security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72
  73 #include "avc.h"
  74 #include "objsec.h"
  75 #include "netif.h"
  76
  77 #define XATTR_SELINUX_SUFFIX "selinux"
  78 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  79
  80 extern unsigned int policydb_loaded_version;
  81 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  82
  83 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  84 int selinux_enforcing = 0;
  85
  86 static int __init enforcing_setup(char *str)
  87 {
  88         selinux_enforcing = simple_strtol(str,NULL,0);
  89         return 1;
  90 }
  91 __setup("enforcing=", enforcing_setup);
  92 #endif
  93
  94 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  95 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  96
  97 static int __init selinux_enabled_setup(char *str)
  98 {
  99         selinux_enabled = simple_strtol(str, NULL, 0);
 100         return 1;
 101 }
 102 __setup("selinux=", selinux_enabled_setup);
 103 #endif
 104
 105 /* Original (dummy) security module. */
 106 static struct security_operations *original_ops = NULL;
 107
 108 /* Minimal support for a secondary security module,
 109    just to allow the use of the dummy or capability modules.
 110    The owlsm module can alternatively be used as a secondary
 111    module as long as CONFIG_OWLSM_FD is not enabled. */
 112 static struct security_operations *secondary_ops = NULL;
 113
 114 /* Lists of inode and superblock security structures initialized
 115    before the policy was loaded. */
 116 static LIST_HEAD(superblock_security_head);
 117 static DEFINE_SPINLOCK(sb_security_lock);
 118
 119 /* Allocate and free functions for each kind of security blob. */
 120
 121 static int task_alloc_security(struct task_struct *task)
 122 {
 123         struct task_security_struct *tsec;
 124
 125         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 126         if (!tsec)
 127                 return -ENOMEM;
 128
 129         memset(tsec, 0, sizeof(struct task_security_struct));
 130         tsec->magic = SELINUX_MAGIC;
 131         tsec->task = task;
 132         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 133         task->security = tsec;
 134
 135         return 0;
 136 }
 137
 138 static void task_free_security(struct task_struct *task)
 139 {
 140         struct task_security_struct *tsec = task->security;
 141
 142         if (!tsec || tsec->magic != SELINUX_MAGIC)
 143                 return;
 144
 145         task->security = NULL;
 146         kfree(tsec);
 147 }
 148
 149 static int inode_alloc_security(struct inode *inode)
 150 {
 151         struct task_security_struct *tsec = current->security;
 152         struct inode_security_struct *isec;
 153
 154         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 155         if (!isec)
 156                 return -ENOMEM;
 157
 158         memset(isec, 0, sizeof(struct inode_security_struct));
 159         init_MUTEX(&isec->sem);
 160         INIT_LIST_HEAD(&isec->list);
 161         isec->magic = SELINUX_MAGIC;
 162         isec->inode = inode;
 163         isec->sid = SECINITSID_UNLABELED;
 164         isec->sclass = SECCLASS_FILE;
 165         if (tsec && tsec->magic == SELINUX_MAGIC)
 166                 isec->task_sid = tsec->sid;
 167         else
 168                 isec->task_sid = SECINITSID_UNLABELED;
 169         inode->i_security = isec;
 170
 171         return 0;
 172 }
 173
 174 static void inode_free_security(struct inode *inode)
 175 {
 176         struct inode_security_struct *isec = inode->i_security;
 177         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 178
 179         if (!isec || isec->magic != SELINUX_MAGIC)
 180                 return;
 181
 182         spin_lock(&sbsec->isec_lock);
 183         if (!list_empty(&isec->list))
 184                 list_del_init(&isec->list);
 185         spin_unlock(&sbsec->isec_lock);
 186
 187         inode->i_security = NULL;
 188         kfree(isec);
 189 }
 190
 191 static int file_alloc_security(struct file *file)
 192 {
 193         struct task_security_struct *tsec = current->security;
 194         struct file_security_struct *fsec;
 195
 196         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 197         if (!fsec)
 198                 return -ENOMEM;
 199
 200         memset(fsec, 0, sizeof(struct file_security_struct));
 201         fsec->magic = SELINUX_MAGIC;
 202         fsec->file = file;
 203         if (tsec && tsec->magic == SELINUX_MAGIC) {
 204                 fsec->sid = tsec->sid;
 205                 fsec->fown_sid = tsec->sid;
 206         } else {
 207                 fsec->sid = SECINITSID_UNLABELED;
 208                 fsec->fown_sid = SECINITSID_UNLABELED;
 209         }
 210         file->f_security = fsec;
 211
 212         return 0;
 213 }
 214
 215 static void file_free_security(struct file *file)
 216 {
 217         struct file_security_struct *fsec = file->f_security;
 218
 219         if (!fsec || fsec->magic != SELINUX_MAGIC)
 220                 return;
 221
 222         file->f_security = NULL;
 223         kfree(fsec);
 224 }
 225
 226 static int superblock_alloc_security(struct super_block *sb)
 227 {
 228         struct superblock_security_struct *sbsec;
 229
 230         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 231         if (!sbsec)
 232                 return -ENOMEM;
 233
 234         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 235         init_MUTEX(&sbsec->sem);
 236         INIT_LIST_HEAD(&sbsec->list);
 237         INIT_LIST_HEAD(&sbsec->isec_head);
 238         spin_lock_init(&sbsec->isec_lock);
 239         sbsec->magic = SELINUX_MAGIC;
 240         sbsec->sb = sb;
 241         sbsec->sid = SECINITSID_UNLABELED;
 242         sbsec->def_sid = SECINITSID_FILE;
 243         sb->s_security = sbsec;
 244
 245         return 0;
 246 }
 247
 248 static void superblock_free_security(struct super_block *sb)
 249 {
 250         struct superblock_security_struct *sbsec = sb->s_security;
 251
 252         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 253                 return;
 254
 255         spin_lock(&sb_security_lock);
 256         if (!list_empty(&sbsec->list))
 257                 list_del_init(&sbsec->list);
 258         spin_unlock(&sb_security_lock);
 259
 260         sb->s_security = NULL;
 261         kfree(sbsec);
 262 }
 263
 264 #ifdef CONFIG_SECURITY_NETWORK
 265 static int sk_alloc_security(struct sock *sk, int family, int priority)
 266 {
 267         struct sk_security_struct *ssec;
 268
 269         if (family != PF_UNIX)
 270                 return 0;
 271
 272         ssec = kmalloc(sizeof(*ssec), priority);
 273         if (!ssec)
 274                 return -ENOMEM;
 275
 276         memset(ssec, 0, sizeof(*ssec));
 277         ssec->magic = SELINUX_MAGIC;
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         sk->sk_security = ssec;
 281
 282         return 0;
 283 }
 284
 285 static void sk_free_security(struct sock *sk)
 286 {
 287         struct sk_security_struct *ssec = sk->sk_security;
 288
 289         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 290                 return;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295 #endif  /* CONFIG_SECURITY_NETWORK */
 296
 297 /* The security server must be initialized before
 298    any labeling or access decisions can be provided. */
 299 extern int ss_initialized;
 300
 301 /* The file system's label must be initialized prior to use. */
 302
 303 static char *labeling_behaviors[6] = {
 304         "uses xattr",
 305         "uses transition SIDs",
 306         "uses task SIDs",
 307         "uses genfs_contexts",
 308         "not configured for labeling",
 309         "uses mountpoint labeling",
 310 };
 311
 312 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 313
 314 static inline int inode_doinit(struct inode *inode)
 315 {
 316         return inode_doinit_with_dentry(inode, NULL);
 317 }
 318
 319 enum {
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 4,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329 };
 330
 331 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 332
 333 static int try_context_mount(struct super_block *sb, void *data)
 334 {
 335         char *context = NULL, *defcontext = NULL;
 336         const char *name;
 337         u32 sid;
 338         int alloc = 0, rc = 0, seen = 0;
 339         struct task_security_struct *tsec = current->security;
 340         struct superblock_security_struct *sbsec = sb->s_security;
 341
 342         if (!data)
 343                 goto out;
 344
 345         name = sb->s_type->name;
 346
 347         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 348
 349                 /* NFS we understand. */
 350                 if (!strcmp(name, "nfs")) {
 351                         struct nfs_mount_data *d = data;
 352
 353                         if (d->version <  NFS_MOUNT_VERSION)
 354                                 goto out;
 355
 356                         if (d->context[0]) {
 357                                 context = d->context;
 358                                 seen |= Opt_context;
 359                         }
 360                 } else
 361                         goto out;
 362
 363         } else {
 364                 /* Standard string-based options. */
 365                 char *p, *options = data;
 366
 367                 while ((p = strsep(&options, ",")) != NULL) {
 368                         int token;
 369                         substring_t args[MAX_OPT_ARGS];
 370
 371                         if (!*p)
 372                                 continue;
 373
 374                         token = match_token(p, tokens, args);
 375
 376                         switch (token) {
 377                         case Opt_context:
 378                                 if (seen) {
 379                                         rc = -EINVAL;
 380                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 381                                         goto out_free;
 382                                 }
 383                                 context = match_strdup(&args[0]);
 384                                 if (!context) {
 385                                         rc = -ENOMEM;
 386                                         goto out_free;
 387                                 }
 388                                 if (!alloc)
 389                                         alloc = 1;
 390                                 seen |= Opt_context;
 391                                 break;
 392
 393                         case Opt_fscontext:
 394                                 if (seen & (Opt_context|Opt_fscontext)) {
 395                                         rc = -EINVAL;
 396                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 397                                         goto out_free;
 398                                 }
 399                                 context = match_strdup(&args[0]);
 400                                 if (!context) {
 401                                         rc = -ENOMEM;
 402                                         goto out_free;
 403                                 }
 404                                 if (!alloc)
 405                                         alloc = 1;
 406                                 seen |= Opt_fscontext;
 407                                 break;
 408
 409                         case Opt_defcontext:
 410                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 411                                         rc = -EINVAL;
 412                                         printk(KERN_WARNING "SELinux:  "
 413                                                "defcontext option is invalid "
 414                                                "for this filesystem type\n");
 415                                         goto out_free;
 416                                 }
 417                                 if (seen & (Opt_context|Opt_defcontext)) {
 418                                         rc = -EINVAL;
 419                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 420                                         goto out_free;
 421                                 }
 422                                 defcontext = match_strdup(&args[0]);
 423                                 if (!defcontext) {
 424                                         rc = -ENOMEM;
 425                                         goto out_free;
 426                                 }
 427                                 if (!alloc)
 428                                         alloc = 1;
 429                                 seen |= Opt_defcontext;
 430                                 break;
 431
 432                         default:
 433                                 rc = -EINVAL;
 434                                 printk(KERN_WARNING "SELinux:  unknown mount "
 435                                        "option\n");
 436                                 goto out_free;
 437
 438                         }
 439                 }
 440         }
 441
 442         if (!seen)
 443                 goto out;
 444
 445         if (context) {
 446                 rc = security_context_to_sid(context, strlen(context), &sid);
 447                 if (rc) {
 448                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 449                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 450                                context, sb->s_id, name, rc);
 451                         goto out_free;
 452                 }
 453
 454                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 455                                   FILESYSTEM__RELABELFROM, NULL);
 456                 if (rc)
 457                         goto out_free;
 458
 459                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 460                                   FILESYSTEM__RELABELTO, NULL);
 461                 if (rc)
 462                         goto out_free;
 463
 464                 sbsec->sid = sid;
 465
 466                 if (seen & Opt_context)
 467                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 468         }
 469
 470         if (defcontext) {
 471                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 472                 if (rc) {
 473                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 474                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 475                                defcontext, sb->s_id, name, rc);
 476                         goto out_free;
 477                 }
 478
 479                 if (sid == sbsec->def_sid)
 480                         goto out_free;
 481
 482                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 483                                   FILESYSTEM__RELABELFROM, NULL);
 484                 if (rc)
 485                         goto out_free;
 486
 487                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 488                                   FILESYSTEM__ASSOCIATE, NULL);
 489                 if (rc)
 490                         goto out_free;
 491
 492                 sbsec->def_sid = sid;
 493         }
 494
 495 out_free:
 496         if (alloc) {
 497                 kfree(context);
 498                 kfree(defcontext);
 499         }
 500 out:
 501         return rc;
 502 }
 503
 504 static int superblock_doinit(struct super_block *sb, void *data)
 505 {
 506         struct superblock_security_struct *sbsec = sb->s_security;
 507         struct dentry *root = sb->s_root;
 508         struct inode *inode = root->d_inode;
 509         int rc = 0;
 510
 511         down(&sbsec->sem);
 512         if (sbsec->initialized)
 513                 goto out;
 514
 515         if (!ss_initialized) {
 516                 /* Defer initialization until selinux_complete_init,
 517                    after the initial policy is loaded and the security
 518                    server is ready to handle calls. */
 519                 spin_lock(&sb_security_lock);
 520                 if (list_empty(&sbsec->list))
 521                         list_add(&sbsec->list, &superblock_security_head);
 522                 spin_unlock(&sb_security_lock);
 523                 goto out;
 524         }
 525
 526         /* Determine the labeling behavior to use for this filesystem type. */
 527         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 528         if (rc) {
 529                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 530                        __FUNCTION__, sb->s_type->name, rc);
 531                 goto out;
 532         }
 533
 534         rc = try_context_mount(sb, data);
 535         if (rc)
 536                 goto out;
 537
 538         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 539                 /* Make sure that the xattr handler exists and that no
 540                    error other than -ENODATA is returned by getxattr on
 541                    the root directory.  -ENODATA is ok, as this may be
 542                    the first boot of the SELinux kernel before we have
 543                    assigned xattr values to the filesystem. */
 544                 if (!inode->i_op->getxattr) {
 545                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 546                                "xattr support\n", sb->s_id, sb->s_type->name);
 547                         rc = -EOPNOTSUPP;
 548                         goto out;
 549                 }
 550                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 551                 if (rc < 0 && rc != -ENODATA) {
 552                         if (rc == -EOPNOTSUPP)
 553                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 554                                        "%s) has no security xattr handler\n",
 555                                        sb->s_id, sb->s_type->name);
 556                         else
 557                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 558                                        "%s) getxattr errno %d\n", sb->s_id,
 559                                        sb->s_type->name, -rc);
 560                         goto out;
 561                 }
 562         }
 563
 564         if (strcmp(sb->s_type->name, "proc") == 0)
 565                 sbsec->proc = 1;
 566
 567         sbsec->initialized = 1;
 568
 569         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 570                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 571                        sb->s_id, sb->s_type->name);
 572         }
 573         else {
 574                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 575                        sb->s_id, sb->s_type->name,
 576                        labeling_behaviors[sbsec->behavior-1]);
 577         }
 578
 579         /* Initialize the root inode. */
 580         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 581
 582         /* Initialize any other inodes associated with the superblock, e.g.
