security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76
  77 #define XATTR_SELINUX_SUFFIX "selinux"
  78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  79
  80 extern unsigned int policydb_loaded_version;
  81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  82
  83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  84 int selinux_enforcing = 0;
  85
  86 static int __init enforcing_setup(char *str)
  87 {
  88         selinux_enforcing = simple_strtol(str,NULL,0);
  89         return 1;
  90 }
  91 __setup("enforcing=", enforcing_setup);
  92 #endif
  93
  94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  96
  97 static int __init selinux_enabled_setup(char *str)
  98 {
  99         selinux_enabled = simple_strtol(str, NULL, 0);
 100         return 1;
 101 }
 102 __setup("selinux=", selinux_enabled_setup);
 103 #endif
 104
 105 /* Original (dummy) security module. */
 106 static struct security_operations *original_ops = NULL;
 107
 108 /* Minimal support for a secondary security module,
 109    just to allow the use of the dummy or capability modules.
 110    The owlsm module can alternatively be used as a secondary
 111    module as long as CONFIG_OWLSM_FD is not enabled. */
 112 static struct security_operations *secondary_ops = NULL;
 113
 114 /* Lists of inode and superblock security structures initialized
 115    before the policy was loaded. */
 116 static LIST_HEAD(superblock_security_head);
 117 static DEFINE_SPINLOCK(sb_security_lock);
 118
 119 /* Allocate and free functions for each kind of security blob. */
 120
 121 static int task_alloc_security(struct task_struct *task)
 122 {
 123         struct task_security_struct *tsec;
 124
 125         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 126         if (!tsec)
 127                 return -ENOMEM;
 128
 129         memset(tsec, 0, sizeof(struct task_security_struct));
 130         tsec->magic = SELINUX_MAGIC;
 131         tsec->task = task;
 132         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 133         task->security = tsec;
 134
 135         return 0;
 136 }
 137
 138 static void task_free_security(struct task_struct *task)
 139 {
 140         struct task_security_struct *tsec = task->security;
 141
 142         if (!tsec || tsec->magic != SELINUX_MAGIC)
 143                 return;
 144
 145         task->security = NULL;
 146         kfree(tsec);
 147 }
 148
 149 static int inode_alloc_security(struct inode *inode)
 150 {
 151         struct task_security_struct *tsec = current->security;
 152         struct inode_security_struct *isec;
 153
 154         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 155         if (!isec)
 156                 return -ENOMEM;
 157
 158         memset(isec, 0, sizeof(struct inode_security_struct));
 159         init_MUTEX(&isec->sem);
 160         INIT_LIST_HEAD(&isec->list);
 161         isec->magic = SELINUX_MAGIC;
 162         isec->inode = inode;
 163         isec->sid = SECINITSID_UNLABELED;
 164         isec->sclass = SECCLASS_FILE;
 165         if (tsec && tsec->magic == SELINUX_MAGIC)
 166                 isec->task_sid = tsec->sid;
 167         else
 168                 isec->task_sid = SECINITSID_UNLABELED;
 169         inode->i_security = isec;
 170
 171         return 0;
 172 }
 173
 174 static void inode_free_security(struct inode *inode)
 175 {
 176         struct inode_security_struct *isec = inode->i_security;
 177         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 178
 179         if (!isec || isec->magic != SELINUX_MAGIC)
 180                 return;
 181
 182         spin_lock(&sbsec->isec_lock);
 183         if (!list_empty(&isec->list))
 184                 list_del_init(&isec->list);
 185         spin_unlock(&sbsec->isec_lock);
 186
 187         inode->i_security = NULL;
 188         kfree(isec);
 189 }
 190
 191 static int file_alloc_security(struct file *file)
 192 {
 193         struct task_security_struct *tsec = current->security;
 194         struct file_security_struct *fsec;
 195
 196         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 197         if (!fsec)
 198                 return -ENOMEM;
 199
 200         memset(fsec, 0, sizeof(struct file_security_struct));
 201         fsec->magic = SELINUX_MAGIC;
 202         fsec->file = file;
 203         if (tsec && tsec->magic == SELINUX_MAGIC) {
 204                 fsec->sid = tsec->sid;
 205                 fsec->fown_sid = tsec->sid;
 206         } else {
 207                 fsec->sid = SECINITSID_UNLABELED;
 208                 fsec->fown_sid = SECINITSID_UNLABELED;
 209         }
 210         file->f_security = fsec;
 211
 212         return 0;
 213 }
 214
 215 static void file_free_security(struct file *file)
 216 {
 217         struct file_security_struct *fsec = file->f_security;
 218
 219         if (!fsec || fsec->magic != SELINUX_MAGIC)
 220                 return;
 221
 222         file->f_security = NULL;
 223         kfree(fsec);
 224 }
 225
 226 static int superblock_alloc_security(struct super_block *sb)
 227 {
 228         struct superblock_security_struct *sbsec;
 229
 230         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 231         if (!sbsec)
 232                 return -ENOMEM;
 233
 234         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 235         init_MUTEX(&sbsec->sem);
 236         INIT_LIST_HEAD(&sbsec->list);
 237         INIT_LIST_HEAD(&sbsec->isec_head);
 238         spin_lock_init(&sbsec->isec_lock);
 239         sbsec->magic = SELINUX_MAGIC;
 240         sbsec->sb = sb;
 241         sbsec->sid = SECINITSID_UNLABELED;
 242         sbsec->def_sid = SECINITSID_FILE;
 243         sb->s_security = sbsec;
 244
 245         return 0;
 246 }
 247
 248 static void superblock_free_security(struct super_block *sb)
 249 {
 250         struct superblock_security_struct *sbsec = sb->s_security;
 251
 252         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 253                 return;
 254
 255         spin_lock(&sb_security_lock);
 256         if (!list_empty(&sbsec->list))
 257                 list_del_init(&sbsec->list);
 258         spin_unlock(&sb_security_lock);
 259
 260         sb->s_security = NULL;
 261         kfree(sbsec);
 262 }
 263
 264 #ifdef CONFIG_SECURITY_NETWORK
 265 static int sk_alloc_security(struct sock *sk, int family, int priority)
 266 {
 267         struct sk_security_struct *ssec;
 268
 269         if (family != PF_UNIX)
 270                 return 0;
 271
 272         ssec = kmalloc(sizeof(*ssec), priority);
 273         if (!ssec)
 274                 return -ENOMEM;
 275
 276         memset(ssec, 0, sizeof(*ssec));
 277         ssec->magic = SELINUX_MAGIC;
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         sk->sk_security = ssec;
 281
 282         return 0;
 283 }
 284
 285 static void sk_free_security(struct sock *sk)
 286 {
 287         struct sk_security_struct *ssec = sk->sk_security;
 288
 289         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 290                 return;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295 #endif  /* CONFIG_SECURITY_NETWORK */
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329 };
 330
 331 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 332
 333 static int try_context_mount(struct super_block *sb, void *data)
 334 {
 335         char *context = NULL, *defcontext = NULL;
 336         const char *name;
 337         u32 sid;
 338         int alloc = 0, rc = 0, seen = 0;
 339         struct task_security_struct *tsec = current->security;
 340         struct superblock_security_struct *sbsec = sb->s_security;
 341
 342         if (!data)
 343                 goto out;
 344
 345         name = sb->s_type->name;
 346
 347         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 348
 349                 /* NFS we understand. */
 350                 if (!strcmp(name, "nfs")) {
 351                         struct nfs_mount_data *d = data;
 352
 353                         if (d->version <  NFS_MOUNT_VERSION)
 354                                 goto out;
 355
 356                         if (d->context[0]) {
 357                                 context = d->context;
 358                                 seen |= Opt_context;
 359                         }
 360                 } else
 361                         goto out;
 362
 363         } else {
 364                 /* Standard string-based options. */
 365                 char *p, *options = data;
 366
 367                 while ((p = strsep(&options, ",")) != NULL) {
 368                         int token;
 369                         substring_t args[MAX_OPT_ARGS];
 370
 371                         if (!*p)
 372                                 continue;
 373
 374                         token = match_token(p, tokens, args);
 375
 376                         switch (token) {
 377                         case Opt_context:
 378                                 if (seen) {
 379                                         rc = -EINVAL;
 380                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 381                                         goto out_free;
 382                                 }
 383                                 context = match_strdup(&args[0]);
 384                                 if (!context) {
 385                                         rc = -ENOMEM;
 386                                         goto out_free;
 387                                 }
 388                                 if (!alloc)
 389                                         alloc = 1;
 390                                 seen |= Opt_context;
 391                                 break;
 392
 393                         case Opt_fscontext:
 394                                 if (seen & (Opt_context|Opt_fscontext)) {
 395                                         rc = -EINVAL;
 396                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 397                                         goto out_free;
 398                                 }
 399                                 context = match_strdup(&args[0]);
 400                                 if (!context) {
 401                                         rc = -ENOMEM;
 402                                         goto out_free;
 403                                 }
 404                                 if (!alloc)
 405                                         alloc = 1;
 406                                 seen |= Opt_fscontext;
 407                                 break;
 408
 409                         case Opt_defcontext:
 410                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 411                                         rc = -EINVAL;
 412                                         printk(KERN_WARNING "SELinux:  "
 413                                                "defcontext option is invalid "
 414                                                "for this filesystem type\n");
 415                                         goto out_free;
 416                                 }
 417                                 if (seen & (Opt_context|Opt_defcontext)) {
 418                                         rc = -EINVAL;
 419                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 420                                         goto out_free;
 421                                 }
 422                                 defcontext = match_strdup(&args[0]);
 423                                 if (!defcontext) {
 424                                         rc = -ENOMEM;
 425                                         goto out_free;
 426                                 }
 427                                 if (!alloc)
 428                                         alloc = 1;
 429                                 seen |= Opt_defcontext;
 430                                 break;
 431
 432                         default:
 433                                 rc = -EINVAL;
 434                                 printk(KERN_WARNING "SELinux:  unknown mount "
 435                                        "option\n");
 436                                 goto out_free;
 437
 438                         }
 439                 }
 440         }
 441
 442         if (!seen)
 443                 goto out;
 444
 445         if (context) {
 446                 rc = security_context_to_sid(context, strlen(context), &sid);
 447                 if (rc) {
 448                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 449                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 450                                context, sb->s_id, name, rc);
 451                         goto out_free;
 452                 }
 453
 454                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELFROM, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 460                                   FILESYSTEM__RELABELTO, NULL);
 461                 if (rc)
 462                         goto out_free;
 463
 464                 sbsec->sid = sid;
 465
 466                 if (seen & Opt_context)
 467                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 468         }
 469
 470         if (defcontext) {
 471                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 472                 if (rc) {
 473                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 474                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 475                                defcontext, sb->s_id, name, rc);
 476                         goto out_free;
 477                 }
 478
 479                 if (sid == sbsec->def_sid)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__RELABELFROM, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 488                                   FILESYSTEM__ASSOCIATE, NULL);
 489                 if (rc)
 490                         goto out_free;
 491
 492                 sbsec->def_sid = sid;
 493         }
 494
 495 out_free:
 496         if (alloc) {
 497                 kfree(context);
 498                 kfree(defcontext);
 499         }
 500 out:
 501         return rc;
 502 }
 503
 504 static int superblock_doinit(struct super_block *sb, void *data)
 505 {
 506         struct superblock_security_struct *sbsec = sb->s_security;
 507         struct dentry *root = sb->s_root;
 508         struct inode *inode = root->d_inode;
 509         int rc = 0;
 510
 511         down(&sbsec->sem);
 512         if (sbsec->initialized)
 513                 goto out;
 514
 515         if (!ss_initialized) {
 516                 /* Defer initialization until selinux_complete_init,
 517                    after the initial policy is loaded and the security
 518                    server is ready to handle calls. */
 519                 spin_lock(&sb_security_lock);
 520                 if (list_empty(&sbsec->list))
 521                         list_add(&sbsec->list, &superblock_security_head);
 522                 spin_unlock(&sb_security_lock);
 523                 goto out;
 524         }
 525
 526         /* Determine the labeling behavior to use for this filesystem type. */
 527         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 528         if (rc) {
 529                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 530                        __FUNCTION__, sb->s_type->name, rc);
 531                 goto out;
 532         }
 533
 534         rc = try_context_mount(sb, data);
 535         if (rc)
 536                 goto out;
 537
 538         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 539                 /* Make sure that the xattr handler exists and that no
 540                    error other than -ENODATA is returned by getxattr on
 541                    the root directory.  -ENODATA is ok, as this may be
 542                    the first boot of the SELinux kernel before we have
 543                    assigned xattr values to the filesystem. */
 544                 if (!inode->i_op->getxattr) {
 545                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 546                                "xattr support\n", sb->s_id, sb->s_type->name);
 547                         rc = -EOPNOTSUPP;
 548                         goto out;
 549                 }
 550                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 551                 if (rc < 0 && rc != -ENODATA) {
 552                         if (rc == -EOPNOTSUPP)
 553                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 554                                        "%s) has no security xattr handler\n",
 555                                        sb->s_id, sb->s_type->name);
 556                         else
 557                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 558                                        "%s) getxattr errno %d\n", sb->s_id,
 559                                        sb->s_type->name, -rc);
 560                         goto out;
 561                 }
 562         }
 563
 564         if (strcmp(sb->s_type->name, "proc") == 0)
 565                 sbsec->proc = 1;
 566
 567         sbsec->initialized = 1;
 568
 569         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 570                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 571                        sb->s_id, sb->s_type->name);
 572         }
 573         else {
 574                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 575                        sb->s_id, sb->s_type->name,
 576                        labeling_behaviors[sbsec->behavior-1]);
 577         }
 578
 579         /* Initialize the root inode. */
 580         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 581
 582         /* Initialize any other inodes associated with the superblock, e.g.
