security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul.moore@hp.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kernel.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched.h>
  31 #include <linux/security.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/swap.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/syscalls.h>
  42 #include <linux/file.h>
  43 #include <linux/fdtable.h>
  44 #include <linux/namei.h>
  45 #include <linux/mount.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <linux/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78 #include <linux/posix-timers.h>
  79
  80 #include "avc.h"
  81 #include "objsec.h"
  82 #include "netif.h"
  83 #include "netnode.h"
  84 #include "netport.h"
  85 #include "xfrm.h"
  86 #include "netlabel.h"
  87 #include "audit.h"
  88
  89 #define XATTR_SELINUX_SUFFIX "selinux"
  90 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  91
  92 #define NUM_SEL_MNT_OPTS 5
  93
  94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  95 extern struct security_operations *security_ops;
  96
  97 /* SECMARK reference count */
  98 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!strict_strtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!strict_strtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128
 129 /*
 130  * Minimal support for a secondary security module,
 131  * just to allow the use of the capability module.
 132  */
 133 static struct security_operations *secondary_ops;
 134
 135 /* Lists of inode and superblock security structures initialized
 136    before the policy was loaded. */
 137 static LIST_HEAD(superblock_security_head);
 138 static DEFINE_SPINLOCK(sb_security_lock);
 139
 140 static struct kmem_cache *sel_inode_cache;
 141
 142 /**
 143  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 144  *
 145  * Description:
 146  * This function checks the SECMARK reference counter to see if any SECMARK
 147  * targets are currently configured, if the reference counter is greater than
 148  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 149  * enabled, false (0) if SECMARK is disabled.
 150  *
 151  */
 152 static int selinux_secmark_enabled(void)
 153 {
 154         return (atomic_read(&selinux_secmark_refcount) > 0);
 155 }
 156
 157 /*
 158  * initialise the security for the init task
 159  */
 160 static void cred_init_security(void)
 161 {
 162         struct cred *cred = (struct cred *) current->real_cred;
 163         struct task_security_struct *tsec;
 164
 165         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 166         if (!tsec)
 167                 panic("SELinux:  Failed to initialize initial task.\n");
 168
 169         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 170         cred->security = tsec;
 171 }
 172
 173 /*
 174  * get the security ID of a set of credentials
 175  */
 176 static inline u32 cred_sid(const struct cred *cred)
 177 {
 178         const struct task_security_struct *tsec;
 179
 180         tsec = cred->security;
 181         return tsec->sid;
 182 }
 183
 184 /*
 185  * get the objective security ID of a task
 186  */
 187 static inline u32 task_sid(const struct task_struct *task)
 188 {
 189         u32 sid;
 190
 191         rcu_read_lock();
 192         sid = cred_sid(__task_cred(task));
 193         rcu_read_unlock();
 194         return sid;
 195 }
 196
 197 /*
 198  * get the subjective security ID of the current task
 199  */
 200 static inline u32 current_sid(void)
 201 {
 202         const struct task_security_struct *tsec = current_cred()->security;
 203
 204         return tsec->sid;
 205 }
 206
 207 /* Allocate and free functions for each kind of security blob. */
 208
 209 static int inode_alloc_security(struct inode *inode)
 210 {
 211         struct inode_security_struct *isec;
 212         u32 sid = current_sid();
 213
 214         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 215         if (!isec)
 216                 return -ENOMEM;
 217
 218         mutex_init(&isec->lock);
 219         INIT_LIST_HEAD(&isec->list);
 220         isec->inode = inode;
 221         isec->sid = SECINITSID_UNLABELED;
 222         isec->sclass = SECCLASS_FILE;
 223         isec->task_sid = sid;
 224         inode->i_security = isec;
 225
 226         return 0;
 227 }
 228
 229 static void inode_free_security(struct inode *inode)
 230 {
 231         struct inode_security_struct *isec = inode->i_security;
 232         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 233
 234         spin_lock(&sbsec->isec_lock);
 235         if (!list_empty(&isec->list))
 236                 list_del_init(&isec->list);
 237         spin_unlock(&sbsec->isec_lock);
 238
 239         inode->i_security = NULL;
 240         kmem_cache_free(sel_inode_cache, isec);
 241 }
 242
 243 static int file_alloc_security(struct file *file)
 244 {
 245         struct file_security_struct *fsec;
 246         u32 sid = current_sid();
 247
 248         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 249         if (!fsec)
 250                 return -ENOMEM;
 251
 252         fsec->sid = sid;
 253         fsec->fown_sid = sid;
 254         file->f_security = fsec;
 255
 256         return 0;
 257 }
 258
 259 static void file_free_security(struct file *file)
 260 {
 261         struct file_security_struct *fsec = file->f_security;
 262         file->f_security = NULL;
 263         kfree(fsec);
 264 }
 265
 266 static int superblock_alloc_security(struct super_block *sb)
 267 {
 268         struct superblock_security_struct *sbsec;
 269
 270         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 271         if (!sbsec)
 272                 return -ENOMEM;
 273
 274         mutex_init(&sbsec->lock);
 275         INIT_LIST_HEAD(&sbsec->list);
 276         INIT_LIST_HEAD(&sbsec->isec_head);
 277         spin_lock_init(&sbsec->isec_lock);
 278         sbsec->sb = sb;
 279         sbsec->sid = SECINITSID_UNLABELED;
 280         sbsec->def_sid = SECINITSID_FILE;
 281         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 282         sb->s_security = sbsec;
 283
 284         return 0;
 285 }
 286
 287 static void superblock_free_security(struct super_block *sb)
 288 {
 289         struct superblock_security_struct *sbsec = sb->s_security;
 290
 291         spin_lock(&sb_security_lock);
 292         if (!list_empty(&sbsec->list))
 293                 list_del_init(&sbsec->list);
 294         spin_unlock(&sb_security_lock);
 295
 296         sb->s_security = NULL;
 297         kfree(sbsec);
 298 }
 299
 300 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 301 {
 302         struct sk_security_struct *ssec;
 303
 304         ssec = kzalloc(sizeof(*ssec), priority);
 305         if (!ssec)
 306                 return -ENOMEM;
 307
 308         ssec->peer_sid = SECINITSID_UNLABELED;
 309         ssec->sid = SECINITSID_UNLABELED;
 310         sk->sk_security = ssec;
 311
 312         selinux_netlbl_sk_security_reset(ssec);
 313
 314         return 0;
 315 }
 316
 317 static void sk_free_security(struct sock *sk)
 318 {
 319         struct sk_security_struct *ssec = sk->sk_security;
 320
 321         sk->sk_security = NULL;
 322         selinux_netlbl_sk_security_free(ssec);
 323         kfree(ssec);
 324 }
 325
 326 /* The security server must be initialized before
 327    any labeling or access decisions can be provided. */
 328 extern int ss_initialized;
 329
 330 /* The file system's label must be initialized prior to use. */
 331
 332 static char *labeling_behaviors[6] = {
 333         "uses xattr",
 334         "uses transition SIDs",
 335         "uses task SIDs",
 336         "uses genfs_contexts",
 337         "not configured for labeling",
 338         "uses mountpoint labeling",
 339 };
 340
 341 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 342
 343 static inline int inode_doinit(struct inode *inode)
 344 {
 345         return inode_doinit_with_dentry(inode, NULL);
 346 }
 347
 348 enum {
 349         Opt_error = -1,
 350         Opt_context = 1,
 351         Opt_fscontext = 2,
 352         Opt_defcontext = 3,
 353         Opt_rootcontext = 4,
 354         Opt_labelsupport = 5,
 355 };
 356
 357 static const match_table_t tokens = {
 358         {Opt_context, CONTEXT_STR "%s"},
 359         {Opt_fscontext, FSCONTEXT_STR "%s"},
 360         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 361         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 362         {Opt_labelsupport, LABELSUPP_STR},
 363         {Opt_error, NULL},
 364 };
 365
 366 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 367
 368 static int may_context_mount_sb_relabel(u32 sid,
 369                         struct superblock_security_struct *sbsec,
 370                         const struct cred *cred)
 371 {
 372         const struct task_security_struct *tsec = cred->security;
 373         int rc;
 374
 375         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 376                           FILESYSTEM__RELABELFROM, NULL);
 377         if (rc)
 378                 return rc;
 379
 380         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 381                           FILESYSTEM__RELABELTO, NULL);
 382         return rc;
 383 }
 384
 385 static int may_context_mount_inode_relabel(u32 sid,
 386                         struct superblock_security_struct *sbsec,
 387                         const struct cred *cred)
 388 {
 389         const struct task_security_struct *tsec = cred->security;
 390         int rc;
 391         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 392                           FILESYSTEM__RELABELFROM, NULL);
 393         if (rc)
 394                 return rc;
 395
 396         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 397                           FILESYSTEM__ASSOCIATE, NULL);
 398         return rc;
 399 }
 400
 401 static int sb_finish_set_opts(struct super_block *sb)
 402 {
 403         struct superblock_security_struct *sbsec = sb->s_security;
 404         struct dentry *root = sb->s_root;
 405         struct inode *root_inode = root->d_inode;
 406         int rc = 0;
 407
 408         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 409                 /* Make sure that the xattr handler exists and that no
 410                    error other than -ENODATA is returned by getxattr on
 411                    the root directory.  -ENODATA is ok, as this may be
 412                    the first boot of the SELinux kernel before we have
 413                    assigned xattr values to the filesystem. */
 414                 if (!root_inode->i_op->getxattr) {
 415                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 416                                "xattr support\n", sb->s_id, sb->s_type->name);
 417                         rc = -EOPNOTSUPP;
 418                         goto out;
 419                 }
 420                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 421                 if (rc < 0 && rc != -ENODATA) {
 422                         if (rc == -EOPNOTSUPP)
 423                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 424                                        "%s) has no security xattr handler\n",
 425                                        sb->s_id, sb->s_type->name);
 426                         else
 427                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 428                                        "%s) getxattr errno %d\n", sb->s_id,
 429                                        sb->s_type->name, -rc);
 430                         goto out;
 431                 }
 432         }
 433
 434         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 435
 436         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 437                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 438                        sb->s_id, sb->s_type->name);
 439         else
 440                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 441                        sb->s_id, sb->s_type->name,
 442                        labeling_behaviors[sbsec->behavior-1]);
 443
 444         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 445             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 446             sbsec->behavior == SECURITY_FS_USE_NONE ||
 447             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 sbsec->flags &= ~SE_SBLABELSUPP;
 449
 450         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 451         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 452                 sbsec->flags |= SE_SBLABELSUPP;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 spin_unlock(&sbsec->isec_lock);
 469                 inode = igrab(inode);
 470                 if (inode) {
 471                         if (!IS_PRIVATE(inode))
 472                                 inode_doinit(inode);
 473                         iput(inode);
 474                 }
 475                 spin_lock(&sbsec->isec_lock);
 476                 list_del_init(&isec->list);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         tmp = sbsec->flags & SE_MNTMASK;
 507         /* count the number of mount options for this sb */
 508         for (i = 0; i < 8; i++) {
 509                 if (tmp & 0x01)
 510                         opts->num_mnt_opts++;
 511                 tmp >>= 1;
 512         }
 513         /* Check if the Label support flag is set */
 514         if (sbsec->flags & SE_SBLABELSUPP)
 515                 opts->num_mnt_opts++;
 516
 517         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 518         if (!opts->mnt_opts) {
 519                 rc = -ENOMEM;
 520                 goto out_free;
 521         }
 522
 523         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 524         if (!opts->mnt_opts_flags) {
 525                 rc = -ENOMEM;
 526                 goto out_free;
 527         }
 528
 529         i = 0;
 530         if (sbsec->flags & FSCONTEXT_MNT) {
 531                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 532                 if (rc)
 533                         goto out_free;
 534                 opts->mnt_opts[i] = context;
 535                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 536         }
 537         if (sbsec->flags & CONTEXT_MNT) {
 538                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 539                 if (rc)
 540                         goto out_free;
 541                 opts->mnt_opts[i] = context;
 542                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 543         }
 544         if (sbsec->flags & DEFCONTEXT_MNT) {
 545                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 546                 if (rc)
 547                         goto out_free;
 548                 opts->mnt_opts[i] = context;
 549                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 550         }
 551         if (sbsec->flags & ROOTCONTEXT_MNT) {
 552                 struct inode *root = sbsec->sb->s_root->d_inode;
 553                 struct inode_security_struct *isec = root->i_security;
 554
 555                 rc = security_sid_to_context(isec->sid, &context, &len);
 556                 if (rc)
 557                         goto out_free;
 558                 opts->mnt_opts[i] = context;
 559                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 560         }
 561         if (sbsec->flags & SE_SBLABELSUPP) {
 562                 opts->mnt_opts[i] = NULL;
 563                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 564         }
 565
 566         BUG_ON(i != opts->num_mnt_opts);
 567
 568         return 0;
 569
 570 out_free:
 571         security_free_mnt_opts(opts);
 572         return rc;
 573 }
 574
 575 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 576                       u32 old_sid, u32 new_sid)
 577 {
 578         char mnt_flags = sbsec->flags & SE_MNTMASK;
 579
 580         /* check if the old mount command had the same options */
 581         if (sbsec->flags & SE_SBINITIALIZED)
 582                 if (!(sbsec->flags & flag) ||
 583                     (old_sid != new_sid))
 584                         return 1;
 585
 586         /* check if we were passed the same options twice,
 587          * aka someone passed context=a,context=b
 588          */
 589         if (!(sbsec->flags & SE_SBINITIALIZED))
 590                 if (mnt_flags & flag)
 591                         return 1;
 592         return 0;
 593 }
 594
 595 /*
 596  * Allow filesystems with binary mount data to explicitly set mount point
 597  * labeling information.
 598  */
 599 static int selinux_set_mnt_opts(struct super_block *sb,
 600                                 struct security_mnt_opts *opts)
 601 {
 602         const struct cred *cred = current_cred();
 603         int rc = 0, i;
 604         struct superblock_security_struct *sbsec = sb->s_security;
 605         const char *name = sb->s_type->name;
 606         struct inode *inode = sbsec->sb->s_root->d_inode;
 607         struct inode_security_struct *root_isec = inode->i_security;
 608         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 609         u32 defcontext_sid = 0;
 610         char **mount_options = opts->mnt_opts;
 611         int *flags = opts->mnt_opts_flags;
 612         int num_opts = opts->num_mnt_opts;
 613
 614         mutex_lock(&sbsec->lock);
 615
 616         if (!ss_initialized) {
 617                 if (!num_opts) {
 618                         /* Defer initialization until selinux_complete_init,
 619                            after the initial policy is loaded and the security
 620                            server is ready to handle calls. */
 621                         spin_lock(&sb_security_lock);
 622                         if (list_empty(&sbsec->list))
 623                                 list_add(&sbsec->list, &superblock_security_head);
 624                         spin_unlock(&sb_security_lock);
 625                         goto out;
 626                 }
 627                 rc = -EINVAL;
 628                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 629                         "before the security server is initialized\n");
 630                 goto out;
 631         }
 632
 633         /*
 634          * Binary mount data FS will come through this function twice.  Once
 635          * from an explicit call and once from the generic calls from the vfs.
 636          * Since the generic VFS calls will not contain any security mount data
 637          * we need to skip the double mount verification.
 638          *
 639          * This does open a hole in which we will not notice if the first
 640          * mount using this sb set explict options and a second mount using
 641          * this sb does not set any security options.  (The first options
 642          * will be used for both mounts)
 643          */
 644         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 645             && (num_opts == 0))
 646                 goto out;
 647
 648         /*
 649          * parse the mount options, check if they are valid sids.
 650          * also check if someone is trying to mount the same sb more
 651          * than once with different security options.
 652          */
 653         for (i = 0; i < num_opts; i++) {
 654                 u32 sid;
 655
 656                 if (flags[i] == SE_SBLABELSUPP)
 657                         continue;
 658                 rc = security_context_to_sid(mount_options[i],
 659                                              strlen(mount_options[i]), &sid);
 660                 if (rc) {
 661                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 662                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 663                                mount_options[i], sb->s_id, name, rc);
 664                         goto out;
 665                 }
 666                 switch (flags[i]) {
 667                 case FSCONTEXT_MNT:
 668                         fscontext_sid = sid;
 669
 670                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 671                                         fscontext_sid))
 672                                 goto out_double_mount;
 673
 674                         sbsec->flags |= FSCONTEXT_MNT;
 675                         break;
 676                 case CONTEXT_MNT:
 677                         context_sid = sid;
 678
 679                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 680                                         context_sid))
 681                                 goto out_double_mount;
 682
 683                         sbsec->flags |= CONTEXT_MNT;
 684                         break;
 685                 case ROOTCONTEXT_MNT:
 686                         rootcontext_sid = sid;
 687
 688                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 689                                         rootcontext_sid))
 690                                 goto out_double_mount;
 691
 692                         sbsec->flags |= ROOTCONTEXT_MNT;
 693
 694                         break;
 695                 case DEFCONTEXT_MNT:
 696                         defcontext_sid = sid;
 697
 698                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 699                                         defcontext_sid))
 700                                 goto out_double_mount;
 701
 702                         sbsec->flags |= DEFCONTEXT_MNT;
 703
 704                         break;
 705                 default:
 706                         rc = -EINVAL;
 707                         goto out;
 708                 }
 709         }
 710
 711         if (sbsec->flags & SE_SBINITIALIZED) {
 712                 /* previously mounted with options, but not on this attempt? */
 713                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 714                         goto out_double_mount;
 715                 rc = 0;
 716                 goto out;
 717         }
 718
 719         if (strcmp(sb->s_type->name, "proc") == 0)
 720                 sbsec->flags |= SE_SBPROC;
 721
 722         /* Determine the labeling behavior to use for this filesystem type. */
 723         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 724         if (rc) {
 725                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 726                        __func__, sb->s_type->name, rc);
 727                 goto out;
 728         }
 729
 730         /* sets the context of the superblock for the fs being mounted. */
 731         if (fscontext_sid) {
 732                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 733                 if (rc)
 734                         goto out;
 735
 736                 sbsec->sid = fscontext_sid;
 737         }
 738
 739         /*
 740          * Switch to using mount point labeling behavior.
 741          * sets the label used on all file below the mountpoint, and will set
 742          * the superblock context if not already set.
