tty: introduce no_tty and use it in selinux
[linux-2.6.git] / security / selinux / hooks.c
1 /*
2  *  NSA Security-Enhanced Linux (SELinux) security module
3  *
4  *  This file contains the SELinux hook function implementations.
5  *
6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
7  *            Chris Vance, <cvance@nai.com>
8  *            Wayne Salamon, <wsalamon@nai.com>
9  *            James Morris <jmorris@redhat.com>
10  *
11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
14  *                          <dgoeddel@trustedcs.com>
15  *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
16  *                     Paul Moore, <paul.moore@hp.com>
17  *
18  *      This program is free software; you can redistribute it and/or modify
19  *      it under the terms of the GNU General Public License version 2,
20  *      as published by the Free Software Foundation.
21  */
22
23 #include <linux/module.h>
24 #include <linux/init.h>
25 #include <linux/kernel.h>
26 #include <linux/ptrace.h>
27 #include <linux/errno.h>
28 #include <linux/sched.h>
29 #include <linux/security.h>
30 #include <linux/xattr.h>
31 #include <linux/capability.h>
32 #include <linux/unistd.h>
33 #include <linux/mm.h>
34 #include <linux/mman.h>
35 #include <linux/slab.h>
36 #include <linux/pagemap.h>
37 #include <linux/swap.h>
38 #include <linux/smp_lock.h>
39 #include <linux/spinlock.h>
40 #include <linux/syscalls.h>
41 #include <linux/file.h>
42 #include <linux/namei.h>
43 #include <linux/mount.h>
44 #include <linux/ext2_fs.h>
45 #include <linux/proc_fs.h>
46 #include <linux/kd.h>
47 #include <linux/netfilter_ipv4.h>
48 #include <linux/netfilter_ipv6.h>
49 #include <linux/tty.h>
50 #include <net/icmp.h>
51 #include <net/ip.h>             /* for sysctl_local_port_range[] */
52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
53 #include <asm/uaccess.h>
54 #include <asm/ioctls.h>
55 #include <linux/bitops.h>
56 #include <linux/interrupt.h>
57 #include <linux/netdevice.h>    /* for network interface checks */
58 #include <linux/netlink.h>
59 #include <linux/tcp.h>
60 #include <linux/udp.h>
61 #include <linux/dccp.h>
62 #include <linux/quota.h>
63 #include <linux/un.h>           /* for Unix socket types */
64 #include <net/af_unix.h>        /* for Unix socket types */
65 #include <linux/parser.h>
66 #include <linux/nfs_mount.h>
67 #include <net/ipv6.h>
68 #include <linux/hugetlb.h>
69 #include <linux/personality.h>
70 #include <linux/sysctl.h>
71 #include <linux/audit.h>
72 #include <linux/string.h>
73 #include <linux/selinux.h>
74 #include <linux/mutex.h>
75
76 #include "avc.h"
77 #include "objsec.h"
78 #include "netif.h"
79 #include "xfrm.h"
80 #include "netlabel.h"
81
82 #define XATTR_SELINUX_SUFFIX "selinux"
83 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
84
85 extern unsigned int policydb_loaded_version;
86 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
87 extern int selinux_compat_net;
88
89 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
90 int selinux_enforcing = 0;
91
92 static int __init enforcing_setup(char *str)
93 {
94         selinux_enforcing = simple_strtol(str,NULL,0);
95         return 1;
96 }
97 __setup("enforcing=", enforcing_setup);
98 #endif
99
100 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
101 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
102
103 static int __init selinux_enabled_setup(char *str)
104 {
105         selinux_enabled = simple_strtol(str, NULL, 0);
106         return 1;
107 }
108 __setup("selinux=", selinux_enabled_setup);
109 #else
110 int selinux_enabled = 1;
111 #endif
112
113 /* Original (dummy) security module. */
114 static struct security_operations *original_ops = NULL;
115
116 /* Minimal support for a secondary security module,
117    just to allow the use of the dummy or capability modules.
118    The owlsm module can alternatively be used as a secondary
119    module as long as CONFIG_OWLSM_FD is not enabled. */
120 static struct security_operations *secondary_ops = NULL;
121
122 /* Lists of inode and superblock security structures initialized
123    before the policy was loaded. */
124 static LIST_HEAD(superblock_security_head);
125 static DEFINE_SPINLOCK(sb_security_lock);
126
127 static struct kmem_cache *sel_inode_cache;
128
129 /* Return security context for a given sid or just the context 
130    length if the buffer is null or length is 0 */
131 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
132 {
133         char *context;
134         unsigned len;
135         int rc;
136
137         rc = security_sid_to_context(sid, &context, &len);
138         if (rc)
139                 return rc;
140
141         if (!buffer || !size)
142                 goto getsecurity_exit;
143
144         if (size < len) {
145                 len = -ERANGE;
146                 goto getsecurity_exit;
147         }
148         memcpy(buffer, context, len);
149
150 getsecurity_exit:
151         kfree(context);
152         return len;
153 }
154
155 /* Allocate and free functions for each kind of security blob. */
156
157 static int task_alloc_security(struct task_struct *task)
158 {
159         struct task_security_struct *tsec;
160
161         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
162         if (!tsec)
163                 return -ENOMEM;
164
165         tsec->task = task;
166         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
167         task->security = tsec;
168
169         return 0;
170 }
171
172 static void task_free_security(struct task_struct *task)
173 {
174         struct task_security_struct *tsec = task->security;
175         task->security = NULL;
176         kfree(tsec);
177 }
178
179 static int inode_alloc_security(struct inode *inode)
180 {
181         struct task_security_struct *tsec = current->security;
182         struct inode_security_struct *isec;
183
184         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
185         if (!isec)
186                 return -ENOMEM;
187
188         mutex_init(&isec->lock);
189         INIT_LIST_HEAD(&isec->list);
190         isec->inode = inode;
191         isec->sid = SECINITSID_UNLABELED;
192         isec->sclass = SECCLASS_FILE;
193         isec->task_sid = tsec->sid;
194         inode->i_security = isec;
195
196         return 0;
197 }
198
199 static void inode_free_security(struct inode *inode)
200 {
201         struct inode_security_struct *isec = inode->i_security;
202         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
203
204         spin_lock(&sbsec->isec_lock);
205         if (!list_empty(&isec->list))
206                 list_del_init(&isec->list);
207         spin_unlock(&sbsec->isec_lock);
208
209         inode->i_security = NULL;
210         kmem_cache_free(sel_inode_cache, isec);
211 }
212
213 static int file_alloc_security(struct file *file)
214 {
215         struct task_security_struct *tsec = current->security;
216         struct file_security_struct *fsec;
217
218         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
219         if (!fsec)
220                 return -ENOMEM;
221
222         fsec->file = file;
223         fsec->sid = tsec->sid;
224         fsec->fown_sid = tsec->sid;
225         file->f_security = fsec;
226
227         return 0;
228 }
229
230 static void file_free_security(struct file *file)
231 {
232         struct file_security_struct *fsec = file->f_security;
233         file->f_security = NULL;
234         kfree(fsec);
235 }
236
237 static int superblock_alloc_security(struct super_block *sb)
238 {
239         struct superblock_security_struct *sbsec;
240
241         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
242         if (!sbsec)
243                 return -ENOMEM;
244
245         mutex_init(&sbsec->lock);
246         INIT_LIST_HEAD(&sbsec->list);
247         INIT_LIST_HEAD(&sbsec->isec_head);
248         spin_lock_init(&sbsec->isec_lock);
249         sbsec->sb = sb;
250         sbsec->sid = SECINITSID_UNLABELED;
251         sbsec->def_sid = SECINITSID_FILE;
252         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
253         sb->s_security = sbsec;
254
255         return 0;
256 }
257
258 static void superblock_free_security(struct super_block *sb)
259 {
260         struct superblock_security_struct *sbsec = sb->s_security;
261
262         spin_lock(&sb_security_lock);
263         if (!list_empty(&sbsec->list))
264                 list_del_init(&sbsec->list);
265         spin_unlock(&sb_security_lock);
266
267         sb->s_security = NULL;
268         kfree(sbsec);
269 }
270
271 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
272 {
273         struct sk_security_struct *ssec;
274
275         ssec = kzalloc(sizeof(*ssec), priority);
276         if (!ssec)
277                 return -ENOMEM;
278
279         ssec->sk = sk;
280         ssec->peer_sid = SECINITSID_UNLABELED;
281         ssec->sid = SECINITSID_UNLABELED;
282         sk->sk_security = ssec;
283
284         selinux_netlbl_sk_security_init(ssec, family);
285
286         return 0;
287 }
288
289 static void sk_free_security(struct sock *sk)
290 {
291         struct sk_security_struct *ssec = sk->sk_security;
292
293         sk->sk_security = NULL;
294         kfree(ssec);
295 }
296
297 /* The security server must be initialized before
298    any labeling or access decisions can be provided. */
299 extern int ss_initialized;
300
301 /* The file system's label must be initialized prior to use. */
302
303 static char *labeling_behaviors[6] = {
304         "uses xattr",
305         "uses transition SIDs",
306         "uses task SIDs",
307         "uses genfs_contexts",
308         "not configured for labeling",
309         "uses mountpoint labeling",
310 };
311
312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
313
314 static inline int inode_doinit(struct inode *inode)
315 {
316         return inode_doinit_with_dentry(inode, NULL);
317 }
318
319 enum {
320         Opt_context = 1,
321         Opt_fscontext = 2,
322         Opt_defcontext = 4,
323         Opt_rootcontext = 8,
324 };
325
326 static match_table_t tokens = {
327         {Opt_context, "context=%s"},
328         {Opt_fscontext, "fscontext=%s"},
329         {Opt_defcontext, "defcontext=%s"},
330         {Opt_rootcontext, "rootcontext=%s"},
331 };
332
333 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
334
335 static int may_context_mount_sb_relabel(u32 sid,
336                         struct superblock_security_struct *sbsec,
337                         struct task_security_struct *tsec)
338 {
339         int rc;
340
341         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
342                           FILESYSTEM__RELABELFROM, NULL);
343         if (rc)
344                 return rc;
345
346         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
347                           FILESYSTEM__RELABELTO, NULL);
348         return rc;
349 }
350
351 static int may_context_mount_inode_relabel(u32 sid,
352                         struct superblock_security_struct *sbsec,
353                         struct task_security_struct *tsec)
354 {
355         int rc;
356         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
357                           FILESYSTEM__RELABELFROM, NULL);
358         if (rc)
359                 return rc;
360
361         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
362                           FILESYSTEM__ASSOCIATE, NULL);
363         return rc;
364 }
365
366 static int try_context_mount(struct super_block *sb, void *data)
367 {
368         char *context = NULL, *defcontext = NULL;
369         char *fscontext = NULL, *rootcontext = NULL;
370         const char *name;
371         u32 sid;
372         int alloc = 0, rc = 0, seen = 0;
373         struct task_security_struct *tsec = current->security;
374         struct superblock_security_struct *sbsec = sb->s_security;
375
376         if (!data)
377                 goto out;
378
379         name = sb->s_type->name;
380
381         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
382
383                 /* NFS we understand. */
384                 if (!strcmp(name, "nfs")) {
385                         struct nfs_mount_data *d = data;
386
387                         if (d->version <  NFS_MOUNT_VERSION)
388                                 goto out;
389
390                         if (d->context[0]) {
391                                 context = d->context;
392                                 seen |= Opt_context;
393                         }
394                 } else
395                         goto out;
396
397         } else {
398                 /* Standard string-based options. */
399                 char *p, *options = data;
400
401                 while ((p = strsep(&options, "|")) != NULL) {
402                         int token;
403                         substring_t args[MAX_OPT_ARGS];
404
405                         if (!*p)
406                                 continue;
407
408                         token = match_token(p, tokens, args);
409
410                         switch (token) {
411                         case Opt_context:
412                                 if (seen & (Opt_context|Opt_defcontext)) {
413                                         rc = -EINVAL;
414                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
415                                         goto out_free;
416                                 }
417                                 context = match_strdup(&args[0]);
418                                 if (!context) {
419                                         rc = -ENOMEM;
420                                         goto out_free;
421                                 }
422                                 if (!alloc)
423                                         alloc = 1;
424                                 seen |= Opt_context;
425                                 break;
426
427                         case Opt_fscontext:
428                                 if (seen & Opt_fscontext) {
429                                         rc = -EINVAL;
430                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
431                                         goto out_free;
432                                 }
433                                 fscontext = match_strdup(&args[0]);
434                                 if (!fscontext) {
435                                         rc = -ENOMEM;
436                                         goto out_free;
437                                 }
438                                 if (!alloc)
439                                         alloc = 1;
440                                 seen |= Opt_fscontext;
441                                 break;
442
443                         case Opt_rootcontext:
444                                 if (seen & Opt_rootcontext) {
445                                         rc = -EINVAL;
446                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
447                                         goto out_free;
448                                 }
449                                 rootcontext = match_strdup(&args[0]);
450                                 if (!rootcontext) {
451                                         rc = -ENOMEM;
452                                         goto out_free;
453                                 }
454                                 if (!alloc)
455                                         alloc = 1;
456                                 seen |= Opt_rootcontext;
457                                 break;
458
459                         case Opt_defcontext:
460                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
461                                         rc = -EINVAL;
462                                         printk(KERN_WARNING "SELinux:  "
463                                                "defcontext option is invalid "
464                                                "for this filesystem type\n");
465                                         goto out_free;
466                                 }
467                                 if (seen & (Opt_context|Opt_defcontext)) {
468                                         rc = -EINVAL;
469                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
470                                         goto out_free;
471                                 }
472                                 defcontext = match_strdup(&args[0]);
473                                 if (!defcontext) {
474                                         rc = -ENOMEM;
475                                         goto out_free;
476                                 }
477                                 if (!alloc)
478                                         alloc = 1;
479                                 seen |= Opt_defcontext;
480                                 break;
481
482                         default:
483                                 rc = -EINVAL;
484                                 printk(KERN_WARNING "SELinux:  unknown mount "
485                                        "option\n");
486                                 goto out_free;
487
488                         }
489                 }
490         }
491
492         if (!seen)
493                 goto out;
494
495         /* sets the context of the superblock for the fs being mounted. */
496         if (fscontext) {
497                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
498                 if (rc) {
499                         printk(KERN_WARNING "SELinux: security_context_to_sid"
500                                "(%s) failed for (dev %s, type %s) errno=%d\n",
501                                fscontext, sb->s_id, name, rc);
502                         goto out_free;
503                 }
504
505                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
506                 if (rc)
507                         goto out_free;
508
509                 sbsec->sid = sid;
510         }
511
512         /*
513          * Switch to using mount point labeling behavior.
514          * sets the label used on all file below the mountpoint, and will set
515          * the superblock context if not already set.
516          */
517         if (context) {
518                 rc = security_context_to_sid(context, strlen(context), &sid);
519                 if (rc) {
520                         printk(KERN_WARNING "SELinux: security_context_to_sid"
521                                "(%s) failed for (dev %s, type %s) errno=%d\n",
522                                context, sb->s_id, name, rc);
523                         goto out_free;
524                 }
525
526                 if (!fscontext) {
527                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
528                         if (rc)
529                                 goto out_free;
530                         sbsec->sid = sid;
531                 } else {
532                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
533                         if (rc)
534                                 goto out_free;
535                 }
536                 sbsec->mntpoint_sid = sid;
537
538                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
539         }
540
541         if (rootcontext) {
542                 struct inode *inode = sb->s_root->d_inode;
543                 struct inode_security_struct *isec = inode->i_security;
544                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
545                 if (rc) {
546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
548                                rootcontext, sb->s_id, name, rc);
549                         goto out_free;
550                 }
551
552                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
553                 if (rc)
554                         goto out_free;
555
556                 isec->sid = sid;
557                 isec->initialized = 1;
558         }
559
560         if (defcontext) {
561                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
562                 if (rc) {
563                         printk(KERN_WARNING "SELinux: security_context_to_sid"
564                                "(%s) failed for (dev %s, type %s) errno=%d\n",
565                                defcontext, sb->s_id, name, rc);
566                         goto out_free;
567                 }
568
569                 if (sid == sbsec->def_sid)
570                         goto out_free;
571
572                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
573                 if (rc)
574                         goto out_free;
575
576                 sbsec->def_sid = sid;
577         }
578
579 out_free:
580         if (alloc) {
581                 kfree(context);
582                 kfree(defcontext);
583                 kfree(fscontext);
584                 kfree(rootcontext);
585         }
586 out:
587         return rc;
588 }
589
590 static int superblock_doinit(struct super_block *sb, void *data)
591 {
592         struct superblock_security_struct *sbsec = sb->s_security;
593         struct dentry *root = sb->s_root;
594         struct inode *inode = root->d_inode;
595         int rc = 0;
596
597         mutex_lock(&sbsec->lock);
598         if (sbsec->initialized)
599                 goto out;
600
601         if (!ss_initialized) {
602                 /* Defer initialization until selinux_complete_init,
603                    after the initial policy is loaded and the security
604                    server is ready to handle calls. */
605                 spin_lock(&sb_security_lock);
606                 if (list_empty(&sbsec->list))
607                         list_add(&sbsec->list, &superblock_security_head);
608                 spin_unlock(&sb_security_lock);
609                 goto out;
610         }
611
612         /* Determine the labeling behavior to use for this filesystem type. */
613         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
614         if (rc) {
615                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
616                        __FUNCTION__, sb->s_type->name, rc);
617                 goto out;
618         }
619
620         rc = try_context_mount(sb, data);
621         if (rc)
622                 goto out;
623
624         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
625                 /* Make sure that the xattr handler exists and that no
626                    error other than -ENODATA is returned by getxattr on
627                    the root directory.  -ENODATA is ok, as this may be
628                    the first boot of the SELinux kernel before we have
629                    assigned xattr values to the filesystem. */
630                 if (!inode->i_op->getxattr) {
631                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
632                                "xattr support\n", sb->s_id, sb->s_type->name);
633                         rc = -EOPNOTSUPP;
634                         goto out;
635                 }
636                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
637                 if (rc < 0 && rc != -ENODATA) {
638                         if (rc == -EOPNOTSUPP)
639                                 printk(KERN_WARNING "SELinux: (dev %s, type "
640                                        "%s) has no security xattr handler\n",
641                                        sb->s_id, sb->s_type->name);
642                         else
643                                 printk(KERN_WARNING "SELinux: (dev %s, type "
644                                        "%s) getxattr errno %d\n", sb->s_id,
645                                        sb->s_type->name, -rc);
646                         goto out;
647                 }
648         }
649
650         if (strcmp(sb->s_type->name, "proc") == 0)
651                 sbsec->proc = 1;
652
653         sbsec->initialized = 1;
654
655         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
656                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
657                        sb->s_id, sb->s_type->name);
658         }
659         else {
660                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
661                        sb->s_id, sb->s_type->name,
662                        labeling_behaviors[sbsec->behavior-1]);
663         }
664
665         /* Initialize the root inode. */
666         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
667
668         /* Initialize any other inodes associated with the superblock, e.g.