 583            inodes created prior to initial policy load or inodes created
 584            during get_sb by a pseudo filesystem that directly
 585            populates itself. */
 586         spin_lock(&sbsec->isec_lock);
 587 next_inode:
 588         if (!list_empty(&sbsec->isec_head)) {
 589                 struct inode_security_struct *isec =
 590                                 list_entry(sbsec->isec_head.next,
 591                                            struct inode_security_struct, list);
 592                 struct inode *inode = isec->inode;
 593                 spin_unlock(&sbsec->isec_lock);
 594                 inode = igrab(inode);
 595                 if (inode) {
 596                         if (!IS_PRIVATE (inode))
 597                                 inode_doinit(inode);
 598                         iput(inode);
 599                 }
 600                 spin_lock(&sbsec->isec_lock);
 601                 list_del_init(&isec->list);
 602                 goto next_inode;
 603         }
 604         spin_unlock(&sbsec->isec_lock);
 605 out:
 606         up(&sbsec->sem);
 607         return rc;
 608 }
 609
 610 static inline u16 inode_mode_to_security_class(umode_t mode)
 611 {
 612         switch (mode & S_IFMT) {
 613         case S_IFSOCK:
 614                 return SECCLASS_SOCK_FILE;
 615         case S_IFLNK:
 616                 return SECCLASS_LNK_FILE;
 617         case S_IFREG:
 618                 return SECCLASS_FILE;
 619         case S_IFBLK:
 620                 return SECCLASS_BLK_FILE;
 621         case S_IFDIR:
 622                 return SECCLASS_DIR;
 623         case S_IFCHR:
 624                 return SECCLASS_CHR_FILE;
 625         case S_IFIFO:
 626                 return SECCLASS_FIFO_FILE;
 627
 628         }
 629
 630         return SECCLASS_FILE;
 631 }
 632
 633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 634 {
 635         switch (family) {
 636         case PF_UNIX:
 637                 switch (type) {
 638                 case SOCK_STREAM:
 639                 case SOCK_SEQPACKET:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644                 break;
 645         case PF_INET:
 646         case PF_INET6:
 647                 switch (type) {
 648                 case SOCK_STREAM:
 649                         return SECCLASS_TCP_SOCKET;
 650                 case SOCK_DGRAM:
 651                         return SECCLASS_UDP_SOCKET;
 652                 case SOCK_RAW:
 653                         return SECCLASS_RAWIP_SOCKET;
 654                 }
 655                 break;
 656         case PF_NETLINK:
 657                 switch (protocol) {
 658                 case NETLINK_ROUTE:
 659                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 660                 case NETLINK_FIREWALL:
 661                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 662                 case NETLINK_INET_DIAG:
 663                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 664                 case NETLINK_NFLOG:
 665                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 666                 case NETLINK_XFRM:
 667                         return SECCLASS_NETLINK_XFRM_SOCKET;
 668                 case NETLINK_SELINUX:
 669                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 670                 case NETLINK_AUDIT:
 671                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 672                 case NETLINK_IP6_FW:
 673                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 674                 case NETLINK_DNRTMSG:
 675                         return SECCLASS_NETLINK_DNRT_SOCKET;
 676                 case NETLINK_KOBJECT_UEVENT:
 677                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 678                 default:
 679                         return SECCLASS_NETLINK_SOCKET;
 680                 }
 681         case PF_PACKET:
 682                 return SECCLASS_PACKET_SOCKET;
 683         case PF_KEY:
 684                 return SECCLASS_KEY_SOCKET;
 685         }
 686
 687         return SECCLASS_SOCKET;
 688 }
 689
 690 #ifdef CONFIG_PROC_FS
 691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 692                                 u16 tclass,
 693                                 u32 *sid)
 694 {
 695         int buflen, rc;
 696         char *buffer, *path, *end;
 697
 698         buffer = (char*)__get_free_page(GFP_KERNEL);
 699         if (!buffer)
 700                 return -ENOMEM;
 701
 702         buflen = PAGE_SIZE;
 703         end = buffer+buflen;
 704         *--end = '\0';
 705         buflen--;
 706         path = end-1;
 707         *path = '/';
 708         while (de && de != de->parent) {
 709                 buflen -= de->namelen + 1;
 710                 if (buflen < 0)
 711                         break;
 712                 end -= de->namelen;
 713                 memcpy(end, de->name, de->namelen);
 714                 *--end = '/';
 715                 path = end;
 716                 de = de->parent;
 717         }
 718         rc = security_genfs_sid("proc", path, tclass, sid);
 719         free_page((unsigned long)buffer);
 720         return rc;
 721 }
 722 #else
 723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 724                                 u16 tclass,
 725                                 u32 *sid)
 726 {
 727         return -EINVAL;
 728 }
 729 #endif
 730
 731 /* The inode's security attributes must be initialized before first use. */
 732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 733 {
 734         struct superblock_security_struct *sbsec = NULL;
 735         struct inode_security_struct *isec = inode->i_security;
 736         u32 sid;
 737         struct dentry *dentry;
 738 #define INITCONTEXTLEN 255
 739         char *context = NULL;
 740         unsigned len = 0;
 741         int rc = 0;
 742         int hold_sem = 0;
 743
 744         if (isec->initialized)
 745                 goto out;
 746
 747         down(&isec->sem);
 748         hold_sem = 1;
 749         if (isec->initialized)
 750                 goto out;
 751
 752         sbsec = inode->i_sb->s_security;
 753         if (!sbsec->initialized) {
 754                 /* Defer initialization until selinux_complete_init,
 755                    after the initial policy is loaded and the security
 756                    server is ready to handle calls. */
 757                 spin_lock(&sbsec->isec_lock);
 758                 if (list_empty(&isec->list))
 759                         list_add(&isec->list, &sbsec->isec_head);
 760                 spin_unlock(&sbsec->isec_lock);
 761                 goto out;
 762         }
 763
 764         switch (sbsec->behavior) {
 765         case SECURITY_FS_USE_XATTR:
 766                 if (!inode->i_op->getxattr) {
 767                         isec->sid = sbsec->def_sid;
 768                         break;
 769                 }
 770
 771                 /* Need a dentry, since the xattr API requires one.
 772                    Life would be simpler if we could just pass the inode. */
 773                 if (opt_dentry) {
 774                         /* Called from d_instantiate or d_splice_alias. */
 775                         dentry = dget(opt_dentry);
 776                 } else {
 777                         /* Called from selinux_complete_init, try to find a dentry. */
 778                         dentry = d_find_alias(inode);
 779                 }
 780                 if (!dentry) {
 781                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 782                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 783                                inode->i_ino);
 784                         goto out;
 785                 }
 786
 787                 len = INITCONTEXTLEN;
 788                 context = kmalloc(len, GFP_KERNEL);
 789                 if (!context) {
 790                         rc = -ENOMEM;
 791                         dput(dentry);
 792                         goto out;
 793                 }
 794                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                            context, len);
 796                 if (rc == -ERANGE) {
 797                         /* Need a larger buffer.  Query for the right size. */
 798                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 799                                                    NULL, 0);
 800                         if (rc < 0) {
 801                                 dput(dentry);
 802                                 goto out;
 803                         }
 804                         kfree(context);
 805                         len = rc;
 806                         context = kmalloc(len, GFP_KERNEL);
 807                         if (!context) {
 808                                 rc = -ENOMEM;
 809                                 dput(dentry);
 810                                 goto out;
 811                         }
 812                         rc = inode->i_op->getxattr(dentry,
 813                                                    XATTR_NAME_SELINUX,
 814                                                    context, len);
 815                 }
 816                 dput(dentry);
 817                 if (rc < 0) {
 818                         if (rc != -ENODATA) {
 819                                 printk(KERN_WARNING "%s:  getxattr returned "
 820                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 821                                        -rc, inode->i_sb->s_id, inode->i_ino);
 822                                 kfree(context);
 823                                 goto out;
 824                         }
 825                         /* Map ENODATA to the default file SID */
 826                         sid = sbsec->def_sid;
 827                         rc = 0;
 828                 } else {
 829                         rc = security_context_to_sid_default(context, rc, &sid,
 830                                                              sbsec->def_sid);
 831                         if (rc) {
 832                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 833                                        "returned %d for dev=%s ino=%ld\n",
 834                                        __FUNCTION__, context, -rc,
 835                                        inode->i_sb->s_id, inode->i_ino);
 836                                 kfree(context);
 837                                 /* Leave with the unlabeled SID */
 838                                 rc = 0;
 839                                 break;
 840                         }
 841                 }
 842                 kfree(context);
 843                 isec->sid = sid;
 844                 break;
 845         case SECURITY_FS_USE_TASK:
 846                 isec->sid = isec->task_sid;
 847                 break;
 848         case SECURITY_FS_USE_TRANS:
 849                 /* Default to the fs SID. */
 850                 isec->sid = sbsec->sid;
 851
 852                 /* Try to obtain a transition SID. */
 853                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 854                 rc = security_transition_sid(isec->task_sid,
 855                                              sbsec->sid,
 856                                              isec->sclass,
 857                                              &sid);
 858                 if (rc)
 859                         goto out;
 860                 isec->sid = sid;
 861                 break;
 862         default:
 863                 /* Default to the fs SID. */
 864                 isec->sid = sbsec->sid;
 865
 866                 if (sbsec->proc) {
 867                         struct proc_inode *proci = PROC_I(inode);
 868                         if (proci->pde) {
 869                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 870                                 rc = selinux_proc_get_sid(proci->pde,
 871                                                           isec->sclass,
 872                                                           &sid);
 873                                 if (rc)
 874                                         goto out;
 875                                 isec->sid = sid;
 876                         }
 877                 }
 878                 break;
 879         }
 880
 881         isec->initialized = 1;
 882
 883 out:
 884         if (isec->sclass == SECCLASS_FILE)
 885                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 886
 887         if (hold_sem)
 888                 up(&isec->sem);
 889         return rc;
 890 }
 891
 892 /* Convert a Linux signal to an access vector. */
 893 static inline u32 signal_to_av(int sig)
 894 {
 895         u32 perm = 0;
 896
 897         switch (sig) {
 898         case SIGCHLD:
 899                 /* Commonly granted from child to parent. */
 900                 perm = PROCESS__SIGCHLD;
 901                 break;
 902         case SIGKILL:
 903                 /* Cannot be caught or ignored */
 904                 perm = PROCESS__SIGKILL;
 905                 break;
 906         case SIGSTOP:
 907                 /* Cannot be caught or ignored */
 908                 perm = PROCESS__SIGSTOP;
 909                 break;
 910         default:
 911                 /* All other signals. */
 912                 perm = PROCESS__SIGNAL;
 913                 break;
 914         }
 915
 916         return perm;
 917 }
 918
 919 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 920    fork check, ptrace check, etc. */
 921 static int task_has_perm(struct task_struct *tsk1,
 922                          struct task_struct *tsk2,
 923                          u32 perms)
 924 {
 925         struct task_security_struct *tsec1, *tsec2;
 926
 927         tsec1 = tsk1->security;
 928         tsec2 = tsk2->security;
 929         return avc_has_perm(tsec1->sid, tsec2->sid,
 930                             SECCLASS_PROCESS, perms, NULL);
 931 }
 932
 933 /* Check whether a task is allowed to use a capability. */
 934 static int task_has_capability(struct task_struct *tsk,
 935                                int cap)
 936 {
 937         struct task_security_struct *tsec;
 938         struct avc_audit_data ad;
 939
 940         tsec = tsk->security;
 941
 942         AVC_AUDIT_DATA_INIT(&ad,CAP);
 943         ad.tsk = tsk;
 944         ad.u.cap = cap;
 945
 946         return avc_has_perm(tsec->sid, tsec->sid,
 947                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 948 }
 949
 950 /* Check whether a task is allowed to use a system operation. */
 951 static int task_has_system(struct task_struct *tsk,
 952                            u32 perms)
 953 {
 954         struct task_security_struct *tsec;
 955
 956         tsec = tsk->security;
 957
 958         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 959                             SECCLASS_SYSTEM, perms, NULL);
 960 }
 961
 962 /* Check whether a task has a particular permission to an inode.