 583            inodes created prior to initial policy load or inodes created
 584            during get_sb by a pseudo filesystem that directly
 585            populates itself. */
 586         spin_lock(&sbsec->isec_lock);
 587 next_inode:
 588         if (!list_empty(&sbsec->isec_head)) {
 589                 struct inode_security_struct *isec =
 590                                 list_entry(sbsec->isec_head.next,
 591                                            struct inode_security_struct, list);
 592                 struct inode *inode = isec->inode;
 593                 spin_unlock(&sbsec->isec_lock);
 594                 inode = igrab(inode);
 595                 if (inode) {
 596                         if (!IS_PRIVATE (inode))
 597                                 inode_doinit(inode);
 598                         iput(inode);
 599                 }
 600                 spin_lock(&sbsec->isec_lock);
 601                 list_del_init(&isec->list);
 602                 goto next_inode;
 603         }
 604         spin_unlock(&sbsec->isec_lock);
 605 out:
 606         up(&sbsec->sem);
 607         return rc;
 608 }
 609
 610 static inline u16 inode_mode_to_security_class(umode_t mode)
 611 {
 612         switch (mode & S_IFMT) {
 613         case S_IFSOCK:
 614                 return SECCLASS_SOCK_FILE;
 615         case S_IFLNK:
 616                 return SECCLASS_LNK_FILE;
 617         case S_IFREG:
 618                 return SECCLASS_FILE;
 619         case S_IFBLK:
 620                 return SECCLASS_BLK_FILE;
 621         case S_IFDIR:
 622                 return SECCLASS_DIR;
 623         case S_IFCHR:
 624                 return SECCLASS_CHR_FILE;
 625         case S_IFIFO:
 626                 return SECCLASS_FIFO_FILE;
 627
 628         }
 629
 630         return SECCLASS_FILE;
 631 }
 632
 633 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 634 {
 635         switch (family) {
 636         case PF_UNIX:
 637                 switch (type) {
 638                 case SOCK_STREAM:
 639                 case SOCK_SEQPACKET:
 640                         return SECCLASS_UNIX_STREAM_SOCKET;
 641                 case SOCK_DGRAM:
 642                         return SECCLASS_UNIX_DGRAM_SOCKET;
 643                 }
 644                 break;
 645         case PF_INET:
 646         case PF_INET6:
 647                 switch (type) {
 648                 case SOCK_STREAM:
 649                         return SECCLASS_TCP_SOCKET;
 650                 case SOCK_DGRAM:
 651                         return SECCLASS_UDP_SOCKET;
 652                 case SOCK_RAW:
 653                         return SECCLASS_RAWIP_SOCKET;
 654                 }
 655                 break;
 656         case PF_NETLINK:
 657                 switch (protocol) {
 658                 case NETLINK_ROUTE:
 659                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 660                 case NETLINK_FIREWALL:
 661                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 662                 case NETLINK_TCPDIAG:
 663                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 664                 case NETLINK_NFLOG:
 665                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 666                 case NETLINK_XFRM:
 667                         return SECCLASS_NETLINK_XFRM_SOCKET;
 668                 case NETLINK_SELINUX:
 669                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 670                 case NETLINK_AUDIT:
 671                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 672                 case NETLINK_IP6_FW:
 673                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 674                 case NETLINK_DNRTMSG:
 675                         return SECCLASS_NETLINK_DNRT_SOCKET;
 676                 case NETLINK_KOBJECT_UEVENT:
 677                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 678                 default:
 679                         return SECCLASS_NETLINK_SOCKET;
 680                 }
 681         case PF_PACKET:
 682                 return SECCLASS_PACKET_SOCKET;
 683         case PF_KEY:
 684                 return SECCLASS_KEY_SOCKET;
 685         }
 686
 687         return SECCLASS_SOCKET;
 688 }
 689
 690 #ifdef CONFIG_PROC_FS
 691 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 692                                 u16 tclass,
 693                                 u32 *sid)
 694 {
 695         int buflen, rc;
 696         char *buffer, *path, *end;
 697
 698         buffer = (char*)__get_free_page(GFP_KERNEL);
 699         if (!buffer)
 700                 return -ENOMEM;
 701
 702         buflen = PAGE_SIZE;
 703         end = buffer+buflen;
 704         *--end = '\0';
 705         buflen--;
 706         path = end-1;
 707         *path = '/';
 708         while (de && de != de->parent) {
 709                 buflen -= de->namelen + 1;
 710                 if (buflen < 0)
 711                         break;
 712                 end -= de->namelen;
 713                 memcpy(end, de->name, de->namelen);
 714                 *--end = '/';
 715                 path = end;
 716                 de = de->parent;
 717         }
 718         rc = security_genfs_sid("proc", path, tclass, sid);
 719         free_page((unsigned long)buffer);
 720         return rc;
 721 }
 722 #else
 723 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 724                                 u16 tclass,
 725                                 u32 *sid)
 726 {
 727         return -EINVAL;
 728 }
 729 #endif
 730
 731 /* The inode's security attributes must be initialized before first use. */
 732 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 733 {
 734         struct superblock_security_struct *sbsec = NULL;
 735         struct inode_security_struct *isec = inode->i_security;
 736         u32 sid;
 737         struct dentry *dentry;
 738 #define INITCONTEXTLEN 255
 739         char *context = NULL;
 740         unsigned len = 0;
 741         int rc = 0;
 742         int hold_sem = 0;
 743
 744         if (isec->initialized)
 745                 goto out;
 746
 747         down(&isec->sem);
 748         hold_sem = 1;
 749         if (isec->initialized)
 750                 goto out;
 751
 752         sbsec = inode->i_sb->s_security;
 753         if (!sbsec->initialized) {
 754                 /* Defer initialization until selinux_complete_init,
 755                    after the initial policy is loaded and the security
 756                    server is ready to handle calls. */
 757                 spin_lock(&sbsec->isec_lock);
 758                 if (list_empty(&isec->list))
 759                         list_add(&isec->list, &sbsec->isec_head);
 760                 spin_unlock(&sbsec->isec_lock);
 761                 goto out;
 762         }
 763
 764         switch (sbsec->behavior) {
 765         case SECURITY_FS_USE_XATTR:
 766                 if (!inode->i_op->getxattr) {
 767                         isec->sid = sbsec->def_sid;
 768                         break;
 769                 }
 770
 771                 /* Need a dentry, since the xattr API requires one.
