^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1) // SPDX-License-Identifier: GPL-2.0-only
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2) /* Updated: Karl MacMillan <kmacmillan@tresys.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 3) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 4) * Added conditional policy language extensions
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 5) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 6) * Updated: Hewlett-Packard <paul@paul-moore.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 7) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 8) * Added support for the policy capability bitmap
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 9) *
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 10) * Copyright (C) 2007 Hewlett-Packard Development Company, L.P.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 11) * Copyright (C) 2003 - 2004 Tresys Technology, LLC
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 12) * Copyright (C) 2004 Red Hat, Inc., James Morris <jmorris@redhat.com>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 13) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 14)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 15) #include <linux/kernel.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 16) #include <linux/pagemap.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 17) #include <linux/slab.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 18) #include <linux/vmalloc.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 19) #include <linux/fs.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 20) #include <linux/fs_context.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 21) #include <linux/mount.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 22) #include <linux/mutex.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 23) #include <linux/namei.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 24) #include <linux/init.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 25) #include <linux/string.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 26) #include <linux/security.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 27) #include <linux/major.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 28) #include <linux/seq_file.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 29) #include <linux/percpu.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 30) #include <linux/audit.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 31) #include <linux/uaccess.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 32) #include <linux/kobject.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 33) #include <linux/ctype.h>
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 34)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 35) /* selinuxfs pseudo filesystem for exporting the security policy API.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 36) Based on the proc code and the fs/nfsd/nfsctl.c code. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 37)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 38) #include "flask.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 39) #include "avc.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 40) #include "avc_ss.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 41) #include "security.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 42) #include "objsec.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 43) #include "conditional.h"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 44)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 45) enum sel_inos {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 46) SEL_ROOT_INO = 2,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 47) SEL_LOAD, /* load policy */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 48) SEL_ENFORCE, /* get or set enforcing status */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 49) SEL_CONTEXT, /* validate context */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 50) SEL_ACCESS, /* compute access decision */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 51) SEL_CREATE, /* compute create labeling decision */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 52) SEL_RELABEL, /* compute relabeling decision */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 53) SEL_USER, /* compute reachable user contexts */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 54) SEL_POLICYVERS, /* return policy version for this kernel */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 55) SEL_COMMIT_BOOLS, /* commit new boolean values */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 56) SEL_MLS, /* return if MLS policy is enabled */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 57) SEL_DISABLE, /* disable SELinux until next reboot */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 58) SEL_MEMBER, /* compute polyinstantiation membership decision */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 59) SEL_CHECKREQPROT, /* check requested protection, not kernel-applied one */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 60) SEL_COMPAT_NET, /* whether to use old compat network packet controls */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 61) SEL_REJECT_UNKNOWN, /* export unknown reject handling to userspace */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 62) SEL_DENY_UNKNOWN, /* export unknown deny handling to userspace */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 63) SEL_STATUS, /* export current status using mmap() */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 64) SEL_POLICY, /* allow userspace to read the in kernel policy */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 65) SEL_VALIDATE_TRANS, /* compute validatetrans decision */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 66) SEL_INO_NEXT, /* The next inode number to use */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 67) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 68)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 69) struct selinux_fs_info {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 70) struct dentry *bool_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 71) unsigned int bool_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 72) char **bool_pending_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 73) unsigned int *bool_pending_values;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 74) struct dentry *class_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 75) unsigned long last_class_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 76) bool policy_opened;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 77) struct dentry *policycap_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 78) unsigned long last_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 79) struct selinux_state *state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 80) struct super_block *sb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 81) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 82)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 83) static int selinux_fs_info_create(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 84) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 85) struct selinux_fs_info *fsi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 86)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 87) fsi = kzalloc(sizeof(*fsi), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 88) if (!fsi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 89) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 90)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 91) fsi->last_ino = SEL_INO_NEXT - 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 92) fsi->state = &selinux_state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 93) fsi->sb = sb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 94) sb->s_fs_info = fsi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 95) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 96) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 97)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 98) static void selinux_fs_info_free(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 99) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 100) struct selinux_fs_info *fsi = sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 101) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 102)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 103) if (fsi) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 104) for (i = 0; i < fsi->bool_num; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 105) kfree(fsi->bool_pending_names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 106) kfree(fsi->bool_pending_names);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 107) kfree(fsi->bool_pending_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 108) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 109) kfree(sb->s_fs_info);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 110) sb->s_fs_info = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 111) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 112)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 113) #define SEL_INITCON_INO_OFFSET 0x01000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 114) #define SEL_BOOL_INO_OFFSET 0x02000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 115) #define SEL_CLASS_INO_OFFSET 0x04000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 116) #define SEL_POLICYCAP_INO_OFFSET 0x08000000
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 117) #define SEL_INO_MASK 0x00ffffff
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 118)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 119) #define BOOL_DIR_NAME "booleans"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 120) #define CLASS_DIR_NAME "class"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 121) #define POLICYCAP_DIR_NAME "policy_capabilities"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 122)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 123) #define TMPBUFLEN 12
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 124) static ssize_t sel_read_enforce(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 125) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 126) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 127) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 128) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 129) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 130)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 131) length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 132) enforcing_enabled(fsi->state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 133) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 136) #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 137) static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 138) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 140) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 141) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 142) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 143) char *page = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 144) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 145) int old_value, new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 146)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 147) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 148) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 150) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 151) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 152) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 153)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 154) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 155) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 156) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 157)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 158) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 159) if (sscanf(page, "%d", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 160) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 161)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 162) new_value = !!new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 163)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 164) old_value = enforcing_enabled(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 165) if (new_value != old_value) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 166) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 167) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 168) SECCLASS_SECURITY, SECURITY__SETENFORCE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 169) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 170) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 171) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 172) audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 173) "enforcing=%d old_enforcing=%d auid=%u ses=%u"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 174) " enabled=1 old-enabled=1 lsm=selinux res=1",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 175) new_value, old_value,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 176) from_kuid(&init_user_ns, audit_get_loginuid(current)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 177) audit_get_sessionid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 178) enforcing_set(state, new_value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 179) if (new_value)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 180) avc_ss_reset(state->avc, 0);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 181) selnl_notify_setenforce(new_value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 182) selinux_status_update_setenforce(state, new_value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 183) if (!new_value)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 184) call_blocking_lsm_notifier(LSM_POLICY_CHANGE, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 185) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 186) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 187) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 188) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 189) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 190) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 191) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 192) #define sel_write_enforce NULL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 193) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 194)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 195) static const struct file_operations sel_enforce_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 196) .read = sel_read_enforce,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 197) .write = sel_write_enforce,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 198) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 199) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 200)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 201) static ssize_t sel_read_handle_unknown(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 202) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 203) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 204) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 205) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 206) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 207) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 208) ino_t ino = file_inode(filp)->i_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 209) int handle_unknown = (ino == SEL_REJECT_UNKNOWN) ?