 963    The 'adp' parameter is optional and allows other audit
 964    data to be passed (e.g. the dentry). */
 965 static int inode_has_perm(struct task_struct *tsk,
 966                           struct inode *inode,
 967                           u32 perms,
 968                           struct avc_audit_data *adp)
 969 {
 970         struct task_security_struct *tsec;
 971         struct inode_security_struct *isec;
 972         struct avc_audit_data ad;
 973
 974         tsec = tsk->security;
 975         isec = inode->i_security;
 976
 977         if (!adp) {
 978                 adp = &ad;
 979                 AVC_AUDIT_DATA_INIT(&ad, FS);
 980                 ad.u.fs.inode = inode;
 981         }
 982
 983         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 984 }
 985
 986 /* Same as inode_has_perm, but pass explicit audit data containing
 987    the dentry to help the auditing code to more easily generate the
 988    pathname if needed. */
 989 static inline int dentry_has_perm(struct task_struct *tsk,
 990                                   struct vfsmount *mnt,
 991                                   struct dentry *dentry,
 992                                   u32 av)
 993 {
 994         struct inode *inode = dentry->d_inode;
 995         struct avc_audit_data ad;
 996         AVC_AUDIT_DATA_INIT(&ad,FS);
 997         ad.u.fs.mnt = mnt;
 998         ad.u.fs.dentry = dentry;
 999         return inode_has_perm(tsk, inode, av, &ad);
1000 }
1001
1002 /* Check whether a task can use an open file descriptor to
1003    access an inode in a given way.  Check access to the
1004    descriptor itself, and then use dentry_has_perm to
1005    check a particular permission to the file.
1006    Access to the descriptor is implicitly granted if it
1007    has the same SID as the process.  If av is zero, then
1008    access to the file is not checked, e.g. for cases
1009    where only the descriptor is affected like seek. */
1010 static inline int file_has_perm(struct task_struct *tsk,
1011                                 struct file *file,
1012                                 u32 av)
1013 {
1014         struct task_security_struct *tsec = tsk->security;
1015         struct file_security_struct *fsec = file->f_security;
1016         struct vfsmount *mnt = file->f_vfsmnt;
1017         struct dentry *dentry = file->f_dentry;
1018         struct inode *inode = dentry->d_inode;
1019         struct avc_audit_data ad;
1020         int rc;
1021
1022         AVC_AUDIT_DATA_INIT(&ad, FS);
1023         ad.u.fs.mnt = mnt;
1024         ad.u.fs.dentry = dentry;
1025
1026         if (tsec->sid != fsec->sid) {
1027                 rc = avc_has_perm(tsec->sid, fsec->sid,
1028                                   SECCLASS_FD,
1029                                   FD__USE,
1030                                   &ad);
1031                 if (rc)
1032                         return rc;
1033         }
1034
1035         /* av is zero if only checking access to the descriptor. */
1036         if (av)
1037                 return inode_has_perm(tsk, inode, av, &ad);
1038
1039         return 0;
1040 }
1041
1042 /* Check whether a task can create a file. */
1043 static int may_create(struct inode *dir,
1044                       struct dentry *dentry,
1045                       u16 tclass)
1046 {
1047         struct task_security_struct *tsec;
1048         struct inode_security_struct *dsec;
1049         struct superblock_security_struct *sbsec;
1050         u32 newsid;
1051         struct avc_audit_data ad;
1052         int rc;
1053
1054         tsec = current->security;
1055         dsec = dir->i_security;
1056         sbsec = dir->i_sb->s_security;
1057
1058         AVC_AUDIT_DATA_INIT(&ad, FS);
1059         ad.u.fs.dentry = dentry;
1060
1061         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1062                           DIR__ADD_NAME | DIR__SEARCH,
1063                           &ad);
1064         if (rc)
1065                 return rc;
1066
1067         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1068                 newsid = tsec->create_sid;
1069         } else {
1070                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1071                                              &newsid);
1072                 if (rc)
1073                         return rc;
1074         }
1075
1076         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1077         if (rc)
1078                 return rc;
1079
1080         return avc_has_perm(newsid, sbsec->sid,
1081                             SECCLASS_FILESYSTEM,
1082                             FILESYSTEM__ASSOCIATE, &ad);
1083 }
1084
1085 #define MAY_LINK   0
1086 #define MAY_UNLINK 1
1087 #define MAY_RMDIR  2
1088
1089 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1090 static int may_link(struct inode *dir,
1091                     struct dentry *dentry,
1092                     int kind)
1093
1094 {
1095         struct task_security_struct *tsec;
1096         struct inode_security_struct *dsec, *isec;
1097         struct avc_audit_data ad;
1098         u32 av;
1099         int rc;
1100
1101         tsec = current->security;
1102         dsec = dir->i_security;
1103         isec = dentry->d_inode->i_security;
1104
1105         AVC_AUDIT_DATA_INIT(&ad, FS);
1106         ad.u.fs.dentry = dentry;
1107
1108         av = DIR__SEARCH;
1109         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1110         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1111         if (rc)
1112                 return rc;
1113
1114         switch (kind) {
1115         case MAY_LINK:
1116                 av = FILE__LINK;
1117                 break;
1118         case MAY_UNLINK:
1119                 av = FILE__UNLINK;
1120                 break;
1121         case MAY_RMDIR:
1122                 av = DIR__RMDIR;
1123                 break;
1124         default:
1125                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1126                 return 0;
1127         }
1128
1129         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1130         return rc;
1131 }
1132
1133 static inline int may_rename(struct inode *old_dir,
1134                              struct dentry *old_dentry,
1135                              struct inode *new_dir,
1136                              struct dentry *new_dentry)
1137 {
1138         struct task_security_struct *tsec;
1139         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1140         struct avc_audit_data ad;
1141         u32 av;
1142         int old_is_dir, new_is_dir;
1143         int rc;
1144
1145         tsec = current->security;
1146         old_dsec = old_dir->i_security;
1147         old_isec = old_dentry->d_inode->i_security;
1148         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1149         new_dsec = new_dir->i_security;
1150
1151         AVC_AUDIT_DATA_INIT(&ad, FS);
1152
1153         ad.u.fs.dentry = old_dentry;
1154         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1155                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1156         if (rc)
1157                 return rc;
1158         rc = avc_has_perm(tsec->sid, old_isec->sid,
1159                           old_isec->sclass, FILE__RENAME, &ad);
1160         if (rc)
1161                 return rc;
1162         if (old_is_dir && new_dir != old_dir) {
1163                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1164                                   old_isec->sclass, DIR__REPARENT, &ad);
1165                 if (rc)
1166                         return rc;
1167         }
1168
1169         ad.u.fs.dentry = new_dentry;
1170         av = DIR__ADD_NAME | DIR__SEARCH;
1171         if (new_dentry->d_inode)
1172                 av |= DIR__REMOVE_NAME;
1173         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1174         if (rc)
1175                 return rc;
1176         if (new_dentry->d_inode) {
1177                 new_isec = new_dentry->d_inode->i_security;
1178                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1179                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1180                                   new_isec->sclass,
1181                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1182                 if (rc)
1183                         return rc;
1184         }
1185
1186         return 0;
1187 }
1188
1189 /* Check whether a task can perform a filesystem operation. */
1190 static int superblock_has_perm(struct task_struct *tsk,
1191                                struct super_block *sb,
1192                                u32 perms,
1193                                struct avc_audit_data *ad)
1194 {
1195         struct task_security_struct *tsec;
1196         struct superblock_security_struct *sbsec;
1197
1198         tsec = tsk->security;
1199         sbsec = sb->s_security;
1200         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1201                             perms, ad);
1202 }
1203
1204 /* Convert a Linux mode and permission mask to an access vector. */
1205 static inline u32 file_mask_to_av(int mode, int mask)
1206 {
1207         u32 av = 0;
1208
1209         if ((mode & S_IFMT) != S_IFDIR) {
1210                 if (mask & MAY_EXEC)
1211                         av |= FILE__EXECUTE;
1212                 if (mask & MAY_READ)
1213                         av |= FILE__READ;
1214
1215                 if (mask & MAY_APPEND)
1216                         av |= FILE__APPEND;
1217                 else if (mask & MAY_WRITE)
1218                         av |= FILE__WRITE;
1219
1220         } else {
1221                 if (mask & MAY_EXEC)
1222                         av |= DIR__SEARCH;
1223                 if (mask & MAY_WRITE)
1224                         av |= DIR__WRITE;
1225                 if (mask & MAY_READ)
1226                         av |= DIR__READ;
1227         }
1228
1229         return av;
1230 }
1231
1232 /* Convert a Linux file to an access vector. */
1233 static inline u32 file_to_av(struct file *file)
1234 {
1235         u32 av = 0;
1236
1237         if (file->f_mode & FMODE_READ)
1238                 av |= FILE__READ;
1239         if (file->f_mode & FMODE_WRITE) {
1240                 if (file->f_flags & O_APPEND)
1241                         av |= FILE__APPEND;
1242                 else
1243                         av |= FILE__WRITE;
1244         }
1245
1246         return av;
1247 }
1248
1249 /* Set an inode's SID to a specified value. */
1250 static int inode_security_set_sid(struct inode *inode, u32 sid)
1251 {
1252         struct inode_security_struct *isec = inode->i_security;
1253         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1254
1255         if (!sbsec->initialized) {
1256                 /* Defer initialization to selinux_complete_init. */
1257                 return 0;
1258         }
1259
1260         down(&isec->sem);
1261         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1262         isec->sid = sid;
1263         isec->initialized = 1;
1264         up(&isec->sem);
1265         return 0;
1266 }
1267
1268 /* Set the security attributes on a newly created file. */
1269 static int post_create(struct inode *dir,
1270                        struct dentry *dentry)
1271 {
1272
1273         struct task_security_struct *tsec;
1274         struct inode *inode;
1275         struct inode_security_struct *dsec;
1276         struct superblock_security_struct *sbsec;
1277         u32 newsid;
1278         char *context;
1279         unsigned int len;
1280         int rc;
1281
1282         tsec = current->security;
1283         dsec = dir->i_security;
1284         sbsec = dir->i_sb->s_security;
1285
1286         inode = dentry->d_inode;
1287         if (!inode) {
1288                 /* Some file system types (e.g. NFS) may not instantiate
1289                    a dentry for all create operations (e.g. symlink),
1290                    so we have to check to see if the inode is non-NULL. */
1291                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1292                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1293                 return 0;
1294         }
1295
1296         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1297                 newsid = tsec->create_sid;
1298         } else {
1299                 rc = security_transition_sid(tsec->sid, dsec->sid,
1300                                              inode_mode_to_security_class(inode->i_mode),
1301                                              &newsid);
1302                 if (rc) {
1303                         printk(KERN_WARNING "post_create:  "
1304                                "security_transition_sid failed, rc=%d (dev=%s "
1305                                "ino=%ld)\n",
1306                                -rc, inode->i_sb->s_id, inode->i_ino);
1307                         return rc;
1308                 }
1309         }
1310
1311         rc = inode_security_set_sid(inode, newsid);
1312         if (rc) {
1313                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1314                        "failed, rc=%d (dev=%s ino=%ld)\n",
1315                        -rc, inode->i_sb->s_id, inode->i_ino);
1316                 return rc;