669            inodes created prior to initial policy load or inodes created
670            during get_sb by a pseudo filesystem that directly
671            populates itself. */
672         spin_lock(&sbsec->isec_lock);
673 next_inode:
674         if (!list_empty(&sbsec->isec_head)) {
675                 struct inode_security_struct *isec =
676                                 list_entry(sbsec->isec_head.next,
677                                            struct inode_security_struct, list);
678                 struct inode *inode = isec->inode;
679                 spin_unlock(&sbsec->isec_lock);
680                 inode = igrab(inode);
681                 if (inode) {
682                         if (!IS_PRIVATE (inode))
683                                 inode_doinit(inode);
684                         iput(inode);
685                 }
686                 spin_lock(&sbsec->isec_lock);
687                 list_del_init(&isec->list);
688                 goto next_inode;
689         }
690         spin_unlock(&sbsec->isec_lock);
691 out:
692         mutex_unlock(&sbsec->lock);
693         return rc;
694 }
695
696 static inline u16 inode_mode_to_security_class(umode_t mode)
697 {
698         switch (mode & S_IFMT) {
699         case S_IFSOCK:
700                 return SECCLASS_SOCK_FILE;
701         case S_IFLNK:
702                 return SECCLASS_LNK_FILE;
703         case S_IFREG:
704                 return SECCLASS_FILE;
705         case S_IFBLK:
706                 return SECCLASS_BLK_FILE;
707         case S_IFDIR:
708                 return SECCLASS_DIR;
709         case S_IFCHR:
710                 return SECCLASS_CHR_FILE;
711         case S_IFIFO:
712                 return SECCLASS_FIFO_FILE;
713
714         }
715
716         return SECCLASS_FILE;
717 }
718
719 static inline int default_protocol_stream(int protocol)
720 {
721         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
722 }
723
724 static inline int default_protocol_dgram(int protocol)
725 {
726         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
727 }
728
729 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
730 {
731         switch (family) {
732         case PF_UNIX:
733                 switch (type) {
734                 case SOCK_STREAM:
735                 case SOCK_SEQPACKET:
736                         return SECCLASS_UNIX_STREAM_SOCKET;
737                 case SOCK_DGRAM:
738                         return SECCLASS_UNIX_DGRAM_SOCKET;
739                 }
740                 break;
741         case PF_INET:
742         case PF_INET6:
743                 switch (type) {
744                 case SOCK_STREAM:
745                         if (default_protocol_stream(protocol))
746                                 return SECCLASS_TCP_SOCKET;
747                         else
748                                 return SECCLASS_RAWIP_SOCKET;
749                 case SOCK_DGRAM:
750                         if (default_protocol_dgram(protocol))
751                                 return SECCLASS_UDP_SOCKET;
752                         else
753                                 return SECCLASS_RAWIP_SOCKET;
754                 case SOCK_DCCP:
755                         return SECCLASS_DCCP_SOCKET;
756                 default:
757                         return SECCLASS_RAWIP_SOCKET;
758                 }
759                 break;
760         case PF_NETLINK:
761                 switch (protocol) {
762                 case NETLINK_ROUTE:
763                         return SECCLASS_NETLINK_ROUTE_SOCKET;
764                 case NETLINK_FIREWALL:
765                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
766                 case NETLINK_INET_DIAG:
767                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
768                 case NETLINK_NFLOG:
769                         return SECCLASS_NETLINK_NFLOG_SOCKET;
770                 case NETLINK_XFRM:
771                         return SECCLASS_NETLINK_XFRM_SOCKET;
772                 case NETLINK_SELINUX:
773                         return SECCLASS_NETLINK_SELINUX_SOCKET;
774                 case NETLINK_AUDIT:
775                         return SECCLASS_NETLINK_AUDIT_SOCKET;
776                 case NETLINK_IP6_FW:
777                         return SECCLASS_NETLINK_IP6FW_SOCKET;
778                 case NETLINK_DNRTMSG:
779                         return SECCLASS_NETLINK_DNRT_SOCKET;
780                 case NETLINK_KOBJECT_UEVENT:
781                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
782                 default:
783                         return SECCLASS_NETLINK_SOCKET;
784                 }
785         case PF_PACKET:
786                 return SECCLASS_PACKET_SOCKET;
787         case PF_KEY:
788                 return SECCLASS_KEY_SOCKET;
789         case PF_APPLETALK:
790                 return SECCLASS_APPLETALK_SOCKET;
791         }
792
793         return SECCLASS_SOCKET;
794 }
795
796 #ifdef CONFIG_PROC_FS
797 static int selinux_proc_get_sid(struct proc_dir_entry *de,
798                                 u16 tclass,
799                                 u32 *sid)
800 {
801         int buflen, rc;
802         char *buffer, *path, *end;
803
804         buffer = (char*)__get_free_page(GFP_KERNEL);
805         if (!buffer)
806                 return -ENOMEM;
807
808         buflen = PAGE_SIZE;
809         end = buffer+buflen;
810         *--end = '\0';
811         buflen--;
812         path = end-1;
813         *path = '/';
814         while (de && de != de->parent) {
815                 buflen -= de->namelen + 1;
816                 if (buflen < 0)
817                         break;
818                 end -= de->namelen;
819                 memcpy(end, de->name, de->namelen);
820                 *--end = '/';
821                 path = end;
822                 de = de->parent;
823         }
824         rc = security_genfs_sid("proc", path, tclass, sid);
825         free_page((unsigned long)buffer);
826         return rc;
827 }
828 #else
829 static int selinux_proc_get_sid(struct proc_dir_entry *de,
830                                 u16 tclass,
831                                 u32 *sid)
832 {
833         return -EINVAL;
834 }
835 #endif
836
837 /* The inode's security attributes must be initialized before first use. */
838 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
839 {
840         struct superblock_security_struct *sbsec = NULL;
841         struct inode_security_struct *isec = inode->i_security;
842         u32 sid;
843         struct dentry *dentry;
844 #define INITCONTEXTLEN 255
845         char *context = NULL;
846         unsigned len = 0;
847         int rc = 0;
848
849         if (isec->initialized)
850                 goto out;
851
852         mutex_lock(&isec->lock);
853         if (isec->initialized)
854                 goto out_unlock;
855
856         sbsec = inode->i_sb->s_security;
857         if (!sbsec->initialized) {
858                 /* Defer initialization until selinux_complete_init,
859                    after the initial policy is loaded and the security
860                    server is ready to handle calls. */
861                 spin_lock(&sbsec->isec_lock);
862                 if (list_empty(&isec->list))
863                         list_add(&isec->list, &sbsec->isec_head);
864                 spin_unlock(&sbsec->isec_lock);
865                 goto out_unlock;
866         }
867
868         switch (sbsec->behavior) {
869         case SECURITY_FS_USE_XATTR:
870                 if (!inode->i_op->getxattr) {
871                         isec->sid = sbsec->def_sid;
872                         break;
873                 }
874
875                 /* Need a dentry, since the xattr API requires one.
876                    Life would be simpler if we could just pass the inode. */
877                 if (opt_dentry) {
878                         /* Called from d_instantiate or d_splice_alias. */
879                         dentry = dget(opt_dentry);
880                 } else {
881                         /* Called from selinux_complete_init, try to find a dentry. */
882                         dentry = d_find_alias(inode);
883                 }
884                 if (!dentry) {
885                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
886                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
887                                inode->i_ino);
888                         goto out_unlock;
889                 }
890
891                 len = INITCONTEXTLEN;
892                 context = kmalloc(len, GFP_KERNEL);
893                 if (!context) {
894                         rc = -ENOMEM;
895                         dput(dentry);
896                         goto out_unlock;
897                 }
898                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
899                                            context, len);
900                 if (rc == -ERANGE) {
901                         /* Need a larger buffer.  Query for the right size. */
902                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
903                                                    NULL, 0);
904                         if (rc < 0) {
905                                 dput(dentry);
906                                 goto out_unlock;
907                         }
908                         kfree(context);
909                         len = rc;
910                         context = kmalloc(len, GFP_KERNEL);
911                         if (!context) {
912                                 rc = -ENOMEM;
913                                 dput(dentry);
914                                 goto out_unlock;
915                         }
916                         rc = inode->i_op->getxattr(dentry,
917                                                    XATTR_NAME_SELINUX,
918                                                    context, len);
919                 }
920                 dput(dentry);
921                 if (rc < 0) {
922                         if (rc != -ENODATA) {
923                                 printk(KERN_WARNING "%s:  getxattr returned "
924                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
925                                        -rc, inode->i_sb->s_id, inode->i_ino);
926                                 kfree(context);
927                                 goto out_unlock;
928                         }
929                         /* Map ENODATA to the default file SID */
930                         sid = sbsec->def_sid;
931                         rc = 0;
932                 } else {
933                         rc = security_context_to_sid_default(context, rc, &sid,
934                                                              sbsec->def_sid);
935                         if (rc) {
936                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
937                                        "returned %d for dev=%s ino=%ld\n",
938                                        __FUNCTION__, context, -rc,
939                                        inode->i_sb->s_id, inode->i_ino);
940                                 kfree(context);
941                                 /* Leave with the unlabeled SID */
942                                 rc = 0;
943                                 break;
944                         }
945                 }
946                 kfree(context);
947                 isec->sid = sid;
948                 break;
949         case SECURITY_FS_USE_TASK:
950                 isec->sid = isec->task_sid;
951                 break;
952         case SECURITY_FS_USE_TRANS:
953                 /* Default to the fs SID. */
954                 isec->sid = sbsec->sid;
955
956                 /* Try to obtain a transition SID. */
957                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
958                 rc = security_transition_sid(isec->task_sid,
959                                              sbsec->sid,
960                                              isec->sclass,
961                                              &sid);
962                 if (rc)
963                         goto out_unlock;
964                 isec->sid = sid;
965                 break;
966         case SECURITY_FS_USE_MNTPOINT:
967                 isec->sid = sbsec->mntpoint_sid;
968                 break;
969         default:
970                 /* Default to the fs superblock SID. */
971                 isec->sid = sbsec->sid;
972
973                 if (sbsec->proc) {
974                         struct proc_inode *proci = PROC_I(inode);
975                         if (proci->pde) {
976                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
977                                 rc = selinux_proc_get_sid(proci->pde,
978                                                           isec->sclass,
979                                                           &sid);
980                                 if (rc)
981                                         goto out_unlock;
982                                 isec->sid = sid;
983                         }
984                 }
985                 break;
986         }
987
988         isec->initialized = 1;
989
990 out_unlock:
991         mutex_unlock(&isec->lock);
992 out:
993         if (isec->sclass == SECCLASS_FILE)
994                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
995         return rc;
996 }
997
998 /* Convert a Linux signal to an access vector. */
999 static inline u32 signal_to_av(int sig)
1000 {
1001         u32 perm = 0;
1002
1003         switch (sig) {
1004         case SIGCHLD:
1005                 /* Commonly granted from child to parent. */
1006                 perm = PROCESS__SIGCHLD;
1007                 break;
1008         case SIGKILL:
1009                 /* Cannot be caught or ignored */
1010                 perm = PROCESS__SIGKILL;
1011                 break;
1012         case SIGSTOP:
1013                 /* Cannot be caught or ignored */
1014                 perm = PROCESS__SIGSTOP;
1015                 break;
1016         default:
1017                 /* All other signals. */
1018                 perm = PROCESS__SIGNAL;
1019                 break;
1020         }
1021
1022         return perm;
1023 }
1024
1025 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1026    fork check, ptrace check, etc. */
1027 static int task_has_perm(struct task_struct *tsk1,
1028                          struct task_struct *tsk2,
1029                          u32 perms)
1030 {
1031         struct task_security_struct *tsec1, *tsec2;
1032
1033         tsec1 = tsk1->security;
1034         tsec2 = tsk2->security;
1035         return avc_has_perm(tsec1->sid, tsec2->sid,
1036                             SECCLASS_PROCESS, perms, NULL);
1037 }
1038
1039 /* Check whether a task is allowed to use a capability. */
1040 static int task_has_capability(struct task_struct *tsk,
1041                                int cap)
1042 {
1043         struct task_security_struct *tsec;
1044         struct avc_audit_data ad;
1045
1046         tsec = tsk->security;
1047
1048         AVC_AUDIT_DATA_INIT(&ad,CAP);
1049         ad.tsk = tsk;
1050         ad.u.cap = cap;
1051
1052         return avc_has_perm(tsec->sid, tsec->sid,
1053                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1054 }
1055
1056 /* Check whether a task is allowed to use a system operation. */
1057 static int task_has_system(struct task_struct *tsk,
1058                            u32 perms)
1059 {
1060         struct task_security_struct *tsec;
1061
1062         tsec = tsk->security;
1063
1064         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1065                             SECCLASS_SYSTEM, perms, NULL);
1066 }
1067
1068 /* Check whether a task has a particular permission to an inode.
1069    The 'adp' parameter is optional and allows other audit
1070    data to be passed (e.g. the dentry). */
1071 static int inode_has_perm(struct task_struct *tsk,
1072                           struct inode *inode,
1073                           u32 perms,
1074                           struct avc_audit_data *adp)
1075 {
1076         struct task_security_struct *tsec;
1077         struct inode_security_struct *isec;
1078         struct avc_audit_data ad;
1079
1080         if (unlikely (IS_PRIVATE (inode)))
1081                 return 0;
1082
1083         tsec = tsk->security;
1084         isec = inode->i_security;
1085
1086         if (!adp) {
1087                 adp = &ad;
1088                 AVC_AUDIT_DATA_INIT(&ad, FS);
1089                 ad.u.fs.inode = inode;
1090         }
1091
1092         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1093 }
1094
1095 /* Same as inode_has_perm, but pass explicit audit data containing
1096    the dentry to help the auditing code to more easily generate the
1097    pathname if needed. */
1098 static inline int dentry_has_perm(struct task_struct *tsk,
1099                                   struct vfsmount *mnt,
1100                                   struct dentry *dentry,
1101                                   u32 av)
1102 {
1103         struct inode *inode = dentry->d_inode;
1104         struct avc_audit_data ad;
1105         AVC_AUDIT_DATA_INIT(&ad,FS);
1106         ad.u.fs.mnt = mnt;
1107         ad.u.fs.dentry = dentry;
1108         return inode_has_perm(tsk, inode, av, &ad);
1109 }
1110
1111 /* Check whether a task can use an open file descriptor to
1112    access an inode in a given way.  Check access to the
1113    descriptor itself, and then use dentry_has_perm to
1114    check a particular permission to the file.
