security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  17  *              Paul Moore <paul.moore@hp.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kernel.h>
  28 #include <linux/tracehook.h>
  29 #include <linux/errno.h>
  30 #include <linux/sched.h>
  31 #include <linux/security.h>
  32 #include <linux/xattr.h>
  33 #include <linux/capability.h>
  34 #include <linux/unistd.h>
  35 #include <linux/mm.h>
  36 #include <linux/mman.h>
  37 #include <linux/slab.h>
  38 #include <linux/pagemap.h>
  39 #include <linux/swap.h>
  40 #include <linux/spinlock.h>
  41 #include <linux/syscalls.h>
  42 #include <linux/file.h>
  43 #include <linux/fdtable.h>
  44 #include <linux/namei.h>
  45 #include <linux/mount.h>
  46 #include <linux/proc_fs.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <linux/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "netport.h"
  84 #include "xfrm.h"
  85 #include "netlabel.h"
  86 #include "audit.h"
  87
  88 #define XATTR_SELINUX_SUFFIX "selinux"
  89 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  90
  91 #define NUM_SEL_MNT_OPTS 4
  92
  93 extern unsigned int policydb_loaded_version;
  94 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  95 extern int selinux_compat_net;
  96 extern struct security_operations *security_ops;
  97
  98 /* SECMARK reference count */
  99 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!strict_strtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!strict_strtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129
 130 /*
 131  * Minimal support for a secondary security module,
 132  * just to allow the use of the capability module.
 133  */
 134 static struct security_operations *secondary_ops;
 135
 136 /* Lists of inode and superblock security structures initialized
 137    before the policy was loaded. */
 138 static LIST_HEAD(superblock_security_head);
 139 static DEFINE_SPINLOCK(sb_security_lock);
 140
 141 static struct kmem_cache *sel_inode_cache;
 142
 143 /**
 144  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 145  *
 146  * Description:
 147  * This function checks the SECMARK reference counter to see if any SECMARK
 148  * targets are currently configured, if the reference counter is greater than
 149  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 150  * enabled, false (0) if SECMARK is disabled.
 151  *
 152  */
 153 static int selinux_secmark_enabled(void)
 154 {
 155         return (atomic_read(&selinux_secmark_refcount) > 0);
 156 }
 157
 158 /* Allocate and free functions for each kind of security blob. */
 159
 160 static int task_alloc_security(struct task_struct *task)
 161 {
 162         struct task_security_struct *tsec;
 163
 164         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 165         if (!tsec)
 166                 return -ENOMEM;
 167
 168         tsec->osid = tsec->sid = SECINITSID_UNLABELED;
 169         task->security = tsec;
 170
 171         return 0;
 172 }
 173
 174 static void task_free_security(struct task_struct *task)
 175 {
 176         struct task_security_struct *tsec = task->security;
 177         task->security = NULL;
 178         kfree(tsec);
 179 }
 180
 181 static int inode_alloc_security(struct inode *inode)
 182 {
 183         struct task_security_struct *tsec = current->security;
 184         struct inode_security_struct *isec;
 185
 186         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 187         if (!isec)
 188                 return -ENOMEM;
 189
 190         mutex_init(&isec->lock);
 191         INIT_LIST_HEAD(&isec->list);
 192         isec->inode = inode;
 193         isec->sid = SECINITSID_UNLABELED;
 194         isec->sclass = SECCLASS_FILE;
 195         isec->task_sid = tsec->sid;
 196         inode->i_security = isec;
 197
 198         return 0;
 199 }
 200
 201 static void inode_free_security(struct inode *inode)
 202 {
 203         struct inode_security_struct *isec = inode->i_security;
 204         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 205
 206         spin_lock(&sbsec->isec_lock);
 207         if (!list_empty(&isec->list))
 208                 list_del_init(&isec->list);
 209         spin_unlock(&sbsec->isec_lock);
 210
 211         inode->i_security = NULL;
 212         kmem_cache_free(sel_inode_cache, isec);
 213 }
 214
 215 static int file_alloc_security(struct file *file)
 216 {
 217         struct task_security_struct *tsec = current->security;
 218         struct file_security_struct *fsec;
 219
 220         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 221         if (!fsec)
 222                 return -ENOMEM;
 223
 224         fsec->sid = tsec->sid;
 225         fsec->fown_sid = tsec->sid;
 226         file->f_security = fsec;
 227
 228         return 0;
 229 }
 230
 231 static void file_free_security(struct file *file)
 232 {
 233         struct file_security_struct *fsec = file->f_security;
 234         file->f_security = NULL;
 235         kfree(fsec);
 236 }
 237
 238 static int superblock_alloc_security(struct super_block *sb)
 239 {
 240         struct superblock_security_struct *sbsec;
 241
 242         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 243         if (!sbsec)
 244                 return -ENOMEM;
 245
 246         mutex_init(&sbsec->lock);
 247         INIT_LIST_HEAD(&sbsec->list);
 248         INIT_LIST_HEAD(&sbsec->isec_head);
 249         spin_lock_init(&sbsec->isec_lock);
 250         sbsec->sb = sb;
 251         sbsec->sid = SECINITSID_UNLABELED;
 252         sbsec->def_sid = SECINITSID_FILE;
 253         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 254         sb->s_security = sbsec;
 255
 256         return 0;
 257 }
 258
 259 static void superblock_free_security(struct super_block *sb)
 260 {
 261         struct superblock_security_struct *sbsec = sb->s_security;
 262
 263         spin_lock(&sb_security_lock);
 264         if (!list_empty(&sbsec->list))
 265                 list_del_init(&sbsec->list);
 266         spin_unlock(&sb_security_lock);
 267
 268         sb->s_security = NULL;
 269         kfree(sbsec);
 270 }
 271
 272 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 273 {
 274         struct sk_security_struct *ssec;
 275
 276         ssec = kzalloc(sizeof(*ssec), priority);
 277         if (!ssec)
 278                 return -ENOMEM;
 279
 280         ssec->peer_sid = SECINITSID_UNLABELED;
 281         ssec->sid = SECINITSID_UNLABELED;
 282         sk->sk_security = ssec;
 283
 284         selinux_netlbl_sk_security_reset(ssec, family);
 285
 286         return 0;
 287 }
 288
 289 static void sk_free_security(struct sock *sk)
 290 {
 291         struct sk_security_struct *ssec = sk->sk_security;
 292
 293         sk->sk_security = NULL;
 294         kfree(ssec);
 295 }
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_error = -1,
 321         Opt_context = 1,
 322         Opt_fscontext = 2,
 323         Opt_defcontext = 3,
 324         Opt_rootcontext = 4,
 325 };
 326
 327 static match_table_t tokens = {
 328         {Opt_context, CONTEXT_STR "%s"},
 329         {Opt_fscontext, FSCONTEXT_STR "%s"},
 330         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 331         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 332         {Opt_error, NULL},
 333 };
 334
 335 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 336
 337 static int may_context_mount_sb_relabel(u32 sid,
 338                         struct superblock_security_struct *sbsec,
 339                         struct task_security_struct *tsec)
 340 {
 341         int rc;
 342
 343         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 344                           FILESYSTEM__RELABELFROM, NULL);
 345         if (rc)
 346                 return rc;
 347
 348         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 349                           FILESYSTEM__RELABELTO, NULL);
 350         return rc;
 351 }
 352
 353 static int may_context_mount_inode_relabel(u32 sid,
 354                         struct superblock_security_struct *sbsec,
 355                         struct task_security_struct *tsec)
 356 {
 357         int rc;
 358         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 359                           FILESYSTEM__RELABELFROM, NULL);
 360         if (rc)
 361                 return rc;
 362
 363         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 364                           FILESYSTEM__ASSOCIATE, NULL);
 365         return rc;
 366 }
 367
 368 static int sb_finish_set_opts(struct super_block *sb)
 369 {
 370         struct superblock_security_struct *sbsec = sb->s_security;
 371         struct dentry *root = sb->s_root;
 372         struct inode *root_inode = root->d_inode;
 373         int rc = 0;
 374
 375         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 376                 /* Make sure that the xattr handler exists and that no
 377                    error other than -ENODATA is returned by getxattr on
 378                    the root directory.  -ENODATA is ok, as this may be
 379                    the first boot of the SELinux kernel before we have
 380                    assigned xattr values to the filesystem. */
 381                 if (!root_inode->i_op->getxattr) {
 382                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 383                                "xattr support\n", sb->s_id, sb->s_type->name);
 384                         rc = -EOPNOTSUPP;
 385                         goto out;
 386                 }
 387                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 388                 if (rc < 0 && rc != -ENODATA) {
 389                         if (rc == -EOPNOTSUPP)
 390                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 391                                        "%s) has no security xattr handler\n",
 392                                        sb->s_id, sb->s_type->name);
 393                         else
 394                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 395                                        "%s) getxattr errno %d\n", sb->s_id,
 396                                        sb->s_type->name, -rc);
 397                         goto out;
 398                 }
 399         }
 400
 401         sbsec->initialized = 1;
 402
 403         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 404                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 405                        sb->s_id, sb->s_type->name);
 406         else
 407                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 408                        sb->s_id, sb->s_type->name,
 409                        labeling_behaviors[sbsec->behavior-1]);
 410
 411         /* Initialize the root inode. */
 412         rc = inode_doinit_with_dentry(root_inode, root);
 413
 414         /* Initialize any other inodes associated with the superblock, e.g.
 415            inodes created prior to initial policy load or inodes created
 416            during get_sb by a pseudo filesystem that directly
 417            populates itself. */
 418         spin_lock(&sbsec->isec_lock);
 419 next_inode:
 420         if (!list_empty(&sbsec->isec_head)) {
 421                 struct inode_security_struct *isec =
 422                                 list_entry(sbsec->isec_head.next,
 423                                            struct inode_security_struct, list);
 424                 struct inode *inode = isec->inode;
 425                 spin_unlock(&sbsec->isec_lock);
 426                 inode = igrab(inode);
 427                 if (inode) {
 428                         if (!IS_PRIVATE(inode))
 429                                 inode_doinit(inode);
 430                         iput(inode);
 431                 }
 432                 spin_lock(&sbsec->isec_lock);
 433                 list_del_init(&isec->list);
 434                 goto next_inode;
 435         }
 436         spin_unlock(&sbsec->isec_lock);
 437 out:
 438         return rc;
 439 }
 440
 441 /*
 442  * This function should allow an FS to ask what it's mount security
 443  * options were so it can use those later for submounts, displaying
 444  * mount options, or whatever.
 445  */
 446 static int selinux_get_mnt_opts(const struct super_block *sb,
 447                                 struct security_mnt_opts *opts)
 448 {
 449         int rc = 0, i;
 450         struct superblock_security_struct *sbsec = sb->s_security;
 451         char *context = NULL;
 452         u32 len;
 453         char tmp;
 454
 455         security_init_mnt_opts(opts);
 456
 457         if (!sbsec->initialized)
 458                 return -EINVAL;
 459
 460         if (!ss_initialized)
 461                 return -EINVAL;
 462
 463         /*
 464          * if we ever use sbsec flags for anything other than tracking mount
 465          * settings this is going to need a mask
 466          */
 467         tmp = sbsec->flags;
 468         /* count the number of mount options for this sb */
 469         for (i = 0; i < 8; i++) {
 470                 if (tmp & 0x01)
 471                         opts->num_mnt_opts++;
 472                 tmp >>= 1;
 473         }
 474
 475         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 476         if (!opts->mnt_opts) {
 477                 rc = -ENOMEM;
 478                 goto out_free;
 479         }
 480
 481         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 482         if (!opts->mnt_opts_flags) {
 483                 rc = -ENOMEM;
 484                 goto out_free;
 485         }
 486
 487         i = 0;
 488         if (sbsec->flags & FSCONTEXT_MNT) {
 489                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 490                 if (rc)
 491                         goto out_free;
 492                 opts->mnt_opts[i] = context;
 493                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 494         }
 495         if (sbsec->flags & CONTEXT_MNT) {
 496                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 497                 if (rc)
 498                         goto out_free;
 499                 opts->mnt_opts[i] = context;
 500                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 501         }
 502         if (sbsec->flags & DEFCONTEXT_MNT) {
 503                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 504                 if (rc)
 505                         goto out_free;
 506                 opts->mnt_opts[i] = context;
 507                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 508         }
 509         if (sbsec->flags & ROOTCONTEXT_MNT) {
 510                 struct inode *root = sbsec->sb->s_root->d_inode;
 511                 struct inode_security_struct *isec = root->i_security;
 512
 513                 rc = security_sid_to_context(isec->sid, &context, &len);
 514                 if (rc)
 515                         goto out_free;
 516                 opts->mnt_opts[i] = context;
 517                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 518         }
 519
 520         BUG_ON(i != opts->num_mnt_opts);
 521
 522         return 0;
 523
 524 out_free:
 525         security_free_mnt_opts(opts);
 526         return rc;
 527 }
 528
 529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 530                       u32 old_sid, u32 new_sid)
 531 {
 532         /* check if the old mount command had the same options */
 533         if (sbsec->initialized)
 534                 if (!(sbsec->flags & flag) ||
 535                     (old_sid != new_sid))
 536                         return 1;
 537
 538         /* check if we were passed the same options twice,
 539          * aka someone passed context=a,context=b
 540          */
 541         if (!sbsec->initialized)
 542                 if (sbsec->flags & flag)
 543                         return 1;
 544         return 0;
 545 }
 546
 547 /*
 548  * Allow filesystems with binary mount data to explicitly set mount point
 549  * labeling information.
 550  */
 551 static int selinux_set_mnt_opts(struct super_block *sb,
 552                                 struct security_mnt_opts *opts)
 553 {
 554         int rc = 0, i;
 555         struct task_security_struct *tsec = current->security;
 556         struct superblock_security_struct *sbsec = sb->s_security;
 557         const char *name = sb->s_type->name;
 558         struct inode *inode = sbsec->sb->s_root->d_inode;
 559         struct inode_security_struct *root_isec = inode->i_security;
 560         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 561         u32 defcontext_sid = 0;
 562         char **mount_options = opts->mnt_opts;
 563         int *flags = opts->mnt_opts_flags;
 564         int num_opts = opts->num_mnt_opts;
 565
 566         mutex_lock(&sbsec->lock);
 567
 568         if (!ss_initialized) {
 569                 if (!num_opts) {
 570                         /* Defer initialization until selinux_complete_init,
 571                            after the initial policy is loaded and the security
 572                            server is ready to handle calls. */
 573                         spin_lock(&sb_security_lock);
 574                         if (list_empty(&sbsec->list))
 575                                 list_add(&sbsec->list, &superblock_security_head);
 576                         spin_unlock(&sb_security_lock);
 577                         goto out;
 578                 }
 579                 rc = -EINVAL;
 580                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 581                         "before the security server is initialized\n");
 582                 goto out;
 583         }
 584
 585         /*
 586          * Binary mount data FS will come through this function twice.  Once
 587          * from an explicit call and once from the generic calls from the vfs.
 588          * Since the generic VFS calls will not contain any security mount data
 589          * we need to skip the double mount verification.
 590          *
 591          * This does open a hole in which we will not notice if the first
 592          * mount using this sb set explict options and a second mount using
 593          * this sb does not set any security options.  (The first options
 594          * will be used for both mounts)
 595          */
 596         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 597             && (num_opts == 0))
 598                 goto out;
 599
 600         /*
 601          * parse the mount options, check if they are valid sids.
 602          * also check if someone is trying to mount the same sb more
 603          * than once with different security options.
 604          */
 605         for (i = 0; i < num_opts; i++) {
 606                 u32 sid;
 607                 rc = security_context_to_sid(mount_options[i],
 608                                              strlen(mount_options[i]), &sid);
 609                 if (rc) {
 610                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 611                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 612                                mount_options[i], sb->s_id, name, rc);
 613                         goto out;
 614                 }
 615                 switch (flags[i]) {
 616                 case FSCONTEXT_MNT:
 617                         fscontext_sid = sid;
 618
 619                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 620                                         fscontext_sid))
 621                                 goto out_double_mount;
 622
 623                         sbsec->flags |= FSCONTEXT_MNT;
 624                         break;
 625                 case CONTEXT_MNT:
 626                         context_sid = sid;
 627
 628                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 629                                         context_sid))
 630                                 goto out_double_mount;
 631
 632                         sbsec->flags |= CONTEXT_MNT;
 633                         break;
 634                 case ROOTCONTEXT_MNT:
 635                         rootcontext_sid = sid;
 636
 637                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 638                                         rootcontext_sid))
 639                                 goto out_double_mount;
 640
 641                         sbsec->flags |= ROOTCONTEXT_MNT;
 642
 643                         break;
 644                 case DEFCONTEXT_MNT:
 645                         defcontext_sid = sid;
 646
 647                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 648                                         defcontext_sid))
 649                                 goto out_double_mount;
 650
 651                         sbsec->flags |= DEFCONTEXT_MNT;
 652
 653                         break;
 654                 default:
 655                         rc = -EINVAL;
 656                         goto out;
 657                 }
 658         }
 659
 660         if (sbsec->initialized) {
 661                 /* previously mounted with options, but not on this attempt? */
 662                 if (sbsec->flags && !num_opts)
 663                         goto out_double_mount;
 664                 rc = 0;
 665                 goto out;
 666         }
 667
 668         if (strcmp(sb->s_type->name, "proc") == 0)
 669                 sbsec->proc = 1;
 670
 671         /* Determine the labeling behavior to use for this filesystem type. */
 672         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 673         if (rc) {
 674                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 675                        __func__, sb->s_type->name, rc);
 676                 goto out;
 677         }
 678
 679         /* sets the context of the superblock for the fs being mounted. */
 680         if (fscontext_sid) {
 681
 682                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 683                 if (rc)
 684                         goto out;
 685
 686                 sbsec->sid = fscontext_sid;
 687         }
 688
 689         /*
 690          * Switch to using mount point labeling behavior.
 691          * sets the label used on all file below the mountpoint, and will set
 692          * the superblock context if not already set.