1317         }
1318
1319         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1320             inode->i_op->setxattr) {
1321                 /* Use extended attributes. */
1322                 rc = security_sid_to_context(newsid, &context, &len);
1323                 if (rc) {
1324                         printk(KERN_WARNING "post_create:  sid_to_context "
1325                                "failed, rc=%d (dev=%s ino=%ld)\n",
1326                                -rc, inode->i_sb->s_id, inode->i_ino);
1327                         return rc;
1328                 }
1329                 down(&inode->i_sem);
1330                 rc = inode->i_op->setxattr(dentry,
1331                                            XATTR_NAME_SELINUX,
1332                                            context, len, 0);
1333                 up(&inode->i_sem);
1334                 kfree(context);
1335                 if (rc < 0) {
1336                         printk(KERN_WARNING "post_create:  setxattr failed, "
1337                                "rc=%d (dev=%s ino=%ld)\n",
1338                                -rc, inode->i_sb->s_id, inode->i_ino);
1339                         return rc;
1340                 }
1341         }
1342
1343         return 0;
1344 }
1345
1346
1347 /* Hook functions begin here. */
1348
1349 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1350 {
1351         struct task_security_struct *psec = parent->security;
1352         struct task_security_struct *csec = child->security;
1353         int rc;
1354
1355         rc = secondary_ops->ptrace(parent,child);
1356         if (rc)
1357                 return rc;
1358
1359         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1360         /* Save the SID of the tracing process for later use in apply_creds. */
1361         if (!rc)
1362                 csec->ptrace_sid = psec->sid;
1363         return rc;
1364 }
1365
1366 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1367                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1368 {
1369         int error;
1370
1371         error = task_has_perm(current, target, PROCESS__GETCAP);
1372         if (error)
1373                 return error;
1374
1375         return secondary_ops->capget(target, effective, inheritable, permitted);
1376 }
1377
1378 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1379                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1380 {
1381         int error;
1382
1383         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1384         if (error)
1385                 return error;
1386
1387         return task_has_perm(current, target, PROCESS__SETCAP);
1388 }
1389
1390 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1391                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1392 {
1393         secondary_ops->capset_set(target, effective, inheritable, permitted);
1394 }
1395
1396 static int selinux_capable(struct task_struct *tsk, int cap)
1397 {
1398         int rc;
1399
1400         rc = secondary_ops->capable(tsk, cap);
1401         if (rc)
1402                 return rc;
1403
1404         return task_has_capability(tsk,cap);
1405 }
1406
1407 static int selinux_sysctl(ctl_table *table, int op)
1408 {
1409         int error = 0;
1410         u32 av;
1411         struct task_security_struct *tsec;
1412         u32 tsid;
1413         int rc;
1414
1415         rc = secondary_ops->sysctl(table, op);
1416         if (rc)
1417                 return rc;
1418
1419         tsec = current->security;
1420
1421         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1422                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1423         if (rc) {
1424                 /* Default to the well-defined sysctl SID. */
1425                 tsid = SECINITSID_SYSCTL;
1426         }
1427
1428         /* The op values are "defined" in sysctl.c, thereby creating
1429          * a bad coupling between this module and sysctl.c */
1430         if(op == 001) {
1431                 error = avc_has_perm(tsec->sid, tsid,
1432                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1433         } else {
1434                 av = 0;
1435                 if (op & 004)
1436                         av |= FILE__READ;
1437                 if (op & 002)
1438                         av |= FILE__WRITE;
1439                 if (av)
1440                         error = avc_has_perm(tsec->sid, tsid,
1441                                              SECCLASS_FILE, av, NULL);
1442         }
1443
1444         return error;
1445 }
1446
1447 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1448 {
1449         int rc = 0;
1450
1451         if (!sb)
1452                 return 0;
1453
1454         switch (cmds) {
1455                 case Q_SYNC:
1456                 case Q_QUOTAON:
1457                 case Q_QUOTAOFF:
1458                 case Q_SETINFO:
1459                 case Q_SETQUOTA:
1460                         rc = superblock_has_perm(current,
1461                                                  sb,
1462                                                  FILESYSTEM__QUOTAMOD, NULL);
1463                         break;
1464                 case Q_GETFMT:
1465                 case Q_GETINFO:
1466                 case Q_GETQUOTA:
1467                         rc = superblock_has_perm(current,
1468                                                  sb,
1469                                                  FILESYSTEM__QUOTAGET, NULL);
1470                         break;
1471                 default:
1472                         rc = 0;  /* let the kernel handle invalid cmds */
1473                         break;
1474         }
1475         return rc;
1476 }
1477
1478 static int selinux_quota_on(struct dentry *dentry)
1479 {
1480         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1481 }
1482
1483 static int selinux_syslog(int type)
1484 {
1485         int rc;
1486
1487         rc = secondary_ops->syslog(type);
1488         if (rc)
1489                 return rc;
1490
1491         switch (type) {
1492                 case 3:         /* Read last kernel messages */
1493                 case 10:        /* Return size of the log buffer */
1494                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1495                         break;
1496                 case 6:         /* Disable logging to console */
1497                 case 7:         /* Enable logging to console */
1498                 case 8:         /* Set level of messages printed to console */
1499                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1500                         break;
1501                 case 0:         /* Close log */
1502                 case 1:         /* Open log */
1503                 case 2:         /* Read from log */
1504                 case 4:         /* Read/clear last kernel messages */
1505                 case 5:         /* Clear ring buffer */
1506                 default:
1507                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1508                         break;
1509         }
1510         return rc;
1511 }
1512
1513 /*
1514  * Check that a process has enough memory to allocate a new virtual
1515  * mapping. 0 means there is enough memory for the allocation to
1516  * succeed and -ENOMEM implies there is not.
1517  *
1518  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1519  * if the capability is granted, but __vm_enough_memory requires 1 if
1520  * the capability is granted.
1521  *
1522  * Do not audit the selinux permission check, as this is applied to all
1523  * processes that allocate mappings.
1524  */
1525 static int selinux_vm_enough_memory(long pages)
1526 {
1527         int rc, cap_sys_admin = 0;
1528         struct task_security_struct *tsec = current->security;
1529
1530         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1531         if (rc == 0)
1532                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1533                                         SECCLASS_CAPABILITY,
1534                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1535                                         NULL);
1536
1537         if (rc == 0)
1538                 cap_sys_admin = 1;
1539
1540         return __vm_enough_memory(pages, cap_sys_admin);
1541 }
1542
1543 /* binprm security operations */
1544
1545 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1546 {
1547         struct bprm_security_struct *bsec;
1548
1549         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1550         if (!bsec)
1551                 return -ENOMEM;
1552
1553         memset(bsec, 0, sizeof *bsec);
1554         bsec->magic = SELINUX_MAGIC;
1555         bsec->bprm = bprm;
1556         bsec->sid = SECINITSID_UNLABELED;
1557         bsec->set = 0;
1558
1559         bprm->security = bsec;
1560         return 0;
1561 }
1562
1563 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1564 {
1565         struct task_security_struct *tsec;
1566         struct inode *inode = bprm->file->f_dentry->d_inode;
1567         struct inode_security_struct *isec;
1568         struct bprm_security_struct *bsec;
1569         u32 newsid;
1570         struct avc_audit_data ad;
1571         int rc;
1572
1573         rc = secondary_ops->bprm_set_security(bprm);
1574         if (rc)
1575                 return rc;
1576
1577         bsec = bprm->security;
1578
1579         if (bsec->set)
1580                 return 0;
1581
1582         tsec = current->security;
1583         isec = inode->i_security;
1584
1585         /* Default to the current task SID. */
1586         bsec->sid = tsec->sid;
1587
1588         /* Reset create SID on execve. */
1589         tsec->create_sid = 0;
1590
1591         if (tsec->exec_sid) {
1592                 newsid = tsec->exec_sid;
1593                 /* Reset exec SID on execve. */
1594                 tsec->exec_sid = 0;
1595         } else {
1596                 /* Check for a default transition on this program. */
1597                 rc = security_transition_sid(tsec->sid, isec->sid,
1598                                              SECCLASS_PROCESS, &newsid);
1599                 if (rc)
1600                         return rc;
1601         }
1602
1603         AVC_AUDIT_DATA_INIT(&ad, FS);
1604         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1605         ad.u.fs.dentry = bprm->file->f_dentry;
1606
1607         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1608                 newsid = tsec->sid;
1609
1610         if (tsec->sid == newsid) {
1611                 rc = avc_has_perm(tsec->sid, isec->sid,
1612                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1613                 if (rc)
1614                         return rc;
1615         } else {
1616                 /* Check permissions for the transition. */
1617                 rc = avc_has_perm(tsec->sid, newsid,
1618                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1619                 if (rc)
1620                         return rc;
1621
1622                 rc = avc_has_perm(newsid, isec->sid,
1623                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1624                 if (rc)
1625                         return rc;
1626
1627                 /* Clear any possibly unsafe personality bits on exec: */
1628                 current->personality &= ~PER_CLEAR_ON_SETID;
1629
1630                 /* Set the security field to the new SID. */
1631                 bsec->sid = newsid;
1632         }
1633
1634         bsec->set = 1;
1635         return 0;
1636 }
1637
1638 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1639 {
1640         return secondary_ops->bprm_check_security(bprm);
1641 }
1642
1643
1644 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1645 {
1646         struct task_security_struct *tsec = current->security;
1647         int atsecure = 0;
1648
1649         if (tsec->osid != tsec->sid) {
1650                 /* Enable secure mode for SIDs transitions unless
1651                    the noatsecure permission is granted between
1652                    the two SIDs, i.e. ahp returns 0. */
1653                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1654                                          SECCLASS_PROCESS,
1655                                          PROCESS__NOATSECURE, NULL);
1656         }
1657
1658         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1659 }
1660
1661 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1662 {
1663         kfree(bprm->security);
1664         bprm->security = NULL;
1665 }
1666
1667 extern struct vfsmount *selinuxfs_mount;
1668 extern struct dentry *selinux_null;
1669
1670 /* Derived from fs/exec.c:flush_old_files. */
1671 static inline void flush_unauthorized_files(struct files_struct * files)
1672 {
1673         struct avc_audit_data ad;
1674         struct file *file, *devnull = NULL;
1675         struct tty_struct *tty = current->signal->tty;
1676         long j = -1;
1677
1678         if (tty) {
1679                 file_list_lock();
1680                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1681                 if (file) {
1682                         /* Revalidate access to controlling tty.