1115    Access to the descriptor is implicitly granted if it
1116    has the same SID as the process.  If av is zero, then
1117    access to the file is not checked, e.g. for cases
1118    where only the descriptor is affected like seek. */
1119 static int file_has_perm(struct task_struct *tsk,
1120                                 struct file *file,
1121                                 u32 av)
1122 {
1123         struct task_security_struct *tsec = tsk->security;
1124         struct file_security_struct *fsec = file->f_security;
1125         struct vfsmount *mnt = file->f_path.mnt;
1126         struct dentry *dentry = file->f_path.dentry;
1127         struct inode *inode = dentry->d_inode;
1128         struct avc_audit_data ad;
1129         int rc;
1130
1131         AVC_AUDIT_DATA_INIT(&ad, FS);
1132         ad.u.fs.mnt = mnt;
1133         ad.u.fs.dentry = dentry;
1134
1135         if (tsec->sid != fsec->sid) {
1136                 rc = avc_has_perm(tsec->sid, fsec->sid,
1137                                   SECCLASS_FD,
1138                                   FD__USE,
1139                                   &ad);
1140                 if (rc)
1141                         return rc;
1142         }
1143
1144         /* av is zero if only checking access to the descriptor. */
1145         if (av)
1146                 return inode_has_perm(tsk, inode, av, &ad);
1147
1148         return 0;
1149 }
1150
1151 /* Check whether a task can create a file. */
1152 static int may_create(struct inode *dir,
1153                       struct dentry *dentry,
1154                       u16 tclass)
1155 {
1156         struct task_security_struct *tsec;
1157         struct inode_security_struct *dsec;
1158         struct superblock_security_struct *sbsec;
1159         u32 newsid;
1160         struct avc_audit_data ad;
1161         int rc;
1162
1163         tsec = current->security;
1164         dsec = dir->i_security;
1165         sbsec = dir->i_sb->s_security;
1166
1167         AVC_AUDIT_DATA_INIT(&ad, FS);
1168         ad.u.fs.dentry = dentry;
1169
1170         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1171                           DIR__ADD_NAME | DIR__SEARCH,
1172                           &ad);
1173         if (rc)
1174                 return rc;
1175
1176         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1177                 newsid = tsec->create_sid;
1178         } else {
1179                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1180                                              &newsid);
1181                 if (rc)
1182                         return rc;
1183         }
1184
1185         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1186         if (rc)
1187                 return rc;
1188
1189         return avc_has_perm(newsid, sbsec->sid,
1190                             SECCLASS_FILESYSTEM,
1191                             FILESYSTEM__ASSOCIATE, &ad);
1192 }
1193
1194 /* Check whether a task can create a key. */
1195 static int may_create_key(u32 ksid,
1196                           struct task_struct *ctx)
1197 {
1198         struct task_security_struct *tsec;
1199
1200         tsec = ctx->security;
1201
1202         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1203 }
1204
1205 #define MAY_LINK   0
1206 #define MAY_UNLINK 1
1207 #define MAY_RMDIR  2
1208
1209 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1210 static int may_link(struct inode *dir,
1211                     struct dentry *dentry,
1212                     int kind)
1213
1214 {
1215         struct task_security_struct *tsec;
1216         struct inode_security_struct *dsec, *isec;
1217         struct avc_audit_data ad;
1218         u32 av;
1219         int rc;
1220
1221         tsec = current->security;
1222         dsec = dir->i_security;
1223         isec = dentry->d_inode->i_security;
1224
1225         AVC_AUDIT_DATA_INIT(&ad, FS);
1226         ad.u.fs.dentry = dentry;
1227
1228         av = DIR__SEARCH;
1229         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1230         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1231         if (rc)
1232                 return rc;
1233
1234         switch (kind) {
1235         case MAY_LINK:
1236                 av = FILE__LINK;
1237                 break;
1238         case MAY_UNLINK:
1239                 av = FILE__UNLINK;
1240                 break;
1241         case MAY_RMDIR:
1242                 av = DIR__RMDIR;
1243                 break;
1244         default:
1245                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1246                 return 0;
1247         }
1248
1249         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1250         return rc;
1251 }
1252
1253 static inline int may_rename(struct inode *old_dir,
1254                              struct dentry *old_dentry,
1255                              struct inode *new_dir,
1256                              struct dentry *new_dentry)
1257 {
1258         struct task_security_struct *tsec;
1259         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1260         struct avc_audit_data ad;
1261         u32 av;
1262         int old_is_dir, new_is_dir;
1263         int rc;
1264
1265         tsec = current->security;
1266         old_dsec = old_dir->i_security;
1267         old_isec = old_dentry->d_inode->i_security;
1268         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1269         new_dsec = new_dir->i_security;
1270
1271         AVC_AUDIT_DATA_INIT(&ad, FS);
1272
1273         ad.u.fs.dentry = old_dentry;
1274         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1275                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1276         if (rc)
1277                 return rc;
1278         rc = avc_has_perm(tsec->sid, old_isec->sid,
1279                           old_isec->sclass, FILE__RENAME, &ad);
1280         if (rc)
1281                 return rc;
1282         if (old_is_dir && new_dir != old_dir) {
1283                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1284                                   old_isec->sclass, DIR__REPARENT, &ad);
1285                 if (rc)
1286                         return rc;
1287         }
1288
1289         ad.u.fs.dentry = new_dentry;
1290         av = DIR__ADD_NAME | DIR__SEARCH;
1291         if (new_dentry->d_inode)
1292                 av |= DIR__REMOVE_NAME;
1293         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1294         if (rc)
1295                 return rc;
1296         if (new_dentry->d_inode) {
1297                 new_isec = new_dentry->d_inode->i_security;
1298                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1299                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1300                                   new_isec->sclass,
1301                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1302                 if (rc)
1303                         return rc;
1304         }
1305
1306         return 0;
1307 }
1308
1309 /* Check whether a task can perform a filesystem operation. */
1310 static int superblock_has_perm(struct task_struct *tsk,
1311                                struct super_block *sb,
1312                                u32 perms,
1313                                struct avc_audit_data *ad)
1314 {
1315         struct task_security_struct *tsec;
1316         struct superblock_security_struct *sbsec;
1317
1318         tsec = tsk->security;
1319         sbsec = sb->s_security;
1320         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1321                             perms, ad);
1322 }
1323
1324 /* Convert a Linux mode and permission mask to an access vector. */
1325 static inline u32 file_mask_to_av(int mode, int mask)
1326 {
1327         u32 av = 0;
1328
1329         if ((mode & S_IFMT) != S_IFDIR) {
1330                 if (mask & MAY_EXEC)
1331                         av |= FILE__EXECUTE;
1332                 if (mask & MAY_READ)
1333                         av |= FILE__READ;
1334
1335                 if (mask & MAY_APPEND)
1336                         av |= FILE__APPEND;
1337                 else if (mask & MAY_WRITE)
1338                         av |= FILE__WRITE;
1339
1340         } else {
1341                 if (mask & MAY_EXEC)
1342                         av |= DIR__SEARCH;
1343                 if (mask & MAY_WRITE)
1344                         av |= DIR__WRITE;
1345                 if (mask & MAY_READ)
1346                         av |= DIR__READ;
1347         }
1348
1349         return av;
1350 }
1351
1352 /* Convert a Linux file to an access vector. */
1353 static inline u32 file_to_av(struct file *file)
1354 {
1355         u32 av = 0;
1356
1357         if (file->f_mode & FMODE_READ)
1358                 av |= FILE__READ;
1359         if (file->f_mode & FMODE_WRITE) {
1360                 if (file->f_flags & O_APPEND)
1361                         av |= FILE__APPEND;
1362                 else
1363                         av |= FILE__WRITE;
1364         }
1365
1366         return av;
1367 }
1368
1369 /* Hook functions begin here. */
1370
1371 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1372 {
1373         struct task_security_struct *psec = parent->security;
1374         struct task_security_struct *csec = child->security;
1375         int rc;
1376
1377         rc = secondary_ops->ptrace(parent,child);
1378         if (rc)
1379                 return rc;
1380
1381         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1382         /* Save the SID of the tracing process for later use in apply_creds. */
1383         if (!(child->ptrace & PT_PTRACED) && !rc)
1384                 csec->ptrace_sid = psec->sid;
1385         return rc;
1386 }
1387
1388 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1389                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391         int error;
1392
1393         error = task_has_perm(current, target, PROCESS__GETCAP);
1394         if (error)
1395                 return error;
1396
1397         return secondary_ops->capget(target, effective, inheritable, permitted);
1398 }
1399
1400 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1401                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1402 {
1403         int error;
1404
1405         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1406         if (error)
1407                 return error;
1408
1409         return task_has_perm(current, target, PROCESS__SETCAP);
1410 }
1411
1412 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1413                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1414 {
1415         secondary_ops->capset_set(target, effective, inheritable, permitted);
1416 }
1417
1418 static int selinux_capable(struct task_struct *tsk, int cap)
1419 {
1420         int rc;
1421
1422         rc = secondary_ops->capable(tsk, cap);
1423         if (rc)
1424                 return rc;
1425
1426         return task_has_capability(tsk,cap);
1427 }
1428
1429 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1430 {
1431         int buflen, rc;
1432         char *buffer, *path, *end;
1433
1434         rc = -ENOMEM;
1435         buffer = (char*)__get_free_page(GFP_KERNEL);
1436         if (!buffer)
1437                 goto out;
1438
1439         buflen = PAGE_SIZE;
1440         end = buffer+buflen;
1441         *--end = '\0';
1442         buflen--;
1443         path = end-1;
1444         *path = '/';
1445         while (table) {
1446                 const char *name = table->procname;
1447                 size_t namelen = strlen(name);
1448                 buflen -= namelen + 1;
1449                 if (buflen < 0)
1450                         goto out_free;
1451                 end -= namelen;
1452                 memcpy(end, name, namelen);
1453                 *--end = '/';
1454                 path = end;
1455                 table = table->parent;
1456         }
1457         buflen -= 4;
1458         if (buflen < 0)
1459                 goto out_free;
1460         end -= 4;
1461         memcpy(end, "/sys", 4);
1462         path = end;
1463         rc = security_genfs_sid("proc", path, tclass, sid);
1464 out_free:
1465         free_page((unsigned long)buffer);
1466 out:
1467         return rc;
1468 }
1469
1470 static int selinux_sysctl(ctl_table *table, int op)
1471 {
1472         int error = 0;
1473         u32 av;
1474         struct task_security_struct *tsec;
1475         u32 tsid;
1476         int rc;
1477
1478         rc = secondary_ops->sysctl(table, op);
1479         if (rc)
1480                 return rc;
1481
1482         tsec = current->security;
1483
1484         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1485                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1486         if (rc) {
1487                 /* Default to the well-defined sysctl SID. */
1488                 tsid = SECINITSID_SYSCTL;
1489         }
1490
1491         /* The op values are "defined" in sysctl.c, thereby creating
1492          * a bad coupling between this module and sysctl.c */
1493         if(op == 001) {
1494                 error = avc_has_perm(tsec->sid, tsid,
1495                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1496         } else {
1497                 av = 0;
1498                 if (op & 004)
1499                         av |= FILE__READ;
1500                 if (op & 002)
1501                         av |= FILE__WRITE;
1502                 if (av)
1503                         error = avc_has_perm(tsec->sid, tsid,
1504                                              SECCLASS_FILE, av, NULL);
1505         }
1506
1507         return error;
1508 }
1509
1510 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1511 {
1512         int rc = 0;
1513
1514         if (!sb)
1515                 return 0;
1516
1517         switch (cmds) {
1518                 case Q_SYNC:
1519                 case Q_QUOTAON:
1520                 case Q_QUOTAOFF:
1521                 case Q_SETINFO:
1522                 case Q_SETQUOTA:
1523                         rc = superblock_has_perm(current,
1524                                                  sb,
1525                                                  FILESYSTEM__QUOTAMOD, NULL);
1526                         break;
1527                 case Q_GETFMT:
1528                 case Q_GETINFO:
1529                 case Q_GETQUOTA:
1530                         rc = superblock_has_perm(current,
1531                                                  sb,
1532                                                  FILESYSTEM__QUOTAGET, NULL);
1533                         break;
1534                 default:
1535                         rc = 0;  /* let the kernel handle invalid cmds */
1536                         break;
1537         }
1538         return rc;
1539 }
1540
1541 static int selinux_quota_on(struct dentry *dentry)
1542 {
1543         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1544 }
1545
1546 static int selinux_syslog(int type)
1547 {
1548         int rc;
1549
1550         rc = secondary_ops->syslog(type);
1551         if (rc)
1552                 return rc;
1553
1554         switch (type) {
1555                 case 3:         /* Read last kernel messages */
1556                 case 10:        /* Return size of the log buffer */
1557                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1558                         break;
1559                 case 6:         /* Disable logging to console */
1560                 case 7:         /* Enable logging to console */
1561                 case 8:         /* Set level of messages printed to console */
1562                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1563                         break;
1564                 case 0:         /* Close log */
1565                 case 1:         /* Open log */
1566                 case 2:         /* Read from log */
1567                 case 4:         /* Read/clear last kernel messages */
1568                 case 5:         /* Clear ring buffer */
1569                 default:
1570                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1571                         break;
1572         }
1573         return rc;
1574 }
1575
1576 /*
1577  * Check that a process has enough memory to allocate a new virtual
1578  * mapping. 0 means there is enough memory for the allocation to
1579  * succeed and -ENOMEM implies there is not.
1580  *
1581  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1582  * if the capability is granted, but __vm_enough_memory requires 1 if
1583  * the capability is granted.
1584  *
1585  * Do not audit the selinux permission check, as this is applied to all
1586  * processes that allocate mappings.
1587  */
1588 static int selinux_vm_enough_memory(long pages)
1589 {
1590         int rc, cap_sys_admin = 0;
1591         struct task_security_struct *tsec = current->security;
1592
1593         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1594         if (rc == 0)
1595                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1596                                         SECCLASS_CAPABILITY,
1597                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1598                                         NULL);
1599
1600         if (rc == 0)
1601                 cap_sys_admin = 1;
1602
1603         return __vm_enough_memory(pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610         struct bprm_security_struct *bsec;
1611
1612         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613         if (!bsec)
1614                 return -ENOMEM;
1615
1616         bsec->bprm = bprm;
1617         bsec->sid = SECINITSID_UNLABELED;
1618         bsec->set = 0;
1619
1620         bprm->security = bsec;
1621         return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626         struct task_security_struct *tsec;
1627         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628         struct inode_security_struct *isec;
1629         struct bprm_security_struct *bsec;
1630         u32 newsid;
1631         struct avc_audit_data ad;
1632         int rc;
1633
1634         rc = secondary_ops->bprm_set_security(bprm);
1635         if (rc)
1636                 return rc;
1637
1638         bsec = bprm->security;
1639
1640         if (bsec->set)
1641                 return 0;
1642
1643         tsec = current->security;
1644         isec = inode->i_security;
1645
1646         /* Default to the current task SID. */
1647         bsec->sid = tsec->sid;
1648
1649         /* Reset fs, key, and sock SIDs on execve. */
1650         tsec->create_sid = 0;
1651         tsec->keycreate_sid = 0;
1652         tsec->sockcreate_sid = 0;
1653
1654         if (tsec->exec_sid) {
1655                 newsid = tsec->exec_sid;
1656                 /* Reset exec SID on execve. */
1657                 tsec->exec_sid = 0;
1658         } else {
1659                 /* Check for a default transition on this program. */
1660                 rc = security_transition_sid(tsec->sid, isec->sid,
1661                                              SECCLASS_PROCESS, &newsid);
1662                 if (rc)
1663                         return rc;
1664         }
1665
1666         AVC_AUDIT_DATA_INIT(&ad, FS);
1667         ad.u.fs.mnt = bprm->file->f_path.mnt;
1668         ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671                 newsid = tsec->sid;
1672
1673         if (tsec->sid == newsid) {
1674                 rc = avc_has_perm(tsec->sid, isec->sid,
1675                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676                 if (rc)
1677                         return rc;
1678         } else {
1679                 /* Check permissions for the transition. */
1680                 rc = avc_has_perm(tsec->sid, newsid,
1681                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682                 if (rc)
1683                         return rc;
1684
1685                 rc = avc_has_perm(newsid, isec->sid,
1686                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687                 if (rc)
1688                         return rc;
1689
1690                 /* Clear any possibly unsafe personality bits on exec: */
1691                 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693                 /* Set the security field to the new SID. */
1694                 bsec->sid = newsid;
1695         }
1696
1697         bsec->set = 1;
1698         return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703         return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709         struct task_security_struct *tsec = current->security;
1710         int atsecure = 0;
1711
1712         if (tsec->osid != tsec->sid) {
1713                 /* Enable secure mode for SIDs transitions unless
1714                    the noatsecure permission is granted between
1715                    the two SIDs, i.e. ahp returns 0. */
1716                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717                                          SECCLASS_PROCESS,
1718                                          PROCESS__NOATSECURE, NULL);
1719         }
1720
1721         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726         kfree(bprm->security);
1727         bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736         struct avc_audit_data ad;
1737         struct file *file, *devnull = NULL;
1738         struct tty_struct *tty;
1739         struct fdtable *fdt;
1740         long j = -1;
1741         int drop_tty = 0;
1742
1743         mutex_lock(&tty_mutex);
1744         tty = get_current_tty();
1745         if (tty) {
1746                 file_list_lock();
1747                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748                 if (file) {
1749                         /* Revalidate access to controlling tty.
1750                            Use inode_has_perm on the tty inode directly rather
1751                            than using file_has_perm, as this particular open
1752                            file may belong to another process and we are only
1753                            interested in the inode-based check here. */
1754                         struct inode *inode = file->f_path.dentry->d_inode;
1755                         if (inode_has_perm(current, inode,
1756                                            FILE__READ | FILE__WRITE, NULL)) {
1757                                 drop_tty = 1;
1758                         }
1759                 }
1760                 file_list_unlock();
1761         }
1762         mutex_unlock(&tty_mutex);
1763         /* Reset controlling tty. */
1764         if (drop_tty)
1765                 no_tty();
1766
1767         /* Revalidate access to inherited open files. */
1768
1769         AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771         spin_lock(&files->file_lock);
1772         for (;;) {
1773                 unsigned long set, i;
1774                 int fd;
1775
1776                 j++;
1777                 i = j * __NFDBITS;
1778                 fdt = files_fdtable(files);
1779                 if (i >= fdt->max_fds)
1780                         break;
1781                 set = fdt->open_fds->fds_bits[j];
1782                 if (!set)
1783                         continue;
1784                 spin_unlock(&files->file_lock);
1785                 for ( ; set ; i++,set >>= 1) {
1786                         if (set & 1) {
1787                                 file = fget(i);
1788                                 if (!file)
1789                                         continue;
1790                                 if (file_has_perm(current,
1791                                                   file,
1792                                                   file_to_av(file))) {
1793                                         sys_close(i);
1794                                         fd = get_unused_fd();
1795                                         if (fd != i) {
1796                                                 if (fd >= 0)
1797                                                         put_unused_fd(fd);
1798                                                 fput(file);
1799                                                 continue;
1800                                         }
1801                                         if (devnull) {
1802                                                 get_file(devnull);
1803                                         } else {
1804                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1805                                                 if (IS_ERR(devnull)) {
1806                                                         devnull = NULL;
1807                                                         put_unused_fd(fd);
1808                                                         fput(file);
1809                                                         continue;
1810                                                 }
1811                                         }
1812                                         fd_install(fd, devnull);
1813                                 }
1814                                 fput(file);
1815                         }
1816                 }
1817                 spin_lock(&files->file_lock);
1818
1819         }
1820         spin_unlock(&files->file_lock);
1821 }
1822
1823 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824 {
1825         struct task_security_struct *tsec;
1826         struct bprm_security_struct *bsec;
1827         u32 sid;
1828         int rc;
1829
1830         secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832         tsec = current->security;
1833
1834         bsec = bprm->security;
1835         sid = bsec->sid;
1836
1837         tsec->osid = tsec->sid;
1838         bsec->unsafe = 0;
1839         if (tsec->sid != sid) {
1840                 /* Check for shared state.  If not ok, leave SID
1841                    unchanged and kill. */
1842                 if (unsafe & LSM_UNSAFE_SHARE) {
1843                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844                                         PROCESS__SHARE, NULL);
1845                         if (rc) {
1846                                 bsec->unsafe = 1;
1847                                 return;
1848                         }
1849                 }
1850
1851                 /* Check for ptracing, and update the task SID if ok.