 743          */
 744         if (context_sid) {
 745                 if (!fscontext_sid) {
 746                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 747                                                           cred);
 748                         if (rc)
 749                                 goto out;
 750                         sbsec->sid = context_sid;
 751                 } else {
 752                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 753                                                              cred);
 754                         if (rc)
 755                                 goto out;
 756                 }
 757                 if (!rootcontext_sid)
 758                         rootcontext_sid = context_sid;
 759
 760                 sbsec->mntpoint_sid = context_sid;
 761                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 762         }
 763
 764         if (rootcontext_sid) {
 765                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 766                                                      cred);
 767                 if (rc)
 768                         goto out;
 769
 770                 root_isec->sid = rootcontext_sid;
 771                 root_isec->initialized = 1;
 772         }
 773
 774         if (defcontext_sid) {
 775                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 776                         rc = -EINVAL;
 777                         printk(KERN_WARNING "SELinux: defcontext option is "
 778                                "invalid for this filesystem type\n");
 779                         goto out;
 780                 }
 781
 782                 if (defcontext_sid != sbsec->def_sid) {
 783                         rc = may_context_mount_inode_relabel(defcontext_sid,
 784                                                              sbsec, cred);
 785                         if (rc)
 786                                 goto out;
 787                 }
 788
 789                 sbsec->def_sid = defcontext_sid;
 790         }
 791
 792         rc = sb_finish_set_opts(sb);
 793 out:
 794         mutex_unlock(&sbsec->lock);
 795         return rc;
 796 out_double_mount:
 797         rc = -EINVAL;
 798         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 799                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 800         goto out;
 801 }
 802
 803 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 804                                         struct super_block *newsb)
 805 {
 806         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 807         struct superblock_security_struct *newsbsec = newsb->s_security;
 808
 809         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 810         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 811         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 812
 813         /*
 814          * if the parent was able to be mounted it clearly had no special lsm
 815          * mount options.  thus we can safely put this sb on the list and deal
 816          * with it later
 817          */
 818         if (!ss_initialized) {
 819                 spin_lock(&sb_security_lock);
 820                 if (list_empty(&newsbsec->list))
 821                         list_add(&newsbsec->list, &superblock_security_head);
 822                 spin_unlock(&sb_security_lock);
 823                 return;
 824         }
 825
 826         /* how can we clone if the old one wasn't set up?? */
 827         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 828
 829         /* if fs is reusing a sb, just let its options stand... */
 830         if (newsbsec->flags & SE_SBINITIALIZED)
 831                 return;
 832
 833         mutex_lock(&newsbsec->lock);
 834
 835         newsbsec->flags = oldsbsec->flags;
 836
 837         newsbsec->sid = oldsbsec->sid;
 838         newsbsec->def_sid = oldsbsec->def_sid;
 839         newsbsec->behavior = oldsbsec->behavior;
 840
 841         if (set_context) {
 842                 u32 sid = oldsbsec->mntpoint_sid;
 843
 844                 if (!set_fscontext)
 845                         newsbsec->sid = sid;
 846                 if (!set_rootcontext) {
 847                         struct inode *newinode = newsb->s_root->d_inode;
 848                         struct inode_security_struct *newisec = newinode->i_security;
 849                         newisec->sid = sid;
 850                 }
 851                 newsbsec->mntpoint_sid = sid;
 852         }
 853         if (set_rootcontext) {
 854                 const struct inode *oldinode = oldsb->s_root->d_inode;
 855                 const struct inode_security_struct *oldisec = oldinode->i_security;
 856                 struct inode *newinode = newsb->s_root->d_inode;
 857                 struct inode_security_struct *newisec = newinode->i_security;
 858
 859                 newisec->sid = oldisec->sid;
 860         }
 861
 862         sb_finish_set_opts(newsb);
 863         mutex_unlock(&newsbsec->lock);
 864 }
 865
 866 static int selinux_parse_opts_str(char *options,
 867                                   struct security_mnt_opts *opts)
 868 {
 869         char *p;
 870         char *context = NULL, *defcontext = NULL;
 871         char *fscontext = NULL, *rootcontext = NULL;
 872         int rc, num_mnt_opts = 0;
 873
 874         opts->num_mnt_opts = 0;
 875
 876         /* Standard string-based options. */
 877         while ((p = strsep(&options, "|")) != NULL) {
 878                 int token;
 879                 substring_t args[MAX_OPT_ARGS];
 880
 881                 if (!*p)
 882                         continue;
 883
 884                 token = match_token(p, tokens, args);
 885
 886                 switch (token) {
 887                 case Opt_context:
 888                         if (context || defcontext) {
 889                                 rc = -EINVAL;
 890                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 891                                 goto out_err;
 892                         }
 893                         context = match_strdup(&args[0]);
 894                         if (!context) {
 895                                 rc = -ENOMEM;
 896                                 goto out_err;
 897                         }
 898                         break;
 899
 900                 case Opt_fscontext:
 901                         if (fscontext) {
 902                                 rc = -EINVAL;
 903                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 904                                 goto out_err;
 905                         }
 906                         fscontext = match_strdup(&args[0]);
 907                         if (!fscontext) {
 908                                 rc = -ENOMEM;
 909                                 goto out_err;
 910                         }
 911                         break;
 912
 913                 case Opt_rootcontext:
 914                         if (rootcontext) {
 915                                 rc = -EINVAL;
 916                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 917                                 goto out_err;
 918                         }
 919                         rootcontext = match_strdup(&args[0]);
 920                         if (!rootcontext) {
 921                                 rc = -ENOMEM;
 922                                 goto out_err;
 923                         }
 924                         break;
 925
 926                 case Opt_defcontext:
 927                         if (context || defcontext) {
 928                                 rc = -EINVAL;
 929                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 930                                 goto out_err;
 931                         }
 932                         defcontext = match_strdup(&args[0]);
 933                         if (!defcontext) {
 934                                 rc = -ENOMEM;
 935                                 goto out_err;
 936                         }
 937                         break;
 938                 case Opt_labelsupport:
 939                         break;
 940                 default:
 941                         rc = -EINVAL;
 942                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 943                         goto out_err;
 944
 945                 }
 946         }
 947
 948         rc = -ENOMEM;
 949         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 950         if (!opts->mnt_opts)
 951                 goto out_err;
 952
 953         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 954         if (!opts->mnt_opts_flags) {
 955                 kfree(opts->mnt_opts);
 956                 goto out_err;
 957         }
 958
 959         if (fscontext) {
 960                 opts->mnt_opts[num_mnt_opts] = fscontext;
 961                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 962         }
 963         if (context) {
 964                 opts->mnt_opts[num_mnt_opts] = context;
 965                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 966         }
 967         if (rootcontext) {
 968                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 969                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 970         }
 971         if (defcontext) {
 972                 opts->mnt_opts[num_mnt_opts] = defcontext;
 973                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 974         }
 975
 976         opts->num_mnt_opts = num_mnt_opts;
 977         return 0;
 978
 979 out_err:
 980         kfree(context);
 981         kfree(defcontext);
 982         kfree(fscontext);
 983         kfree(rootcontext);
 984         return rc;
 985 }
 986 /*
 987  * string mount options parsing and call set the sbsec
 988  */
 989 static int superblock_doinit(struct super_block *sb, void *data)
 990 {
 991         int rc = 0;
 992         char *options = data;
 993         struct security_mnt_opts opts;
 994
 995         security_init_mnt_opts(&opts);
 996
 997         if (!data)
 998                 goto out;
 999
1000         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1001
1002         rc = selinux_parse_opts_str(options, &opts);
1003         if (rc)
1004                 goto out_err;
1005
1006 out:
1007         rc = selinux_set_mnt_opts(sb, &opts);
1008
1009 out_err:
1010         security_free_mnt_opts(&opts);
1011         return rc;
1012 }
1013
1014 static void selinux_write_opts(struct seq_file *m,
1015                                struct security_mnt_opts *opts)
1016 {
1017         int i;
1018         char *prefix;
1019
1020         for (i = 0; i < opts->num_mnt_opts; i++) {
1021                 char *has_comma;
1022
1023                 if (opts->mnt_opts[i])
1024                         has_comma = strchr(opts->mnt_opts[i], ',');
1025                 else
1026                         has_comma = NULL;
1027
1028                 switch (opts->mnt_opts_flags[i]) {
1029                 case CONTEXT_MNT:
1030                         prefix = CONTEXT_STR;
1031                         break;
1032                 case FSCONTEXT_MNT:
1033                         prefix = FSCONTEXT_STR;
1034                         break;
1035                 case ROOTCONTEXT_MNT:
1036                         prefix = ROOTCONTEXT_STR;
1037                         break;
1038                 case DEFCONTEXT_MNT:
1039                         prefix = DEFCONTEXT_STR;
1040                         break;
1041                 case SE_SBLABELSUPP:
1042                         seq_putc(m, ',');
1043                         seq_puts(m, LABELSUPP_STR);
1044                         continue;
1045                 default:
1046                         BUG();
1047                 };
1048                 /* we need a comma before each option */
1049                 seq_putc(m, ',');
1050                 seq_puts(m, prefix);
1051                 if (has_comma)
1052                         seq_putc(m, '\"');
1053                 seq_puts(m, opts->mnt_opts[i]);
1054                 if (has_comma)
1055                         seq_putc(m, '\"');
1056         }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061         struct security_mnt_opts opts;
1062         int rc;
1063
1064         rc = selinux_get_mnt_opts(sb, &opts);
1065         if (rc) {
1066                 /* before policy load we may get EINVAL, don't show anything */
1067                 if (rc == -EINVAL)
1068                         rc = 0;
1069                 return rc;
1070         }
1071
1072         selinux_write_opts(m, &opts);
1073
1074         security_free_mnt_opts(&opts);
1075
1076         return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081         switch (mode & S_IFMT) {
1082         case S_IFSOCK:
1083                 return SECCLASS_SOCK_FILE;
1084         case S_IFLNK:
1085                 return SECCLASS_LNK_FILE;
1086         case S_IFREG:
1087                 return SECCLASS_FILE;
1088         case S_IFBLK:
1089                 return SECCLASS_BLK_FILE;
1090         case S_IFDIR:
1091                 return SECCLASS_DIR;
1092         case S_IFCHR:
1093                 return SECCLASS_CHR_FILE;
1094         case S_IFIFO:
1095                 return SECCLASS_FIFO_FILE;
1096
1097         }
1098
1099         return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114         switch (family) {
1115         case PF_UNIX:
1116                 switch (type) {
1117                 case SOCK_STREAM:
1118                 case SOCK_SEQPACKET:
1119                         return SECCLASS_UNIX_STREAM_SOCKET;
1120                 case SOCK_DGRAM:
1121                         return SECCLASS_UNIX_DGRAM_SOCKET;
1122                 }
1123                 break;
1124         case PF_INET:
1125         case PF_INET6:
1126                 switch (type) {
1127                 case SOCK_STREAM:
1128                         if (default_protocol_stream(protocol))
1129                                 return SECCLASS_TCP_SOCKET;
1130                         else
1131                                 return SECCLASS_RAWIP_SOCKET;
1132                 case SOCK_DGRAM:
1133                         if (default_protocol_dgram(protocol))
1134                                 return SECCLASS_UDP_SOCKET;
1135                         else
1136                                 return SECCLASS_RAWIP_SOCKET;
1137                 case SOCK_DCCP:
1138                         return SECCLASS_DCCP_SOCKET;
1139                 default:
1140                         return SECCLASS_RAWIP_SOCKET;
1141                 }
1142                 break;
1143         case PF_NETLINK:
1144                 switch (protocol) {
1145                 case NETLINK_ROUTE:
1146                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1147                 case NETLINK_FIREWALL:
1148                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149                 case NETLINK_INET_DIAG:
1150                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151                 case NETLINK_NFLOG:
1152                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1153                 case NETLINK_XFRM:
1154                         return SECCLASS_NETLINK_XFRM_SOCKET;
1155                 case NETLINK_SELINUX:
1156                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1157                 case NETLINK_AUDIT:
1158                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1159                 case NETLINK_IP6_FW:
1160                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1161                 case NETLINK_DNRTMSG:
1162                         return SECCLASS_NETLINK_DNRT_SOCKET;
1163                 case NETLINK_KOBJECT_UEVENT:
1164                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165                 default:
1166                         return SECCLASS_NETLINK_SOCKET;
1167                 }
1168         case PF_PACKET:
1169                 return SECCLASS_PACKET_SOCKET;
1170         case PF_KEY:
1171                 return SECCLASS_KEY_SOCKET;
1172         case PF_APPLETALK:
1173                 return SECCLASS_APPLETALK_SOCKET;
1174         }
1175
1176         return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1181                                 u16 tclass,
1182                                 u32 *sid)
1183 {
1184         int buflen, rc;
1185         char *buffer, *path, *end;
1186
1187         buffer = (char *)__get_free_page(GFP_KERNEL);
1188         if (!buffer)
1189                 return -ENOMEM;
1190
1191         buflen = PAGE_SIZE;
1192         end = buffer+buflen;
1193         *--end = '\0';
1194         buflen--;
1195         path = end-1;
1196         *path = '/';
1197         while (de && de != de->parent) {
1198                 buflen -= de->namelen + 1;
1199                 if (buflen < 0)
1200                         break;
1201                 end -= de->namelen;
1202                 memcpy(end, de->name, de->namelen);
1203                 *--end = '/';
1204                 path = end;
1205                 de = de->parent;
1206         }
1207         rc = security_genfs_sid("proc", path, tclass, sid);
1208         free_page((unsigned long)buffer);
1209         return rc;
1210 }
1211 #else
1212 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1213                                 u16 tclass,
1214                                 u32 *sid)
1215 {
1216         return -EINVAL;
1217 }
1218 #endif
1219
1220 /* The inode's security attributes must be initialized before first use. */
1221 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1222 {
1223         struct superblock_security_struct *sbsec = NULL;
1224         struct inode_security_struct *isec = inode->i_security;
1225         u32 sid;
1226         struct dentry *dentry;
1227 #define INITCONTEXTLEN 255
1228         char *context = NULL;
1229         unsigned len = 0;
1230         int rc = 0;
1231
1232         if (isec->initialized)
1233                 goto out;
1234
1235         mutex_lock(&isec->lock);
1236         if (isec->initialized)
1237                 goto out_unlock;
1238
1239         sbsec = inode->i_sb->s_security;
1240         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1241                 /* Defer initialization until selinux_complete_init,
1242                    after the initial policy is loaded and the security
1243                    server is ready to handle calls. */
1244                 spin_lock(&sbsec->isec_lock);
1245                 if (list_empty(&isec->list))
1246                         list_add(&isec->list, &sbsec->isec_head);
1247                 spin_unlock(&sbsec->isec_lock);
1248                 goto out_unlock;
1249         }
1250
1251         switch (sbsec->behavior) {
1252         case SECURITY_FS_USE_XATTR:
1253                 if (!inode->i_op->getxattr) {
1254                         isec->sid = sbsec->def_sid;
1255                         break;
1256                 }
1257
1258                 /* Need a dentry, since the xattr API requires one.
1259                    Life would be simpler if we could just pass the inode. */
1260                 if (opt_dentry) {
1261                         /* Called from d_instantiate or d_splice_alias. */
1262                         dentry = dget(opt_dentry);
1263                 } else {
1264                         /* Called from selinux_complete_init, try to find a dentry. */
1265                         dentry = d_find_alias(inode);
1266                 }
1267                 if (!dentry) {
1268                         /*
1269                          * this is can be hit on boot when a file is accessed
1270                          * before the policy is loaded.  When we load policy we
1271                          * may find inodes that have no dentry on the
1272                          * sbsec->isec_head list.  No reason to complain as these
1273                          * will get fixed up the next time we go through
1274                          * inode_doinit with a dentry, before these inodes could
1275                          * be used again by userspace.
1276                          */
1277                         goto out_unlock;
1278                 }
1279
1280                 len = INITCONTEXTLEN;
1281                 context = kmalloc(len+1, GFP_NOFS);
1282                 if (!context) {
1283                         rc = -ENOMEM;
1284                         dput(dentry);
1285                         goto out_unlock;
1286                 }
1287                 context[len] = '\0';
1288                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1289                                            context, len);
1290                 if (rc == -ERANGE) {
1291                         kfree(context);
1292
1293                         /* Need a larger buffer.  Query for the right size. */
1294                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1295                                                    NULL, 0);
1296                         if (rc < 0) {
1297                                 dput(dentry);
1298                                 goto out_unlock;
1299                         }
1300                         len = rc;
1301                         context = kmalloc(len+1, GFP_NOFS);
1302                         if (!context) {
1303                                 rc = -ENOMEM;
1304                                 dput(dentry);
1305                                 goto out_unlock;
1306                         }
1307                         context[len] = '\0';
1308                         rc = inode->i_op->getxattr(dentry,
1309                                                    XATTR_NAME_SELINUX,
1310                                                    context, len);
1311                 }
1312                 dput(dentry);
1313                 if (rc < 0) {
1314                         if (rc != -ENODATA) {
1315                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1316                                        "%d for dev=%s ino=%ld\n", __func__,
1317                                        -rc, inode->i_sb->s_id, inode->i_ino);
1318                                 kfree(context);
1319                                 goto out_unlock;
1320                         }
1321                         /* Map ENODATA to the default file SID */
1322                         sid = sbsec->def_sid;
1323                         rc = 0;
1324                 } else {
1325                         rc = security_context_to_sid_default(context, rc, &sid,
1326                                                              sbsec->def_sid,
1327                                                              GFP_NOFS);
1328                         if (rc) {
1329                                 char *dev = inode->i_sb->s_id;
1330                                 unsigned long ino = inode->i_ino;
1331
1332                                 if (rc == -EINVAL) {
1333                                         if (printk_ratelimit())
1334                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1335                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1336                                                         "filesystem in question.\n", ino, dev, context);
1337                                 } else {
1338                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1339                                                "returned %d for dev=%s ino=%ld\n",
1340                                                __func__, context, -rc, dev, ino);
1341                                 }
1342                                 kfree(context);
1343                                 /* Leave with the unlabeled SID */
1344                                 rc = 0;
1345                                 break;
1346                         }
1347                 }
1348                 kfree(context);
1349                 isec->sid = sid;
1350                 break;
1351         case SECURITY_FS_USE_TASK:
1352                 isec->sid = isec->task_sid;
1353                 break;
1354         case SECURITY_FS_USE_TRANS:
1355                 /* Default to the fs SID. */
1356                 isec->sid = sbsec->sid;
1357
1358                 /* Try to obtain a transition SID. */
1359                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1360                 rc = security_transition_sid(isec->task_sid,
1361                                              sbsec->sid,
1362                                              isec->sclass,
1363                                              &sid);
1364                 if (rc)
1365                         goto out_unlock;
1366                 isec->sid = sid;
1367                 break;
1368         case SECURITY_FS_USE_MNTPOINT:
1369                 isec->sid = sbsec->mntpoint_sid;
1370                 break;
1371         default:
1372                 /* Default to the fs superblock SID. */
1373                 isec->sid = sbsec->sid;
1374
1375                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1376                         struct proc_inode *proci = PROC_I(inode);
1377                         if (proci->pde) {
1378                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1379                                 rc = selinux_proc_get_sid(proci->pde,
1380                                                           isec->sclass,
1381                                                           &sid);
1382                                 if (rc)
1383                                         goto out_unlock;
1384                                 isec->sid = sid;
1385                         }
1386                 }
1387                 break;
1388         }
1389
1390         isec->initialized = 1;
1391
1392 out_unlock:
1393         mutex_unlock(&isec->lock);
1394 out:
1395         if (isec->sclass == SECCLASS_FILE)
1396                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1397         return rc;
1398 }
1399
1400 /* Convert a Linux signal to an access vector. */
1401 static inline u32 signal_to_av(int sig)
1402 {
1403         u32 perm = 0;
1404
1405         switch (sig) {
1406         case SIGCHLD:
1407                 /* Commonly granted from child to parent. */
1408                 perm = PROCESS__SIGCHLD;
1409                 break;
1410         case SIGKILL:
1411                 /* Cannot be caught or ignored */
1412                 perm = PROCESS__SIGKILL;
1413                 break;
1414         case SIGSTOP:
1415                 /* Cannot be caught or ignored */
1416                 perm = PROCESS__SIGSTOP;
1417                 break;
1418         default:
1419                 /* All other signals. */
1420                 perm = PROCESS__SIGNAL;
1421                 break;
1422         }
1423
1424         return perm;
1425 }
1426
1427 /*
1428  * Check permission between a pair of credentials
1429  * fork check, ptrace check, etc.
1430  */
1431 static int cred_has_perm(const struct cred *actor,
1432                          const struct cred *target,
1433                          u32 perms)
1434 {
1435         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1436
1437         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1438 }
1439
1440 /*
1441  * Check permission between a pair of tasks, e.g. signal checks,
1442  * fork check, ptrace check, etc.
1443  * tsk1 is the actor and tsk2 is the target
1444  * - this uses the default subjective creds of tsk1
1445  */
1446 static int task_has_perm(const struct task_struct *tsk1,
1447                          const struct task_struct *tsk2,
1448                          u32 perms)
1449 {
1450         const struct task_security_struct *__tsec1, *__tsec2;
1451         u32 sid1, sid2;
1452
1453         rcu_read_lock();
1454         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1455         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1456         rcu_read_unlock();
1457         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1458 }
1459
1460 /*
1461  * Check permission between current and another task, e.g. signal checks,
1462  * fork check, ptrace check, etc.
1463  * current is the actor and tsk2 is the target
1464  * - this uses current's subjective creds
1465  */
1466 static int current_has_perm(const struct task_struct *tsk,
1467                             u32 perms)
1468 {
1469         u32 sid, tsid;
1470
1471         sid = current_sid();
1472         tsid = task_sid(tsk);
1473         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1474 }
1475
1476 #if CAP_LAST_CAP > 63
1477 #error Fix SELinux to handle capabilities > 63.
1478 #endif
1479
1480 /* Check whether a task is allowed to use a capability. */
1481 static int task_has_capability(struct task_struct *tsk,
1482                                const struct cred *cred,
1483                                int cap, int audit)
1484 {
1485         struct common_audit_data ad;
1486         struct av_decision avd;
1487         u16 sclass;
1488         u32 sid = cred_sid(cred);
1489         u32 av = CAP_TO_MASK(cap);
1490         int rc;
1491
1492         COMMON_AUDIT_DATA_INIT(&ad, CAP);
1493         ad.tsk = tsk;
1494         ad.u.cap = cap;
1495
1496         switch (CAP_TO_INDEX(cap)) {
1497         case 0:
1498                 sclass = SECCLASS_CAPABILITY;
1499                 break;
1500         case 1:
1501                 sclass = SECCLASS_CAPABILITY2;
1502                 break;
1503         default:
1504                 printk(KERN_ERR
1505                        "SELinux:  out of range capability %d\n", cap);
1506                 BUG();
1507         }
1508
1509         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1510         if (audit == SECURITY_CAP_AUDIT)
1511                 avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1512         return rc;
1513 }
1514
1515 /* Check whether a task is allowed to use a system operation. */
1516 static int task_has_system(struct task_struct *tsk,
1517                            u32 perms)
1518 {
1519         u32 sid = task_sid(tsk);
1520
1521         return avc_has_perm(sid, SECINITSID_KERNEL,
1522                             SECCLASS_SYSTEM, perms, NULL);
1523 }
1524
1525 /* Check whether a task has a particular permission to an inode.