1683                            Use inode_has_perm on the tty inode directly rather
1684                            than using file_has_perm, as this particular open
1685                            file may belong to another process and we are only
1686                            interested in the inode-based check here. */
1687                         struct inode *inode = file->f_dentry->d_inode;
1688                         if (inode_has_perm(current, inode,
1689                                            FILE__READ | FILE__WRITE, NULL)) {
1690                                 /* Reset controlling tty. */
1691                                 current->signal->tty = NULL;
1692                                 current->signal->tty_old_pgrp = 0;
1693                         }
1694                 }
1695                 file_list_unlock();
1696         }
1697
1698         /* Revalidate access to inherited open files. */
1699
1700         AVC_AUDIT_DATA_INIT(&ad,FS);
1701
1702         spin_lock(&files->file_lock);
1703         for (;;) {
1704                 unsigned long set, i;
1705                 int fd;
1706
1707                 j++;
1708                 i = j * __NFDBITS;
1709                 if (i >= files->max_fds || i >= files->max_fdset)
1710                         break;
1711                 set = files->open_fds->fds_bits[j];
1712                 if (!set)
1713                         continue;
1714                 spin_unlock(&files->file_lock);
1715                 for ( ; set ; i++,set >>= 1) {
1716                         if (set & 1) {
1717                                 file = fget(i);
1718                                 if (!file)
1719                                         continue;
1720                                 if (file_has_perm(current,
1721                                                   file,
1722                                                   file_to_av(file))) {
1723                                         sys_close(i);
1724                                         fd = get_unused_fd();
1725                                         if (fd != i) {
1726                                                 if (fd >= 0)
1727                                                         put_unused_fd(fd);
1728                                                 fput(file);
1729                                                 continue;
1730                                         }
1731                                         if (devnull) {
1732                                                 atomic_inc(&devnull->f_count);
1733                                         } else {
1734                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1735                                                 if (!devnull) {
1736                                                         put_unused_fd(fd);
1737                                                         fput(file);
1738                                                         continue;
1739                                                 }
1740                                         }
1741                                         fd_install(fd, devnull);
1742                                 }
1743                                 fput(file);
1744                         }
1745                 }
1746                 spin_lock(&files->file_lock);
1747
1748         }
1749         spin_unlock(&files->file_lock);
1750 }
1751
1752 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1753 {
1754         struct task_security_struct *tsec;
1755         struct bprm_security_struct *bsec;
1756         u32 sid;
1757         int rc;
1758
1759         secondary_ops->bprm_apply_creds(bprm, unsafe);
1760
1761         tsec = current->security;
1762
1763         bsec = bprm->security;
1764         sid = bsec->sid;
1765
1766         tsec->osid = tsec->sid;
1767         bsec->unsafe = 0;
1768         if (tsec->sid != sid) {
1769                 /* Check for shared state.  If not ok, leave SID
1770                    unchanged and kill. */
1771                 if (unsafe & LSM_UNSAFE_SHARE) {
1772                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1773                                         PROCESS__SHARE, NULL);
1774                         if (rc) {
1775                                 bsec->unsafe = 1;
1776                                 return;
1777                         }
1778                 }
1779
1780                 /* Check for ptracing, and update the task SID if ok.
1781                    Otherwise, leave SID unchanged and kill. */
1782                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1783                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1784                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1785                                           NULL);
1786                         if (rc) {
1787                                 bsec->unsafe = 1;
1788                                 return;
1789                         }
1790                 }
1791                 tsec->sid = sid;
1792         }
1793 }
1794
1795 /*
1796  * called after apply_creds without the task lock held
1797  */
1798 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1799 {
1800         struct task_security_struct *tsec;
1801         struct rlimit *rlim, *initrlim;
1802         struct itimerval itimer;
1803         struct bprm_security_struct *bsec;
1804         int rc, i;
1805
1806         tsec = current->security;
1807         bsec = bprm->security;
1808
1809         if (bsec->unsafe) {
1810                 force_sig_specific(SIGKILL, current);
1811                 return;
1812         }
1813         if (tsec->osid == tsec->sid)
1814                 return;
1815
1816         /* Close files for which the new task SID is not authorized. */
1817         flush_unauthorized_files(current->files);
1818
1819         /* Check whether the new SID can inherit signal state
1820            from the old SID.  If not, clear itimers to avoid
1821            subsequent signal generation and flush and unblock
1822            signals. This must occur _after_ the task SID has
1823           been updated so that any kill done after the flush
1824           will be checked against the new SID. */
1825         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1826                           PROCESS__SIGINH, NULL);
1827         if (rc) {
1828                 memset(&itimer, 0, sizeof itimer);
1829                 for (i = 0; i < 3; i++)
1830                         do_setitimer(i, &itimer, NULL);
1831                 flush_signals(current);
1832                 spin_lock_irq(&current->sighand->siglock);
1833                 flush_signal_handlers(current, 1);
1834                 sigemptyset(&current->blocked);
1835                 recalc_sigpending();
1836                 spin_unlock_irq(&current->sighand->siglock);
1837         }
1838
1839         /* Check whether the new SID can inherit resource limits
1840            from the old SID.  If not, reset all soft limits to
1841            the lower of the current task's hard limit and the init
1842            task's soft limit.  Note that the setting of hard limits
1843            (even to lower them) can be controlled by the setrlimit
1844            check. The inclusion of the init task's soft limit into
1845            the computation is to avoid resetting soft limits higher
1846            than the default soft limit for cases where the default
1847            is lower than the hard limit, e.g. RLIMIT_CORE or
1848            RLIMIT_STACK.*/
1849         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1850                           PROCESS__RLIMITINH, NULL);
1851         if (rc) {
1852                 for (i = 0; i < RLIM_NLIMITS; i++) {
1853                         rlim = current->signal->rlim + i;
1854                         initrlim = init_task.signal->rlim+i;
1855                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1856                 }
1857                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1858                         /*
1859                          * This will cause RLIMIT_CPU calculations
1860                          * to be refigured.
1861                          */
1862                         current->it_prof_expires = jiffies_to_cputime(1);
1863                 }
1864         }
1865
1866         /* Wake up the parent if it is waiting so that it can
1867            recheck wait permission to the new task SID. */
1868         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1869 }
1870
1871 /* superblock security operations */
1872
1873 static int selinux_sb_alloc_security(struct super_block *sb)
1874 {
1875         return superblock_alloc_security(sb);
1876 }
1877
1878 static void selinux_sb_free_security(struct super_block *sb)
1879 {
1880         superblock_free_security(sb);
1881 }
1882
1883 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1884 {
1885         if (plen > olen)
1886                 return 0;
1887
1888         return !memcmp(prefix, option, plen);
1889 }
1890
1891 static inline int selinux_option(char *option, int len)
1892 {
1893         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1894                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1895                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1896 }
1897
1898 static inline void take_option(char **to, char *from, int *first, int len)
1899 {
1900         if (!*first) {
1901                 **to = ',';
1902                 *to += 1;
1903         }
1904         else
1905                 *first = 0;
1906         memcpy(*to, from, len);
1907         *to += len;
1908 }
1909
1910 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1911 {
1912         int fnosec, fsec, rc = 0;
1913         char *in_save, *in_curr, *in_end;
1914         char *sec_curr, *nosec_save, *nosec;
1915
1916         in_curr = orig;
1917         sec_curr = copy;
1918
1919         /* Binary mount data: just copy */
1920         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1921                 copy_page(sec_curr, in_curr);
1922                 goto out;
1923         }
1924
1925         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1926         if (!nosec) {
1927                 rc = -ENOMEM;
1928                 goto out;
1929         }
1930
1931         nosec_save = nosec;
1932         fnosec = fsec = 1;
1933         in_save = in_end = orig;
1934
1935         do {
1936                 if (*in_end == ',' || *in_end == '\0') {
1937                         int len = in_end - in_curr;
1938
1939                         if (selinux_option(in_curr, len))
1940                                 take_option(&sec_curr, in_curr, &fsec, len);
1941                         else
1942                                 take_option(&nosec, in_curr, &fnosec, len);
1943
1944                         in_curr = in_end + 1;
1945                 }
1946         } while (*in_end++);
1947
1948         strcpy(in_save, nosec_save);
1949         free_page((unsigned long)nosec_save);
1950 out:
1951         return rc;
1952 }
1953
1954 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1955 {
1956         struct avc_audit_data ad;
1957         int rc;
1958
1959         rc = superblock_doinit(sb, data);
1960         if (rc)
1961                 return rc;
1962
1963         AVC_AUDIT_DATA_INIT(&ad,FS);
1964         ad.u.fs.dentry = sb->s_root;
1965         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1966 }
1967
1968 static int selinux_sb_statfs(struct super_block *sb)
1969 {
1970         struct avc_audit_data ad;
1971
1972         AVC_AUDIT_DATA_INIT(&ad,FS);
1973         ad.u.fs.dentry = sb->s_root;
1974         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1975 }
1976
1977 static int selinux_mount(char * dev_name,
1978                          struct nameidata *nd,
1979                          char * type,
1980                          unsigned long flags,
1981                          void * data)
1982 {
1983         int rc;
1984
1985         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1986         if (rc)
1987                 return rc;
1988
1989         if (flags & MS_REMOUNT)
1990                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1991                                            FILESYSTEM__REMOUNT, NULL);
1992         else
1993                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1994                                        FILE__MOUNTON);
1995 }
1996
1997 static int selinux_umount(struct vfsmount *mnt, int flags)
1998 {
1999         int rc;
2000
2001         rc = secondary_ops->sb_umount(mnt, flags);
2002         if (rc)
2003                 return rc;
2004
2005         return superblock_has_perm(current,mnt->mnt_sb,
2006                                    FILESYSTEM__UNMOUNT,NULL);
2007 }
2008
2009 /* inode security operations */
2010
2011 static int selinux_inode_alloc_security(struct inode *inode)
2012 {
2013         return inode_alloc_security(inode);
2014 }
2015
2016 static void selinux_inode_free_security(struct inode *inode)
2017 {
2018         inode_free_security(inode);
2019 }
2020
2021 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2022 {
2023         return may_create(dir, dentry, SECCLASS_FILE);
2024 }
2025
2026 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2027 {
2028         post_create(dir, dentry);
2029 }
2030
2031 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2032 {
2033         int rc;
2034
2035         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2036         if (rc)
2037                 return rc;
2038         return may_link(dir, old_dentry, MAY_LINK);
2039 }
2040
2041 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2042 {
2043         return;
2044 }
2045
2046 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2047 {
2048         int rc;
2049
2050         rc = secondary_ops->inode_unlink(dir, dentry);
2051         if (rc)
2052                 return rc;
2053         return may_link(dir, dentry, MAY_UNLINK);
2054 }
2055
2056 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2057 {
2058         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2059 }
2060
2061 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2062 {
2063         post_create(dir, dentry);
2064 }
2065
2066 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2067 {
2068         return may_create(dir, dentry, SECCLASS_DIR);
2069 }
2070
2071 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2072 {
2073         post_create(dir, dentry);
2074 }
2075
2076 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2077 {
2078         return may_link(dir, dentry, MAY_RMDIR);
2079 }
2080
2081 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2082 {
2083         int rc;
2084
2085         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2086         if (rc)
2087                 return rc;
2088
2089         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2090 }
2091
2092 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2093 {
2094         post_create(dir, dentry);
2095 }
2096
2097 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2098                                 struct inode *new_inode, struct dentry *new_dentry)
2099 {
2100         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2101 }
2102
2103 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2104                                       struct inode *new_inode, struct dentry *new_dentry)
2105 {
2106         return;
2107 }
2108
2109 static int selinux_inode_readlink(struct dentry *dentry)
2110 {
2111         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2112 }
2113
2114 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2115 {
2116         int rc;
2117
2118         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2119         if (rc)
2120                 return rc;
2121         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2122 }
2123
2124 static int selinux_inode_permission(struct inode *inode, int mask,
2125                                     struct nameidata *nd)
2126 {
2127         int rc;
2128
2129         rc = secondary_ops->inode_permission(inode, mask, nd);
2130         if (rc)
2131                 return rc;
2132
2133         if (!mask) {
2134                 /* No permission to check.  Existence test. */
2135                 return 0;
2136         }
2137
2138         return inode_has_perm(current, inode,
2139                                file_mask_to_av(inode->i_mode, mask), NULL);
2140 }
2141
2142 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2143 {
2144         int rc;
2145
2146         rc = secondary_ops->inode_setattr(dentry, iattr);
2147         if (rc)
2148                 return rc;
2149
2150         if (iattr->ia_valid & ATTR_FORCE)
2151                 return 0;
2152
2153         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2154                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2155                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2156
2157         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2158 }
2159
2160 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2161 {
2162         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2163 }
2164
2165 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2166 {
2167         struct task_security_struct *tsec = current->security;
2168         struct inode *inode = dentry->d_inode;
2169         struct inode_security_struct *isec = inode->i_security;
2170         struct superblock_security_struct *sbsec;
2171         struct avc_audit_data ad;
2172         u32 newsid;
2173         int rc = 0;
2174
2175         if (strcmp(name, XATTR_NAME_SELINUX)) {
2176                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2177                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2178                     !capable(CAP_SYS_ADMIN)) {
2179                         /* A different attribute in the security namespace.