 772                    Life would be simpler if we could just pass the inode. */
 773                 if (opt_dentry) {
 774                         /* Called from d_instantiate or d_splice_alias. */
 775                         dentry = dget(opt_dentry);
 776                 } else {
 777                         /* Called from selinux_complete_init, try to find a dentry. */
 778                         dentry = d_find_alias(inode);
 779                 }
 780                 if (!dentry) {
 781                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 782                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 783                                inode->i_ino);
 784                         goto out;
 785                 }
 786
 787                 len = INITCONTEXTLEN;
 788                 context = kmalloc(len, GFP_KERNEL);
 789                 if (!context) {
 790                         rc = -ENOMEM;
 791                         dput(dentry);
 792                         goto out;
 793                 }
 794                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 795                                            context, len);
 796                 if (rc == -ERANGE) {
 797                         /* Need a larger buffer.  Query for the right size. */
 798                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 799                                                    NULL, 0);
 800                         if (rc < 0) {
 801                                 dput(dentry);
 802                                 goto out;
 803                         }
 804                         kfree(context);
 805                         len = rc;
 806                         context = kmalloc(len, GFP_KERNEL);
 807                         if (!context) {
 808                                 rc = -ENOMEM;
 809                                 dput(dentry);
 810                                 goto out;
 811                         }
 812                         rc = inode->i_op->getxattr(dentry,
 813                                                    XATTR_NAME_SELINUX,
 814                                                    context, len);
 815                 }
 816                 dput(dentry);
 817                 if (rc < 0) {
 818                         if (rc != -ENODATA) {
 819                                 printk(KERN_WARNING "%s:  getxattr returned "
 820                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 821                                        -rc, inode->i_sb->s_id, inode->i_ino);
 822                                 kfree(context);
 823                                 goto out;
 824                         }
 825                         /* Map ENODATA to the default file SID */
 826                         sid = sbsec->def_sid;
 827                         rc = 0;
 828                 } else {
 829                         rc = security_context_to_sid(context, rc, &sid);
 830                         if (rc) {
 831                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 832                                        "returned %d for dev=%s ino=%ld\n",
 833                                        __FUNCTION__, context, -rc,
 834                                        inode->i_sb->s_id, inode->i_ino);
 835                                 kfree(context);
 836                                 /* Leave with the unlabeled SID */
 837                                 rc = 0;
 838                                 break;
 839                         }
 840                 }
 841                 kfree(context);
 842                 isec->sid = sid;
 843                 break;
 844         case SECURITY_FS_USE_TASK:
 845                 isec->sid = isec->task_sid;
 846                 break;
 847         case SECURITY_FS_USE_TRANS:
 848                 /* Default to the fs SID. */
 849                 isec->sid = sbsec->sid;
 850
 851                 /* Try to obtain a transition SID. */
 852                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 853                 rc = security_transition_sid(isec->task_sid,
 854                                              sbsec->sid,
 855                                              isec->sclass,
 856                                              &sid);
 857                 if (rc)
 858                         goto out;
 859                 isec->sid = sid;
 860                 break;
 861         default:
 862                 /* Default to the fs SID. */
 863                 isec->sid = sbsec->sid;
 864
 865                 if (sbsec->proc) {
 866                         struct proc_inode *proci = PROC_I(inode);
 867                         if (proci->pde) {
 868                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 869                                 rc = selinux_proc_get_sid(proci->pde,
 870                                                           isec->sclass,
 871                                                           &sid);
 872                                 if (rc)
 873                                         goto out;
 874                                 isec->sid = sid;
 875                         }
 876                 }
 877                 break;
 878         }
 879
 880         isec->initialized = 1;
 881
 882 out:
 883         if (isec->sclass == SECCLASS_FILE)
 884                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 885
 886         if (hold_sem)
 887                 up(&isec->sem);
 888         return rc;
 889 }
 890
 891 /* Convert a Linux signal to an access vector. */
 892 static inline u32 signal_to_av(int sig)
 893 {
 894         u32 perm = 0;
 895
 896         switch (sig) {
 897         case SIGCHLD:
 898                 /* Commonly granted from child to parent. */
 899                 perm = PROCESS__SIGCHLD;
 900                 break;
 901         case SIGKILL:
 902                 /* Cannot be caught or ignored */
 903                 perm = PROCESS__SIGKILL;
 904                 break;
 905         case SIGSTOP:
 906                 /* Cannot be caught or ignored */
 907                 perm = PROCESS__SIGSTOP;
 908                 break;
 909         default:
 910                 /* All other signals. */
 911                 perm = PROCESS__SIGNAL;
 912                 break;
 913         }
 914
 915         return perm;
 916 }
 917
 918 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 919    fork check, ptrace check, etc. */
 920 static int task_has_perm(struct task_struct *tsk1,
 921                          struct task_struct *tsk2,
 922                          u32 perms)
 923 {
 924         struct task_security_struct *tsec1, *tsec2;
 925
 926         tsec1 = tsk1->security;
 927         tsec2 = tsk2->security;
 928         return avc_has_perm(tsec1->sid, tsec2->sid,
 929                             SECCLASS_PROCESS, perms, NULL);
 930 }
 931
 932 /* Check whether a task is allowed to use a capability. */
 933 static int task_has_capability(struct task_struct *tsk,
 934                                int cap)
 935 {
 936         struct task_security_struct *tsec;
 937         struct avc_audit_data ad;
 938
 939         tsec = tsk->security;
 940
 941         AVC_AUDIT_DATA_INIT(&ad,CAP);
 942         ad.tsk = tsk;
 943         ad.u.cap = cap;
 944
 945         return avc_has_perm(tsec->sid, tsec->sid,
 946                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 947 }
 948
 949 /* Check whether a task is allowed to use a system operation. */
 950 static int task_has_system(struct task_struct *tsk,
 951                            u32 perms)
 952 {
 953         struct task_security_struct *tsec;
 954
 955         tsec = tsk->security;
 956
 957         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 958                             SECCLASS_SYSTEM, perms, NULL);
 959 }
 960
 961 /* Check whether a task has a particular permission to an inode.
 962    The 'adp' parameter is optional and allows other audit
 963    data to be passed (e.g. the dentry). */
 964 static int inode_has_perm(struct task_struct *tsk,
 965                           struct inode *inode,
 966                           u32 perms,
 967                           struct avc_audit_data *adp)
 968 {
 969         struct task_security_struct *tsec;
 970         struct inode_security_struct *isec;
 971         struct avc_audit_data ad;
 972
 973         tsec = tsk->security;
 974         isec = inode->i_security;
 975
 976         if (!adp) {
 977                 adp = &ad;
 978                 AVC_AUDIT_DATA_INIT(&ad, FS);
 979                 ad.u.fs.inode = inode;
 980         }
 981
 982         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 983 }
 984
 985 /* Same as inode_has_perm, but pass explicit audit data containing
 986    the dentry to help the auditing code to more easily generate the
 987    pathname if needed. */
 988 static inline int dentry_has_perm(struct task_struct *tsk,
 989                                   struct vfsmount *mnt,
 990                                   struct dentry *dentry,
 991                                   u32 av)
 992 {
 993         struct inode *inode = dentry->d_inode;
 994         struct avc_audit_data ad;
 995         AVC_AUDIT_DATA_INIT(&ad,FS);
 996         ad.u.fs.mnt = mnt;
 997         ad.u.fs.dentry = dentry;
 998         return inode_has_perm(tsk, inode, av, &ad);
 999 }
1000
1001 /* Check whether a task can use an open file descriptor to
1002    access an inode in a given way.  Check access to the
1003    descriptor itself, and then use dentry_has_perm to
1004    check a particular permission to the file.
1005    Access to the descriptor is implicitly granted if it
1006    has the same SID as the process.  If av is zero, then
1007    access to the file is not checked, e.g. for cases
1008    where only the descriptor is affected like seek. */
1009 static inline int file_has_perm(struct task_struct *tsk,
1010                                 struct file *file,
1011                                 u32 av)
1012 {
1013         struct task_security_struct *tsec = tsk->security;
1014         struct file_security_struct *fsec = file->f_security;
1015         struct vfsmount *mnt = file->f_vfsmnt;
1016         struct dentry *dentry = file->f_dentry;
1017         struct inode *inode = dentry->d_inode;
1018         struct avc_audit_data ad;
1019         int rc;
1020
1021         AVC_AUDIT_DATA_INIT(&ad, FS);
1022         ad.u.fs.mnt = mnt;
1023         ad.u.fs.dentry = dentry;
1024
1025         if (tsec->sid != fsec->sid) {
1026                 rc = avc_has_perm(tsec->sid, fsec->sid,
1027                                   SECCLASS_FD,
1028                                   FD__USE,
1029                                   &ad);
1030                 if (rc)
1031                         return rc;
1032         }
1033
1034         /* av is zero if only checking access to the descriptor. */
1035         if (av)
1036                 return inode_has_perm(tsk, inode, av, &ad);
1037
1038         return 0;
1039 }
1040
1041 /* Check whether a task can create a file. */
1042 static int may_create(struct inode *dir,
1043                       struct dentry *dentry,
1044                       u16 tclass)
1045 {
1046         struct task_security_struct *tsec;
1047         struct inode_security_struct *dsec;
1048         struct superblock_security_struct *sbsec;
1049         u32 newsid;
1050         struct avc_audit_data ad;
1051         int rc;
1052
1053         tsec = current->security;
1054         dsec = dir->i_security;
1055         sbsec = dir->i_sb->s_security;
1056
1057         AVC_AUDIT_DATA_INIT(&ad, FS);
1058         ad.u.fs.dentry = dentry;
1059
1060         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1061                           DIR__ADD_NAME | DIR__SEARCH,
1062                           &ad);
1063         if (rc)
1064                 return rc;
1065
1066         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1067                 newsid = tsec->create_sid;
1068         } else {
1069                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1070                                              &newsid);
1071                 if (rc)
1072                         return rc;
1073         }
1074
1075         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1076         if (rc)
1077                 return rc;
1078
1079         return avc_has_perm(newsid, sbsec->sid,
1080                             SECCLASS_FILESYSTEM,
1081                             FILESYSTEM__ASSOCIATE, &ad);
1082 }
1083
1084 #define MAY_LINK   0
1085 #define MAY_UNLINK 1
1086 #define MAY_RMDIR  2
1087
1088 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1089 static int may_link(struct inode *dir,
1090                     struct dentry *dentry,
1091                     int kind)
1092
1093 {
1094         struct task_security_struct *tsec;
1095         struct inode_security_struct *dsec, *isec;
1096         struct avc_audit_data ad;
1097         u32 av;
1098         int rc;
1099
1100         tsec = current->security;
1101         dsec = dir->i_security;
1102         isec = dentry->d_inode->i_security;
1103
1104         AVC_AUDIT_DATA_INIT(&ad, FS);
1105         ad.u.fs.dentry = dentry;
1106
1107         av = DIR__SEARCH;
1108         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1109         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1110         if (rc)
1111                 return rc;
1112
1113         switch (kind) {
1114         case MAY_LINK:
1115                 av = FILE__LINK;
1116                 break;
1117         case MAY_UNLINK:
1118                 av = FILE__UNLINK;
1119                 break;
1120         case MAY_RMDIR:
1121                 av = DIR__RMDIR;
1122                 break;
1123         default:
1124                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1125                 return 0;
1126         }
1127
1128         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1129         return rc;
1130 }
1131
1132 static inline int may_rename(struct inode *old_dir,
1133                              struct dentry *old_dentry,
1134                              struct inode *new_dir,
1135                              struct dentry *new_dentry)
1136 {
1137         struct task_security_struct *tsec;
1138         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1139         struct avc_audit_data ad;