 693          */
 694         if (context_sid) {
 695                 if (!fscontext_sid) {
 696                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 697                         if (rc)
 698                                 goto out;
 699                         sbsec->sid = context_sid;
 700                 } else {
 701                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 702                         if (rc)
 703                                 goto out;
 704                 }
 705                 if (!rootcontext_sid)
 706                         rootcontext_sid = context_sid;
 707
 708                 sbsec->mntpoint_sid = context_sid;
 709                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 710         }
 711
 712         if (rootcontext_sid) {
 713                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 714                 if (rc)
 715                         goto out;
 716
 717                 root_isec->sid = rootcontext_sid;
 718                 root_isec->initialized = 1;
 719         }
 720
 721         if (defcontext_sid) {
 722                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 723                         rc = -EINVAL;
 724                         printk(KERN_WARNING "SELinux: defcontext option is "
 725                                "invalid for this filesystem type\n");
 726                         goto out;
 727                 }
 728
 729                 if (defcontext_sid != sbsec->def_sid) {
 730                         rc = may_context_mount_inode_relabel(defcontext_sid,
 731                                                              sbsec, tsec);
 732                         if (rc)
 733                                 goto out;
 734                 }
 735
 736                 sbsec->def_sid = defcontext_sid;
 737         }
 738
 739         rc = sb_finish_set_opts(sb);
 740 out:
 741         mutex_unlock(&sbsec->lock);
 742         return rc;
 743 out_double_mount:
 744         rc = -EINVAL;
 745         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 746                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 747         goto out;
 748 }
 749
 750 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 751                                         struct super_block *newsb)
 752 {
 753         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 754         struct superblock_security_struct *newsbsec = newsb->s_security;
 755
 756         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 757         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 758         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 759
 760         /*
 761          * if the parent was able to be mounted it clearly had no special lsm
 762          * mount options.  thus we can safely put this sb on the list and deal
 763          * with it later
 764          */
 765         if (!ss_initialized) {
 766                 spin_lock(&sb_security_lock);
 767                 if (list_empty(&newsbsec->list))
 768                         list_add(&newsbsec->list, &superblock_security_head);
 769                 spin_unlock(&sb_security_lock);
 770                 return;
 771         }
 772
 773         /* how can we clone if the old one wasn't set up?? */
 774         BUG_ON(!oldsbsec->initialized);
 775
 776         /* if fs is reusing a sb, just let its options stand... */
 777         if (newsbsec->initialized)
 778                 return;
 779
 780         mutex_lock(&newsbsec->lock);
 781
 782         newsbsec->flags = oldsbsec->flags;
 783
 784         newsbsec->sid = oldsbsec->sid;
 785         newsbsec->def_sid = oldsbsec->def_sid;
 786         newsbsec->behavior = oldsbsec->behavior;
 787
 788         if (set_context) {
 789                 u32 sid = oldsbsec->mntpoint_sid;
 790
 791                 if (!set_fscontext)
 792                         newsbsec->sid = sid;
 793                 if (!set_rootcontext) {
 794                         struct inode *newinode = newsb->s_root->d_inode;
 795                         struct inode_security_struct *newisec = newinode->i_security;
 796                         newisec->sid = sid;
 797                 }
 798                 newsbsec->mntpoint_sid = sid;
 799         }
 800         if (set_rootcontext) {
 801                 const struct inode *oldinode = oldsb->s_root->d_inode;
 802                 const struct inode_security_struct *oldisec = oldinode->i_security;
 803                 struct inode *newinode = newsb->s_root->d_inode;
 804                 struct inode_security_struct *newisec = newinode->i_security;
 805
 806                 newisec->sid = oldisec->sid;
 807         }
 808
 809         sb_finish_set_opts(newsb);
 810         mutex_unlock(&newsbsec->lock);
 811 }
 812
 813 static int selinux_parse_opts_str(char *options,
 814                                   struct security_mnt_opts *opts)
 815 {
 816         char *p;
 817         char *context = NULL, *defcontext = NULL;
 818         char *fscontext = NULL, *rootcontext = NULL;
 819         int rc, num_mnt_opts = 0;
 820
 821         opts->num_mnt_opts = 0;
 822
 823         /* Standard string-based options. */
 824         while ((p = strsep(&options, "|")) != NULL) {
 825                 int token;
 826                 substring_t args[MAX_OPT_ARGS];
 827
 828                 if (!*p)
 829                         continue;
 830
 831                 token = match_token(p, tokens, args);
 832
 833                 switch (token) {
 834                 case Opt_context:
 835                         if (context || defcontext) {
 836                                 rc = -EINVAL;
 837                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 838                                 goto out_err;
 839                         }
 840                         context = match_strdup(&args[0]);
 841                         if (!context) {
 842                                 rc = -ENOMEM;
 843                                 goto out_err;
 844                         }
 845                         break;
 846
 847                 case Opt_fscontext:
 848                         if (fscontext) {
 849                                 rc = -EINVAL;
 850                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 851                                 goto out_err;
 852                         }
 853                         fscontext = match_strdup(&args[0]);
 854                         if (!fscontext) {
 855                                 rc = -ENOMEM;
 856                                 goto out_err;
 857                         }
 858                         break;
 859
 860                 case Opt_rootcontext:
 861                         if (rootcontext) {
 862                                 rc = -EINVAL;
 863                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 864                                 goto out_err;
 865                         }
 866                         rootcontext = match_strdup(&args[0]);
 867                         if (!rootcontext) {
 868                                 rc = -ENOMEM;
 869                                 goto out_err;
 870                         }
 871                         break;
 872
 873                 case Opt_defcontext:
 874                         if (context || defcontext) {
 875                                 rc = -EINVAL;
 876                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 877                                 goto out_err;
 878                         }
 879                         defcontext = match_strdup(&args[0]);
 880                         if (!defcontext) {
 881                                 rc = -ENOMEM;
 882                                 goto out_err;
 883                         }
 884                         break;
 885
 886                 default:
 887                         rc = -EINVAL;
 888                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 889                         goto out_err;
 890
 891                 }
 892         }
 893
 894         rc = -ENOMEM;
 895         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 896         if (!opts->mnt_opts)
 897                 goto out_err;
 898
 899         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 900         if (!opts->mnt_opts_flags) {
 901                 kfree(opts->mnt_opts);
 902                 goto out_err;
 903         }
 904
 905         if (fscontext) {
 906                 opts->mnt_opts[num_mnt_opts] = fscontext;
 907                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 908         }
 909         if (context) {
 910                 opts->mnt_opts[num_mnt_opts] = context;
 911                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 912         }
 913         if (rootcontext) {
 914                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 915                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 916         }
 917         if (defcontext) {
 918                 opts->mnt_opts[num_mnt_opts] = defcontext;
 919                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 920         }
 921
 922         opts->num_mnt_opts = num_mnt_opts;
 923         return 0;
 924
 925 out_err:
 926         kfree(context);
 927         kfree(defcontext);
 928         kfree(fscontext);
 929         kfree(rootcontext);
 930         return rc;
 931 }
 932 /*
 933  * string mount options parsing and call set the sbsec
 934  */
 935 static int superblock_doinit(struct super_block *sb, void *data)
 936 {
 937         int rc = 0;
 938         char *options = data;
 939         struct security_mnt_opts opts;
 940
 941         security_init_mnt_opts(&opts);
 942
 943         if (!data)
 944                 goto out;
 945
 946         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 947
 948         rc = selinux_parse_opts_str(options, &opts);
 949         if (rc)
 950                 goto out_err;
 951
 952 out:
 953         rc = selinux_set_mnt_opts(sb, &opts);
 954
 955 out_err:
 956         security_free_mnt_opts(&opts);
 957         return rc;
 958 }
 959
 960 void selinux_write_opts(struct seq_file *m, struct security_mnt_opts *opts)
 961 {
 962         int i;
 963         char *prefix;
 964
 965         for (i = 0; i < opts->num_mnt_opts; i++) {
 966                 char *has_comma = strchr(opts->mnt_opts[i], ',');
 967
 968                 switch (opts->mnt_opts_flags[i]) {
 969                 case CONTEXT_MNT:
 970                         prefix = CONTEXT_STR;
 971                         break;
 972                 case FSCONTEXT_MNT:
 973                         prefix = FSCONTEXT_STR;
 974                         break;
 975                 case ROOTCONTEXT_MNT:
 976                         prefix = ROOTCONTEXT_STR;
 977                         break;
 978                 case DEFCONTEXT_MNT:
 979                         prefix = DEFCONTEXT_STR;
 980                         break;
 981                 default:
 982                         BUG();
 983                 };
 984                 /* we need a comma before each option */
 985                 seq_putc(m, ',');
 986                 seq_puts(m, prefix);
 987                 if (has_comma)
 988                         seq_putc(m, '\"');
 989                 seq_puts(m, opts->mnt_opts[i]);
 990                 if (has_comma)
 991                         seq_putc(m, '\"');
 992         }
 993 }
 994
 995 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
 996 {
 997         struct security_mnt_opts opts;
 998         int rc;
 999
1000         rc = selinux_get_mnt_opts(sb, &opts);
1001         if (rc)
1002                 return rc;
1003
1004         selinux_write_opts(m, &opts);
1005
1006         security_free_mnt_opts(&opts);
1007
1008         return rc;
1009 }
1010
1011 static inline u16 inode_mode_to_security_class(umode_t mode)
1012 {
1013         switch (mode & S_IFMT) {
1014         case S_IFSOCK:
1015                 return SECCLASS_SOCK_FILE;
1016         case S_IFLNK:
1017                 return SECCLASS_LNK_FILE;
1018         case S_IFREG:
1019                 return SECCLASS_FILE;
1020         case S_IFBLK:
1021                 return SECCLASS_BLK_FILE;
1022         case S_IFDIR:
1023                 return SECCLASS_DIR;
1024         case S_IFCHR:
1025                 return SECCLASS_CHR_FILE;
1026         case S_IFIFO:
1027                 return SECCLASS_FIFO_FILE;
1028
1029         }
1030
1031         return SECCLASS_FILE;
1032 }
1033
1034 static inline int default_protocol_stream(int protocol)
1035 {
1036         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1037 }
1038
1039 static inline int default_protocol_dgram(int protocol)
1040 {
1041         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1042 }
1043
1044 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1045 {
1046         switch (family) {
1047         case PF_UNIX:
1048                 switch (type) {
1049                 case SOCK_STREAM:
1050                 case SOCK_SEQPACKET:
1051                         return SECCLASS_UNIX_STREAM_SOCKET;
1052                 case SOCK_DGRAM:
1053                         return SECCLASS_UNIX_DGRAM_SOCKET;
1054                 }
1055                 break;
1056         case PF_INET:
1057         case PF_INET6:
1058                 switch (type) {
1059                 case SOCK_STREAM:
1060                         if (default_protocol_stream(protocol))
1061                                 return SECCLASS_TCP_SOCKET;
1062                         else
1063                                 return SECCLASS_RAWIP_SOCKET;
1064                 case SOCK_DGRAM:
1065                         if (default_protocol_dgram(protocol))
1066                                 return SECCLASS_UDP_SOCKET;
1067                         else
1068                                 return SECCLASS_RAWIP_SOCKET;
1069                 case SOCK_DCCP:
1070                         return SECCLASS_DCCP_SOCKET;
1071                 default:
1072                         return SECCLASS_RAWIP_SOCKET;
1073                 }
1074                 break;
1075         case PF_NETLINK:
1076                 switch (protocol) {
1077                 case NETLINK_ROUTE:
1078                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1079                 case NETLINK_FIREWALL:
1080                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1081                 case NETLINK_INET_DIAG:
1082                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1083                 case NETLINK_NFLOG:
1084                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1085                 case NETLINK_XFRM:
1086                         return SECCLASS_NETLINK_XFRM_SOCKET;
1087                 case NETLINK_SELINUX:
1088                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1089                 case NETLINK_AUDIT:
1090                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1091                 case NETLINK_IP6_FW:
1092                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1093                 case NETLINK_DNRTMSG:
1094                         return SECCLASS_NETLINK_DNRT_SOCKET;
1095                 case NETLINK_KOBJECT_UEVENT:
1096                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1097                 default:
1098                         return SECCLASS_NETLINK_SOCKET;
1099                 }
1100         case PF_PACKET:
1101                 return SECCLASS_PACKET_SOCKET;
1102         case PF_KEY:
1103                 return SECCLASS_KEY_SOCKET;
1104         case PF_APPLETALK:
1105                 return SECCLASS_APPLETALK_SOCKET;
1106         }
1107
1108         return SECCLASS_SOCKET;
1109 }
1110
1111 #ifdef CONFIG_PROC_FS
1112 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1113                                 u16 tclass,
1114                                 u32 *sid)
1115 {
1116         int buflen, rc;
1117         char *buffer, *path, *end;
1118
1119         buffer = (char *)__get_free_page(GFP_KERNEL);
1120         if (!buffer)
1121                 return -ENOMEM;
1122
1123         buflen = PAGE_SIZE;
1124         end = buffer+buflen;
1125         *--end = '\0';
1126         buflen--;
1127         path = end-1;
1128         *path = '/';
1129         while (de && de != de->parent) {
1130                 buflen -= de->namelen + 1;
1131                 if (buflen < 0)
1132                         break;
1133                 end -= de->namelen;
1134                 memcpy(end, de->name, de->namelen);
1135                 *--end = '/';
1136                 path = end;
1137                 de = de->parent;
1138         }
1139         rc = security_genfs_sid("proc", path, tclass, sid);
1140         free_page((unsigned long)buffer);
1141         return rc;
1142 }
1143 #else
1144 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1145                                 u16 tclass,
1146                                 u32 *sid)
1147 {
1148         return -EINVAL;
1149 }
1150 #endif
1151
1152 /* The inode's security attributes must be initialized before first use. */
1153 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1154 {
1155         struct superblock_security_struct *sbsec = NULL;
1156         struct inode_security_struct *isec = inode->i_security;
1157         u32 sid;
1158         struct dentry *dentry;
1159 #define INITCONTEXTLEN 255
1160         char *context = NULL;
1161         unsigned len = 0;
1162         int rc = 0;
1163
1164         if (isec->initialized)
1165                 goto out;
1166
1167         mutex_lock(&isec->lock);
1168         if (isec->initialized)
1169                 goto out_unlock;
1170
1171         sbsec = inode->i_sb->s_security;
1172         if (!sbsec->initialized) {
1173                 /* Defer initialization until selinux_complete_init,
1174                    after the initial policy is loaded and the security
1175                    server is ready to handle calls. */
1176                 spin_lock(&sbsec->isec_lock);
1177                 if (list_empty(&isec->list))
1178                         list_add(&isec->list, &sbsec->isec_head);
1179                 spin_unlock(&sbsec->isec_lock);
1180                 goto out_unlock;
1181         }
1182
1183         switch (sbsec->behavior) {
1184         case SECURITY_FS_USE_XATTR:
1185                 if (!inode->i_op->getxattr) {
1186                         isec->sid = sbsec->def_sid;
1187                         break;
1188                 }
1189
1190                 /* Need a dentry, since the xattr API requires one.
1191                    Life would be simpler if we could just pass the inode. */
1192                 if (opt_dentry) {
1193                         /* Called from d_instantiate or d_splice_alias. */
1194                         dentry = dget(opt_dentry);
1195                 } else {
1196                         /* Called from selinux_complete_init, try to find a dentry. */
1197                         dentry = d_find_alias(inode);
1198                 }
1199                 if (!dentry) {
1200                         printk(KERN_WARNING "SELinux: %s:  no dentry for dev=%s "
1201                                "ino=%ld\n", __func__, inode->i_sb->s_id,
1202                                inode->i_ino);
1203                         goto out_unlock;
1204                 }
1205
1206                 len = INITCONTEXTLEN;
1207                 context = kmalloc(len, GFP_NOFS);
1208                 if (!context) {
1209                         rc = -ENOMEM;
1210                         dput(dentry);
1211                         goto out_unlock;
1212                 }
1213                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1214                                            context, len);
1215                 if (rc == -ERANGE) {
1216                         /* Need a larger buffer.  Query for the right size. */
1217                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1218                                                    NULL, 0);
1219                         if (rc < 0) {
1220                                 dput(dentry);
1221                                 goto out_unlock;
1222                         }
1223                         kfree(context);
1224                         len = rc;
1225                         context = kmalloc(len, GFP_NOFS);
1226                         if (!context) {
1227                                 rc = -ENOMEM;
1228                                 dput(dentry);
1229                                 goto out_unlock;
1230                         }
1231                         rc = inode->i_op->getxattr(dentry,
1232                                                    XATTR_NAME_SELINUX,
1233                                                    context, len);
1234                 }
1235                 dput(dentry);
1236                 if (rc < 0) {
1237                         if (rc != -ENODATA) {
1238                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1239                                        "%d for dev=%s ino=%ld\n", __func__,
1240                                        -rc, inode->i_sb->s_id, inode->i_ino);
1241                                 kfree(context);
1242                                 goto out_unlock;
1243                         }
1244                         /* Map ENODATA to the default file SID */
1245                         sid = sbsec->def_sid;
1246                         rc = 0;
1247                 } else {
1248                         rc = security_context_to_sid_default(context, rc, &sid,
1249                                                              sbsec->def_sid,
1250                                                              GFP_NOFS);
1251                         if (rc) {
1252                                 printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1253                                        "returned %d for dev=%s ino=%ld\n",
1254                                        __func__, context, -rc,
1255                                        inode->i_sb->s_id, inode->i_ino);
1256                                 kfree(context);
1257                                 /* Leave with the unlabeled SID */
1258                                 rc = 0;
1259                                 break;
1260                         }
1261                 }
1262                 kfree(context);
1263                 isec->sid = sid;
1264                 break;
1265         case SECURITY_FS_USE_TASK:
1266                 isec->sid = isec->task_sid;
1267                 break;
1268         case SECURITY_FS_USE_TRANS:
1269                 /* Default to the fs SID. */
1270                 isec->sid = sbsec->sid;
1271
1272                 /* Try to obtain a transition SID. */
1273                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1274                 rc = security_transition_sid(isec->task_sid,
1275                                              sbsec->sid,
1276                                              isec->sclass,
1277                                              &sid);
1278                 if (rc)
1279                         goto out_unlock;
1280                 isec->sid = sid;
1281                 break;
1282         case SECURITY_FS_USE_MNTPOINT:
1283                 isec->sid = sbsec->mntpoint_sid;
1284                 break;
1285         default:
1286                 /* Default to the fs superblock SID. */
1287                 isec->sid = sbsec->sid;
1288
1289                 if (sbsec->proc) {
1290                         struct proc_inode *proci = PROC_I(inode);
1291                         if (proci->pde) {
1292                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1293                                 rc = selinux_proc_get_sid(proci->pde,
1294                                                           isec->sclass,
1295                                                           &sid);
1296                                 if (rc)
1297                                         goto out_unlock;
1298                                 isec->sid = sid;
1299                         }
1300                 }
1301                 break;
1302         }
1303
1304         isec->initialized = 1;
1305
1306 out_unlock:
1307         mutex_unlock(&isec->lock);
1308 out:
1309         if (isec->sclass == SECCLASS_FILE)
1310                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1311         return rc;
1312 }
1313
1314 /* Convert a Linux signal to an access vector. */
1315 static inline u32 signal_to_av(int sig)
1316 {
1317         u32 perm = 0;
1318
1319         switch (sig) {
1320         case SIGCHLD:
1321                 /* Commonly granted from child to parent. */
1322                 perm = PROCESS__SIGCHLD;
1323                 break;
1324         case SIGKILL:
1325                 /* Cannot be caught or ignored */
1326                 perm = PROCESS__SIGKILL;
1327                 break;
1328         case SIGSTOP:
1329                 /* Cannot be caught or ignored */
1330                 perm = PROCESS__SIGSTOP;
1331                 break;
1332         default:
1333                 /* All other signals. */
1334                 perm = PROCESS__SIGNAL;
1335                 break;
1336         }
1337
1338         return perm;
1339 }
1340
1341 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1342    fork check, ptrace check, etc. */
1343 static int task_has_perm(struct task_struct *tsk1,
1344                          struct task_struct *tsk2,
1345                          u32 perms)
1346 {
1347         struct task_security_struct *tsec1, *tsec2;
1348
1349         tsec1 = tsk1->security;
1350         tsec2 = tsk2->security;
1351         return avc_has_perm(tsec1->sid, tsec2->sid,
1352                             SECCLASS_PROCESS, perms, NULL);
1353 }
1354
1355 #if CAP_LAST_CAP > 63
1356 #error Fix SELinux to handle capabilities > 63.
1357 #endif
1358
1359 /* Check whether a task is allowed to use a capability. */
1360 static int task_has_capability(struct task_struct *tsk,
1361                                int cap)
1362 {
1363         struct task_security_struct *tsec;
1364         struct avc_audit_data ad;
1365         u16 sclass;
1366         u32 av = CAP_TO_MASK(cap);
1367
1368         tsec = tsk->security;
1369
1370         AVC_AUDIT_DATA_INIT(&ad, CAP);
1371         ad.tsk = tsk;
1372         ad.u.cap = cap;
1373
1374         switch (CAP_TO_INDEX(cap)) {
1375         case 0:
1376                 sclass = SECCLASS_CAPABILITY;
1377                 break;
1378         case 1:
1379                 sclass = SECCLASS_CAPABILITY2;
1380                 break;
1381         default:
1382                 printk(KERN_ERR
1383                        "SELinux:  out of range capability %d\n", cap);
1384                 BUG();
1385         }
1386         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1387 }
1388
1389 /* Check whether a task is allowed to use a system operation. */
1390 static int task_has_system(struct task_struct *tsk,
1391                            u32 perms)
1392 {
1393         struct task_security_struct *tsec;
1394
1395         tsec = tsk->security;
1396
1397         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1398                             SECCLASS_SYSTEM, perms, NULL);
1399 }
1400
1401 /* Check whether a task has a particular permission to an inode.
1402    The 'adp' parameter is optional and allows other audit
1403    data to be passed (e.g. the dentry). */
1404 static int inode_has_perm(struct task_struct *tsk,
1405                           struct inode *inode,
1406                           u32 perms,
1407                           struct avc_audit_data *adp)
1408 {
1409         struct task_security_struct *tsec;
1410         struct inode_security_struct *isec;
1411         struct avc_audit_data ad;
1412
1413         if (unlikely(IS_PRIVATE(inode)))
1414                 return 0;
1415
1416         tsec = tsk->security;
1417         isec = inode->i_security;
1418
1419         if (!adp) {
1420                 adp = &ad;
1421                 AVC_AUDIT_DATA_INIT(&ad, FS);
1422                 ad.u.fs.inode = inode;
1423         }
1424
1425         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1426 }
1427
1428 /* Same as inode_has_perm, but pass explicit audit data containing
1429    the dentry to help the auditing code to more easily generate the
1430    pathname if needed. */
1431 static inline int dentry_has_perm(struct task_struct *tsk,
1432                                   struct vfsmount *mnt,
1433                                   struct dentry *dentry,
1434                                   u32 av)
1435 {
1436         struct inode *inode = dentry->d_inode;
1437         struct avc_audit_data ad;
1438         AVC_AUDIT_DATA_INIT(&ad, FS);
1439         ad.u.fs.path.mnt = mnt;
1440         ad.u.fs.path.dentry = dentry;
1441         return inode_has_perm(tsk, inode, av, &ad);
1442 }
1443
1444 /* Check whether a task can use an open file descriptor to
1445    access an inode in a given way.  Check access to the
1446    descriptor itself, and then use dentry_has_perm to
1447    check a particular permission to the file.