1852                    Otherwise, leave SID unchanged and kill. */
1853                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1855                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1856                                           NULL);
1857                         if (rc) {
1858                                 bsec->unsafe = 1;
1859                                 return;
1860                         }
1861                 }
1862                 tsec->sid = sid;
1863         }
1864 }
1865
1866 /*
1867  * called after apply_creds without the task lock held
1868  */
1869 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870 {
1871         struct task_security_struct *tsec;
1872         struct rlimit *rlim, *initrlim;
1873         struct itimerval itimer;
1874         struct bprm_security_struct *bsec;
1875         int rc, i;
1876
1877         tsec = current->security;
1878         bsec = bprm->security;
1879
1880         if (bsec->unsafe) {
1881                 force_sig_specific(SIGKILL, current);
1882                 return;
1883         }
1884         if (tsec->osid == tsec->sid)
1885                 return;
1886
1887         /* Close files for which the new task SID is not authorized. */
1888         flush_unauthorized_files(current->files);
1889
1890         /* Check whether the new SID can inherit signal state
1891            from the old SID.  If not, clear itimers to avoid
1892            subsequent signal generation and flush and unblock
1893            signals. This must occur _after_ the task SID has
1894           been updated so that any kill done after the flush
1895           will be checked against the new SID. */
1896         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897                           PROCESS__SIGINH, NULL);
1898         if (rc) {
1899                 memset(&itimer, 0, sizeof itimer);
1900                 for (i = 0; i < 3; i++)
1901                         do_setitimer(i, &itimer, NULL);
1902                 flush_signals(current);
1903                 spin_lock_irq(&current->sighand->siglock);
1904                 flush_signal_handlers(current, 1);
1905                 sigemptyset(&current->blocked);
1906                 recalc_sigpending();
1907                 spin_unlock_irq(&current->sighand->siglock);
1908         }
1909
1910         /* Check whether the new SID can inherit resource limits
1911            from the old SID.  If not, reset all soft limits to
1912            the lower of the current task's hard limit and the init
1913            task's soft limit.  Note that the setting of hard limits
1914            (even to lower them) can be controlled by the setrlimit
1915            check. The inclusion of the init task's soft limit into
1916            the computation is to avoid resetting soft limits higher
1917            than the default soft limit for cases where the default
1918            is lower than the hard limit, e.g. RLIMIT_CORE or
1919            RLIMIT_STACK.*/
1920         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1921                           PROCESS__RLIMITINH, NULL);
1922         if (rc) {
1923                 for (i = 0; i < RLIM_NLIMITS; i++) {
1924                         rlim = current->signal->rlim + i;
1925                         initrlim = init_task.signal->rlim+i;
1926                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1927                 }
1928                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1929                         /*
1930                          * This will cause RLIMIT_CPU calculations
1931                          * to be refigured.
1932                          */
1933                         current->it_prof_expires = jiffies_to_cputime(1);
1934                 }
1935         }
1936
1937         /* Wake up the parent if it is waiting so that it can
1938            recheck wait permission to the new task SID. */
1939         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1940 }
1941
1942 /* superblock security operations */
1943
1944 static int selinux_sb_alloc_security(struct super_block *sb)
1945 {
1946         return superblock_alloc_security(sb);
1947 }
1948
1949 static void selinux_sb_free_security(struct super_block *sb)
1950 {
1951         superblock_free_security(sb);
1952 }
1953
1954 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1955 {
1956         if (plen > olen)
1957                 return 0;
1958
1959         return !memcmp(prefix, option, plen);
1960 }
1961
1962 static inline int selinux_option(char *option, int len)
1963 {
1964         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1965                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1966                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1967                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1968 }
1969
1970 static inline void take_option(char **to, char *from, int *first, int len)
1971 {
1972         if (!*first) {
1973                 **to = ',';
1974                 *to += 1;
1975         } else
1976                 *first = 0;
1977         memcpy(*to, from, len);
1978         *to += len;
1979 }
1980
1981 static inline void take_selinux_option(char **to, char *from, int *first, 
1982                                        int len)
1983 {
1984         int current_size = 0;
1985
1986         if (!*first) {
1987                 **to = '|';
1988                 *to += 1;
1989         }
1990         else
1991                 *first = 0;
1992
1993         while (current_size < len) {
1994                 if (*from != '"') {
1995                         **to = *from;
1996                         *to += 1;
1997                 }
1998                 from += 1;
1999                 current_size += 1;
2000         }
2001 }
2002
2003 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2004 {
2005         int fnosec, fsec, rc = 0;
2006         char *in_save, *in_curr, *in_end;
2007         char *sec_curr, *nosec_save, *nosec;
2008         int open_quote = 0;
2009
2010         in_curr = orig;
2011         sec_curr = copy;
2012
2013         /* Binary mount data: just copy */
2014         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2015                 copy_page(sec_curr, in_curr);
2016                 goto out;
2017         }
2018
2019         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2020         if (!nosec) {
2021                 rc = -ENOMEM;
2022                 goto out;
2023         }
2024
2025         nosec_save = nosec;
2026         fnosec = fsec = 1;
2027         in_save = in_end = orig;
2028
2029         do {
2030                 if (*in_end == '"')
2031                         open_quote = !open_quote;
2032                 if ((*in_end == ',' && open_quote == 0) ||
2033                                 *in_end == '\0') {
2034                         int len = in_end - in_curr;
2035
2036                         if (selinux_option(in_curr, len))
2037                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2038                         else
2039                                 take_option(&nosec, in_curr, &fnosec, len);
2040
2041                         in_curr = in_end + 1;
2042                 }
2043         } while (*in_end++);
2044
2045         strcpy(in_save, nosec_save);
2046         free_page((unsigned long)nosec_save);
2047 out:
2048         return rc;
2049 }
2050
2051 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2052 {
2053         struct avc_audit_data ad;
2054         int rc;
2055
2056         rc = superblock_doinit(sb, data);
2057         if (rc)
2058                 return rc;
2059
2060         AVC_AUDIT_DATA_INIT(&ad,FS);
2061         ad.u.fs.dentry = sb->s_root;
2062         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2063 }
2064
2065 static int selinux_sb_statfs(struct dentry *dentry)
2066 {
2067         struct avc_audit_data ad;
2068
2069         AVC_AUDIT_DATA_INIT(&ad,FS);
2070         ad.u.fs.dentry = dentry->d_sb->s_root;
2071         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2072 }
2073
2074 static int selinux_mount(char * dev_name,
2075                          struct nameidata *nd,
2076                          char * type,
2077                          unsigned long flags,
2078                          void * data)
2079 {
2080         int rc;
2081
2082         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2083         if (rc)
2084                 return rc;
2085
2086         if (flags & MS_REMOUNT)
2087                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2088                                            FILESYSTEM__REMOUNT, NULL);
2089         else
2090                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2091                                        FILE__MOUNTON);
2092 }
2093
2094 static int selinux_umount(struct vfsmount *mnt, int flags)
2095 {
2096         int rc;
2097
2098         rc = secondary_ops->sb_umount(mnt, flags);
2099         if (rc)
2100                 return rc;
2101
2102         return superblock_has_perm(current,mnt->mnt_sb,
2103                                    FILESYSTEM__UNMOUNT,NULL);
2104 }
2105
2106 /* inode security operations */
2107
2108 static int selinux_inode_alloc_security(struct inode *inode)
2109 {
2110         return inode_alloc_security(inode);
2111 }
2112
2113 static void selinux_inode_free_security(struct inode *inode)
2114 {
2115         inode_free_security(inode);
2116 }
2117
2118 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2119                                        char **name, void **value,
2120                                        size_t *len)
2121 {
2122         struct task_security_struct *tsec;
2123         struct inode_security_struct *dsec;
2124         struct superblock_security_struct *sbsec;
2125         u32 newsid, clen;
2126         int rc;
2127         char *namep = NULL, *context;
2128
2129         tsec = current->security;
2130         dsec = dir->i_security;
2131         sbsec = dir->i_sb->s_security;
2132
2133         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2134                 newsid = tsec->create_sid;
2135         } else {
2136                 rc = security_transition_sid(tsec->sid, dsec->sid,
2137                                              inode_mode_to_security_class(inode->i_mode),
2138                                              &newsid);
2139                 if (rc) {
2140                         printk(KERN_WARNING "%s:  "
2141                                "security_transition_sid failed, rc=%d (dev=%s "
2142                                "ino=%ld)\n",
2143                                __FUNCTION__,
2144                                -rc, inode->i_sb->s_id, inode->i_ino);
2145                         return rc;
2146                 }
2147         }
2148
2149         /* Possibly defer initialization to selinux_complete_init. */
2150         if (sbsec->initialized) {
2151                 struct inode_security_struct *isec = inode->i_security;
2152                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2153                 isec->sid = newsid;
2154                 isec->initialized = 1;
2155         }
2156
2157         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2158                 return -EOPNOTSUPP;
2159
2160         if (name) {
2161                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2162                 if (!namep)
2163                         return -ENOMEM;
2164                 *name = namep;
2165         }
2166
2167         if (value && len) {
2168                 rc = security_sid_to_context(newsid, &context, &clen);
2169                 if (rc) {
2170                         kfree(namep);
2171                         return rc;
2172                 }
2173                 *value = context;
2174                 *len = clen;
2175         }
2176
2177         return 0;
2178 }
2179
2180 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2181 {
2182         return may_create(dir, dentry, SECCLASS_FILE);
2183 }
2184
2185 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2186 {
2187         int rc;
2188
2189         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2190         if (rc)
2191                 return rc;
2192         return may_link(dir, old_dentry, MAY_LINK);
2193 }
2194
2195 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2196 {
2197         int rc;
2198
2199         rc = secondary_ops->inode_unlink(dir, dentry);
2200         if (rc)
2201                 return rc;
2202         return may_link(dir, dentry, MAY_UNLINK);
2203 }
2204
2205 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2206 {
2207         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2208 }
2209
2210 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2211 {
2212         return may_create(dir, dentry, SECCLASS_DIR);
2213 }
2214
2215 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2216 {
2217         return may_link(dir, dentry, MAY_RMDIR);
2218 }
2219
2220 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2221 {
2222         int rc;
2223
2224         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2225         if (rc)
2226                 return rc;
2227
2228         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2229 }
2230
2231 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2232                                 struct inode *new_inode, struct dentry *new_dentry)
2233 {
2234         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2235 }
2236
2237 static int selinux_inode_readlink(struct dentry *dentry)
2238 {
2239         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2240 }
2241
2242 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2243 {
2244         int rc;
2245
2246         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2247         if (rc)
2248                 return rc;
2249         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2250 }
2251
2252 static int selinux_inode_permission(struct inode *inode, int mask,
2253                                     struct nameidata *nd)
2254 {
2255         int rc;
2256
2257         rc = secondary_ops->inode_permission(inode, mask, nd);
2258         if (rc)
2259                 return rc;
2260
2261         if (!mask) {
2262                 /* No permission to check.  Existence test. */
2263                 return 0;
2264         }
2265
2266         return inode_has_perm(current, inode,
2267                                file_mask_to_av(inode->i_mode, mask), NULL);
2268 }
2269
2270 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2271 {
2272         int rc;
2273
2274         rc = secondary_ops->inode_setattr(dentry, iattr);
2275         if (rc)
2276                 return rc;
2277
2278         if (iattr->ia_valid & ATTR_FORCE)
2279                 return 0;
2280
2281         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2282                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2283                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2284
2285         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2286 }
2287
2288 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2289 {
2290         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2291 }
2292
2293 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2294 {
2295         struct task_security_struct *tsec = current->security;
2296         struct inode *inode = dentry->d_inode;
2297         struct inode_security_struct *isec = inode->i_security;
2298         struct superblock_security_struct *sbsec;
2299         struct avc_audit_data ad;
2300         u32 newsid;
2301         int rc = 0;
2302
2303         if (strcmp(name, XATTR_NAME_SELINUX)) {
2304                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2305                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2306                     !capable(CAP_SYS_ADMIN)) {
2307                         /* A different attribute in the security namespace.
2308                            Restrict to administrator. */
2309                         return -EPERM;
2310                 }
2311
2312                 /* Not an attribute we recognize, so just check the
2313                    ordinary setattr permission. */
2314                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2315         }
2316
2317         sbsec = inode->i_sb->s_security;
2318         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2319                 return -EOPNOTSUPP;
2320
2321         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2322                 return -EPERM;
2323
2324         AVC_AUDIT_DATA_INIT(&ad,FS);
2325         ad.u.fs.dentry = dentry;
2326
2327         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2328                           FILE__RELABELFROM, &ad);
2329         if (rc)
2330                 return rc;
2331
2332         rc = security_context_to_sid(value, size, &newsid);
2333         if (rc)
2334                 return rc;
2335
2336         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2337                           FILE__RELABELTO, &ad);
2338         if (rc)
2339                 return rc;
2340
2341         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2342                                           isec->sclass);
2343         if (rc)
2344                 return rc;
2345
2346         return avc_has_perm(newsid,
2347                             sbsec->sid,
2348                             SECCLASS_FILESYSTEM,
2349                             FILESYSTEM__ASSOCIATE,
2350                             &ad);
2351 }
2352
2353 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2354                                         void *value, size_t size, int flags)
2355 {
2356         struct inode *inode = dentry->d_inode;
2357         struct inode_security_struct *isec = inode->i_security;
2358         u32 newsid;
2359         int rc;
2360
2361         if (strcmp(name, XATTR_NAME_SELINUX)) {
2362                 /* Not an attribute we recognize, so nothing to do. */
2363                 return;
2364         }
2365
2366         rc = security_context_to_sid(value, size, &newsid);
2367         if (rc) {
2368                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2369                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2370                 return;
2371         }
2372
2373         isec->sid = newsid;
2374         return;
2375 }
2376
2377 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2378 {
2379         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2380 }
2381
2382 static int selinux_inode_listxattr (struct dentry *dentry)
2383 {
2384         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2385 }
2386
2387 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2388 {
2389         if (strcmp(name, XATTR_NAME_SELINUX)) {
2390                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2391                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2392                     !capable(CAP_SYS_ADMIN)) {
2393                         /* A different attribute in the security namespace.
2394                            Restrict to administrator. */
2395                         return -EPERM;
2396                 }
2397
2398                 /* Not an attribute we recognize, so just check the
2399                    ordinary setattr permission. Might want a separate
2400                    permission for removexattr. */
2401                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2402         }
2403
2404         /* No one is allowed to remove a SELinux security label.
2405            You can change the label, but all data must be labeled. */
2406         return -EACCES;
2407 }
2408
2409 static const char *selinux_inode_xattr_getsuffix(void)
2410 {
2411       return XATTR_SELINUX_SUFFIX;
2412 }
2413
2414 /*
2415  * Copy the in-core inode security context value to the user.  If the
2416  * getxattr() prior to this succeeded, check to see if we need to
2417  * canonicalize the value to be finally returned to the user.
2418  *
2419  * Permission check is handled by selinux_inode_getxattr hook.
2420  */
2421 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2422 {
2423         struct inode_security_struct *isec = inode->i_security;
2424
2425         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2426                 return -EOPNOTSUPP;
2427
2428         return selinux_getsecurity(isec->sid, buffer, size);
2429 }
2430
2431 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2432                                      const void *value, size_t size, int flags)
2433 {
2434         struct inode_security_struct *isec = inode->i_security;
2435         u32 newsid;
2436         int rc;
2437
2438         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2439                 return -EOPNOTSUPP;
2440
2441         if (!value || !size)
2442                 return -EACCES;
2443
2444         rc = security_context_to_sid((void*)value, size, &newsid);
2445         if (rc)
2446                 return rc;
2447
2448         isec->sid = newsid;
2449         return 0;
2450 }
2451
2452 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2453 {
2454         const int len = sizeof(XATTR_NAME_SELINUX);
2455         if (buffer && len <= buffer_size)
2456                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2457         return len;
2458 }
2459
2460 /* file security operations */
2461
2462 static int selinux_file_permission(struct file *file, int mask)
2463 {
2464         int rc;
2465         struct inode *inode = file->f_path.dentry->d_inode;
2466
2467         if (!mask) {
2468                 /* No permission to check.  Existence test. */
2469                 return 0;
2470         }
2471
2472         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2473         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2474                 mask |= MAY_APPEND;
2475
2476         rc = file_has_perm(current, file,
2477                            file_mask_to_av(inode->i_mode, mask));
2478         if (rc)
2479                 return rc;
2480
2481         return selinux_netlbl_inode_permission(inode, mask);
2482 }
2483
2484 static int selinux_file_alloc_security(struct file *file)
2485 {
2486         return file_alloc_security(file);
2487 }
2488
2489 static void selinux_file_free_security(struct file *file)
2490 {
2491         file_free_security(file);
2492 }
2493
2494 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2495                               unsigned long arg)
2496 {
2497         int error = 0;
2498
2499         switch (cmd) {
2500                 case FIONREAD:
2501                 /* fall through */
2502                 case FIBMAP:
2503                 /* fall through */
2504                 case FIGETBSZ:
2505                 /* fall through */
2506                 case EXT2_IOC_GETFLAGS:
2507                 /* fall through */
2508                 case EXT2_IOC_GETVERSION:
2509                         error = file_has_perm(current, file, FILE__GETATTR);
2510                         break;
2511
2512                 case EXT2_IOC_SETFLAGS:
2513                 /* fall through */
2514                 case EXT2_IOC_SETVERSION:
2515                         error = file_has_perm(current, file, FILE__SETATTR);
2516                         break;
2517
2518                 /* sys_ioctl() checks */
2519                 case FIONBIO:
2520                 /* fall through */
2521                 case FIOASYNC:
2522                         error = file_has_perm(current, file, 0);
2523                         break;
2524
2525                 case KDSKBENT:
2526                 case KDSKBSENT:
2527                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2528                         break;
2529
2530                 /* default case assumes that the command will go
2531                  * to the file's ioctl() function.
2532                  */
2533                 default:
2534                         error = file_has_perm(current, file, FILE__IOCTL);
2535
2536         }
2537         return error;
2538 }
2539
2540 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2541 {
2542 #ifndef CONFIG_PPC32
2543         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2544                 /*
2545                  * We are making executable an anonymous mapping or a
2546                  * private file mapping that will also be writable.
2547                  * This has an additional check.
