security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006, 2007 Hewlett-Packard Development Company, L.P.
  16  *                Paul Moore <paul.moore@hp.com>
  17  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  18  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  19  *
  20  *      This program is free software; you can redistribute it and/or modify
  21  *      it under the terms of the GNU General Public License version 2,
  22  *      as published by the Free Software Foundation.
  23  */
  24
  25 #include <linux/init.h>
  26 #include <linux/kernel.h>
  27 #include <linux/ptrace.h>
  28 #include <linux/errno.h>
  29 #include <linux/sched.h>
  30 #include <linux/security.h>
  31 #include <linux/xattr.h>
  32 #include <linux/capability.h>
  33 #include <linux/unistd.h>
  34 #include <linux/mm.h>
  35 #include <linux/mman.h>
  36 #include <linux/slab.h>
  37 #include <linux/pagemap.h>
  38 #include <linux/swap.h>
  39 #include <linux/spinlock.h>
  40 #include <linux/syscalls.h>
  41 #include <linux/file.h>
  42 #include <linux/namei.h>
  43 #include <linux/mount.h>
  44 #include <linux/ext2_fs.h>
  45 #include <linux/proc_fs.h>
  46 #include <linux/kd.h>
  47 #include <linux/netfilter_ipv4.h>
  48 #include <linux/netfilter_ipv6.h>
  49 #include <linux/tty.h>
  50 #include <net/icmp.h>
  51 #include <net/ip.h>             /* for local_port_range[] */
  52 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  53 #include <net/net_namespace.h>
  54 #include <net/netlabel.h>
  55 #include <asm/uaccess.h>
  56 #include <asm/ioctls.h>
  57 #include <asm/atomic.h>
  58 #include <linux/bitops.h>
  59 #include <linux/interrupt.h>
  60 #include <linux/netdevice.h>    /* for network interface checks */
  61 #include <linux/netlink.h>
  62 #include <linux/tcp.h>
  63 #include <linux/udp.h>
  64 #include <linux/dccp.h>
  65 #include <linux/quota.h>
  66 #include <linux/un.h>           /* for Unix socket types */
  67 #include <net/af_unix.h>        /* for Unix socket types */
  68 #include <linux/parser.h>
  69 #include <linux/nfs_mount.h>
  70 #include <net/ipv6.h>
  71 #include <linux/hugetlb.h>
  72 #include <linux/personality.h>
  73 #include <linux/sysctl.h>
  74 #include <linux/audit.h>
  75 #include <linux/string.h>
  76 #include <linux/selinux.h>
  77 #include <linux/mutex.h>
  78
  79 #include "avc.h"
  80 #include "objsec.h"
  81 #include "netif.h"
  82 #include "netnode.h"
  83 #include "xfrm.h"
  84 #include "netlabel.h"
  85
  86 #define XATTR_SELINUX_SUFFIX "selinux"
  87 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  88
  89 #define NUM_SEL_MNT_OPTS 4
  90
  91 extern unsigned int policydb_loaded_version;
  92 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  93 extern int selinux_compat_net;
  94 extern struct security_operations *security_ops;
  95
  96 /* SECMARK reference count */
  97 atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 100 int selinux_enforcing = 0;
 101
 102 static int __init enforcing_setup(char *str)
 103 {
 104         selinux_enforcing = simple_strtol(str,NULL,0);
 105         return 1;
 106 }
 107 __setup("enforcing=", enforcing_setup);
 108 #endif
 109
 110 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 111 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 112
 113 static int __init selinux_enabled_setup(char *str)
 114 {
 115         selinux_enabled = simple_strtol(str, NULL, 0);
 116         return 1;
 117 }
 118 __setup("selinux=", selinux_enabled_setup);
 119 #else
 120 int selinux_enabled = 1;
 121 #endif
 122
 123 /* Original (dummy) security module. */
 124 static struct security_operations *original_ops = NULL;
 125
 126 /* Minimal support for a secondary security module,
 127    just to allow the use of the dummy or capability modules.