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 210) security_get_reject_unknown(state) :
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 211) !security_get_allow_unknown(state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 212)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 213) length = scnprintf(tmpbuf, TMPBUFLEN, "%d", handle_unknown);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 214) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 215) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 217) static const struct file_operations sel_handle_unknown_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 218) .read = sel_read_handle_unknown,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 219) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 220) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 222) static int sel_open_handle_status(struct inode *inode, struct file *filp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 223) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 224) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 225) struct page *status = selinux_kernel_status_page(fsi->state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 226)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 227) if (!status)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 228) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 229)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 230) filp->private_data = status;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 231)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 232) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 233) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 234)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 235) static ssize_t sel_read_handle_status(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 236) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 237) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 238) struct page *status = filp->private_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 239)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 240) BUG_ON(!status);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 241)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 242) return simple_read_from_buffer(buf, count, ppos,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 243) page_address(status),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 244) sizeof(struct selinux_kernel_status));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 245) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 246)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 247) static int sel_mmap_handle_status(struct file *filp,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 248) struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 249) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 250) struct page *status = filp->private_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 251) unsigned long size = vma->vm_end - vma->vm_start;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 252)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 253) BUG_ON(!status);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 254)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 255) /* only allows one page from the head */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 256) if (vma->vm_pgoff > 0 || size != PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 257) return -EIO;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 258) /* disallow writable mapping */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 259) if (vma->vm_flags & VM_WRITE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 260) return -EPERM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 261) /* disallow mprotect() turns it into writable */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 262) vma->vm_flags &= ~VM_MAYWRITE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 263)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 264) return remap_pfn_range(vma, vma->vm_start,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 265) page_to_pfn(status),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 266) size, vma->vm_page_prot);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 267) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 268)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 269) static const struct file_operations sel_handle_status_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 270) .open = sel_open_handle_status,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 271) .read = sel_read_handle_status,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 272) .mmap = sel_mmap_handle_status,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 273) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 274) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 275)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 276) #ifdef CONFIG_SECURITY_SELINUX_DISABLE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 277) static ssize_t sel_write_disable(struct file *file, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 278) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 279)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 280) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 281) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 282) char *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 283) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 284) int new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 285) int enforcing;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 286)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 287) /* NOTE: we are now officially considering runtime disable as
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 288) * deprecated, and using it will become increasingly painful
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 289) * (e.g. sleeping/blocking) as we progress through future
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 290) * kernel releases until eventually it is removed
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 291) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 292) pr_err("SELinux: Runtime disable is deprecated, use selinux=0 on the kernel cmdline.\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 293)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 294) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 295) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 297) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 298) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 299) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 300)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 301) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 302) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 303) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 304)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 305) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 306) if (sscanf(page, "%d", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 307) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 308)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 309) if (new_value) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 310) enforcing = enforcing_enabled(fsi->state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 311) length = selinux_disable(fsi->state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 312) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 313) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 314) audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_STATUS,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 315) "enforcing=%d old_enforcing=%d auid=%u ses=%u"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 316) " enabled=0 old-enabled=1 lsm=selinux res=1",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 317) enforcing, enforcing,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 318) from_kuid(&init_user_ns, audit_get_loginuid(current)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 319) audit_get_sessionid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 320) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 321)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 322) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 323) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 324) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 325) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 326) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 327) #else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 328) #define sel_write_disable NULL
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 329) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 330)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 331) static const struct file_operations sel_disable_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 332) .write = sel_write_disable,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 333) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 334) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 335)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 336) static ssize_t sel_read_policyvers(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 337) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 338) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 339) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 340) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 341)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 342) length = scnprintf(tmpbuf, TMPBUFLEN, "%u", POLICYDB_VERSION_MAX);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 343) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 344) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 345)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 346) static const struct file_operations sel_policyvers_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 347) .read = sel_read_policyvers,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 348) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 349) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 350)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 351) /* declaration for sel_write_load */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 352) static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 353) unsigned int *bool_num, char ***bool_pending_names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 354) unsigned int **bool_pending_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 355) static int sel_make_classes(struct selinux_policy *newpolicy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 356) struct dentry *class_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 357) unsigned long *last_class_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 359) /* declaration for sel_make_class_dirs */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 360) static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 361) unsigned long *ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 362)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 363) /* declaration for sel_make_policy_nodes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 364) static struct dentry *sel_make_disconnected_dir(struct super_block *sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 365) unsigned long *ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 366)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 367) /* declaration for sel_make_policy_nodes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 368) static void sel_remove_entries(struct dentry *de);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 369)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 370) static ssize_t sel_read_mls(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 371) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 372) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 373) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 374) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 375) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 376)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 377) length = scnprintf(tmpbuf, TMPBUFLEN, "%d",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 378) security_mls_enabled(fsi->state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 379) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 380) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 381)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 382) static const struct file_operations sel_mls_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 383) .read = sel_read_mls,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 384) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 385) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 386)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 387) struct policy_load_memory {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 388) size_t len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 389) void *data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 390) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 391)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 392) static int sel_open_policy(struct inode *inode, struct file *filp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 393) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 394) struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 395) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 396) struct policy_load_memory *plm = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 397) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 398)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 399) BUG_ON(filp->private_data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 400)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 401) mutex_lock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 402)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 403) rc = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 404) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 405) SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 406) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 407) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 408)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 409) rc = -EBUSY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 410) if (fsi->policy_opened)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 411) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 412)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 413) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 414) plm = kzalloc(sizeof(*plm), GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 415) if (!plm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 416) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 417)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 418) rc = security_read_policy(state, &plm->data, &plm->len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 419) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 420) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 421)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 422) if ((size_t)i_size_read(inode) != plm->len) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 423) inode_lock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 424) i_size_write(inode, plm->len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 425) inode_unlock(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 426) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 427)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 428) fsi->policy_opened = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 429)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 430) filp->private_data = plm;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 431)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 432) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 433)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 434) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 435) err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 436) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 437)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 438) if (plm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 439) vfree(plm->data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 440) kfree(plm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 441) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 442) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 443)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 444) static int sel_release_policy(struct inode *inode, struct file *filp)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 445) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 446) struct selinux_fs_info *fsi = inode->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 447) struct policy_load_memory *plm = filp->private_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 448)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 449) BUG_ON(!plm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 450)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 451) fsi->policy_opened = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 452)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 453) vfree(plm->data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 454) kfree(plm);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 455)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 456) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 457) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 458)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 459) static ssize_t sel_read_policy(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 460) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 461) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 462) struct policy_load_memory *plm = filp->private_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 463) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 464)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 465) ret = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 466) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 467) SECCLASS_SECURITY, SECURITY__READ_POLICY, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 468) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 469) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 470)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 471) return simple_read_from_buffer(buf, count, ppos, plm->data, plm->len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 472) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 473)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 474) static vm_fault_t sel_mmap_policy_fault(struct vm_fault *vmf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 475) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 476) struct policy_load_memory *plm = vmf->vma->vm_file->private_data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 477) unsigned long offset;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 478) struct page *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 479)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 480) if (vmf->flags & (FAULT_FLAG_MKWRITE | FAULT_FLAG_WRITE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 481) return VM_FAULT_SIGBUS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 482)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 483) offset = vmf->pgoff << PAGE_SHIFT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 484) if (offset >= roundup(plm->len, PAGE_SIZE))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 485) return VM_FAULT_SIGBUS;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 486)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 487) page = vmalloc_to_page(plm->data + offset);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 488) get_page(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 489)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 490) vmf->page = page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 491)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 492) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 493) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 494)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 495) static const struct vm_operations_struct sel_mmap_policy_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 496) .fault = sel_mmap_policy_fault,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 497) .page_mkwrite = sel_mmap_policy_fault,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 498) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 499)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 500) static int sel_mmap_policy(struct file *filp, struct vm_area_struct *vma)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 501) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 