1526    The 'adp' parameter is optional and allows other audit
1527    data to be passed (e.g. the dentry). */
1528 static int inode_has_perm(const struct cred *cred,
1529                           struct inode *inode,
1530                           u32 perms,
1531                           struct common_audit_data *adp)
1532 {
1533         struct inode_security_struct *isec;
1534         struct common_audit_data ad;
1535         u32 sid;
1536
1537         validate_creds(cred);
1538
1539         if (unlikely(IS_PRIVATE(inode)))
1540                 return 0;
1541
1542         sid = cred_sid(cred);
1543         isec = inode->i_security;
1544
1545         if (!adp) {
1546                 adp = &ad;
1547                 COMMON_AUDIT_DATA_INIT(&ad, FS);
1548                 ad.u.fs.inode = inode;
1549         }
1550
1551         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1552 }
1553
1554 /* Same as inode_has_perm, but pass explicit audit data containing
1555    the dentry to help the auditing code to more easily generate the
1556    pathname if needed. */
1557 static inline int dentry_has_perm(const struct cred *cred,
1558                                   struct vfsmount *mnt,
1559                                   struct dentry *dentry,
1560                                   u32 av)
1561 {
1562         struct inode *inode = dentry->d_inode;
1563         struct common_audit_data ad;
1564
1565         COMMON_AUDIT_DATA_INIT(&ad, FS);
1566         ad.u.fs.path.mnt = mnt;
1567         ad.u.fs.path.dentry = dentry;
1568         return inode_has_perm(cred, inode, av, &ad);
1569 }
1570
1571 /* Check whether a task can use an open file descriptor to
1572    access an inode in a given way.  Check access to the
1573    descriptor itself, and then use dentry_has_perm to
1574    check a particular permission to the file.
1575    Access to the descriptor is implicitly granted if it
1576    has the same SID as the process.  If av is zero, then
1577    access to the file is not checked, e.g. for cases
1578    where only the descriptor is affected like seek. */
1579 static int file_has_perm(const struct cred *cred,
1580                          struct file *file,
1581                          u32 av)
1582 {
1583         struct file_security_struct *fsec = file->f_security;
1584         struct inode *inode = file->f_path.dentry->d_inode;
1585         struct common_audit_data ad;
1586         u32 sid = cred_sid(cred);
1587         int rc;
1588
1589         COMMON_AUDIT_DATA_INIT(&ad, FS);
1590         ad.u.fs.path = file->f_path;
1591
1592         if (sid != fsec->sid) {
1593                 rc = avc_has_perm(sid, fsec->sid,
1594                                   SECCLASS_FD,
1595                                   FD__USE,
1596                                   &ad);
1597                 if (rc)
1598                         goto out;
1599         }
1600
1601         /* av is zero if only checking access to the descriptor. */
1602         rc = 0;
1603         if (av)
1604                 rc = inode_has_perm(cred, inode, av, &ad);
1605
1606 out:
1607         return rc;
1608 }
1609
1610 /* Check whether a task can create a file. */
1611 static int may_create(struct inode *dir,
1612                       struct dentry *dentry,
1613                       u16 tclass)
1614 {
1615         const struct cred *cred = current_cred();
1616         const struct task_security_struct *tsec = cred->security;
1617         struct inode_security_struct *dsec;
1618         struct superblock_security_struct *sbsec;
1619         u32 sid, newsid;
1620         struct common_audit_data ad;
1621         int rc;
1622
1623         dsec = dir->i_security;
1624         sbsec = dir->i_sb->s_security;
1625
1626         sid = tsec->sid;
1627         newsid = tsec->create_sid;
1628
1629         COMMON_AUDIT_DATA_INIT(&ad, FS);
1630         ad.u.fs.path.dentry = dentry;
1631
1632         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1633                           DIR__ADD_NAME | DIR__SEARCH,
1634                           &ad);
1635         if (rc)
1636                 return rc;
1637
1638         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1639                 rc = security_transition_sid(sid, dsec->sid, tclass, &newsid);
1640                 if (rc)
1641                         return rc;
1642         }
1643
1644         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1645         if (rc)
1646                 return rc;
1647
1648         return avc_has_perm(newsid, sbsec->sid,
1649                             SECCLASS_FILESYSTEM,
1650                             FILESYSTEM__ASSOCIATE, &ad);
1651 }
1652
1653 /* Check whether a task can create a key. */
1654 static int may_create_key(u32 ksid,
1655                           struct task_struct *ctx)
1656 {
1657         u32 sid = task_sid(ctx);
1658
1659         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1660 }
1661
1662 #define MAY_LINK        0
1663 #define MAY_UNLINK      1
1664 #define MAY_RMDIR       2
1665
1666 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1667 static int may_link(struct inode *dir,
1668                     struct dentry *dentry,
1669                     int kind)
1670
1671 {
1672         struct inode_security_struct *dsec, *isec;
1673         struct common_audit_data ad;
1674         u32 sid = current_sid();
1675         u32 av;
1676         int rc;
1677
1678         dsec = dir->i_security;
1679         isec = dentry->d_inode->i_security;
1680
1681         COMMON_AUDIT_DATA_INIT(&ad, FS);
1682         ad.u.fs.path.dentry = dentry;
1683
1684         av = DIR__SEARCH;
1685         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1686         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1687         if (rc)
1688                 return rc;
1689
1690         switch (kind) {
1691         case MAY_LINK:
1692                 av = FILE__LINK;
1693                 break;
1694         case MAY_UNLINK:
1695                 av = FILE__UNLINK;
1696                 break;
1697         case MAY_RMDIR:
1698                 av = DIR__RMDIR;
1699                 break;
1700         default:
1701                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1702                         __func__, kind);
1703                 return 0;
1704         }
1705
1706         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1707         return rc;
1708 }
1709
1710 static inline int may_rename(struct inode *old_dir,
1711                              struct dentry *old_dentry,
1712                              struct inode *new_dir,
1713                              struct dentry *new_dentry)
1714 {
1715         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1716         struct common_audit_data ad;
1717         u32 sid = current_sid();
1718         u32 av;
1719         int old_is_dir, new_is_dir;
1720         int rc;
1721
1722         old_dsec = old_dir->i_security;
1723         old_isec = old_dentry->d_inode->i_security;
1724         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1725         new_dsec = new_dir->i_security;
1726
1727         COMMON_AUDIT_DATA_INIT(&ad, FS);
1728
1729         ad.u.fs.path.dentry = old_dentry;
1730         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1731                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1732         if (rc)
1733                 return rc;
1734         rc = avc_has_perm(sid, old_isec->sid,
1735                           old_isec->sclass, FILE__RENAME, &ad);
1736         if (rc)
1737                 return rc;
1738         if (old_is_dir && new_dir != old_dir) {
1739                 rc = avc_has_perm(sid, old_isec->sid,
1740                                   old_isec->sclass, DIR__REPARENT, &ad);
1741                 if (rc)
1742                         return rc;
1743         }
1744
1745         ad.u.fs.path.dentry = new_dentry;
1746         av = DIR__ADD_NAME | DIR__SEARCH;
1747         if (new_dentry->d_inode)
1748                 av |= DIR__REMOVE_NAME;
1749         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1750         if (rc)
1751                 return rc;
1752         if (new_dentry->d_inode) {
1753                 new_isec = new_dentry->d_inode->i_security;
1754                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1755                 rc = avc_has_perm(sid, new_isec->sid,
1756                                   new_isec->sclass,
1757                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1758                 if (rc)
1759                         return rc;
1760         }
1761
1762         return 0;
1763 }
1764
1765 /* Check whether a task can perform a filesystem operation. */
1766 static int superblock_has_perm(const struct cred *cred,
1767                                struct super_block *sb,
1768                                u32 perms,
1769                                struct common_audit_data *ad)
1770 {
1771         struct superblock_security_struct *sbsec;
1772         u32 sid = cred_sid(cred);
1773
1774         sbsec = sb->s_security;
1775         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1776 }
1777
1778 /* Convert a Linux mode and permission mask to an access vector. */
1779 static inline u32 file_mask_to_av(int mode, int mask)
1780 {
1781         u32 av = 0;
1782
1783         if ((mode & S_IFMT) != S_IFDIR) {
1784                 if (mask & MAY_EXEC)
1785                         av |= FILE__EXECUTE;
1786                 if (mask & MAY_READ)
1787                         av |= FILE__READ;
1788
1789                 if (mask & MAY_APPEND)
1790                         av |= FILE__APPEND;
1791                 else if (mask & MAY_WRITE)
1792                         av |= FILE__WRITE;
1793
1794         } else {
1795                 if (mask & MAY_EXEC)
1796                         av |= DIR__SEARCH;
1797                 if (mask & MAY_WRITE)
1798                         av |= DIR__WRITE;
1799                 if (mask & MAY_READ)
1800                         av |= DIR__READ;
1801         }
1802
1803         return av;
1804 }
1805
1806 /* Convert a Linux file to an access vector. */
1807 static inline u32 file_to_av(struct file *file)
1808 {
1809         u32 av = 0;
1810
1811         if (file->f_mode & FMODE_READ)
1812                 av |= FILE__READ;
1813         if (file->f_mode & FMODE_WRITE) {
1814                 if (file->f_flags & O_APPEND)
1815                         av |= FILE__APPEND;
1816                 else
1817                         av |= FILE__WRITE;
1818         }
1819         if (!av) {
1820                 /*
1821                  * Special file opened with flags 3 for ioctl-only use.
1822                  */
1823                 av = FILE__IOCTL;
1824         }
1825
1826         return av;
1827 }
1828
1829 /*
1830  * Convert a file to an access vector and include the correct open
1831  * open permission.
1832  */
1833 static inline u32 open_file_to_av(struct file *file)
1834 {
1835         u32 av = file_to_av(file);
1836
1837         if (selinux_policycap_openperm) {
1838                 mode_t mode = file->f_path.dentry->d_inode->i_mode;
1839                 /*
1840                  * lnk files and socks do not really have an 'open'
1841                  */
1842                 if (S_ISREG(mode))
1843                         av |= FILE__OPEN;
1844                 else if (S_ISCHR(mode))
1845                         av |= CHR_FILE__OPEN;
1846                 else if (S_ISBLK(mode))
1847                         av |= BLK_FILE__OPEN;
1848                 else if (S_ISFIFO(mode))
1849                         av |= FIFO_FILE__OPEN;
1850                 else if (S_ISDIR(mode))
1851                         av |= DIR__OPEN;
1852                 else if (S_ISSOCK(mode))
1853                         av |= SOCK_FILE__OPEN;
1854                 else
1855                         printk(KERN_ERR "SELinux: WARNING: inside %s with "
1856                                 "unknown mode:%o\n", __func__, mode);
1857         }
1858         return av;
1859 }
1860
1861 /* Hook functions begin here. */
1862
1863 static int selinux_ptrace_access_check(struct task_struct *child,
1864                                      unsigned int mode)
1865 {
1866         int rc;
1867
1868         rc = cap_ptrace_access_check(child, mode);
1869         if (rc)
1870                 return rc;
1871
1872         if (mode == PTRACE_MODE_READ) {
1873                 u32 sid = current_sid();
1874                 u32 csid = task_sid(child);
1875                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1876         }
1877
1878         return current_has_perm(child, PROCESS__PTRACE);
1879 }
1880
1881 static int selinux_ptrace_traceme(struct task_struct *parent)
1882 {
1883         int rc;
1884
1885         rc = cap_ptrace_traceme(parent);
1886         if (rc)
1887                 return rc;
1888
1889         return task_has_perm(parent, current, PROCESS__PTRACE);
1890 }
1891
1892 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1893                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1894 {
1895         int error;
1896
1897         error = current_has_perm(target, PROCESS__GETCAP);
1898         if (error)
1899                 return error;
1900
1901         return cap_capget(target, effective, inheritable, permitted);
1902 }
1903
1904 static int selinux_capset(struct cred *new, const struct cred *old,
1905                           const kernel_cap_t *effective,
1906                           const kernel_cap_t *inheritable,
1907                           const kernel_cap_t *permitted)
1908 {
1909         int error;
1910
1911         error = cap_capset(new, old,
1912                                       effective, inheritable, permitted);
1913         if (error)
1914                 return error;
1915
1916         return cred_has_perm(old, new, PROCESS__SETCAP);
1917 }
1918
1919 /*
1920  * (This comment used to live with the selinux_task_setuid hook,
1921  * which was removed).
1922  *
1923  * Since setuid only affects the current process, and since the SELinux
1924  * controls are not based on the Linux identity attributes, SELinux does not
1925  * need to control this operation.  However, SELinux does control the use of
1926  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1927  */
1928
1929 static int selinux_capable(struct task_struct *tsk, const struct cred *cred,
1930                            int cap, int audit)
1931 {
1932         int rc;
1933
1934         rc = cap_capable(tsk, cred, cap, audit);
1935         if (rc)
1936                 return rc;
1937
1938         return task_has_capability(tsk, cred, cap, audit);
1939 }
1940
1941 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1942 {
1943         int buflen, rc;
1944         char *buffer, *path, *end;
1945
1946         rc = -ENOMEM;
1947         buffer = (char *)__get_free_page(GFP_KERNEL);
1948         if (!buffer)
1949                 goto out;
1950
1951         buflen = PAGE_SIZE;
1952         end = buffer+buflen;
1953         *--end = '\0';
1954         buflen--;
1955         path = end-1;
1956         *path = '/';
1957         while (table) {
1958                 const char *name = table->procname;
1959                 size_t namelen = strlen(name);
1960                 buflen -= namelen + 1;
1961                 if (buflen < 0)
1962                         goto out_free;
1963                 end -= namelen;
1964                 memcpy(end, name, namelen);
1965                 *--end = '/';
1966                 path = end;
1967                 table = table->parent;
1968         }
1969         buflen -= 4;
1970         if (buflen < 0)
1971                 goto out_free;
1972         end -= 4;
1973         memcpy(end, "/sys", 4);
1974         path = end;
1975         rc = security_genfs_sid("proc", path, tclass, sid);
1976 out_free:
1977         free_page((unsigned long)buffer);
1978 out:
1979         return rc;
1980 }
1981
1982 static int selinux_sysctl(ctl_table *table, int op)
1983 {
1984         int error = 0;
1985         u32 av;
1986         u32 tsid, sid;
1987         int rc;
1988
1989         sid = current_sid();
1990
1991         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1992                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1993         if (rc) {
1994                 /* Default to the well-defined sysctl SID. */
1995                 tsid = SECINITSID_SYSCTL;
1996         }
1997
1998         /* The op values are "defined" in sysctl.c, thereby creating
1999          * a bad coupling between this module and sysctl.c */
2000         if (op == 001) {
2001                 error = avc_has_perm(sid, tsid,
2002                                      SECCLASS_DIR, DIR__SEARCH, NULL);
2003         } else {
2004                 av = 0;
2005                 if (op & 004)
2006                         av |= FILE__READ;
2007                 if (op & 002)
2008                         av |= FILE__WRITE;
2009                 if (av)
2010                         error = avc_has_perm(sid, tsid,
2011                                              SECCLASS_FILE, av, NULL);
2012         }
2013
2014         return error;
2015 }
2016
2017 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2018 {
2019         const struct cred *cred = current_cred();
2020         int rc = 0;
2021
2022         if (!sb)
2023                 return 0;
2024
2025         switch (cmds) {
2026         case Q_SYNC:
2027         case Q_QUOTAON:
2028         case Q_QUOTAOFF:
2029         case Q_SETINFO:
2030         case Q_SETQUOTA:
2031                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2032                 break;
2033         case Q_GETFMT:
2034         case Q_GETINFO:
2035         case Q_GETQUOTA:
2036                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2037                 break;
2038         default:
2039                 rc = 0;  /* let the kernel handle invalid cmds */
2040                 break;
2041         }
2042         return rc;
2043 }
2044
2045 static int selinux_quota_on(struct dentry *dentry)
2046 {
2047         const struct cred *cred = current_cred();
2048
2049         return dentry_has_perm(cred, NULL, dentry, FILE__QUOTAON);
2050 }
2051
2052 static int selinux_syslog(int type)
2053 {
2054         int rc;
2055
2056         rc = cap_syslog(type);
2057         if (rc)
2058                 return rc;
2059
2060         switch (type) {
2061         case 3:         /* Read last kernel messages */
2062         case 10:        /* Return size of the log buffer */
2063                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2064                 break;
2065         case 6:         /* Disable logging to console */
2066         case 7:         /* Enable logging to console */
2067         case 8:         /* Set level of messages printed to console */
2068                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2069                 break;
2070         case 0:         /* Close log */
2071         case 1:         /* Open log */
2072         case 2:         /* Read from log */
2073         case 4:         /* Read/clear last kernel messages */
2074         case 5:         /* Clear ring buffer */
2075         default:
2076                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2077                 break;
2078         }
2079         return rc;
2080 }
2081
2082 /*
2083  * Check that a process has enough memory to allocate a new virtual
2084  * mapping. 0 means there is enough memory for the allocation to
2085  * succeed and -ENOMEM implies there is not.
2086  *
2087  * Do not audit the selinux permission check, as this is applied to all
2088  * processes that allocate mappings.
2089  */
2090 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2091 {
2092         int rc, cap_sys_admin = 0;
2093
2094         rc = selinux_capable(current, current_cred(), CAP_SYS_ADMIN,
2095                              SECURITY_CAP_NOAUDIT);
2096         if (rc == 0)
2097                 cap_sys_admin = 1;
2098
2099         return __vm_enough_memory(mm, pages, cap_sys_admin);
2100 }
2101
2102 /* binprm security operations */
2103
2104 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2105 {
2106         const struct task_security_struct *old_tsec;
2107         struct task_security_struct *new_tsec;
2108         struct inode_security_struct *isec;
2109         struct common_audit_data ad;
2110         struct inode *inode = bprm->file->f_path.dentry->d_inode;
2111         int rc;
2112
2113         rc = cap_bprm_set_creds(bprm);
2114         if (rc)
2115                 return rc;
2116
2117         /* SELinux context only depends on initial program or script and not
2118          * the script interpreter */
2119         if (bprm->cred_prepared)
2120                 return 0;
2121
2122         old_tsec = current_security();
2123         new_tsec = bprm->cred->security;
2124         isec = inode->i_security;
2125
2126         /* Default to the current task SID. */
2127         new_tsec->sid = old_tsec->sid;
2128         new_tsec->osid = old_tsec->sid;
2129
2130         /* Reset fs, key, and sock SIDs on execve. */
2131         new_tsec->create_sid = 0;
2132         new_tsec->keycreate_sid = 0;
2133         new_tsec->sockcreate_sid = 0;
2134
2135         if (old_tsec->exec_sid) {
2136                 new_tsec->sid = old_tsec->exec_sid;
2137                 /* Reset exec SID on execve. */
2138                 new_tsec->exec_sid = 0;
2139         } else {
2140                 /* Check for a default transition on this program. */
2141                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2142                                              SECCLASS_PROCESS, &new_tsec->sid);
2143                 if (rc)
2144                         return rc;
2145         }
2146
2147         COMMON_AUDIT_DATA_INIT(&ad, FS);
2148         ad.u.fs.path = bprm->file->f_path;
2149
2150         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2151                 new_tsec->sid = old_tsec->sid;
2152
2153         if (new_tsec->sid == old_tsec->sid) {
2154                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2155                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2156                 if (rc)
2157                         return rc;
2158         } else {
2159                 /* Check permissions for the transition. */
2160                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2161                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2162                 if (rc)
2163                         return rc;
2164
2165                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2166                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2167                 if (rc)
2168                         return rc;
2169
2170                 /* Check for shared state */
2171                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2172                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2173                                           SECCLASS_PROCESS, PROCESS__SHARE,
2174                                           NULL);
2175                         if (rc)
2176                                 return -EPERM;
2177                 }
2178
2179                 /* Make sure that anyone attempting to ptrace over a task that
2180                  * changes its SID has the appropriate permit */
2181                 if (bprm->unsafe &
2182                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2183                         struct task_struct *tracer;
2184                         struct task_security_struct *sec;
2185                         u32 ptsid = 0;
2186
2187                         rcu_read_lock();
2188                         tracer = tracehook_tracer_task(current);
2189                         if (likely(tracer != NULL)) {
2190                                 sec = __task_cred(tracer)->security;
2191                                 ptsid = sec->sid;
2192                         }
2193                         rcu_read_unlock();
2194
2195                         if (ptsid != 0) {
2196                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2197                                                   SECCLASS_PROCESS,
2198                                                   PROCESS__PTRACE, NULL);
2199                                 if (rc)
2200                                         return -EPERM;
2201                         }
2202                 }
2203
2204                 /* Clear any possibly unsafe personality bits on exec: */
2205                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2206         }
2207
2208         return 0;
2209 }
2210
2211 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2212 {
2213         const struct cred *cred = current_cred();
2214         const struct task_security_struct *tsec = cred->security;
2215         u32 sid, osid;
2216         int atsecure = 0;
2217
2218         sid = tsec->sid;
2219         osid = tsec->osid;
2220
2221         if (osid != sid) {
2222                 /* Enable secure mode for SIDs transitions unless
2223                    the noatsecure permission is granted between
2224                    the two SIDs, i.e. ahp returns 0. */
2225                 atsecure = avc_has_perm(osid, sid,
2226                                         SECCLASS_PROCESS,
2227                                         PROCESS__NOATSECURE, NULL);
2228         }
2229
2230         return (atsecure || cap_bprm_secureexec(bprm));
2231 }
2232
2233 extern struct vfsmount *selinuxfs_mount;
2234 extern struct dentry *selinux_null;
2235
2236 /* Derived from fs/exec.c:flush_old_files. */
2237 static inline void flush_unauthorized_files(const struct cred *cred,
2238                                             struct files_struct *files)
2239 {
2240         struct common_audit_data ad;
2241         struct file *file, *devnull = NULL;
2242         struct tty_struct *tty;
2243         struct fdtable *fdt;
2244         long j = -1;
2245         int drop_tty = 0;
2246
2247         tty = get_current_tty();
2248         if (tty) {
2249                 file_list_lock();
2250                 if (!list_empty(&tty->tty_files)) {
2251                         struct inode *inode;
2252
2253                         /* Revalidate access to controlling tty.