2548                  */
2549                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2550                 if (rc)
2551                         return rc;
2552         }
2553 #endif
2554
2555         if (file) {
2556                 /* read access is always possible with a mapping */
2557                 u32 av = FILE__READ;
2558
2559                 /* write access only matters if the mapping is shared */
2560                 if (shared && (prot & PROT_WRITE))
2561                         av |= FILE__WRITE;
2562
2563                 if (prot & PROT_EXEC)
2564                         av |= FILE__EXECUTE;
2565
2566                 return file_has_perm(current, file, av);
2567         }
2568         return 0;
2569 }
2570
2571 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2572                              unsigned long prot, unsigned long flags)
2573 {
2574         int rc;
2575
2576         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2577         if (rc)
2578                 return rc;
2579
2580         if (selinux_checkreqprot)
2581                 prot = reqprot;
2582
2583         return file_map_prot_check(file, prot,
2584                                    (flags & MAP_TYPE) == MAP_SHARED);
2585 }
2586
2587 static int selinux_file_mprotect(struct vm_area_struct *vma,
2588                                  unsigned long reqprot,
2589                                  unsigned long prot)
2590 {
2591         int rc;
2592
2593         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2594         if (rc)
2595                 return rc;
2596
2597         if (selinux_checkreqprot)
2598                 prot = reqprot;
2599
2600 #ifndef CONFIG_PPC32
2601         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2602                 rc = 0;
2603                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2604                     vma->vm_end <= vma->vm_mm->brk) {
2605                         rc = task_has_perm(current, current,
2606                                            PROCESS__EXECHEAP);
2607                 } else if (!vma->vm_file &&
2608                            vma->vm_start <= vma->vm_mm->start_stack &&
2609                            vma->vm_end >= vma->vm_mm->start_stack) {
2610                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2611                 } else if (vma->vm_file && vma->anon_vma) {
2612                         /*
2613                          * We are making executable a file mapping that has
2614                          * had some COW done. Since pages might have been
2615                          * written, check ability to execute the possibly
2616                          * modified content.  This typically should only
2617                          * occur for text relocations.
2618                          */
2619                         rc = file_has_perm(current, vma->vm_file,
2620                                            FILE__EXECMOD);
2621                 }
2622                 if (rc)
2623                         return rc;
2624         }
2625 #endif
2626
2627         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2628 }
2629
2630 static int selinux_file_lock(struct file *file, unsigned int cmd)
2631 {
2632         return file_has_perm(current, file, FILE__LOCK);
2633 }
2634
2635 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2636                               unsigned long arg)
2637 {
2638         int err = 0;
2639
2640         switch (cmd) {
2641                 case F_SETFL:
2642                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2643                                 err = -EINVAL;
2644                                 break;
2645                         }
2646
2647                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2648                                 err = file_has_perm(current, file,FILE__WRITE);
2649                                 break;
2650                         }
2651                         /* fall through */
2652                 case F_SETOWN:
2653                 case F_SETSIG:
2654                 case F_GETFL:
2655                 case F_GETOWN:
2656                 case F_GETSIG:
2657                         /* Just check FD__USE permission */
2658                         err = file_has_perm(current, file, 0);
2659                         break;
2660                 case F_GETLK:
2661                 case F_SETLK:
2662                 case F_SETLKW:
2663 #if BITS_PER_LONG == 32
2664                 case F_GETLK64:
2665                 case F_SETLK64:
2666                 case F_SETLKW64:
2667 #endif
2668                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2669                                 err = -EINVAL;
2670                                 break;
2671                         }
2672                         err = file_has_perm(current, file, FILE__LOCK);
2673                         break;
2674         }
2675
2676         return err;
2677 }
2678
2679 static int selinux_file_set_fowner(struct file *file)
2680 {
2681         struct task_security_struct *tsec;
2682         struct file_security_struct *fsec;
2683
2684         tsec = current->security;
2685         fsec = file->f_security;
2686         fsec->fown_sid = tsec->sid;
2687
2688         return 0;
2689 }
2690
2691 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2692                                        struct fown_struct *fown, int signum)
2693 {
2694         struct file *file;
2695         u32 perm;
2696         struct task_security_struct *tsec;
2697         struct file_security_struct *fsec;
2698
2699         /* struct fown_struct is never outside the context of a struct file */
2700         file = container_of(fown, struct file, f_owner);
2701
2702         tsec = tsk->security;
2703         fsec = file->f_security;
2704
2705         if (!signum)
2706                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2707         else
2708                 perm = signal_to_av(signum);
2709
2710         return avc_has_perm(fsec->fown_sid, tsec->sid,
2711                             SECCLASS_PROCESS, perm, NULL);
2712 }
2713
2714 static int selinux_file_receive(struct file *file)
2715 {
2716         return file_has_perm(current, file, file_to_av(file));
2717 }
2718
2719 /* task security operations */
2720
2721 static int selinux_task_create(unsigned long clone_flags)
2722 {
2723         int rc;
2724
2725         rc = secondary_ops->task_create(clone_flags);
2726         if (rc)
2727                 return rc;
2728
2729         return task_has_perm(current, current, PROCESS__FORK);
2730 }
2731
2732 static int selinux_task_alloc_security(struct task_struct *tsk)
2733 {
2734         struct task_security_struct *tsec1, *tsec2;
2735         int rc;
2736
2737         tsec1 = current->security;
2738
2739         rc = task_alloc_security(tsk);
2740         if (rc)
2741                 return rc;
2742         tsec2 = tsk->security;
2743
2744         tsec2->osid = tsec1->osid;
2745         tsec2->sid = tsec1->sid;
2746
2747         /* Retain the exec, fs, key, and sock SIDs across fork */
2748         tsec2->exec_sid = tsec1->exec_sid;
2749         tsec2->create_sid = tsec1->create_sid;
2750         tsec2->keycreate_sid = tsec1->keycreate_sid;
2751         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2752
2753         /* Retain ptracer SID across fork, if any.
2754            This will be reset by the ptrace hook upon any
2755            subsequent ptrace_attach operations. */
2756         tsec2->ptrace_sid = tsec1->ptrace_sid;
2757
2758         return 0;
2759 }
2760
2761 static void selinux_task_free_security(struct task_struct *tsk)
2762 {
2763         task_free_security(tsk);
2764 }
2765
2766 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2767 {
2768         /* Since setuid only affects the current process, and
2769            since the SELinux controls are not based on the Linux
2770            identity attributes, SELinux does not need to control
2771            this operation.  However, SELinux does control the use
2772            of the CAP_SETUID and CAP_SETGID capabilities using the
2773            capable hook. */
2774         return 0;
2775 }
2776
2777 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2778 {
2779         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2780 }
2781
2782 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2783 {
2784         /* See the comment for setuid above. */
2785         return 0;
2786 }
2787
2788 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2789 {
2790         return task_has_perm(current, p, PROCESS__SETPGID);
2791 }
2792
2793 static int selinux_task_getpgid(struct task_struct *p)
2794 {
2795         return task_has_perm(current, p, PROCESS__GETPGID);
2796 }
2797
2798 static int selinux_task_getsid(struct task_struct *p)
2799 {
2800         return task_has_perm(current, p, PROCESS__GETSESSION);
2801 }
2802
2803 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2804 {
2805         selinux_get_task_sid(p, secid);
2806 }
2807
2808 static int selinux_task_setgroups(struct group_info *group_info)
2809 {
2810         /* See the comment for setuid above. */
2811         return 0;
2812 }
2813
2814 static int selinux_task_setnice(struct task_struct *p, int nice)
2815 {
2816         int rc;
2817
2818         rc = secondary_ops->task_setnice(p, nice);
2819         if (rc)
2820                 return rc;
2821
2822         return task_has_perm(current,p, PROCESS__SETSCHED);
2823 }
2824
2825 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2826 {
2827         return task_has_perm(current, p, PROCESS__SETSCHED);
2828 }
2829
2830 static int selinux_task_getioprio(struct task_struct *p)
2831 {
2832         return task_has_perm(current, p, PROCESS__GETSCHED);
2833 }
2834
2835 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2836 {
2837         struct rlimit *old_rlim = current->signal->rlim + resource;
2838         int rc;
2839
2840         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2841         if (rc)
2842                 return rc;
2843
2844         /* Control the ability to change the hard limit (whether
2845            lowering or raising it), so that the hard limit can
2846            later be used as a safe reset point for the soft limit
2847            upon context transitions. See selinux_bprm_apply_creds. */
2848         if (old_rlim->rlim_max != new_rlim->rlim_max)
2849                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2850
2851         return 0;
2852 }
2853
2854 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2855 {
2856         return task_has_perm(current, p, PROCESS__SETSCHED);
2857 }
2858
2859 static int selinux_task_getscheduler(struct task_struct *p)
2860 {
2861         return task_has_perm(current, p, PROCESS__GETSCHED);
2862 }
2863
2864 static int selinux_task_movememory(struct task_struct *p)
2865 {
2866         return task_has_perm(current, p, PROCESS__SETSCHED);
2867 }
2868
2869 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2870                                 int sig, u32 secid)
2871 {
2872         u32 perm;
2873         int rc;
2874         struct task_security_struct *tsec;
2875
2876         rc = secondary_ops->task_kill(p, info, sig, secid);
2877         if (rc)
2878                 return rc;
2879
2880         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2881                 return 0;
2882
2883         if (!sig)
2884                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2885         else
2886                 perm = signal_to_av(sig);
2887         tsec = p->security;
2888         if (secid)
2889                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2890         else
2891                 rc = task_has_perm(current, p, perm);
2892         return rc;
2893 }
2894
2895 static int selinux_task_prctl(int option,
2896                               unsigned long arg2,
2897                               unsigned long arg3,
2898                               unsigned long arg4,
2899                               unsigned long arg5)
2900 {
2901         /* The current prctl operations do not appear to require
2902            any SELinux controls since they merely observe or modify
2903            the state of the current process. */
2904         return 0;
2905 }
2906
2907 static int selinux_task_wait(struct task_struct *p)
2908 {
2909         u32 perm;
2910
2911         perm = signal_to_av(p->exit_signal);
2912
2913         return task_has_perm(p, current, perm);
2914 }
2915
2916 static void selinux_task_reparent_to_init(struct task_struct *p)
2917 {
2918         struct task_security_struct *tsec;
2919
2920         secondary_ops->task_reparent_to_init(p);
2921
2922         tsec = p->security;
2923         tsec->osid = tsec->sid;
2924         tsec->sid = SECINITSID_KERNEL;
2925         return;
2926 }
2927
2928 static void selinux_task_to_inode(struct task_struct *p,
2929                                   struct inode *inode)
2930 {
2931         struct task_security_struct *tsec = p->security;
2932         struct inode_security_struct *isec = inode->i_security;
2933
2934         isec->sid = tsec->sid;
2935         isec->initialized = 1;
2936         return;
2937 }
2938
2939 /* Returns error only if unable to parse addresses */
2940 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2941                         struct avc_audit_data *ad, u8 *proto)
2942 {
2943         int offset, ihlen, ret = -EINVAL;
2944         struct iphdr _iph, *ih;
2945
2946         offset = skb_network_offset(skb);
2947         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2948         if (ih == NULL)
2949                 goto out;
2950
2951         ihlen = ih->ihl * 4;
2952         if (ihlen < sizeof(_iph))
2953                 goto out;
2954
2955         ad->u.net.v4info.saddr = ih->saddr;
2956         ad->u.net.v4info.daddr = ih->daddr;
2957         ret = 0;
2958
2959         if (proto)
2960                 *proto = ih->protocol;
2961
2962         switch (ih->protocol) {
2963         case IPPROTO_TCP: {
2964                 struct tcphdr _tcph, *th;
2965
2966                 if (ntohs(ih->frag_off) & IP_OFFSET)
2967                         break;
2968
2969                 offset += ihlen;
2970                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2971                 if (th == NULL)
2972                         break;
2973
2974                 ad->u.net.sport = th->source;
2975                 ad->u.net.dport = th->dest;
2976                 break;
2977         }
2978         
2979         case IPPROTO_UDP: {
2980                 struct udphdr _udph, *uh;
2981                 
2982                 if (ntohs(ih->frag_off) & IP_OFFSET)
2983                         break;
2984                         
2985                 offset += ihlen;
2986                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2987                 if (uh == NULL)
2988                         break;  
2989
2990                 ad->u.net.sport = uh->source;
2991                 ad->u.net.dport = uh->dest;
2992                 break;
2993         }
2994
2995         case IPPROTO_DCCP: {
2996                 struct dccp_hdr _dccph, *dh;
2997
2998                 if (ntohs(ih->frag_off) & IP_OFFSET)
2999                         break;
3000
3001                 offset += ihlen;
3002                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3003                 if (dh == NULL)
3004                         break;
3005
3006                 ad->u.net.sport = dh->dccph_sport;
3007                 ad->u.net.dport = dh->dccph_dport;
3008                 break;
3009         }
3010
3011         default:
3012                 break;
3013         }
3014 out:
3015         return ret;
3016 }
3017
3018 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3019
3020 /* Returns error only if unable to parse addresses */
3021 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3022                         struct avc_audit_data *ad, u8 *proto)
3023 {
3024         u8 nexthdr;
3025         int ret = -EINVAL, offset;
3026         struct ipv6hdr _ipv6h, *ip6;
3027
3028         offset = skb_network_offset(skb);
3029         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3030         if (ip6 == NULL)
3031                 goto out;
3032
3033         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3034         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3035         ret = 0;
3036
3037         nexthdr = ip6->nexthdr;
3038         offset += sizeof(_ipv6h);
3039         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3040         if (offset < 0)
3041                 goto out;
3042
3043         if (proto)
3044                 *proto = nexthdr;
3045
3046         switch (nexthdr) {
3047         case IPPROTO_TCP: {
3048                 struct tcphdr _tcph, *th;
3049
3050                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3051                 if (th == NULL)
3052                         break;
3053
3054                 ad->u.net.sport = th->source;
3055                 ad->u.net.dport = th->dest;
3056                 break;
3057         }
3058
3059         case IPPROTO_UDP: {
3060                 struct udphdr _udph, *uh;
3061
3062                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3063                 if (uh == NULL)
3064                         break;
3065
3066                 ad->u.net.sport = uh->source;
3067                 ad->u.net.dport = uh->dest;
3068                 break;
3069         }
3070
3071         case IPPROTO_DCCP: {
3072                 struct dccp_hdr _dccph, *dh;
3073
3074                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3075                 if (dh == NULL)
3076                         break;
3077
3078                 ad->u.net.sport = dh->dccph_sport;
3079                 ad->u.net.dport = dh->dccph_dport;
3080                 break;
3081         }
3082
3083         /* includes fragments */
3084         default:
3085                 break;
3086         }
3087 out:
3088         return ret;
3089 }
3090
3091 #endif /* IPV6 */
3092
3093 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3094                              char **addrp, int *len, int src, u8 *proto)
3095 {
3096         int ret = 0;
3097
3098         switch (ad->u.net.family) {
3099         case PF_INET:
3100                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3101                 if (ret || !addrp)
3102                         break;
3103                 *len = 4;
3104                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3105                                         &ad->u.net.v4info.daddr);
3106                 break;
3107
3108 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3109         case PF_INET6:
3110                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3111                 if (ret || !addrp)
3112                         break;
3113                 *len = 16;
3114                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3115                                         &ad->u.net.v6info.daddr);
3116                 break;
3117 #endif  /* IPV6 */
3118         default:
3119                 break;
3120         }
3121
3122         return ret;
3123 }
3124
3125 /**
3126  * selinux_skb_extlbl_sid - Determine the external label of a packet
3127  * @skb: the packet
3128  * @base_sid: the SELinux SID to use as a context for MLS only external labels
3129  * @sid: the packet's SID
3130  *
3131  * Description:
3132  * Check the various different forms of external packet labeling and determine
3133  * the external SID for the packet.
3134  *
3135  */
3136 static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3137                                    u32 base_sid,
3138                                    u32 *sid)
3139 {
3140         u32 xfrm_sid;
3141         u32 nlbl_sid;
3142
3143         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3144         if (selinux_netlbl_skbuff_getsid(skb,
3145                                          (xfrm_sid == SECSID_NULL ?
3146                                           base_sid : xfrm_sid),
3147                                          &nlbl_sid) != 0)
3148                 nlbl_sid = SECSID_NULL;
3149
3150         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3151 }
3152
3153 /* socket security operations */
3154 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3155                            u32 perms)
3156 {
3157         struct inode_security_struct *isec;
3158         struct task_security_struct *tsec;
3159         struct avc_audit_data ad;
3160         int err = 0;
3161
3162         tsec = task->security;
3163         isec = SOCK_INODE(sock)->i_security;
3164
3165         if (isec->sid == SECINITSID_KERNEL)
3166                 goto out;
3167
3168         AVC_AUDIT_DATA_INIT(&ad,NET);
3169         ad.u.net.sk = sock->sk;
3170         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3171
3172 out:
3173         return err;
3174 }
3175
3176 static int selinux_socket_create(int family, int type,
3177                                  int protocol, int kern)
3178 {
3179         int err = 0;
3180         struct task_security_struct *tsec;
3181         u32 newsid;
3182
3183         if (kern)
3184                 goto out;
3185
3186         tsec = current->security;
3187         newsid = tsec->sockcreate_sid ? : tsec->sid;
3188         err = avc_has_perm(tsec->sid, newsid,
3189                            socket_type_to_security_class(family, type,
3190                            protocol), SOCKET__CREATE, NULL);
3191
3192 out:
3193         return err;
3194 }
3195
3196 static int selinux_socket_post_create(struct socket *sock, int family,
3197                                       int type, int protocol, int kern)
3198 {
3199         int err = 0;
3200         struct inode_security_struct *isec;
3201         struct task_security_struct *tsec;
3202         struct sk_security_struct *sksec;
3203         u32 newsid;
3204
3205         isec = SOCK_INODE(sock)->i_security;
3206
3207         tsec = current->security;
3208         newsid = tsec->sockcreate_sid ? : tsec->sid;
3209         isec->sclass = socket_type_to_security_class(family, type, protocol);
3210         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3211         isec->initialized = 1;
3212
3213         if (sock->sk) {
3214                 sksec = sock->sk->sk_security;
3215                 sksec->sid = isec->sid;
3216                 err = selinux_netlbl_socket_post_create(sock);
3217         }
3218
3219         return err;
3220 }
3221
3222 /* Range of port numbers used to automatically bind.
3223    Need to determine whether we should perform a name_bind
3224    permission check between the socket and the port number. */
3225 #define ip_local_port_range_0 sysctl_local_port_range[0]
3226 #define ip_local_port_range_1 sysctl_local_port_range[1]
3227
3228 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3229 {
3230         u16 family;
3231         int err;
3232
3233         err = socket_has_perm(current, sock, SOCKET__BIND);
3234         if (err)
3235                 goto out;
3236
3237         /*
3238          * If PF_INET or PF_INET6, check name_bind permission for the port.
3239          * Multiple address binding for SCTP is not supported yet: we just
3240          * check the first address now.