1448    Access to the descriptor is implicitly granted if it
1449    has the same SID as the process.  If av is zero, then
1450    access to the file is not checked, e.g. for cases
1451    where only the descriptor is affected like seek. */
1452 static int file_has_perm(struct task_struct *tsk,
1453                                 struct file *file,
1454                                 u32 av)
1455 {
1456         struct task_security_struct *tsec = tsk->security;
1457         struct file_security_struct *fsec = file->f_security;
1458         struct inode *inode = file->f_path.dentry->d_inode;
1459         struct avc_audit_data ad;
1460         int rc;
1461
1462         AVC_AUDIT_DATA_INIT(&ad, FS);
1463         ad.u.fs.path = file->f_path;
1464
1465         if (tsec->sid != fsec->sid) {
1466                 rc = avc_has_perm(tsec->sid, fsec->sid,
1467                                   SECCLASS_FD,
1468                                   FD__USE,
1469                                   &ad);
1470                 if (rc)
1471                         return rc;
1472         }
1473
1474         /* av is zero if only checking access to the descriptor. */
1475         if (av)
1476                 return inode_has_perm(tsk, inode, av, &ad);
1477
1478         return 0;
1479 }
1480
1481 /* Check whether a task can create a file. */
1482 static int may_create(struct inode *dir,
1483                       struct dentry *dentry,
1484                       u16 tclass)
1485 {
1486         struct task_security_struct *tsec;
1487         struct inode_security_struct *dsec;
1488         struct superblock_security_struct *sbsec;
1489         u32 newsid;
1490         struct avc_audit_data ad;
1491         int rc;
1492
1493         tsec = current->security;
1494         dsec = dir->i_security;
1495         sbsec = dir->i_sb->s_security;
1496
1497         AVC_AUDIT_DATA_INIT(&ad, FS);
1498         ad.u.fs.path.dentry = dentry;
1499
1500         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1501                           DIR__ADD_NAME | DIR__SEARCH,
1502                           &ad);
1503         if (rc)
1504                 return rc;
1505
1506         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1507                 newsid = tsec->create_sid;
1508         } else {
1509                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1510                                              &newsid);
1511                 if (rc)
1512                         return rc;
1513         }
1514
1515         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1516         if (rc)
1517                 return rc;
1518
1519         return avc_has_perm(newsid, sbsec->sid,
1520                             SECCLASS_FILESYSTEM,
1521                             FILESYSTEM__ASSOCIATE, &ad);
1522 }
1523
1524 /* Check whether a task can create a key. */
1525 static int may_create_key(u32 ksid,
1526                           struct task_struct *ctx)
1527 {
1528         struct task_security_struct *tsec;
1529
1530         tsec = ctx->security;
1531
1532         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1533 }
1534
1535 #define MAY_LINK        0
1536 #define MAY_UNLINK      1
1537 #define MAY_RMDIR       2
1538
1539 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1540 static int may_link(struct inode *dir,
1541                     struct dentry *dentry,
1542                     int kind)
1543
1544 {
1545         struct task_security_struct *tsec;
1546         struct inode_security_struct *dsec, *isec;
1547         struct avc_audit_data ad;
1548         u32 av;
1549         int rc;
1550
1551         tsec = current->security;
1552         dsec = dir->i_security;
1553         isec = dentry->d_inode->i_security;
1554
1555         AVC_AUDIT_DATA_INIT(&ad, FS);
1556         ad.u.fs.path.dentry = dentry;
1557
1558         av = DIR__SEARCH;
1559         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1560         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1561         if (rc)
1562                 return rc;
1563
1564         switch (kind) {
1565         case MAY_LINK:
1566                 av = FILE__LINK;
1567                 break;
1568         case MAY_UNLINK:
1569                 av = FILE__UNLINK;
1570                 break;
1571         case MAY_RMDIR:
1572                 av = DIR__RMDIR;
1573                 break;
1574         default:
1575                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1576                         __func__, kind);
1577                 return 0;
1578         }
1579
1580         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1581         return rc;
1582 }
1583
1584 static inline int may_rename(struct inode *old_dir,
1585                              struct dentry *old_dentry,
1586                              struct inode *new_dir,
1587                              struct dentry *new_dentry)
1588 {
1589         struct task_security_struct *tsec;
1590         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1591         struct avc_audit_data ad;
1592         u32 av;
1593         int old_is_dir, new_is_dir;
1594         int rc;
1595
1596         tsec = current->security;
1597         old_dsec = old_dir->i_security;
1598         old_isec = old_dentry->d_inode->i_security;
1599         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1600         new_dsec = new_dir->i_security;
1601
1602         AVC_AUDIT_DATA_INIT(&ad, FS);
1603
1604         ad.u.fs.path.dentry = old_dentry;
1605         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1606                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1607         if (rc)
1608                 return rc;
1609         rc = avc_has_perm(tsec->sid, old_isec->sid,
1610                           old_isec->sclass, FILE__RENAME, &ad);
1611         if (rc)
1612                 return rc;
1613         if (old_is_dir && new_dir != old_dir) {
1614                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1615                                   old_isec->sclass, DIR__REPARENT, &ad);
1616                 if (rc)
1617                         return rc;
1618         }
1619
1620         ad.u.fs.path.dentry = new_dentry;
1621         av = DIR__ADD_NAME | DIR__SEARCH;
1622         if (new_dentry->d_inode)
1623                 av |= DIR__REMOVE_NAME;
1624         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1625         if (rc)
1626                 return rc;
1627         if (new_dentry->d_inode) {
1628                 new_isec = new_dentry->d_inode->i_security;
1629                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1630                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1631                                   new_isec->sclass,
1632                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1633                 if (rc)
1634                         return rc;
1635         }
1636
1637         return 0;
1638 }
1639
1640 /* Check whether a task can perform a filesystem operation. */
1641 static int superblock_has_perm(struct task_struct *tsk,
1642                                struct super_block *sb,
1643                                u32 perms,
1644                                struct avc_audit_data *ad)
1645 {
1646         struct task_security_struct *tsec;
1647         struct superblock_security_struct *sbsec;
1648
1649         tsec = tsk->security;
1650         sbsec = sb->s_security;
1651         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1652                             perms, ad);
1653 }
1654
1655 /* Convert a Linux mode and permission mask to an access vector. */
1656 static inline u32 file_mask_to_av(int mode, int mask)
1657 {
1658         u32 av = 0;
1659
1660         if ((mode & S_IFMT) != S_IFDIR) {
1661                 if (mask & MAY_EXEC)
1662                         av |= FILE__EXECUTE;
1663                 if (mask & MAY_READ)
1664                         av |= FILE__READ;
1665
1666                 if (mask & MAY_APPEND)
1667                         av |= FILE__APPEND;
1668                 else if (mask & MAY_WRITE)
1669                         av |= FILE__WRITE;
1670
1671         } else {
1672                 if (mask & MAY_EXEC)
1673                         av |= DIR__SEARCH;
1674                 if (mask & MAY_WRITE)
1675                         av |= DIR__WRITE;
1676                 if (mask & MAY_READ)
1677                         av |= DIR__READ;
1678         }
1679
1680         return av;
1681 }
1682
1683 /*
1684  * Convert a file mask to an access vector and include the correct open
1685  * open permission.
1686  */
1687 static inline u32 open_file_mask_to_av(int mode, int mask)
1688 {
1689         u32 av = file_mask_to_av(mode, mask);
1690
1691         if (selinux_policycap_openperm) {
1692                 /*
1693                  * lnk files and socks do not really have an 'open'
1694                  */
1695                 if (S_ISREG(mode))
1696                         av |= FILE__OPEN;
1697                 else if (S_ISCHR(mode))
1698                         av |= CHR_FILE__OPEN;
1699                 else if (S_ISBLK(mode))
1700                         av |= BLK_FILE__OPEN;
1701                 else if (S_ISFIFO(mode))
1702                         av |= FIFO_FILE__OPEN;
1703                 else if (S_ISDIR(mode))
1704                         av |= DIR__OPEN;
1705                 else
1706                         printk(KERN_ERR "SELinux: WARNING: inside %s with "
1707                                 "unknown mode:%x\n", __func__, mode);
1708         }
1709         return av;
1710 }
1711
1712 /* Convert a Linux file to an access vector. */
1713 static inline u32 file_to_av(struct file *file)
1714 {
1715         u32 av = 0;
1716
1717         if (file->f_mode & FMODE_READ)
1718                 av |= FILE__READ;
1719         if (file->f_mode & FMODE_WRITE) {
1720                 if (file->f_flags & O_APPEND)
1721                         av |= FILE__APPEND;
1722                 else
1723                         av |= FILE__WRITE;
1724         }
1725         if (!av) {
1726                 /*
1727                  * Special file opened with flags 3 for ioctl-only use.
1728                  */
1729                 av = FILE__IOCTL;
1730         }
1731
1732         return av;
1733 }
1734
1735 /* Hook functions begin here. */
1736
1737 static int selinux_ptrace(struct task_struct *parent,
1738                           struct task_struct *child,
1739                           unsigned int mode)
1740 {
1741         int rc;
1742
1743         rc = secondary_ops->ptrace(parent, child, mode);
1744         if (rc)
1745                 return rc;
1746
1747         if (mode == PTRACE_MODE_READ) {
1748                 struct task_security_struct *tsec = parent->security;
1749                 struct task_security_struct *csec = child->security;
1750                 return avc_has_perm(tsec->sid, csec->sid,
1751                                     SECCLASS_FILE, FILE__READ, NULL);
1752         }
1753
1754         return task_has_perm(parent, child, PROCESS__PTRACE);
1755 }
1756
1757 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1758                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1759 {
1760         int error;
1761
1762         error = task_has_perm(current, target, PROCESS__GETCAP);
1763         if (error)
1764                 return error;
1765
1766         return secondary_ops->capget(target, effective, inheritable, permitted);
1767 }
1768
1769 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1770                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1771 {
1772         int error;
1773
1774         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1775         if (error)
1776                 return error;
1777
1778         return task_has_perm(current, target, PROCESS__SETCAP);
1779 }
1780
1781 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1782                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1783 {
1784         secondary_ops->capset_set(target, effective, inheritable, permitted);
1785 }
1786
1787 static int selinux_capable(struct task_struct *tsk, int cap)
1788 {
1789         int rc;
1790
1791         rc = secondary_ops->capable(tsk, cap);
1792         if (rc)
1793                 return rc;
1794
1795         return task_has_capability(tsk, cap);
1796 }
1797
1798 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1799 {
1800         int buflen, rc;
1801         char *buffer, *path, *end;
1802
1803         rc = -ENOMEM;
1804         buffer = (char *)__get_free_page(GFP_KERNEL);
1805         if (!buffer)
1806                 goto out;
1807
1808         buflen = PAGE_SIZE;
1809         end = buffer+buflen;
1810         *--end = '\0';
1811         buflen--;
1812         path = end-1;
1813         *path = '/';
1814         while (table) {
1815                 const char *name = table->procname;
1816                 size_t namelen = strlen(name);
1817                 buflen -= namelen + 1;
1818                 if (buflen < 0)
1819                         goto out_free;
1820                 end -= namelen;
1821                 memcpy(end, name, namelen);
1822                 *--end = '/';
1823                 path = end;
1824                 table = table->parent;
1825         }
1826         buflen -= 4;
1827         if (buflen < 0)
1828                 goto out_free;
1829         end -= 4;
1830         memcpy(end, "/sys", 4);
1831         path = end;
1832         rc = security_genfs_sid("proc", path, tclass, sid);
1833 out_free:
1834         free_page((unsigned long)buffer);
1835 out:
1836         return rc;
1837 }
1838
1839 static int selinux_sysctl(ctl_table *table, int op)
1840 {
1841         int error = 0;
1842         u32 av;
1843         struct task_security_struct *tsec;
1844         u32 tsid;
1845         int rc;
1846
1847         rc = secondary_ops->sysctl(table, op);
1848         if (rc)
1849                 return rc;
1850
1851         tsec = current->security;
1852
1853         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1854                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1855         if (rc) {
1856                 /* Default to the well-defined sysctl SID. */
1857                 tsid = SECINITSID_SYSCTL;
1858         }
1859
1860         /* The op values are "defined" in sysctl.c, thereby creating
1861          * a bad coupling between this module and sysctl.c */
1862         if (op == 001) {
1863                 error = avc_has_perm(tsec->sid, tsid,
1864                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1865         } else {
1866                 av = 0;
1867                 if (op & 004)
1868                         av |= FILE__READ;
1869                 if (op & 002)
1870                         av |= FILE__WRITE;
1871                 if (av)
1872                         error = avc_has_perm(tsec->sid, tsid,
1873                                              SECCLASS_FILE, av, NULL);
1874         }
1875
1876         return error;
1877 }
1878
1879 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1880 {
1881         int rc = 0;
1882
1883         if (!sb)
1884                 return 0;
1885
1886         switch (cmds) {
1887         case Q_SYNC:
1888         case Q_QUOTAON:
1889         case Q_QUOTAOFF:
1890         case Q_SETINFO:
1891         case Q_SETQUOTA:
1892                 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAMOD,
1893                                          NULL);
1894                 break;
1895         case Q_GETFMT:
1896         case Q_GETINFO:
1897         case Q_GETQUOTA:
1898                 rc = superblock_has_perm(current, sb, FILESYSTEM__QUOTAGET,
1899                                          NULL);
1900                 break;
1901         default:
1902                 rc = 0;  /* let the kernel handle invalid cmds */
1903                 break;
1904         }
1905         return rc;
1906 }
1907
1908 static int selinux_quota_on(struct dentry *dentry)
1909 {
1910         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1911 }
1912
1913 static int selinux_syslog(int type)
1914 {
1915         int rc;
1916
1917         rc = secondary_ops->syslog(type);
1918         if (rc)
1919                 return rc;
1920
1921         switch (type) {
1922         case 3:         /* Read last kernel messages */
1923         case 10:        /* Return size of the log buffer */
1924                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1925                 break;
1926         case 6:         /* Disable logging to console */
1927         case 7:         /* Enable logging to console */
1928         case 8:         /* Set level of messages printed to console */
1929                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1930                 break;
1931         case 0:         /* Close log */
1932         case 1:         /* Open log */
1933         case 2:         /* Read from log */
1934         case 4:         /* Read/clear last kernel messages */
1935         case 5:         /* Clear ring buffer */
1936         default:
1937                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1938                 break;
1939         }
1940         return rc;
1941 }
1942
1943 /*
1944  * Check that a process has enough memory to allocate a new virtual
1945  * mapping. 0 means there is enough memory for the allocation to
1946  * succeed and -ENOMEM implies there is not.
1947  *
1948  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1949  * if the capability is granted, but __vm_enough_memory requires 1 if
1950  * the capability is granted.
1951  *
1952  * Do not audit the selinux permission check, as this is applied to all
1953  * processes that allocate mappings.
1954  */
1955 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1956 {
1957         int rc, cap_sys_admin = 0;
1958         struct task_security_struct *tsec = current->security;
1959
1960         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1961         if (rc == 0)
1962                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1963                                           SECCLASS_CAPABILITY,
1964                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1965                                           0,
1966                                           NULL);
1967
1968         if (rc == 0)
1969                 cap_sys_admin = 1;
1970
1971         return __vm_enough_memory(mm, pages, cap_sys_admin);
1972 }
1973
1974 /* binprm security operations */
1975
1976 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1977 {
1978         struct bprm_security_struct *bsec;
1979
1980         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1981         if (!bsec)
1982                 return -ENOMEM;
1983
1984         bsec->sid = SECINITSID_UNLABELED;
1985         bsec->set = 0;
1986
1987         bprm->security = bsec;
1988         return 0;
1989 }
1990
1991 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1992 {
1993         struct task_security_struct *tsec;
1994         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1995         struct inode_security_struct *isec;
1996         struct bprm_security_struct *bsec;
1997         u32 newsid;
1998         struct avc_audit_data ad;
1999         int rc;
2000
2001         rc = secondary_ops->bprm_set_security(bprm);
2002         if (rc)
2003                 return rc;
2004
2005         bsec = bprm->security;
2006
2007         if (bsec->set)
2008                 return 0;
2009
2010         tsec = current->security;
2011         isec = inode->i_security;
2012
2013         /* Default to the current task SID. */
2014         bsec->sid = tsec->sid;
2015
2016         /* Reset fs, key, and sock SIDs on execve. */
2017         tsec->create_sid = 0;
2018         tsec->keycreate_sid = 0;
2019         tsec->sockcreate_sid = 0;
2020
2021         if (tsec->exec_sid) {
2022                 newsid = tsec->exec_sid;
2023                 /* Reset exec SID on execve. */
2024                 tsec->exec_sid = 0;
2025         } else {
2026                 /* Check for a default transition on this program. */
2027                 rc = security_transition_sid(tsec->sid, isec->sid,
2028                                              SECCLASS_PROCESS, &newsid);
2029                 if (rc)
2030                         return rc;
2031         }
2032
2033         AVC_AUDIT_DATA_INIT(&ad, FS);
2034         ad.u.fs.path = bprm->file->f_path;
2035
2036         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
2037                 newsid = tsec->sid;
2038
2039         if (tsec->sid == newsid) {
2040                 rc = avc_has_perm(tsec->sid, isec->sid,
2041                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2042                 if (rc)
2043                         return rc;
2044         } else {
2045                 /* Check permissions for the transition. */
2046                 rc = avc_has_perm(tsec->sid, newsid,
2047                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2048                 if (rc)
2049                         return rc;
2050
2051                 rc = avc_has_perm(newsid, isec->sid,
2052                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2053                 if (rc)
2054                         return rc;
2055
2056                 /* Clear any possibly unsafe personality bits on exec: */
2057                 current->personality &= ~PER_CLEAR_ON_SETID;
2058
2059                 /* Set the security field to the new SID. */
2060                 bsec->sid = newsid;
2061         }
2062
2063         bsec->set = 1;
2064         return 0;
2065 }
2066
2067 static int selinux_bprm_check_security(struct linux_binprm *bprm)
2068 {
2069         return secondary_ops->bprm_check_security(bprm);
2070 }
2071
2072
2073 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2074 {
2075         struct task_security_struct *tsec = current->security;
2076         int atsecure = 0;
2077
2078         if (tsec->osid != tsec->sid) {
2079                 /* Enable secure mode for SIDs transitions unless
2080                    the noatsecure permission is granted between
2081                    the two SIDs, i.e. ahp returns 0. */
2082                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
2083                                          SECCLASS_PROCESS,
2084                                          PROCESS__NOATSECURE, NULL);
2085         }
2086
2087         return (atsecure || secondary_ops->bprm_secureexec(bprm));
2088 }
2089
2090 static void selinux_bprm_free_security(struct linux_binprm *bprm)
2091 {
2092         kfree(bprm->security);
2093         bprm->security = NULL;
2094 }
2095
2096 extern struct vfsmount *selinuxfs_mount;
2097 extern struct dentry *selinux_null;
2098
2099 /* Derived from fs/exec.c:flush_old_files. */
2100 static inline void flush_unauthorized_files(struct files_struct *files)
2101 {
2102         struct avc_audit_data ad;
2103         struct file *file, *devnull = NULL;
2104         struct tty_struct *tty;
2105         struct fdtable *fdt;
2106         long j = -1;
2107         int drop_tty = 0;
2108
2109         mutex_lock(&tty_mutex);
2110         tty = get_current_tty();
2111         if (tty) {
2112                 file_list_lock();
2113                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2114                 if (file) {
2115                         /* Revalidate access to controlling tty.
2116                            Use inode_has_perm on the tty inode directly rather
2117                            than using file_has_perm, as this particular open
2118                            file may belong to another process and we are only
2119                            interested in the inode-based check here. */
2120                         struct inode *inode = file->f_path.dentry->d_inode;
2121                         if (inode_has_perm(current, inode,
2122                                            FILE__READ | FILE__WRITE, NULL)) {
2123                                 drop_tty = 1;
2124                         }
2125                 }
2126                 file_list_unlock();
2127         }
2128         mutex_unlock(&tty_mutex);
2129         /* Reset controlling tty. */
2130         if (drop_tty)
2131                 no_tty();
2132
2133         /* Revalidate access to inherited open files. */
2134
2135         AVC_AUDIT_DATA_INIT(&ad, FS);
2136
2137         spin_lock(&files->file_lock);
2138         for (;;) {
2139                 unsigned long set, i;
2140                 int fd;
2141
2142                 j++;
2143                 i = j * __NFDBITS;
2144                 fdt = files_fdtable(files);
2145                 if (i >= fdt->max_fds)
2146                         break;
2147                 set = fdt->open_fds->fds_bits[j];
2148                 if (!set)
2149                         continue;
2150                 spin_unlock(&files->file_lock);
2151                 for ( ; set ; i++, set >>= 1) {
2152                         if (set & 1) {
2153                                 file = fget(i);
2154                                 if (!file)
2155                                         continue;
2156                                 if (file_has_perm(current,
2157                                                   file,
2158                                                   file_to_av(file))) {
2159                                         sys_close(i);
2160                                         fd = get_unused_fd();
2161                                         if (fd != i) {
2162                                                 if (fd >= 0)
2163                                                         put_unused_fd(fd);
2164                                                 fput(file);
2165                                                 continue;
2166                                         }
2167                                         if (devnull) {
2168                                                 get_file(devnull);
2169                                         } else {
2170                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2171                                                 if (IS_ERR(devnull)) {
2172                                                         devnull = NULL;
2173                                                         put_unused_fd(fd);
2174                                                         fput(file);
2175                                                         continue;
2176                                                 }
2177                                         }
2178                                         fd_install(fd, devnull);
2179                                 }
2180                                 fput(file);
2181                         }
2182                 }
2183                 spin_lock(&files->file_lock);
2184
2185         }
2186         spin_unlock(&files->file_lock);
2187 }
2188
2189 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2190 {
2191         struct task_security_struct *tsec;
2192         struct bprm_security_struct *bsec;
2193         u32 sid;
2194         int rc;
2195
2196         secondary_ops->bprm_apply_creds(bprm, unsafe);
2197
2198         tsec = current->security;
2199
2200         bsec = bprm->security;
2201         sid = bsec->sid;
2202
2203         tsec->osid = tsec->sid;
2204         bsec->unsafe = 0;
2205         if (tsec->sid != sid) {
2206                 /* Check for shared state.  If not ok, leave SID
2207                    unchanged and kill. */
2208                 if (unsafe & LSM_UNSAFE_SHARE) {
2209                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2210                                         PROCESS__SHARE, NULL);
2211                         if (rc) {
2212                                 bsec->unsafe = 1;
2213                                 return;
2214                         }
2215                 }
2216
2217                 /* Check for ptracing, and update the task SID if ok.