1140         u32 av;
1141         int old_is_dir, new_is_dir;
1142         int rc;
1143
1144         tsec = current->security;
1145         old_dsec = old_dir->i_security;
1146         old_isec = old_dentry->d_inode->i_security;
1147         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1148         new_dsec = new_dir->i_security;
1149
1150         AVC_AUDIT_DATA_INIT(&ad, FS);
1151
1152         ad.u.fs.dentry = old_dentry;
1153         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1154                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1155         if (rc)
1156                 return rc;
1157         rc = avc_has_perm(tsec->sid, old_isec->sid,
1158                           old_isec->sclass, FILE__RENAME, &ad);
1159         if (rc)
1160                 return rc;
1161         if (old_is_dir && new_dir != old_dir) {
1162                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1163                                   old_isec->sclass, DIR__REPARENT, &ad);
1164                 if (rc)
1165                         return rc;
1166         }
1167
1168         ad.u.fs.dentry = new_dentry;
1169         av = DIR__ADD_NAME | DIR__SEARCH;
1170         if (new_dentry->d_inode)
1171                 av |= DIR__REMOVE_NAME;
1172         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1173         if (rc)
1174                 return rc;
1175         if (new_dentry->d_inode) {
1176                 new_isec = new_dentry->d_inode->i_security;
1177                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1178                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1179                                   new_isec->sclass,
1180                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1181                 if (rc)
1182                         return rc;
1183         }
1184
1185         return 0;
1186 }
1187
1188 /* Check whether a task can perform a filesystem operation. */
1189 static int superblock_has_perm(struct task_struct *tsk,
1190                                struct super_block *sb,
1191                                u32 perms,
1192                                struct avc_audit_data *ad)
1193 {
1194         struct task_security_struct *tsec;
1195         struct superblock_security_struct *sbsec;
1196
1197         tsec = tsk->security;
1198         sbsec = sb->s_security;
1199         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1200                             perms, ad);
1201 }
1202
1203 /* Convert a Linux mode and permission mask to an access vector. */
1204 static inline u32 file_mask_to_av(int mode, int mask)
1205 {
1206         u32 av = 0;
1207
1208         if ((mode & S_IFMT) != S_IFDIR) {
1209                 if (mask & MAY_EXEC)
1210                         av |= FILE__EXECUTE;
1211                 if (mask & MAY_READ)
1212                         av |= FILE__READ;
1213
1214                 if (mask & MAY_APPEND)
1215                         av |= FILE__APPEND;
1216                 else if (mask & MAY_WRITE)
1217                         av |= FILE__WRITE;
1218
1219         } else {
1220                 if (mask & MAY_EXEC)
1221                         av |= DIR__SEARCH;
1222                 if (mask & MAY_WRITE)
1223                         av |= DIR__WRITE;
1224                 if (mask & MAY_READ)
1225                         av |= DIR__READ;
1226         }
1227
1228         return av;
1229 }
1230
1231 /* Convert a Linux file to an access vector. */
1232 static inline u32 file_to_av(struct file *file)
1233 {
1234         u32 av = 0;
1235
1236         if (file->f_mode & FMODE_READ)
1237                 av |= FILE__READ;
1238         if (file->f_mode & FMODE_WRITE) {
1239                 if (file->f_flags & O_APPEND)
1240                         av |= FILE__APPEND;
1241                 else
1242                         av |= FILE__WRITE;
1243         }
1244
1245         return av;
1246 }
1247
1248 /* Set an inode's SID to a specified value. */
1249 static int inode_security_set_sid(struct inode *inode, u32 sid)
1250 {
1251         struct inode_security_struct *isec = inode->i_security;
1252         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1253
1254         if (!sbsec->initialized) {
1255                 /* Defer initialization to selinux_complete_init. */
1256                 return 0;
1257         }
1258
1259         down(&isec->sem);
1260         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1261         isec->sid = sid;
1262         isec->initialized = 1;
1263         up(&isec->sem);
1264         return 0;
1265 }
1266
1267 /* Set the security attributes on a newly created file. */
1268 static int post_create(struct inode *dir,
1269                        struct dentry *dentry)
1270 {
1271
1272         struct task_security_struct *tsec;
1273         struct inode *inode;
1274         struct inode_security_struct *dsec;
1275         struct superblock_security_struct *sbsec;
1276         u32 newsid;
1277         char *context;
1278         unsigned int len;
1279         int rc;
1280
1281         tsec = current->security;
1282         dsec = dir->i_security;
1283         sbsec = dir->i_sb->s_security;
1284
1285         inode = dentry->d_inode;
1286         if (!inode) {
1287                 /* Some file system types (e.g. NFS) may not instantiate
1288                    a dentry for all create operations (e.g. symlink),
1289                    so we have to check to see if the inode is non-NULL. */
1290                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1291                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1292                 return 0;
1293         }
1294
1295         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1296                 newsid = tsec->create_sid;
1297         } else {
1298                 rc = security_transition_sid(tsec->sid, dsec->sid,
1299                                              inode_mode_to_security_class(inode->i_mode),
1300                                              &newsid);
1301                 if (rc) {
1302                         printk(KERN_WARNING "post_create:  "
1303                                "security_transition_sid failed, rc=%d (dev=%s "
1304                                "ino=%ld)\n",
1305                                -rc, inode->i_sb->s_id, inode->i_ino);
1306                         return rc;
1307                 }
1308         }
1309
1310         rc = inode_security_set_sid(inode, newsid);
1311         if (rc) {
1312                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1313                        "failed, rc=%d (dev=%s ino=%ld)\n",
1314                        -rc, inode->i_sb->s_id, inode->i_ino);
1315                 return rc;
1316         }
1317
1318         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1319             inode->i_op->setxattr) {
1320                 /* Use extended attributes. */
1321                 rc = security_sid_to_context(newsid, &context, &len);
1322                 if (rc) {
1323                         printk(KERN_WARNING "post_create:  sid_to_context "
1324                                "failed, rc=%d (dev=%s ino=%ld)\n",
1325                                -rc, inode->i_sb->s_id, inode->i_ino);
1326                         return rc;
1327                 }
1328                 down(&inode->i_sem);
1329                 rc = inode->i_op->setxattr(dentry,
1330                                            XATTR_NAME_SELINUX,
1331                                            context, len, 0);
1332                 up(&inode->i_sem);
1333                 kfree(context);
1334                 if (rc < 0) {
1335                         printk(KERN_WARNING "post_create:  setxattr failed, "
1336                                "rc=%d (dev=%s ino=%ld)\n",
1337                                -rc, inode->i_sb->s_id, inode->i_ino);
1338                         return rc;
1339                 }
1340         }
1341
1342         return 0;
1343 }
1344
1345
1346 /* Hook functions begin here. */
1347
1348 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1349 {
1350         struct task_security_struct *psec = parent->security;
1351         struct task_security_struct *csec = child->security;
1352         int rc;
1353
1354         rc = secondary_ops->ptrace(parent,child);
1355         if (rc)
1356                 return rc;
1357
1358         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1359         /* Save the SID of the tracing process for later use in apply_creds. */
1360         if (!rc)
1361                 csec->ptrace_sid = psec->sid;
1362         return rc;
1363 }
1364
1365 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1366                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1367 {
1368         int error;
1369
1370         error = task_has_perm(current, target, PROCESS__GETCAP);
1371         if (error)
1372                 return error;
1373
1374         return secondary_ops->capget(target, effective, inheritable, permitted);
1375 }
1376
1377 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1378                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1379 {
1380         int error;
1381
1382         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1383         if (error)
1384                 return error;
1385
1386         return task_has_perm(current, target, PROCESS__SETCAP);
1387 }
1388
1389 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1390                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1391 {
1392         secondary_ops->capset_set(target, effective, inheritable, permitted);
1393 }
1394
1395 static int selinux_capable(struct task_struct *tsk, int cap)
1396 {
1397         int rc;
1398
1399         rc = secondary_ops->capable(tsk, cap);
1400         if (rc)
1401                 return rc;
1402
1403         return task_has_capability(tsk,cap);
1404 }
1405
1406 static int selinux_sysctl(ctl_table *table, int op)
1407 {
1408         int error = 0;
1409         u32 av;
1410         struct task_security_struct *tsec;
1411         u32 tsid;
1412         int rc;
1413
1414         rc = secondary_ops->sysctl(table, op);
1415         if (rc)
1416                 return rc;
1417
1418         tsec = current->security;
1419
1420         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1421                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1422         if (rc) {
1423                 /* Default to the well-defined sysctl SID. */
1424                 tsid = SECINITSID_SYSCTL;
1425         }
1426
1427         /* The op values are "defined" in sysctl.c, thereby creating
1428          * a bad coupling between this module and sysctl.c */
1429         if(op == 001) {
1430                 error = avc_has_perm(tsec->sid, tsid,
1431                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1432         } else {
1433                 av = 0;
1434                 if (op & 004)
1435                         av |= FILE__READ;
1436                 if (op & 002)
1437                         av |= FILE__WRITE;
1438                 if (av)
1439                         error = avc_has_perm(tsec->sid, tsid,
1440                                              SECCLASS_FILE, av, NULL);
1441         }
1442
1443         return error;
1444 }
1445
1446 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1447 {
1448         int rc = 0;
1449
1450         if (!sb)
1451                 return 0;
1452
1453         switch (cmds) {
1454                 case Q_SYNC:
1455                 case Q_QUOTAON:
1456                 case Q_QUOTAOFF:
1457                 case Q_SETINFO:
1458                 case Q_SETQUOTA:
1459                         rc = superblock_has_perm(current,
1460                                                  sb,
1461                                                  FILESYSTEM__QUOTAMOD, NULL);
1462                         break;
1463                 case Q_GETFMT:
1464                 case Q_GETINFO:
1465                 case Q_GETQUOTA:
1466                         rc = superblock_has_perm(current,
1467                                                  sb,
1468                                                  FILESYSTEM__QUOTAGET, NULL);
1469                         break;
1470                 default:
1471                         rc = 0;  /* let the kernel handle invalid cmds */
1472                         break;
1473         }
1474         return rc;
1475 }
1476
1477 static int selinux_quota_on(struct dentry *dentry)
1478 {
1479         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1480 }
1481
1482 static int selinux_syslog(int type)
1483 {
1484         int rc;
1485
1486         rc = secondary_ops->syslog(type);
1487         if (rc)
1488                 return rc;
1489
1490         switch (type) {
1491                 case 3:         /* Read last kernel messages */
1492                 case 10:        /* Return size of the log buffer */
1493                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1494                         break;
1495                 case 6:         /* Disable logging to console */
1496                 case 7:         /* Enable logging to console */
1497                 case 8:         /* Set level of messages printed to console */
1498                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1499                         break;
1500                 case 0:         /* Close log */
1501                 case 1:         /* Open log */
1502                 case 2:         /* Read from log */
1503                 case 4:         /* Read/clear last kernel messages */
1504                 case 5:         /* Clear ring buffer */
1505                 default:
1506                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1507                         break;
1508         }
1509         return rc;
1510 }
1511
1512 /*
1513  * Check that a process has enough memory to allocate a new virtual
1514  * mapping. 0 means there is enough memory for the allocation to
1515  * succeed and -ENOMEM implies there is not.
1516  *
1517  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1518  * if the capability is granted, but __vm_enough_memory requires 1 if
1519  * the capability is granted.
1520  *
1521  * Do not audit the selinux permission check, as this is applied to all
1522  * processes that allocate mappings.