2254                            Use inode_has_perm on the tty inode directly rather
2255                            than using file_has_perm, as this particular open
2256                            file may belong to another process and we are only
2257                            interested in the inode-based check here. */
2258                         file = list_first_entry(&tty->tty_files, struct file, f_u.fu_list);
2259                         inode = file->f_path.dentry->d_inode;
2260                         if (inode_has_perm(cred, inode,
2261                                            FILE__READ | FILE__WRITE, NULL)) {
2262                                 drop_tty = 1;
2263                         }
2264                 }
2265                 file_list_unlock();
2266                 tty_kref_put(tty);
2267         }
2268         /* Reset controlling tty. */
2269         if (drop_tty)
2270                 no_tty();
2271
2272         /* Revalidate access to inherited open files. */
2273
2274         COMMON_AUDIT_DATA_INIT(&ad, FS);
2275
2276         spin_lock(&files->file_lock);
2277         for (;;) {
2278                 unsigned long set, i;
2279                 int fd;
2280
2281                 j++;
2282                 i = j * __NFDBITS;
2283                 fdt = files_fdtable(files);
2284                 if (i >= fdt->max_fds)
2285                         break;
2286                 set = fdt->open_fds->fds_bits[j];
2287                 if (!set)
2288                         continue;
2289                 spin_unlock(&files->file_lock);
2290                 for ( ; set ; i++, set >>= 1) {
2291                         if (set & 1) {
2292                                 file = fget(i);
2293                                 if (!file)
2294                                         continue;
2295                                 if (file_has_perm(cred,
2296                                                   file,
2297                                                   file_to_av(file))) {
2298                                         sys_close(i);
2299                                         fd = get_unused_fd();
2300                                         if (fd != i) {
2301                                                 if (fd >= 0)
2302                                                         put_unused_fd(fd);
2303                                                 fput(file);
2304                                                 continue;
2305                                         }
2306                                         if (devnull) {
2307                                                 get_file(devnull);
2308                                         } else {
2309                                                 devnull = dentry_open(
2310                                                         dget(selinux_null),
2311                                                         mntget(selinuxfs_mount),
2312                                                         O_RDWR, cred);
2313                                                 if (IS_ERR(devnull)) {
2314                                                         devnull = NULL;
2315                                                         put_unused_fd(fd);
2316                                                         fput(file);
2317                                                         continue;
2318                                                 }
2319                                         }
2320                                         fd_install(fd, devnull);
2321                                 }
2322                                 fput(file);
2323                         }
2324                 }
2325                 spin_lock(&files->file_lock);
2326
2327         }
2328         spin_unlock(&files->file_lock);
2329 }
2330
2331 /*
2332  * Prepare a process for imminent new credential changes due to exec
2333  */
2334 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2335 {
2336         struct task_security_struct *new_tsec;
2337         struct rlimit *rlim, *initrlim;
2338         int rc, i;
2339
2340         new_tsec = bprm->cred->security;
2341         if (new_tsec->sid == new_tsec->osid)
2342                 return;
2343
2344         /* Close files for which the new task SID is not authorized. */
2345         flush_unauthorized_files(bprm->cred, current->files);
2346
2347         /* Always clear parent death signal on SID transitions. */
2348         current->pdeath_signal = 0;
2349
2350         /* Check whether the new SID can inherit resource limits from the old
2351          * SID.  If not, reset all soft limits to the lower of the current
2352          * task's hard limit and the init task's soft limit.
2353          *
2354          * Note that the setting of hard limits (even to lower them) can be
2355          * controlled by the setrlimit check.  The inclusion of the init task's
2356          * soft limit into the computation is to avoid resetting soft limits
2357          * higher than the default soft limit for cases where the default is
2358          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2359          */
2360         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2361                           PROCESS__RLIMITINH, NULL);
2362         if (rc) {
2363                 for (i = 0; i < RLIM_NLIMITS; i++) {
2364                         rlim = current->signal->rlim + i;
2365                         initrlim = init_task.signal->rlim + i;
2366                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2367                 }
2368                 update_rlimit_cpu(rlim->rlim_cur);
2369         }
2370 }
2371
2372 /*
2373  * Clean up the process immediately after the installation of new credentials
2374  * due to exec
2375  */
2376 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2377 {
2378         const struct task_security_struct *tsec = current_security();
2379         struct itimerval itimer;
2380         u32 osid, sid;
2381         int rc, i;
2382
2383         osid = tsec->osid;
2384         sid = tsec->sid;
2385
2386         if (sid == osid)
2387                 return;
2388
2389         /* Check whether the new SID can inherit signal state from the old SID.
2390          * If not, clear itimers to avoid subsequent signal generation and
2391          * flush and unblock signals.
2392          *
2393          * This must occur _after_ the task SID has been updated so that any
2394          * kill done after the flush will be checked against the new SID.
2395          */
2396         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2397         if (rc) {
2398                 memset(&itimer, 0, sizeof itimer);
2399                 for (i = 0; i < 3; i++)
2400                         do_setitimer(i, &itimer, NULL);
2401                 spin_lock_irq(&current->sighand->siglock);
2402                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2403                         __flush_signals(current);
2404                         flush_signal_handlers(current, 1);
2405                         sigemptyset(&current->blocked);
2406                 }
2407                 spin_unlock_irq(&current->sighand->siglock);
2408         }
2409
2410         /* Wake up the parent if it is waiting so that it can recheck
2411          * wait permission to the new task SID. */
2412         read_lock(&tasklist_lock);
2413         __wake_up_parent(current, current->real_parent);
2414         read_unlock(&tasklist_lock);
2415 }
2416
2417 /* superblock security operations */
2418
2419 static int selinux_sb_alloc_security(struct super_block *sb)
2420 {
2421         return superblock_alloc_security(sb);
2422 }
2423
2424 static void selinux_sb_free_security(struct super_block *sb)
2425 {
2426         superblock_free_security(sb);
2427 }
2428
2429 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2430 {
2431         if (plen > olen)
2432                 return 0;
2433
2434         return !memcmp(prefix, option, plen);
2435 }
2436
2437 static inline int selinux_option(char *option, int len)
2438 {
2439         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2440                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2441                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2442                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2443                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2444 }
2445
2446 static inline void take_option(char **to, char *from, int *first, int len)
2447 {
2448         if (!*first) {
2449                 **to = ',';
2450                 *to += 1;
2451         } else
2452                 *first = 0;
2453         memcpy(*to, from, len);
2454         *to += len;
2455 }
2456
2457 static inline void take_selinux_option(char **to, char *from, int *first,
2458                                        int len)
2459 {
2460         int current_size = 0;
2461
2462         if (!*first) {
2463                 **to = '|';
2464                 *to += 1;
2465         } else
2466                 *first = 0;
2467
2468         while (current_size < len) {
2469                 if (*from != '"') {
2470                         **to = *from;
2471                         *to += 1;
2472                 }
2473                 from += 1;
2474                 current_size += 1;
2475         }
2476 }
2477
2478 static int selinux_sb_copy_data(char *orig, char *copy)
2479 {
2480         int fnosec, fsec, rc = 0;
2481         char *in_save, *in_curr, *in_end;
2482         char *sec_curr, *nosec_save, *nosec;
2483         int open_quote = 0;
2484
2485         in_curr = orig;
2486         sec_curr = copy;
2487
2488         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2489         if (!nosec) {
2490                 rc = -ENOMEM;
2491                 goto out;
2492         }
2493
2494         nosec_save = nosec;
2495         fnosec = fsec = 1;
2496         in_save = in_end = orig;
2497
2498         do {
2499                 if (*in_end == '"')
2500                         open_quote = !open_quote;
2501                 if ((*in_end == ',' && open_quote == 0) ||
2502                                 *in_end == '\0') {
2503                         int len = in_end - in_curr;
2504
2505                         if (selinux_option(in_curr, len))
2506                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2507                         else
2508                                 take_option(&nosec, in_curr, &fnosec, len);
2509
2510                         in_curr = in_end + 1;
2511                 }
2512         } while (*in_end++);
2513
2514         strcpy(in_save, nosec_save);
2515         free_page((unsigned long)nosec_save);
2516 out:
2517         return rc;
2518 }
2519
2520 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2521 {
2522         const struct cred *cred = current_cred();
2523         struct common_audit_data ad;
2524         int rc;
2525
2526         rc = superblock_doinit(sb, data);
2527         if (rc)
2528                 return rc;
2529
2530         /* Allow all mounts performed by the kernel */
2531         if (flags & MS_KERNMOUNT)
2532                 return 0;
2533
2534         COMMON_AUDIT_DATA_INIT(&ad, FS);
2535         ad.u.fs.path.dentry = sb->s_root;
2536         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2537 }
2538
2539 static int selinux_sb_statfs(struct dentry *dentry)
2540 {
2541         const struct cred *cred = current_cred();
2542         struct common_audit_data ad;
2543
2544         COMMON_AUDIT_DATA_INIT(&ad, FS);
2545         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2546         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2547 }
2548
2549 static int selinux_mount(char *dev_name,
2550                          struct path *path,
2551                          char *type,
2552                          unsigned long flags,
2553                          void *data)
2554 {
2555         const struct cred *cred = current_cred();
2556
2557         if (flags & MS_REMOUNT)
2558                 return superblock_has_perm(cred, path->mnt->mnt_sb,
2559                                            FILESYSTEM__REMOUNT, NULL);
2560         else
2561                 return dentry_has_perm(cred, path->mnt, path->dentry,
2562                                        FILE__MOUNTON);
2563 }
2564
2565 static int selinux_umount(struct vfsmount *mnt, int flags)
2566 {
2567         const struct cred *cred = current_cred();
2568
2569         return superblock_has_perm(cred, mnt->mnt_sb,
2570                                    FILESYSTEM__UNMOUNT, NULL);
2571 }
2572
2573 /* inode security operations */
2574
2575 static int selinux_inode_alloc_security(struct inode *inode)
2576 {
2577         return inode_alloc_security(inode);
2578 }
2579
2580 static void selinux_inode_free_security(struct inode *inode)
2581 {
2582         inode_free_security(inode);
2583 }
2584
2585 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2586                                        char **name, void **value,
2587                                        size_t *len)
2588 {
2589         const struct cred *cred = current_cred();
2590         const struct task_security_struct *tsec = cred->security;
2591         struct inode_security_struct *dsec;
2592         struct superblock_security_struct *sbsec;
2593         u32 sid, newsid, clen;
2594         int rc;
2595         char *namep = NULL, *context;
2596
2597         dsec = dir->i_security;
2598         sbsec = dir->i_sb->s_security;
2599
2600         sid = tsec->sid;
2601         newsid = tsec->create_sid;
2602
2603         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2604                 rc = security_transition_sid(sid, dsec->sid,
2605                                              inode_mode_to_security_class(inode->i_mode),
2606                                              &newsid);
2607                 if (rc) {
2608                         printk(KERN_WARNING "%s:  "
2609                                "security_transition_sid failed, rc=%d (dev=%s "
2610                                "ino=%ld)\n",
2611                                __func__,
2612                                -rc, inode->i_sb->s_id, inode->i_ino);
2613                         return rc;
2614                 }
2615         }
2616
2617         /* Possibly defer initialization to selinux_complete_init. */
2618         if (sbsec->flags & SE_SBINITIALIZED) {
2619                 struct inode_security_struct *isec = inode->i_security;
2620                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2621                 isec->sid = newsid;
2622                 isec->initialized = 1;
2623         }
2624
2625         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2626                 return -EOPNOTSUPP;
2627
2628         if (name) {
2629                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2630                 if (!namep)
2631                         return -ENOMEM;
2632                 *name = namep;
2633         }
2634
2635         if (value && len) {
2636                 rc = security_sid_to_context_force(newsid, &context, &clen);
2637                 if (rc) {
2638                         kfree(namep);
2639                         return rc;
2640                 }
2641                 *value = context;
2642                 *len = clen;
2643         }
2644
2645         return 0;
2646 }
2647
2648 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2649 {
2650         return may_create(dir, dentry, SECCLASS_FILE);
2651 }
2652
2653 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2654 {
2655         return may_link(dir, old_dentry, MAY_LINK);
2656 }
2657
2658 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2659 {
2660         return may_link(dir, dentry, MAY_UNLINK);
2661 }
2662
2663 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2664 {
2665         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2666 }
2667
2668 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2669 {
2670         return may_create(dir, dentry, SECCLASS_DIR);
2671 }
2672
2673 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2674 {
2675         return may_link(dir, dentry, MAY_RMDIR);
2676 }
2677
2678 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2679 {
2680         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2681 }
2682
2683 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2684                                 struct inode *new_inode, struct dentry *new_dentry)
2685 {
2686         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2687 }
2688
2689 static int selinux_inode_readlink(struct dentry *dentry)
2690 {
2691         const struct cred *cred = current_cred();
2692
2693         return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2694 }
2695
2696 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2697 {
2698         const struct cred *cred = current_cred();
2699
2700         return dentry_has_perm(cred, NULL, dentry, FILE__READ);
2701 }
2702
2703 static int selinux_inode_permission(struct inode *inode, int mask)
2704 {
2705         const struct cred *cred = current_cred();
2706
2707         if (!mask) {
2708                 /* No permission to check.  Existence test. */
2709                 return 0;
2710         }
2711
2712         return inode_has_perm(cred, inode,
2713                               file_mask_to_av(inode->i_mode, mask), NULL);
2714 }
2715
2716 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2717 {
2718         const struct cred *cred = current_cred();
2719         unsigned int ia_valid = iattr->ia_valid;
2720
2721         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2722         if (ia_valid & ATTR_FORCE) {
2723                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2724                               ATTR_FORCE);
2725                 if (!ia_valid)
2726                         return 0;
2727         }
2728
2729         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2730                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2731                 return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2732
2733         return dentry_has_perm(cred, NULL, dentry, FILE__WRITE);
2734 }
2735
2736 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2737 {
2738         const struct cred *cred = current_cred();
2739
2740         return dentry_has_perm(cred, mnt, dentry, FILE__GETATTR);
2741 }
2742
2743 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2744 {
2745         const struct cred *cred = current_cred();
2746
2747         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2748                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2749                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2750                         if (!capable(CAP_SETFCAP))
2751                                 return -EPERM;
2752                 } else if (!capable(CAP_SYS_ADMIN)) {
2753                         /* A different attribute in the security namespace.
2754                            Restrict to administrator. */
2755                         return -EPERM;
2756                 }
2757         }
2758
2759         /* Not an attribute we recognize, so just check the
2760            ordinary setattr permission. */
2761         return dentry_has_perm(cred, NULL, dentry, FILE__SETATTR);
2762 }
2763
2764 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2765                                   const void *value, size_t size, int flags)
2766 {
2767         struct inode *inode = dentry->d_inode;
2768         struct inode_security_struct *isec = inode->i_security;
2769         struct superblock_security_struct *sbsec;
2770         struct common_audit_data ad;
2771         u32 newsid, sid = current_sid();
2772         int rc = 0;
2773
2774         if (strcmp(name, XATTR_NAME_SELINUX))
2775                 return selinux_inode_setotherxattr(dentry, name);
2776
2777         sbsec = inode->i_sb->s_security;
2778         if (!(sbsec->flags & SE_SBLABELSUPP))
2779                 return -EOPNOTSUPP;
2780
2781         if (!is_owner_or_cap(inode))
2782                 return -EPERM;
2783
2784         COMMON_AUDIT_DATA_INIT(&ad, FS);
2785         ad.u.fs.path.dentry = dentry;
2786
2787         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2788                           FILE__RELABELFROM, &ad);
2789         if (rc)
2790                 return rc;
2791
2792         rc = security_context_to_sid(value, size, &newsid);
2793         if (rc == -EINVAL) {
2794                 if (!capable(CAP_MAC_ADMIN))
2795                         return rc;
2796                 rc = security_context_to_sid_force(value, size, &newsid);
2797         }
2798         if (rc)
2799                 return rc;
2800
2801         rc = avc_has_perm(sid, newsid, isec->sclass,
2802                           FILE__RELABELTO, &ad);
2803         if (rc)
2804                 return rc;
2805
2806         rc = security_validate_transition(isec->sid, newsid, sid,
2807                                           isec->sclass);
2808         if (rc)
2809                 return rc;
2810
2811         return avc_has_perm(newsid,
2812                             sbsec->sid,
2813                             SECCLASS_FILESYSTEM,
2814                             FILESYSTEM__ASSOCIATE,
2815                             &ad);
2816 }
2817
2818 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2819                                         const void *value, size_t size,
2820                                         int flags)
2821 {
2822         struct inode *inode = dentry->d_inode;
2823         struct inode_security_struct *isec = inode->i_security;
2824         u32 newsid;
2825         int rc;
2826
2827         if (strcmp(name, XATTR_NAME_SELINUX)) {
2828                 /* Not an attribute we recognize, so nothing to do. */
2829                 return;
2830         }
2831
2832         rc = security_context_to_sid_force(value, size, &newsid);
2833         if (rc) {
2834                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2835                        "for (%s, %lu), rc=%d\n",
2836                        inode->i_sb->s_id, inode->i_ino, -rc);
2837                 return;
2838         }
2839
2840         isec->sid = newsid;
2841         return;
2842 }
2843
2844 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2845 {
2846         const struct cred *cred = current_cred();
2847
2848         return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2849 }
2850
2851 static int selinux_inode_listxattr(struct dentry *dentry)
2852 {
2853         const struct cred *cred = current_cred();
2854
2855         return dentry_has_perm(cred, NULL, dentry, FILE__GETATTR);
2856 }
2857
2858 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2859 {
2860         if (strcmp(name, XATTR_NAME_SELINUX))
2861                 return selinux_inode_setotherxattr(dentry, name);
2862
2863         /* No one is allowed to remove a SELinux security label.
2864            You can change the label, but all data must be labeled. */
2865         return -EACCES;
2866 }
2867
2868 /*
2869  * Copy the inode security context value to the user.
2870  *
2871  * Permission check is handled by selinux_inode_getxattr hook.
2872  */
2873 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2874 {
2875         u32 size;
2876         int error;
2877         char *context = NULL;
2878         struct inode_security_struct *isec = inode->i_security;
2879
2880         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2881                 return -EOPNOTSUPP;
2882
2883         /*
2884          * If the caller has CAP_MAC_ADMIN, then get the raw context
2885          * value even if it is not defined by current policy; otherwise,
2886          * use the in-core value under current policy.
2887          * Use the non-auditing forms of the permission checks since
2888          * getxattr may be called by unprivileged processes commonly
2889          * and lack of permission just means that we fall back to the
2890          * in-core context value, not a denial.
2891          */
2892         error = selinux_capable(current, current_cred(), CAP_MAC_ADMIN,
2893                                 SECURITY_CAP_NOAUDIT);
2894         if (!error)
2895                 error = security_sid_to_context_force(isec->sid, &context,
2896                                                       &size);
2897         else
2898                 error = security_sid_to_context(isec->sid, &context, &size);
2899         if (error)
2900                 return error;
2901         error = size;
2902         if (alloc) {
2903                 *buffer = context;
2904                 goto out_nofree;
2905         }
2906         kfree(context);
2907 out_nofree:
2908         return error;
2909 }
2910
2911 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2912                                      const void *value, size_t size, int flags)
2913 {
2914         struct inode_security_struct *isec = inode->i_security;
2915         u32 newsid;
2916         int rc;
2917
2918         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2919                 return -EOPNOTSUPP;
2920
2921         if (!value || !size)
2922                 return -EACCES;
2923
2924         rc = security_context_to_sid((void *)value, size, &newsid);
2925         if (rc)
2926                 return rc;
2927
2928         isec->sid = newsid;
2929         isec->initialized = 1;
2930         return 0;
2931 }
2932
2933 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2934 {
2935         const int len = sizeof(XATTR_NAME_SELINUX);
2936         if (buffer && len <= buffer_size)
2937                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2938         return len;
2939 }
2940
2941 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2942 {
2943         struct inode_security_struct *isec = inode->i_security;
2944         *secid = isec->sid;
2945 }
2946
2947 /* file security operations */
2948
2949 static int selinux_revalidate_file_permission(struct file *file, int mask)
2950 {
2951         const struct cred *cred = current_cred();
2952         struct inode *inode = file->f_path.dentry->d_inode;
2953
2954         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2955         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2956                 mask |= MAY_APPEND;
2957
2958         return file_has_perm(cred, file,
2959                              file_mask_to_av(inode->i_mode, mask));
2960 }
2961
2962 static int selinux_file_permission(struct file *file, int mask)
2963 {
2964         struct inode *inode = file->f_path.dentry->d_inode;
2965         struct file_security_struct *fsec = file->f_security;
2966         struct inode_security_struct *isec = inode->i_security;
2967         u32 sid = current_sid();
2968
2969         if (!mask)
2970                 /* No permission to check.  Existence test. */
2971                 return 0;
2972
2973         if (sid == fsec->sid && fsec->isid == isec->sid &&
2974             fsec->pseqno == avc_policy_seqno())
2975                 /* No change since dentry_open check. */
2976                 return 0;
2977
2978         return selinux_revalidate_file_permission(file, mask);
2979 }
2980
2981 static int selinux_file_alloc_security(struct file *file)
2982 {
2983         return file_alloc_security(file);
2984 }
2985
2986 static void selinux_file_free_security(struct file *file)
2987 {
2988         file_free_security(file);
2989 }
2990
2991 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2992                               unsigned long arg)
2993 {
2994         const struct cred *cred = current_cred();
2995         u32 av = 0;
2996
2997         if (_IOC_DIR(cmd) & _IOC_WRITE)
2998                 av |= FILE__WRITE;
2999         if (_IOC_DIR(cmd) & _IOC_READ)
3000                 av |= FILE__READ;
3001         if (!av)
3002                 av = FILE__IOCTL;
3003
3004         return file_has_perm(cred, file, av);
3005 }
3006
3007 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3008 {
3009         const struct cred *cred = current_cred();
3010         int rc = 0;
3011
3012 #ifndef CONFIG_PPC32
3013         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3014                 /*
3015                  * We are making executable an anonymous mapping or a
3016                  * private file mapping that will also be writable.