 128    The owlsm module can alternatively be used as a secondary
 129    module as long as CONFIG_OWLSM_FD is not enabled. */
 130 static struct security_operations *secondary_ops = NULL;
 131
 132 /* Lists of inode and superblock security structures initialized
 133    before the policy was loaded. */
 134 static LIST_HEAD(superblock_security_head);
 135 static DEFINE_SPINLOCK(sb_security_lock);
 136
 137 static struct kmem_cache *sel_inode_cache;
 138
 139 /**
 140  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 141  *
 142  * Description:
 143  * This function checks the SECMARK reference counter to see if any SECMARK
 144  * targets are currently configured, if the reference counter is greater than
 145  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 146  * enabled, false (0) if SECMARK is disabled.
 147  *
 148  */
 149 static int selinux_secmark_enabled(void)
 150 {
 151         return (atomic_read(&selinux_secmark_refcount) > 0);
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_error = -1,
 320         Opt_context = 1,
 321         Opt_fscontext = 2,
 322         Opt_defcontext = 3,
 323         Opt_rootcontext = 4,
 324 };
 325
 326 static match_table_t tokens = {
 327         {Opt_context, "context=%s"},
 328         {Opt_fscontext, "fscontext=%s"},
 329         {Opt_defcontext, "defcontext=%s"},
 330         {Opt_rootcontext, "rootcontext=%s"},
 331         {Opt_error, NULL},
 332 };
 333
 334 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 335
 336 static int may_context_mount_sb_relabel(u32 sid,
 337                         struct superblock_security_struct *sbsec,
 338                         struct task_security_struct *tsec)
 339 {
 340         int rc;
 341
 342         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 343                           FILESYSTEM__RELABELFROM, NULL);
 344         if (rc)
 345                 return rc;
 346
 347         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 348                           FILESYSTEM__RELABELTO, NULL);
 349         return rc;
 350 }
 351
 352 static int may_context_mount_inode_relabel(u32 sid,
 353                         struct superblock_security_struct *sbsec,
 354                         struct task_security_struct *tsec)
 355 {
 356         int rc;
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__ASSOCIATE, NULL);
 364         return rc;
 365 }
 366
 367 static int sb_finish_set_opts(struct super_block *sb)
 368 {
 369         struct superblock_security_struct *sbsec = sb->s_security;
 370         struct dentry *root = sb->s_root;
 371         struct inode *root_inode = root->d_inode;
 372         int rc = 0;
 373
 374         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 375                 /* Make sure that the xattr handler exists and that no
 376                    error other than -ENODATA is returned by getxattr on
 377                    the root directory.  -ENODATA is ok, as this may be
 378                    the first boot of the SELinux kernel before we have
 379                    assigned xattr values to the filesystem. */
 380                 if (!root_inode->i_op->getxattr) {
 381                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 382                                "xattr support\n", sb->s_id, sb->s_type->name);
 383                         rc = -EOPNOTSUPP;
 384                         goto out;
 385                 }
 386                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 387                 if (rc < 0 && rc != -ENODATA) {
 388                         if (rc == -EOPNOTSUPP)
 389                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 390                                        "%s) has no security xattr handler\n",
 391                                        sb->s_id, sb->s_type->name);
 392                         else
 393                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 394                                        "%s) getxattr errno %d\n", sb->s_id,
 395                                        sb->s_type->name, -rc);
 396                         goto out;
 397                 }
 398         }
 399
 400         sbsec->initialized = 1;
 401
 402         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 403                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 404                        sb->s_id, sb->s_type->name);
 405         else
 406                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 407                        sb->s_id, sb->s_type->name,
 408                        labeling_behaviors[sbsec->behavior-1]);
 409
 410         /* Initialize the root inode. */
 411         rc = inode_doinit_with_dentry(root_inode, root);
 412
 413         /* Initialize any other inodes associated with the superblock, e.g.