1523  */
1524 static int selinux_vm_enough_memory(long pages)
1525 {
1526         int rc, cap_sys_admin = 0;
1527         struct task_security_struct *tsec = current->security;
1528
1529         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1530         if (rc == 0)
1531                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1532                                         SECCLASS_CAPABILITY,
1533                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1534                                         NULL);
1535
1536         if (rc == 0)
1537                 cap_sys_admin = 1;
1538
1539         return __vm_enough_memory(pages, cap_sys_admin);
1540 }
1541
1542 /* binprm security operations */
1543
1544 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1545 {
1546         struct bprm_security_struct *bsec;
1547
1548         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1549         if (!bsec)
1550                 return -ENOMEM;
1551
1552         memset(bsec, 0, sizeof *bsec);
1553         bsec->magic = SELINUX_MAGIC;
1554         bsec->bprm = bprm;
1555         bsec->sid = SECINITSID_UNLABELED;
1556         bsec->set = 0;
1557
1558         bprm->security = bsec;
1559         return 0;
1560 }
1561
1562 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1563 {
1564         struct task_security_struct *tsec;
1565         struct inode *inode = bprm->file->f_dentry->d_inode;
1566         struct inode_security_struct *isec;
1567         struct bprm_security_struct *bsec;
1568         u32 newsid;
1569         struct avc_audit_data ad;
1570         int rc;
1571
1572         rc = secondary_ops->bprm_set_security(bprm);
1573         if (rc)
1574                 return rc;
1575
1576         bsec = bprm->security;
1577
1578         if (bsec->set)
1579                 return 0;
1580
1581         tsec = current->security;
1582         isec = inode->i_security;
1583
1584         /* Default to the current task SID. */
1585         bsec->sid = tsec->sid;
1586
1587         /* Reset create SID on execve. */
1588         tsec->create_sid = 0;
1589
1590         if (tsec->exec_sid) {
1591                 newsid = tsec->exec_sid;
1592                 /* Reset exec SID on execve. */
1593                 tsec->exec_sid = 0;
1594         } else {
1595                 /* Check for a default transition on this program. */
1596                 rc = security_transition_sid(tsec->sid, isec->sid,
1597                                              SECCLASS_PROCESS, &newsid);
1598                 if (rc)
1599                         return rc;
1600         }
1601
1602         AVC_AUDIT_DATA_INIT(&ad, FS);
1603         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1604         ad.u.fs.dentry = bprm->file->f_dentry;
1605
1606         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1607                 newsid = tsec->sid;
1608
1609         if (tsec->sid == newsid) {
1610                 rc = avc_has_perm(tsec->sid, isec->sid,
1611                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1612                 if (rc)
1613                         return rc;
1614         } else {
1615                 /* Check permissions for the transition. */
1616                 rc = avc_has_perm(tsec->sid, newsid,
1617                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1618                 if (rc)
1619                         return rc;
1620
1621                 rc = avc_has_perm(newsid, isec->sid,
1622                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1623                 if (rc)
1624                         return rc;
1625
1626                 /* Clear any possibly unsafe personality bits on exec: */
1627                 current->personality &= ~PER_CLEAR_ON_SETID;
1628
1629                 /* Set the security field to the new SID. */
1630                 bsec->sid = newsid;
1631         }
1632
1633         bsec->set = 1;
1634         return 0;
1635 }
1636
1637 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1638 {
1639         return secondary_ops->bprm_check_security(bprm);
1640 }
1641
1642
1643 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1644 {
1645         struct task_security_struct *tsec = current->security;
1646         int atsecure = 0;
1647
1648         if (tsec->osid != tsec->sid) {
1649                 /* Enable secure mode for SIDs transitions unless
1650                    the noatsecure permission is granted between
1651                    the two SIDs, i.e. ahp returns 0. */
1652                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1653                                          SECCLASS_PROCESS,
1654                                          PROCESS__NOATSECURE, NULL);
1655         }
1656
1657         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1658 }
1659
1660 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1661 {
1662         kfree(bprm->security);
1663         bprm->security = NULL;
1664 }
1665
1666 extern struct vfsmount *selinuxfs_mount;
1667 extern struct dentry *selinux_null;
1668
1669 /* Derived from fs/exec.c:flush_old_files. */
1670 static inline void flush_unauthorized_files(struct files_struct * files)
1671 {
1672         struct avc_audit_data ad;
1673         struct file *file, *devnull = NULL;
1674         struct tty_struct *tty = current->signal->tty;
1675         long j = -1;
1676
1677         if (tty) {
1678                 file_list_lock();
1679                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1680                 if (file) {
1681                         /* Revalidate access to controlling tty.
1682                            Use inode_has_perm on the tty inode directly rather
1683                            than using file_has_perm, as this particular open
1684                            file may belong to another process and we are only
1685                            interested in the inode-based check here. */
1686                         struct inode *inode = file->f_dentry->d_inode;
1687                         if (inode_has_perm(current, inode,
1688                                            FILE__READ | FILE__WRITE, NULL)) {
1689                                 /* Reset controlling tty. */
1690                                 current->signal->tty = NULL;
1691                                 current->signal->tty_old_pgrp = 0;
1692                         }
1693                 }
1694                 file_list_unlock();
1695         }
1696
1697         /* Revalidate access to inherited open files. */
1698
1699         AVC_AUDIT_DATA_INIT(&ad,FS);
1700
1701         spin_lock(&files->file_lock);
1702         for (;;) {
1703                 unsigned long set, i;
1704                 int fd;
1705
1706                 j++;
1707                 i = j * __NFDBITS;
1708                 if (i >= files->max_fds || i >= files->max_fdset)
1709                         break;
1710                 set = files->open_fds->fds_bits[j];
1711                 if (!set)
1712                         continue;
1713                 spin_unlock(&files->file_lock);
1714                 for ( ; set ; i++,set >>= 1) {
1715                         if (set & 1) {
1716                                 file = fget(i);
1717                                 if (!file)
1718                                         continue;
1719                                 if (file_has_perm(current,
1720                                                   file,
1721                                                   file_to_av(file))) {
1722                                         sys_close(i);
1723                                         fd = get_unused_fd();
1724                                         if (fd != i) {
1725                                                 if (fd >= 0)
1726                                                         put_unused_fd(fd);
1727                                                 fput(file);
1728                                                 continue;
1729                                         }
1730                                         if (devnull) {
1731                                                 atomic_inc(&devnull->f_count);
1732                                         } else {
1733                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1734                                                 if (!devnull) {
1735                                                         put_unused_fd(fd);
1736                                                         fput(file);
1737                                                         continue;
1738                                                 }
1739                                         }
1740                                         fd_install(fd, devnull);
1741                                 }
1742                                 fput(file);
1743                         }
1744                 }
1745                 spin_lock(&files->file_lock);
1746
1747         }
1748         spin_unlock(&files->file_lock);
1749 }
1750
1751 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1752 {
1753         struct task_security_struct *tsec;
1754         struct bprm_security_struct *bsec;
1755         u32 sid;
1756         int rc;
1757
1758         secondary_ops->bprm_apply_creds(bprm, unsafe);
1759
1760         tsec = current->security;
1761
1762         bsec = bprm->security;
1763         sid = bsec->sid;
1764
1765         tsec->osid = tsec->sid;
1766         bsec->unsafe = 0;
1767         if (tsec->sid != sid) {
1768                 /* Check for shared state.  If not ok, leave SID
1769                    unchanged and kill. */
1770                 if (unsafe & LSM_UNSAFE_SHARE) {
1771                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1772                                         PROCESS__SHARE, NULL);
1773                         if (rc) {
1774                                 bsec->unsafe = 1;
1775                                 return;
1776                         }
1777                 }
1778
1779                 /* Check for ptracing, and update the task SID if ok.
1780                    Otherwise, leave SID unchanged and kill. */
1781                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1782                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1783                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1784                                           NULL);
1785                         if (rc) {
1786                                 bsec->unsafe = 1;
1787                                 return;
1788                         }
1789                 }
1790                 tsec->sid = sid;
1791         }
1792 }
1793
1794 /*
1795  * called after apply_creds without the task lock held
1796  */
1797 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1798 {
1799         struct task_security_struct *tsec;
1800         struct rlimit *rlim, *initrlim;
1801         struct itimerval itimer;
1802         struct bprm_security_struct *bsec;
1803         int rc, i;
1804
1805         tsec = current->security;
1806         bsec = bprm->security;
1807
1808         if (bsec->unsafe) {
1809                 force_sig_specific(SIGKILL, current);
1810                 return;
1811         }
1812         if (tsec->osid == tsec->sid)
1813                 return;
1814
1815         /* Close files for which the new task SID is not authorized. */
1816         flush_unauthorized_files(current->files);
1817
1818         /* Check whether the new SID can inherit signal state
1819            from the old SID.  If not, clear itimers to avoid
1820            subsequent signal generation and flush and unblock
1821            signals. This must occur _after_ the task SID has
1822           been updated so that any kill done after the flush
1823           will be checked against the new SID. */
1824         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1825                           PROCESS__SIGINH, NULL);
1826         if (rc) {
1827                 memset(&itimer, 0, sizeof itimer);
1828                 for (i = 0; i < 3; i++)
1829                         do_setitimer(i, &itimer, NULL);
1830                 flush_signals(current);
1831                 spin_lock_irq(&current->sighand->siglock);
1832                 flush_signal_handlers(current, 1);
1833                 sigemptyset(&current->blocked);
1834                 recalc_sigpending();
1835                 spin_unlock_irq(&current->sighand->siglock);
1836         }
1837
1838         /* Check whether the new SID can inherit resource limits
1839            from the old SID.  If not, reset all soft limits to
1840            the lower of the current task's hard limit and the init
1841            task's soft limit.  Note that the setting of hard limits
1842            (even to lower them) can be controlled by the setrlimit
1843            check. The inclusion of the init task's soft limit into
1844            the computation is to avoid resetting soft limits higher
1845            than the default soft limit for cases where the default
1846            is lower than the hard limit, e.g. RLIMIT_CORE or
1847            RLIMIT_STACK.*/
1848         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1849                           PROCESS__RLIMITINH, NULL);
1850         if (rc) {
1851                 for (i = 0; i < RLIM_NLIMITS; i++) {
1852                         rlim = current->signal->rlim + i;
1853                         initrlim = init_task.signal->rlim+i;
1854                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1855                 }
1856                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1857                         /*
1858                          * This will cause RLIMIT_CPU calculations
1859                          * to be refigured.