3017                  * This has an additional check.
3018                  */
3019                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3020                 if (rc)
3021                         goto error;
3022         }
3023 #endif
3024
3025         if (file) {
3026                 /* read access is always possible with a mapping */
3027                 u32 av = FILE__READ;
3028
3029                 /* write access only matters if the mapping is shared */
3030                 if (shared && (prot & PROT_WRITE))
3031                         av |= FILE__WRITE;
3032
3033                 if (prot & PROT_EXEC)
3034                         av |= FILE__EXECUTE;
3035
3036                 return file_has_perm(cred, file, av);
3037         }
3038
3039 error:
3040         return rc;
3041 }
3042
3043 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
3044                              unsigned long prot, unsigned long flags,
3045                              unsigned long addr, unsigned long addr_only)
3046 {
3047         int rc = 0;
3048         u32 sid = current_sid();
3049
3050         /*
3051          * notice that we are intentionally putting the SELinux check before
3052          * the secondary cap_file_mmap check.  This is such a likely attempt
3053          * at bad behaviour/exploit that we always want to get the AVC, even
3054          * if DAC would have also denied the operation.
3055          */
3056         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3057                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3058                                   MEMPROTECT__MMAP_ZERO, NULL);
3059                 if (rc)
3060                         return rc;
3061         }
3062
3063         /* do DAC check on address space usage */
3064         rc = cap_file_mmap(file, reqprot, prot, flags, addr, addr_only);
3065         if (rc || addr_only)
3066                 return rc;
3067
3068         if (selinux_checkreqprot)
3069                 prot = reqprot;
3070
3071         return file_map_prot_check(file, prot,
3072                                    (flags & MAP_TYPE) == MAP_SHARED);
3073 }
3074
3075 static int selinux_file_mprotect(struct vm_area_struct *vma,
3076                                  unsigned long reqprot,
3077                                  unsigned long prot)
3078 {
3079         const struct cred *cred = current_cred();
3080
3081         if (selinux_checkreqprot)
3082                 prot = reqprot;
3083
3084 #ifndef CONFIG_PPC32
3085         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3086                 int rc = 0;
3087                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3088                     vma->vm_end <= vma->vm_mm->brk) {
3089                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3090                 } else if (!vma->vm_file &&
3091                            vma->vm_start <= vma->vm_mm->start_stack &&
3092                            vma->vm_end >= vma->vm_mm->start_stack) {
3093                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3094                 } else if (vma->vm_file && vma->anon_vma) {
3095                         /*
3096                          * We are making executable a file mapping that has
3097                          * had some COW done. Since pages might have been
3098                          * written, check ability to execute the possibly
3099                          * modified content.  This typically should only
3100                          * occur for text relocations.
3101                          */
3102                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3103                 }
3104                 if (rc)
3105                         return rc;
3106         }
3107 #endif
3108
3109         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3110 }
3111
3112 static int selinux_file_lock(struct file *file, unsigned int cmd)
3113 {
3114         const struct cred *cred = current_cred();
3115
3116         return file_has_perm(cred, file, FILE__LOCK);
3117 }
3118
3119 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3120                               unsigned long arg)
3121 {
3122         const struct cred *cred = current_cred();
3123         int err = 0;
3124
3125         switch (cmd) {
3126         case F_SETFL:
3127                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3128                         err = -EINVAL;
3129                         break;
3130                 }
3131
3132                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3133                         err = file_has_perm(cred, file, FILE__WRITE);
3134                         break;
3135                 }
3136                 /* fall through */
3137         case F_SETOWN:
3138         case F_SETSIG:
3139         case F_GETFL:
3140         case F_GETOWN:
3141         case F_GETSIG:
3142                 /* Just check FD__USE permission */
3143                 err = file_has_perm(cred, file, 0);
3144                 break;
3145         case F_GETLK:
3146         case F_SETLK:
3147         case F_SETLKW:
3148 #if BITS_PER_LONG == 32
3149         case F_GETLK64:
3150         case F_SETLK64:
3151         case F_SETLKW64:
3152 #endif
3153                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3154                         err = -EINVAL;
3155                         break;
3156                 }
3157                 err = file_has_perm(cred, file, FILE__LOCK);
3158                 break;
3159         }
3160
3161         return err;
3162 }
3163
3164 static int selinux_file_set_fowner(struct file *file)
3165 {
3166         struct file_security_struct *fsec;
3167
3168         fsec = file->f_security;
3169         fsec->fown_sid = current_sid();
3170
3171         return 0;
3172 }
3173
3174 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3175                                        struct fown_struct *fown, int signum)
3176 {
3177         struct file *file;
3178         u32 sid = task_sid(tsk);
3179         u32 perm;
3180         struct file_security_struct *fsec;
3181
3182         /* struct fown_struct is never outside the context of a struct file */
3183         file = container_of(fown, struct file, f_owner);
3184
3185         fsec = file->f_security;
3186
3187         if (!signum)
3188                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3189         else
3190                 perm = signal_to_av(signum);
3191
3192         return avc_has_perm(fsec->fown_sid, sid,
3193                             SECCLASS_PROCESS, perm, NULL);
3194 }
3195
3196 static int selinux_file_receive(struct file *file)
3197 {
3198         const struct cred *cred = current_cred();
3199
3200         return file_has_perm(cred, file, file_to_av(file));
3201 }
3202
3203 static int selinux_dentry_open(struct file *file, const struct cred *cred)
3204 {
3205         struct file_security_struct *fsec;
3206         struct inode *inode;
3207         struct inode_security_struct *isec;
3208
3209         inode = file->f_path.dentry->d_inode;
3210         fsec = file->f_security;
3211         isec = inode->i_security;
3212         /*
3213          * Save inode label and policy sequence number
3214          * at open-time so that selinux_file_permission
3215          * can determine whether revalidation is necessary.
3216          * Task label is already saved in the file security
3217          * struct as its SID.
3218          */
3219         fsec->isid = isec->sid;
3220         fsec->pseqno = avc_policy_seqno();
3221         /*
3222          * Since the inode label or policy seqno may have changed
3223          * between the selinux_inode_permission check and the saving
3224          * of state above, recheck that access is still permitted.
3225          * Otherwise, access might never be revalidated against the
3226          * new inode label or new policy.
3227          * This check is not redundant - do not remove.
3228          */
3229         return inode_has_perm(cred, inode, open_file_to_av(file), NULL);
3230 }
3231
3232 /* task security operations */
3233
3234 static int selinux_task_create(unsigned long clone_flags)
3235 {
3236         return current_has_perm(current, PROCESS__FORK);
3237 }
3238
3239 /*
3240  * allocate the SELinux part of blank credentials
3241  */
3242 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3243 {
3244         struct task_security_struct *tsec;
3245
3246         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3247         if (!tsec)
3248                 return -ENOMEM;
3249
3250         cred->security = tsec;
3251         return 0;
3252 }
3253
3254 /*
3255  * detach and free the LSM part of a set of credentials
3256  */
3257 static void selinux_cred_free(struct cred *cred)
3258 {
3259         struct task_security_struct *tsec = cred->security;
3260
3261         BUG_ON((unsigned long) cred->security < PAGE_SIZE);
3262         cred->security = (void *) 0x7UL;
3263         kfree(tsec);
3264 }
3265
3266 /*
3267  * prepare a new set of credentials for modification
3268  */
3269 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3270                                 gfp_t gfp)
3271 {
3272         const struct task_security_struct *old_tsec;
3273         struct task_security_struct *tsec;
3274
3275         old_tsec = old->security;
3276
3277         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3278         if (!tsec)
3279                 return -ENOMEM;
3280
3281         new->security = tsec;
3282         return 0;
3283 }
3284
3285 /*
3286  * transfer the SELinux data to a blank set of creds
3287  */
3288 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3289 {
3290         const struct task_security_struct *old_tsec = old->security;
3291         struct task_security_struct *tsec = new->security;
3292
3293         *tsec = *old_tsec;
3294 }
3295
3296 /*
3297  * set the security data for a kernel service
3298  * - all the creation contexts are set to unlabelled
3299  */
3300 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3301 {
3302         struct task_security_struct *tsec = new->security;
3303         u32 sid = current_sid();
3304         int ret;
3305
3306         ret = avc_has_perm(sid, secid,
3307                            SECCLASS_KERNEL_SERVICE,
3308                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3309                            NULL);
3310         if (ret == 0) {
3311                 tsec->sid = secid;
3312                 tsec->create_sid = 0;
3313                 tsec->keycreate_sid = 0;
3314                 tsec->sockcreate_sid = 0;
3315         }
3316         return ret;
3317 }
3318
3319 /*
3320  * set the file creation context in a security record to the same as the
3321  * objective context of the specified inode
3322  */
3323 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3324 {
3325         struct inode_security_struct *isec = inode->i_security;
3326         struct task_security_struct *tsec = new->security;
3327         u32 sid = current_sid();
3328         int ret;
3329
3330         ret = avc_has_perm(sid, isec->sid,
3331                            SECCLASS_KERNEL_SERVICE,
3332                            KERNEL_SERVICE__CREATE_FILES_AS,
3333                            NULL);
3334
3335         if (ret == 0)
3336                 tsec->create_sid = isec->sid;
3337         return 0;
3338 }
3339
3340 static int selinux_kernel_module_request(void)
3341 {
3342         return task_has_system(current, SYSTEM__MODULE_REQUEST);
3343 }
3344
3345 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3346 {
3347         return current_has_perm(p, PROCESS__SETPGID);
3348 }
3349
3350 static int selinux_task_getpgid(struct task_struct *p)
3351 {
3352         return current_has_perm(p, PROCESS__GETPGID);
3353 }
3354
3355 static int selinux_task_getsid(struct task_struct *p)
3356 {
3357         return current_has_perm(p, PROCESS__GETSESSION);
3358 }
3359
3360 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3361 {
3362         *secid = task_sid(p);
3363 }
3364
3365 static int selinux_task_setnice(struct task_struct *p, int nice)
3366 {
3367         int rc;
3368
3369         rc = cap_task_setnice(p, nice);
3370         if (rc)
3371                 return rc;
3372
3373         return current_has_perm(p, PROCESS__SETSCHED);
3374 }
3375
3376 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3377 {
3378         int rc;
3379
3380         rc = cap_task_setioprio(p, ioprio);
3381         if (rc)
3382                 return rc;
3383
3384         return current_has_perm(p, PROCESS__SETSCHED);
3385 }
3386
3387 static int selinux_task_getioprio(struct task_struct *p)
3388 {
3389         return current_has_perm(p, PROCESS__GETSCHED);
3390 }
3391
3392 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3393 {
3394         struct rlimit *old_rlim = current->signal->rlim + resource;
3395
3396         /* Control the ability to change the hard limit (whether
3397            lowering or raising it), so that the hard limit can
3398            later be used as a safe reset point for the soft limit
3399            upon context transitions.  See selinux_bprm_committing_creds. */
3400         if (old_rlim->rlim_max != new_rlim->rlim_max)
3401                 return current_has_perm(current, PROCESS__SETRLIMIT);
3402
3403         return 0;
3404 }
3405
3406 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3407 {
3408         int rc;
3409
3410         rc = cap_task_setscheduler(p, policy, lp);
3411         if (rc)
3412                 return rc;
3413
3414         return current_has_perm(p, PROCESS__SETSCHED);
3415 }
3416
3417 static int selinux_task_getscheduler(struct task_struct *p)
3418 {
3419         return current_has_perm(p, PROCESS__GETSCHED);
3420 }
3421
3422 static int selinux_task_movememory(struct task_struct *p)
3423 {
3424         return current_has_perm(p, PROCESS__SETSCHED);
3425 }
3426
3427 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3428                                 int sig, u32 secid)
3429 {
3430         u32 perm;
3431         int rc;
3432
3433         if (!sig)
3434                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3435         else
3436                 perm = signal_to_av(sig);
3437         if (secid)
3438                 rc = avc_has_perm(secid, task_sid(p),
3439                                   SECCLASS_PROCESS, perm, NULL);
3440         else
3441                 rc = current_has_perm(p, perm);
3442         return rc;
3443 }
3444
3445 static int selinux_task_wait(struct task_struct *p)
3446 {
3447         return task_has_perm(p, current, PROCESS__SIGCHLD);
3448 }
3449
3450 static void selinux_task_to_inode(struct task_struct *p,
3451                                   struct inode *inode)
3452 {
3453         struct inode_security_struct *isec = inode->i_security;
3454         u32 sid = task_sid(p);
3455
3456         isec->sid = sid;
3457         isec->initialized = 1;
3458 }
3459
3460 /* Returns error only if unable to parse addresses */
3461 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3462                         struct common_audit_data *ad, u8 *proto)
3463 {
3464         int offset, ihlen, ret = -EINVAL;
3465         struct iphdr _iph, *ih;
3466
3467         offset = skb_network_offset(skb);
3468         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3469         if (ih == NULL)
3470                 goto out;
3471
3472         ihlen = ih->ihl * 4;
3473         if (ihlen < sizeof(_iph))
3474                 goto out;
3475
3476         ad->u.net.v4info.saddr = ih->saddr;
3477         ad->u.net.v4info.daddr = ih->daddr;
3478         ret = 0;
3479
3480         if (proto)
3481                 *proto = ih->protocol;
3482
3483         switch (ih->protocol) {
3484         case IPPROTO_TCP: {
3485                 struct tcphdr _tcph, *th;
3486
3487                 if (ntohs(ih->frag_off) & IP_OFFSET)
3488                         break;
3489
3490                 offset += ihlen;
3491                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3492                 if (th == NULL)
3493                         break;
3494
3495                 ad->u.net.sport = th->source;
3496                 ad->u.net.dport = th->dest;
3497                 break;
3498         }
3499
3500         case IPPROTO_UDP: {
3501                 struct udphdr _udph, *uh;
3502
3503                 if (ntohs(ih->frag_off) & IP_OFFSET)
3504                         break;
3505
3506                 offset += ihlen;
3507                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3508                 if (uh == NULL)
3509                         break;
3510
3511                 ad->u.net.sport = uh->source;
3512                 ad->u.net.dport = uh->dest;
3513                 break;
3514         }
3515
3516         case IPPROTO_DCCP: {
3517                 struct dccp_hdr _dccph, *dh;
3518
3519                 if (ntohs(ih->frag_off) & IP_OFFSET)
3520                         break;
3521
3522                 offset += ihlen;
3523                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3524                 if (dh == NULL)
3525                         break;
3526
3527                 ad->u.net.sport = dh->dccph_sport;
3528                 ad->u.net.dport = dh->dccph_dport;
3529                 break;
3530         }
3531
3532         default:
3533                 break;
3534         }
3535 out:
3536         return ret;
3537 }
3538
3539 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3540
3541 /* Returns error only if unable to parse addresses */
3542 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3543                         struct common_audit_data *ad, u8 *proto)
3544 {
3545         u8 nexthdr;
3546         int ret = -EINVAL, offset;
3547         struct ipv6hdr _ipv6h, *ip6;
3548
3549         offset = skb_network_offset(skb);
3550         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3551         if (ip6 == NULL)
3552                 goto out;
3553
3554         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3555         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3556         ret = 0;
3557
3558         nexthdr = ip6->nexthdr;
3559         offset += sizeof(_ipv6h);
3560         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3561         if (offset < 0)
3562                 goto out;
3563
3564         if (proto)
3565                 *proto = nexthdr;
3566
3567         switch (nexthdr) {
3568         case IPPROTO_TCP: {
3569                 struct tcphdr _tcph, *th;
3570
3571                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3572                 if (th == NULL)
3573                         break;
3574
3575                 ad->u.net.sport = th->source;
3576                 ad->u.net.dport = th->dest;
3577                 break;
3578         }
3579
3580         case IPPROTO_UDP: {
3581                 struct udphdr _udph, *uh;
3582
3583                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3584                 if (uh == NULL)
3585                         break;
3586
3587                 ad->u.net.sport = uh->source;
3588                 ad->u.net.dport = uh->dest;
3589                 break;
3590         }
3591
3592         case IPPROTO_DCCP: {
3593                 struct dccp_hdr _dccph, *dh;
3594
3595                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3596                 if (dh == NULL)
3597                         break;
3598
3599                 ad->u.net.sport = dh->dccph_sport;
3600                 ad->u.net.dport = dh->dccph_dport;
3601                 break;
3602         }
3603
3604         /* includes fragments */
3605         default:
3606                 break;
3607         }
3608 out:
3609         return ret;
3610 }
3611
3612 #endif /* IPV6 */
3613
3614 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3615                              char **_addrp, int src, u8 *proto)
3616 {
3617         char *addrp;
3618         int ret;
3619
3620         switch (ad->u.net.family) {
3621         case PF_INET:
3622                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3623                 if (ret)
3624                         goto parse_error;
3625                 addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3626                                        &ad->u.net.v4info.daddr);
3627                 goto okay;
3628
3629 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3630         case PF_INET6:
3631                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3632                 if (ret)
3633                         goto parse_error;
3634                 addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3635                                        &ad->u.net.v6info.daddr);
3636                 goto okay;
3637 #endif  /* IPV6 */
3638         default:
3639                 addrp = NULL;
3640                 goto okay;
3641         }
3642
3643 parse_error:
3644         printk(KERN_WARNING
3645                "SELinux: failure in selinux_parse_skb(),"
3646                " unable to parse packet\n");
3647         return ret;
3648
3649 okay:
3650         if (_addrp)
3651                 *_addrp = addrp;
3652         return 0;
3653 }
3654
3655 /**
3656  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3657  * @skb: the packet
3658  * @family: protocol family
3659  * @sid: the packet's peer label SID
3660  *
3661  * Description:
3662  * Check the various different forms of network peer labeling and determine
3663  * the peer label/SID for the packet; most of the magic actually occurs in
3664  * the security server function security_net_peersid_cmp().  The function
3665  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3666  * or -EACCES if @sid is invalid due to inconsistencies with the different
3667  * peer labels.
3668  *
3669  */
3670 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3671 {
3672         int err;
3673         u32 xfrm_sid;
3674         u32 nlbl_sid;
3675         u32 nlbl_type;
3676
3677         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3678         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3679
3680         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3681         if (unlikely(err)) {
3682                 printk(KERN_WARNING
3683                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3684                        " unable to determine packet's peer label\n");
3685                 return -EACCES;
3686         }
3687
3688         return 0;
3689 }
3690
3691 /* socket security operations */
3692 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3693                            u32 perms)
3694 {
3695         struct inode_security_struct *isec;
3696         struct common_audit_data ad;
3697         u32 sid;
3698         int err = 0;
3699
3700         isec = SOCK_INODE(sock)->i_security;
3701
3702         if (isec->sid == SECINITSID_KERNEL)
3703                 goto out;
3704         sid = task_sid(task);
3705
3706         COMMON_AUDIT_DATA_INIT(&ad, NET);
3707         ad.u.net.sk = sock->sk;
3708         err = avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
3709
3710 out:
3711         return err;
3712 }
3713
3714 static int selinux_socket_create(int family, int type,
3715                                  int protocol, int kern)
3716 {
3717         const struct cred *cred = current_cred();
3718         const struct task_security_struct *tsec = cred->security;
3719         u32 sid, newsid;
3720         u16 secclass;
3721         int err = 0;
3722
3723         if (kern)
3724                 goto out;
3725
3726         sid = tsec->sid;
3727         newsid = tsec->sockcreate_sid ?: sid;
3728
3729         secclass = socket_type_to_security_class(family, type, protocol);
3730         err = avc_has_perm(sid, newsid, secclass, SOCKET__CREATE, NULL);
3731
3732 out:
3733         return err;
3734 }
3735
3736 static int selinux_socket_post_create(struct socket *sock, int family,
3737                                       int type, int protocol, int kern)
3738 {
3739         const struct cred *cred = current_cred();
3740         const struct task_security_struct *tsec = cred->security;
3741         struct inode_security_struct *isec;
3742         struct sk_security_struct *sksec;
3743         u32 sid, newsid;
3744         int err = 0;
3745
3746         sid = tsec->sid;
3747         newsid = tsec->sockcreate_sid;
3748
3749         isec = SOCK_INODE(sock)->i_security;
3750
3751         if (kern)
3752                 isec->sid = SECINITSID_KERNEL;
3753         else if (newsid)
3754                 isec->sid = newsid;
3755         else
3756                 isec->sid = sid;
3757
3758         isec->sclass = socket_type_to_security_class(family, type, protocol);
3759         isec->initialized = 1;
3760
3761         if (sock->sk) {
3762                 sksec = sock->sk->sk_security;
3763                 sksec->sid = isec->sid;
3764                 sksec->sclass = isec->sclass;
3765                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3766         }
3767
3768         return err;
3769 }
3770
3771 /* Range of port numbers used to automatically bind.