2180                            Restrict to administrator. */
2181                         return -EPERM;
2182                 }
2183
2184                 /* Not an attribute we recognize, so just check the
2185                    ordinary setattr permission. */
2186                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2187         }
2188
2189         sbsec = inode->i_sb->s_security;
2190         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2191                 return -EOPNOTSUPP;
2192
2193         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2194                 return -EPERM;
2195
2196         AVC_AUDIT_DATA_INIT(&ad,FS);
2197         ad.u.fs.dentry = dentry;
2198
2199         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2200                           FILE__RELABELFROM, &ad);
2201         if (rc)
2202                 return rc;
2203
2204         rc = security_context_to_sid(value, size, &newsid);
2205         if (rc)
2206                 return rc;
2207
2208         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2209                           FILE__RELABELTO, &ad);
2210         if (rc)
2211                 return rc;
2212
2213         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2214                                           isec->sclass);
2215         if (rc)
2216                 return rc;
2217
2218         return avc_has_perm(newsid,
2219                             sbsec->sid,
2220                             SECCLASS_FILESYSTEM,
2221                             FILESYSTEM__ASSOCIATE,
2222                             &ad);
2223 }
2224
2225 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2226                                         void *value, size_t size, int flags)
2227 {
2228         struct inode *inode = dentry->d_inode;
2229         struct inode_security_struct *isec = inode->i_security;
2230         u32 newsid;
2231         int rc;
2232
2233         if (strcmp(name, XATTR_NAME_SELINUX)) {
2234                 /* Not an attribute we recognize, so nothing to do. */
2235                 return;
2236         }
2237
2238         rc = security_context_to_sid(value, size, &newsid);
2239         if (rc) {
2240                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2241                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2242                 return;
2243         }
2244
2245         isec->sid = newsid;
2246         return;
2247 }
2248
2249 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2250 {
2251         struct inode *inode = dentry->d_inode;
2252         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2253
2254         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2255                 return -EOPNOTSUPP;
2256
2257         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2258 }
2259
2260 static int selinux_inode_listxattr (struct dentry *dentry)
2261 {
2262         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2263 }
2264
2265 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2266 {
2267         if (strcmp(name, XATTR_NAME_SELINUX)) {
2268                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2269                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2270                     !capable(CAP_SYS_ADMIN)) {
2271                         /* A different attribute in the security namespace.
2272                            Restrict to administrator. */
2273                         return -EPERM;
2274                 }
2275
2276                 /* Not an attribute we recognize, so just check the
2277                    ordinary setattr permission. Might want a separate
2278                    permission for removexattr. */
2279                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2280         }
2281
2282         /* No one is allowed to remove a SELinux security label.
2283            You can change the label, but all data must be labeled. */
2284         return -EACCES;
2285 }
2286
2287 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2288 {
2289         struct inode_security_struct *isec = inode->i_security;
2290         char *context;
2291         unsigned len;
2292         int rc;
2293
2294         /* Permission check handled by selinux_inode_getxattr hook.*/
2295
2296         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2297                 return -EOPNOTSUPP;
2298
2299         rc = security_sid_to_context(isec->sid, &context, &len);
2300         if (rc)
2301                 return rc;
2302
2303         if (!buffer || !size) {
2304                 kfree(context);
2305                 return len;
2306         }
2307         if (size < len) {
2308                 kfree(context);
2309                 return -ERANGE;
2310         }
2311         memcpy(buffer, context, len);
2312         kfree(context);
2313         return len;
2314 }
2315
2316 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2317                                      const void *value, size_t size, int flags)
2318 {
2319         struct inode_security_struct *isec = inode->i_security;
2320         u32 newsid;
2321         int rc;
2322
2323         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2324                 return -EOPNOTSUPP;
2325
2326         if (!value || !size)
2327                 return -EACCES;
2328
2329         rc = security_context_to_sid((void*)value, size, &newsid);
2330         if (rc)
2331                 return rc;
2332
2333         isec->sid = newsid;
2334         return 0;
2335 }
2336
2337 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2338 {
2339         const int len = sizeof(XATTR_NAME_SELINUX);
2340         if (buffer && len <= buffer_size)
2341                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2342         return len;
2343 }
2344
2345 /* file security operations */
2346
2347 static int selinux_file_permission(struct file *file, int mask)
2348 {
2349         struct inode *inode = file->f_dentry->d_inode;
2350
2351         if (!mask) {
2352                 /* No permission to check.  Existence test. */
2353                 return 0;
2354         }
2355
2356         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2357         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2358                 mask |= MAY_APPEND;
2359
2360         return file_has_perm(current, file,
2361                              file_mask_to_av(inode->i_mode, mask));
2362 }
2363
2364 static int selinux_file_alloc_security(struct file *file)
2365 {
2366         return file_alloc_security(file);
2367 }
2368
2369 static void selinux_file_free_security(struct file *file)
2370 {
2371         file_free_security(file);
2372 }
2373
2374 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2375                               unsigned long arg)
2376 {
2377         int error = 0;
2378
2379         switch (cmd) {
2380                 case FIONREAD:
2381                 /* fall through */
2382                 case FIBMAP:
2383                 /* fall through */
2384                 case FIGETBSZ:
2385                 /* fall through */
2386                 case EXT2_IOC_GETFLAGS:
2387                 /* fall through */
2388                 case EXT2_IOC_GETVERSION:
2389                         error = file_has_perm(current, file, FILE__GETATTR);
2390                         break;
2391
2392                 case EXT2_IOC_SETFLAGS:
2393                 /* fall through */
2394                 case EXT2_IOC_SETVERSION:
2395                         error = file_has_perm(current, file, FILE__SETATTR);
2396                         break;
2397
2398                 /* sys_ioctl() checks */
2399                 case FIONBIO:
2400                 /* fall through */
2401                 case FIOASYNC:
2402                         error = file_has_perm(current, file, 0);
2403                         break;
2404
2405                 case KDSKBENT:
2406                 case KDSKBSENT:
2407                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2408                         break;
2409
2410                 /* default case assumes that the command will go
2411                  * to the file's ioctl() function.
2412                  */
2413                 default:
2414                         error = file_has_perm(current, file, FILE__IOCTL);
2415
2416         }
2417         return error;
2418 }
2419
2420 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2421 {
2422 #ifndef CONFIG_PPC32
2423         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2424                 /*
2425                  * We are making executable an anonymous mapping or a
2426                  * private file mapping that will also be writable.
2427                  * This has an additional check.
2428                  */
2429                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2430                 if (rc)
2431                         return rc;
2432         }
2433 #endif
2434
2435         if (file) {
2436                 /* read access is always possible with a mapping */
2437                 u32 av = FILE__READ;
2438
2439                 /* write access only matters if the mapping is shared */
2440                 if (shared && (prot & PROT_WRITE))
2441                         av |= FILE__WRITE;
2442
2443                 if (prot & PROT_EXEC)
2444                         av |= FILE__EXECUTE;
2445
2446                 return file_has_perm(current, file, av);
2447         }
2448         return 0;
2449 }
2450
2451 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2452                              unsigned long prot, unsigned long flags)
2453 {
2454         int rc;
2455
2456         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2457         if (rc)
2458                 return rc;
2459
2460         if (selinux_checkreqprot)
2461                 prot = reqprot;
2462
2463         return file_map_prot_check(file, prot,
2464                                    (flags & MAP_TYPE) == MAP_SHARED);
2465 }
2466
2467 static int selinux_file_mprotect(struct vm_area_struct *vma,
2468                                  unsigned long reqprot,
2469                                  unsigned long prot)
2470 {
2471         int rc;
2472
2473         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2474         if (rc)
2475                 return rc;
2476
2477         if (selinux_checkreqprot)
2478                 prot = reqprot;
2479
2480 #ifndef CONFIG_PPC32
2481         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2482            (vma->vm_start >= vma->vm_mm->start_brk &&
2483             vma->vm_end <= vma->vm_mm->brk)) {
2484                 /*
2485                  * We are making an executable mapping in the brk region.
2486                  * This has an additional execheap check.
2487                  */
2488                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2489                 if (rc)
2490                         return rc;
2491         }
2492         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2493                 /*
2494                  * We are making executable a file mapping that has
2495                  * had some COW done. Since pages might have been written,
2496                  * check ability to execute the possibly modified content.