1860                          */
1861                         current->it_prof_expires = jiffies_to_cputime(1);
1862                 }
1863         }
1864
1865         /* Wake up the parent if it is waiting so that it can
1866            recheck wait permission to the new task SID. */
1867         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1868 }
1869
1870 /* superblock security operations */
1871
1872 static int selinux_sb_alloc_security(struct super_block *sb)
1873 {
1874         return superblock_alloc_security(sb);
1875 }
1876
1877 static void selinux_sb_free_security(struct super_block *sb)
1878 {
1879         superblock_free_security(sb);
1880 }
1881
1882 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1883 {
1884         if (plen > olen)
1885                 return 0;
1886
1887         return !memcmp(prefix, option, plen);
1888 }
1889
1890 static inline int selinux_option(char *option, int len)
1891 {
1892         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1893                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1894                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1895 }
1896
1897 static inline void take_option(char **to, char *from, int *first, int len)
1898 {
1899         if (!*first) {
1900                 **to = ',';
1901                 *to += 1;
1902         }
1903         else
1904                 *first = 0;
1905         memcpy(*to, from, len);
1906         *to += len;
1907 }
1908
1909 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1910 {
1911         int fnosec, fsec, rc = 0;
1912         char *in_save, *in_curr, *in_end;
1913         char *sec_curr, *nosec_save, *nosec;
1914
1915         in_curr = orig;
1916         sec_curr = copy;
1917
1918         /* Binary mount data: just copy */
1919         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1920                 copy_page(sec_curr, in_curr);
1921                 goto out;
1922         }
1923
1924         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1925         if (!nosec) {
1926                 rc = -ENOMEM;
1927                 goto out;
1928         }
1929
1930         nosec_save = nosec;
1931         fnosec = fsec = 1;
1932         in_save = in_end = orig;
1933
1934         do {
1935                 if (*in_end == ',' || *in_end == '\0') {
1936                         int len = in_end - in_curr;
1937
1938                         if (selinux_option(in_curr, len))
1939                                 take_option(&sec_curr, in_curr, &fsec, len);
1940                         else
1941                                 take_option(&nosec, in_curr, &fnosec, len);
1942
1943                         in_curr = in_end + 1;
1944                 }
1945         } while (*in_end++);
1946
1947         strcpy(in_save, nosec_save);
1948         free_page((unsigned long)nosec_save);
1949 out:
1950         return rc;
1951 }
1952
1953 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1954 {
1955         struct avc_audit_data ad;
1956         int rc;
1957
1958         rc = superblock_doinit(sb, data);
1959         if (rc)
1960                 return rc;
1961
1962         AVC_AUDIT_DATA_INIT(&ad,FS);
1963         ad.u.fs.dentry = sb->s_root;
1964         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1965 }
1966
1967 static int selinux_sb_statfs(struct super_block *sb)
1968 {
1969         struct avc_audit_data ad;
1970
1971         AVC_AUDIT_DATA_INIT(&ad,FS);
1972         ad.u.fs.dentry = sb->s_root;
1973         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1974 }
1975
1976 static int selinux_mount(char * dev_name,
1977                          struct nameidata *nd,
1978                          char * type,
1979                          unsigned long flags,
1980                          void * data)
1981 {
1982         int rc;
1983
1984         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1985         if (rc)
1986                 return rc;
1987
1988         if (flags & MS_REMOUNT)
1989                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1990                                            FILESYSTEM__REMOUNT, NULL);
1991         else
1992                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1993                                        FILE__MOUNTON);
1994 }
1995
1996 static int selinux_umount(struct vfsmount *mnt, int flags)
1997 {
1998         int rc;
1999
2000         rc = secondary_ops->sb_umount(mnt, flags);
2001         if (rc)
2002                 return rc;
2003
2004         return superblock_has_perm(current,mnt->mnt_sb,
2005                                    FILESYSTEM__UNMOUNT,NULL);
2006 }
2007
2008 /* inode security operations */
2009
2010 static int selinux_inode_alloc_security(struct inode *inode)
2011 {
2012         return inode_alloc_security(inode);
2013 }
2014
2015 static void selinux_inode_free_security(struct inode *inode)
2016 {
2017         inode_free_security(inode);
2018 }
2019
2020 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2021 {
2022         return may_create(dir, dentry, SECCLASS_FILE);
2023 }
2024
2025 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2026 {
2027         post_create(dir, dentry);
2028 }
2029
2030 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2031 {
2032         int rc;
2033
2034         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2035         if (rc)
2036                 return rc;
2037         return may_link(dir, old_dentry, MAY_LINK);
2038 }
2039
2040 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2041 {
2042         return;
2043 }
2044
2045 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2046 {
2047         int rc;
2048
2049         rc = secondary_ops->inode_unlink(dir, dentry);
2050         if (rc)
2051                 return rc;
2052         return may_link(dir, dentry, MAY_UNLINK);
2053 }
2054
2055 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2056 {
2057         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2058 }
2059
2060 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2061 {
2062         post_create(dir, dentry);
2063 }
2064
2065 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2066 {
2067         return may_create(dir, dentry, SECCLASS_DIR);
2068 }
2069
2070 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2071 {
2072         post_create(dir, dentry);
2073 }
2074
2075 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2076 {
2077         return may_link(dir, dentry, MAY_RMDIR);
2078 }
2079
2080 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2081 {
2082         int rc;
2083
2084         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2085         if (rc)
2086                 return rc;
2087
2088         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2089 }
2090
2091 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2092 {
2093         post_create(dir, dentry);
2094 }
2095
2096 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2097                                 struct inode *new_inode, struct dentry *new_dentry)
2098 {
2099         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2100 }
2101
2102 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2103                                       struct inode *new_inode, struct dentry *new_dentry)
2104 {
2105         return;
2106 }
2107
2108 static int selinux_inode_readlink(struct dentry *dentry)
2109 {
2110         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2111 }
2112
2113 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2114 {
2115         int rc;
2116
2117         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2118         if (rc)
2119                 return rc;
2120         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2121 }
2122
2123 static int selinux_inode_permission(struct inode *inode, int mask,
2124                                     struct nameidata *nd)
2125 {
2126         int rc;
2127
2128         rc = secondary_ops->inode_permission(inode, mask, nd);
2129         if (rc)
2130                 return rc;
2131
2132         if (!mask) {
2133                 /* No permission to check.  Existence test. */
2134                 return 0;
2135         }
2136
2137         return inode_has_perm(current, inode,
2138                                file_mask_to_av(inode->i_mode, mask), NULL);
2139 }
2140
2141 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2142 {
2143         int rc;
2144
2145         rc = secondary_ops->inode_setattr(dentry, iattr);
2146         if (rc)
2147                 return rc;
2148
2149         if (iattr->ia_valid & ATTR_FORCE)
2150                 return 0;
2151
2152         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2153                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2154                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2155
2156         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2157 }
2158
2159 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2160 {
2161         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2162 }
2163
2164 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2165 {
2166         struct task_security_struct *tsec = current->security;
2167         struct inode *inode = dentry->d_inode;
2168         struct inode_security_struct *isec = inode->i_security;
2169         struct superblock_security_struct *sbsec;
2170         struct avc_audit_data ad;
2171         u32 newsid;
2172         int rc = 0;
2173
2174         if (strcmp(name, XATTR_NAME_SELINUX)) {
2175                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2176                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2177                     !capable(CAP_SYS_ADMIN)) {
2178                         /* A different attribute in the security namespace.
2179                            Restrict to administrator. */
2180                         return -EPERM;
2181                 }
2182
2183                 /* Not an attribute we recognize, so just check the
2184                    ordinary setattr permission. */
2185                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2186         }
2187
2188         sbsec = inode->i_sb->s_security;
2189         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2190                 return -EOPNOTSUPP;
2191
2192         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2193                 return -EPERM;
2194
2195         AVC_AUDIT_DATA_INIT(&ad,FS);
2196         ad.u.fs.dentry = dentry;
2197
2198         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2199                           FILE__RELABELFROM, &ad);
2200         if (rc)
2201                 return rc;
2202
2203         rc = security_context_to_sid(value, size, &newsid);
2204         if (rc)
2205                 return rc;
2206
2207         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2208                           FILE__RELABELTO, &ad);
2209         if (rc)
2210                 return rc;
2211
2212         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2213                                           isec->sclass);
2214         if (rc)
2215                 return rc;
2216
2217         return avc_has_perm(newsid,
2218                             sbsec->sid,
2219                             SECCLASS_FILESYSTEM,
2220                             FILESYSTEM__ASSOCIATE,
2221                             &ad);
2222 }
2223
2224 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2225                                         void *value, size_t size, int flags)
2226 {
2227         struct inode *inode = dentry->d_inode;
2228         struct inode_security_struct *isec = inode->i_security;
2229         u32 newsid;
2230         int rc;
2231
2232         if (strcmp(name, XATTR_NAME_SELINUX)) {
2233                 /* Not an attribute we recognize, so nothing to do. */
2234                 return;
2235         }
2236
2237         rc = security_context_to_sid(value, size, &newsid);
2238         if (rc) {
2239                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2240                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2241                 return;
2242         }
2243
2244         isec->sid = newsid;
2245         return;
2246 }
2247
2248 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2249 {
2250         struct inode *inode = dentry->d_inode;
2251         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2252
2253         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2254                 return -EOPNOTSUPP;
2255
2256         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2257 }
2258
2259 static int selinux_inode_listxattr (struct dentry *dentry)
2260 {
2261         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2262 }
2263
2264 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2265 {
2266         if (strcmp(name, XATTR_NAME_SELINUX)) {
2267                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2268                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2269                     !capable(CAP_SYS_ADMIN)) {
2270                         /* A different attribute in the security namespace.
2271                            Restrict to administrator. */
2272                         return -EPERM;
2273                 }
2274
2275                 /* Not an attribute we recognize, so just check the
2276                    ordinary setattr permission. Might want a separate
2277                    permission for removexattr. */
2278                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2279         }
2280
2281         /* No one is allowed to remove a SELinux security label.
2282            You can change the label, but all data must be labeled. */
2283         return -EACCES;
2284 }
2285
2286 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2287 {
2288         struct inode_security_struct *isec = inode->i_security;
2289         char *context;
2290         unsigned len;
2291         int rc;
2292
2293         /* Permission check handled by selinux_inode_getxattr hook.*/
2294
2295         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2296                 return -EOPNOTSUPP;
2297
2298         rc = security_sid_to_context(isec->sid, &context, &len);
2299         if (rc)
2300                 return rc;
2301
2302         if (!buffer || !size) {
2303                 kfree(context);
2304                 return len;
2305         }
2306         if (size < len) {
2307                 kfree(context);
2308                 return -ERANGE;
2309         }
2310         memcpy(buffer, context, len);
2311         kfree(context);
2312         return len;
2313 }
2314
2315 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2316                                      const void *value, size_t size, int flags)
2317 {
2318         struct inode_security_struct *isec = inode->i_security;
2319         u32 newsid;
2320         int rc;
2321
2322         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2323                 return -EOPNOTSUPP;
2324
2325         if (!value || !size)
2326                 return -EACCES;
2327
2328         rc = security_context_to_sid((void*)value, size, &newsid);
2329         if (rc)
2330                 return rc;
2331
2332         isec->sid = newsid;
2333         return 0;
2334 }
2335
2336 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2337 {
2338         const int len = sizeof(XATTR_NAME_SELINUX);
2339         if (buffer && len <= buffer_size)
2340                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2341         return len;
2342 }
2343
2344 /* file security operations */
2345
2346 static int selinux_file_permission(struct file *file, int mask)
2347 {
2348         struct inode *inode = file->f_dentry->d_inode;
2349
2350         if (!mask) {
2351                 /* No permission to check.  Existence test. */
2352                 return 0;
2353         }
2354
2355         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2356         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2357                 mask |= MAY_APPEND;
2358
2359         return file_has_perm(current, file,
2360                              file_mask_to_av(inode->i_mode, mask));
2361 }
2362
2363 static int selinux_file_alloc_security(struct file *file)
2364 {
2365         return file_alloc_security(file);
2366 }
2367
2368 static void selinux_file_free_security(struct file *file)
2369 {
2370         file_free_security(file);
2371 }
2372
2373 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2374                               unsigned long arg)
2375 {
2376         int error = 0;
2377
2378         switch (cmd) {
2379                 case FIONREAD:
2380                 /* fall through */
2381                 case FIBMAP:
2382                 /* fall through */
2383                 case FIGETBSZ:
2384                 /* fall through */
2385                 case EXT2_IOC_GETFLAGS:
2386                 /* fall through */
2387                 case EXT2_IOC_GETVERSION:
2388                         error = file_has_perm(current, file, FILE__GETATTR);
2389                         break;
2390
2391                 case EXT2_IOC_SETFLAGS:
2392                 /* fall through */
2393                 case EXT2_IOC_SETVERSION:
2394                         error = file_has_perm(current, file, FILE__SETATTR);
2395                         break;
2396
2397                 /* sys_ioctl() checks */
2398                 case FIONBIO:
2399                 /* fall through */
2400                 case FIOASYNC:
2401                         error = file_has_perm(current, file, 0);
2402                         break;
2403
2404                 case KDSKBENT:
2405                 case KDSKBSENT:
2406                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2407                         break;
2408
2409                 /* default case assumes that the command will go
2410                  * to the file's ioctl() function.
2411                  */
2412                 default:
2413                         error = file_has_perm(current, file, FILE__IOCTL);
2414
2415         }
2416         return error;
2417 }
2418
2419 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2420 {
2421 #ifndef CONFIG_PPC32
2422         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2423                 /*
2424                  * We are making executable an anonymous mapping or a
2425                  * private file mapping that will also be writable.
2426                  * This has an additional check.
2427                  */
2428                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2429                 if (rc)
2430                         return rc;
2431         }
2432 #endif
2433
2434         if (file) {
2435                 /* read access is always possible with a mapping */
2436                 u32 av = FILE__READ;
2437
2438                 /* write access only matters if the mapping is shared */
2439                 if (shared && (prot & PROT_WRITE))
2440                         av |= FILE__WRITE;
2441
2442                 if (prot & PROT_EXEC)
2443                         av |= FILE__EXECUTE;
2444
2445                 return file_has_perm(current, file, av);
2446         }
2447         return 0;
2448 }
2449
2450 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2451                              unsigned long prot, unsigned long flags)
2452 {
2453         int rc;
2454
2455         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2456         if (rc)
2457                 return rc;
2458
2459         if (selinux_checkreqprot)
2460                 prot = reqprot;
2461
2462         return file_map_prot_check(file, prot,
2463                                    (flags & MAP_TYPE) == MAP_SHARED);
2464 }
2465
2466 static int selinux_file_mprotect(struct vm_area_struct *vma,
2467                                  unsigned long reqprot,
2468                                  unsigned long prot)
2469 {
2470         int rc;
2471
2472         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2473         if (rc)
2474                 return rc;
2475
2476         if (selinux_checkreqprot)
2477                 prot = reqprot;
2478
2479 #ifndef CONFIG_PPC32
2480         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2481            (vma->vm_start >= vma->vm_mm->start_brk &&
2482             vma->vm_end <= vma->vm_mm->brk)) {
2483                 /*
2484                  * We are making an executable mapping in the brk region.