2218                    Otherwise, leave SID unchanged and kill. */
2219                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2220                         struct task_struct *tracer;
2221                         struct task_security_struct *sec;
2222                         u32 ptsid = 0;
2223
2224                         rcu_read_lock();
2225                         tracer = tracehook_tracer_task(current);
2226                         if (likely(tracer != NULL)) {
2227                                 sec = tracer->security;
2228                                 ptsid = sec->sid;
2229                         }
2230                         rcu_read_unlock();
2231
2232                         if (ptsid != 0) {
2233                                 rc = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
2234                                                   PROCESS__PTRACE, NULL);
2235                                 if (rc) {
2236                                         bsec->unsafe = 1;
2237                                         return;
2238                                 }
2239                         }
2240                 }
2241                 tsec->sid = sid;
2242         }
2243 }
2244
2245 /*
2246  * called after apply_creds without the task lock held
2247  */
2248 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2249 {
2250         struct task_security_struct *tsec;
2251         struct rlimit *rlim, *initrlim;
2252         struct itimerval itimer;
2253         struct bprm_security_struct *bsec;
2254         int rc, i;
2255
2256         tsec = current->security;
2257         bsec = bprm->security;
2258
2259         if (bsec->unsafe) {
2260                 force_sig_specific(SIGKILL, current);
2261                 return;
2262         }
2263         if (tsec->osid == tsec->sid)
2264                 return;
2265
2266         /* Close files for which the new task SID is not authorized. */
2267         flush_unauthorized_files(current->files);
2268
2269         /* Check whether the new SID can inherit signal state
2270            from the old SID.  If not, clear itimers to avoid
2271            subsequent signal generation and flush and unblock
2272            signals. This must occur _after_ the task SID has
2273           been updated so that any kill done after the flush
2274           will be checked against the new SID. */
2275         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2276                           PROCESS__SIGINH, NULL);
2277         if (rc) {
2278                 memset(&itimer, 0, sizeof itimer);
2279                 for (i = 0; i < 3; i++)
2280                         do_setitimer(i, &itimer, NULL);
2281                 flush_signals(current);
2282                 spin_lock_irq(&current->sighand->siglock);
2283                 flush_signal_handlers(current, 1);
2284                 sigemptyset(&current->blocked);
2285                 recalc_sigpending();
2286                 spin_unlock_irq(&current->sighand->siglock);
2287         }
2288
2289         /* Always clear parent death signal on SID transitions. */
2290         current->pdeath_signal = 0;
2291
2292         /* Check whether the new SID can inherit resource limits
2293            from the old SID.  If not, reset all soft limits to
2294            the lower of the current task's hard limit and the init
2295            task's soft limit.  Note that the setting of hard limits
2296            (even to lower them) can be controlled by the setrlimit
2297            check. The inclusion of the init task's soft limit into
2298            the computation is to avoid resetting soft limits higher
2299            than the default soft limit for cases where the default
2300            is lower than the hard limit, e.g. RLIMIT_CORE or
2301            RLIMIT_STACK.*/
2302         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2303                           PROCESS__RLIMITINH, NULL);
2304         if (rc) {
2305                 for (i = 0; i < RLIM_NLIMITS; i++) {
2306                         rlim = current->signal->rlim + i;
2307                         initrlim = init_task.signal->rlim+i;
2308                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2309                 }
2310                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2311                         /*
2312                          * This will cause RLIMIT_CPU calculations
2313                          * to be refigured.
2314                          */
2315                         current->it_prof_expires = jiffies_to_cputime(1);
2316                 }
2317         }
2318
2319         /* Wake up the parent if it is waiting so that it can
2320            recheck wait permission to the new task SID. */
2321         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2322 }
2323
2324 /* superblock security operations */
2325
2326 static int selinux_sb_alloc_security(struct super_block *sb)
2327 {
2328         return superblock_alloc_security(sb);
2329 }
2330
2331 static void selinux_sb_free_security(struct super_block *sb)
2332 {
2333         superblock_free_security(sb);
2334 }
2335
2336 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2337 {
2338         if (plen > olen)
2339                 return 0;
2340
2341         return !memcmp(prefix, option, plen);
2342 }
2343
2344 static inline int selinux_option(char *option, int len)
2345 {
2346         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2347                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2348                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2349                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len));
2350 }
2351
2352 static inline void take_option(char **to, char *from, int *first, int len)
2353 {
2354         if (!*first) {
2355                 **to = ',';
2356                 *to += 1;
2357         } else
2358                 *first = 0;
2359         memcpy(*to, from, len);
2360         *to += len;
2361 }
2362
2363 static inline void take_selinux_option(char **to, char *from, int *first,
2364                                        int len)
2365 {
2366         int current_size = 0;
2367
2368         if (!*first) {
2369                 **to = '|';
2370                 *to += 1;
2371         } else
2372                 *first = 0;
2373
2374         while (current_size < len) {
2375                 if (*from != '"') {
2376                         **to = *from;
2377                         *to += 1;
2378                 }
2379                 from += 1;
2380                 current_size += 1;
2381         }
2382 }
2383
2384 static int selinux_sb_copy_data(char *orig, char *copy)
2385 {
2386         int fnosec, fsec, rc = 0;
2387         char *in_save, *in_curr, *in_end;
2388         char *sec_curr, *nosec_save, *nosec;
2389         int open_quote = 0;
2390
2391         in_curr = orig;
2392         sec_curr = copy;
2393
2394         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2395         if (!nosec) {
2396                 rc = -ENOMEM;
2397                 goto out;
2398         }
2399
2400         nosec_save = nosec;
2401         fnosec = fsec = 1;
2402         in_save = in_end = orig;
2403
2404         do {
2405                 if (*in_end == '"')
2406                         open_quote = !open_quote;
2407                 if ((*in_end == ',' && open_quote == 0) ||
2408                                 *in_end == '\0') {
2409                         int len = in_end - in_curr;
2410
2411                         if (selinux_option(in_curr, len))
2412                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2413                         else
2414                                 take_option(&nosec, in_curr, &fnosec, len);
2415
2416                         in_curr = in_end + 1;
2417                 }
2418         } while (*in_end++);
2419
2420         strcpy(in_save, nosec_save);
2421         free_page((unsigned long)nosec_save);
2422 out:
2423         return rc;
2424 }
2425
2426 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2427 {
2428         struct avc_audit_data ad;
2429         int rc;
2430
2431         rc = superblock_doinit(sb, data);
2432         if (rc)
2433                 return rc;
2434
2435         AVC_AUDIT_DATA_INIT(&ad, FS);
2436         ad.u.fs.path.dentry = sb->s_root;
2437         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2438 }
2439
2440 static int selinux_sb_statfs(struct dentry *dentry)
2441 {
2442         struct avc_audit_data ad;
2443
2444         AVC_AUDIT_DATA_INIT(&ad, FS);
2445         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2446         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2447 }
2448
2449 static int selinux_mount(char *dev_name,
2450                          struct path *path,
2451                          char *type,
2452                          unsigned long flags,
2453                          void *data)
2454 {
2455         int rc;
2456
2457         rc = secondary_ops->sb_mount(dev_name, path, type, flags, data);
2458         if (rc)
2459                 return rc;
2460
2461         if (flags & MS_REMOUNT)
2462                 return superblock_has_perm(current, path->mnt->mnt_sb,
2463                                            FILESYSTEM__REMOUNT, NULL);
2464         else
2465                 return dentry_has_perm(current, path->mnt, path->dentry,
2466                                        FILE__MOUNTON);
2467 }
2468
2469 static int selinux_umount(struct vfsmount *mnt, int flags)
2470 {
2471         int rc;
2472
2473         rc = secondary_ops->sb_umount(mnt, flags);
2474         if (rc)
2475                 return rc;
2476
2477         return superblock_has_perm(current, mnt->mnt_sb,
2478                                    FILESYSTEM__UNMOUNT, NULL);
2479 }
2480
2481 /* inode security operations */
2482
2483 static int selinux_inode_alloc_security(struct inode *inode)
2484 {
2485         return inode_alloc_security(inode);
2486 }
2487
2488 static void selinux_inode_free_security(struct inode *inode)
2489 {
2490         inode_free_security(inode);
2491 }
2492
2493 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2494                                        char **name, void **value,
2495                                        size_t *len)
2496 {
2497         struct task_security_struct *tsec;
2498         struct inode_security_struct *dsec;
2499         struct superblock_security_struct *sbsec;
2500         u32 newsid, clen;
2501         int rc;
2502         char *namep = NULL, *context;
2503
2504         tsec = current->security;
2505         dsec = dir->i_security;
2506         sbsec = dir->i_sb->s_security;
2507
2508         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2509                 newsid = tsec->create_sid;
2510         } else {
2511                 rc = security_transition_sid(tsec->sid, dsec->sid,
2512                                              inode_mode_to_security_class(inode->i_mode),
2513                                              &newsid);
2514                 if (rc) {
2515                         printk(KERN_WARNING "%s:  "
2516                                "security_transition_sid failed, rc=%d (dev=%s "
2517                                "ino=%ld)\n",
2518                                __func__,
2519                                -rc, inode->i_sb->s_id, inode->i_ino);
2520                         return rc;
2521                 }
2522         }
2523
2524         /* Possibly defer initialization to selinux_complete_init. */
2525         if (sbsec->initialized) {
2526                 struct inode_security_struct *isec = inode->i_security;
2527                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2528                 isec->sid = newsid;
2529                 isec->initialized = 1;
2530         }
2531
2532         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2533                 return -EOPNOTSUPP;
2534
2535         if (name) {
2536                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2537                 if (!namep)
2538                         return -ENOMEM;
2539                 *name = namep;
2540         }
2541
2542         if (value && len) {
2543                 rc = security_sid_to_context_force(newsid, &context, &clen);
2544                 if (rc) {
2545                         kfree(namep);
2546                         return rc;
2547                 }
2548                 *value = context;
2549                 *len = clen;
2550         }
2551
2552         return 0;
2553 }
2554
2555 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2556 {
2557         return may_create(dir, dentry, SECCLASS_FILE);
2558 }
2559
2560 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2561 {
2562         int rc;
2563
2564         rc = secondary_ops->inode_link(old_dentry, dir, new_dentry);
2565         if (rc)
2566                 return rc;
2567         return may_link(dir, old_dentry, MAY_LINK);
2568 }
2569
2570 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2571 {
2572         int rc;
2573
2574         rc = secondary_ops->inode_unlink(dir, dentry);
2575         if (rc)
2576                 return rc;
2577         return may_link(dir, dentry, MAY_UNLINK);
2578 }
2579
2580 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2581 {
2582         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2583 }
2584
2585 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2586 {
2587         return may_create(dir, dentry, SECCLASS_DIR);
2588 }
2589
2590 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2591 {
2592         return may_link(dir, dentry, MAY_RMDIR);
2593 }
2594
2595 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2596 {
2597         int rc;
2598
2599         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2600         if (rc)
2601                 return rc;
2602
2603         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2604 }
2605
2606 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2607                                 struct inode *new_inode, struct dentry *new_dentry)
2608 {
2609         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2610 }
2611
2612 static int selinux_inode_readlink(struct dentry *dentry)
2613 {
2614         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2615 }
2616
2617 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2618 {
2619         int rc;
2620
2621         rc = secondary_ops->inode_follow_link(dentry, nameidata);
2622         if (rc)
2623                 return rc;
2624         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2625 }
2626
2627 static int selinux_inode_permission(struct inode *inode, int mask)
2628 {
2629         int rc;
2630
2631         rc = secondary_ops->inode_permission(inode, mask);
2632         if (rc)
2633                 return rc;
2634
2635         if (!mask) {
2636                 /* No permission to check.  Existence test. */
2637                 return 0;
2638         }
2639
2640         return inode_has_perm(current, inode,
2641                                open_file_mask_to_av(inode->i_mode, mask), NULL);
2642 }
2643
2644 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2645 {
2646         int rc;
2647
2648         rc = secondary_ops->inode_setattr(dentry, iattr);
2649         if (rc)
2650                 return rc;
2651
2652         if (iattr->ia_valid & ATTR_FORCE)
2653                 return 0;
2654
2655         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2656                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2657                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2658
2659         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2660 }
2661
2662 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2663 {
2664         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2665 }
2666
2667 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2668 {
2669         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2670                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2671                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2672                         if (!capable(CAP_SETFCAP))
2673                                 return -EPERM;
2674                 } else if (!capable(CAP_SYS_ADMIN)) {
2675                         /* A different attribute in the security namespace.
2676                            Restrict to administrator. */
2677                         return -EPERM;
2678                 }
2679         }
2680
2681         /* Not an attribute we recognize, so just check the
2682            ordinary setattr permission. */
2683         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2684 }
2685
2686 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2687                                   const void *value, size_t size, int flags)
2688 {
2689         struct task_security_struct *tsec = current->security;
2690         struct inode *inode = dentry->d_inode;
2691         struct inode_security_struct *isec = inode->i_security;
2692         struct superblock_security_struct *sbsec;
2693         struct avc_audit_data ad;
2694         u32 newsid;
2695         int rc = 0;
2696
2697         if (strcmp(name, XATTR_NAME_SELINUX))
2698                 return selinux_inode_setotherxattr(dentry, name);
2699
2700         sbsec = inode->i_sb->s_security;
2701         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2702                 return -EOPNOTSUPP;
2703
2704         if (!is_owner_or_cap(inode))
2705                 return -EPERM;
2706
2707         AVC_AUDIT_DATA_INIT(&ad, FS);
2708         ad.u.fs.path.dentry = dentry;
2709
2710         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2711                           FILE__RELABELFROM, &ad);
2712         if (rc)
2713                 return rc;
2714
2715         rc = security_context_to_sid(value, size, &newsid);
2716         if (rc == -EINVAL) {
2717                 if (!capable(CAP_MAC_ADMIN))
2718                         return rc;
2719                 rc = security_context_to_sid_force(value, size, &newsid);
2720         }
2721         if (rc)
2722                 return rc;
2723
2724         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2725                           FILE__RELABELTO, &ad);
2726         if (rc)
2727                 return rc;
2728
2729         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2730                                           isec->sclass);
2731         if (rc)
2732                 return rc;
2733
2734         return avc_has_perm(newsid,
2735                             sbsec->sid,
2736                             SECCLASS_FILESYSTEM,
2737                             FILESYSTEM__ASSOCIATE,
2738                             &ad);
2739 }
2740
2741 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2742                                         const void *value, size_t size,
2743                                         int flags)
2744 {
2745         struct inode *inode = dentry->d_inode;
2746         struct inode_security_struct *isec = inode->i_security;
2747         u32 newsid;
2748         int rc;
2749
2750         if (strcmp(name, XATTR_NAME_SELINUX)) {
2751                 /* Not an attribute we recognize, so nothing to do. */
2752                 return;
2753         }
2754
2755         rc = security_context_to_sid_force(value, size, &newsid);
2756         if (rc) {
2757                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2758                        "for (%s, %lu), rc=%d\n",
2759                        inode->i_sb->s_id, inode->i_ino, -rc);
2760                 return;
2761         }
2762
2763         isec->sid = newsid;
2764         return;
2765 }
2766
2767 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2768 {
2769         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2770 }
2771
2772 static int selinux_inode_listxattr(struct dentry *dentry)
2773 {
2774         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2775 }
2776
2777 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2778 {
2779         if (strcmp(name, XATTR_NAME_SELINUX))
2780                 return selinux_inode_setotherxattr(dentry, name);
2781
2782         /* No one is allowed to remove a SELinux security label.
2783            You can change the label, but all data must be labeled. */
2784         return -EACCES;
2785 }
2786
2787 /*
2788  * Copy the inode security context value to the user.
2789  *
2790  * Permission check is handled by selinux_inode_getxattr hook.
2791  */
2792 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2793 {
2794         u32 size;
2795         int error;
2796         char *context = NULL;
2797         struct task_security_struct *tsec = current->security;
2798         struct inode_security_struct *isec = inode->i_security;
2799
2800         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2801                 return -EOPNOTSUPP;
2802
2803         /*
2804          * If the caller has CAP_MAC_ADMIN, then get the raw context
2805          * value even if it is not defined by current policy; otherwise,
2806          * use the in-core value under current policy.
2807          * Use the non-auditing forms of the permission checks since
2808          * getxattr may be called by unprivileged processes commonly
2809          * and lack of permission just means that we fall back to the
2810          * in-core context value, not a denial.
2811          */
2812         error = secondary_ops->capable(current, CAP_MAC_ADMIN);
2813         if (!error)
2814                 error = avc_has_perm_noaudit(tsec->sid, tsec->sid,
2815                                              SECCLASS_CAPABILITY2,
2816                                              CAPABILITY2__MAC_ADMIN,
2817                                              0,
2818                                              NULL);
2819         if (!error)
2820                 error = security_sid_to_context_force(isec->sid, &context,
2821                                                       &size);
2822         else
2823                 error = security_sid_to_context(isec->sid, &context, &size);
2824         if (error)
2825                 return error;
2826         error = size;
2827         if (alloc) {
2828                 *buffer = context;
2829                 goto out_nofree;
2830         }
2831         kfree(context);
2832 out_nofree:
2833         return error;
2834 }
2835
2836 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2837                                      const void *value, size_t size, int flags)
2838 {
2839         struct inode_security_struct *isec = inode->i_security;
2840         u32 newsid;
2841         int rc;
2842
2843         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2844                 return -EOPNOTSUPP;
2845
2846         if (!value || !size)
2847                 return -EACCES;
2848
2849         rc = security_context_to_sid((void *)value, size, &newsid);
2850         if (rc)
2851                 return rc;
2852
2853         isec->sid = newsid;
2854         return 0;
2855 }
2856
2857 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2858 {
2859         const int len = sizeof(XATTR_NAME_SELINUX);
2860         if (buffer && len <= buffer_size)
2861                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2862         return len;
2863 }
2864
2865 static int selinux_inode_need_killpriv(struct dentry *dentry)
2866 {
2867         return secondary_ops->inode_need_killpriv(dentry);
2868 }
2869
2870 static int selinux_inode_killpriv(struct dentry *dentry)
2871 {
2872         return secondary_ops->inode_killpriv(dentry);
2873 }
2874
2875 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2876 {
2877         struct inode_security_struct *isec = inode->i_security;
2878         *secid = isec->sid;
2879 }
2880
2881 /* file security operations */
2882
2883 static int selinux_revalidate_file_permission(struct file *file, int mask)
2884 {
2885         int rc;
2886         struct inode *inode = file->f_path.dentry->d_inode;
2887
2888         if (!mask) {
2889                 /* No permission to check.  Existence test. */
2890                 return 0;
2891         }
2892
2893         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2894         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2895                 mask |= MAY_APPEND;
2896
2897         rc = file_has_perm(current, file,
2898                            file_mask_to_av(inode->i_mode, mask));
2899         if (rc)
2900                 return rc;
2901
2902         return selinux_netlbl_inode_permission(inode, mask);
2903 }
2904
2905 static int selinux_file_permission(struct file *file, int mask)
2906 {
2907         struct inode *inode = file->f_path.dentry->d_inode;
2908         struct task_security_struct *tsec = current->security;
2909         struct file_security_struct *fsec = file->f_security;
2910         struct inode_security_struct *isec = inode->i_security;
2911
2912         if (!mask) {
2913                 /* No permission to check.  Existence test. */
2914                 return 0;
2915         }
2916
2917         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2918             && fsec->pseqno == avc_policy_seqno())
2919                 return selinux_netlbl_inode_permission(inode, mask);
2920
2921         return selinux_revalidate_file_permission(file, mask);
2922 }
2923
2924 static int selinux_file_alloc_security(struct file *file)
2925 {
2926         return file_alloc_security(file);
2927 }
2928
2929 static void selinux_file_free_security(struct file *file)
2930 {
2931         file_free_security(file);
2932 }
2933
2934 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2935                               unsigned long arg)
2936 {
2937         u32 av = 0;
2938
2939         if (_IOC_DIR(cmd) & _IOC_WRITE)
2940                 av |= FILE__WRITE;
2941         if (_IOC_DIR(cmd) & _IOC_READ)
2942                 av |= FILE__READ;
2943         if (!av)
2944                 av = FILE__IOCTL;
2945
2946         return file_has_perm(current, file, av);
2947 }
2948
2949 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2950 {
2951 #ifndef CONFIG_PPC32
2952         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2953                 /*
2954                  * We are making executable an anonymous mapping or a
2955                  * private file mapping that will also be writable.