502) if (vma->vm_flags & VM_SHARED) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 503) /* do not allow mprotect to make mapping writable */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 504) vma->vm_flags &= ~VM_MAYWRITE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 505)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 506) if (vma->vm_flags & VM_WRITE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 507) return -EACCES;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 508) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 509)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 510) vma->vm_flags |= VM_DONTEXPAND | VM_DONTDUMP;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 511) vma->vm_ops = &sel_mmap_policy_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 512)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 513) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 514) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 515)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 516) static const struct file_operations sel_policy_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 517) .open = sel_open_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 518) .read = sel_read_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 519) .mmap = sel_mmap_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 520) .release = sel_release_policy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 521) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 522) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 523)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 524) static void sel_remove_old_bool_data(unsigned int bool_num, char **bool_names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 525) unsigned int *bool_values)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 526) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 527) u32 i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 528)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 529) /* bool_dir cleanup */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 530) for (i = 0; i < bool_num; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 531) kfree(bool_names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 532) kfree(bool_names);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 533) kfree(bool_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 534) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 535)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 536) static int sel_make_policy_nodes(struct selinux_fs_info *fsi,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 537) struct selinux_policy *newpolicy)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 538) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 539) int ret = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 540) struct dentry *tmp_parent, *tmp_bool_dir, *tmp_class_dir, *old_dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 541) unsigned int tmp_bool_num, old_bool_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 542) char **tmp_bool_names, **old_bool_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 543) unsigned int *tmp_bool_values, *old_bool_values;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 544) unsigned long tmp_ino = fsi->last_ino; /* Don't increment last_ino in this function */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 545)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 546) tmp_parent = sel_make_disconnected_dir(fsi->sb, &tmp_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 547) if (IS_ERR(tmp_parent))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 548) return PTR_ERR(tmp_parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 549)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 550) tmp_ino = fsi->bool_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 551) tmp_bool_dir = sel_make_dir(tmp_parent, BOOL_DIR_NAME, &tmp_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 552) if (IS_ERR(tmp_bool_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 553) ret = PTR_ERR(tmp_bool_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 554) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 555) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 556)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 557) tmp_ino = fsi->class_dir->d_inode->i_ino - 1; /* sel_make_dir will increment and set */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 558) tmp_class_dir = sel_make_dir(tmp_parent, CLASS_DIR_NAME, &tmp_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 559) if (IS_ERR(tmp_class_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 560) ret = PTR_ERR(tmp_class_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 561) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 562) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 563)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 564) ret = sel_make_bools(newpolicy, tmp_bool_dir, &tmp_bool_num,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 565) &tmp_bool_names, &tmp_bool_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 566) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 567) pr_err("SELinux: failed to load policy booleans\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 568) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 569) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 570)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 571) ret = sel_make_classes(newpolicy, tmp_class_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 572) &fsi->last_class_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 573) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 574) pr_err("SELinux: failed to load policy classes\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 575) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 576) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 577)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 578) /* booleans */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 579) old_dentry = fsi->bool_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 580) lock_rename(tmp_bool_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 581) d_exchange(tmp_bool_dir, fsi->bool_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 582)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 583) old_bool_num = fsi->bool_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 584) old_bool_names = fsi->bool_pending_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 585) old_bool_values = fsi->bool_pending_values;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 586)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 587) fsi->bool_num = tmp_bool_num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 588) fsi->bool_pending_names = tmp_bool_names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 589) fsi->bool_pending_values = tmp_bool_values;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 590)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 591) sel_remove_old_bool_data(old_bool_num, old_bool_names, old_bool_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 592)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 593) fsi->bool_dir = tmp_bool_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 594) unlock_rename(tmp_bool_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 595)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 596) /* classes */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 597) old_dentry = fsi->class_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 598) lock_rename(tmp_class_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 599) d_exchange(tmp_class_dir, fsi->class_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 600) fsi->class_dir = tmp_class_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 601) unlock_rename(tmp_class_dir, old_dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 602)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 603) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 604) /* Since the other temporary dirs are children of tmp_parent
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 605) * this will handle all the cleanup in the case of a failure before
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 606) * the swapover
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 607) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 608) sel_remove_entries(tmp_parent);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 609) dput(tmp_parent); /* d_genocide() only handles the children */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 610)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 611) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 612) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 613)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 614) static ssize_t sel_write_load(struct file *file, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 615) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 616)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 617) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 618) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 619) struct selinux_load_state load_state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 620) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 621) void *data = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 622)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 623) mutex_lock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 624)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 625) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 626) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 627) SECCLASS_SECURITY, SECURITY__LOAD_POLICY, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 628) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 629) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 630)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 631) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 632) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 633) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 634) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 635)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 636) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 637) data = vmalloc(count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 638) if (!data)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 639) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 640)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 641) length = -EFAULT;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 642) if (copy_from_user(data, buf, count) != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 643) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 644)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 645) length = security_load_policy(fsi->state, data, count, &load_state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 646) if (length) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 647) pr_warn_ratelimited("SELinux: failed to load policy\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 648) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 649) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 650)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 651) length = sel_make_policy_nodes(fsi, load_state.policy);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 652) if (length) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 653) selinux_policy_cancel(fsi->state, &load_state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 654) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 655) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 656)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 657) selinux_policy_commit(fsi->state, &load_state);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 658)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 659) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 660)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 661) audit_log(audit_context(), GFP_KERNEL, AUDIT_MAC_POLICY_LOAD,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 662) "auid=%u ses=%u lsm=selinux res=1",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 663) from_kuid(&init_user_ns, audit_get_loginuid(current)),
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 664) audit_get_sessionid(current));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 665) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 666) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 667) vfree(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 668) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 669) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 670)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 671) static const struct file_operations sel_load_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 672) .write = sel_write_load,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 673) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 674) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 675)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 676) static ssize_t sel_write_context(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 677) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 678) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 679) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 680) char *canon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 681) u32 sid, len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 682) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 683)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 684) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 685) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 686) SECCLASS_SECURITY, SECURITY__CHECK_CONTEXT, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 687) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 688) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 689)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 690) length = security_context_to_sid(state, buf, size, &sid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 691) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 692) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 693)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 694) length = security_sid_to_context(state, sid, &canon, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 695) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 696) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 697)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 698) length = -ERANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 699) if (len > SIMPLE_TRANSACTION_LIMIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 700) pr_err("SELinux: %s: context size (%u) exceeds "
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 701) "payload max\n", __func__, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 702) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 703) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 704)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 705) memcpy(buf, canon, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 706) length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 707) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 708) kfree(canon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 709) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 710) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 711)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 712) static ssize_t sel_read_checkreqprot(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 713) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 714) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 715) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 716) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 717) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 718)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 719) length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 720) checkreqprot_get(fsi->state));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 721) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 722) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 723)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 724) static ssize_t sel_write_checkreqprot(struct file *file, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 725) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 726) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 727) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 728) char *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 729) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 730) unsigned int new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 731)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 732) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 733) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 734) SECCLASS_SECURITY, SECURITY__SETCHECKREQPROT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 735) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 736) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 737) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 738)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 739) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 740) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 741)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 742) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 743) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 744) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 745)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 746) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 747) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 748) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 749)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 750) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 751) if (sscanf(page, "%u", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 752) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 753)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 754) if (new_value) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 755) char comm[sizeof(current->comm)];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 756)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 757) memcpy(comm, current->comm, sizeof(comm));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 758) pr_warn_once("SELinux: %s (%d) set checkreqprot to 1. This is deprecated and will be rejected in a future kernel release.\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 759) comm, current->pid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 760) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 761)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 762) checkreqprot_set(fsi->state, (new_value ? 