2485                  * This has an additional execheap check.
2486                  */
2487                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2488                 if (rc)
2489                         return rc;
2490         }
2491         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2492                 /*
2493                  * We are making executable a file mapping that has
2494                  * had some COW done. Since pages might have been written,
2495                  * check ability to execute the possibly modified content.
2496                  * This typically should only occur for text relocations.
2497                  */
2498                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2499                 if (rc)
2500                         return rc;
2501         }
2502         if (!vma->vm_file && (prot & PROT_EXEC) &&
2503                 vma->vm_start <= vma->vm_mm->start_stack &&
2504                 vma->vm_end >= vma->vm_mm->start_stack) {
2505                 /* Attempt to make the process stack executable.
2506                  * This has an additional execstack check.
2507                  */
2508                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2509                 if (rc)
2510                         return rc;
2511         }
2512 #endif
2513
2514         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2515 }
2516
2517 static int selinux_file_lock(struct file *file, unsigned int cmd)
2518 {
2519         return file_has_perm(current, file, FILE__LOCK);
2520 }
2521
2522 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2523                               unsigned long arg)
2524 {
2525         int err = 0;
2526
2527         switch (cmd) {
2528                 case F_SETFL:
2529                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2530                                 err = -EINVAL;
2531                                 break;
2532                         }
2533
2534                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2535                                 err = file_has_perm(current, file,FILE__WRITE);
2536                                 break;
2537                         }
2538                         /* fall through */
2539                 case F_SETOWN:
2540                 case F_SETSIG:
2541                 case F_GETFL:
2542                 case F_GETOWN:
2543                 case F_GETSIG:
2544                         /* Just check FD__USE permission */
2545                         err = file_has_perm(current, file, 0);
2546                         break;
2547                 case F_GETLK:
2548                 case F_SETLK:
2549                 case F_SETLKW:
2550 #if BITS_PER_LONG == 32
2551                 case F_GETLK64:
2552                 case F_SETLK64:
2553                 case F_SETLKW64:
2554 #endif
2555                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2556                                 err = -EINVAL;
2557                                 break;
2558                         }
2559                         err = file_has_perm(current, file, FILE__LOCK);
2560                         break;
2561         }
2562
2563         return err;
2564 }
2565
2566 static int selinux_file_set_fowner(struct file *file)
2567 {
2568         struct task_security_struct *tsec;
2569         struct file_security_struct *fsec;
2570
2571         tsec = current->security;
2572         fsec = file->f_security;
2573         fsec->fown_sid = tsec->sid;
2574
2575         return 0;
2576 }
2577
2578 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2579                                        struct fown_struct *fown, int signum)
2580 {
2581         struct file *file;
2582         u32 perm;
2583         struct task_security_struct *tsec;
2584         struct file_security_struct *fsec;
2585
2586         /* struct fown_struct is never outside the context of a struct file */
2587         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2588
2589         tsec = tsk->security;
2590         fsec = file->f_security;
2591
2592         if (!signum)
2593                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2594         else
2595                 perm = signal_to_av(signum);
2596
2597         return avc_has_perm(fsec->fown_sid, tsec->sid,
2598                             SECCLASS_PROCESS, perm, NULL);
2599 }
2600
2601 static int selinux_file_receive(struct file *file)
2602 {
2603         return file_has_perm(current, file, file_to_av(file));
2604 }
2605
2606 /* task security operations */
2607
2608 static int selinux_task_create(unsigned long clone_flags)
2609 {
2610         int rc;
2611
2612         rc = secondary_ops->task_create(clone_flags);
2613         if (rc)
2614                 return rc;
2615
2616         return task_has_perm(current, current, PROCESS__FORK);
2617 }
2618
2619 static int selinux_task_alloc_security(struct task_struct *tsk)
2620 {
2621         struct task_security_struct *tsec1, *tsec2;
2622         int rc;
2623
2624         tsec1 = current->security;
2625
2626         rc = task_alloc_security(tsk);
2627         if (rc)
2628                 return rc;
2629         tsec2 = tsk->security;
2630
2631         tsec2->osid = tsec1->osid;
2632         tsec2->sid = tsec1->sid;
2633
2634         /* Retain the exec and create SIDs across fork */
2635         tsec2->exec_sid = tsec1->exec_sid;
2636         tsec2->create_sid = tsec1->create_sid;
2637
2638         /* Retain ptracer SID across fork, if any.
2639            This will be reset by the ptrace hook upon any
2640            subsequent ptrace_attach operations. */
2641         tsec2->ptrace_sid = tsec1->ptrace_sid;
2642
2643         return 0;
2644 }
2645
2646 static void selinux_task_free_security(struct task_struct *tsk)
2647 {
2648         task_free_security(tsk);
2649 }
2650
2651 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2652 {
2653         /* Since setuid only affects the current process, and
2654            since the SELinux controls are not based on the Linux
2655            identity attributes, SELinux does not need to control
2656            this operation.  However, SELinux does control the use
2657            of the CAP_SETUID and CAP_SETGID capabilities using the
2658            capable hook. */
2659         return 0;
2660 }
2661
2662 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2663 {
2664         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2665 }
2666
2667 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2668 {
2669         /* See the comment for setuid above. */
2670         return 0;
2671 }
2672
2673 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2674 {
2675         return task_has_perm(current, p, PROCESS__SETPGID);
2676 }
2677
2678 static int selinux_task_getpgid(struct task_struct *p)
2679 {
2680         return task_has_perm(current, p, PROCESS__GETPGID);
2681 }
2682
2683 static int selinux_task_getsid(struct task_struct *p)
2684 {
2685         return task_has_perm(current, p, PROCESS__GETSESSION);
2686 }
2687
2688 static int selinux_task_setgroups(struct group_info *group_info)
2689 {
2690         /* See the comment for setuid above. */
2691         return 0;
2692 }
2693
2694 static int selinux_task_setnice(struct task_struct *p, int nice)
2695 {
2696         int rc;
2697
2698         rc = secondary_ops->task_setnice(p, nice);
2699         if (rc)
2700                 return rc;
2701
2702         return task_has_perm(current,p, PROCESS__SETSCHED);
2703 }
2704
2705 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2706 {
2707         struct rlimit *old_rlim = current->signal->rlim + resource;
2708         int rc;
2709
2710         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2711         if (rc)
2712                 return rc;
2713
2714         /* Control the ability to change the hard limit (whether
2715            lowering or raising it), so that the hard limit can
2716            later be used as a safe reset point for the soft limit
2717            upon context transitions. See selinux_bprm_apply_creds. */
2718         if (old_rlim->rlim_max != new_rlim->rlim_max)
2719                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2720
2721         return 0;
2722 }
2723
2724 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2725 {
2726         return task_has_perm(current, p, PROCESS__SETSCHED);
2727 }
2728
2729 static int selinux_task_getscheduler(struct task_struct *p)
2730 {
2731         return task_has_perm(current, p, PROCESS__GETSCHED);
2732 }
2733
2734 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2735 {
2736         u32 perm;
2737         int rc;
2738
2739         rc = secondary_ops->task_kill(p, info, sig);
2740         if (rc)
2741                 return rc;
2742
2743         if (info && ((unsigned long)info == 1 ||
2744                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2745                 return 0;
2746
2747         if (!sig)
2748                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2749         else
2750                 perm = signal_to_av(sig);
2751
2752         return task_has_perm(current, p, perm);
2753 }
2754
2755 static int selinux_task_prctl(int option,
2756                               unsigned long arg2,
2757                               unsigned long arg3,
2758                               unsigned long arg4,
2759                               unsigned long arg5)
2760 {
2761         /* The current prctl operations do not appear to require
2762            any SELinux controls since they merely observe or modify
2763            the state of the current process. */
2764         return 0;
2765 }
2766
2767 static int selinux_task_wait(struct task_struct *p)
2768 {
2769         u32 perm;
2770
2771         perm = signal_to_av(p->exit_signal);
2772
2773         return task_has_perm(p, current, perm);
2774 }
2775
2776 static void selinux_task_reparent_to_init(struct task_struct *p)
2777 {
2778         struct task_security_struct *tsec;
2779
2780         secondary_ops->task_reparent_to_init(p);
2781
2782         tsec = p->security;
2783         tsec->osid = tsec->sid;
2784         tsec->sid = SECINITSID_KERNEL;
2785         return;
2786 }
2787
2788 static void selinux_task_to_inode(struct task_struct *p,
2789                                   struct inode *inode)
2790 {
2791         struct task_security_struct *tsec = p->security;
2792         struct inode_security_struct *isec = inode->i_security;
2793
2794         isec->sid = tsec->sid;
2795         isec->initialized = 1;
2796         return;
2797 }
2798
2799 #ifdef CONFIG_SECURITY_NETWORK
2800
2801 /* Returns error only if unable to parse addresses */
2802 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2803 {
2804         int offset, ihlen, ret = -EINVAL;
2805         struct iphdr _iph, *ih;
2806
2807         offset = skb->nh.raw - skb->data;
2808         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2809         if (ih == NULL)
2810                 goto out;
2811
2812         ihlen = ih->ihl * 4;
2813         if (ihlen < sizeof(_iph))
2814                 goto out;
2815
2816         ad->u.net.v4info.saddr = ih->saddr;
2817         ad->u.net.v4info.daddr = ih->daddr;
2818         ret = 0;
2819
2820         switch (ih->protocol) {
2821         case IPPROTO_TCP: {
2822                 struct tcphdr _tcph, *th;
2823
2824                 if (ntohs(ih->frag_off) & IP_OFFSET)
2825                         break;
2826
2827                 offset += ihlen;
2828                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2829                 if (th == NULL)
2830                         break;
2831
2832                 ad->u.net.sport = th->source;
2833                 ad->u.net.dport = th->dest;
2834                 break;
2835         }
2836
2837         case IPPROTO_UDP: {
2838                 struct udphdr _udph, *uh;
2839
2840                 if (ntohs(ih->frag_off) & IP_OFFSET)
2841                         break;
2842
2843                 offset += ihlen;
2844                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2845                 if (uh == NULL)
2846                         break;
2847
2848                 ad->u.net.sport = uh->source;
2849                 ad->u.net.dport = uh->dest;
2850                 break;
2851         }
2852
2853         default:
2854                 break;
2855         }
2856 out:
2857         return ret;
2858 }
2859
2860 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2861
2862 /* Returns error only if unable to parse addresses */
2863 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2864 {
2865         u8 nexthdr;
2866         int ret = -EINVAL, offset;
2867         struct ipv6hdr _ipv6h, *ip6;
2868
2869         offset = skb->nh.raw - skb->data;
2870         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2871         if (ip6 == NULL)
2872                 goto out;
2873
2874         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2875         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2876         ret = 0;
2877
2878         nexthdr = ip6->nexthdr;
2879         offset += sizeof(_ipv6h);
2880         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2881         if (offset < 0)
2882                 goto out;
2883
2884         switch (nexthdr) {
2885         case IPPROTO_TCP: {
2886                 struct tcphdr _tcph, *th;
2887
2888                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2889                 if (th == NULL)
2890                         break;
2891
2892                 ad->u.net.sport = th->source;
2893                 ad->u.net.dport = th->dest;
2894                 break;
2895         }
2896
2897         case IPPROTO_UDP: {
2898                 struct udphdr _udph, *uh;
2899
2900                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2901                 if (uh == NULL)
2902                         break;
2903
2904                 ad->u.net.sport = uh->source;
2905                 ad->u.net.dport = uh->dest;
2906                 break;
2907         }
2908
2909         /* includes fragments */
2910         default:
2911                 break;
2912         }
2913 out:
2914         return ret;
2915 }
2916
2917 #endif /* IPV6 */
2918
2919 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2920                              char **addrp, int *len, int src)
2921 {
2922         int ret = 0;
2923
2924         switch (ad->u.net.family) {
2925         case PF_INET:
2926                 ret = selinux_parse_skb_ipv4(skb, ad);
2927                 if (ret || !addrp)
2928                         break;
2929                 *len = 4;
2930                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2931                                         &ad->u.net.v4info.daddr);
2932                 break;
2933
2934 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2935         case PF_INET6:
2936                 ret = selinux_parse_skb_ipv6(skb, ad);
2937                 if (ret || !addrp)
2938                         break;
2939                 *len = 16;
2940                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2941                                         &ad->u.net.v6info.daddr);
2942                 break;
2943 #endif  /* IPV6 */
2944         default:
2945                 break;
2946         }
2947
2948         return ret;
2949 }
2950
2951 /* socket security operations */
2952 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2953                            u32 perms)
2954 {
2955         struct inode_security_struct *isec;
2956         struct task_security_struct *tsec;
2957         struct avc_audit_data ad;
2958         int err = 0;
2959
2960         tsec = task->security;
2961         isec = SOCK_INODE(sock)->i_security;
2962
2963         if (isec->sid == SECINITSID_KERNEL)
2964                 goto out;
2965
2966         AVC_AUDIT_DATA_INIT(&ad,NET);
2967         ad.u.net.sk = sock->sk;
2968         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2969
2970 out:
2971         return err;
2972 }
2973
2974 static int selinux_socket_create(int family, int type,
2975                                  int protocol, int kern)
2976 {
2977         int err = 0;
2978         struct task_security_struct *tsec;
2979
2980         if (kern)
2981                 goto out;
2982
2983         tsec = current->security;
2984         err = avc_has_perm(tsec->sid, tsec->sid,
2985                            socket_type_to_security_class(family, type,
2986                            protocol), SOCKET__CREATE, NULL);
2987
2988 out:
2989         return err;
2990 }
2991
2992 static void selinux_socket_post_create(struct socket *sock, int family,
2993                                        int type, int protocol, int kern)
2994 {
2995         struct inode_security_struct *isec;
2996         struct task_security_struct *tsec;
2997
2998         isec = SOCK_INODE(sock)->i_security;
2999
3000         tsec = current->security;
3001         isec->sclass = socket_type_to_security_class(family, type, protocol);
3002         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3003         isec->initialized = 1;
3004
3005         return;
3006 }
3007
3008 /* Range of port numbers used to automatically bind.