3772    Need to determine whether we should perform a name_bind
3773    permission check between the socket and the port number. */
3774
3775 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3776 {
3777         u16 family;
3778         int err;
3779
3780         err = socket_has_perm(current, sock, SOCKET__BIND);
3781         if (err)
3782                 goto out;
3783
3784         /*
3785          * If PF_INET or PF_INET6, check name_bind permission for the port.
3786          * Multiple address binding for SCTP is not supported yet: we just
3787          * check the first address now.
3788          */
3789         family = sock->sk->sk_family;
3790         if (family == PF_INET || family == PF_INET6) {
3791                 char *addrp;
3792                 struct inode_security_struct *isec;
3793                 struct common_audit_data ad;
3794                 struct sockaddr_in *addr4 = NULL;
3795                 struct sockaddr_in6 *addr6 = NULL;
3796                 unsigned short snum;
3797                 struct sock *sk = sock->sk;
3798                 u32 sid, node_perm;
3799
3800                 isec = SOCK_INODE(sock)->i_security;
3801
3802                 if (family == PF_INET) {
3803                         addr4 = (struct sockaddr_in *)address;
3804                         snum = ntohs(addr4->sin_port);
3805                         addrp = (char *)&addr4->sin_addr.s_addr;
3806                 } else {
3807                         addr6 = (struct sockaddr_in6 *)address;
3808                         snum = ntohs(addr6->sin6_port);
3809                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3810                 }
3811
3812                 if (snum) {
3813                         int low, high;
3814
3815                         inet_get_local_port_range(&low, &high);
3816
3817                         if (snum < max(PROT_SOCK, low) || snum > high) {
3818                                 err = sel_netport_sid(sk->sk_protocol,
3819                                                       snum, &sid);
3820                                 if (err)
3821                                         goto out;
3822                                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3823                                 ad.u.net.sport = htons(snum);
3824                                 ad.u.net.family = family;
3825                                 err = avc_has_perm(isec->sid, sid,
3826                                                    isec->sclass,
3827                                                    SOCKET__NAME_BIND, &ad);
3828                                 if (err)
3829                                         goto out;
3830                         }
3831                 }
3832
3833                 switch (isec->sclass) {
3834                 case SECCLASS_TCP_SOCKET:
3835                         node_perm = TCP_SOCKET__NODE_BIND;
3836                         break;
3837
3838                 case SECCLASS_UDP_SOCKET:
3839                         node_perm = UDP_SOCKET__NODE_BIND;
3840                         break;
3841
3842                 case SECCLASS_DCCP_SOCKET:
3843                         node_perm = DCCP_SOCKET__NODE_BIND;
3844                         break;
3845
3846                 default:
3847                         node_perm = RAWIP_SOCKET__NODE_BIND;
3848                         break;
3849                 }
3850
3851                 err = sel_netnode_sid(addrp, family, &sid);
3852                 if (err)
3853                         goto out;
3854
3855                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3856                 ad.u.net.sport = htons(snum);
3857                 ad.u.net.family = family;
3858
3859                 if (family == PF_INET)
3860                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3861                 else
3862                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3863
3864                 err = avc_has_perm(isec->sid, sid,
3865                                    isec->sclass, node_perm, &ad);
3866                 if (err)
3867                         goto out;
3868         }
3869 out:
3870         return err;
3871 }
3872
3873 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3874 {
3875         struct sock *sk = sock->sk;
3876         struct inode_security_struct *isec;
3877         int err;
3878
3879         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3880         if (err)
3881                 return err;
3882
3883         /*
3884          * If a TCP or DCCP socket, check name_connect permission for the port.
3885          */
3886         isec = SOCK_INODE(sock)->i_security;
3887         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3888             isec->sclass == SECCLASS_DCCP_SOCKET) {
3889                 struct common_audit_data ad;
3890                 struct sockaddr_in *addr4 = NULL;
3891                 struct sockaddr_in6 *addr6 = NULL;
3892                 unsigned short snum;
3893                 u32 sid, perm;
3894
3895                 if (sk->sk_family == PF_INET) {
3896                         addr4 = (struct sockaddr_in *)address;
3897                         if (addrlen < sizeof(struct sockaddr_in))
3898                                 return -EINVAL;
3899                         snum = ntohs(addr4->sin_port);
3900                 } else {
3901                         addr6 = (struct sockaddr_in6 *)address;
3902                         if (addrlen < SIN6_LEN_RFC2133)
3903                                 return -EINVAL;
3904                         snum = ntohs(addr6->sin6_port);
3905                 }
3906
3907                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3908                 if (err)
3909                         goto out;
3910
3911                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3912                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3913
3914                 COMMON_AUDIT_DATA_INIT(&ad, NET);
3915                 ad.u.net.dport = htons(snum);
3916                 ad.u.net.family = sk->sk_family;
3917                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3918                 if (err)
3919                         goto out;
3920         }
3921
3922         err = selinux_netlbl_socket_connect(sk, address);
3923
3924 out:
3925         return err;
3926 }
3927
3928 static int selinux_socket_listen(struct socket *sock, int backlog)
3929 {
3930         return socket_has_perm(current, sock, SOCKET__LISTEN);
3931 }
3932
3933 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3934 {
3935         int err;
3936         struct inode_security_struct *isec;
3937         struct inode_security_struct *newisec;
3938
3939         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3940         if (err)
3941                 return err;
3942
3943         newisec = SOCK_INODE(newsock)->i_security;
3944
3945         isec = SOCK_INODE(sock)->i_security;
3946         newisec->sclass = isec->sclass;
3947         newisec->sid = isec->sid;
3948         newisec->initialized = 1;
3949
3950         return 0;
3951 }
3952
3953 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3954                                   int size)
3955 {
3956         return socket_has_perm(current, sock, SOCKET__WRITE);
3957 }
3958
3959 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3960                                   int size, int flags)
3961 {
3962         return socket_has_perm(current, sock, SOCKET__READ);
3963 }
3964
3965 static int selinux_socket_getsockname(struct socket *sock)
3966 {
3967         return socket_has_perm(current, sock, SOCKET__GETATTR);
3968 }
3969
3970 static int selinux_socket_getpeername(struct socket *sock)
3971 {
3972         return socket_has_perm(current, sock, SOCKET__GETATTR);
3973 }
3974
3975 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3976 {
3977         int err;
3978
3979         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3980         if (err)
3981                 return err;
3982
3983         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3984 }
3985
3986 static int selinux_socket_getsockopt(struct socket *sock, int level,
3987                                      int optname)
3988 {
3989         return socket_has_perm(current, sock, SOCKET__GETOPT);
3990 }
3991
3992 static int selinux_socket_shutdown(struct socket *sock, int how)
3993 {
3994         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3995 }
3996
3997 static int selinux_socket_unix_stream_connect(struct socket *sock,
3998                                               struct socket *other,
3999                                               struct sock *newsk)
4000 {
4001         struct sk_security_struct *ssec;
4002         struct inode_security_struct *isec;
4003         struct inode_security_struct *other_isec;
4004         struct common_audit_data ad;
4005         int err;
4006
4007         isec = SOCK_INODE(sock)->i_security;
4008         other_isec = SOCK_INODE(other)->i_security;
4009
4010         COMMON_AUDIT_DATA_INIT(&ad, NET);
4011         ad.u.net.sk = other->sk;
4012
4013         err = avc_has_perm(isec->sid, other_isec->sid,
4014                            isec->sclass,
4015                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4016         if (err)
4017                 return err;
4018
4019         /* connecting socket */
4020         ssec = sock->sk->sk_security;
4021         ssec->peer_sid = other_isec->sid;
4022
4023         /* server child socket */
4024         ssec = newsk->sk_security;
4025         ssec->peer_sid = isec->sid;
4026         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
4027
4028         return err;
4029 }
4030
4031 static int selinux_socket_unix_may_send(struct socket *sock,
4032                                         struct socket *other)
4033 {
4034         struct inode_security_struct *isec;
4035         struct inode_security_struct *other_isec;
4036         struct common_audit_data ad;
4037         int err;
4038
4039         isec = SOCK_INODE(sock)->i_security;
4040         other_isec = SOCK_INODE(other)->i_security;
4041
4042         COMMON_AUDIT_DATA_INIT(&ad, NET);
4043         ad.u.net.sk = other->sk;
4044
4045         err = avc_has_perm(isec->sid, other_isec->sid,
4046                            isec->sclass, SOCKET__SENDTO, &ad);
4047         if (err)
4048                 return err;
4049
4050         return 0;
4051 }
4052
4053 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4054                                     u32 peer_sid,
4055                                     struct common_audit_data *ad)
4056 {
4057         int err;
4058         u32 if_sid;
4059         u32 node_sid;
4060
4061         err = sel_netif_sid(ifindex, &if_sid);
4062         if (err)
4063                 return err;
4064         err = avc_has_perm(peer_sid, if_sid,
4065                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4066         if (err)
4067                 return err;
4068
4069         err = sel_netnode_sid(addrp, family, &node_sid);
4070         if (err)
4071                 return err;
4072         return avc_has_perm(peer_sid, node_sid,
4073                             SECCLASS_NODE, NODE__RECVFROM, ad);
4074 }
4075
4076 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4077                                        u16 family)
4078 {
4079         int err = 0;
4080         struct sk_security_struct *sksec = sk->sk_security;
4081         u32 peer_sid;
4082         u32 sk_sid = sksec->sid;
4083         struct common_audit_data ad;
4084         char *addrp;
4085
4086         COMMON_AUDIT_DATA_INIT(&ad, NET);
4087         ad.u.net.netif = skb->iif;
4088         ad.u.net.family = family;
4089         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4090         if (err)
4091                 return err;
4092
4093         if (selinux_secmark_enabled()) {
4094                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4095                                    PACKET__RECV, &ad);
4096                 if (err)
4097                         return err;
4098         }
4099
4100         if (selinux_policycap_netpeer) {
4101                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4102                 if (err)
4103                         return err;
4104                 err = avc_has_perm(sk_sid, peer_sid,
4105                                    SECCLASS_PEER, PEER__RECV, &ad);
4106                 if (err)
4107                         selinux_netlbl_err(skb, err, 0);
4108         } else {
4109                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4110                 if (err)
4111                         return err;
4112                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4113         }
4114
4115         return err;
4116 }
4117
4118 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4119 {
4120         int err;
4121         struct sk_security_struct *sksec = sk->sk_security;
4122         u16 family = sk->sk_family;
4123         u32 sk_sid = sksec->sid;
4124         struct common_audit_data ad;
4125         char *addrp;
4126         u8 secmark_active;
4127         u8 peerlbl_active;
4128
4129         if (family != PF_INET && family != PF_INET6)
4130                 return 0;
4131
4132         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4133         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4134                 family = PF_INET;
4135
4136         /* If any sort of compatibility mode is enabled then handoff processing
4137          * to the selinux_sock_rcv_skb_compat() function to deal with the
4138          * special handling.  We do this in an attempt to keep this function
4139          * as fast and as clean as possible. */
4140         if (!selinux_policycap_netpeer)
4141                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4142
4143         secmark_active = selinux_secmark_enabled();
4144         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4145         if (!secmark_active && !peerlbl_active)
4146                 return 0;
4147
4148         COMMON_AUDIT_DATA_INIT(&ad, NET);
4149         ad.u.net.netif = skb->iif;
4150         ad.u.net.family = family;
4151         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4152         if (err)
4153                 return err;
4154
4155         if (peerlbl_active) {
4156                 u32 peer_sid;
4157
4158                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4159                 if (err)
4160                         return err;
4161                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4162                                                peer_sid, &ad);
4163                 if (err) {
4164                         selinux_netlbl_err(skb, err, 0);
4165                         return err;
4166                 }
4167                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4168                                    PEER__RECV, &ad);
4169                 if (err)
4170                         selinux_netlbl_err(skb, err, 0);
4171         }
4172
4173         if (secmark_active) {
4174                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4175                                    PACKET__RECV, &ad);
4176                 if (err)
4177                         return err;
4178         }
4179
4180         return err;
4181 }
4182
4183 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4184                                             int __user *optlen, unsigned len)
4185 {
4186         int err = 0;
4187         char *scontext;
4188         u32 scontext_len;
4189         struct sk_security_struct *ssec;
4190         struct inode_security_struct *isec;
4191         u32 peer_sid = SECSID_NULL;
4192
4193         isec = SOCK_INODE(sock)->i_security;
4194
4195         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4196             isec->sclass == SECCLASS_TCP_SOCKET) {
4197                 ssec = sock->sk->sk_security;
4198                 peer_sid = ssec->peer_sid;
4199         }
4200         if (peer_sid == SECSID_NULL) {
4201                 err = -ENOPROTOOPT;
4202                 goto out;
4203         }
4204
4205         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4206
4207         if (err)
4208                 goto out;
4209
4210         if (scontext_len > len) {
4211                 err = -ERANGE;
4212                 goto out_len;
4213         }
4214
4215         if (copy_to_user(optval, scontext, scontext_len))
4216                 err = -EFAULT;
4217
4218 out_len:
4219         if (put_user(scontext_len, optlen))
4220                 err = -EFAULT;
4221
4222         kfree(scontext);
4223 out:
4224         return err;
4225 }
4226
4227 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4228 {
4229         u32 peer_secid = SECSID_NULL;
4230         u16 family;
4231
4232         if (skb && skb->protocol == htons(ETH_P_IP))
4233                 family = PF_INET;
4234         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4235                 family = PF_INET6;
4236         else if (sock)
4237                 family = sock->sk->sk_family;
4238         else
4239                 goto out;
4240
4241         if (sock && family == PF_UNIX)
4242                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4243         else if (skb)
4244                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4245
4246 out:
4247         *secid = peer_secid;
4248         if (peer_secid == SECSID_NULL)
4249                 return -EINVAL;
4250         return 0;
4251 }
4252
4253 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4254 {
4255         return sk_alloc_security(sk, family, priority);
4256 }
4257
4258 static void selinux_sk_free_security(struct sock *sk)
4259 {
4260         sk_free_security(sk);
4261 }
4262
4263 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4264 {
4265         struct sk_security_struct *ssec = sk->sk_security;
4266         struct sk_security_struct *newssec = newsk->sk_security;
4267
4268         newssec->sid = ssec->sid;
4269         newssec->peer_sid = ssec->peer_sid;
4270         newssec->sclass = ssec->sclass;
4271
4272         selinux_netlbl_sk_security_reset(newssec);
4273 }
4274
4275 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4276 {
4277         if (!sk)
4278                 *secid = SECINITSID_ANY_SOCKET;
4279         else {
4280                 struct sk_security_struct *sksec = sk->sk_security;
4281
4282                 *secid = sksec->sid;
4283         }
4284 }
4285
4286 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4287 {
4288         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4289         struct sk_security_struct *sksec = sk->sk_security;
4290
4291         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4292             sk->sk_family == PF_UNIX)
4293                 isec->sid = sksec->sid;
4294         sksec->sclass = isec->sclass;
4295 }
4296
4297 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4298                                      struct request_sock *req)
4299 {
4300         struct sk_security_struct *sksec = sk->sk_security;
4301         int err;
4302         u16 family = sk->sk_family;
4303         u32 newsid;
4304         u32 peersid;
4305
4306         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4307         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4308                 family = PF_INET;
4309
4310         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4311         if (err)
4312                 return err;
4313         if (peersid == SECSID_NULL) {
4314                 req->secid = sksec->sid;
4315                 req->peer_secid = SECSID_NULL;
4316         } else {
4317                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4318                 if (err)
4319                         return err;
4320                 req->secid = newsid;
4321                 req->peer_secid = peersid;
4322         }
4323
4324         return selinux_netlbl_inet_conn_request(req, family);
4325 }
4326
4327 static void selinux_inet_csk_clone(struct sock *newsk,
4328                                    const struct request_sock *req)
4329 {
4330         struct sk_security_struct *newsksec = newsk->sk_security;
4331
4332         newsksec->sid = req->secid;
4333         newsksec->peer_sid = req->peer_secid;
4334         /* NOTE: Ideally, we should also get the isec->sid for the
4335            new socket in sync, but we don't have the isec available yet.