1 : 0));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 763) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 764) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 765) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 766) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 767) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 768) static const struct file_operations sel_checkreqprot_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 769) .read = sel_read_checkreqprot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 770) .write = sel_write_checkreqprot,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 771) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 772) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 773)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 774) static ssize_t sel_write_validatetrans(struct file *file,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 775) const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 776) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 777) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 778) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 779) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 780) char *oldcon = NULL, *newcon = NULL, *taskcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 781) char *req = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 782) u32 osid, nsid, tsid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 783) u16 tclass;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 784) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 785)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 786) rc = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 787) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 788) SECCLASS_SECURITY, SECURITY__VALIDATE_TRANS, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 789) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 790) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 791)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 792) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 793) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 794) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 795)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 796) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 797) rc = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 798) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 799) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 800)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 801) req = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 802) if (IS_ERR(req)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 803) rc = PTR_ERR(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 804) req = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 805) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 806) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 807)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 808) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 809) oldcon = kzalloc(count + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 810) if (!oldcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 811) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 812)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 813) newcon = kzalloc(count + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 814) if (!newcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 815) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 816)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 817) taskcon = kzalloc(count + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 818) if (!taskcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 819) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 820)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 821) rc = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 822) if (sscanf(req, "%s %s %hu %s", oldcon, newcon, &tclass, taskcon) != 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 823) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 824)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 825) rc = security_context_str_to_sid(state, oldcon, &osid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 826) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 827) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 828)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 829) rc = security_context_str_to_sid(state, newcon, &nsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 830) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 831) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 832)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 833) rc = security_context_str_to_sid(state, taskcon, &tsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 834) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 835) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 836)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 837) rc = security_validate_transition_user(state, osid, nsid, tsid, tclass);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 838) if (!rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 839) rc = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 840) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 841) kfree(req);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 842) kfree(oldcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 843) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 844) kfree(taskcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 845) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 846) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 847)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 848) static const struct file_operations sel_transition_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 849) .write = sel_write_validatetrans,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 850) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 851) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 852)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 853) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 854) * Remaining nodes use transaction based IO methods like nfsd/nfsctl.c
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 855) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 856) static ssize_t sel_write_access(struct file *file, char *buf, size_t size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 857) static ssize_t sel_write_create(struct file *file, char *buf, size_t size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 858) static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 859) static ssize_t sel_write_user(struct file *file, char *buf, size_t size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 860) static ssize_t sel_write_member(struct file *file, char *buf, size_t size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 861)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 862) static ssize_t (*const write_op[])(struct file *, char *, size_t) = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 863) [SEL_ACCESS] = sel_write_access,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 864) [SEL_CREATE] = sel_write_create,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 865) [SEL_RELABEL] = sel_write_relabel,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 866) [SEL_USER] = sel_write_user,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 867) [SEL_MEMBER] = sel_write_member,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 868) [SEL_CONTEXT] = sel_write_context,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 869) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 870)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 871) static ssize_t selinux_transaction_write(struct file *file, const char __user *buf, size_t size, loff_t *pos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 872) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 873) ino_t ino = file_inode(file)->i_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 874) char *data;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 875) ssize_t rv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 876)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 877) if (ino >= ARRAY_SIZE(write_op) || !write_op[ino])
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 878) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 879)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 880) data = simple_transaction_get(file, buf, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 881) if (IS_ERR(data))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 882) return PTR_ERR(data);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 883)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 884) rv = write_op[ino](file, data, size);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 885) if (rv > 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 886) simple_transaction_set(file, rv);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 887) rv = size;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 888) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 889) return rv;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 890) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 891)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 892) static const struct file_operations transaction_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 893) .write = selinux_transaction_write,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 894) .read = simple_transaction_read,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 895) .release = simple_transaction_release,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 896) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 897) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 898)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 899) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 900) * payload - write methods
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 901) * If the method has a response, the response should be put in buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 902) * and the length returned. Otherwise return 0 or and -error.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 903) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 904)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 905) static ssize_t sel_write_access(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 906) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 907) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 908) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 909) char *scon = NULL, *tcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 910) u32 ssid, tsid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 911) u16 tclass;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 912) struct av_decision avd;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 913) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 914)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 915) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 916) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 917) SECCLASS_SECURITY, SECURITY__COMPUTE_AV, NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 918) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 919) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 920)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 921) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 922) scon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 923) if (!scon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 924) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 925)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 926) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 927) tcon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 928) if (!tcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 929) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 930)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 931) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 932) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 933) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 934)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 935) length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 936) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 937) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 938)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 939) length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 940) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 941) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 942)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 943) security_compute_av_user(state, ssid, tsid, tclass, &avd);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 944)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 945) length = scnprintf(buf, SIMPLE_TRANSACTION_LIMIT,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 946) "%x %x %x %x %u %x",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 947) avd.allowed, 0xffffffff,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 948) avd.auditallow, avd.auditdeny,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 949) avd.seqno, avd.flags);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 950) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 951) kfree(tcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 952) kfree(scon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 953) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 954) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 955)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 956) static ssize_t sel_write_create(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 957) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 958) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 959) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 960) char *scon = NULL, *tcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 961) char *namebuf = NULL, *objname = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 962) u32 ssid, tsid, newsid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 963) u16 tclass;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 964) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 965) char *newcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 966) u32 len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 967) int nargs;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 968)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 969) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 970) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 971) SECCLASS_SECURITY, SECURITY__COMPUTE_CREATE,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 972) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 973) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 974) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 975)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 976) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 977) scon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 978) if (!scon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 979) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 980)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 981) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 982) tcon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 983) if (!tcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 984) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 985)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 986) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 987) namebuf = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 988) if (!namebuf)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 989) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 990)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 991) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 992) nargs = sscanf(buf, "%s %s %hu %s", scon, tcon, &tclass, namebuf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 993) if (nargs < 3 || nargs > 4)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 994) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 995) if (nargs == 4) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 996) /*
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 997) * If and when the name of new object to be queried contains
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 998) * either whitespace or multibyte characters, they shall be
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 999) * encoded based on the percentage-encoding rule.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1000) * If not encoded, the sscanf logic picks up only left-half
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1001) * of the supplied name; splitted by a whitespace unexpectedly.
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1002) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1003) char *r, *w;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1004) int c1, c2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1005)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1006) r = w = namebuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1007) do {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1008) c1 = *r++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1009) if (c1 == '+')
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1010) c1 = ' ';
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1011) else if (c1 == '%') {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1012) c1 = hex_to_bin(*r++);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1013) if (c1 < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1014) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1015) c2 = hex_to_bin(*r++);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1016) if (c2 < 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1017) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1018) c1 = (c1 << 4) | c2;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1019) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1020) *w++ = c1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1021) } while (c1 != '\0');
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1022)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1023) objname = namebuf;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1024) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1025)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1026) length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1027) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1028) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1029)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1030) length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1031) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1032) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1033)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1034) length = security_transition_sid_user(state, ssid, tsid, tclass,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1035) objname, &newsid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1036) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1037) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1038)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1039) length = security_sid_to_context(state, newsid, &newcon, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1040) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1041) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1042)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1043) length = -ERANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1044) if (len > SIMPLE_TRANSACTION_LIMIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1045) pr_err("SELinux: %s: context size (%u) exceeds "