3009    Need to determine whether we should perform a name_bind
3010    permission check between the socket and the port number. */
3011 #define ip_local_port_range_0 sysctl_local_port_range[0]
3012 #define ip_local_port_range_1 sysctl_local_port_range[1]
3013
3014 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3015 {
3016         u16 family;
3017         int err;
3018
3019         err = socket_has_perm(current, sock, SOCKET__BIND);
3020         if (err)
3021                 goto out;
3022
3023         /*
3024          * If PF_INET or PF_INET6, check name_bind permission for the port.
3025          */
3026         family = sock->sk->sk_family;
3027         if (family == PF_INET || family == PF_INET6) {
3028                 char *addrp;
3029                 struct inode_security_struct *isec;
3030                 struct task_security_struct *tsec;
3031                 struct avc_audit_data ad;
3032                 struct sockaddr_in *addr4 = NULL;
3033                 struct sockaddr_in6 *addr6 = NULL;
3034                 unsigned short snum;
3035                 struct sock *sk = sock->sk;
3036                 u32 sid, node_perm, addrlen;
3037
3038                 tsec = current->security;
3039                 isec = SOCK_INODE(sock)->i_security;
3040
3041                 if (family == PF_INET) {
3042                         addr4 = (struct sockaddr_in *)address;
3043                         snum = ntohs(addr4->sin_port);
3044                         addrlen = sizeof(addr4->sin_addr.s_addr);
3045                         addrp = (char *)&addr4->sin_addr.s_addr;
3046                 } else {
3047                         addr6 = (struct sockaddr_in6 *)address;
3048                         snum = ntohs(addr6->sin6_port);
3049                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3050                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3051                 }
3052
3053                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3054                            snum > ip_local_port_range_1)) {
3055                         err = security_port_sid(sk->sk_family, sk->sk_type,
3056                                                 sk->sk_protocol, snum, &sid);
3057                         if (err)
3058                                 goto out;
3059                         AVC_AUDIT_DATA_INIT(&ad,NET);
3060                         ad.u.net.sport = htons(snum);
3061                         ad.u.net.family = family;
3062                         err = avc_has_perm(isec->sid, sid,
3063                                            isec->sclass,
3064                                            SOCKET__NAME_BIND, &ad);
3065                         if (err)
3066                                 goto out;
3067                 }
3068
3069                 switch(sk->sk_protocol) {
3070                 case IPPROTO_TCP:
3071                         node_perm = TCP_SOCKET__NODE_BIND;
3072                         break;
3073
3074                 case IPPROTO_UDP:
3075                         node_perm = UDP_SOCKET__NODE_BIND;
3076                         break;
3077
3078                 default:
3079                         node_perm = RAWIP_SOCKET__NODE_BIND;
3080                         break;
3081                 }
3082
3083                 err = security_node_sid(family, addrp, addrlen, &sid);
3084                 if (err)
3085                         goto out;
3086
3087                 AVC_AUDIT_DATA_INIT(&ad,NET);
3088                 ad.u.net.sport = htons(snum);
3089                 ad.u.net.family = family;
3090
3091                 if (family == PF_INET)
3092                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3093                 else
3094                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3095
3096                 err = avc_has_perm(isec->sid, sid,
3097                                    isec->sclass, node_perm, &ad);
3098                 if (err)
3099                         goto out;
3100         }
3101 out:
3102         return err;
3103 }
3104
3105 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3106 {
3107         struct inode_security_struct *isec;
3108         int err;
3109
3110         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3111         if (err)
3112                 return err;
3113
3114         /*
3115          * If a TCP socket, check name_connect permission for the port.
3116          */
3117         isec = SOCK_INODE(sock)->i_security;
3118         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3119                 struct sock *sk = sock->sk;
3120                 struct avc_audit_data ad;
3121                 struct sockaddr_in *addr4 = NULL;
3122                 struct sockaddr_in6 *addr6 = NULL;
3123                 unsigned short snum;
3124                 u32 sid;
3125
3126                 if (sk->sk_family == PF_INET) {
3127                         addr4 = (struct sockaddr_in *)address;
3128                         if (addrlen != sizeof(struct sockaddr_in))
3129                                 return -EINVAL;
3130                         snum = ntohs(addr4->sin_port);
3131                 } else {
3132                         addr6 = (struct sockaddr_in6 *)address;
3133                         if (addrlen != sizeof(struct sockaddr_in6))
3134                                 return -EINVAL;
3135                         snum = ntohs(addr6->sin6_port);
3136                 }
3137
3138                 err = security_port_sid(sk->sk_family, sk->sk_type,
3139                                         sk->sk_protocol, snum, &sid);
3140                 if (err)
3141                         goto out;
3142
3143                 AVC_AUDIT_DATA_INIT(&ad,NET);
3144                 ad.u.net.dport = htons(snum);
3145                 ad.u.net.family = sk->sk_family;
3146                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3147                                    TCP_SOCKET__NAME_CONNECT, &ad);
3148                 if (err)
3149                         goto out;
3150         }
3151
3152 out:
3153         return err;
3154 }
3155
3156 static int selinux_socket_listen(struct socket *sock, int backlog)
3157 {
3158         return socket_has_perm(current, sock, SOCKET__LISTEN);
3159 }
3160
3161 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3162 {
3163         int err;
3164         struct inode_security_struct *isec;
3165         struct inode_security_struct *newisec;
3166
3167         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3168         if (err)
3169                 return err;
3170
3171         newisec = SOCK_INODE(newsock)->i_security;
3172
3173         isec = SOCK_INODE(sock)->i_security;
3174         newisec->sclass = isec->sclass;
3175         newisec->sid = isec->sid;
3176         newisec->initialized = 1;
3177
3178         return 0;
3179 }
3180
3181 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3182                                   int size)
3183 {
3184         return socket_has_perm(current, sock, SOCKET__WRITE);
3185 }
3186
3187 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3188                                   int size, int flags)
3189 {
3190         return socket_has_perm(current, sock, SOCKET__READ);
3191 }
3192
3193 static int selinux_socket_getsockname(struct socket *sock)
3194 {
3195         return socket_has_perm(current, sock, SOCKET__GETATTR);
3196 }
3197
3198 static int selinux_socket_getpeername(struct socket *sock)
3199 {
3200         return socket_has_perm(current, sock, SOCKET__GETATTR);
3201 }
3202
3203 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3204 {
3205         return socket_has_perm(current, sock, SOCKET__SETOPT);
3206 }
3207
3208 static int selinux_socket_getsockopt(struct socket *sock, int level,
3209                                      int optname)
3210 {
3211         return socket_has_perm(current, sock, SOCKET__GETOPT);
3212 }
3213
3214 static int selinux_socket_shutdown(struct socket *sock, int how)
3215 {
3216         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3217 }
3218
3219 static int selinux_socket_unix_stream_connect(struct socket *sock,
3220                                               struct socket *other,
3221                                               struct sock *newsk)
3222 {
3223         struct sk_security_struct *ssec;
3224         struct inode_security_struct *isec;
3225         struct inode_security_struct *other_isec;
3226         struct avc_audit_data ad;
3227         int err;
3228
3229         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3230         if (err)
3231                 return err;
3232
3233         isec = SOCK_INODE(sock)->i_security;
3234         other_isec = SOCK_INODE(other)->i_security;
3235
3236         AVC_AUDIT_DATA_INIT(&ad,NET);
3237         ad.u.net.sk = other->sk;
3238
3239         err = avc_has_perm(isec->sid, other_isec->sid,
3240                            isec->sclass,
3241                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3242         if (err)
3243                 return err;
3244
3245         /* connecting socket */
3246         ssec = sock->sk->sk_security;
3247         ssec->peer_sid = other_isec->sid;
3248
3249         /* server child socket */
3250         ssec = newsk->sk_security;
3251         ssec->peer_sid = isec->sid;
3252
3253         return 0;
3254 }
3255
3256 static int selinux_socket_unix_may_send(struct socket *sock,
3257                                         struct socket *other)
3258 {
3259         struct inode_security_struct *isec;
3260         struct inode_security_struct *other_isec;
3261         struct avc_audit_data ad;
3262         int err;
3263
3264         isec = SOCK_INODE(sock)->i_security;
3265         other_isec = SOCK_INODE(other)->i_security;
3266
3267         AVC_AUDIT_DATA_INIT(&ad,NET);
3268         ad.u.net.sk = other->sk;
3269
3270         err = avc_has_perm(isec->sid, other_isec->sid,
3271                            isec->sclass, SOCKET__SENDTO, &ad);
3272         if (err)
3273                 return err;
3274
3275         return 0;
3276 }
3277
3278 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3279 {
3280         u16 family;
3281         char *addrp;
3282         int len, err = 0;
3283         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3284         u32 sock_sid = 0;
3285         u16 sock_class = 0;
3286         struct socket *sock;
3287         struct net_device *dev;
3288         struct avc_audit_data ad;
3289
3290         family = sk->sk_family;
3291         if (family != PF_INET && family != PF_INET6)