 414            inodes created prior to initial policy load or inodes created
 415            during get_sb by a pseudo filesystem that directly
 416            populates itself. */
 417         spin_lock(&sbsec->isec_lock);
 418 next_inode:
 419         if (!list_empty(&sbsec->isec_head)) {
 420                 struct inode_security_struct *isec =
 421                                 list_entry(sbsec->isec_head.next,
 422                                            struct inode_security_struct, list);
 423                 struct inode *inode = isec->inode;
 424                 spin_unlock(&sbsec->isec_lock);
 425                 inode = igrab(inode);
 426                 if (inode) {
 427                         if (!IS_PRIVATE(inode))
 428                                 inode_doinit(inode);
 429                         iput(inode);
 430                 }
 431                 spin_lock(&sbsec->isec_lock);
 432                 list_del_init(&isec->list);
 433                 goto next_inode;
 434         }
 435         spin_unlock(&sbsec->isec_lock);
 436 out:
 437         return rc;
 438 }
 439
 440 /*
 441  * This function should allow an FS to ask what it's mount security
 442  * options were so it can use those later for submounts, displaying
 443  * mount options, or whatever.
 444  */
 445 static int selinux_get_mnt_opts(const struct super_block *sb,
 446                                 struct security_mnt_opts *opts)
 447 {
 448         int rc = 0, i;
 449         struct superblock_security_struct *sbsec = sb->s_security;
 450         char *context = NULL;
 451         u32 len;
 452         char tmp;
 453
 454         security_init_mnt_opts(opts);
 455
 456         if (!sbsec->initialized)
 457                 return -EINVAL;
 458
 459         if (!ss_initialized)
 460                 return -EINVAL;
 461
 462         /*
 463          * if we ever use sbsec flags for anything other than tracking mount
 464          * settings this is going to need a mask
 465          */
 466         tmp = sbsec->flags;
 467         /* count the number of mount options for this sb */
 468         for (i = 0; i < 8; i++) {
 469                 if (tmp & 0x01)
 470                         opts->num_mnt_opts++;
 471                 tmp >>= 1;
 472         }
 473
 474         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 475         if (!opts->mnt_opts) {
 476                 rc = -ENOMEM;
 477                 goto out_free;
 478         }
 479
 480         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 481         if (!opts->mnt_opts_flags) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         i = 0;
 487         if (sbsec->flags & FSCONTEXT_MNT) {
 488                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 489                 if (rc)
 490                         goto out_free;
 491                 opts->mnt_opts[i] = context;
 492                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 493         }
 494         if (sbsec->flags & CONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 500         }
 501         if (sbsec->flags & DEFCONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 507         }
 508         if (sbsec->flags & ROOTCONTEXT_MNT) {
 509                 struct inode *root = sbsec->sb->s_root->d_inode;
 510                 struct inode_security_struct *isec = root->i_security;
 511
 512                 rc = security_sid_to_context(isec->sid, &context, &len);
 513                 if (rc)
 514                         goto out_free;
 515                 opts->mnt_opts[i] = context;
 516                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 517         }
 518
 519         BUG_ON(i != opts->num_mnt_opts);
 520
 521         return 0;
 522
 523 out_free:
 524         security_free_mnt_opts(opts);
 525         return rc;
 526 }
 527
 528 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 529                       u32 old_sid, u32 new_sid)
 530 {
 531         /* check if the old mount command had the same options */
 532         if (sbsec->initialized)
 533                 if (!(sbsec->flags & flag) ||
 534                     (old_sid != new_sid))
 535                         return 1;
 536
 537         /* check if we were passed the same options twice,
 538          * aka someone passed context=a,context=b
 539          */
 540         if (!sbsec->initialized)
 541                 if (sbsec->flags & flag)
 542                         return 1;
 543         return 0;
 544 }
 545
 546 /*
 547  * Allow filesystems with binary mount data to explicitly set mount point
 548  * labeling information.