2956                  * This has an additional check.
2957                  */
2958                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2959                 if (rc)
2960                         return rc;
2961         }
2962 #endif
2963
2964         if (file) {
2965                 /* read access is always possible with a mapping */
2966                 u32 av = FILE__READ;
2967
2968                 /* write access only matters if the mapping is shared */
2969                 if (shared && (prot & PROT_WRITE))
2970                         av |= FILE__WRITE;
2971
2972                 if (prot & PROT_EXEC)
2973                         av |= FILE__EXECUTE;
2974
2975                 return file_has_perm(current, file, av);
2976         }
2977         return 0;
2978 }
2979
2980 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2981                              unsigned long prot, unsigned long flags,
2982                              unsigned long addr, unsigned long addr_only)
2983 {
2984         int rc = 0;
2985         u32 sid = ((struct task_security_struct *)(current->security))->sid;
2986
2987         if (addr < mmap_min_addr)
2988                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2989                                   MEMPROTECT__MMAP_ZERO, NULL);
2990         if (rc || addr_only)
2991                 return rc;
2992
2993         if (selinux_checkreqprot)
2994                 prot = reqprot;
2995
2996         return file_map_prot_check(file, prot,
2997                                    (flags & MAP_TYPE) == MAP_SHARED);
2998 }
2999
3000 static int selinux_file_mprotect(struct vm_area_struct *vma,
3001                                  unsigned long reqprot,
3002                                  unsigned long prot)
3003 {
3004         int rc;
3005
3006         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
3007         if (rc)
3008                 return rc;
3009
3010         if (selinux_checkreqprot)
3011                 prot = reqprot;
3012
3013 #ifndef CONFIG_PPC32
3014         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3015                 rc = 0;
3016                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3017                     vma->vm_end <= vma->vm_mm->brk) {
3018                         rc = task_has_perm(current, current,
3019                                            PROCESS__EXECHEAP);
3020                 } else if (!vma->vm_file &&
3021                            vma->vm_start <= vma->vm_mm->start_stack &&
3022                            vma->vm_end >= vma->vm_mm->start_stack) {
3023                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
3024                 } else if (vma->vm_file && vma->anon_vma) {
3025                         /*
3026                          * We are making executable a file mapping that has
3027                          * had some COW done. Since pages might have been
3028                          * written, check ability to execute the possibly
3029                          * modified content.  This typically should only
3030                          * occur for text relocations.
3031                          */
3032                         rc = file_has_perm(current, vma->vm_file,
3033                                            FILE__EXECMOD);
3034                 }
3035                 if (rc)
3036                         return rc;
3037         }
3038 #endif
3039
3040         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3041 }
3042
3043 static int selinux_file_lock(struct file *file, unsigned int cmd)
3044 {
3045         return file_has_perm(current, file, FILE__LOCK);
3046 }
3047
3048 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3049                               unsigned long arg)
3050 {
3051         int err = 0;
3052
3053         switch (cmd) {
3054         case F_SETFL:
3055                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3056                         err = -EINVAL;
3057                         break;
3058                 }
3059
3060                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3061                         err = file_has_perm(current, file, FILE__WRITE);
3062                         break;
3063                 }
3064                 /* fall through */
3065         case F_SETOWN:
3066         case F_SETSIG:
3067         case F_GETFL:
3068         case F_GETOWN:
3069         case F_GETSIG:
3070                 /* Just check FD__USE permission */
3071                 err = file_has_perm(current, file, 0);
3072                 break;
3073         case F_GETLK:
3074         case F_SETLK:
3075         case F_SETLKW:
3076 #if BITS_PER_LONG == 32
3077         case F_GETLK64:
3078         case F_SETLK64:
3079         case F_SETLKW64:
3080 #endif
3081                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3082                         err = -EINVAL;
3083                         break;
3084                 }
3085                 err = file_has_perm(current, file, FILE__LOCK);
3086                 break;
3087         }
3088
3089         return err;
3090 }
3091
3092 static int selinux_file_set_fowner(struct file *file)
3093 {
3094         struct task_security_struct *tsec;
3095         struct file_security_struct *fsec;
3096
3097         tsec = current->security;
3098         fsec = file->f_security;
3099         fsec->fown_sid = tsec->sid;
3100
3101         return 0;
3102 }
3103
3104 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3105                                        struct fown_struct *fown, int signum)
3106 {
3107         struct file *file;
3108         u32 perm;
3109         struct task_security_struct *tsec;
3110         struct file_security_struct *fsec;
3111
3112         /* struct fown_struct is never outside the context of a struct file */
3113         file = container_of(fown, struct file, f_owner);
3114
3115         tsec = tsk->security;
3116         fsec = file->f_security;
3117
3118         if (!signum)
3119                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3120         else
3121                 perm = signal_to_av(signum);
3122
3123         return avc_has_perm(fsec->fown_sid, tsec->sid,
3124                             SECCLASS_PROCESS, perm, NULL);
3125 }
3126
3127 static int selinux_file_receive(struct file *file)
3128 {
3129         return file_has_perm(current, file, file_to_av(file));
3130 }
3131
3132 static int selinux_dentry_open(struct file *file)
3133 {
3134         struct file_security_struct *fsec;
3135         struct inode *inode;
3136         struct inode_security_struct *isec;
3137         inode = file->f_path.dentry->d_inode;
3138         fsec = file->f_security;
3139         isec = inode->i_security;
3140         /*
3141          * Save inode label and policy sequence number
3142          * at open-time so that selinux_file_permission
3143          * can determine whether revalidation is necessary.
3144          * Task label is already saved in the file security
3145          * struct as its SID.
3146          */
3147         fsec->isid = isec->sid;
3148         fsec->pseqno = avc_policy_seqno();
3149         /*
3150          * Since the inode label or policy seqno may have changed
3151          * between the selinux_inode_permission check and the saving
3152          * of state above, recheck that access is still permitted.
3153          * Otherwise, access might never be revalidated against the
3154          * new inode label or new policy.
3155          * This check is not redundant - do not remove.
3156          */
3157         return inode_has_perm(current, inode, file_to_av(file), NULL);
3158 }
3159
3160 /* task security operations */
3161
3162 static int selinux_task_create(unsigned long clone_flags)
3163 {
3164         int rc;
3165
3166         rc = secondary_ops->task_create(clone_flags);
3167         if (rc)
3168                 return rc;
3169
3170         return task_has_perm(current, current, PROCESS__FORK);
3171 }
3172
3173 static int selinux_task_alloc_security(struct task_struct *tsk)
3174 {
3175         struct task_security_struct *tsec1, *tsec2;
3176         int rc;
3177
3178         tsec1 = current->security;
3179
3180         rc = task_alloc_security(tsk);
3181         if (rc)
3182                 return rc;
3183         tsec2 = tsk->security;
3184
3185         tsec2->osid = tsec1->osid;
3186         tsec2->sid = tsec1->sid;
3187
3188         /* Retain the exec, fs, key, and sock SIDs across fork */
3189         tsec2->exec_sid = tsec1->exec_sid;
3190         tsec2->create_sid = tsec1->create_sid;
3191         tsec2->keycreate_sid = tsec1->keycreate_sid;
3192         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3193
3194         return 0;
3195 }
3196
3197 static void selinux_task_free_security(struct task_struct *tsk)
3198 {
3199         task_free_security(tsk);
3200 }
3201
3202 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3203 {
3204         /* Since setuid only affects the current process, and
3205            since the SELinux controls are not based on the Linux
3206            identity attributes, SELinux does not need to control
3207            this operation.  However, SELinux does control the use
3208            of the CAP_SETUID and CAP_SETGID capabilities using the
3209            capable hook. */
3210         return 0;
3211 }
3212
3213 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3214 {
3215         return secondary_ops->task_post_setuid(id0, id1, id2, flags);
3216 }
3217
3218 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3219 {
3220         /* See the comment for setuid above. */
3221         return 0;
3222 }
3223
3224 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3225 {
3226         return task_has_perm(current, p, PROCESS__SETPGID);
3227 }
3228
3229 static int selinux_task_getpgid(struct task_struct *p)
3230 {
3231         return task_has_perm(current, p, PROCESS__GETPGID);
3232 }
3233
3234 static int selinux_task_getsid(struct task_struct *p)
3235 {
3236         return task_has_perm(current, p, PROCESS__GETSESSION);
3237 }
3238
3239 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3240 {
3241         struct task_security_struct *tsec = p->security;
3242         *secid = tsec->sid;
3243 }
3244
3245 static int selinux_task_setgroups(struct group_info *group_info)
3246 {
3247         /* See the comment for setuid above. */
3248         return 0;
3249 }
3250
3251 static int selinux_task_setnice(struct task_struct *p, int nice)
3252 {
3253         int rc;
3254
3255         rc = secondary_ops->task_setnice(p, nice);
3256         if (rc)
3257                 return rc;
3258
3259         return task_has_perm(current, p, PROCESS__SETSCHED);
3260 }
3261
3262 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3263 {
3264         int rc;
3265
3266         rc = secondary_ops->task_setioprio(p, ioprio);
3267         if (rc)
3268                 return rc;
3269
3270         return task_has_perm(current, p, PROCESS__SETSCHED);
3271 }
3272
3273 static int selinux_task_getioprio(struct task_struct *p)
3274 {
3275         return task_has_perm(current, p, PROCESS__GETSCHED);
3276 }
3277
3278 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3279 {
3280         struct rlimit *old_rlim = current->signal->rlim + resource;
3281         int rc;
3282
3283         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3284         if (rc)
3285                 return rc;
3286
3287         /* Control the ability to change the hard limit (whether
3288            lowering or raising it), so that the hard limit can
3289            later be used as a safe reset point for the soft limit
3290            upon context transitions. See selinux_bprm_apply_creds. */
3291         if (old_rlim->rlim_max != new_rlim->rlim_max)
3292                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3293
3294         return 0;
3295 }
3296
3297 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3298 {
3299         int rc;
3300
3301         rc = secondary_ops->task_setscheduler(p, policy, lp);
3302         if (rc)
3303                 return rc;
3304
3305         return task_has_perm(current, p, PROCESS__SETSCHED);
3306 }
3307
3308 static int selinux_task_getscheduler(struct task_struct *p)
3309 {
3310         return task_has_perm(current, p, PROCESS__GETSCHED);
3311 }
3312
3313 static int selinux_task_movememory(struct task_struct *p)
3314 {
3315         return task_has_perm(current, p, PROCESS__SETSCHED);
3316 }
3317
3318 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3319                                 int sig, u32 secid)
3320 {
3321         u32 perm;
3322         int rc;
3323         struct task_security_struct *tsec;
3324
3325         rc = secondary_ops->task_kill(p, info, sig, secid);
3326         if (rc)
3327                 return rc;
3328
3329         if (!sig)
3330                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3331         else
3332                 perm = signal_to_av(sig);
3333         tsec = p->security;
3334         if (secid)
3335                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3336         else
3337                 rc = task_has_perm(current, p, perm);
3338         return rc;
3339 }
3340
3341 static int selinux_task_prctl(int option,
3342                               unsigned long arg2,
3343                               unsigned long arg3,
3344                               unsigned long arg4,
3345                               unsigned long arg5,
3346                               long *rc_p)
3347 {
3348         /* The current prctl operations do not appear to require
3349            any SELinux controls since they merely observe or modify
3350            the state of the current process. */
3351         return secondary_ops->task_prctl(option, arg2, arg3, arg4, arg5, rc_p);
3352 }
3353
3354 static int selinux_task_wait(struct task_struct *p)
3355 {
3356         return task_has_perm(p, current, PROCESS__SIGCHLD);
3357 }
3358
3359 static void selinux_task_reparent_to_init(struct task_struct *p)
3360 {
3361         struct task_security_struct *tsec;
3362
3363         secondary_ops->task_reparent_to_init(p);
3364
3365         tsec = p->security;
3366         tsec->osid = tsec->sid;
3367         tsec->sid = SECINITSID_KERNEL;
3368         return;
3369 }
3370
3371 static void selinux_task_to_inode(struct task_struct *p,
3372                                   struct inode *inode)
3373 {
3374         struct task_security_struct *tsec = p->security;
3375         struct inode_security_struct *isec = inode->i_security;
3376
3377         isec->sid = tsec->sid;
3378         isec->initialized = 1;
3379         return;
3380 }
3381
3382 /* Returns error only if unable to parse addresses */
3383 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3384                         struct avc_audit_data *ad, u8 *proto)
3385 {
3386         int offset, ihlen, ret = -EINVAL;
3387         struct iphdr _iph, *ih;
3388
3389         offset = skb_network_offset(skb);
3390         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3391         if (ih == NULL)
3392                 goto out;
3393
3394         ihlen = ih->ihl * 4;
3395         if (ihlen < sizeof(_iph))
3396                 goto out;
3397
3398         ad->u.net.v4info.saddr = ih->saddr;
3399         ad->u.net.v4info.daddr = ih->daddr;
3400         ret = 0;
3401
3402         if (proto)
3403                 *proto = ih->protocol;
3404
3405         switch (ih->protocol) {
3406         case IPPROTO_TCP: {
3407                 struct tcphdr _tcph, *th;
3408
3409                 if (ntohs(ih->frag_off) & IP_OFFSET)
3410                         break;
3411
3412                 offset += ihlen;
3413                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3414                 if (th == NULL)
3415                         break;
3416
3417                 ad->u.net.sport = th->source;
3418                 ad->u.net.dport = th->dest;
3419                 break;
3420         }
3421
3422         case IPPROTO_UDP: {
3423                 struct udphdr _udph, *uh;
3424
3425                 if (ntohs(ih->frag_off) & IP_OFFSET)
3426                         break;
3427
3428                 offset += ihlen;
3429                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3430                 if (uh == NULL)
3431                         break;
3432
3433                 ad->u.net.sport = uh->source;
3434                 ad->u.net.dport = uh->dest;
3435                 break;
3436         }
3437
3438         case IPPROTO_DCCP: {
3439                 struct dccp_hdr _dccph, *dh;
3440
3441                 if (ntohs(ih->frag_off) & IP_OFFSET)
3442                         break;
3443
3444                 offset += ihlen;
3445                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3446                 if (dh == NULL)
3447                         break;
3448
3449                 ad->u.net.sport = dh->dccph_sport;
3450                 ad->u.net.dport = dh->dccph_dport;
3451                 break;
3452         }
3453
3454         default:
3455                 break;
3456         }
3457 out:
3458         return ret;
3459 }
3460
3461 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3462
3463 /* Returns error only if unable to parse addresses */
3464 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3465                         struct avc_audit_data *ad, u8 *proto)
3466 {
3467         u8 nexthdr;
3468         int ret = -EINVAL, offset;
3469         struct ipv6hdr _ipv6h, *ip6;
3470
3471         offset = skb_network_offset(skb);
3472         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3473         if (ip6 == NULL)
3474                 goto out;
3475
3476         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3477         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3478         ret = 0;
3479
3480         nexthdr = ip6->nexthdr;
3481         offset += sizeof(_ipv6h);
3482         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3483         if (offset < 0)
3484                 goto out;
3485
3486         if (proto)
3487                 *proto = nexthdr;
3488
3489         switch (nexthdr) {
3490         case IPPROTO_TCP: {
3491                 struct tcphdr _tcph, *th;
3492
3493                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3494                 if (th == NULL)
3495                         break;
3496
3497                 ad->u.net.sport = th->source;
3498                 ad->u.net.dport = th->dest;
3499                 break;
3500         }
3501
3502         case IPPROTO_UDP: {
3503                 struct udphdr _udph, *uh;
3504
3505                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3506                 if (uh == NULL)
3507                         break;
3508
3509                 ad->u.net.sport = uh->source;
3510                 ad->u.net.dport = uh->dest;
3511                 break;
3512         }
3513
3514         case IPPROTO_DCCP: {
3515                 struct dccp_hdr _dccph, *dh;
3516
3517                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3518                 if (dh == NULL)
3519                         break;
3520
3521                 ad->u.net.sport = dh->dccph_sport;
3522                 ad->u.net.dport = dh->dccph_dport;
3523                 break;
3524         }
3525
3526         /* includes fragments */
3527         default:
3528                 break;
3529         }
3530 out:
3531         return ret;
3532 }
3533
3534 #endif /* IPV6 */
3535
3536 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3537                              char **addrp, int src, u8 *proto)
3538 {
3539         int ret = 0;
3540
3541         switch (ad->u.net.family) {
3542         case PF_INET:
3543                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3544                 if (ret || !addrp)
3545                         break;
3546                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3547                                         &ad->u.net.v4info.daddr);
3548                 break;
3549
3550 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3551         case PF_INET6:
3552                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3553                 if (ret || !addrp)
3554                         break;
3555                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3556                                         &ad->u.net.v6info.daddr);
3557                 break;
3558 #endif  /* IPV6 */
3559         default:
3560                 break;
3561         }
3562
3563         if (unlikely(ret))
3564                 printk(KERN_WARNING
3565                        "SELinux: failure in selinux_parse_skb(),"
3566                        " unable to parse packet\n");
3567
3568         return ret;
3569 }
3570
3571 /**
3572  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3573  * @skb: the packet
3574  * @family: protocol family
3575  * @sid: the packet's peer label SID
3576  *
3577  * Description:
3578  * Check the various different forms of network peer labeling and determine
3579  * the peer label/SID for the packet; most of the magic actually occurs in
3580  * the security server function security_net_peersid_cmp().  The function
3581  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3582  * or -EACCES if @sid is invalid due to inconsistencies with the different
3583  * peer labels.
3584  *
3585  */
3586 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3587 {
3588         int err;
3589         u32 xfrm_sid;
3590         u32 nlbl_sid;
3591         u32 nlbl_type;
3592
3593         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3594         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3595
3596         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3597         if (unlikely(err)) {
3598                 printk(KERN_WARNING
3599                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3600                        " unable to determine packet's peer label\n");
3601                 return -EACCES;
3602         }
3603
3604         return 0;
3605 }
3606
3607 /* socket security operations */
3608 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3609                            u32 perms)
3610 {
3611         struct inode_security_struct *isec;
3612         struct task_security_struct *tsec;
3613         struct avc_audit_data ad;
3614         int err = 0;
3615
3616         tsec = task->security;
3617         isec = SOCK_INODE(sock)->i_security;
3618
3619         if (isec->sid == SECINITSID_KERNEL)
3620                 goto out;
3621
3622         AVC_AUDIT_DATA_INIT(&ad, NET);
3623         ad.u.net.sk = sock->sk;
3624         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3625
3626 out:
3627         return err;
3628 }
3629
3630 static int selinux_socket_create(int family, int type,
3631                                  int protocol, int kern)
3632 {
3633         int err = 0;
3634         struct task_security_struct *tsec;
3635         u32 newsid;
3636
3637         if (kern)
3638                 goto out;
3639
3640         tsec = current->security;
3641         newsid = tsec->sockcreate_sid ? : tsec->sid;
3642         err = avc_has_perm(tsec->sid, newsid,
3643                            socket_type_to_security_class(family, type,
3644                            protocol), SOCKET__CREATE, NULL);
3645
3646 out:
3647         return err;
3648 }
3649
3650 static int selinux_socket_post_create(struct socket *sock, int family,
3651                                       int type, int protocol, int kern)
3652 {
3653         int err = 0;
3654         struct inode_security_struct *isec;
3655         struct task_security_struct *tsec;
3656         struct sk_security_struct *sksec;
3657         u32 newsid;
3658
3659         isec = SOCK_INODE(sock)->i_security;
3660
3661         tsec = current->security;
3662         newsid = tsec->sockcreate_sid ? : tsec->sid;
3663         isec->sclass = socket_type_to_security_class(family, type, protocol);
3664         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3665         isec->initialized = 1;
3666
3667         if (sock->sk) {
3668                 sksec = sock->sk->sk_security;
3669                 sksec->sid = isec->sid;
3670                 sksec->sclass = isec->sclass;
3671                 err = selinux_netlbl_socket_post_create(sock);
3672         }
3673
3674         return err;
3675 }
3676
3677 /* Range of port numbers used to automatically bind.
