROUTING,
7487 .priority = NF_IP_PRI_SELINUX_LAST,
7490 .hook = selinux_ip_forward,
7492 .hooknum = NF_INET_FORWARD,
7493 .priority = NF_IP_PRI_SELINUX_FIRST,
7496 .hook = selinux_ip_output,
7498 .hooknum = NF_INET_LOCAL_OUT,
7499 .priority = NF_IP_PRI_SELINUX_FIRST,
7501 #if IS_ENABLED(CONFIG_IPV6)
7503 .hook = selinux_ip_postroute,
7505 .hooknum = NF_INET_POST_ROUTING,
7506 .priority = NF_IP6_PRI_SELINUX_LAST,
7509 .hook = selinux_ip_forward,
7511 .hooknum = NF_INET_FORWARD,
7512 .priority = NF_IP6_PRI_SELINUX_FIRST,
7515 .hook = selinux_ip_output,
7517 .hooknum = NF_INET_LOCAL_OUT,
7518 .priority = NF_IP6_PRI_SELINUX_FIRST,
7523 static int __net_init selinux_nf_register(struct net *net)
7525 return nf_register_net_hooks(net, selinux_nf_ops,
7526 ARRAY_SIZE(selinux_nf_ops));
7529 static void __net_exit selinux_nf_unregister(struct net *net)
7531 nf_unregister_net_hooks(net, selinux_nf_ops,
7532 ARRAY_SIZE(selinux_nf_ops));
7535 static struct pernet_operations selinux_net_ops = {
7536 .init = selinux_nf_register,
7537 .exit = selinux_nf_unregister,
7540 static int __init selinux_nf_ip_init(void)
7544 if (!selinux_enabled_boot)
7547 pr_debug("SELinux: Registering netfilter hooks\n");
7549 err = register_pernet_subsys(&selinux_net_ops);
7551 panic("SELinux: register_pernet_subsys: error %d\n", err);
7555 __initcall(selinux_nf_ip_init);
7556 #endif /* CONFIG_NETFILTER */