 549  */
 550 static int selinux_set_mnt_opts(struct super_block *sb,
 551                                 struct security_mnt_opts *opts)
 552 {
 553         int rc = 0, i;
 554         struct task_security_struct *tsec = current->security;
 555         struct superblock_security_struct *sbsec = sb->s_security;
 556         const char *name = sb->s_type->name;
 557         struct inode *inode = sbsec->sb->s_root->d_inode;
 558         struct inode_security_struct *root_isec = inode->i_security;
 559         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 560         u32 defcontext_sid = 0;
 561         char **mount_options = opts->mnt_opts;
 562         int *flags = opts->mnt_opts_flags;
 563         int num_opts = opts->num_mnt_opts;
 564
 565         mutex_lock(&sbsec->lock);
 566
 567         if (!ss_initialized) {
 568                 if (!num_opts) {
 569                         /* Defer initialization until selinux_complete_init,
 570                            after the initial policy is loaded and the security
 571                            server is ready to handle calls. */
 572                         spin_lock(&sb_security_lock);
 573                         if (list_empty(&sbsec->list))
 574                                 list_add(&sbsec->list, &superblock_security_head);
 575                         spin_unlock(&sb_security_lock);
 576                         goto out;
 577                 }
 578                 rc = -EINVAL;
 579                 printk(KERN_WARNING "Unable to set superblock options before "
 580                        "the security server is initialized\n");
 581                 goto out;
 582         }
 583
 584         /*
 585          * Binary mount data FS will come through this function twice.  Once
 586          * from an explicit call and once from the generic calls from the vfs.
 587          * Since the generic VFS calls will not contain any security mount data
 588          * we need to skip the double mount verification.
 589          *
 590          * This does open a hole in which we will not notice if the first
 591          * mount using this sb set explict options and a second mount using
 592          * this sb does not set any security options.  (The first options
 593          * will be used for both mounts)
 594          */
 595         if (sbsec->initialized && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 596             && (num_opts == 0))
 597                 goto out;
 598
 599         /*
 600          * parse the mount options, check if they are valid sids.
 601          * also check if someone is trying to mount the same sb more
 602          * than once with different security options.
 603          */
 604         for (i = 0; i < num_opts; i++) {
 605                 u32 sid;
 606                 rc = security_context_to_sid(mount_options[i],
 607                                              strlen(mount_options[i]), &sid);
 608                 if (rc) {
 609                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 610                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 611                                mount_options[i], sb->s_id, name, rc);
 612                         goto out;
 613                 }
 614                 switch (flags[i]) {
 615                 case FSCONTEXT_MNT:
 616                         fscontext_sid = sid;
 617
 618                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 619                                         fscontext_sid))
 620                                 goto out_double_mount;
 621
 622                         sbsec->flags |= FSCONTEXT_MNT;
 623                         break;
 624                 case CONTEXT_MNT:
 625                         context_sid = sid;
 626
 627                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 628                                         context_sid))
 629                                 goto out_double_mount;
 630
 631                         sbsec->flags |= CONTEXT_MNT;
 632                         break;
 633                 case ROOTCONTEXT_MNT:
 634                         rootcontext_sid = sid;
 635
 636                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 637                                         rootcontext_sid))
 638                                 goto out_double_mount;
 639
 640                         sbsec->flags |= ROOTCONTEXT_MNT;
 641
 642                         break;
 643                 case DEFCONTEXT_MNT:
 644                         defcontext_sid = sid;
 645
 646                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 647                                         defcontext_sid))
 648                                 goto out_double_mount;
 649
 650                         sbsec->flags |= DEFCONTEXT_MNT;
 651
 652                         break;
 653                 default:
 654                         rc = -EINVAL;
 655                         goto out;
 656                 }
 657         }
 658
 659         if (sbsec->initialized) {
 660                 /* previously mounted with options, but not on this attempt? */
 661                 if (sbsec->flags && !num_opts)
 662                         goto out_double_mount;
 663                 rc = 0;
 664                 goto out;
 665         }
 666
 667         if (strcmp(sb->s_type->name, "proc") == 0)
 668                 sbsec->proc = 1;
 669
 670         /* Determine the labeling behavior to use for this filesystem type. */
 671         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 672         if (rc) {
 673                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 674                        __FUNCTION__, sb->s_type->name, rc);
 675                 goto out;
 676         }
 677
 678         /* sets the context of the superblock for the fs being mounted. */
 679         if (fscontext_sid) {
 680
 681                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, tsec);
 682                 if (rc)
 683                         goto out;
 684
 685                 sbsec->sid = fscontext_sid;
 686         }
 687
 688         /*
 689          * Switch to using mount point labeling behavior.