3241          */
3242         family = sock->sk->sk_family;
3243         if (family == PF_INET || family == PF_INET6) {
3244                 char *addrp;
3245                 struct inode_security_struct *isec;
3246                 struct task_security_struct *tsec;
3247                 struct avc_audit_data ad;
3248                 struct sockaddr_in *addr4 = NULL;
3249                 struct sockaddr_in6 *addr6 = NULL;
3250                 unsigned short snum;
3251                 struct sock *sk = sock->sk;
3252                 u32 sid, node_perm, addrlen;
3253
3254                 tsec = current->security;
3255                 isec = SOCK_INODE(sock)->i_security;
3256
3257                 if (family == PF_INET) {
3258                         addr4 = (struct sockaddr_in *)address;
3259                         snum = ntohs(addr4->sin_port);
3260                         addrlen = sizeof(addr4->sin_addr.s_addr);
3261                         addrp = (char *)&addr4->sin_addr.s_addr;
3262                 } else {
3263                         addr6 = (struct sockaddr_in6 *)address;
3264                         snum = ntohs(addr6->sin6_port);
3265                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3266                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3267                 }
3268
3269                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3270                            snum > ip_local_port_range_1)) {
3271                         err = security_port_sid(sk->sk_family, sk->sk_type,
3272                                                 sk->sk_protocol, snum, &sid);
3273                         if (err)
3274                                 goto out;
3275                         AVC_AUDIT_DATA_INIT(&ad,NET);
3276                         ad.u.net.sport = htons(snum);
3277                         ad.u.net.family = family;
3278                         err = avc_has_perm(isec->sid, sid,
3279                                            isec->sclass,
3280                                            SOCKET__NAME_BIND, &ad);
3281                         if (err)
3282                                 goto out;
3283                 }
3284                 
3285                 switch(isec->sclass) {
3286                 case SECCLASS_TCP_SOCKET:
3287                         node_perm = TCP_SOCKET__NODE_BIND;
3288                         break;
3289                         
3290                 case SECCLASS_UDP_SOCKET:
3291                         node_perm = UDP_SOCKET__NODE_BIND;
3292                         break;
3293
3294                 case SECCLASS_DCCP_SOCKET:
3295                         node_perm = DCCP_SOCKET__NODE_BIND;
3296                         break;
3297
3298                 default:
3299                         node_perm = RAWIP_SOCKET__NODE_BIND;
3300                         break;
3301                 }
3302                 
3303                 err = security_node_sid(family, addrp, addrlen, &sid);
3304                 if (err)
3305                         goto out;
3306                 
3307                 AVC_AUDIT_DATA_INIT(&ad,NET);
3308                 ad.u.net.sport = htons(snum);
3309                 ad.u.net.family = family;
3310
3311                 if (family == PF_INET)
3312                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3313                 else
3314                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3315
3316                 err = avc_has_perm(isec->sid, sid,
3317                                    isec->sclass, node_perm, &ad);
3318                 if (err)
3319                         goto out;
3320         }
3321 out:
3322         return err;
3323 }
3324
3325 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3326 {
3327         struct inode_security_struct *isec;
3328         int err;
3329
3330         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3331         if (err)
3332                 return err;
3333
3334         /*
3335          * If a TCP or DCCP socket, check name_connect permission for the port.
3336          */
3337         isec = SOCK_INODE(sock)->i_security;
3338         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3339             isec->sclass == SECCLASS_DCCP_SOCKET) {
3340                 struct sock *sk = sock->sk;
3341                 struct avc_audit_data ad;
3342                 struct sockaddr_in *addr4 = NULL;
3343                 struct sockaddr_in6 *addr6 = NULL;
3344                 unsigned short snum;
3345                 u32 sid, perm;
3346
3347                 if (sk->sk_family == PF_INET) {
3348                         addr4 = (struct sockaddr_in *)address;
3349                         if (addrlen < sizeof(struct sockaddr_in))
3350                                 return -EINVAL;
3351                         snum = ntohs(addr4->sin_port);
3352                 } else {
3353                         addr6 = (struct sockaddr_in6 *)address;
3354                         if (addrlen < SIN6_LEN_RFC2133)
3355                                 return -EINVAL;
3356                         snum = ntohs(addr6->sin6_port);
3357                 }
3358
3359                 err = security_port_sid(sk->sk_family, sk->sk_type,
3360                                         sk->sk_protocol, snum, &sid);
3361                 if (err)
3362                         goto out;
3363
3364                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3365                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3366
3367                 AVC_AUDIT_DATA_INIT(&ad,NET);
3368                 ad.u.net.dport = htons(snum);
3369                 ad.u.net.family = sk->sk_family;
3370                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3371                 if (err)
3372                         goto out;
3373         }
3374
3375 out:
3376         return err;
3377 }
3378
3379 static int selinux_socket_listen(struct socket *sock, int backlog)
3380 {
3381         return socket_has_perm(current, sock, SOCKET__LISTEN);
3382 }
3383
3384 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3385 {
3386         int err;
3387         struct inode_security_struct *isec;
3388         struct inode_security_struct *newisec;
3389
3390         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3391         if (err)
3392                 return err;
3393
3394         newisec = SOCK_INODE(newsock)->i_security;
3395
3396         isec = SOCK_INODE(sock)->i_security;
3397         newisec->sclass = isec->sclass;
3398         newisec->sid = isec->sid;
3399         newisec->initialized = 1;
3400
3401         return 0;
3402 }
3403
3404 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3405                                   int size)
3406 {
3407         int rc;
3408
3409         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3410         if (rc)
3411                 return rc;
3412
3413         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3414 }
3415
3416 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3417                                   int size, int flags)
3418 {
3419         return socket_has_perm(current, sock, SOCKET__READ);
3420 }
3421
3422 static int selinux_socket_getsockname(struct socket *sock)
3423 {
3424         return socket_has_perm(current, sock, SOCKET__GETATTR);
3425 }
3426
3427 static int selinux_socket_getpeername(struct socket *sock)
3428 {
3429         return socket_has_perm(current, sock, SOCKET__GETATTR);
3430 }
3431
3432 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3433 {
3434         int err;
3435
3436         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3437         if (err)
3438                 return err;
3439
3440         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3441 }
3442
3443 static int selinux_socket_getsockopt(struct socket *sock, int level,
3444                                      int optname)
3445 {
3446         return socket_has_perm(current, sock, SOCKET__GETOPT);
3447 }
3448
3449 static int selinux_socket_shutdown(struct socket *sock, int how)
3450 {
3451         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3452 }
3453
3454 static int selinux_socket_unix_stream_connect(struct socket *sock,
3455                                               struct socket *other,
3456                                               struct sock *newsk)
3457 {
3458         struct sk_security_struct *ssec;
3459         struct inode_security_struct *isec;
3460         struct inode_security_struct *other_isec;
3461         struct avc_audit_data ad;
3462         int err;
3463
3464         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3465         if (err)
3466                 return err;
3467
3468         isec = SOCK_INODE(sock)->i_security;
3469         other_isec = SOCK_INODE(other)->i_security;
3470
3471         AVC_AUDIT_DATA_INIT(&ad,NET);
3472         ad.u.net.sk = other->sk;
3473
3474         err = avc_has_perm(isec->sid, other_isec->sid,
3475                            isec->sclass,
3476                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3477         if (err)
3478                 return err;
3479
3480         /* connecting socket */
3481         ssec = sock->sk->sk_security;
3482         ssec->peer_sid = other_isec->sid;
3483         
3484         /* server child socket */
3485         ssec = newsk->sk_security;
3486         ssec->peer_sid = isec->sid;
3487         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3488
3489         return err;
3490 }
3491
3492 static int selinux_socket_unix_may_send(struct socket *sock,
3493                                         struct socket *other)
3494 {
3495         struct inode_security_struct *isec;
3496         struct inode_security_struct *other_isec;
3497         struct avc_audit_data ad;
3498         int err;
3499
3500         isec = SOCK_INODE(sock)->i_security;
3501         other_isec = SOCK_INODE(other)->i_security;
3502
3503         AVC_AUDIT_DATA_INIT(&ad,NET);
3504         ad.u.net.sk = other->sk;
3505
3506         err = avc_has_perm(isec->sid, other_isec->sid,
3507                            isec->sclass, SOCKET__SENDTO, &ad);
3508         if (err)
3509                 return err;
3510
3511         return 0;
3512 }
3513
3514 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3515                 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3516 {
3517         int err = 0;
3518         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3519         struct socket *sock;
3520         u16 sock_class = 0;
3521         u32 sock_sid = 0;
3522
3523         read_lock_bh(&sk->sk_callback_lock);
3524         sock = sk->sk_socket;
3525         if (sock) {
3526                 struct inode *inode;
3527                 inode = SOCK_INODE(sock);
3528                 if (inode) {
3529                         struct inode_security_struct *isec;
3530                         isec = inode->i_security;
3531                         sock_sid = isec->sid;
3532                         sock_class = isec->sclass;
3533                 }
3534         }
3535         read_unlock_bh(&sk->sk_callback_lock);
3536         if (!sock_sid)
3537                 goto out;
3538
3539         if (!skb->dev)
3540                 goto out;
3541
3542         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3543         if (err)
3544                 goto out;
3545
3546         switch (sock_class) {
3547         case SECCLASS_UDP_SOCKET:
3548                 netif_perm = NETIF__UDP_RECV;
3549                 node_perm = NODE__UDP_RECV;
3550                 recv_perm = UDP_SOCKET__RECV_MSG;
3551                 break;
3552         
3553         case SECCLASS_TCP_SOCKET:
3554                 netif_perm = NETIF__TCP_RECV;
3555                 node_perm = NODE__TCP_RECV;
3556                 recv_perm = TCP_SOCKET__RECV_MSG;
3557                 break;
3558
3559         case SECCLASS_DCCP_SOCKET:
3560                 netif_perm = NETIF__DCCP_RECV;
3561                 node_perm = NODE__DCCP_RECV;
3562                 recv_perm = DCCP_SOCKET__RECV_MSG;
3563                 break;
3564
3565         default:
3566                 netif_perm = NETIF__RAWIP_RECV;
3567                 node_perm = NODE__RAWIP_RECV;
3568                 break;
3569         }
3570
3571         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3572         if (err)
3573                 goto out;
3574         
3575         err = security_node_sid(family, addrp, len, &node_sid);
3576         if (err)
3577                 goto out;
3578         
3579         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3580         if (err)
3581                 goto out;
3582
3583         if (recv_perm) {
3584                 u32 port_sid;
3585
3586                 err = security_port_sid(sk->sk_family, sk->sk_type,
3587                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3588                                         &port_sid);
3589                 if (err)
3590                         goto out;
3591
3592                 err = avc_has_perm(sock_sid, port_sid,
3593                                    sock_class, recv_perm, ad);
3594         }
3595
3596 out:
3597         return err;
3598 }
3599
3600 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3601 {
3602         u16 family;
3603         char *addrp;
3604         int len, err = 0;
3605         struct avc_audit_data ad;
3606         struct sk_security_struct *sksec = sk->sk_security;
3607
3608         family = sk->sk_family;
3609         if (family != PF_INET && family != PF_INET6)
3610                 goto out;
3611
3612         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3613         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3614                 family = PF_INET;
3615
3616         AVC_AUDIT_DATA_INIT(&ad, NET);
3617         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3618         ad.u.net.family = family;
3619
3620         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3621         if (err)
3622                 goto out;
3623
3624         if (selinux_compat_net)
3625                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3626                                                   addrp, len);
3627         else
3628                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3629                                    PACKET__RECV, &ad);
3630         if (err)
3631                 goto out;
3632
3633         err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3634         if (err)
3635                 goto out;
3636
3637         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3638 out:    
3639         return err;
3640 }
3641
3642 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3643                                             int __user *optlen, unsigned len)
3644 {
3645         int err = 0;
3646         char *scontext;
3647         u32 scontext_len;
3648         struct sk_security_struct *ssec;
3649         struct inode_security_struct *isec;
3650         u32 peer_sid = SECSID_NULL;
3651
3652         isec = SOCK_INODE(sock)->i_security;
3653
3654         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3655             isec->sclass == SECCLASS_TCP_SOCKET) {
3656                 ssec = sock->sk->sk_security;
3657                 peer_sid = ssec->peer_sid;
3658         }
3659         if (peer_sid == SECSID_NULL) {
3660                 err = -ENOPROTOOPT;
3661                 goto out;
3662         }
3663
3664         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3665
3666         if (err)
3667                 goto out;
3668
3669         if (scontext_len > len) {
3670                 err = -ERANGE;
3671                 goto out_len;
3672         }
3673
3674         if (copy_to_user(optval, scontext, scontext_len))
3675                 err = -EFAULT;
3676
3677 out_len:
3678         if (put_user(scontext_len, optlen))
3679                 err = -EFAULT;
3680
3681         kfree(scontext);
3682 out:    
3683         return err;
3684 }
3685
3686 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3687 {
3688         u32 peer_secid = SECSID_NULL;
3689         int err = 0;
3690
3691         if (sock && sock->sk->sk_family == PF_UNIX)
3692                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3693         else if (skb)
3694                 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3695
3696         if (peer_secid == SECSID_NULL)
3697                 err = -EINVAL;
3698         *secid = peer_secid;
3699
3700         return err;
3701 }
3702
3703 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3704 {
3705         return sk_alloc_security(sk, family, priority);
3706 }
3707
3708 static void selinux_sk_free_security(struct sock *sk)
3709 {
3710         sk_free_security(sk);
3711 }
3712
3713 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3714 {
3715         struct sk_security_struct *ssec = sk->sk_security;
3716         struct sk_security_struct *newssec = newsk->sk_security;
3717
3718         newssec->sid = ssec->sid;
3719         newssec->peer_sid = ssec->peer_sid;
3720
3721         selinux_netlbl_sk_security_clone(ssec, newssec);
3722 }
3723
3724 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3725 {
3726         if (!sk)
3727                 *secid = SECINITSID_ANY_SOCKET;
3728         else {
3729                 struct sk_security_struct *sksec = sk->sk_security;
3730
3731                 *secid = sksec->sid;
3732         }
3733 }
3734
3735 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3736 {
3737         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3738         struct sk_security_struct *sksec = sk->sk_security;
3739
3740         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3741             sk->sk_family == PF_UNIX)
3742                 isec->sid = sksec->sid;
3743
3744         selinux_netlbl_sock_graft(sk, parent);
3745 }
3746
3747 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3748                                      struct request_sock *req)
3749 {
3750         struct sk_security_struct *sksec = sk->sk_security;
3751         int err;
3752         u32 newsid;
3753         u32 peersid;
3754
3755         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3756         if (peersid == SECSID_NULL) {
3757                 req->secid = sksec->sid;
3758                 req->peer_secid = SECSID_NULL;
3759                 return 0;
3760         }
3761
3762         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3763         if (err)
3764                 return err;
3765
3766         req->secid = newsid;
3767         req->peer_secid = peersid;
3768         return 0;
3769 }
3770
3771 static void selinux_inet_csk_clone(struct sock *newsk,
3772                                    const struct request_sock *req)
3773 {
3774         struct sk_security_struct *newsksec = newsk->sk_security;
3775
3776         newsksec->sid = req->secid;
3777         newsksec->peer_sid = req->peer_secid;
3778         /* NOTE: Ideally, we should also get the isec->sid for the
3779            new socket in sync, but we don't have the isec available yet.