3678    Need to determine whether we should perform a name_bind
3679    permission check between the socket and the port number. */
3680
3681 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3682 {
3683         u16 family;
3684         int err;
3685
3686         err = socket_has_perm(current, sock, SOCKET__BIND);
3687         if (err)
3688                 goto out;
3689
3690         /*
3691          * If PF_INET or PF_INET6, check name_bind permission for the port.
3692          * Multiple address binding for SCTP is not supported yet: we just
3693          * check the first address now.
3694          */
3695         family = sock->sk->sk_family;
3696         if (family == PF_INET || family == PF_INET6) {
3697                 char *addrp;
3698                 struct inode_security_struct *isec;
3699                 struct task_security_struct *tsec;
3700                 struct avc_audit_data ad;
3701                 struct sockaddr_in *addr4 = NULL;
3702                 struct sockaddr_in6 *addr6 = NULL;
3703                 unsigned short snum;
3704                 struct sock *sk = sock->sk;
3705                 u32 sid, node_perm;
3706
3707                 tsec = current->security;
3708                 isec = SOCK_INODE(sock)->i_security;
3709
3710                 if (family == PF_INET) {
3711                         addr4 = (struct sockaddr_in *)address;
3712                         snum = ntohs(addr4->sin_port);
3713                         addrp = (char *)&addr4->sin_addr.s_addr;
3714                 } else {
3715                         addr6 = (struct sockaddr_in6 *)address;
3716                         snum = ntohs(addr6->sin6_port);
3717                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3718                 }
3719
3720                 if (snum) {
3721                         int low, high;
3722
3723                         inet_get_local_port_range(&low, &high);
3724
3725                         if (snum < max(PROT_SOCK, low) || snum > high) {
3726                                 err = sel_netport_sid(sk->sk_protocol,
3727                                                       snum, &sid);
3728                                 if (err)
3729                                         goto out;
3730                                 AVC_AUDIT_DATA_INIT(&ad, NET);
3731                                 ad.u.net.sport = htons(snum);
3732                                 ad.u.net.family = family;
3733                                 err = avc_has_perm(isec->sid, sid,
3734                                                    isec->sclass,
3735                                                    SOCKET__NAME_BIND, &ad);
3736                                 if (err)
3737                                         goto out;
3738                         }
3739                 }
3740
3741                 switch (isec->sclass) {
3742                 case SECCLASS_TCP_SOCKET:
3743                         node_perm = TCP_SOCKET__NODE_BIND;
3744                         break;
3745
3746                 case SECCLASS_UDP_SOCKET:
3747                         node_perm = UDP_SOCKET__NODE_BIND;
3748                         break;
3749
3750                 case SECCLASS_DCCP_SOCKET:
3751                         node_perm = DCCP_SOCKET__NODE_BIND;
3752                         break;
3753
3754                 default:
3755                         node_perm = RAWIP_SOCKET__NODE_BIND;
3756                         break;
3757                 }
3758
3759                 err = sel_netnode_sid(addrp, family, &sid);
3760                 if (err)
3761                         goto out;
3762
3763                 AVC_AUDIT_DATA_INIT(&ad, NET);
3764                 ad.u.net.sport = htons(snum);
3765                 ad.u.net.family = family;
3766
3767                 if (family == PF_INET)
3768                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3769                 else
3770                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3771
3772                 err = avc_has_perm(isec->sid, sid,
3773                                    isec->sclass, node_perm, &ad);
3774                 if (err)
3775                         goto out;
3776         }
3777 out:
3778         return err;
3779 }
3780
3781 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3782 {
3783         struct inode_security_struct *isec;
3784         int err;
3785
3786         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3787         if (err)
3788                 return err;
3789
3790         /*
3791          * If a TCP or DCCP socket, check name_connect permission for the port.
3792          */
3793         isec = SOCK_INODE(sock)->i_security;
3794         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3795             isec->sclass == SECCLASS_DCCP_SOCKET) {
3796                 struct sock *sk = sock->sk;
3797                 struct avc_audit_data ad;
3798                 struct sockaddr_in *addr4 = NULL;
3799                 struct sockaddr_in6 *addr6 = NULL;
3800                 unsigned short snum;
3801                 u32 sid, perm;
3802
3803                 if (sk->sk_family == PF_INET) {
3804                         addr4 = (struct sockaddr_in *)address;
3805                         if (addrlen < sizeof(struct sockaddr_in))
3806                                 return -EINVAL;
3807                         snum = ntohs(addr4->sin_port);
3808                 } else {
3809                         addr6 = (struct sockaddr_in6 *)address;
3810                         if (addrlen < SIN6_LEN_RFC2133)
3811                                 return -EINVAL;
3812                         snum = ntohs(addr6->sin6_port);
3813                 }
3814
3815                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3816                 if (err)
3817                         goto out;
3818
3819                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3820                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3821
3822                 AVC_AUDIT_DATA_INIT(&ad, NET);
3823                 ad.u.net.dport = htons(snum);
3824                 ad.u.net.family = sk->sk_family;
3825                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3826                 if (err)
3827                         goto out;
3828         }
3829
3830 out:
3831         return err;
3832 }
3833
3834 static int selinux_socket_listen(struct socket *sock, int backlog)
3835 {
3836         return socket_has_perm(current, sock, SOCKET__LISTEN);
3837 }
3838
3839 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3840 {
3841         int err;
3842         struct inode_security_struct *isec;
3843         struct inode_security_struct *newisec;
3844
3845         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3846         if (err)
3847                 return err;
3848
3849         newisec = SOCK_INODE(newsock)->i_security;
3850
3851         isec = SOCK_INODE(sock)->i_security;
3852         newisec->sclass = isec->sclass;
3853         newisec->sid = isec->sid;
3854         newisec->initialized = 1;
3855
3856         return 0;
3857 }
3858
3859 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3860                                   int size)
3861 {
3862         int rc;
3863
3864         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3865         if (rc)
3866                 return rc;
3867
3868         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3869 }
3870
3871 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3872                                   int size, int flags)
3873 {
3874         return socket_has_perm(current, sock, SOCKET__READ);
3875 }
3876
3877 static int selinux_socket_getsockname(struct socket *sock)
3878 {
3879         return socket_has_perm(current, sock, SOCKET__GETATTR);
3880 }
3881
3882 static int selinux_socket_getpeername(struct socket *sock)
3883 {
3884         return socket_has_perm(current, sock, SOCKET__GETATTR);
3885 }
3886
3887 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
3888 {
3889         int err;
3890
3891         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3892         if (err)
3893                 return err;
3894
3895         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3896 }
3897
3898 static int selinux_socket_getsockopt(struct socket *sock, int level,
3899                                      int optname)
3900 {
3901         return socket_has_perm(current, sock, SOCKET__GETOPT);
3902 }
3903
3904 static int selinux_socket_shutdown(struct socket *sock, int how)
3905 {
3906         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3907 }
3908
3909 static int selinux_socket_unix_stream_connect(struct socket *sock,
3910                                               struct socket *other,
3911                                               struct sock *newsk)
3912 {
3913         struct sk_security_struct *ssec;
3914         struct inode_security_struct *isec;
3915         struct inode_security_struct *other_isec;
3916         struct avc_audit_data ad;
3917         int err;
3918
3919         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3920         if (err)
3921                 return err;
3922
3923         isec = SOCK_INODE(sock)->i_security;
3924         other_isec = SOCK_INODE(other)->i_security;
3925
3926         AVC_AUDIT_DATA_INIT(&ad, NET);
3927         ad.u.net.sk = other->sk;
3928
3929         err = avc_has_perm(isec->sid, other_isec->sid,
3930                            isec->sclass,
3931                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3932         if (err)
3933                 return err;
3934
3935         /* connecting socket */
3936         ssec = sock->sk->sk_security;
3937         ssec->peer_sid = other_isec->sid;
3938
3939         /* server child socket */
3940         ssec = newsk->sk_security;
3941         ssec->peer_sid = isec->sid;
3942         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3943
3944         return err;
3945 }
3946
3947 static int selinux_socket_unix_may_send(struct socket *sock,
3948                                         struct socket *other)
3949 {
3950         struct inode_security_struct *isec;
3951         struct inode_security_struct *other_isec;
3952         struct avc_audit_data ad;
3953         int err;
3954
3955         isec = SOCK_INODE(sock)->i_security;
3956         other_isec = SOCK_INODE(other)->i_security;
3957
3958         AVC_AUDIT_DATA_INIT(&ad, NET);
3959         ad.u.net.sk = other->sk;
3960
3961         err = avc_has_perm(isec->sid, other_isec->sid,
3962                            isec->sclass, SOCKET__SENDTO, &ad);
3963         if (err)
3964                 return err;
3965
3966         return 0;
3967 }
3968
3969 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3970                                     u32 peer_sid,
3971                                     struct avc_audit_data *ad)
3972 {
3973         int err;
3974         u32 if_sid;
3975         u32 node_sid;
3976
3977         err = sel_netif_sid(ifindex, &if_sid);
3978         if (err)
3979                 return err;
3980         err = avc_has_perm(peer_sid, if_sid,
3981                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3982         if (err)
3983                 return err;
3984
3985         err = sel_netnode_sid(addrp, family, &node_sid);
3986         if (err)
3987                 return err;
3988         return avc_has_perm(peer_sid, node_sid,
3989                             SECCLASS_NODE, NODE__RECVFROM, ad);
3990 }
3991
3992 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3993                                                 struct sk_buff *skb,
3994                                                 struct avc_audit_data *ad,
3995                                                 u16 family,
3996                                                 char *addrp)
3997 {
3998         int err;
3999         struct sk_security_struct *sksec = sk->sk_security;
4000         u16 sk_class;
4001         u32 netif_perm, node_perm, recv_perm;
4002         u32 port_sid, node_sid, if_sid, sk_sid;
4003
4004         sk_sid = sksec->sid;
4005         sk_class = sksec->sclass;
4006
4007         switch (sk_class) {
4008         case SECCLASS_UDP_SOCKET:
4009                 netif_perm = NETIF__UDP_RECV;
4010                 node_perm = NODE__UDP_RECV;
4011                 recv_perm = UDP_SOCKET__RECV_MSG;
4012                 break;
4013         case SECCLASS_TCP_SOCKET:
4014                 netif_perm = NETIF__TCP_RECV;
4015                 node_perm = NODE__TCP_RECV;
4016                 recv_perm = TCP_SOCKET__RECV_MSG;
4017                 break;
4018         case SECCLASS_DCCP_SOCKET:
4019                 netif_perm = NETIF__DCCP_RECV;
4020                 node_perm = NODE__DCCP_RECV;
4021                 recv_perm = DCCP_SOCKET__RECV_MSG;
4022                 break;
4023         default:
4024                 netif_perm = NETIF__RAWIP_RECV;
4025                 node_perm = NODE__RAWIP_RECV;
4026                 recv_perm = 0;
4027                 break;
4028         }
4029
4030         err = sel_netif_sid(skb->iif, &if_sid);
4031         if (err)
4032                 return err;
4033         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4034         if (err)
4035                 return err;
4036
4037         err = sel_netnode_sid(addrp, family, &node_sid);
4038         if (err)
4039                 return err;
4040         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4041         if (err)
4042                 return err;
4043
4044         if (!recv_perm)
4045                 return 0;
4046         err = sel_netport_sid(sk->sk_protocol,
4047                               ntohs(ad->u.net.sport), &port_sid);
4048         if (unlikely(err)) {
4049                 printk(KERN_WARNING
4050                        "SELinux: failure in"
4051                        " selinux_sock_rcv_skb_iptables_compat(),"
4052                        " network port label not found\n");
4053                 return err;
4054         }
4055         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
4056 }
4057
4058 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4059                                        struct avc_audit_data *ad,
4060                                        u16 family, char *addrp)
4061 {
4062         int err;
4063         struct sk_security_struct *sksec = sk->sk_security;
4064         u32 peer_sid;
4065         u32 sk_sid = sksec->sid;
4066
4067         if (selinux_compat_net)
4068                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
4069                                                            family, addrp);
4070         else
4071                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4072                                    PACKET__RECV, ad);
4073         if (err)
4074                 return err;
4075
4076         if (selinux_policycap_netpeer) {
4077                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4078                 if (err)
4079                         return err;
4080                 err = avc_has_perm(sk_sid, peer_sid,
4081                                    SECCLASS_PEER, PEER__RECV, ad);
4082         } else {
4083                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
4084                 if (err)
4085                         return err;
4086                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
4087         }
4088
4089         return err;
4090 }
4091
4092 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4093 {
4094         int err;
4095         struct sk_security_struct *sksec = sk->sk_security;
4096         u16 family = sk->sk_family;
4097         u32 sk_sid = sksec->sid;
4098         struct avc_audit_data ad;
4099         char *addrp;
4100
4101         if (family != PF_INET && family != PF_INET6)
4102                 return 0;
4103
4104         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4105         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4106                 family = PF_INET;
4107
4108         AVC_AUDIT_DATA_INIT(&ad, NET);
4109         ad.u.net.netif = skb->iif;
4110         ad.u.net.family = family;
4111         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4112         if (err)
4113                 return err;
4114
4115         /* If any sort of compatibility mode is enabled then handoff processing
4116          * to the selinux_sock_rcv_skb_compat() function to deal with the
4117          * special handling.  We do this in an attempt to keep this function
4118          * as fast and as clean as possible. */
4119         if (selinux_compat_net || !selinux_policycap_netpeer)
4120                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4121                                                    family, addrp);
4122
4123         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4124                 u32 peer_sid;
4125
4126                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4127                 if (err)
4128                         return err;
4129                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4130                                                peer_sid, &ad);
4131                 if (err)
4132                         return err;
4133                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4134                                    PEER__RECV, &ad);
4135         }
4136
4137         if (selinux_secmark_enabled()) {
4138                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4139                                    PACKET__RECV, &ad);
4140                 if (err)
4141                         return err;
4142         }
4143
4144         return err;
4145 }
4146
4147 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4148                                             int __user *optlen, unsigned len)
4149 {
4150         int err = 0;
4151         char *scontext;
4152         u32 scontext_len;
4153         struct sk_security_struct *ssec;
4154         struct inode_security_struct *isec;
4155         u32 peer_sid = SECSID_NULL;
4156
4157         isec = SOCK_INODE(sock)->i_security;
4158
4159         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4160             isec->sclass == SECCLASS_TCP_SOCKET) {
4161                 ssec = sock->sk->sk_security;
4162                 peer_sid = ssec->peer_sid;
4163         }
4164         if (peer_sid == SECSID_NULL) {
4165                 err = -ENOPROTOOPT;
4166                 goto out;
4167         }
4168
4169         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4170
4171         if (err)
4172                 goto out;
4173
4174         if (scontext_len > len) {
4175                 err = -ERANGE;
4176                 goto out_len;
4177         }
4178
4179         if (copy_to_user(optval, scontext, scontext_len))
4180                 err = -EFAULT;
4181
4182 out_len:
4183         if (put_user(scontext_len, optlen))
4184                 err = -EFAULT;
4185
4186         kfree(scontext);
4187 out:
4188         return err;
4189 }
4190
4191 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4192 {
4193         u32 peer_secid = SECSID_NULL;
4194         u16 family;
4195
4196         if (sock)
4197                 family = sock->sk->sk_family;
4198         else if (skb && skb->sk)
4199                 family = skb->sk->sk_family;
4200         else
4201                 goto out;
4202
4203         if (sock && family == PF_UNIX)
4204                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4205         else if (skb)
4206                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4207
4208 out:
4209         *secid = peer_secid;
4210         if (peer_secid == SECSID_NULL)
4211                 return -EINVAL;
4212         return 0;
4213 }
4214
4215 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4216 {
4217         return sk_alloc_security(sk, family, priority);
4218 }
4219
4220 static void selinux_sk_free_security(struct sock *sk)
4221 {
4222         sk_free_security(sk);
4223 }
4224
4225 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4226 {
4227         struct sk_security_struct *ssec = sk->sk_security;
4228         struct sk_security_struct *newssec = newsk->sk_security;
4229
4230         newssec->sid = ssec->sid;
4231         newssec->peer_sid = ssec->peer_sid;
4232         newssec->sclass = ssec->sclass;
4233
4234         selinux_netlbl_sk_security_reset(newssec, newsk->sk_family);
4235 }
4236
4237 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4238 {
4239         if (!sk)
4240                 *secid = SECINITSID_ANY_SOCKET;
4241         else {
4242                 struct sk_security_struct *sksec = sk->sk_security;
4243
4244                 *secid = sksec->sid;
4245         }
4246 }
4247
4248 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4249 {
4250         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4251         struct sk_security_struct *sksec = sk->sk_security;
4252
4253         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4254             sk->sk_family == PF_UNIX)
4255                 isec->sid = sksec->sid;
4256         sksec->sclass = isec->sclass;
4257
4258         selinux_netlbl_sock_graft(sk, parent);
4259 }
4260
4261 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4262                                      struct request_sock *req)
4263 {
4264         struct sk_security_struct *sksec = sk->sk_security;
4265         int err;
4266         u32 newsid;
4267         u32 peersid;
4268
4269         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4270         if (err)
4271                 return err;
4272         if (peersid == SECSID_NULL) {
4273                 req->secid = sksec->sid;
4274                 req->peer_secid = SECSID_NULL;
4275                 return 0;
4276         }
4277
4278         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4279         if (err)
4280                 return err;
4281
4282         req->secid = newsid;
4283         req->peer_secid = peersid;
4284         return 0;
4285 }
4286
4287 static void selinux_inet_csk_clone(struct sock *newsk,
4288                                    const struct request_sock *req)
4289 {
4290         struct sk_security_struct *newsksec = newsk->sk_security;
4291
4292         newsksec->sid = req->secid;
4293         newsksec->peer_sid = req->peer_secid;
4294         /* NOTE: Ideally, we should also get the isec->sid for the
4295            new socket in sync, but we don't have the isec available yet.