 690          * sets the label used on all file below the mountpoint, and will set
 691          * the superblock context if not already set.
 692          */
 693         if (context_sid) {
 694                 if (!fscontext_sid) {
 695                         rc = may_context_mount_sb_relabel(context_sid, sbsec, tsec);
 696                         if (rc)
 697                                 goto out;
 698                         sbsec->sid = context_sid;
 699                 } else {
 700                         rc = may_context_mount_inode_relabel(context_sid, sbsec, tsec);
 701                         if (rc)
 702                                 goto out;
 703                 }
 704                 if (!rootcontext_sid)
 705                         rootcontext_sid = context_sid;
 706
 707                 sbsec->mntpoint_sid = context_sid;
 708                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 709         }
 710
 711         if (rootcontext_sid) {
 712                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec, tsec);
 713                 if (rc)
 714                         goto out;
 715
 716                 root_isec->sid = rootcontext_sid;
 717                 root_isec->initialized = 1;
 718         }
 719
 720         if (defcontext_sid) {
 721                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 722                         rc = -EINVAL;
 723                         printk(KERN_WARNING "SELinux: defcontext option is "
 724                                "invalid for this filesystem type\n");
 725                         goto out;
 726                 }
 727
 728                 if (defcontext_sid != sbsec->def_sid) {
 729                         rc = may_context_mount_inode_relabel(defcontext_sid,
 730                                                              sbsec, tsec);
 731                         if (rc)
 732                                 goto out;
 733                 }
 734
 735                 sbsec->def_sid = defcontext_sid;
 736         }
 737
 738         rc = sb_finish_set_opts(sb);
 739 out:
 740         mutex_unlock(&sbsec->lock);
 741         return rc;
 742 out_double_mount:
 743         rc = -EINVAL;
 744         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 745                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 746         goto out;
 747 }
 748
 749 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 750                                         struct super_block *newsb)
 751 {
 752         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 753         struct superblock_security_struct *newsbsec = newsb->s_security;
 754
 755         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 756         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 757         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 758
 759         /* we can't error, we can't save the info, this shouldn't get called
 760          * this early in the boot process. */
 761         BUG_ON(!ss_initialized);
 762
 763         /* this might go away sometime down the line if there is a new user
 764          * of clone, but for now, nfs better not get here... */
 765         BUG_ON(newsbsec->initialized);
 766
 767         /* how can we clone if the old one wasn't set up?? */
 768         BUG_ON(!oldsbsec->initialized);
 769
 770         mutex_lock(&newsbsec->lock);
 771
 772         newsbsec->flags = oldsbsec->flags;
 773
 774         newsbsec->sid = oldsbsec->sid;
 775         newsbsec->def_sid = oldsbsec->def_sid;
 776         newsbsec->behavior = oldsbsec->behavior;
 777
 778         if (set_context) {
 779                 u32 sid = oldsbsec->mntpoint_sid;
 780
 781                 if (!set_fscontext)
 782                         newsbsec->sid = sid;
 783                 if (!set_rootcontext) {
 784                         struct inode *newinode = newsb->s_root->d_inode;
 785                         struct inode_security_struct *newisec = newinode->i_security;
 786                         newisec->sid = sid;
 787                 }
 788                 newsbsec->mntpoint_sid = sid;
 789         }
 790         if (set_rootcontext) {
 791                 const struct inode *oldinode = oldsb->s_root->d_inode;
 792                 const struct inode_security_struct *oldisec = oldinode->i_security;
 793                 struct inode *newinode = newsb->s_root->d_inode;
 794                 struct inode_security_struct *newisec = newinode->i_security;
 795
 796                 newisec->sid = oldisec->sid;
 797         }
 798