2497                  * This typically should only occur for text relocations.
2498                  */
2499                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2500                 if (rc)
2501                         return rc;
2502         }
2503         if (!vma->vm_file && (prot & PROT_EXEC) &&
2504                 vma->vm_start <= vma->vm_mm->start_stack &&
2505                 vma->vm_end >= vma->vm_mm->start_stack) {
2506                 /* Attempt to make the process stack executable.
2507                  * This has an additional execstack check.
2508                  */
2509                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2510                 if (rc)
2511                         return rc;
2512         }
2513 #endif
2514
2515         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2516 }
2517
2518 static int selinux_file_lock(struct file *file, unsigned int cmd)
2519 {
2520         return file_has_perm(current, file, FILE__LOCK);
2521 }
2522
2523 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2524                               unsigned long arg)
2525 {
2526         int err = 0;
2527
2528         switch (cmd) {
2529                 case F_SETFL:
2530                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2531                                 err = -EINVAL;
2532                                 break;
2533                         }
2534
2535                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2536                                 err = file_has_perm(current, file,FILE__WRITE);
2537                                 break;
2538                         }
2539                         /* fall through */
2540                 case F_SETOWN:
2541                 case F_SETSIG:
2542                 case F_GETFL:
2543                 case F_GETOWN:
2544                 case F_GETSIG:
2545                         /* Just check FD__USE permission */
2546                         err = file_has_perm(current, file, 0);
2547                         break;
2548                 case F_GETLK:
2549                 case F_SETLK:
2550                 case F_SETLKW:
2551 #if BITS_PER_LONG == 32
2552                 case F_GETLK64:
2553                 case F_SETLK64:
2554                 case F_SETLKW64:
2555 #endif
2556                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2557                                 err = -EINVAL;
2558                                 break;
2559                         }
2560                         err = file_has_perm(current, file, FILE__LOCK);
2561                         break;
2562         }
2563
2564         return err;
2565 }
2566
2567 static int selinux_file_set_fowner(struct file *file)
2568 {
2569         struct task_security_struct *tsec;
2570         struct file_security_struct *fsec;
2571
2572         tsec = current->security;
2573         fsec = file->f_security;
2574         fsec->fown_sid = tsec->sid;
2575
2576         return 0;
2577 }
2578
2579 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2580                                        struct fown_struct *fown, int signum)
2581 {
2582         struct file *file;
2583         u32 perm;
2584         struct task_security_struct *tsec;
2585         struct file_security_struct *fsec;
2586
2587         /* struct fown_struct is never outside the context of a struct file */
2588         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2589
2590         tsec = tsk->security;
2591         fsec = file->f_security;
2592
2593         if (!signum)
2594                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2595         else
2596                 perm = signal_to_av(signum);
2597
2598         return avc_has_perm(fsec->fown_sid, tsec->sid,
2599                             SECCLASS_PROCESS, perm, NULL);
2600 }
2601
2602 static int selinux_file_receive(struct file *file)
2603 {
2604         return file_has_perm(current, file, file_to_av(file));
2605 }
2606
2607 /* task security operations */
2608
2609 static int selinux_task_create(unsigned long clone_flags)
2610 {
2611         int rc;
2612
2613         rc = secondary_ops->task_create(clone_flags);
2614         if (rc)
2615                 return rc;
2616
2617         return task_has_perm(current, current, PROCESS__FORK);
2618 }
2619
2620 static int selinux_task_alloc_security(struct task_struct *tsk)
2621 {
2622         struct task_security_struct *tsec1, *tsec2;
2623         int rc;
2624
2625         tsec1 = current->security;
2626
2627         rc = task_alloc_security(tsk);
2628         if (rc)
2629                 return rc;
2630         tsec2 = tsk->security;
2631
2632         tsec2->osid = tsec1->osid;
2633         tsec2->sid = tsec1->sid;
2634
2635         /* Retain the exec and create SIDs across fork */
2636         tsec2->exec_sid = tsec1->exec_sid;
2637         tsec2->create_sid = tsec1->create_sid;
2638
2639         /* Retain ptracer SID across fork, if any.
2640            This will be reset by the ptrace hook upon any
2641            subsequent ptrace_attach operations. */
2642         tsec2->ptrace_sid = tsec1->ptrace_sid;
2643
2644         return 0;
2645 }
2646
2647 static void selinux_task_free_security(struct task_struct *tsk)
2648 {
2649         task_free_security(tsk);
2650 }
2651
2652 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2653 {
2654         /* Since setuid only affects the current process, and
2655            since the SELinux controls are not based on the Linux
2656            identity attributes, SELinux does not need to control
2657            this operation.  However, SELinux does control the use
2658            of the CAP_SETUID and CAP_SETGID capabilities using the
2659            capable hook. */
2660         return 0;
2661 }
2662
2663 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2664 {
2665         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2666 }
2667
2668 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2669 {
2670         /* See the comment for setuid above. */
2671         return 0;
2672 }
2673
2674 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2675 {
2676         return task_has_perm(current, p, PROCESS__SETPGID);
2677 }
2678
2679 static int selinux_task_getpgid(struct task_struct *p)
2680 {
2681         return task_has_perm(current, p, PROCESS__GETPGID);
2682 }
2683
2684 static int selinux_task_getsid(struct task_struct *p)
2685 {
2686         return task_has_perm(current, p, PROCESS__GETSESSION);
2687 }
2688
2689 static int selinux_task_setgroups(struct group_info *group_info)
2690 {
2691         /* See the comment for setuid above. */
2692         return 0;
2693 }
2694
2695 static int selinux_task_setnice(struct task_struct *p, int nice)
2696 {
2697         int rc;
2698
2699         rc = secondary_ops->task_setnice(p, nice);
2700         if (rc)
2701                 return rc;
2702
2703         return task_has_perm(current,p, PROCESS__SETSCHED);
2704 }
2705
2706 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2707 {
2708         struct rlimit *old_rlim = current->signal->rlim + resource;
2709         int rc;
2710
2711         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2712         if (rc)
2713                 return rc;
2714
2715         /* Control the ability to change the hard limit (whether
2716            lowering or raising it), so that the hard limit can
2717            later be used as a safe reset point for the soft limit
2718            upon context transitions. See selinux_bprm_apply_creds. */
2719         if (old_rlim->rlim_max != new_rlim->rlim_max)
2720                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2721
2722         return 0;
2723 }
2724
2725 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2726 {
2727         return task_has_perm(current, p, PROCESS__SETSCHED);
2728 }
2729
2730 static int selinux_task_getscheduler(struct task_struct *p)
2731 {
2732         return task_has_perm(current, p, PROCESS__GETSCHED);
2733 }
2734
2735 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2736 {
2737         u32 perm;
2738         int rc;
2739
2740         rc = secondary_ops->task_kill(p, info, sig);
2741         if (rc)
2742                 return rc;
2743
2744         if (info && ((unsigned long)info == 1 ||
2745                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2746                 return 0;
2747
2748         if (!sig)
2749                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2750         else
2751                 perm = signal_to_av(sig);
2752
2753         return task_has_perm(current, p, perm);
2754 }
2755
2756 static int selinux_task_prctl(int option,
2757                               unsigned long arg2,
2758                               unsigned long arg3,
2759                               unsigned long arg4,
2760                               unsigned long arg5)
2761 {
2762         /* The current prctl operations do not appear to require
2763            any SELinux controls since they merely observe or modify
2764            the state of the current process. */
2765         return 0;
2766 }
2767
2768 static int selinux_task_wait(struct task_struct *p)
2769 {
2770         u32 perm;
2771
2772         perm = signal_to_av(p->exit_signal);
2773
2774         return task_has_perm(p, current, perm);
2775 }
2776
2777 static void selinux_task_reparent_to_init(struct task_struct *p)
2778 {
2779         struct task_security_struct *tsec;
2780
2781         secondary_ops->task_reparent_to_init(p);
2782
2783         tsec = p->security;
2784         tsec->osid = tsec->sid;
2785         tsec->sid = SECINITSID_KERNEL;
2786         return;
2787 }
2788
2789 static void selinux_task_to_inode(struct task_struct *p,
2790                                   struct inode *inode)
2791 {
2792         struct task_security_struct *tsec = p->security;
2793         struct inode_security_struct *isec = inode->i_security;
2794
2795         isec->sid = tsec->sid;
2796         isec->initialized = 1;
2797         return;
2798 }
2799
2800 #ifdef CONFIG_SECURITY_NETWORK
2801
2802 /* Returns error only if unable to parse addresses */
2803 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2804 {
2805         int offset, ihlen, ret = -EINVAL;
2806         struct iphdr _iph, *ih;
2807
2808         offset = skb->nh.raw - skb->data;
2809         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2810         if (ih == NULL)
2811                 goto out;
2812
2813         ihlen = ih->ihl * 4;
2814         if (ihlen < sizeof(_iph))
2815                 goto out;
2816
2817         ad->u.net.v4info.saddr = ih->saddr;
2818         ad->u.net.v4info.daddr = ih->daddr;
2819         ret = 0;
2820
2821         switch (ih->protocol) {
2822         case IPPROTO_TCP: {
2823                 struct tcphdr _tcph, *th;
2824
2825                 if (ntohs(ih->frag_off) & IP_OFFSET)
2826                         break;
2827
2828                 offset += ihlen;
2829                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2830                 if (th == NULL)
2831                         break;
2832
2833                 ad->u.net.sport = th->source;
2834                 ad->u.net.dport = th->dest;
2835                 break;
2836         }
2837
2838         case IPPROTO_UDP: {
2839                 struct udphdr _udph, *uh;
2840
2841                 if (ntohs(ih->frag_off) & IP_OFFSET)
2842                         break;
2843
2844                 offset += ihlen;
2845                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2846                 if (uh == NULL)
2847                         break;
2848
2849                 ad->u.net.sport = uh->source;
2850                 ad->u.net.dport = uh->dest;
2851                 break;
2852         }
2853
2854         default:
2855                 break;
2856         }
2857 out:
2858         return ret;
2859 }
2860
2861 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2862
2863 /* Returns error only if unable to parse addresses */
2864 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2865 {
2866         u8 nexthdr;
2867         int ret = -EINVAL, offset;
2868         struct ipv6hdr _ipv6h, *ip6;
2869
2870         offset = skb->nh.raw - skb->data;
2871         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2872         if (ip6 == NULL)
2873                 goto out;
2874
2875         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2876         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2877         ret = 0;
2878
2879         nexthdr = ip6->nexthdr;
2880         offset += sizeof(_ipv6h);
2881         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2882         if (offset < 0)
2883                 goto out;
2884
2885         switch (nexthdr) {
2886         case IPPROTO_TCP: {
2887                 struct tcphdr _tcph, *th;
2888
2889                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2890                 if (th == NULL)
2891                         break;
2892
2893                 ad->u.net.sport = th->source;
2894                 ad->u.net.dport = th->dest;
2895                 break;
2896         }
2897
2898         case IPPROTO_UDP: {
2899                 struct udphdr _udph, *uh;
2900
2901                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2902                 if (uh == NULL)
2903                         break;
2904
2905                 ad->u.net.sport = uh->source;
2906                 ad->u.net.dport = uh->dest;
2907                 break;
2908         }
2909
2910         /* includes fragments */
2911         default:
2912                 break;
2913         }
2914 out:
2915         return ret;
2916 }
2917
2918 #endif /* IPV6 */
2919
2920 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2921                              char **addrp, int *len, int src)
2922 {
2923         int ret = 0;
2924
2925         switch (ad->u.net.family) {
2926         case PF_INET:
2927                 ret = selinux_parse_skb_ipv4(skb, ad);
2928                 if (ret || !addrp)
2929                         break;
2930                 *len = 4;
2931                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2932                                         &ad->u.net.v4info.daddr);
2933                 break;
2934
2935 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2936         case PF_INET6:
2937                 ret = selinux_parse_skb_ipv6(skb, ad);
2938                 if (ret || !addrp)
2939                         break;
2940                 *len = 16;
2941                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2942                                         &ad->u.net.v6info.daddr);
2943                 break;
2944 #endif  /* IPV6 */
2945         default:
2946                 break;
2947         }
2948
2949         return ret;
2950 }
2951
2952 /* socket security operations */
2953 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2954                            u32 perms)
2955 {
2956         struct inode_security_struct *isec;
2957         struct task_security_struct *tsec;
2958         struct avc_audit_data ad;
2959         int err = 0;
2960
2961         tsec = task->security;
2962         isec = SOCK_INODE(sock)->i_security;
2963
2964         if (isec->sid == SECINITSID_KERNEL)
2965                 goto out;
2966
2967         AVC_AUDIT_DATA_INIT(&ad,NET);
2968         ad.u.net.sk = sock->sk;
2969         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2970
2971 out:
2972         return err;
2973 }
2974
2975 static int selinux_socket_create(int family, int type,
2976                                  int protocol, int kern)
2977 {
2978         int err = 0;
2979         struct task_security_struct *tsec;
2980
2981         if (kern)
2982                 goto out;
2983
2984         tsec = current->security;
2985         err = avc_has_perm(tsec->sid, tsec->sid,
2986                            socket_type_to_security_class(family, type,
2987                            protocol), SOCKET__CREATE, NULL);
2988
2989 out:
2990         return err;
2991 }
2992
2993 static void selinux_socket_post_create(struct socket *sock, int family,
2994                                        int type, int protocol, int kern)
2995 {
2996         struct inode_security_struct *isec;
2997         struct task_security_struct *tsec;
2998
2999         isec = SOCK_INODE(sock)->i_security;
3000
3001         tsec = current->security;
3002         isec->sclass = socket_type_to_security_class(family, type, protocol);
3003         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3004         isec->initialized = 1;
3005
3006         return;
3007 }
3008
3009 /* Range of port numbers used to automatically bind.