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1046) "payload max\n", __func__, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1047) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1048) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1049)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1050) memcpy(buf, newcon, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1051) length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1052) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1053) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1054) kfree(namebuf);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1055) kfree(tcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1056) kfree(scon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1057) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1058) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1059)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1060) static ssize_t sel_write_relabel(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1061) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1062) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1063) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1064) char *scon = NULL, *tcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1065) u32 ssid, tsid, newsid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1066) u16 tclass;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1067) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1068) char *newcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1069) u32 len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1070)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1071) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1072) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1073) SECCLASS_SECURITY, SECURITY__COMPUTE_RELABEL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1074) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1075) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1076) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1077)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1078) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1079) scon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1080) if (!scon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1081) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1082)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1083) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1084) tcon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1085) if (!tcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1086) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1087)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1088) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1089) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1090) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1091)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1092) length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1093) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1094) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1095)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1096) length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1097) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1098) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1099)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1100) length = security_change_sid(state, ssid, tsid, tclass, &newsid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1101) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1102) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1104) length = security_sid_to_context(state, newsid, &newcon, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1105) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1106) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1107)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1108) length = -ERANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1109) if (len > SIMPLE_TRANSACTION_LIMIT)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1110) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1111)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1112) memcpy(buf, newcon, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1113) length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1114) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1115) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1116) kfree(tcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1117) kfree(scon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1118) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1119) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1120)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1121) static ssize_t sel_write_user(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1122) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1123) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1124) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1125) char *con = NULL, *user = NULL, *ptr;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1126) u32 sid, *sids = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1127) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1128) char *newcon;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1129) int i, rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1130) u32 len, nsids;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1131)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1132) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1133) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1134) SECCLASS_SECURITY, SECURITY__COMPUTE_USER,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1135) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1136) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1137) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1138)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1139) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1140) con = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1141) if (!con)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1142) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1143)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1144) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1145) user = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1146) if (!user)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1147) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1148)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1149) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1150) if (sscanf(buf, "%s %s", con, user) != 2)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1151) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1152)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1153) length = security_context_str_to_sid(state, con, &sid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1154) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1155) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1157) length = security_get_user_sids(state, sid, user, &sids, &nsids);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1158) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1159) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1160)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1161) length = sprintf(buf, "%u", nsids) + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1162) ptr = buf + length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1163) for (i = 0; i < nsids; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1164) rc = security_sid_to_context(state, sids[i], &newcon, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1165) if (rc) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1166) length = rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1167) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1168) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1169) if ((length + len) >= SIMPLE_TRANSACTION_LIMIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1170) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1171) length = -ERANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1172) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1173) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1174) memcpy(ptr, newcon, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1175) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1176) ptr += len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1177) length += len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1178) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1179) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1180) kfree(sids);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1181) kfree(user);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1182) kfree(con);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1183) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1186) static ssize_t sel_write_member(struct file *file, char *buf, size_t size)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1187) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1188) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1189) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1190) char *scon = NULL, *tcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1191) u32 ssid, tsid, newsid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1192) u16 tclass;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1193) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1194) char *newcon = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1195) u32 len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1196)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1197) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1198) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1199) SECCLASS_SECURITY, SECURITY__COMPUTE_MEMBER,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1200) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1201) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1202) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1203)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1204) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1205) scon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1206) if (!scon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1207) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1208)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1209) length = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1210) tcon = kzalloc(size + 1, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1211) if (!tcon)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1212) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1213)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1214) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1215) if (sscanf(buf, "%s %s %hu", scon, tcon, &tclass) != 3)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1216) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1217)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1218) length = security_context_str_to_sid(state, scon, &ssid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1219) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1220) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1221)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1222) length = security_context_str_to_sid(state, tcon, &tsid, GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1223) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1224) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1225)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1226) length = security_member_sid(state, ssid, tsid, tclass, &newsid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1227) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1228) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1229)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1230) length = security_sid_to_context(state, newsid, &newcon, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1231) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1232) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1233)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1234) length = -ERANGE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1235) if (len > SIMPLE_TRANSACTION_LIMIT) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1236) pr_err("SELinux: %s: context size (%u) exceeds "
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1237) "payload max\n", __func__, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1238) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1239) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1240)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1241) memcpy(buf, newcon, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1242) length = len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1243) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1244) kfree(newcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1245) kfree(tcon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1246) kfree(scon);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1247) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1248) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1249)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1250) static struct inode *sel_make_inode(struct super_block *sb, int mode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1251) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1252) struct inode *ret = new_inode(sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1253)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1254) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1255) ret->i_mode = mode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1256) ret->i_atime = ret->i_mtime = ret->i_ctime = current_time(ret);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1257) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1258) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1259) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1260)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1261) static ssize_t sel_read_bool(struct file *filep, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1262) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1263) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1264) struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1265) char *page = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1266) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1267) ssize_t ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1268) int cur_enforcing;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1269) unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1270) const char *name = filep->f_path.dentry->d_name.name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1271)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1272) mutex_lock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1273)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1274) ret = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1275) if (index >= fsi->bool_num || strcmp(name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1276) fsi->bool_pending_names[index]))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1277) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1278)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1279) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1280) page = (char *)get_zeroed_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1281) if (!page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1282) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1283)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1284) cur_enforcing = security_get_bool_value(fsi->state, index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1285) if (cur_enforcing < 0) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1286) ret = cur_enforcing;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1287) goto out_unlock;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1288) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1289) length = scnprintf(page, PAGE_SIZE, "%d %d", cur_enforcing,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1290) fsi->bool_pending_values[index]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1291) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1292) ret = simple_read_from_buffer(buf, count, ppos, page, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1293) out_free:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1294) free_page((unsigned long)page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1295) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1296)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1297) out_unlock:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1298) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1299) goto out_free;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1300) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1301)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1302) static ssize_t sel_write_bool(struct file *filep, const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1303) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1304) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1305) struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1306) char *page = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1307) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1308) int new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1309) unsigned index = file_inode(filep)->i_ino & SEL_INO_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1310) const char *name = filep->f_path.dentry->d_name.name;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1311)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1312) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1313) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1314)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1315) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1316) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1317) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1318)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1319) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1320) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1321) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1322)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1323) mutex_lock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1324)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1325) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1326) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1327) SECCLASS_SECURITY, SECURITY__SETBOOL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1328) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1329) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1330) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1331)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1332) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1333) if (index >= fsi->bool_num || strcmp(name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1334) fsi->bool_pending_names[index]))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1335) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1336)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1337) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1338) if (sscanf(page, "%d", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1339) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1340)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1341) if (new_value)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1342) new_value = 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1343)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1344) fsi->bool_pending_values[index] = new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1345) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1346)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1347) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1348) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1349) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1350) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1351) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1352)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1353) static const struct file_operations sel_bool_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1354) .read = sel_read_bool,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1355) .write = sel_write_bool,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1356) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1357) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1358)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1359) static ssize_t sel_commit_bools_write(struct file *filep,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1360) const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1361) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1362) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1363) struct selinux_fs_info *fsi = file_inode(filep)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1364) char *page = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1365) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1366) int new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1367)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1368) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1369) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1370)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1371) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1372) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1373) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1374)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1375) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1376) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1377) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1378)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1379) mutex_lock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1380)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1381) length = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1382) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1383) SECCLASS_SECURITY, SECURITY__SETBOOL,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1384) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1385) if (length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1386) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1387)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1388) length = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1389) if (sscanf(page, "%d", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1390) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1391)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1392) length = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1393) if (new_value && fsi->bool_pending_values)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1394) length = security_set_bools(fsi->state, fsi->bool_num,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1395) fsi->bool_pending_values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1396)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1397) if (!length)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1398) length = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1399)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1400) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1401) mutex_unlock(&fsi->state->policy_mutex);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1402) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1403) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1404) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1405)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1406) static const struct file_operations sel_commit_bools_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1407) .write = sel_commit_bools_write,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1408) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1409) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1410)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1411) static void sel_remove_entries(struct dentry *de)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1412) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1413) d_genocide(de);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1414) shrink_dcache_parent(de);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1415) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1416)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1417) static int sel_make_bools(struct selinux_policy *newpolicy, struct dentry *bool_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1418) unsigned int *bool_num, char ***bool_pending_names,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1419) unsigned int **bool_pending_values)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1420) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1421) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1422) ssize_t len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1423) struct dentry *dentry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1424) struct inode *inode = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1425) struct inode_security_struct *isec;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1426) char **names = NULL, *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1427) u32 i, num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1428) int *values = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1429) u32 sid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1430)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1431) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1432) page = (char *)get_zeroed_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1433) if (!page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1434) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1435)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1436) ret = security_get_bools(newpolicy, &num, &names, &values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1437) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1438) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1439)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1440) for (i = 0; i < num; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1441) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1442) dentry = d_alloc_name(bool_dir, names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1443) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1444) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1445)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1446) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1447) inode = sel_make_inode(bool_dir->d_sb, S_IFREG | S_IRUGO | S_IWUSR);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1448) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1449) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1450) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1451) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1452)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1453) ret = -ENAMETOOLONG;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1454) len = snprintf(page, PAGE_SIZE, "/%s/%s", BOOL_DIR_NAME, names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1455) if (len >= PAGE_SIZE) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1456) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1457) iput(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1458) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1459) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1460)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1461) isec = selinux_inode(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1462) ret = selinux_policy_genfs_sid(newpolicy, "selinuxfs", page,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1463) SECCLASS_FILE, &sid);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1464) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1465) pr_warn_ratelimited("SELinux: no sid found, defaulting to security isid for %s\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1466) page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1467) sid = SECINITSID_SECURITY;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1468) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1469)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1470) isec->sid = sid;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1471) isec->initialized = LABEL_INITIALIZED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1472) inode->i_fop = &sel_bool_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1473) inode->i_ino = i|SEL_BOOL_INO_OFFSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1474) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1475) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1476) *bool_num = num;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1477) *bool_pending_names = names;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1478) *bool_pending_values = values;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1479)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1480) free_page((unsigned long)page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1481) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1482) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1483) free_page((unsigned long)page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1484)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1485) if (names) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1486) for (i = 0; i < num; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1487) kfree(names[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1488) kfree(names);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1489) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1490) kfree(values);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1491) sel_remove_entries(bool_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1492)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1493) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1494) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1495)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1496) static ssize_t sel_read_avc_cache_threshold(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1497) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1498) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1499) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1500) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1501) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1502) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1503)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1504) length = scnprintf(tmpbuf, TMPBUFLEN, "%u",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1505) avc_get_cache_threshold(state->avc));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1506) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1507) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1508)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1509) static ssize_t sel_write_avc_cache_threshold(struct file *file,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1510) const char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1511) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1512)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1513) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1514) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1515) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1516) char *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1517) ssize_t ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1518) unsigned int new_value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1519)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1520) ret = avc_has_perm(&selinux_state,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1521) current_sid(), SECINITSID_SECURITY,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1522) SECCLASS_SECURITY, SECURITY__SETSECPARAM,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1523) NULL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1524) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1525) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1526)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1527) if (count >= PAGE_SIZE)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1528) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1529)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1530) /* No partial writes. */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1531) if (*ppos != 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1532) return -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1533)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1534) page = memdup_user_nul(buf, count);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1535) if (IS_ERR(page))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1536) return PTR_ERR(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1537)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1538) ret = -EINVAL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1539) if (sscanf(page, "%u", &new_value) != 1)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1540) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1541)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1542) avc_set_cache_threshold(state->avc, new_value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1543)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1544) ret = count;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1545) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1546) kfree(page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1547) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1548) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1549)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1550) static ssize_t sel_read_avc_hash_stats(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1551) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1552) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1553) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1554) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1555) char *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1556) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1557)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1558) page = (char *)__get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1559) if (!page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1560) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1561)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1562) length = avc_get_hash_stats(state->avc, page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1563) if (length >= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1564) length = simple_read_from_buffer(buf, count, ppos, page, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1565) free_page((unsigned long)page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1566)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1567) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1568) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1569)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1570) static ssize_t sel_read_sidtab_hash_stats(struct file *filp, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1571) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1572) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1573) struct selinux_fs_info *fsi = file_inode(filp)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1574) struct selinux_state *state = fsi->state;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1575) char *page;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1576) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1577)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1578) page = (char *)__get_free_page(GFP_KERNEL);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1579) if (!page)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1580) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1581)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1582) length = security_sidtab_hash_stats(state, page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1583) if (length >= 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1584) length = simple_read_from_buffer(buf, count, ppos, page,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1585) length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1586) free_page((unsigned long)page);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1587)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1588) return length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1589) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1590)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1591) static const struct file_operations sel_sidtab_hash_stats_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1592) .read = sel_read_sidtab_hash_stats,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1593) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1594) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1595)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1596) static const struct file_operations sel_avc_cache_threshold_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1597) .read = sel_read_avc_cache_threshold,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1598) .write = sel_write_avc_cache_threshold,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1599) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1600) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1601)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1602) static const struct file_operations sel_avc_hash_stats_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1603) .read = sel_read_avc_hash_stats,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1604) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1605) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1606)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1607) #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1608) static struct avc_cache_stats *sel_avc_get_stat_idx(loff_t *idx)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1609) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1610) int cpu;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1611)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1612) for (cpu = *idx; cpu < nr_cpu_ids; ++cpu) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1613) if (!cpu_possible(cpu))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1614) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1615) *idx = cpu + 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1616) return &per_cpu(avc_cache_stats, cpu);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1617) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1618) (*idx)++;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1619) return NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1620) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1621)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1622) static void *sel_avc_stats_seq_start(struct seq_file *seq, loff_t *pos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1623) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1624) loff_t n = *pos - 1;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1625)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1626) if (*pos == 0)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1627) return SEQ_START_TOKEN;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1628)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1629) return sel_avc_get_stat_idx(&n);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1630) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1631)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1632) static void *sel_avc_stats_seq_next(struct seq_file *seq, void *v, loff_t *pos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1633) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1634) return sel_avc_get_stat_idx(pos);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1635) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1636)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1637) static int sel_avc_stats_seq_show(struct seq_file *seq, void *v)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1638) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1639) struct avc_cache_stats *st = v;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1640)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1641) if (v == SEQ_START_TOKEN) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1642) seq_puts(seq,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1643) "lookups hits misses allocations reclaims frees\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1644) } else {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1645) unsigned int lookups = st->lookups;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1646) unsigned int misses = st->misses;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1647) unsigned int hits = lookups - misses;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1648) seq_printf(seq, "%u %u %u %u %u %u\n", lookups,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1649) hits, misses, st->allocations,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1650) st->reclaims, st->frees);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1651) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1652) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1653) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1654)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1655) static void sel_avc_stats_seq_stop(struct seq_file *seq, void *v)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1656) { }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1657)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1658) static const struct seq_operations sel_avc_cache_stats_seq_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1659) .start = sel_avc_stats_seq_start,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1660) .next = sel_avc_stats_seq_next,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1661) .show = sel_avc_stats_seq_show,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1662) .stop = sel_avc_stats_seq_stop,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1663) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1664)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1665) static int sel_open_avc_cache_stats(struct inode *inode, struct file *file)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1666) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1667) return seq_open(file, &sel_avc_cache_stats_seq_ops);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1668) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1669)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1670) static const struct file_operations sel_avc_cache_stats_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1671) .open = sel_open_avc_cache_stats,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1672) .read = seq_read,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1673) .llseek = seq_lseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1674) .release = seq_release,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1675) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1676) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1677)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1678) static int sel_make_avc_files(struct dentry *dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1679) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1680) struct super_block *sb = dir->d_sb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1681) struct selinux_fs_info *fsi = sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1682) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1683) static const struct tree_descr files[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1684) { "cache_threshold",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1685) &sel_avc_cache_threshold_ops, S_IRUGO|S_IWUSR },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1686) { "hash_stats", &sel_avc_hash_stats_ops, S_IRUGO },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1687) #ifdef CONFIG_SECURITY_SELINUX_AVC_STATS
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1688) { "cache_stats", &sel_avc_cache_stats_ops, S_IRUGO },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1689) #endif