3780            So we will wait until sock_graft to do it, by which
3781            time it will have been created and available. */
3782
3783         /* We don't need to take any sort of lock here as we are the only
3784          * thread with access to newsksec */
3785         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3786 }
3787
3788 static void selinux_inet_conn_established(struct sock *sk,
3789                                 struct sk_buff *skb)
3790 {
3791         struct sk_security_struct *sksec = sk->sk_security;
3792
3793         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3794 }
3795
3796 static void selinux_req_classify_flow(const struct request_sock *req,
3797                                       struct flowi *fl)
3798 {
3799         fl->secid = req->secid;
3800 }
3801
3802 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3803 {
3804         int err = 0;
3805         u32 perm;
3806         struct nlmsghdr *nlh;
3807         struct socket *sock = sk->sk_socket;
3808         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3809         
3810         if (skb->len < NLMSG_SPACE(0)) {
3811                 err = -EINVAL;
3812                 goto out;
3813         }
3814         nlh = nlmsg_hdr(skb);
3815         
3816         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3817         if (err) {
3818                 if (err == -EINVAL) {
3819                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3820                                   "SELinux:  unrecognized netlink message"
3821                                   " type=%hu for sclass=%hu\n",
3822                                   nlh->nlmsg_type, isec->sclass);
3823                         if (!selinux_enforcing)
3824                                 err = 0;
3825                 }
3826
3827                 /* Ignore */
3828                 if (err == -ENOENT)
3829                         err = 0;
3830                 goto out;
3831         }
3832
3833         err = socket_has_perm(current, sock, perm);
3834 out:
3835         return err;
3836 }
3837
3838 #ifdef CONFIG_NETFILTER
3839
3840 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3841                                             struct avc_audit_data *ad,
3842                                             u16 family, char *addrp, int len)
3843 {
3844         int err = 0;
3845         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3846         struct socket *sock;
3847         struct inode *inode;
3848         struct inode_security_struct *isec;
3849
3850         sock = sk->sk_socket;
3851         if (!sock)
3852                 goto out;
3853
3854         inode = SOCK_INODE(sock);
3855         if (!inode)
3856                 goto out;
3857
3858         isec = inode->i_security;
3859         
3860         err = sel_netif_sids(dev, &if_sid, NULL);
3861         if (err)
3862                 goto out;
3863
3864         switch (isec->sclass) {
3865         case SECCLASS_UDP_SOCKET:
3866                 netif_perm = NETIF__UDP_SEND;
3867                 node_perm = NODE__UDP_SEND;
3868                 send_perm = UDP_SOCKET__SEND_MSG;
3869                 break;
3870         
3871         case SECCLASS_TCP_SOCKET:
3872                 netif_perm = NETIF__TCP_SEND;
3873                 node_perm = NODE__TCP_SEND;
3874                 send_perm = TCP_SOCKET__SEND_MSG;
3875                 break;
3876
3877         case SECCLASS_DCCP_SOCKET:
3878                 netif_perm = NETIF__DCCP_SEND;
3879                 node_perm = NODE__DCCP_SEND;
3880                 send_perm = DCCP_SOCKET__SEND_MSG;
3881                 break;
3882
3883         default:
3884                 netif_perm = NETIF__RAWIP_SEND;
3885                 node_perm = NODE__RAWIP_SEND;
3886                 break;
3887         }
3888
3889         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3890         if (err)
3891                 goto out;
3892                 
3893         err = security_node_sid(family, addrp, len, &node_sid);
3894         if (err)
3895                 goto out;
3896         
3897         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3898         if (err)
3899                 goto out;
3900
3901         if (send_perm) {
3902                 u32 port_sid;
3903                 
3904                 err = security_port_sid(sk->sk_family,
3905                                         sk->sk_type,
3906                                         sk->sk_protocol,
3907                                         ntohs(ad->u.net.dport),
3908                                         &port_sid);
3909                 if (err)
3910                         goto out;
3911
3912                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3913                                    send_perm, ad);
3914         }
3915 out:
3916         return err;
3917 }
3918
3919 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3920                                               struct sk_buff **pskb,
3921                                               const struct net_device *in,
3922                                               const struct net_device *out,
3923                                               int (*okfn)(struct sk_buff *),
3924                                               u16 family)
3925 {
3926         char *addrp;
3927         int len, err = 0;
3928         struct sock *sk;
3929         struct sk_buff *skb = *pskb;
3930         struct avc_audit_data ad;
3931         struct net_device *dev = (struct net_device *)out;
3932         struct sk_security_struct *sksec;
3933         u8 proto;
3934
3935         sk = skb->sk;
3936         if (!sk)
3937                 goto out;
3938
3939         sksec = sk->sk_security;
3940
3941         AVC_AUDIT_DATA_INIT(&ad, NET);
3942         ad.u.net.netif = dev->name;
3943         ad.u.net.family = family;
3944
3945         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3946         if (err)
3947                 goto out;
3948
3949         if (selinux_compat_net)
3950                 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3951                                                        family, addrp, len);
3952         else
3953                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3954                                    PACKET__SEND, &ad);
3955
3956         if (err)
3957                 goto out;
3958
3959         err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3960 out:
3961         return err ? NF_DROP : NF_ACCEPT;
3962 }
3963
3964 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3965                                                 struct sk_buff **pskb,
3966                                                 const struct net_device *in,
3967                                                 const struct net_device *out,
3968                                                 int (*okfn)(struct sk_buff *))
3969 {
3970         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3971 }
3972
3973 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3974
3975 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3976                                                 struct sk_buff **pskb,
3977                                                 const struct net_device *in,
3978                                                 const struct net_device *out,
3979                                                 int (*okfn)(struct sk_buff *))
3980 {
3981         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3982 }
3983
3984 #endif  /* IPV6 */
3985
3986 #endif  /* CONFIG_NETFILTER */
3987
3988 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3989 {
3990         int err;
3991
3992         err = secondary_ops->netlink_send(sk, skb);
3993         if (err)
3994                 return err;
3995
3996         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3997                 err = selinux_nlmsg_perm(sk, skb);
3998
3999         return err;
4000 }
4001
4002 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4003 {
4004         int err;
4005         struct avc_audit_data ad;
4006
4007         err = secondary_ops->netlink_recv(skb, capability);
4008         if (err)
4009                 return err;
4010
4011         AVC_AUDIT_DATA_INIT(&ad, CAP);
4012         ad.u.cap = capability;
4013
4014         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4015                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4016 }
4017
4018 static int ipc_alloc_security(struct task_struct *task,
4019                               struct kern_ipc_perm *perm,
4020                               u16 sclass)
4021 {
4022         struct task_security_struct *tsec = task->security;
4023         struct ipc_security_struct *isec;
4024
4025         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4026         if (!isec)
4027                 return -ENOMEM;
4028
4029         isec->sclass = sclass;
4030         isec->ipc_perm = perm;
4031         isec->sid = tsec->sid;
4032         perm->security = isec;
4033
4034         return 0;
4035 }
4036
4037 static void ipc_free_security(struct kern_ipc_perm *perm)
4038 {
4039         struct ipc_security_struct *isec = perm->security;
4040         perm->security = NULL;
4041         kfree(isec);
4042 }
4043
4044 static int msg_msg_alloc_security(struct msg_msg *msg)
4045 {
4046         struct msg_security_struct *msec;
4047
4048         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4049         if (!msec)
4050                 return -ENOMEM;
4051
4052         msec->msg = msg;
4053         msec->sid = SECINITSID_UNLABELED;
4054         msg->security = msec;
4055
4056         return 0;
4057 }
4058
4059 static void msg_msg_free_security(struct msg_msg *msg)
4060 {
4061         struct msg_security_struct *msec = msg->security;
4062
4063         msg->security = NULL;
4064         kfree(msec);
4065 }
4066
4067 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4068                         u32 perms)
4069 {
4070         struct task_security_struct *tsec;
4071         struct ipc_security_struct *isec;
4072         struct avc_audit_data ad;
4073
4074         tsec = current->security;
4075         isec = ipc_perms->security;
4076
4077         AVC_AUDIT_DATA_INIT(&ad, IPC);
4078         ad.u.ipc_id = ipc_perms->key;
4079
4080         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4081 }
4082
4083 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4084 {
4085         return msg_msg_alloc_security(msg);
4086 }
4087
4088 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4089 {
4090         msg_msg_free_security(msg);
4091 }
4092
4093 /* message queue security operations */
4094 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4095 {
4096         struct task_security_struct *tsec;
4097         struct ipc_security_struct *isec;
4098         struct avc_audit_data ad;
4099         int rc;
4100
4101         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4102         if (rc)
4103                 return rc;
4104
4105         tsec = current->security;
4106         isec = msq->q_perm.security;
4107
4108         AVC_AUDIT_DATA_INIT(&ad, IPC);
4109         ad.u.ipc_id = msq->q_perm.key;
4110
4111         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4112                           MSGQ__CREATE, &ad);
4113         if (rc) {
4114                 ipc_free_security(&msq->q_perm);
4115                 return rc;
4116         }
4117         return 0;
4118 }
4119
4120 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4121 {
4122         ipc_free_security(&msq->q_perm);
4123 }
4124
4125 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4126 {
4127         struct task_security_struct *tsec;
4128         struct ipc_security_struct *isec;
4129         struct avc_audit_data ad;
4130
4131         tsec = current->security;
4132         isec = msq->q_perm.security;
4133
4134         AVC_AUDIT_DATA_INIT(&ad, IPC);
4135         ad.u.ipc_id = msq->q_perm.key;
4136
4137         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4138                             MSGQ__ASSOCIATE, &ad);
4139 }
4140
4141 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4142 {
4143         int err;
4144         int perms;
4145
4146         switch(cmd) {
4147         case IPC_INFO:
4148         case MSG_INFO:
4149                 /* No specific object, just general system-wide information. */
4150                 return task_has_system(current, SYSTEM__IPC_INFO);
4151         case IPC_STAT:
4152         case MSG_STAT:
4153                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4154                 break;
4155         case IPC_SET:
4156                 perms = MSGQ__SETATTR;
4157                 break;
4158         case IPC_RMID:
4159                 perms = MSGQ__DESTROY;
4160                 break;
4161         default:
4162                 return 0;
4163         }
4164
4165         err = ipc_has_perm(&msq->q_perm, perms);
4166         return err;
4167 }
4168
4169 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4170 {
4171         struct task_security_struct *tsec;
4172         struct ipc_security_struct *isec;
4173         struct msg_security_struct *msec;
4174         struct avc_audit_data ad;
4175         int rc;
4176
4177         tsec = current->security;
4178         isec = msq->q_perm.security;
4179         msec = msg->security;
4180
4181         /*
4182          * First time through, need to assign label to the message
4183          */
4184         if (msec->sid == SECINITSID_UNLABELED) {
4185                 /*
4186                  * Compute new sid based on current process and
4187                  * message queue this message will be stored in
4188                  */
4189                 rc = security_transition_sid(tsec->sid,
4190                                              isec->sid,
4191                                              SECCLASS_MSG,
4192                                              &msec->sid);
4193                 if (rc)
4194                         return rc;
4195         }
4196
4197         AVC_AUDIT_DATA_INIT(&ad, IPC);
4198         ad.u.ipc_id = msq->q_perm.key;
4199
4200         /* Can this process write to the queue? */
4201         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4202                           MSGQ__WRITE, &ad);
4203         if (!rc)
4204                 /* Can this process send the message */
4205                 rc = avc_has_perm(tsec->sid, msec->sid,
4206                                   SECCLASS_MSG, MSG__SEND, &ad);
4207         if (!rc)
4208                 /* Can the message be put in the queue? */
4209                 rc = avc_has_perm(msec->sid, isec->sid,
4210                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4211
4212         return rc;
4213 }
4214
4215 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4216                                     struct task_struct *target,
4217                                     long type, int mode)
4218 {
4219         struct task_security_struct *tsec;
4220         struct ipc_security_struct *isec;
4221         struct msg_security_struct *msec;
4222         struct avc_audit_data ad;
4223         int rc;
4224
4225         tsec = target->security;
4226         isec = msq->q_perm.security;
4227         msec = msg->security;
4228
4229         AVC_AUDIT_DATA_INIT(&ad, IPC);
4230         ad.u.ipc_id = msq->q_perm.key;
4231
4232         rc = avc_has_perm(tsec->sid, isec->sid,
4233                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4234         if (!rc)
4235                 rc = avc_has_perm(tsec->sid, msec->sid,
4236                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4237         return rc;
4238 }
4239
4240 /* Shared Memory security operations */
4241 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4242 {
4243         struct task_security_struct *tsec;
4244         struct ipc_security_struct *isec;
4245         struct avc_audit_data ad;
4246         int rc;
4247
4248         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4249         if (rc)
4250                 return rc;
4251
4252         tsec = current->security;
4253         isec = shp->shm_perm.security;
4254
4255         AVC_AUDIT_DATA_INIT(&ad, IPC);
4256         ad.u.ipc_id = shp->shm_perm.key;
4257
4258         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4259                           SHM__CREATE, &ad);
4260         if (rc) {
4261                 ipc_free_security(&shp->shm_perm);
4262                 return rc;
4263         }
4264         return 0;
4265 }
4266
4267 static void selinux_shm_free_security(struct shmid_kernel *shp)
4268 {
4269         ipc_free_security(&shp->shm_perm);
4270 }
4271
4272 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4273 {
4274         struct task_security_struct *tsec;
4275         struct ipc_security_struct *isec;
4276         struct avc_audit_data ad;
4277
4278         tsec = current->security;
4279         isec = shp->shm_perm.security;
4280
4281         AVC_AUDIT_DATA_INIT(&ad, IPC);
4282         ad.u.ipc_id = shp->shm_perm.key;
4283
4284         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4285                             SHM__ASSOCIATE, &ad);
4286 }
4287
4288 /* Note, at this point, shp is locked down */
4289 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4290 {
4291         int perms;
4292         int err;
4293
4294         switch(cmd) {
4295         case IPC_INFO:
4296         case SHM_INFO:
4297                 /* No specific object, just general system-wide information. */
4298                 return task_has_system(current, SYSTEM__IPC_INFO);
4299         case IPC_STAT:
4300         case SHM_STAT:
4301                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4302                 break;
4303         case IPC_SET:
4304                 perms = SHM__SETATTR;
4305                 break;
4306         case SHM_LOCK:
4307         case SHM_UNLOCK:
4308                 perms = SHM__LOCK;
4309                 break;
4310         case IPC_RMID:
4311                 perms = SHM__DESTROY;
4312                 break;
4313         default:
4314                 return 0;
4315         }
4316
4317         err = ipc_has_perm(&shp->shm_perm, perms);
4318         return err;
4319 }
4320
4321 static int selinux_shm_shmat(struct shmid_kernel *shp,
4322                              char __user *shmaddr, int shmflg)
4323 {
4324         u32 perms;
4325         int rc;
4326
4327         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4328         if (rc)
4329                 return rc;
4330
4331         if (shmflg & SHM_RDONLY)
4332                 perms = SHM__READ;
4333         else
4334                 perms = SHM__READ | SHM__WRITE;
4335
4336         return ipc_has_perm(&shp->shm_perm, perms);
4337 }
4338
4339 /* Semaphore security operations */
4340 static int selinux_sem_alloc_security(struct sem_array *sma)
4341 {
4342         struct task_security_struct *tsec;
4343         struct ipc_security_struct *isec;
4344         struct avc_audit_data ad;
4345         int rc;
4346
4347         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4348         if (rc)
4349                 return rc;
4350
4351         tsec = current->security;
4352         isec = sma->sem_perm.security;
4353
4354         AVC_AUDIT_DATA_INIT(&ad, IPC);
4355         ad.u.ipc_id = sma->sem_perm.key;
4356
4357         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4358                           SEM__CREATE, &ad);
4359         if (rc) {
4360                 ipc_free_security(&sma->sem_perm);
4361                 return rc;
4362         }
4363         return 0;
4364 }
4365
4366 static void selinux_sem_free_security(struct sem_array *sma)
4367 {
4368         ipc_free_security(&sma->sem_perm);
4369 }
4370
4371 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4372 {
4373         struct task_security_struct *tsec;
4374         struct ipc_security_struct *isec;
4375         struct avc_audit_data ad;
4376
4377         tsec = current->security;
4378         isec = sma->sem_perm.security;
4379
4380         AVC_AUDIT_DATA_INIT(&ad, IPC);
4381         ad.u.ipc_id = sma->sem_perm.key;
4382
4383         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4384                             SEM__ASSOCIATE, &ad);
4385 }
4386
4387 /* Note, at this point, sma is locked down */
4388 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4389 {
4390         int err;
4391         u32 perms;
4392
4393         switch(cmd) {
4394         case IPC_INFO:
4395         case SEM_INFO:
4396                 /* No specific object, just general system-wide information. */
4397                 return task_has_system(current, SYSTEM__IPC_INFO);
4398         case GETPID:
4399         case GETNCNT:
4400         case GETZCNT:
4401                 perms = SEM__GETATTR;
4402                 break;
4403         case GETVAL:
4404         case GETALL:
4405                 perms = SEM__READ;
4406                 break;
4407         case SETVAL:
4408         case SETALL:
4409                 perms = SEM__WRITE;
4410                 break;
4411         case IPC_RMID:
4412                 perms = SEM__DESTROY;
4413                 break;
4414         case IPC_SET:
4415                 perms = SEM__SETATTR;
4416                 break;
4417         case IPC_STAT:
4418         case SEM_STAT:
4419                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4420                 break;
4421         default:
4422                 return 0;
4423         }
4424
4425         err = ipc_has_perm(&sma->sem_perm, perms);
4426         return err;
4427 }
4428
4429 static int selinux_sem_semop(struct sem_array *sma,
4430                              struct sembuf *sops, unsigned nsops, int alter)
4431 {
4432         u32 perms;
4433
4434         if (alter)
4435                 perms = SEM__READ | SEM__WRITE;
4436         else
4437                 perms = SEM__READ;
4438
4439         return ipc_has_perm(&sma->sem_perm, perms);
4440 }
4441
4442 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4443 {
4444         u32 av = 0;
4445
4446         av = 0;
4447         if (flag & S_IRUGO)
4448                 av |= IPC__UNIX_READ;
4449         if (flag & S_IWUGO)
4450                 av |= IPC__UNIX_WRITE;
4451
4452         if (av == 0)
4453                 return 0;
4454
4455         return ipc_has_perm(ipcp, av);
4456 }
4457
4458 /* module stacking operations */
4459 static int selinux_register_security (const char *name, struct security_operations *ops)
4460 {
4461         if (secondary_ops != original_ops) {
4462                 printk(KERN_ERR "%s:  There is already a secondary security "
4463                        "module registered.\n", __FUNCTION__);
4464                 return -EINVAL;
4465         }
4466
4467         secondary_ops = ops;
4468
4469         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4470                __FUNCTION__,
4471                name);
4472
4473         return 0;
4474 }
4475
4476 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4477 {
4478         if (ops != secondary_ops) {
4479                 printk(KERN_ERR "%s:  trying to unregister a security module "
4480                         "that is not registered.\n", __FUNCTION__);
4481                 return -EINVAL;
4482         }
4483
4484         secondary_ops = original_ops;
4485
4486         return 0;
4487 }
4488
4489 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4490 {
4491         if (inode)
4492                 inode_doinit_with_dentry(inode, dentry);
4493 }
4494
4495 static int selinux_getprocattr(struct task_struct *p,
4496                                char *name, char **value)
4497 {
4498         struct task_security_struct *tsec;
4499         u32 sid;
4500         int error;
4501         unsigned len;
4502
4503         if (current != p) {
4504                 error = task_has_perm(current, p, PROCESS__GETATTR);
4505                 if (error)
4506                         return error;
4507         }
4508
4509         tsec = p->security;
4510
4511         if (!strcmp(name, "current"))
4512                 sid = tsec->sid;
4513         else if (!strcmp(name, "prev"))
4514                 sid = tsec->osid;
4515         else if (!strcmp(name, "exec"))
4516                 sid = tsec->exec_sid;
4517         else if (!strcmp(name, "fscreate"))
4518                 sid = tsec->create_sid;
4519         else if (!strcmp(name, "keycreate"))
4520                 sid = tsec->keycreate_sid;
4521         else if (!strcmp(name, "sockcreate"))
4522                 sid = tsec->sockcreate_sid;
4523         else
4524                 return -EINVAL;
4525
4526         if (!sid)
4527                 return 0;
4528
4529         error = security_sid_to_context(sid, value, &len);
4530         if (error)
4531                 return error;
4532         return len;
4533 }
4534
4535 static int selinux_setprocattr(struct task_struct *p,
4536                                char *name, void *value, size_t size)
4537 {
4538         struct task_security_struct *tsec;
4539         u32 sid = 0;
4540         int error;
4541         char *str = value;
4542
4543         if (current != p) {
4544                 /* SELinux only allows a process to change its own
4545                    security attributes. */
4546                 return -EACCES;
4547         }
4548
4549         /*
4550          * Basic control over ability to set these attributes at all.
4551          * current == p, but we'll pass them separately in case the
4552          * above restriction is ever removed.