4336            So we will wait until sock_graft to do it, by which
4337            time it will have been created and available. */
4338
4339         /* We don't need to take any sort of lock here as we are the only
4340          * thread with access to newsksec */
4341         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4342 }
4343
4344 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4345 {
4346         u16 family = sk->sk_family;
4347         struct sk_security_struct *sksec = sk->sk_security;
4348
4349         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4350         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4351                 family = PF_INET;
4352
4353         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4354 }
4355
4356 static void selinux_req_classify_flow(const struct request_sock *req,
4357                                       struct flowi *fl)
4358 {
4359         fl->secid = req->secid;
4360 }
4361
4362 static int selinux_tun_dev_create(void)
4363 {
4364         u32 sid = current_sid();
4365
4366         /* we aren't taking into account the "sockcreate" SID since the socket
4367          * that is being created here is not a socket in the traditional sense,
4368          * instead it is a private sock, accessible only to the kernel, and
4369          * representing a wide range of network traffic spanning multiple
4370          * connections unlike traditional sockets - check the TUN driver to
4371          * get a better understanding of why this socket is special */
4372
4373         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4374                             NULL);
4375 }
4376
4377 static void selinux_tun_dev_post_create(struct sock *sk)
4378 {
4379         struct sk_security_struct *sksec = sk->sk_security;
4380
4381         /* we don't currently perform any NetLabel based labeling here and it
4382          * isn't clear that we would want to do so anyway; while we could apply
4383          * labeling without the support of the TUN user the resulting labeled
4384          * traffic from the other end of the connection would almost certainly
4385          * cause confusion to the TUN user that had no idea network labeling
4386          * protocols were being used */
4387
4388         /* see the comments in selinux_tun_dev_create() about why we don't use
4389          * the sockcreate SID here */
4390
4391         sksec->sid = current_sid();
4392         sksec->sclass = SECCLASS_TUN_SOCKET;
4393 }
4394
4395 static int selinux_tun_dev_attach(struct sock *sk)
4396 {
4397         struct sk_security_struct *sksec = sk->sk_security;
4398         u32 sid = current_sid();
4399         int err;
4400
4401         err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4402                            TUN_SOCKET__RELABELFROM, NULL);
4403         if (err)
4404                 return err;
4405         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4406                            TUN_SOCKET__RELABELTO, NULL);
4407         if (err)
4408                 return err;
4409
4410         sksec->sid = sid;
4411
4412         return 0;
4413 }
4414
4415 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4416 {
4417         int err = 0;
4418         u32 perm;
4419         struct nlmsghdr *nlh;
4420         struct socket *sock = sk->sk_socket;
4421         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4422
4423         if (skb->len < NLMSG_SPACE(0)) {
4424                 err = -EINVAL;
4425                 goto out;
4426         }
4427         nlh = nlmsg_hdr(skb);
4428
4429         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4430         if (err) {
4431                 if (err == -EINVAL) {
4432                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4433                                   "SELinux:  unrecognized netlink message"
4434                                   " type=%hu for sclass=%hu\n",
4435                                   nlh->nlmsg_type, isec->sclass);
4436                         if (!selinux_enforcing || security_get_allow_unknown())
4437                                 err = 0;
4438                 }
4439
4440                 /* Ignore */
4441                 if (err == -ENOENT)
4442                         err = 0;
4443                 goto out;
4444         }
4445
4446         err = socket_has_perm(current, sock, perm);
4447 out:
4448         return err;
4449 }
4450
4451 #ifdef CONFIG_NETFILTER
4452
4453 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4454                                        u16 family)
4455 {
4456         int err;
4457         char *addrp;
4458         u32 peer_sid;
4459         struct common_audit_data ad;
4460         u8 secmark_active;
4461         u8 netlbl_active;
4462         u8 peerlbl_active;
4463
4464         if (!selinux_policycap_netpeer)
4465                 return NF_ACCEPT;
4466
4467         secmark_active = selinux_secmark_enabled();
4468         netlbl_active = netlbl_enabled();
4469         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4470         if (!secmark_active && !peerlbl_active)
4471                 return NF_ACCEPT;
4472
4473         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4474                 return NF_DROP;
4475
4476         COMMON_AUDIT_DATA_INIT(&ad, NET);
4477         ad.u.net.netif = ifindex;
4478         ad.u.net.family = family;
4479         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4480                 return NF_DROP;
4481
4482         if (peerlbl_active) {
4483                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4484                                                peer_sid, &ad);
4485                 if (err) {
4486                         selinux_netlbl_err(skb, err, 1);
4487                         return NF_DROP;
4488                 }
4489         }
4490
4491         if (secmark_active)
4492                 if (avc_has_perm(peer_sid, skb->secmark,
4493                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4494                         return NF_DROP;
4495
4496         if (netlbl_active)
4497                 /* we do this in the FORWARD path and not the POST_ROUTING
4498                  * path because we want to make sure we apply the necessary
4499                  * labeling before IPsec is applied so we can leverage AH
4500                  * protection */
4501                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4502                         return NF_DROP;
4503
4504         return NF_ACCEPT;
4505 }
4506
4507 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4508                                          struct sk_buff *skb,
4509                                          const struct net_device *in,
4510                                          const struct net_device *out,
4511                                          int (*okfn)(struct sk_buff *))
4512 {
4513         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4514 }
4515
4516 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4517 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4518                                          struct sk_buff *skb,
4519                                          const struct net_device *in,
4520                                          const struct net_device *out,
4521                                          int (*okfn)(struct sk_buff *))
4522 {
4523         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4524 }
4525 #endif  /* IPV6 */
4526
4527 static unsigned int selinux_ip_output(struct sk_buff *skb,
4528                                       u16 family)
4529 {
4530         u32 sid;
4531
4532         if (!netlbl_enabled())
4533                 return NF_ACCEPT;
4534
4535         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4536          * because we want to make sure we apply the necessary labeling
4537          * before IPsec is applied so we can leverage AH protection */
4538         if (skb->sk) {
4539                 struct sk_security_struct *sksec = skb->sk->sk_security;
4540                 sid = sksec->sid;
4541         } else
4542                 sid = SECINITSID_KERNEL;
4543         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4544                 return NF_DROP;
4545
4546         return NF_ACCEPT;
4547 }
4548
4549 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4550                                         struct sk_buff *skb,
4551                                         const struct net_device *in,
4552                                         const struct net_device *out,
4553                                         int (*okfn)(struct sk_buff *))
4554 {
4555         return selinux_ip_output(skb, PF_INET);
4556 }
4557
4558 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4559                                                 int ifindex,
4560                                                 u16 family)
4561 {
4562         struct sock *sk = skb->sk;
4563         struct sk_security_struct *sksec;
4564         struct common_audit_data ad;
4565         char *addrp;
4566         u8 proto;
4567
4568         if (sk == NULL)
4569                 return NF_ACCEPT;
4570         sksec = sk->sk_security;
4571
4572         COMMON_AUDIT_DATA_INIT(&ad, NET);
4573         ad.u.net.netif = ifindex;
4574         ad.u.net.family = family;
4575         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4576                 return NF_DROP;
4577
4578         if (selinux_secmark_enabled())
4579                 if (avc_has_perm(sksec->sid, skb->secmark,
4580                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4581                         return NF_DROP;
4582
4583         if (selinux_policycap_netpeer)
4584                 if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4585                         return NF_DROP;
4586
4587         return NF_ACCEPT;
4588 }
4589
4590 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4591                                          u16 family)
4592 {
4593         u32 secmark_perm;
4594         u32 peer_sid;
4595         struct sock *sk;
4596         struct common_audit_data ad;
4597         char *addrp;
4598         u8 secmark_active;
4599         u8 peerlbl_active;
4600
4601         /* If any sort of compatibility mode is enabled then handoff processing
4602          * to the selinux_ip_postroute_compat() function to deal with the
4603          * special handling.  We do this in an attempt to keep this function
4604          * as fast and as clean as possible. */
4605         if (!selinux_policycap_netpeer)
4606                 return selinux_ip_postroute_compat(skb, ifindex, family);
4607 #ifdef CONFIG_XFRM
4608         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4609          * packet transformation so allow the packet to pass without any checks
4610          * since we'll have another chance to perform access control checks
4611          * when the packet is on it's final way out.
4612          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4613          *       is NULL, in this case go ahead and apply access control. */
4614         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4615                 return NF_ACCEPT;
4616 #endif
4617         secmark_active = selinux_secmark_enabled();
4618         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4619         if (!secmark_active && !peerlbl_active)
4620                 return NF_ACCEPT;
4621
4622         /* if the packet is being forwarded then get the peer label from the
4623          * packet itself; otherwise check to see if it is from a local
4624          * application or the kernel, if from an application get the peer label
4625          * from the sending socket, otherwise use the kernel's sid */
4626         sk = skb->sk;
4627         if (sk == NULL) {
4628                 switch (family) {
4629                 case PF_INET:
4630                         if (IPCB(skb)->flags & IPSKB_FORWARDED)
4631                                 secmark_perm = PACKET__FORWARD_OUT;
4632                         else
4633                                 secmark_perm = PACKET__SEND;
4634                         break;
4635                 case PF_INET6:
4636                         if (IP6CB(skb)->flags & IP6SKB_FORWARDED)
4637                                 secmark_perm = PACKET__FORWARD_OUT;
4638                         else
4639                                 secmark_perm = PACKET__SEND;
4640                         break;
4641                 default:
4642                         return NF_DROP;
4643                 }
4644                 if (secmark_perm == PACKET__FORWARD_OUT) {
4645                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4646                                 return NF_DROP;
4647                 } else
4648                         peer_sid = SECINITSID_KERNEL;
4649         } else {
4650                 struct sk_security_struct *sksec = sk->sk_security;
4651                 peer_sid = sksec->sid;
4652                 secmark_perm = PACKET__SEND;
4653         }
4654
4655         COMMON_AUDIT_DATA_INIT(&ad, NET);
4656         ad.u.net.netif = ifindex;
4657         ad.u.net.family = family;
4658         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4659                 return NF_DROP;
4660
4661         if (secmark_active)
4662                 if (avc_has_perm(peer_sid, skb->secmark,
4663                                  SECCLASS_PACKET, secmark_perm, &ad))
4664                         return NF_DROP;
4665
4666         if (peerlbl_active) {
4667                 u32 if_sid;
4668                 u32 node_sid;
4669
4670                 if (sel_netif_sid(ifindex, &if_sid))
4671                         return NF_DROP;
4672                 if (avc_has_perm(peer_sid, if_sid,
4673                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4674                         return NF_DROP;
4675
4676                 if (sel_netnode_sid(addrp, family, &node_sid))
4677                         return NF_DROP;
4678                 if (avc_has_perm(peer_sid, node_sid,
4679                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4680                         return NF_DROP;
4681         }
4682
4683         return NF_ACCEPT;
4684 }
4685
4686 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4687                                            struct sk_buff *skb,
4688                                            const struct net_device *in,
4689                                            const struct net_device *out,
4690                                            int (*okfn)(struct sk_buff *))
4691 {
4692         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4693 }
4694
4695 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4696 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4697                                            struct sk_buff *skb,
4698                                            const struct net_device *in,
4699                                            const struct net_device *out,
4700                                            int (*okfn)(struct sk_buff *))
4701 {
4702         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4703 }
4704 #endif  /* IPV6 */
4705
4706 #endif  /* CONFIG_NETFILTER */
4707
4708 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4709 {
4710         int err;
4711
4712         err = cap_netlink_send(sk, skb);
4713         if (err)
4714                 return err;
4715
4716         return selinux_nlmsg_perm(sk, skb);
4717 }
4718
4719 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4720 {
4721         int err;
4722         struct common_audit_data ad;
4723
4724         err = cap_netlink_recv(skb, capability);
4725         if (err)
4726                 return err;
4727
4728         COMMON_AUDIT_DATA_INIT(&ad, CAP);
4729         ad.u.cap = capability;
4730
4731         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4732                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4733 }
4734
4735 static int ipc_alloc_security(struct task_struct *task,
4736                               struct kern_ipc_perm *perm,
4737                               u16 sclass)
4738 {
4739         struct ipc_security_struct *isec;
4740         u32 sid;
4741
4742         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4743         if (!isec)
4744                 return -ENOMEM;
4745
4746         sid = task_sid(task);
4747         isec->sclass = sclass;
4748         isec->sid = sid;
4749         perm->security = isec;
4750
4751         return 0;
4752 }
4753
4754 static void ipc_free_security(struct kern_ipc_perm *perm)
4755 {
4756         struct ipc_security_struct *isec = perm->security;
4757         perm->security = NULL;
4758         kfree(isec);
4759 }
4760
4761 static int msg_msg_alloc_security(struct msg_msg *msg)
4762 {
4763         struct msg_security_struct *msec;
4764
4765         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4766         if (!msec)
4767                 return -ENOMEM;
4768
4769         msec->sid = SECINITSID_UNLABELED;
4770         msg->security = msec;
4771
4772         return 0;
4773 }
4774
4775 static void msg_msg_free_security(struct msg_msg *msg)
4776 {
4777         struct msg_security_struct *msec = msg->security;
4778
4779         msg->security = NULL;
4780         kfree(msec);
4781 }
4782
4783 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4784                         u32 perms)
4785 {
4786         struct ipc_security_struct *isec;
4787         struct common_audit_data ad;
4788         u32 sid = current_sid();
4789
4790         isec = ipc_perms->security;
4791
4792         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4793         ad.u.ipc_id = ipc_perms->key;
4794
4795         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4796 }
4797
4798 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4799 {
4800         return msg_msg_alloc_security(msg);
4801 }
4802
4803 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4804 {
4805         msg_msg_free_security(msg);
4806 }
4807
4808 /* message queue security operations */
4809 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4810 {
4811         struct ipc_security_struct *isec;
4812         struct common_audit_data ad;
4813         u32 sid = current_sid();
4814         int rc;
4815
4816         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4817         if (rc)
4818                 return rc;
4819
4820         isec = msq->q_perm.security;
4821
4822         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4823         ad.u.ipc_id = msq->q_perm.key;
4824
4825         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4826                           MSGQ__CREATE, &ad);
4827         if (rc) {
4828                 ipc_free_security(&msq->q_perm);
4829                 return rc;
4830         }
4831         return 0;
4832 }
4833
4834 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4835 {
4836         ipc_free_security(&msq->q_perm);
4837 }
4838
4839 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4840 {
4841         struct ipc_security_struct *isec;
4842         struct common_audit_data ad;
4843         u32 sid = current_sid();
4844
4845         isec = msq->q_perm.security;
4846
4847         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4848         ad.u.ipc_id = msq->q_perm.key;
4849
4850         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4851                             MSGQ__ASSOCIATE, &ad);
4852 }
4853
4854 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4855 {
4856         int err;
4857         int perms;
4858
4859         switch (cmd) {
4860         case IPC_INFO:
4861         case MSG_INFO:
4862                 /* No specific object, just general system-wide information. */
4863                 return task_has_system(current, SYSTEM__IPC_INFO);
4864         case IPC_STAT:
4865         case MSG_STAT:
4866                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4867                 break;
4868         case IPC_SET:
4869                 perms = MSGQ__SETATTR;
4870                 break;
4871         case IPC_RMID:
4872                 perms = MSGQ__DESTROY;
4873                 break;
4874         default:
4875                 return 0;
4876         }
4877
4878         err = ipc_has_perm(&msq->q_perm, perms);
4879         return err;
4880 }
4881
4882 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4883 {
4884         struct ipc_security_struct *isec;
4885         struct msg_security_struct *msec;
4886         struct common_audit_data ad;
4887         u32 sid = current_sid();
4888         int rc;
4889
4890         isec = msq->q_perm.security;
4891         msec = msg->security;
4892
4893         /*
4894          * First time through, need to assign label to the message
4895          */
4896         if (msec->sid == SECINITSID_UNLABELED) {
4897                 /*
4898                  * Compute new sid based on current process and
4899                  * message queue this message will be stored in
4900                  */
4901                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4902                                              &msec->sid);
4903                 if (rc)
4904                         return rc;
4905         }
4906
4907         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4908         ad.u.ipc_id = msq->q_perm.key;
4909
4910         /* Can this process write to the queue? */
4911         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4912                           MSGQ__WRITE, &ad);
4913         if (!rc)
4914                 /* Can this process send the message */
4915                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4916                                   MSG__SEND, &ad);
4917         if (!rc)
4918                 /* Can the message be put in the queue? */
4919                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4920                                   MSGQ__ENQUEUE, &ad);
4921
4922         return rc;
4923 }
4924
4925 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4926                                     struct task_struct *target,
4927                                     long type, int mode)
4928 {
4929         struct ipc_security_struct *isec;
4930         struct msg_security_struct *msec;
4931         struct common_audit_data ad;
4932         u32 sid = task_sid(target);
4933         int rc;
4934
4935         isec = msq->q_perm.security;
4936         msec = msg->security;
4937
4938         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4939         ad.u.ipc_id = msq->q_perm.key;
4940
4941         rc = avc_has_perm(sid, isec->sid,
4942                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4943         if (!rc)
4944                 rc = avc_has_perm(sid, msec->sid,
4945                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4946         return rc;
4947 }
4948
4949 /* Shared Memory security operations */
4950 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4951 {
4952         struct ipc_security_struct *isec;
4953         struct common_audit_data ad;
4954         u32 sid = current_sid();
4955         int rc;
4956
4957         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4958         if (rc)
4959                 return rc;
4960
4961         isec = shp->shm_perm.security;
4962
4963         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4964         ad.u.ipc_id = shp->shm_perm.key;
4965
4966         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4967                           SHM__CREATE, &ad);
4968         if (rc) {
4969                 ipc_free_security(&shp->shm_perm);
4970                 return rc;
4971         }
4972         return 0;
4973 }
4974
4975 static void selinux_shm_free_security(struct shmid_kernel *shp)
4976 {
4977         ipc_free_security(&shp->shm_perm);
4978 }
4979
4980 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4981 {
4982         struct ipc_security_struct *isec;
4983         struct common_audit_data ad;
4984         u32 sid = current_sid();
4985
4986         isec = shp->shm_perm.security;
4987
4988         COMMON_AUDIT_DATA_INIT(&ad, IPC);
4989         ad.u.ipc_id = shp->shm_perm.key;
4990
4991         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
4992                             SHM__ASSOCIATE, &ad);
4993 }
4994
4995 /* Note, at this point, shp is locked down */
4996 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4997 {
4998         int perms;
4999         int err;
5000
5001         switch (cmd) {
5002         case IPC_INFO:
5003         case SHM_INFO:
5004                 /* No specific object, just general system-wide information. */
5005                 return task_has_system(current, SYSTEM__IPC_INFO);
5006         case IPC_STAT:
5007         case SHM_STAT:
5008                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5009                 break;
5010         case IPC_SET:
5011                 perms = SHM__SETATTR;
5012                 break;
5013         case SHM_LOCK:
5014         case SHM_UNLOCK:
5015                 perms = SHM__LOCK;
5016                 break;
5017         case IPC_RMID:
5018                 perms = SHM__DESTROY;
5019                 break;
5020         default:
5021                 return 0;
5022         }
5023
5024         err = ipc_has_perm(&shp->shm_perm, perms);
5025         return err;
5026 }
5027
5028 static int selinux_shm_shmat(struct shmid_kernel *shp,
5029                              char __user *shmaddr, int shmflg)
5030 {
5031         u32 perms;
5032
5033         if (shmflg & SHM_RDONLY)
5034                 perms = SHM__READ;
5035         else
5036                 perms = SHM__READ | SHM__WRITE;
5037
5038         return ipc_has_perm(&shp->shm_perm, perms);
5039 }
5040
5041 /* Semaphore security operations */
5042 static int selinux_sem_alloc_security(struct sem_array *sma)
5043 {
5044         struct ipc_security_struct *isec;
5045         struct common_audit_data ad;
5046         u32 sid = current_sid();
5047         int rc;
5048
5049         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5050         if (rc)
5051                 return rc;
5052
5053         isec = sma->sem_perm.security;
5054
5055         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5056         ad.u.ipc_id = sma->sem_perm.key;
5057
5058         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5059                           SEM__CREATE, &ad);
5060         if (rc) {
5061                 ipc_free_security(&sma->sem_perm);
5062                 return rc;
5063         }
5064         return 0;
5065 }
5066
5067 static void selinux_sem_free_security(struct sem_array *sma)
5068 {
5069         ipc_free_security(&sma->sem_perm);
5070 }
5071
5072 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5073 {
5074         struct ipc_security_struct *isec;
5075         struct common_audit_data ad;
5076         u32 sid = current_sid();
5077
5078         isec = sma->sem_perm.security;
5079
5080         COMMON_AUDIT_DATA_INIT(&ad, IPC);
5081         ad.u.ipc_id = sma->sem_perm.key;
5082
5083         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5084                             SEM__ASSOCIATE, &ad);
5085 }
5086
5087 /* Note, at this point, sma is locked down */
5088 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5089 {
5090         int err;
5091         u32 perms;
5092
5093         switch (cmd) {
5094         case IPC_INFO:
5095         case SEM_INFO:
5096                 /* No specific object, just general system-wide information. */
5097                 return task_has_system(current, SYSTEM__IPC_INFO);
5098         case GETPID:
5099         case GETNCNT:
5100         case GETZCNT:
5101                 perms = SEM__GETATTR;
5102                 break;
5103         case GETVAL:
5104         case GETALL:
5105                 perms = SEM__READ;
5106                 break;
5107         case SETVAL:
5108         case SETALL:
5109                 perms = SEM__WRITE;
5110                 break;
5111         case IPC_RMID:
5112                 perms = SEM__DESTROY;
5113                 break;
5114         case IPC_SET:
5115                 perms = SEM__SETATTR;
5116                 break;
5117         case IPC_STAT:
5118         case SEM_STAT:
5119                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5120                 break;
5121         default:
5122                 return 0;
5123         }
5124
5125         err = ipc_has_perm(&sma->sem_perm, perms);
5126         return err;
5127 }
5128
5129 static int selinux_sem_semop(struct sem_array *sma,
5130                              struct sembuf *sops, unsigned nsops, int alter)
5131 {
5132         u32 perms;
5133
5134         if (alter)
5135                 perms = SEM__READ | SEM__WRITE;
5136         else
5137                 perms = SEM__READ;
5138
5139         return ipc_has_perm(&sma->sem_perm, perms);
5140 }
5141
5142 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5143 {
5144         u32 av = 0;
5145
5146         av = 0;
5147         if (flag & S_IRUGO)
5148                 av |= IPC__UNIX_READ;
5149         if (flag & S_IWUGO)
5150                 av |= IPC__UNIX_WRITE;
5151
5152         if (av == 0)
5153                 return 0;
5154
5155         return ipc_has_perm(ipcp, av);
5156 }
5157
5158 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5159 {
5160         struct ipc_security_struct *isec = ipcp->security;
5161         *secid = isec->sid;
5162 }
5163
5164 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5165 {
5166         if (inode)
5167                 inode_doinit_with_dentry(inode, dentry);
5168 }
5169
5170 static int selinux_getprocattr(struct task_struct *p,
5171                                char *name, char **value)
5172 {
5173         const struct task_security_struct *__tsec;
5174         u32 sid;
5175         int error;
5176         unsigned len;
5177
5178         if (current != p) {
5179                 error = current_has_perm(p, PROCESS__GETATTR);
5180                 if (error)
5181                         return error;
5182         }
5183
5184         rcu_read_lock();
5185         __tsec = __task_cred(p)->security;
5186
5187         if (!strcmp(name, "current"))
5188                 sid = __tsec->sid;
5189         else if (!strcmp(name, "prev"))
5190                 sid = __tsec->osid;
5191         else if (!strcmp(name, "exec"))
5192                 sid = __tsec->exec_sid;
5193         else if (!strcmp(name, "fscreate"))
5194                 sid = __tsec->create_sid;
5195         else if (!strcmp(name, "keycreate"))
5196                 sid = __tsec->keycreate_sid;
5197         else if (!strcmp(name, "sockcreate"))
5198                 sid = __tsec->sockcreate_sid;
5199         else
5200                 goto invalid;
5201         rcu_read_unlock();
5202
5203         if (!sid)
5204                 return 0;
5205
5206         error = security_sid_to_context(sid, value, &len);
5207         if (error)
5208                 return error;
5209         return len;
5210
5211 invalid:
5212         rcu_read_unlock();
5213         return -EINVAL;
5214 }
5215
5216 static int selinux_setprocattr(struct task_struct *p,
5217                                char *name, void *value, size_t size)
5218 {
5219         struct task_security_struct *tsec;
5220         struct task_struct *tracer;
5221         struct cred *new;
5222         u32 sid = 0, ptsid;
5223         int error;
5224         char *str = value;
5225
5226         if (current != p) {
5227                 /* SELinux only allows a process to change its own
5228                    security attributes. */
5229                 return -EACCES;
5230         }
5231
5232         /*
5233          * Basic control over ability to set these attributes at all.