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1690) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1691)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1692) for (i = 0; i < ARRAY_SIZE(files); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1693) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1694) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1695)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1696) dentry = d_alloc_name(dir, files[i].name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1697) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1698) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1699)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1700) inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1701) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1702) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1703) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1704) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1705)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1706) inode->i_fop = files[i].ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1707) inode->i_ino = ++fsi->last_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1708) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1709) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1710)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1711) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1712) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1713)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1714) static int sel_make_ss_files(struct dentry *dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1715) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1716) struct super_block *sb = dir->d_sb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1717) struct selinux_fs_info *fsi = sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1718) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1719) static struct tree_descr files[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1720) { "sidtab_hash_stats", &sel_sidtab_hash_stats_ops, S_IRUGO },
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1721) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1722)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1723) for (i = 0; i < ARRAY_SIZE(files); i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1724) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1725) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1726)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1727) dentry = d_alloc_name(dir, files[i].name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1728) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1729) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1730)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1731) inode = sel_make_inode(dir->d_sb, S_IFREG|files[i].mode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1732) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1733) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1734) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1735) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1736)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1737) inode->i_fop = files[i].ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1738) inode->i_ino = ++fsi->last_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1739) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1740) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1741)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1742) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1743) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1744)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1745) static ssize_t sel_read_initcon(struct file *file, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1746) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1747) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1748) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1749) char *con;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1750) u32 sid, len;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1751) ssize_t ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1752)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1753) sid = file_inode(file)->i_ino&SEL_INO_MASK;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1754) ret = security_sid_to_context(fsi->state, sid, &con, &len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1755) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1756) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1757)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1758) ret = simple_read_from_buffer(buf, count, ppos, con, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1759) kfree(con);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1760) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1761) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1762)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1763) static const struct file_operations sel_initcon_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1764) .read = sel_read_initcon,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1765) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1766) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1767)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1768) static int sel_make_initcon_files(struct dentry *dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1769) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1770) int i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1771)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1772) for (i = 1; i <= SECINITSID_NUM; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1773) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1774) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1775) const char *s = security_get_initial_sid_context(i);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1776)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1777) if (!s)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1778) continue;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1779) dentry = d_alloc_name(dir, s);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1780) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1781) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1782)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1783) inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1784) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1785) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1786) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1787) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1788)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1789) inode->i_fop = &sel_initcon_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1790) inode->i_ino = i|SEL_INITCON_INO_OFFSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1791) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1792) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1793)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1794) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1795) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1796)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1797) static inline unsigned long sel_class_to_ino(u16 class)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1798) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1799) return (class * (SEL_VEC_MAX + 1)) | SEL_CLASS_INO_OFFSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1800) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1801)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1802) static inline u16 sel_ino_to_class(unsigned long ino)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1803) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1804) return (ino & SEL_INO_MASK) / (SEL_VEC_MAX + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1805) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1806)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1807) static inline unsigned long sel_perm_to_ino(u16 class, u32 perm)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1808) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1809) return (class * (SEL_VEC_MAX + 1) + perm) | SEL_CLASS_INO_OFFSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1810) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1811)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1812) static inline u32 sel_ino_to_perm(unsigned long ino)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1813) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1814) return (ino & SEL_INO_MASK) % (SEL_VEC_MAX + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1815) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1816)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1817) static ssize_t sel_read_class(struct file *file, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1818) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1819) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1820) unsigned long ino = file_inode(file)->i_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1821) char res[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1822) ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_class(ino));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1823) return simple_read_from_buffer(buf, count, ppos, res, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1824) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1825)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1826) static const struct file_operations sel_class_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1827) .read = sel_read_class,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1828) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1829) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1830)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1831) static ssize_t sel_read_perm(struct file *file, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1832) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1833) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1834) unsigned long ino = file_inode(file)->i_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1835) char res[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1836) ssize_t len = scnprintf(res, sizeof(res), "%d", sel_ino_to_perm(ino));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1837) return simple_read_from_buffer(buf, count, ppos, res, len);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1838) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1839)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1840) static const struct file_operations sel_perm_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1841) .read = sel_read_perm,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1842) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1843) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1844)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1845) static ssize_t sel_read_policycap(struct file *file, char __user *buf,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1846) size_t count, loff_t *ppos)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1847) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1848) struct selinux_fs_info *fsi = file_inode(file)->i_sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1849) int value;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1850) char tmpbuf[TMPBUFLEN];
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1851) ssize_t length;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1852) unsigned long i_ino = file_inode(file)->i_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1853)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1854) value = security_policycap_supported(fsi->state, i_ino & SEL_INO_MASK);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1855) length = scnprintf(tmpbuf, TMPBUFLEN, "%d", value);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1856)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1857) return simple_read_from_buffer(buf, count, ppos, tmpbuf, length);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1858) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1859)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1860) static const struct file_operations sel_policycap_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1861) .read = sel_read_policycap,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1862) .llseek = generic_file_llseek,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1863) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1864)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1865) static int sel_make_perm_files(struct selinux_policy *newpolicy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1866) char *objclass, int classvalue,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1867) struct dentry *dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1868) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1869) int i, rc, nperms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1870) char **perms;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1871)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1872) rc = security_get_permissions(newpolicy, objclass, &perms, &nperms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1873) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1874) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1875)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1876) for (i = 0; i < nperms; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1877) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1878) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1879)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1880) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1881) dentry = d_alloc_name(dir, perms[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1882) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1883) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1884)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1885) rc = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1886) inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1887) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1888) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1889) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1890) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1891)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1892) inode->i_fop = &sel_perm_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1893) /* i+1 since perm values are 1-indexed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1894) inode->i_ino = sel_perm_to_ino(classvalue, i + 1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1895) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1896) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1897) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1898) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1899) for (i = 0; i < nperms; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1900) kfree(perms[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1901) kfree(perms);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1902) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1903) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1904)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1905) static int sel_make_class_dir_entries(struct selinux_policy *newpolicy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1906) char *classname, int index,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1907) struct dentry *dir)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1908) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1909) struct super_block *sb = dir->d_sb;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1910) struct selinux_fs_info *fsi = sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1911) struct dentry *dentry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1912) struct inode *inode = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1913) int rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1914)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1915) dentry = d_alloc_name(dir, "index");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1916) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1917) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1918)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1919) inode = sel_make_inode(dir->d_sb, S_IFREG|S_IRUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1920) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1921) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1922) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1923) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1924)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1925) inode->i_fop = &sel_class_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1926) inode->i_ino = sel_class_to_ino(index);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1927) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1928)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1929) dentry = sel_make_dir(dir, "perms", &fsi->last_class_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1930) if (IS_ERR(dentry))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1931) return PTR_ERR(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1932)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1933) rc = sel_make_perm_files(newpolicy, classname, index, dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1934)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1935) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1936) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1937)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1938) static int sel_make_classes(struct selinux_policy *newpolicy,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1939) struct dentry *class_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1940) unsigned long *last_class_ino)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1941) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1942)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1943) int rc, nclasses, i;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1944) char **classes;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1945)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1946) rc = security_get_classes(newpolicy, &classes, &nclasses);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1947) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1948) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1949)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1950) /* +2 since classes are 1-indexed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1951) *last_class_ino = sel_class_to_ino(nclasses + 2);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1952)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1953) for (i = 0; i < nclasses; i++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1954) struct dentry *class_name_dir;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1955)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1956) class_name_dir = sel_make_dir(class_dir, classes[i],
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1957) last_class_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1958) if (IS_ERR(class_name_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1959) rc = PTR_ERR(class_name_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1960) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1961) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1962)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1963) /* i+1 since class values are 1-indexed */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1964) rc = sel_make_class_dir_entries(newpolicy, classes[i], i + 1,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1965) class_name_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1966) if (rc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1967) goto out;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1968) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1969) rc = 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1970) out:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1971) for (i = 0; i < nclasses; i++)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1972) kfree(classes[i]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1973) kfree(classes);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1974) return rc;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1975) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1976)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1977) static int sel_make_policycap(struct selinux_fs_info *fsi)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1978) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1979) unsigned int iter;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1980) struct dentry *dentry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1981) struct inode *inode = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1982)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1983) for (iter = 0; iter <= POLICYDB_CAPABILITY_MAX; iter++) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1984) if (iter < ARRAY_SIZE(selinux_policycap_names))