4296            So we will wait until sock_graft to do it, by which
4297            time it will have been created and available. */
4298
4299         /* We don't need to take any sort of lock here as we are the only
4300          * thread with access to newsksec */
4301         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4302 }
4303
4304 static void selinux_inet_conn_established(struct sock *sk,
4305                                 struct sk_buff *skb)
4306 {
4307         struct sk_security_struct *sksec = sk->sk_security;
4308
4309         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4310 }
4311
4312 static void selinux_req_classify_flow(const struct request_sock *req,
4313                                       struct flowi *fl)
4314 {
4315         fl->secid = req->secid;
4316 }
4317
4318 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4319 {
4320         int err = 0;
4321         u32 perm;
4322         struct nlmsghdr *nlh;
4323         struct socket *sock = sk->sk_socket;
4324         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4325
4326         if (skb->len < NLMSG_SPACE(0)) {
4327                 err = -EINVAL;
4328                 goto out;
4329         }
4330         nlh = nlmsg_hdr(skb);
4331
4332         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4333         if (err) {
4334                 if (err == -EINVAL) {
4335                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4336                                   "SELinux:  unrecognized netlink message"
4337                                   " type=%hu for sclass=%hu\n",
4338                                   nlh->nlmsg_type, isec->sclass);
4339                         if (!selinux_enforcing)
4340                                 err = 0;
4341                 }
4342
4343                 /* Ignore */
4344                 if (err == -ENOENT)
4345                         err = 0;
4346                 goto out;
4347         }
4348
4349         err = socket_has_perm(current, sock, perm);
4350 out:
4351         return err;
4352 }
4353
4354 #ifdef CONFIG_NETFILTER
4355
4356 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4357                                        u16 family)
4358 {
4359         char *addrp;
4360         u32 peer_sid;
4361         struct avc_audit_data ad;
4362         u8 secmark_active;
4363         u8 peerlbl_active;
4364
4365         if (!selinux_policycap_netpeer)
4366                 return NF_ACCEPT;
4367
4368         secmark_active = selinux_secmark_enabled();
4369         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4370         if (!secmark_active && !peerlbl_active)
4371                 return NF_ACCEPT;
4372
4373         AVC_AUDIT_DATA_INIT(&ad, NET);
4374         ad.u.net.netif = ifindex;
4375         ad.u.net.family = family;
4376         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4377                 return NF_DROP;
4378
4379         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4380                 return NF_DROP;
4381
4382         if (peerlbl_active)
4383                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4384                                              peer_sid, &ad) != 0)
4385                         return NF_DROP;
4386
4387         if (secmark_active)
4388                 if (avc_has_perm(peer_sid, skb->secmark,
4389                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4390                         return NF_DROP;
4391
4392         return NF_ACCEPT;
4393 }
4394
4395 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4396                                          struct sk_buff *skb,
4397                                          const struct net_device *in,
4398                                          const struct net_device *out,
4399                                          int (*okfn)(struct sk_buff *))
4400 {
4401         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4402 }
4403
4404 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4405 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4406                                          struct sk_buff *skb,
4407                                          const struct net_device *in,
4408                                          const struct net_device *out,
4409                                          int (*okfn)(struct sk_buff *))
4410 {
4411         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4412 }
4413 #endif  /* IPV6 */
4414
4415 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4416                                                 int ifindex,
4417                                                 struct avc_audit_data *ad,
4418                                                 u16 family, char *addrp)
4419 {
4420         int err;
4421         struct sk_security_struct *sksec = sk->sk_security;
4422         u16 sk_class;
4423         u32 netif_perm, node_perm, send_perm;
4424         u32 port_sid, node_sid, if_sid, sk_sid;
4425
4426         sk_sid = sksec->sid;
4427         sk_class = sksec->sclass;
4428
4429         switch (sk_class) {
4430         case SECCLASS_UDP_SOCKET:
4431                 netif_perm = NETIF__UDP_SEND;
4432                 node_perm = NODE__UDP_SEND;
4433                 send_perm = UDP_SOCKET__SEND_MSG;
4434                 break;
4435         case SECCLASS_TCP_SOCKET:
4436                 netif_perm = NETIF__TCP_SEND;
4437                 node_perm = NODE__TCP_SEND;
4438                 send_perm = TCP_SOCKET__SEND_MSG;
4439                 break;
4440         case SECCLASS_DCCP_SOCKET:
4441                 netif_perm = NETIF__DCCP_SEND;
4442                 node_perm = NODE__DCCP_SEND;
4443                 send_perm = DCCP_SOCKET__SEND_MSG;
4444                 break;
4445         default:
4446                 netif_perm = NETIF__RAWIP_SEND;
4447                 node_perm = NODE__RAWIP_SEND;
4448                 send_perm = 0;
4449                 break;
4450         }
4451
4452         err = sel_netif_sid(ifindex, &if_sid);
4453         if (err)
4454                 return err;
4455         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4456                 return err;
4457
4458         err = sel_netnode_sid(addrp, family, &node_sid);
4459         if (err)
4460                 return err;
4461         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4462         if (err)
4463                 return err;
4464
4465         if (send_perm != 0)
4466                 return 0;
4467
4468         err = sel_netport_sid(sk->sk_protocol,
4469                               ntohs(ad->u.net.dport), &port_sid);
4470         if (unlikely(err)) {
4471                 printk(KERN_WARNING
4472                        "SELinux: failure in"
4473                        " selinux_ip_postroute_iptables_compat(),"
4474                        " network port label not found\n");
4475                 return err;
4476         }
4477         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4478 }
4479
4480 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4481                                                 int ifindex,
4482                                                 struct avc_audit_data *ad,
4483                                                 u16 family,
4484                                                 char *addrp,
4485                                                 u8 proto)
4486 {
4487         struct sock *sk = skb->sk;
4488         struct sk_security_struct *sksec;
4489
4490         if (sk == NULL)
4491                 return NF_ACCEPT;
4492         sksec = sk->sk_security;
4493
4494         if (selinux_compat_net) {
4495                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4496                                                          ad, family, addrp))
4497                         return NF_DROP;
4498         } else {
4499                 if (avc_has_perm(sksec->sid, skb->secmark,
4500                                  SECCLASS_PACKET, PACKET__SEND, ad))
4501                         return NF_DROP;
4502         }
4503
4504         if (selinux_policycap_netpeer)
4505                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4506                         return NF_DROP;
4507
4508         return NF_ACCEPT;
4509 }
4510
4511 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4512                                          u16 family)
4513 {
4514         u32 secmark_perm;
4515         u32 peer_sid;
4516         struct sock *sk;
4517         struct avc_audit_data ad;
4518         char *addrp;
4519         u8 proto;
4520         u8 secmark_active;
4521         u8 peerlbl_active;
4522
4523         AVC_AUDIT_DATA_INIT(&ad, NET);
4524         ad.u.net.netif = ifindex;
4525         ad.u.net.family = family;
4526         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4527                 return NF_DROP;
4528
4529         /* If any sort of compatibility mode is enabled then handoff processing
4530          * to the selinux_ip_postroute_compat() function to deal with the
4531          * special handling.  We do this in an attempt to keep this function
4532          * as fast and as clean as possible. */
4533         if (selinux_compat_net || !selinux_policycap_netpeer)
4534                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4535                                                    family, addrp, proto);
4536
4537         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4538          * packet transformation so allow the packet to pass without any checks
4539          * since we'll have another chance to perform access control checks
4540          * when the packet is on it's final way out.
4541          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4542          *       is NULL, in this case go ahead and apply access control. */
4543         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4544                 return NF_ACCEPT;
4545
4546         secmark_active = selinux_secmark_enabled();
4547         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4548         if (!secmark_active && !peerlbl_active)
4549                 return NF_ACCEPT;
4550
4551         /* if the packet is locally generated (skb->sk != NULL) then use the
4552          * socket's label as the peer label, otherwise the packet is being
4553          * forwarded through this system and we need to fetch the peer label
4554          * directly from the packet */
4555         sk = skb->sk;
4556         if (sk) {
4557                 struct sk_security_struct *sksec = sk->sk_security;
4558                 peer_sid = sksec->sid;
4559                 secmark_perm = PACKET__SEND;
4560         } else {
4561                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4562                                 return NF_DROP;
4563                 secmark_perm = PACKET__FORWARD_OUT;
4564         }
4565
4566         if (secmark_active)
4567                 if (avc_has_perm(peer_sid, skb->secmark,
4568                                  SECCLASS_PACKET, secmark_perm, &ad))
4569                         return NF_DROP;
4570
4571         if (peerlbl_active) {
4572                 u32 if_sid;
4573                 u32 node_sid;
4574
4575                 if (sel_netif_sid(ifindex, &if_sid))
4576                         return NF_DROP;
4577                 if (avc_has_perm(peer_sid, if_sid,
4578                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4579                         return NF_DROP;
4580
4581                 if (sel_netnode_sid(addrp, family, &node_sid))
4582                         return NF_DROP;
4583                 if (avc_has_perm(peer_sid, node_sid,
4584                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4585                         return NF_DROP;
4586         }
4587
4588         return NF_ACCEPT;
4589 }
4590
4591 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4592                                            struct sk_buff *skb,
4593                                            const struct net_device *in,
4594                                            const struct net_device *out,
4595                                            int (*okfn)(struct sk_buff *))
4596 {
4597         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4598 }
4599
4600 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4601 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4602                                            struct sk_buff *skb,
4603                                            const struct net_device *in,
4604                                            const struct net_device *out,
4605                                            int (*okfn)(struct sk_buff *))
4606 {
4607         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4608 }
4609 #endif  /* IPV6 */
4610
4611 #endif  /* CONFIG_NETFILTER */
4612
4613 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4614 {
4615         int err;
4616
4617         err = secondary_ops->netlink_send(sk, skb);
4618         if (err)
4619                 return err;
4620
4621         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4622                 err = selinux_nlmsg_perm(sk, skb);
4623
4624         return err;
4625 }
4626
4627 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4628 {
4629         int err;
4630         struct avc_audit_data ad;
4631
4632         err = secondary_ops->netlink_recv(skb, capability);
4633         if (err)
4634                 return err;
4635
4636         AVC_AUDIT_DATA_INIT(&ad, CAP);
4637         ad.u.cap = capability;
4638
4639         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4640                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4641 }
4642
4643 static int ipc_alloc_security(struct task_struct *task,
4644                               struct kern_ipc_perm *perm,
4645                               u16 sclass)
4646 {
4647         struct task_security_struct *tsec = task->security;
4648         struct ipc_security_struct *isec;
4649
4650         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4651         if (!isec)
4652                 return -ENOMEM;
4653
4654         isec->sclass = sclass;
4655         isec->sid = tsec->sid;
4656         perm->security = isec;
4657
4658         return 0;
4659 }
4660
4661 static void ipc_free_security(struct kern_ipc_perm *perm)
4662 {
4663         struct ipc_security_struct *isec = perm->security;
4664         perm->security = NULL;
4665         kfree(isec);
4666 }
4667
4668 static int msg_msg_alloc_security(struct msg_msg *msg)
4669 {
4670         struct msg_security_struct *msec;
4671
4672         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4673         if (!msec)
4674                 return -ENOMEM;
4675
4676         msec->sid = SECINITSID_UNLABELED;
4677         msg->security = msec;
4678
4679         return 0;
4680 }
4681
4682 static void msg_msg_free_security(struct msg_msg *msg)
4683 {
4684         struct msg_security_struct *msec = msg->security;
4685
4686         msg->security = NULL;
4687         kfree(msec);
4688 }
4689
4690 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4691                         u32 perms)
4692 {
4693         struct task_security_struct *tsec;
4694         struct ipc_security_struct *isec;
4695         struct avc_audit_data ad;
4696
4697         tsec = current->security;
4698         isec = ipc_perms->security;
4699
4700         AVC_AUDIT_DATA_INIT(&ad, IPC);
4701         ad.u.ipc_id = ipc_perms->key;
4702
4703         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4704 }
4705
4706 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4707 {
4708         return msg_msg_alloc_security(msg);
4709 }
4710
4711 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4712 {
4713         msg_msg_free_security(msg);
4714 }
4715
4716 /* message queue security operations */
4717 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4718 {
4719         struct task_security_struct *tsec;
4720         struct ipc_security_struct *isec;
4721         struct avc_audit_data ad;
4722         int rc;
4723
4724         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4725         if (rc)
4726                 return rc;
4727
4728         tsec = current->security;
4729         isec = msq->q_perm.security;
4730
4731         AVC_AUDIT_DATA_INIT(&ad, IPC);
4732         ad.u.ipc_id = msq->q_perm.key;
4733
4734         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4735                           MSGQ__CREATE, &ad);
4736         if (rc) {
4737                 ipc_free_security(&msq->q_perm);
4738                 return rc;
4739         }
4740         return 0;
4741 }
4742
4743 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4744 {
4745         ipc_free_security(&msq->q_perm);
4746 }
4747
4748 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4749 {
4750         struct task_security_struct *tsec;
4751         struct ipc_security_struct *isec;
4752         struct avc_audit_data ad;
4753
4754         tsec = current->security;
4755         isec = msq->q_perm.security;
4756
4757         AVC_AUDIT_DATA_INIT(&ad, IPC);
4758         ad.u.ipc_id = msq->q_perm.key;
4759
4760         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4761                             MSGQ__ASSOCIATE, &ad);
4762 }
4763
4764 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4765 {
4766         int err;
4767         int perms;
4768
4769         switch (cmd) {
4770         case IPC_INFO:
4771         case MSG_INFO:
4772                 /* No specific object, just general system-wide information. */
4773                 return task_has_system(current, SYSTEM__IPC_INFO);
4774         case IPC_STAT:
4775         case MSG_STAT:
4776                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4777                 break;
4778         case IPC_SET:
4779                 perms = MSGQ__SETATTR;
4780                 break;
4781         case IPC_RMID:
4782                 perms = MSGQ__DESTROY;
4783                 break;
4784         default:
4785                 return 0;
4786         }
4787
4788         err = ipc_has_perm(&msq->q_perm, perms);
4789         return err;
4790 }
4791
4792 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4793 {
4794         struct task_security_struct *tsec;
4795         struct ipc_security_struct *isec;
4796         struct msg_security_struct *msec;
4797         struct avc_audit_data ad;
4798         int rc;
4799
4800         tsec = current->security;
4801         isec = msq->q_perm.security;
4802         msec = msg->security;
4803
4804         /*
4805          * First time through, need to assign label to the message
4806          */
4807         if (msec->sid == SECINITSID_UNLABELED) {
4808                 /*
4809                  * Compute new sid based on current process and
4810                  * message queue this message will be stored in
4811                  */
4812                 rc = security_transition_sid(tsec->sid,
4813                                              isec->sid,
4814                                              SECCLASS_MSG,
4815                                              &msec->sid);
4816                 if (rc)
4817                         return rc;
4818         }
4819
4820         AVC_AUDIT_DATA_INIT(&ad, IPC);
4821         ad.u.ipc_id = msq->q_perm.key;
4822
4823         /* Can this process write to the queue? */
4824         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4825                           MSGQ__WRITE, &ad);
4826         if (!rc)
4827                 /* Can this process send the message */
4828                 rc = avc_has_perm(tsec->sid, msec->sid,
4829                                   SECCLASS_MSG, MSG__SEND, &ad);
4830         if (!rc)
4831                 /* Can the message be put in the queue? */
4832                 rc = avc_has_perm(msec->sid, isec->sid,
4833                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4834
4835         return rc;
4836 }
4837
4838 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4839                                     struct task_struct *target,
4840                                     long type, int mode)
4841 {
4842         struct task_security_struct *tsec;
4843         struct ipc_security_struct *isec;
4844         struct msg_security_struct *msec;
4845         struct avc_audit_data ad;
4846         int rc;
4847
4848         tsec = target->security;
4849         isec = msq->q_perm.security;
4850         msec = msg->security;
4851
4852         AVC_AUDIT_DATA_INIT(&ad, IPC);
4853         ad.u.ipc_id = msq->q_perm.key;
4854
4855         rc = avc_has_perm(tsec->sid, isec->sid,
4856                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4857         if (!rc)
4858                 rc = avc_has_perm(tsec->sid, msec->sid,
4859                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4860         return rc;
4861 }
4862
4863 /* Shared Memory security operations */
4864 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4865 {
4866         struct task_security_struct *tsec;
4867         struct ipc_security_struct *isec;
4868         struct avc_audit_data ad;
4869         int rc;
4870
4871         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4872         if (rc)
4873                 return rc;
4874
4875         tsec = current->security;
4876         isec = shp->shm_perm.security;
4877
4878         AVC_AUDIT_DATA_INIT(&ad, IPC);
4879         ad.u.ipc_id = shp->shm_perm.key;
4880
4881         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4882                           SHM__CREATE, &ad);
4883         if (rc) {
4884                 ipc_free_security(&shp->shm_perm);
4885                 return rc;
4886         }
4887         return 0;
4888 }
4889
4890 static void selinux_shm_free_security(struct shmid_kernel *shp)
4891 {
4892         ipc_free_security(&shp->shm_perm);
4893 }
4894
4895 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4896 {
4897         struct task_security_struct *tsec;
4898         struct ipc_security_struct *isec;
4899         struct avc_audit_data ad;
4900
4901         tsec = current->security;
4902         isec = shp->shm_perm.security;
4903
4904         AVC_AUDIT_DATA_INIT(&ad, IPC);
4905         ad.u.ipc_id = shp->shm_perm.key;
4906
4907         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4908                             SHM__ASSOCIATE, &ad);
4909 }
4910
4911 /* Note, at this point, shp is locked down */
4912 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4913 {
4914         int perms;
4915         int err;
4916
4917         switch (cmd) {
4918         case IPC_INFO:
4919         case SHM_INFO:
4920                 /* No specific object, just general system-wide information. */
4921                 return task_has_system(current, SYSTEM__IPC_INFO);
4922         case IPC_STAT:
4923         case SHM_STAT:
4924                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4925                 break;
4926         case IPC_SET:
4927                 perms = SHM__SETATTR;
4928                 break;
4929         case SHM_LOCK:
4930         case SHM_UNLOCK:
4931                 perms = SHM__LOCK;
4932                 break;
4933         case IPC_RMID:
4934                 perms = SHM__DESTROY;
4935                 break;
4936         default:
4937                 return 0;
4938         }
4939
4940         err = ipc_has_perm(&shp->shm_perm, perms);
4941         return err;
4942 }
4943
4944 static int selinux_shm_shmat(struct shmid_kernel *shp,
4945                              char __user *shmaddr, int shmflg)
4946 {
4947         u32 perms;
4948         int rc;
4949
4950         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4951         if (rc)
4952                 return rc;
4953
4954         if (shmflg & SHM_RDONLY)
4955                 perms = SHM__READ;
4956         else
4957                 perms = SHM__READ | SHM__WRITE;
4958
4959         return ipc_has_perm(&shp->shm_perm, perms);
4960 }
4961
4962 /* Semaphore security operations */
4963 static int selinux_sem_alloc_security(struct sem_array *sma)
4964 {
4965         struct task_security_struct *tsec;
4966         struct ipc_security_struct *isec;
4967         struct avc_audit_data ad;
4968         int rc;
4969
4970         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4971         if (rc)
4972                 return rc;
4973
4974         tsec = current->security;
4975         isec = sma->sem_perm.security;
4976
4977         AVC_AUDIT_DATA_INIT(&ad, IPC);
4978         ad.u.ipc_id = sma->sem_perm.key;
4979
4980         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4981                           SEM__CREATE, &ad);
4982         if (rc) {
4983                 ipc_free_security(&sma->sem_perm);
4984                 return rc;
4985         }
4986         return 0;
4987 }
4988
4989 static void selinux_sem_free_security(struct sem_array *sma)
4990 {
4991         ipc_free_security(&sma->sem_perm);
4992 }
4993
4994 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4995 {
4996         struct task_security_struct *tsec;
4997         struct ipc_security_struct *isec;
4998         struct avc_audit_data ad;
4999
5000         tsec = current->security;
5001         isec = sma->sem_perm.security;
5002
5003         AVC_AUDIT_DATA_INIT(&ad, IPC);
5004         ad.u.ipc_id = sma->sem_perm.key;
5005
5006         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
5007                             SEM__ASSOCIATE, &ad);
5008 }
5009
5010 /* Note, at this point, sma is locked down */
5011 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5012 {
5013         int err;
5014         u32 perms;
5015
5016         switch (cmd) {
5017         case IPC_INFO:
5018         case SEM_INFO:
5019                 /* No specific object, just general system-wide information. */
5020                 return task_has_system(current, SYSTEM__IPC_INFO);
5021         case GETPID:
5022         case GETNCNT:
5023         case GETZCNT:
5024                 perms = SEM__GETATTR;
5025                 break;
5026         case GETVAL:
5027         case GETALL:
5028                 perms = SEM__READ;
5029                 break;
5030         case SETVAL:
5031         case SETALL:
5032                 perms = SEM__WRITE;
5033                 break;
5034         case IPC_RMID:
5035                 perms = SEM__DESTROY;
5036                 break;
5037         case IPC_SET:
5038                 perms = SEM__SETATTR;
5039                 break;
5040         case IPC_STAT:
5041         case SEM_STAT:
5042                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5043                 break;
5044         default:
5045                 return 0;
5046         }
5047
5048         err = ipc_has_perm(&sma->sem_perm, perms);
5049         return err;
5050 }
5051
5052 static int selinux_sem_semop(struct sem_array *sma,
5053                              struct sembuf *sops, unsigned nsops, int alter)
5054 {
5055         u32 perms;
5056
5057         if (alter)
5058                 perms = SEM__READ | SEM__WRITE;
5059         else
5060                 perms = SEM__READ;
5061
5062         return ipc_has_perm(&sma->sem_perm, perms);
5063 }
5064
5065 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5066 {
5067         u32 av = 0;
5068
5069         av = 0;
5070         if (flag & S_IRUGO)
5071                 av |= IPC__UNIX_READ;
5072         if (flag & S_IWUGO)
5073                 av |= IPC__UNIX_WRITE;
5074
5075         if (av == 0)
5076                 return 0;
5077
5078         return ipc_has_perm(ipcp, av);
5079 }
5080
5081 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5082 {
5083         struct ipc_security_struct *isec = ipcp->security;
5084         *secid = isec->sid;
5085 }
5086
5087 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5088 {
5089         if (inode)
5090                 inode_doinit_with_dentry(inode, dentry);
5091 }
5092
5093 static int selinux_getprocattr(struct task_struct *p,
5094                                char *name, char **value)
5095 {
5096         struct task_security_struct *tsec;
5097         u32 sid;
5098         int error;
5099         unsigned len;
5100
5101         if (current != p) {
5102                 error = task_has_perm(current, p, PROCESS__GETATTR);
5103                 if (error)
5104                         return error;
5105         }
5106
5107         tsec = p->security;
5108
5109         if (!strcmp(name, "current"))
5110                 sid = tsec->sid;
5111         else if (!strcmp(name, "prev"))
5112                 sid = tsec->osid;
5113         else if (!strcmp(name, "exec"))
5114                 sid = tsec->exec_sid;
5115         else if (!strcmp(name, "fscreate"))
5116                 sid = tsec->create_sid;
5117         else if (!strcmp(name, "keycreate"))
5118                 sid = tsec->keycreate_sid;
5119         else if (!strcmp(name, "sockcreate"))
5120                 sid = tsec->sockcreate_sid;
5121         else
5122                 return -EINVAL;
5123
5124         if (!sid)
5125                 return 0;
5126
5127         error = security_sid_to_context(sid, value, &len);
5128         if (error)
5129                 return error;
5130         return len;
5131 }
5132
5133 static int selinux_setprocattr(struct task_struct *p,
5134                                char *name, void *value, size_t size)
5135 {
5136         struct task_security_struct *tsec;
5137         struct task_struct *tracer;
5138         u32 sid = 0;
5139         int error;
5140         char *str = value;
5141
5142         if (current != p) {
5143                 /* SELinux only allows a process to change its own
5144                    security attributes. */
5145                 return -EACCES;
5146         }
5147
5148         /*
5149          * Basic control over ability to set these attributes at all.