3010    Need to determine whether we should perform a name_bind
3011    permission check between the socket and the port number. */
3012 #define ip_local_port_range_0 sysctl_local_port_range[0]
3013 #define ip_local_port_range_1 sysctl_local_port_range[1]
3014
3015 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3016 {
3017         u16 family;
3018         int err;
3019
3020         err = socket_has_perm(current, sock, SOCKET__BIND);
3021         if (err)
3022                 goto out;
3023
3024         /*
3025          * If PF_INET or PF_INET6, check name_bind permission for the port.
3026          */
3027         family = sock->sk->sk_family;
3028         if (family == PF_INET || family == PF_INET6) {
3029                 char *addrp;
3030                 struct inode_security_struct *isec;
3031                 struct task_security_struct *tsec;
3032                 struct avc_audit_data ad;
3033                 struct sockaddr_in *addr4 = NULL;
3034                 struct sockaddr_in6 *addr6 = NULL;
3035                 unsigned short snum;
3036                 struct sock *sk = sock->sk;
3037                 u32 sid, node_perm, addrlen;
3038
3039                 tsec = current->security;
3040                 isec = SOCK_INODE(sock)->i_security;
3041
3042                 if (family == PF_INET) {
3043                         addr4 = (struct sockaddr_in *)address;
3044                         snum = ntohs(addr4->sin_port);
3045                         addrlen = sizeof(addr4->sin_addr.s_addr);
3046                         addrp = (char *)&addr4->sin_addr.s_addr;
3047                 } else {
3048                         addr6 = (struct sockaddr_in6 *)address;
3049                         snum = ntohs(addr6->sin6_port);
3050                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3051                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3052                 }
3053
3054                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3055                            snum > ip_local_port_range_1)) {
3056                         err = security_port_sid(sk->sk_family, sk->sk_type,
3057                                                 sk->sk_protocol, snum, &sid);
3058                         if (err)
3059                                 goto out;
3060                         AVC_AUDIT_DATA_INIT(&ad,NET);
3061                         ad.u.net.sport = htons(snum);
3062                         ad.u.net.family = family;
3063                         err = avc_has_perm(isec->sid, sid,
3064                                            isec->sclass,
3065                                            SOCKET__NAME_BIND, &ad);
3066                         if (err)
3067                                 goto out;
3068                 }
3069
3070                 switch(sk->sk_protocol) {
3071                 case IPPROTO_TCP:
3072                         node_perm = TCP_SOCKET__NODE_BIND;
3073                         break;
3074
3075                 case IPPROTO_UDP:
3076                         node_perm = UDP_SOCKET__NODE_BIND;
3077                         break;
3078
3079                 default:
3080                         node_perm = RAWIP_SOCKET__NODE_BIND;
3081                         break;
3082                 }
3083
3084                 err = security_node_sid(family, addrp, addrlen, &sid);
3085                 if (err)
3086                         goto out;
3087
3088                 AVC_AUDIT_DATA_INIT(&ad,NET);
3089                 ad.u.net.sport = htons(snum);
3090                 ad.u.net.family = family;
3091
3092                 if (family == PF_INET)
3093                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3094                 else
3095                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3096
3097                 err = avc_has_perm(isec->sid, sid,
3098                                    isec->sclass, node_perm, &ad);
3099                 if (err)
3100                         goto out;
3101         }
3102 out:
3103         return err;
3104 }
3105
3106 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3107 {
3108         struct inode_security_struct *isec;
3109         int err;
3110
3111         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3112         if (err)
3113                 return err;
3114
3115         /*
3116          * If a TCP socket, check name_connect permission for the port.
3117          */
3118         isec = SOCK_INODE(sock)->i_security;
3119         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3120                 struct sock *sk = sock->sk;
3121                 struct avc_audit_data ad;
3122                 struct sockaddr_in *addr4 = NULL;
3123                 struct sockaddr_in6 *addr6 = NULL;
3124                 unsigned short snum;
3125                 u32 sid;
3126
3127                 if (sk->sk_family == PF_INET) {
3128                         addr4 = (struct sockaddr_in *)address;
3129                         if (addrlen < sizeof(struct sockaddr_in))
3130                                 return -EINVAL;
3131                         snum = ntohs(addr4->sin_port);
3132                 } else {
3133                         addr6 = (struct sockaddr_in6 *)address;
3134                         if (addrlen < SIN6_LEN_RFC2133)
3135                                 return -EINVAL;
3136                         snum = ntohs(addr6->sin6_port);
3137                 }
3138
3139                 err = security_port_sid(sk->sk_family, sk->sk_type,
3140                                         sk->sk_protocol, snum, &sid);
3141                 if (err)
3142                         goto out;
3143
3144                 AVC_AUDIT_DATA_INIT(&ad,NET);
3145                 ad.u.net.dport = htons(snum);
3146                 ad.u.net.family = sk->sk_family;
3147                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3148                                    TCP_SOCKET__NAME_CONNECT, &ad);
3149                 if (err)
3150                         goto out;
3151         }
3152
3153 out:
3154         return err;
3155 }
3156
3157 static int selinux_socket_listen(struct socket *sock, int backlog)
3158 {
3159         return socket_has_perm(current, sock, SOCKET__LISTEN);
3160 }
3161
3162 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3163 {
3164         int err;
3165         struct inode_security_struct *isec;
3166         struct inode_security_struct *newisec;
3167
3168         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3169         if (err)
3170                 return err;
3171
3172         newisec = SOCK_INODE(newsock)->i_security;
3173
3174         isec = SOCK_INODE(sock)->i_security;
3175         newisec->sclass = isec->sclass;
3176         newisec->sid = isec->sid;
3177         newisec->initialized = 1;
3178
3179         return 0;
3180 }
3181
3182 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3183                                   int size)
3184 {
3185         return socket_has_perm(current, sock, SOCKET__WRITE);
3186 }
3187
3188 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3189                                   int size, int flags)
3190 {
3191         return socket_has_perm(current, sock, SOCKET__READ);
3192 }
3193
3194 static int selinux_socket_getsockname(struct socket *sock)
3195 {
3196         return socket_has_perm(current, sock, SOCKET__GETATTR);
3197 }
3198
3199 static int selinux_socket_getpeername(struct socket *sock)
3200 {
3201         return socket_has_perm(current, sock, SOCKET__GETATTR);
3202 }
3203
3204 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3205 {
3206         return socket_has_perm(current, sock, SOCKET__SETOPT);
3207 }
3208
3209 static int selinux_socket_getsockopt(struct socket *sock, int level,
3210                                      int optname)
3211 {
3212         return socket_has_perm(current, sock, SOCKET__GETOPT);
3213 }
3214
3215 static int selinux_socket_shutdown(struct socket *sock, int how)
3216 {
3217         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3218 }
3219
3220 static int selinux_socket_unix_stream_connect(struct socket *sock,
3221                                               struct socket *other,
3222                                               struct sock *newsk)
3223 {
3224         struct sk_security_struct *ssec;
3225         struct inode_security_struct *isec;
3226         struct inode_security_struct *other_isec;
3227         struct avc_audit_data ad;
3228         int err;
3229
3230         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3231         if (err)
3232                 return err;
3233
3234         isec = SOCK_INODE(sock)->i_security;
3235         other_isec = SOCK_INODE(other)->i_security;
3236
3237         AVC_AUDIT_DATA_INIT(&ad,NET);
3238         ad.u.net.sk = other->sk;
3239
3240         err = avc_has_perm(isec->sid, other_isec->sid,
3241                            isec->sclass,
3242                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3243         if (err)
3244                 return err;
3245
3246         /* connecting socket */
3247         ssec = sock->sk->sk_security;
3248         ssec->peer_sid = other_isec->sid;
3249
3250         /* server child socket */
3251         ssec = newsk->sk_security;
3252         ssec->peer_sid = isec->sid;
3253
3254         return 0;
3255 }
3256
3257 static int selinux_socket_unix_may_send(struct socket *sock,
3258                                         struct socket *other)
3259 {
3260         struct inode_security_struct *isec;
3261         struct inode_security_struct *other_isec;
3262         struct avc_audit_data ad;
3263         int err;
3264
3265         isec = SOCK_INODE(sock)->i_security;
3266         other_isec = SOCK_INODE(other)->i_security;
3267
3268         AVC_AUDIT_DATA_INIT(&ad,NET);
3269         ad.u.net.sk = other->sk;
3270
3271         err = avc_has_perm(isec->sid, other_isec->sid,
3272                            isec->sclass, SOCKET__SENDTO, &ad);
3273         if (err)
3274                 return err;
3275
3276         return 0;
3277 }
3278
3279 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3280 {
3281         u16 family;
3282         char *addrp;
3283         int len, err = 0;
3284         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3285         u32 sock_sid = 0;
3286         u16 sock_class = 0;
3287         struct socket *sock;
3288         struct net_device *dev;
3289         struct avc_audit_data ad;
3290
3291         family = sk->sk_family;
3292         if (family != PF_INET && family != PF_INET6)
3293                 goto out;
3294
3295         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3296         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3297                 family = PF_INET;
3298
3299         read_lock_bh(&sk->sk_callback_lock);
3300         sock = sk->sk_socket;
3301         if (sock) {