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1985) dentry = d_alloc_name(fsi->policycap_dir,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1986) selinux_policycap_names[iter]);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1987) else
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1988) dentry = d_alloc_name(fsi->policycap_dir, "unknown");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1989)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1990) if (dentry == NULL)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1991) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1992)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1993) inode = sel_make_inode(fsi->sb, S_IFREG | 0444);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1994) if (inode == NULL) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1995) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1996) return -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1997) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1998)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 1999) inode->i_fop = &sel_policycap_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2000) inode->i_ino = iter | SEL_POLICYCAP_INO_OFFSET;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2001) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2002) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2003)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2004) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2005) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2006)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2007) static struct dentry *sel_make_dir(struct dentry *dir, const char *name,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2008) unsigned long *ino)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2009) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2010) struct dentry *dentry = d_alloc_name(dir, name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2011) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2012)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2013) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2014) return ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2015)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2016) inode = sel_make_inode(dir->d_sb, S_IFDIR | S_IRUGO | S_IXUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2017) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2018) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2019) return ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2020) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2021)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2022) inode->i_op = &simple_dir_inode_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2023) inode->i_fop = &simple_dir_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2024) inode->i_ino = ++(*ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2025) /* directory inodes start off with i_nlink == 2 (for "." entry) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2026) inc_nlink(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2027) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2028) /* bump link count on parent directory, too */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2029) inc_nlink(d_inode(dir));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2030)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2031) return dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2032) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2033)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2034) static struct dentry *sel_make_disconnected_dir(struct super_block *sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2035) unsigned long *ino)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2036) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2037) struct inode *inode = sel_make_inode(sb, S_IFDIR | S_IRUGO | S_IXUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2038)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2039) if (!inode)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2040) return ERR_PTR(-ENOMEM);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2041)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2042) inode->i_op = &simple_dir_inode_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2043) inode->i_fop = &simple_dir_operations;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2044) inode->i_ino = ++(*ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2045) /* directory inodes start off with i_nlink == 2 (for "." entry) */
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2046) inc_nlink(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2047) return d_obtain_alias(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2048) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2049)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2050) #define NULL_FILE_NAME "null"
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2051)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2052) static int sel_fill_super(struct super_block *sb, struct fs_context *fc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2053) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2054) struct selinux_fs_info *fsi;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2055) int ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2056) struct dentry *dentry;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2057) struct inode *inode;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2058) struct inode_security_struct *isec;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2059)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2060) static const struct tree_descr selinux_files[] = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2061) [SEL_LOAD] = {"load", &sel_load_ops, S_IRUSR|S_IWUSR},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2062) [SEL_ENFORCE] = {"enforce", &sel_enforce_ops, S_IRUGO|S_IWUSR},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2063) [SEL_CONTEXT] = {"context", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2064) [SEL_ACCESS] = {"access", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2065) [SEL_CREATE] = {"create", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2066) [SEL_RELABEL] = {"relabel", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2067) [SEL_USER] = {"user", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2068) [SEL_POLICYVERS] = {"policyvers", &sel_policyvers_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2069) [SEL_COMMIT_BOOLS] = {"commit_pending_bools", &sel_commit_bools_ops, S_IWUSR},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2070) [SEL_MLS] = {"mls", &sel_mls_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2071) [SEL_DISABLE] = {"disable", &sel_disable_ops, S_IWUSR},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2072) [SEL_MEMBER] = {"member", &transaction_ops, S_IRUGO|S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2073) [SEL_CHECKREQPROT] = {"checkreqprot", &sel_checkreqprot_ops, S_IRUGO|S_IWUSR},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2074) [SEL_REJECT_UNKNOWN] = {"reject_unknown", &sel_handle_unknown_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2075) [SEL_DENY_UNKNOWN] = {"deny_unknown", &sel_handle_unknown_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2076) [SEL_STATUS] = {"status", &sel_handle_status_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2077) [SEL_POLICY] = {"policy", &sel_policy_ops, S_IRUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2078) [SEL_VALIDATE_TRANS] = {"validatetrans", &sel_transition_ops,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2079) S_IWUGO},
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2080) /* last one */ {""}
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2081) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2082)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2083) ret = selinux_fs_info_create(sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2084) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2085) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2086)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2087) ret = simple_fill_super(sb, SELINUX_MAGIC, selinux_files);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2088) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2089) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2090)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2091) fsi = sb->s_fs_info;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2092) fsi->bool_dir = sel_make_dir(sb->s_root, BOOL_DIR_NAME, &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2093) if (IS_ERR(fsi->bool_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2094) ret = PTR_ERR(fsi->bool_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2095) fsi->bool_dir = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2096) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2097) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2098)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2099) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2100) dentry = d_alloc_name(sb->s_root, NULL_FILE_NAME);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2101) if (!dentry)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2102) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2103)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2104) ret = -ENOMEM;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2105) inode = sel_make_inode(sb, S_IFCHR | S_IRUGO | S_IWUGO);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2106) if (!inode) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2107) dput(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2108) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2109) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2110)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2111) inode->i_ino = ++fsi->last_ino;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2112) isec = selinux_inode(inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2113) isec->sid = SECINITSID_DEVNULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2114) isec->sclass = SECCLASS_CHR_FILE;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2115) isec->initialized = LABEL_INITIALIZED;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2116)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2117) init_special_inode(inode, S_IFCHR | S_IRUGO | S_IWUGO, MKDEV(MEM_MAJOR, 3));
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2118) d_add(dentry, inode);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2119)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2120) dentry = sel_make_dir(sb->s_root, "avc", &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2121) if (IS_ERR(dentry)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2122) ret = PTR_ERR(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2123) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2124) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2125)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2126) ret = sel_make_avc_files(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2127) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2128) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2129)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2130) dentry = sel_make_dir(sb->s_root, "ss", &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2131) if (IS_ERR(dentry)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2132) ret = PTR_ERR(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2133) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2134) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2135)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2136) ret = sel_make_ss_files(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2137) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2138) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2139)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2140) dentry = sel_make_dir(sb->s_root, "initial_contexts", &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2141) if (IS_ERR(dentry)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2142) ret = PTR_ERR(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2143) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2144) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2145)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2146) ret = sel_make_initcon_files(dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2147) if (ret)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2148) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2149)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2150) fsi->class_dir = sel_make_dir(sb->s_root, CLASS_DIR_NAME, &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2151) if (IS_ERR(fsi->class_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2152) ret = PTR_ERR(fsi->class_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2153) fsi->class_dir = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2154) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2155) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2156)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2157) fsi->policycap_dir = sel_make_dir(sb->s_root, POLICYCAP_DIR_NAME,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2158) &fsi->last_ino);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2159) if (IS_ERR(fsi->policycap_dir)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2160) ret = PTR_ERR(fsi->policycap_dir);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2161) fsi->policycap_dir = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2162) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2163) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2164)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2165) ret = sel_make_policycap(fsi);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2166) if (ret) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2167) pr_err("SELinux: failed to load policy capabilities\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2168) goto err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2169) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2170)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2171) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2172) err:
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2173) pr_err("SELinux: %s: failed while creating inodes\n",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2174) __func__);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2175)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2176) selinux_fs_info_free(sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2177)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2178) return ret;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2179) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2180)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2181) static int sel_get_tree(struct fs_context *fc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2182) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2183) return get_tree_single(fc, sel_fill_super);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2184) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2185)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2186) static const struct fs_context_operations sel_context_ops = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2187) .get_tree = sel_get_tree,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2188) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2189)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2190) static int sel_init_fs_context(struct fs_context *fc)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2191) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2192) fc->ops = &sel_context_ops;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2193) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2194) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2195)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2196) static void sel_kill_sb(struct super_block *sb)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2197) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2198) selinux_fs_info_free(sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2199) kill_litter_super(sb);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2200) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2201)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2202) static struct file_system_type sel_fs_type = {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2203) .name = "selinuxfs",
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2204) .init_fs_context = sel_init_fs_context,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2205) .kill_sb = sel_kill_sb,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2206) };
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2207)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2208) struct vfsmount *selinuxfs_mount;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2209) struct path selinux_null;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2210)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2211) static int __init init_sel_fs(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2212) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2213) struct qstr null_name = QSTR_INIT(NULL_FILE_NAME,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2214) sizeof(NULL_FILE_NAME)-1);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2215) int err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2216)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2217) if (!selinux_enabled_boot)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2218) return 0;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2219)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2220) err = sysfs_create_mount_point(fs_kobj, "selinux");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2221) if (err)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2222) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2223)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2224) err = register_filesystem(&sel_fs_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2225) if (err) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2226) sysfs_remove_mount_point(fs_kobj, "selinux");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2227) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2228) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2229)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2230) selinux_null.mnt = selinuxfs_mount = kern_mount(&sel_fs_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2231) if (IS_ERR(selinuxfs_mount)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2232) pr_err("selinuxfs: could not mount!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2233) err = PTR_ERR(selinuxfs_mount);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2234) selinuxfs_mount = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2235) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2236) selinux_null.dentry = d_hash_and_lookup(selinux_null.mnt->mnt_root,
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2237) &null_name);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2238) if (IS_ERR(selinux_null.dentry)) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2239) pr_err("selinuxfs: could not lookup null!\n");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2240) err = PTR_ERR(selinux_null.dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2241) selinux_null.dentry = NULL;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2242) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2243)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2244) return err;
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2245) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2246)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2247) __initcall(init_sel_fs);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2248)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2249) #ifdef CONFIG_SECURITY_SELINUX_DISABLE
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2250) void exit_sel_fs(void)
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2251) {
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2252) sysfs_remove_mount_point(fs_kobj, "selinux");
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2253) dput(selinux_null.dentry);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2254) kern_unmount(selinuxfs_mount);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2255) unregister_filesystem(&sel_fs_type);
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2256) }
^8f3ce5b39 (kx 2023-10-28 12:00:06 +0300 2257) #endif
Orange Pi5 kernel
Deprecated Linux kernel 5.10.110 for OrangePi 5/5B/5+ boards
3 Commits
0 Branches
0 Tags