4553          */
4554         if (!strcmp(name, "exec"))
4555                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4556         else if (!strcmp(name, "fscreate"))
4557                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4558         else if (!strcmp(name, "keycreate"))
4559                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4560         else if (!strcmp(name, "sockcreate"))
4561                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4562         else if (!strcmp(name, "current"))
4563                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4564         else
4565                 error = -EINVAL;
4566         if (error)
4567                 return error;
4568
4569         /* Obtain a SID for the context, if one was specified. */
4570         if (size && str[1] && str[1] != '\n') {
4571                 if (str[size-1] == '\n') {
4572                         str[size-1] = 0;
4573                         size--;
4574                 }
4575                 error = security_context_to_sid(value, size, &sid);
4576                 if (error)
4577                         return error;
4578         }
4579
4580         /* Permission checking based on the specified context is
4581            performed during the actual operation (execve,
4582            open/mkdir/...), when we know the full context of the
4583            operation.  See selinux_bprm_set_security for the execve
4584            checks and may_create for the file creation checks. The
4585            operation will then fail if the context is not permitted. */
4586         tsec = p->security;
4587         if (!strcmp(name, "exec"))
4588                 tsec->exec_sid = sid;
4589         else if (!strcmp(name, "fscreate"))
4590                 tsec->create_sid = sid;
4591         else if (!strcmp(name, "keycreate")) {
4592                 error = may_create_key(sid, p);
4593                 if (error)
4594                         return error;
4595                 tsec->keycreate_sid = sid;
4596         } else if (!strcmp(name, "sockcreate"))
4597                 tsec->sockcreate_sid = sid;
4598         else if (!strcmp(name, "current")) {
4599                 struct av_decision avd;
4600
4601                 if (sid == 0)
4602                         return -EINVAL;
4603
4604                 /* Only allow single threaded processes to change context */
4605                 if (atomic_read(&p->mm->mm_users) != 1) {
4606                         struct task_struct *g, *t;
4607                         struct mm_struct *mm = p->mm;
4608                         read_lock(&tasklist_lock);
4609                         do_each_thread(g, t)
4610                                 if (t->mm == mm && t != p) {
4611                                         read_unlock(&tasklist_lock);
4612                                         return -EPERM;
4613                                 }
4614                         while_each_thread(g, t);
4615                         read_unlock(&tasklist_lock);
4616                 }
4617
4618                 /* Check permissions for the transition. */
4619                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4620                                      PROCESS__DYNTRANSITION, NULL);
4621                 if (error)
4622                         return error;
4623
4624                 /* Check for ptracing, and update the task SID if ok.
4625                    Otherwise, leave SID unchanged and fail. */
4626                 task_lock(p);
4627                 if (p->ptrace & PT_PTRACED) {
4628                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4629                                                      SECCLASS_PROCESS,
4630                                                      PROCESS__PTRACE, &avd);
4631                         if (!error)
4632                                 tsec->sid = sid;
4633                         task_unlock(p);
4634                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4635                                   PROCESS__PTRACE, &avd, error, NULL);
4636                         if (error)
4637                                 return error;
4638                 } else {
4639                         tsec->sid = sid;
4640                         task_unlock(p);
4641                 }
4642         }
4643         else
4644                 return -EINVAL;
4645
4646         return size;
4647 }
4648
4649 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4650 {
4651         return security_sid_to_context(secid, secdata, seclen);
4652 }
4653
4654 static void selinux_release_secctx(char *secdata, u32 seclen)
4655 {
4656         if (secdata)
4657                 kfree(secdata);
4658 }
4659
4660 #ifdef CONFIG_KEYS
4661
4662 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4663                              unsigned long flags)
4664 {
4665         struct task_security_struct *tsec = tsk->security;
4666         struct key_security_struct *ksec;
4667
4668         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4669         if (!ksec)
4670                 return -ENOMEM;
4671
4672         ksec->obj = k;
4673         if (tsec->keycreate_sid)
4674                 ksec->sid = tsec->keycreate_sid;
4675         else
4676                 ksec->sid = tsec->sid;
4677         k->security = ksec;
4678
4679         return 0;
4680 }
4681
4682 static void selinux_key_free(struct key *k)
4683 {
4684         struct key_security_struct *ksec = k->security;
4685
4686         k->security = NULL;
4687         kfree(ksec);
4688 }
4689
4690 static int selinux_key_permission(key_ref_t key_ref,
4691                             struct task_struct *ctx,
4692                             key_perm_t perm)
4693 {
4694         struct key *key;
4695         struct task_security_struct *tsec;
4696         struct key_security_struct *ksec;
4697
4698         key = key_ref_to_ptr(key_ref);
4699
4700         tsec = ctx->security;
4701         ksec = key->security;
4702
4703         /* if no specific permissions are requested, we skip the
4704            permission check. No serious, additional covert channels
4705            appear to be created. */
4706         if (perm == 0)
4707                 return 0;
4708
4709         return avc_has_perm(tsec->sid, ksec->sid,
4710                             SECCLASS_KEY, perm, NULL);
4711 }
4712
4713 #endif
4714
4715 static struct security_operations selinux_ops = {
4716         .ptrace =                       selinux_ptrace,
4717         .capget =                       selinux_capget,
4718         .capset_check =                 selinux_capset_check,
4719         .capset_set =                   selinux_capset_set,
4720         .sysctl =                       selinux_sysctl,
4721         .capable =                      selinux_capable,
4722         .quotactl =                     selinux_quotactl,
4723         .quota_on =                     selinux_quota_on,
4724         .syslog =                       selinux_syslog,
4725         .vm_enough_memory =             selinux_vm_enough_memory,
4726
4727         .netlink_send =                 selinux_netlink_send,
4728         .netlink_recv =                 selinux_netlink_recv,
4729
4730         .bprm_alloc_security =          selinux_bprm_alloc_security,
4731         .bprm_free_security =           selinux_bprm_free_security,
4732         .bprm_apply_creds =             selinux_bprm_apply_creds,
4733         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4734         .bprm_set_security =            selinux_bprm_set_security,
4735         .bprm_check_security =          selinux_bprm_check_security,
4736         .bprm_secureexec =              selinux_bprm_secureexec,
4737
4738         .sb_alloc_security =            selinux_sb_alloc_security,
4739         .sb_free_security =             selinux_sb_free_security,
4740         .sb_copy_data =                 selinux_sb_copy_data,
4741         .sb_kern_mount =                selinux_sb_kern_mount,
4742         .sb_statfs =                    selinux_sb_statfs,
4743         .sb_mount =                     selinux_mount,
4744         .sb_umount =                    selinux_umount,
4745
4746         .inode_alloc_security =         selinux_inode_alloc_security,
4747         .inode_free_security =          selinux_inode_free_security,
4748         .inode_init_security =          selinux_inode_init_security,
4749         .inode_create =                 selinux_inode_create,
4750         .inode_link =                   selinux_inode_link,
4751         .inode_unlink =                 selinux_inode_unlink,
4752         .inode_symlink =                selinux_inode_symlink,
4753         .inode_mkdir =                  selinux_inode_mkdir,
4754         .inode_rmdir =                  selinux_inode_rmdir,
4755         .inode_mknod =                  selinux_inode_mknod,
4756         .inode_rename =                 selinux_inode_rename,
4757         .inode_readlink =               selinux_inode_readlink,
4758         .inode_follow_link =            selinux_inode_follow_link,
4759         .inode_permission =             selinux_inode_permission,
4760         .inode_setattr =                selinux_inode_setattr,
4761         .inode_getattr =                selinux_inode_getattr,
4762         .inode_setxattr =               selinux_inode_setxattr,
4763         .inode_post_setxattr =          selinux_inode_post_setxattr,
4764         .inode_getxattr =               selinux_inode_getxattr,
4765         .inode_listxattr =              selinux_inode_listxattr,
4766         .inode_removexattr =            selinux_inode_removexattr,
4767         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4768         .inode_getsecurity =            selinux_inode_getsecurity,
4769         .inode_setsecurity =            selinux_inode_setsecurity,
4770         .inode_listsecurity =           selinux_inode_listsecurity,
4771
4772         .file_permission =              selinux_file_permission,
4773         .file_alloc_security =          selinux_file_alloc_security,
4774         .file_free_security =           selinux_file_free_security,
4775         .file_ioctl =                   selinux_file_ioctl,
4776         .file_mmap =                    selinux_file_mmap,
4777         .file_mprotect =                selinux_file_mprotect,
4778         .file_lock =                    selinux_file_lock,
4779         .file_fcntl =                   selinux_file_fcntl,
4780         .file_set_fowner =              selinux_file_set_fowner,
4781         .file_send_sigiotask =          selinux_file_send_sigiotask,
4782         .file_receive =                 selinux_file_receive,
4783
4784         .task_create =                  selinux_task_create,
4785         .task_alloc_security =          selinux_task_alloc_security,
4786         .task_free_security =           selinux_task_free_security,
4787         .task_setuid =                  selinux_task_setuid,
4788         .task_post_setuid =             selinux_task_post_setuid,
4789         .task_setgid =                  selinux_task_setgid,
4790         .task_setpgid =                 selinux_task_setpgid,
4791         .task_getpgid =                 selinux_task_getpgid,
4792         .task_getsid =                  selinux_task_getsid,
4793         .task_getsecid =                selinux_task_getsecid,
4794         .task_setgroups =               selinux_task_setgroups,
4795         .task_setnice =                 selinux_task_setnice,
4796         .task_setioprio =               selinux_task_setioprio,
4797         .task_getioprio =               selinux_task_getioprio,
4798         .task_setrlimit =               selinux_task_setrlimit,
4799         .task_setscheduler =            selinux_task_setscheduler,
4800         .task_getscheduler =            selinux_task_getscheduler,
4801         .task_movememory =              selinux_task_movememory,
4802         .task_kill =                    selinux_task_kill,
4803         .task_wait =                    selinux_task_wait,
4804         .task_prctl =                   selinux_task_prctl,
4805         .task_reparent_to_init =        selinux_task_reparent_to_init,
4806         .task_to_inode =                selinux_task_to_inode,
4807
4808         .ipc_permission =               selinux_ipc_permission,
4809
4810         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4811         .msg_msg_free_security =        selinux_msg_msg_free_security,
4812
4813         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4814         .msg_queue_free_security =      selinux_msg_queue_free_security,
4815         .msg_queue_associate =          selinux_msg_queue_associate,
4816         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4817         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4818         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4819
4820         .shm_alloc_security =           selinux_shm_alloc_security,
4821         .shm_free_security =            selinux_shm_free_security,
4822         .shm_associate =                selinux_shm_associate,
4823         .shm_shmctl =                   selinux_shm_shmctl,
4824         .shm_shmat =                    selinux_shm_shmat,
4825
4826         .sem_alloc_security =           selinux_sem_alloc_security,
4827         .sem_free_security =            selinux_sem_free_security,
4828         .sem_associate =                selinux_sem_associate,
4829         .sem_semctl =                   selinux_sem_semctl,
4830         .sem_semop =                    selinux_sem_semop,
4831
4832         .register_security =            selinux_register_security,
4833         .unregister_security =          selinux_unregister_security,
4834
4835         .d_instantiate =                selinux_d_instantiate,
4836
4837         .getprocattr =                  selinux_getprocattr,
4838         .setprocattr =                  selinux_setprocattr,
4839
4840         .secid_to_secctx =              selinux_secid_to_secctx,
4841         .release_secctx =               selinux_release_secctx,
4842
4843         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4844         .unix_may_send =                selinux_socket_unix_may_send,
4845
4846         .socket_create =                selinux_socket_create,
4847         .socket_post_create =           selinux_socket_post_create,
4848         .socket_bind =                  selinux_socket_bind,
4849         .socket_connect =               selinux_socket_connect,
4850         .socket_listen =                selinux_socket_listen,
4851         .socket_accept =                selinux_socket_accept,
4852         .socket_sendmsg =               selinux_socket_sendmsg,
4853         .socket_recvmsg =               selinux_socket_recvmsg,
4854         .socket_getsockname =           selinux_socket_getsockname,
4855         .socket_getpeername =           selinux_socket_getpeername,
4856         .socket_getsockopt =            selinux_socket_getsockopt,
4857         .socket_setsockopt =            selinux_socket_setsockopt,
4858         .socket_shutdown =              selinux_socket_shutdown,
4859         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4860         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4861         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4862         .sk_alloc_security =            selinux_sk_alloc_security,
4863         .sk_free_security =             selinux_sk_free_security,
4864         .sk_clone_security =            selinux_sk_clone_security,
4865         .sk_getsecid =                  selinux_sk_getsecid,
4866         .sock_graft =                   selinux_sock_graft,
4867         .inet_conn_request =            selinux_inet_conn_request,
4868         .inet_csk_clone =               selinux_inet_csk_clone,
4869         .inet_conn_established =        selinux_inet_conn_established,
4870         .req_classify_flow =            selinux_req_classify_flow,
4871
4872 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4873         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4874         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4875         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4876         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4877         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4878         .xfrm_state_free_security =     selinux_xfrm_state_free,
4879         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4880         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4881         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
4882         .xfrm_decode_session =          selinux_xfrm_decode_session,
4883 #endif
4884
4885 #ifdef CONFIG_KEYS
4886         .key_alloc =                    selinux_key_alloc,
4887         .key_free =                     selinux_key_free,
4888         .key_permission =               selinux_key_permission,
4889 #endif
4890 };
4891
4892 static __init int selinux_init(void)
4893 {
4894         struct task_security_struct *tsec;
4895
4896         if (!selinux_enabled) {
4897                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4898                 return 0;
4899         }
4900
4901         printk(KERN_INFO "SELinux:  Initializing.\n");
4902
4903         /* Set the security state for the initial task. */
4904         if (task_alloc_security(current))
4905                 panic("SELinux:  Failed to initialize initial task.\n");
4906         tsec = current->security;
4907         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4908
4909         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4910                                             sizeof(struct inode_security_struct),
4911                                             0, SLAB_PANIC, NULL, NULL);
4912         avc_init();
4913
4914         original_ops = secondary_ops = security_ops;
4915         if (!secondary_ops)
4916                 panic ("SELinux: No initial security operations\n");
4917         if (register_security (&selinux_ops))
4918                 panic("SELinux: Unable to register with kernel.\n");
4919
4920         if (selinux_enforcing) {
4921                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
4922         } else {
4923                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
4924         }
4925
4926 #ifdef CONFIG_KEYS
4927         /* Add security information to initial keyrings */
4928         selinux_key_alloc(&root_user_keyring, current,
4929                           KEY_ALLOC_NOT_IN_QUOTA);
4930         selinux_key_alloc(&root_session_keyring, current,
4931                           KEY_ALLOC_NOT_IN_QUOTA);
4932 #endif
4933
4934         return 0;
4935 }
4936
4937 void selinux_complete_init(void)
4938 {
4939         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
4940
4941         /* Set up any superblocks initialized prior to the policy load. */
4942         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
4943         spin_lock(&sb_lock);
4944         spin_lock(&sb_security_lock);
4945 next_sb:
4946         if (!list_empty(&superblock_security_head)) {
4947                 struct superblock_security_struct *sbsec =
4948                                 list_entry(superblock_security_head.next,
4949                                            struct superblock_security_struct,
4950                                            list);
4951                 struct super_block *sb = sbsec->sb;
4952                 sb->s_count++;
4953                 spin_unlock(&sb_security_lock);
4954                 spin_unlock(&sb_lock);
4955                 down_read(&sb->s_umount);
4956                 if (sb->s_root)
4957                         superblock_doinit(sb, NULL);
4958                 drop_super(sb);
4959                 spin_lock(&sb_lock);
4960                 spin_lock(&sb_security_lock);
4961                 list_del_init(&sbsec->list);
4962                 goto next_sb;
4963         }
4964         spin_unlock(&sb_security_lock);
4965         spin_unlock(&sb_lock);
4966 }
4967
4968 /* SELinux requires early initialization in order to label
4969    all processes and objects when they are created. */
4970 security_initcall(selinux_init);
4971
4972 #if defined(CONFIG_NETFILTER)
4973
4974 static struct nf_hook_ops selinux_ipv4_op = {
4975         .hook =         selinux_ipv4_postroute_last,
4976         .owner =        THIS_MODULE,
4977         .pf =           PF_INET,
4978         .hooknum =      NF_IP_POST_ROUTING,
4979         .priority =     NF_IP_PRI_SELINUX_LAST,
4980 };
4981
4982 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4983
4984 static struct nf_hook_ops selinux_ipv6_op = {
4985         .hook =         selinux_ipv6_postroute_last,
4986         .owner =        THIS_MODULE,
4987         .pf =           PF_INET6,
4988         .hooknum =      NF_IP6_POST_ROUTING,
4989         .priority =     NF_IP6_PRI_SELINUX_LAST,
4990 };
4991
4992 #endif  /* IPV6 */
4993
4994 static int __init selinux_nf_ip_init(void)
4995 {
4996         int err = 0;
4997
4998         if (!selinux_enabled)
4999                 goto out;
5000
5001         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5002
5003         err = nf_register_hook(&selinux_ipv4_op);
5004         if (err)
5005                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5006
5007 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5008
5009         err = nf_register_hook(&selinux_ipv6_op);
5010         if (err)
5011                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5012
5013 #endif  /* IPV6 */
5014
5015 out:
5016         return err;
5017 }
5018
5019 __initcall(selinux_nf_ip_init);
5020
5021 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5022 static void selinux_nf_ip_exit(void)
5023 {
5024         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5025
5026         nf_unregister_hook(&selinux_ipv4_op);
5027 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5028         nf_unregister_hook(&selinux_ipv6_op);
5029 #endif  /* IPV6 */
5030 }
5031 #endif
5032
5033 #else /* CONFIG_NETFILTER */
5034
5035 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5036 #define selinux_nf_ip_exit()
5037 #endif
5038
5039 #endif /* CONFIG_NETFILTER */
5040
5041 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5042 int selinux_disable(void)
5043 {
5044         extern void exit_sel_fs(void);
5045         static int selinux_disabled = 0;
5046
5047         if (ss_initialized) {
5048                 /* Not permitted after initial policy load. */
5049                 return -EINVAL;
5050         }
5051
5052         if (selinux_disabled) {
5053                 /* Only do this once. */
5054                 return -EINVAL;
5055         }
5056
5057         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5058
5059         selinux_disabled = 1;
5060         selinux_enabled = 0;
5061
5062         /* Reset security_ops to the secondary module, dummy or capability. */
5063         security_ops = secondary_ops;
5064
5065         /* Unregister netfilter hooks. */
5066         selinux_nf_ip_exit();
5067
5068         /* Unregister selinuxfs. */
5069         exit_sel_fs();
5070
5071         return 0;
5072 }
5073 #endif
5074
5075