5150          * current == p, but we'll pass them separately in case the
5151          * above restriction is ever removed.
5152          */
5153         if (!strcmp(name, "exec"))
5154                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5155         else if (!strcmp(name, "fscreate"))
5156                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5157         else if (!strcmp(name, "keycreate"))
5158                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5159         else if (!strcmp(name, "sockcreate"))
5160                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5161         else if (!strcmp(name, "current"))
5162                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5163         else
5164                 error = -EINVAL;
5165         if (error)
5166                 return error;
5167
5168         /* Obtain a SID for the context, if one was specified. */
5169         if (size && str[1] && str[1] != '\n') {
5170                 if (str[size-1] == '\n') {
5171                         str[size-1] = 0;
5172                         size--;
5173                 }
5174                 error = security_context_to_sid(value, size, &sid);
5175                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5176                         if (!capable(CAP_MAC_ADMIN))
5177                                 return error;
5178                         error = security_context_to_sid_force(value, size,
5179                                                               &sid);
5180                 }
5181                 if (error)
5182                         return error;
5183         }
5184
5185         /* Permission checking based on the specified context is
5186            performed during the actual operation (execve,
5187            open/mkdir/...), when we know the full context of the
5188            operation.  See selinux_bprm_set_security for the execve
5189            checks and may_create for the file creation checks. The
5190            operation will then fail if the context is not permitted. */
5191         tsec = p->security;
5192         if (!strcmp(name, "exec"))
5193                 tsec->exec_sid = sid;
5194         else if (!strcmp(name, "fscreate"))
5195                 tsec->create_sid = sid;
5196         else if (!strcmp(name, "keycreate")) {
5197                 error = may_create_key(sid, p);
5198                 if (error)
5199                         return error;
5200                 tsec->keycreate_sid = sid;
5201         } else if (!strcmp(name, "sockcreate"))
5202                 tsec->sockcreate_sid = sid;
5203         else if (!strcmp(name, "current")) {
5204                 struct av_decision avd;
5205
5206                 if (sid == 0)
5207                         return -EINVAL;
5208
5209                 /* Only allow single threaded processes to change context */
5210                 if (atomic_read(&p->mm->mm_users) != 1) {
5211                         struct task_struct *g, *t;
5212                         struct mm_struct *mm = p->mm;
5213                         read_lock(&tasklist_lock);
5214                         do_each_thread(g, t) {
5215                                 if (t->mm == mm && t != p) {
5216                                         read_unlock(&tasklist_lock);
5217                                         return -EPERM;
5218                                 }
5219                         } while_each_thread(g, t);
5220                         read_unlock(&tasklist_lock);
5221                 }
5222
5223                 /* Check permissions for the transition. */
5224                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5225                                      PROCESS__DYNTRANSITION, NULL);
5226                 if (error)
5227                         return error;
5228
5229                 /* Check for ptracing, and update the task SID if ok.
5230                    Otherwise, leave SID unchanged and fail. */
5231                 task_lock(p);
5232                 rcu_read_lock();
5233                 tracer = tracehook_tracer_task(p);
5234                 if (tracer != NULL) {
5235                         struct task_security_struct *ptsec = tracer->security;
5236                         u32 ptsid = ptsec->sid;
5237                         rcu_read_unlock();
5238                         error = avc_has_perm_noaudit(ptsid, sid,
5239                                                      SECCLASS_PROCESS,
5240                                                      PROCESS__PTRACE, 0, &avd);
5241                         if (!error)
5242                                 tsec->sid = sid;
5243                         task_unlock(p);
5244                         avc_audit(ptsid, sid, SECCLASS_PROCESS,
5245                                   PROCESS__PTRACE, &avd, error, NULL);
5246                         if (error)
5247                                 return error;
5248                 } else {
5249                         rcu_read_unlock();
5250                         tsec->sid = sid;
5251                         task_unlock(p);
5252                 }
5253         } else
5254                 return -EINVAL;
5255
5256         return size;
5257 }
5258
5259 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5260 {
5261         return security_sid_to_context(secid, secdata, seclen);
5262 }
5263
5264 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5265 {
5266         return security_context_to_sid(secdata, seclen, secid);
5267 }
5268
5269 static void selinux_release_secctx(char *secdata, u32 seclen)
5270 {
5271         kfree(secdata);
5272 }
5273
5274 #ifdef CONFIG_KEYS
5275
5276 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5277                              unsigned long flags)
5278 {
5279         struct task_security_struct *tsec = tsk->security;
5280         struct key_security_struct *ksec;
5281
5282         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5283         if (!ksec)
5284                 return -ENOMEM;
5285
5286         if (tsec->keycreate_sid)
5287                 ksec->sid = tsec->keycreate_sid;
5288         else
5289                 ksec->sid = tsec->sid;
5290         k->security = ksec;
5291
5292         return 0;
5293 }
5294
5295 static void selinux_key_free(struct key *k)
5296 {
5297         struct key_security_struct *ksec = k->security;
5298
5299         k->security = NULL;
5300         kfree(ksec);
5301 }
5302
5303 static int selinux_key_permission(key_ref_t key_ref,
5304                             struct task_struct *ctx,
5305                             key_perm_t perm)
5306 {
5307         struct key *key;
5308         struct task_security_struct *tsec;
5309         struct key_security_struct *ksec;
5310
5311         key = key_ref_to_ptr(key_ref);
5312
5313         tsec = ctx->security;
5314         ksec = key->security;
5315
5316         /* if no specific permissions are requested, we skip the
5317            permission check. No serious, additional covert channels
5318            appear to be created. */
5319         if (perm == 0)
5320                 return 0;
5321
5322         return avc_has_perm(tsec->sid, ksec->sid,
5323                             SECCLASS_KEY, perm, NULL);
5324 }
5325
5326 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5327 {
5328         struct key_security_struct *ksec = key->security;
5329         char *context = NULL;
5330         unsigned len;
5331         int rc;
5332
5333         rc = security_sid_to_context(ksec->sid, &context, &len);
5334         if (!rc)
5335                 rc = len;
5336         *_buffer = context;
5337         return rc;
5338 }
5339
5340 #endif
5341
5342 static struct security_operations selinux_ops = {
5343         .name =                         "selinux",
5344
5345         .ptrace =                       selinux_ptrace,
5346         .capget =                       selinux_capget,
5347         .capset_check =                 selinux_capset_check,
5348         .capset_set =                   selinux_capset_set,
5349         .sysctl =                       selinux_sysctl,
5350         .capable =                      selinux_capable,
5351         .quotactl =                     selinux_quotactl,
5352         .quota_on =                     selinux_quota_on,
5353         .syslog =                       selinux_syslog,
5354         .vm_enough_memory =             selinux_vm_enough_memory,
5355
5356         .netlink_send =                 selinux_netlink_send,
5357         .netlink_recv =                 selinux_netlink_recv,
5358
5359         .bprm_alloc_security =          selinux_bprm_alloc_security,
5360         .bprm_free_security =           selinux_bprm_free_security,
5361         .bprm_apply_creds =             selinux_bprm_apply_creds,
5362         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5363         .bprm_set_security =            selinux_bprm_set_security,
5364         .bprm_check_security =          selinux_bprm_check_security,
5365         .bprm_secureexec =              selinux_bprm_secureexec,
5366
5367         .sb_alloc_security =            selinux_sb_alloc_security,
5368         .sb_free_security =             selinux_sb_free_security,
5369         .sb_copy_data =                 selinux_sb_copy_data,
5370         .sb_kern_mount =                selinux_sb_kern_mount,
5371         .sb_show_options =              selinux_sb_show_options,
5372         .sb_statfs =                    selinux_sb_statfs,
5373         .sb_mount =                     selinux_mount,
5374         .sb_umount =                    selinux_umount,
5375         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5376         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5377         .sb_parse_opts_str =            selinux_parse_opts_str,
5378
5379
5380         .inode_alloc_security =         selinux_inode_alloc_security,
5381         .inode_free_security =          selinux_inode_free_security,
5382         .inode_init_security =          selinux_inode_init_security,
5383         .inode_create =                 selinux_inode_create,
5384         .inode_link =                   selinux_inode_link,
5385         .inode_unlink =                 selinux_inode_unlink,
5386         .inode_symlink =                selinux_inode_symlink,
5387         .inode_mkdir =                  selinux_inode_mkdir,
5388         .inode_rmdir =                  selinux_inode_rmdir,
5389         .inode_mknod =                  selinux_inode_mknod,
5390         .inode_rename =                 selinux_inode_rename,
5391         .inode_readlink =               selinux_inode_readlink,
5392         .inode_follow_link =            selinux_inode_follow_link,
5393         .inode_permission =             selinux_inode_permission,
5394         .inode_setattr =                selinux_inode_setattr,
5395         .inode_getattr =                selinux_inode_getattr,
5396         .inode_setxattr =               selinux_inode_setxattr,
5397         .inode_post_setxattr =          selinux_inode_post_setxattr,
5398         .inode_getxattr =               selinux_inode_getxattr,
5399         .inode_listxattr =              selinux_inode_listxattr,
5400         .inode_removexattr =            selinux_inode_removexattr,
5401         .inode_getsecurity =            selinux_inode_getsecurity,
5402         .inode_setsecurity =            selinux_inode_setsecurity,
5403         .inode_listsecurity =           selinux_inode_listsecurity,
5404         .inode_need_killpriv =          selinux_inode_need_killpriv,
5405         .inode_killpriv =               selinux_inode_killpriv,
5406         .inode_getsecid =               selinux_inode_getsecid,
5407
5408         .file_permission =              selinux_file_permission,
5409         .file_alloc_security =          selinux_file_alloc_security,
5410         .file_free_security =           selinux_file_free_security,
5411         .file_ioctl =                   selinux_file_ioctl,
5412         .file_mmap =                    selinux_file_mmap,
5413         .file_mprotect =                selinux_file_mprotect,
5414         .file_lock =                    selinux_file_lock,
5415         .file_fcntl =                   selinux_file_fcntl,
5416         .file_set_fowner =              selinux_file_set_fowner,
5417         .file_send_sigiotask =          selinux_file_send_sigiotask,
5418         .file_receive =                 selinux_file_receive,
5419
5420         .dentry_open =                  selinux_dentry_open,
5421
5422         .task_create =                  selinux_task_create,
5423         .task_alloc_security =          selinux_task_alloc_security,
5424         .task_free_security =           selinux_task_free_security,
5425         .task_setuid =                  selinux_task_setuid,
5426         .task_post_setuid =             selinux_task_post_setuid,
5427         .task_setgid =                  selinux_task_setgid,
5428         .task_setpgid =                 selinux_task_setpgid,
5429         .task_getpgid =                 selinux_task_getpgid,
5430         .task_getsid =                  selinux_task_getsid,
5431         .task_getsecid =                selinux_task_getsecid,
5432         .task_setgroups =               selinux_task_setgroups,
5433         .task_setnice =                 selinux_task_setnice,
5434         .task_setioprio =               selinux_task_setioprio,
5435         .task_getioprio =               selinux_task_getioprio,
5436         .task_setrlimit =               selinux_task_setrlimit,
5437         .task_setscheduler =            selinux_task_setscheduler,
5438         .task_getscheduler =            selinux_task_getscheduler,
5439         .task_movememory =              selinux_task_movememory,
5440         .task_kill =                    selinux_task_kill,
5441         .task_wait =                    selinux_task_wait,
5442         .task_prctl =                   selinux_task_prctl,
5443         .task_reparent_to_init =        selinux_task_reparent_to_init,
5444         .task_to_inode =                selinux_task_to_inode,
5445
5446         .ipc_permission =               selinux_ipc_permission,
5447         .ipc_getsecid =                 selinux_ipc_getsecid,
5448
5449         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5450         .msg_msg_free_security =        selinux_msg_msg_free_security,
5451
5452         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5453         .msg_queue_free_security =      selinux_msg_queue_free_security,
5454         .msg_queue_associate =          selinux_msg_queue_associate,
5455         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5456         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5457         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5458
5459         .shm_alloc_security =           selinux_shm_alloc_security,
5460         .shm_free_security =            selinux_shm_free_security,
5461         .shm_associate =                selinux_shm_associate,
5462         .shm_shmctl =                   selinux_shm_shmctl,
5463         .shm_shmat =                    selinux_shm_shmat,
5464
5465         .sem_alloc_security =           selinux_sem_alloc_security,
5466         .sem_free_security =            selinux_sem_free_security,
5467         .sem_associate =                selinux_sem_associate,
5468         .sem_semctl =                   selinux_sem_semctl,
5469         .sem_semop =                    selinux_sem_semop,
5470
5471         .d_instantiate =                selinux_d_instantiate,
5472
5473         .getprocattr =                  selinux_getprocattr,
5474         .setprocattr =                  selinux_setprocattr,
5475
5476         .secid_to_secctx =              selinux_secid_to_secctx,
5477         .secctx_to_secid =              selinux_secctx_to_secid,
5478         .release_secctx =               selinux_release_secctx,
5479
5480         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5481         .unix_may_send =                selinux_socket_unix_may_send,
5482
5483         .socket_create =                selinux_socket_create,
5484         .socket_post_create =           selinux_socket_post_create,
5485         .socket_bind =                  selinux_socket_bind,
5486         .socket_connect =               selinux_socket_connect,
5487         .socket_listen =                selinux_socket_listen,
5488         .socket_accept =                selinux_socket_accept,
5489         .socket_sendmsg =               selinux_socket_sendmsg,
5490         .socket_recvmsg =               selinux_socket_recvmsg,
5491         .socket_getsockname =           selinux_socket_getsockname,
5492         .socket_getpeername =           selinux_socket_getpeername,
5493         .socket_getsockopt =            selinux_socket_getsockopt,
5494         .socket_setsockopt =            selinux_socket_setsockopt,
5495         .socket_shutdown =              selinux_socket_shutdown,
5496         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5497         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5498         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5499         .sk_alloc_security =            selinux_sk_alloc_security,
5500         .sk_free_security =             selinux_sk_free_security,
5501         .sk_clone_security =            selinux_sk_clone_security,
5502         .sk_getsecid =                  selinux_sk_getsecid,
5503         .sock_graft =                   selinux_sock_graft,
5504         .inet_conn_request =            selinux_inet_conn_request,
5505         .inet_csk_clone =               selinux_inet_csk_clone,
5506         .inet_conn_established =        selinux_inet_conn_established,
5507         .req_classify_flow =            selinux_req_classify_flow,
5508
5509 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5510         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5511         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5512         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5513         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5514         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5515         .xfrm_state_free_security =     selinux_xfrm_state_free,
5516         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5517         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5518         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5519         .xfrm_decode_session =          selinux_xfrm_decode_session,
5520 #endif
5521
5522 #ifdef CONFIG_KEYS
5523         .key_alloc =                    selinux_key_alloc,
5524         .key_free =                     selinux_key_free,
5525         .key_permission =               selinux_key_permission,
5526         .key_getsecurity =              selinux_key_getsecurity,
5527 #endif
5528
5529 #ifdef CONFIG_AUDIT
5530         .audit_rule_init =              selinux_audit_rule_init,
5531         .audit_rule_known =             selinux_audit_rule_known,
5532         .audit_rule_match =             selinux_audit_rule_match,
5533         .audit_rule_free =              selinux_audit_rule_free,
5534 #endif
5535 };
5536
5537 static __init int selinux_init(void)
5538 {
5539         struct task_security_struct *tsec;
5540
5541         if (!security_module_enable(&selinux_ops)) {
5542                 selinux_enabled = 0;
5543                 return 0;
5544         }
5545
5546         if (!selinux_enabled) {
5547                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5548                 return 0;
5549         }
5550
5551         printk(KERN_INFO "SELinux:  Initializing.\n");
5552
5553         /* Set the security state for the initial task. */
5554         if (task_alloc_security(current))
5555                 panic("SELinux:  Failed to initialize initial task.\n");
5556         tsec = current->security;
5557         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5558
5559         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5560                                             sizeof(struct inode_security_struct),
5561                                             0, SLAB_PANIC, NULL);
5562         avc_init();
5563
5564         secondary_ops = security_ops;
5565         if (!secondary_ops)
5566                 panic("SELinux: No initial security operations\n");
5567         if (register_security(&selinux_ops))
5568                 panic("SELinux: Unable to register with kernel.\n");
5569
5570         if (selinux_enforcing)
5571                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5572         else
5573                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5574
5575         return 0;
5576 }
5577
5578 void selinux_complete_init(void)
5579 {
5580         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5581
5582         /* Set up any superblocks initialized prior to the policy load. */
5583         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5584         spin_lock(&sb_lock);
5585         spin_lock(&sb_security_lock);
5586 next_sb:
5587         if (!list_empty(&superblock_security_head)) {
5588                 struct superblock_security_struct *sbsec =
5589                                 list_entry(superblock_security_head.next,
5590                                            struct superblock_security_struct,
5591                                            list);
5592                 struct super_block *sb = sbsec->sb;
5593                 sb->s_count++;
5594                 spin_unlock(&sb_security_lock);
5595                 spin_unlock(&sb_lock);
5596                 down_read(&sb->s_umount);
5597                 if (sb->s_root)
5598                         superblock_doinit(sb, NULL);
5599                 drop_super(sb);
5600                 spin_lock(&sb_lock);
5601                 spin_lock(&sb_security_lock);
5602                 list_del_init(&sbsec->list);
5603                 goto next_sb;
5604         }
5605         spin_unlock(&sb_security_lock);
5606         spin_unlock(&sb_lock);
5607 }
5608
5609 /* SELinux requires early initialization in order to label
5610    all processes and objects when they are created. */
5611 security_initcall(selinux_init);
5612
5613 #if defined(CONFIG_NETFILTER)
5614
5615 static struct nf_hook_ops selinux_ipv4_ops[] = {
5616         {
5617                 .hook =         selinux_ipv4_postroute,
5618                 .owner =        THIS_MODULE,
5619                 .pf =           PF_INET,
5620                 .hooknum =      NF_INET_POST_ROUTING,
5621                 .priority =     NF_IP_PRI_SELINUX_LAST,
5622         },
5623         {
5624                 .hook =         selinux_ipv4_forward,
5625                 .owner =        THIS_MODULE,
5626                 .pf =           PF_INET,
5627                 .hooknum =      NF_INET_FORWARD,
5628                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5629         }
5630 };
5631
5632 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5633
5634 static struct nf_hook_ops selinux_ipv6_ops[] = {
5635         {
5636                 .hook =         selinux_ipv6_postroute,
5637                 .owner =        THIS_MODULE,
5638                 .pf =           PF_INET6,
5639                 .hooknum =      NF_INET_POST_ROUTING,
5640                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5641         },
5642         {
5643                 .hook =         selinux_ipv6_forward,
5644                 .owner =        THIS_MODULE,
5645                 .pf =           PF_INET6,
5646                 .hooknum =      NF_INET_FORWARD,
5647                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5648         }
5649 };
5650
5651 #endif  /* IPV6 */
5652
5653 static int __init selinux_nf_ip_init(void)
5654 {
5655         int err = 0;
5656
5657         if (!selinux_enabled)
5658                 goto out;
5659
5660         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5661
5662         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5663         if (err)
5664                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5665
5666 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5667         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5668         if (err)
5669                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5670 #endif  /* IPV6 */
5671
5672 out:
5673         return err;
5674 }
5675
5676 __initcall(selinux_nf_ip_init);
5677
5678 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5679 static void selinux_nf_ip_exit(void)
5680 {
5681         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5682
5683         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5684 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5685         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5686 #endif  /* IPV6 */
5687 }
5688 #endif
5689
5690 #else /* CONFIG_NETFILTER */
5691
5692 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5693 #define selinux_nf_ip_exit()
5694 #endif
5695
5696 #endif /* CONFIG_NETFILTER */
5697
5698 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5699 static int selinux_disabled;
5700
5701 int selinux_disable(void)
5702 {
5703         extern void exit_sel_fs(void);
5704
5705         if (ss_initialized) {
5706                 /* Not permitted after initial policy load. */
5707                 return -EINVAL;
5708         }
5709
5710         if (selinux_disabled) {
5711                 /* Only do this once. */
5712                 return -EINVAL;
5713         }
5714
5715         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5716
5717         selinux_disabled = 1;
5718         selinux_enabled = 0;
5719
5720         /* Reset security_ops to the secondary module, dummy or capability. */
5721         security_ops = secondary_ops;
5722
5723         /* Unregister netfilter hooks. */
5724         selinux_nf_ip_exit();
5725
5726         /* Unregister selinuxfs. */
5727         exit_sel_fs();
5728
5729         return 0;
5730 }
5731 #endif