5234          * current == p, but we'll pass them separately in case the
5235          * above restriction is ever removed.
5236          */
5237         if (!strcmp(name, "exec"))
5238                 error = current_has_perm(p, PROCESS__SETEXEC);
5239         else if (!strcmp(name, "fscreate"))
5240                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5241         else if (!strcmp(name, "keycreate"))
5242                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5243         else if (!strcmp(name, "sockcreate"))
5244                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5245         else if (!strcmp(name, "current"))
5246                 error = current_has_perm(p, PROCESS__SETCURRENT);
5247         else
5248                 error = -EINVAL;
5249         if (error)
5250                 return error;
5251
5252         /* Obtain a SID for the context, if one was specified. */
5253         if (size && str[1] && str[1] != '\n') {
5254                 if (str[size-1] == '\n') {
5255                         str[size-1] = 0;
5256                         size--;
5257                 }
5258                 error = security_context_to_sid(value, size, &sid);
5259                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5260                         if (!capable(CAP_MAC_ADMIN))
5261                                 return error;
5262                         error = security_context_to_sid_force(value, size,
5263                                                               &sid);
5264                 }
5265                 if (error)
5266                         return error;
5267         }
5268
5269         new = prepare_creds();
5270         if (!new)
5271                 return -ENOMEM;
5272
5273         /* Permission checking based on the specified context is
5274            performed during the actual operation (execve,
5275            open/mkdir/...), when we know the full context of the
5276            operation.  See selinux_bprm_set_creds for the execve
5277            checks and may_create for the file creation checks. The
5278            operation will then fail if the context is not permitted. */
5279         tsec = new->security;
5280         if (!strcmp(name, "exec")) {
5281                 tsec->exec_sid = sid;
5282         } else if (!strcmp(name, "fscreate")) {
5283                 tsec->create_sid = sid;
5284         } else if (!strcmp(name, "keycreate")) {
5285                 error = may_create_key(sid, p);
5286                 if (error)
5287                         goto abort_change;
5288                 tsec->keycreate_sid = sid;
5289         } else if (!strcmp(name, "sockcreate")) {
5290                 tsec->sockcreate_sid = sid;
5291         } else if (!strcmp(name, "current")) {
5292                 error = -EINVAL;
5293                 if (sid == 0)
5294                         goto abort_change;
5295
5296                 /* Only allow single threaded processes to change context */
5297                 error = -EPERM;
5298                 if (!current_is_single_threaded()) {
5299                         error = security_bounded_transition(tsec->sid, sid);
5300                         if (error)
5301                                 goto abort_change;
5302                 }
5303
5304                 /* Check permissions for the transition. */
5305                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5306                                      PROCESS__DYNTRANSITION, NULL);
5307                 if (error)
5308                         goto abort_change;
5309
5310                 /* Check for ptracing, and update the task SID if ok.
5311                    Otherwise, leave SID unchanged and fail. */
5312                 ptsid = 0;
5313                 task_lock(p);
5314                 tracer = tracehook_tracer_task(p);
5315                 if (tracer)
5316                         ptsid = task_sid(tracer);
5317                 task_unlock(p);
5318
5319                 if (tracer) {
5320                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5321                                              PROCESS__PTRACE, NULL);
5322                         if (error)
5323                                 goto abort_change;
5324                 }
5325
5326                 tsec->sid = sid;
5327         } else {
5328                 error = -EINVAL;
5329                 goto abort_change;
5330         }
5331
5332         commit_creds(new);
5333         return size;
5334
5335 abort_change:
5336         abort_creds(new);
5337         return error;
5338 }
5339
5340 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5341 {
5342         return security_sid_to_context(secid, secdata, seclen);
5343 }
5344
5345 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5346 {
5347         return security_context_to_sid(secdata, seclen, secid);
5348 }
5349
5350 static void selinux_release_secctx(char *secdata, u32 seclen)
5351 {
5352         kfree(secdata);
5353 }
5354
5355 /*
5356  *      called with inode->i_mutex locked
5357  */
5358 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5359 {
5360         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5361 }
5362
5363 /*
5364  *      called with inode->i_mutex locked
5365  */
5366 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5367 {
5368         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5369 }
5370
5371 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5372 {
5373         int len = 0;
5374         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5375                                                 ctx, true);
5376         if (len < 0)
5377                 return len;
5378         *ctxlen = len;
5379         return 0;
5380 }
5381 #ifdef CONFIG_KEYS
5382
5383 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5384                              unsigned long flags)
5385 {
5386         const struct task_security_struct *tsec;
5387         struct key_security_struct *ksec;
5388
5389         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5390         if (!ksec)
5391                 return -ENOMEM;
5392
5393         tsec = cred->security;
5394         if (tsec->keycreate_sid)
5395                 ksec->sid = tsec->keycreate_sid;
5396         else
5397                 ksec->sid = tsec->sid;
5398
5399         k->security = ksec;
5400         return 0;
5401 }
5402
5403 static void selinux_key_free(struct key *k)
5404 {
5405         struct key_security_struct *ksec = k->security;
5406
5407         k->security = NULL;
5408         kfree(ksec);
5409 }
5410
5411 static int selinux_key_permission(key_ref_t key_ref,
5412                                   const struct cred *cred,
5413                                   key_perm_t perm)
5414 {
5415         struct key *key;
5416         struct key_security_struct *ksec;
5417         u32 sid;
5418
5419         /* if no specific permissions are requested, we skip the
5420            permission check. No serious, additional covert channels
5421            appear to be created. */
5422         if (perm == 0)
5423                 return 0;
5424
5425         sid = cred_sid(cred);
5426
5427         key = key_ref_to_ptr(key_ref);
5428         ksec = key->security;
5429
5430         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5431 }
5432
5433 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5434 {
5435         struct key_security_struct *ksec = key->security;
5436         char *context = NULL;
5437         unsigned len;
5438         int rc;
5439
5440         rc = security_sid_to_context(ksec->sid, &context, &len);
5441         if (!rc)
5442                 rc = len;
5443         *_buffer = context;
5444         return rc;
5445 }
5446
5447 #endif
5448
5449 static struct security_operations selinux_ops = {
5450         .name =                         "selinux",
5451
5452         .ptrace_access_check =          selinux_ptrace_access_check,
5453         .ptrace_traceme =               selinux_ptrace_traceme,
5454         .capget =                       selinux_capget,
5455         .capset =                       selinux_capset,
5456         .sysctl =                       selinux_sysctl,
5457         .capable =                      selinux_capable,
5458         .quotactl =                     selinux_quotactl,
5459         .quota_on =                     selinux_quota_on,
5460         .syslog =                       selinux_syslog,
5461         .vm_enough_memory =             selinux_vm_enough_memory,
5462
5463         .netlink_send =                 selinux_netlink_send,
5464         .netlink_recv =                 selinux_netlink_recv,
5465
5466         .bprm_set_creds =               selinux_bprm_set_creds,
5467         .bprm_committing_creds =        selinux_bprm_committing_creds,
5468         .bprm_committed_creds =         selinux_bprm_committed_creds,
5469         .bprm_secureexec =              selinux_bprm_secureexec,
5470
5471         .sb_alloc_security =            selinux_sb_alloc_security,
5472         .sb_free_security =             selinux_sb_free_security,
5473         .sb_copy_data =                 selinux_sb_copy_data,
5474         .sb_kern_mount =                selinux_sb_kern_mount,
5475         .sb_show_options =              selinux_sb_show_options,
5476         .sb_statfs =                    selinux_sb_statfs,
5477         .sb_mount =                     selinux_mount,
5478         .sb_umount =                    selinux_umount,
5479         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5480         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5481         .sb_parse_opts_str =            selinux_parse_opts_str,
5482
5483
5484         .inode_alloc_security =         selinux_inode_alloc_security,
5485         .inode_free_security =          selinux_inode_free_security,
5486         .inode_init_security =          selinux_inode_init_security,
5487         .inode_create =                 selinux_inode_create,
5488         .inode_link =                   selinux_inode_link,
5489         .inode_unlink =                 selinux_inode_unlink,
5490         .inode_symlink =                selinux_inode_symlink,
5491         .inode_mkdir =                  selinux_inode_mkdir,
5492         .inode_rmdir =                  selinux_inode_rmdir,
5493         .inode_mknod =                  selinux_inode_mknod,
5494         .inode_rename =                 selinux_inode_rename,
5495         .inode_readlink =               selinux_inode_readlink,
5496         .inode_follow_link =            selinux_inode_follow_link,
5497         .inode_permission =             selinux_inode_permission,
5498         .inode_setattr =                selinux_inode_setattr,
5499         .inode_getattr =                selinux_inode_getattr,
5500         .inode_setxattr =               selinux_inode_setxattr,
5501         .inode_post_setxattr =          selinux_inode_post_setxattr,
5502         .inode_getxattr =               selinux_inode_getxattr,
5503         .inode_listxattr =              selinux_inode_listxattr,
5504         .inode_removexattr =            selinux_inode_removexattr,
5505         .inode_getsecurity =            selinux_inode_getsecurity,
5506         .inode_setsecurity =            selinux_inode_setsecurity,
5507         .inode_listsecurity =           selinux_inode_listsecurity,
5508         .inode_getsecid =               selinux_inode_getsecid,
5509
5510         .file_permission =              selinux_file_permission,
5511         .file_alloc_security =          selinux_file_alloc_security,
5512         .file_free_security =           selinux_file_free_security,
5513         .file_ioctl =                   selinux_file_ioctl,
5514         .file_mmap =                    selinux_file_mmap,
5515         .file_mprotect =                selinux_file_mprotect,
5516         .file_lock =                    selinux_file_lock,
5517         .file_fcntl =                   selinux_file_fcntl,
5518         .file_set_fowner =              selinux_file_set_fowner,
5519         .file_send_sigiotask =          selinux_file_send_sigiotask,
5520         .file_receive =                 selinux_file_receive,
5521
5522         .dentry_open =                  selinux_dentry_open,
5523
5524         .task_create =                  selinux_task_create,
5525         .cred_alloc_blank =             selinux_cred_alloc_blank,
5526         .cred_free =                    selinux_cred_free,
5527         .cred_prepare =                 selinux_cred_prepare,
5528         .cred_transfer =                selinux_cred_transfer,
5529         .kernel_act_as =                selinux_kernel_act_as,
5530         .kernel_create_files_as =       selinux_kernel_create_files_as,
5531         .kernel_module_request =        selinux_kernel_module_request,
5532         .task_setpgid =                 selinux_task_setpgid,
5533         .task_getpgid =                 selinux_task_getpgid,
5534         .task_getsid =                  selinux_task_getsid,
5535         .task_getsecid =                selinux_task_getsecid,
5536         .task_setnice =                 selinux_task_setnice,
5537         .task_setioprio =               selinux_task_setioprio,
5538         .task_getioprio =               selinux_task_getioprio,
5539         .task_setrlimit =               selinux_task_setrlimit,
5540         .task_setscheduler =            selinux_task_setscheduler,
5541         .task_getscheduler =            selinux_task_getscheduler,
5542         .task_movememory =              selinux_task_movememory,
5543         .task_kill =                    selinux_task_kill,
5544         .task_wait =                    selinux_task_wait,
5545         .task_to_inode =                selinux_task_to_inode,
5546
5547         .ipc_permission =               selinux_ipc_permission,
5548         .ipc_getsecid =                 selinux_ipc_getsecid,
5549
5550         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5551         .msg_msg_free_security =        selinux_msg_msg_free_security,
5552
5553         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5554         .msg_queue_free_security =      selinux_msg_queue_free_security,
5555         .msg_queue_associate =          selinux_msg_queue_associate,
5556         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5557         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5558         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5559
5560         .shm_alloc_security =           selinux_shm_alloc_security,
5561         .shm_free_security =            selinux_shm_free_security,
5562         .shm_associate =                selinux_shm_associate,
5563         .shm_shmctl =                   selinux_shm_shmctl,
5564         .shm_shmat =                    selinux_shm_shmat,
5565
5566         .sem_alloc_security =           selinux_sem_alloc_security,
5567         .sem_free_security =            selinux_sem_free_security,
5568         .sem_associate =                selinux_sem_associate,
5569         .sem_semctl =                   selinux_sem_semctl,
5570         .sem_semop =                    selinux_sem_semop,
5571
5572         .d_instantiate =                selinux_d_instantiate,
5573
5574         .getprocattr =                  selinux_getprocattr,
5575         .setprocattr =                  selinux_setprocattr,
5576
5577         .secid_to_secctx =              selinux_secid_to_secctx,
5578         .secctx_to_secid =              selinux_secctx_to_secid,
5579         .release_secctx =               selinux_release_secctx,
5580         .inode_notifysecctx =           selinux_inode_notifysecctx,
5581         .inode_setsecctx =              selinux_inode_setsecctx,
5582         .inode_getsecctx =              selinux_inode_getsecctx,
5583
5584         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5585         .unix_may_send =                selinux_socket_unix_may_send,
5586
5587         .socket_create =                selinux_socket_create,
5588         .socket_post_create =           selinux_socket_post_create,
5589         .socket_bind =                  selinux_socket_bind,
5590         .socket_connect =               selinux_socket_connect,
5591         .socket_listen =                selinux_socket_listen,
5592         .socket_accept =                selinux_socket_accept,
5593         .socket_sendmsg =               selinux_socket_sendmsg,
5594         .socket_recvmsg =               selinux_socket_recvmsg,
5595         .socket_getsockname =           selinux_socket_getsockname,
5596         .socket_getpeername =           selinux_socket_getpeername,
5597         .socket_getsockopt =            selinux_socket_getsockopt,
5598         .socket_setsockopt =            selinux_socket_setsockopt,
5599         .socket_shutdown =              selinux_socket_shutdown,
5600         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5601         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5602         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5603         .sk_alloc_security =            selinux_sk_alloc_security,
5604         .sk_free_security =             selinux_sk_free_security,
5605         .sk_clone_security =            selinux_sk_clone_security,
5606         .sk_getsecid =                  selinux_sk_getsecid,
5607         .sock_graft =                   selinux_sock_graft,
5608         .inet_conn_request =            selinux_inet_conn_request,
5609         .inet_csk_clone =               selinux_inet_csk_clone,
5610         .inet_conn_established =        selinux_inet_conn_established,
5611         .req_classify_flow =            selinux_req_classify_flow,
5612         .tun_dev_create =               selinux_tun_dev_create,
5613         .tun_dev_post_create =          selinux_tun_dev_post_create,
5614         .tun_dev_attach =               selinux_tun_dev_attach,
5615
5616 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5617         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5618         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5619         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5620         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5621         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5622         .xfrm_state_free_security =     selinux_xfrm_state_free,
5623         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5624         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5625         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5626         .xfrm_decode_session =          selinux_xfrm_decode_session,
5627 #endif
5628
5629 #ifdef CONFIG_KEYS
5630         .key_alloc =                    selinux_key_alloc,
5631         .key_free =                     selinux_key_free,
5632         .key_permission =               selinux_key_permission,
5633         .key_getsecurity =              selinux_key_getsecurity,
5634 #endif
5635
5636 #ifdef CONFIG_AUDIT
5637         .audit_rule_init =              selinux_audit_rule_init,
5638         .audit_rule_known =             selinux_audit_rule_known,
5639         .audit_rule_match =             selinux_audit_rule_match,
5640         .audit_rule_free =              selinux_audit_rule_free,
5641 #endif
5642 };
5643
5644 static __init int selinux_init(void)
5645 {
5646         if (!security_module_enable(&selinux_ops)) {
5647                 selinux_enabled = 0;
5648                 return 0;
5649         }
5650
5651         if (!selinux_enabled) {
5652                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5653                 return 0;
5654         }
5655
5656         printk(KERN_INFO "SELinux:  Initializing.\n");
5657
5658         /* Set the security state for the initial task. */
5659         cred_init_security();
5660
5661         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5662                                             sizeof(struct inode_security_struct),
5663                                             0, SLAB_PANIC, NULL);
5664         avc_init();
5665
5666         secondary_ops = security_ops;
5667         if (!secondary_ops)
5668                 panic("SELinux: No initial security operations\n");
5669         if (register_security(&selinux_ops))
5670                 panic("SELinux: Unable to register with kernel.\n");
5671
5672         if (selinux_enforcing)
5673                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5674         else
5675                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5676
5677         return 0;
5678 }
5679
5680 void selinux_complete_init(void)
5681 {
5682         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5683
5684         /* Set up any superblocks initialized prior to the policy load. */
5685         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5686         spin_lock(&sb_lock);
5687         spin_lock(&sb_security_lock);
5688 next_sb:
5689         if (!list_empty(&superblock_security_head)) {
5690                 struct superblock_security_struct *sbsec =
5691                                 list_entry(superblock_security_head.next,
5692                                            struct superblock_security_struct,
5693                                            list);
5694                 struct super_block *sb = sbsec->sb;
5695                 sb->s_count++;
5696                 spin_unlock(&sb_security_lock);
5697                 spin_unlock(&sb_lock);
5698                 down_read(&sb->s_umount);
5699                 if (sb->s_root)
5700                         superblock_doinit(sb, NULL);
5701                 drop_super(sb);
5702                 spin_lock(&sb_lock);
5703                 spin_lock(&sb_security_lock);
5704                 list_del_init(&sbsec->list);
5705                 goto next_sb;
5706         }
5707         spin_unlock(&sb_security_lock);
5708         spin_unlock(&sb_lock);
5709 }
5710
5711 /* SELinux requires early initialization in order to label
5712    all processes and objects when they are created. */
5713 security_initcall(selinux_init);
5714
5715 #if defined(CONFIG_NETFILTER)
5716
5717 static struct nf_hook_ops selinux_ipv4_ops[] = {
5718         {
5719                 .hook =         selinux_ipv4_postroute,
5720                 .owner =        THIS_MODULE,
5721                 .pf =           PF_INET,
5722                 .hooknum =      NF_INET_POST_ROUTING,
5723                 .priority =     NF_IP_PRI_SELINUX_LAST,
5724         },
5725         {
5726                 .hook =         selinux_ipv4_forward,
5727                 .owner =        THIS_MODULE,
5728                 .pf =           PF_INET,
5729                 .hooknum =      NF_INET_FORWARD,
5730                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5731         },
5732         {
5733                 .hook =         selinux_ipv4_output,
5734                 .owner =        THIS_MODULE,
5735                 .pf =           PF_INET,
5736                 .hooknum =      NF_INET_LOCAL_OUT,
5737                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5738         }
5739 };
5740
5741 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5742
5743 static struct nf_hook_ops selinux_ipv6_ops[] = {
5744         {
5745                 .hook =         selinux_ipv6_postroute,
5746                 .owner =        THIS_MODULE,
5747                 .pf =           PF_INET6,
5748                 .hooknum =      NF_INET_POST_ROUTING,
5749                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5750         },
5751         {
5752                 .hook =         selinux_ipv6_forward,
5753                 .owner =        THIS_MODULE,
5754                 .pf =           PF_INET6,
5755                 .hooknum =      NF_INET_FORWARD,
5756                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5757         }
5758 };
5759
5760 #endif  /* IPV6 */
5761
5762 static int __init selinux_nf_ip_init(void)
5763 {
5764         int err = 0;
5765
5766         if (!selinux_enabled)
5767                 goto out;
5768
5769         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5770
5771         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5772         if (err)
5773                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5774
5775 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5776         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5777         if (err)
5778                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5779 #endif  /* IPV6 */
5780
5781 out:
5782         return err;
5783 }
5784
5785 __initcall(selinux_nf_ip_init);
5786
5787 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5788 static void selinux_nf_ip_exit(void)
5789 {
5790         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5791
5792         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5793 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5794         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5795 #endif  /* IPV6 */
5796 }
5797 #endif
5798
5799 #else /* CONFIG_NETFILTER */
5800
5801 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5802 #define selinux_nf_ip_exit()
5803 #endif
5804
5805 #endif /* CONFIG_NETFILTER */
5806
5807 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5808 static int selinux_disabled;
5809
5810 int selinux_disable(void)
5811 {
5812         extern void exit_sel_fs(void);
5813
5814         if (ss_initialized) {
5815                 /* Not permitted after initial policy load. */
5816                 return -EINVAL;
5817         }
5818
5819         if (selinux_disabled) {
5820                 /* Only do this once. */
5821                 return -EINVAL;
5822         }
5823
5824         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5825
5826         selinux_disabled = 1;
5827         selinux_enabled = 0;
5828
5829         /* Reset security_ops to the secondary module, dummy or capability. */
5830         security_ops = secondary_ops;
5831
5832         /* Try to destroy the avc node cache */
5833         avc_disable();
5834
5835         /* Unregister netfilter hooks. */
5836         selinux_nf_ip_exit();
5837
5838         /* Unregister selinuxfs. */
5839         exit_sel_fs();
5840
5841         return 0;
5842 }
5843 #endif