 799         sb_finish_set_opts(newsb);
 800         mutex_unlock(&newsbsec->lock);
 801 }
 802
 803 static int selinux_parse_opts_str(char *options,
 804                                   struct security_mnt_opts *opts)
 805 {
 806         char *p;
 807         char *context = NULL, *defcontext = NULL;
 808         char *fscontext = NULL, *rootcontext = NULL;
 809         int rc, num_mnt_opts = 0;
 810
 811         opts->num_mnt_opts = 0;
 812
 813         /* Standard string-based options. */
 814         while ((p = strsep(&options, "|")) != NULL) {
 815                 int token;
 816                 substring_t args[MAX_OPT_ARGS];
 817
 818                 if (!*p)
 819                         continue;
 820
 821                 token = match_token(p, tokens, args);
 822
 823                 switch (token) {
 824                 case Opt_context:
 825                         if (context || defcontext) {
 826                                 rc = -EINVAL;
 827                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 828                                 goto out_err;
 829                         }
 830                         context = match_strdup(&args[0]);
 831                         if (!context) {
 832                                 rc = -ENOMEM;
 833                                 goto out_err;
 834                         }
 835                         break;
 836
 837                 case Opt_fscontext:
 838                         if (fscontext) {
 839                                 rc = -EINVAL;
 840                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 841                                 goto out_err;
 842                         }
 843                         fscontext = match_strdup(&args[0]);
 844                         if (!fscontext) {
 845                                 rc = -ENOMEM;
 846                                 goto out_err;
 847                         }
 848                         break;
 849
 850                 case Opt_rootcontext:
 851                         if (rootcontext) {
 852                                 rc = -EINVAL;
 853                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 854                                 goto out_err;
 855                         }
 856                         rootcontext = match_strdup(&args[0]);
 857                         if (!rootcontext) {
 858                                 rc = -ENOMEM;
 859                                 goto out_err;
 860                         }
 861                         break;
 862
 863                 case Opt_defcontext:
 864                         if (context || defcontext) {
 865                                 rc = -EINVAL;
 866                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 867                                 goto out_err;
 868                         }
 869                         defcontext = match_strdup(&args[0]);
 870                         if (!defcontext) {
 871                                 rc = -ENOMEM;
 872                                 goto out_err;
 873                         }
 874                         break;
 875
 876                 default:
 877                         rc = -EINVAL;
 878                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 879                         goto out_err;
 880
 881                 }
 882         }
 883
 884         rc = -ENOMEM;
 885         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 886         if (!opts->mnt_opts)
 887                 goto out_err;
 888
 889         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 890         if (!opts->mnt_opts_flags) {
 891                 kfree(opts->mnt_opts);
 892                 goto out_err;
 893         }
 894
 895         if (fscontext) {
 896                 opts->mnt_opts[num_mnt_opts] = fscontext;
 897                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 898         }
 899         if (context) {
 900                 opts->mnt_opts[num_mnt_opts] = context;
 901                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 902         }
 903         if (rootcontext) {
 904                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 905                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 906         }
 907         if (defcontext) {
 908                 opts->mnt_opts[num_mnt_opts] = defcontext;
 909                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 910         }
 911
 912         opts->num_mnt_opts = num_mnt_opts;
 913         return 0;
 914
 915 out_err:
 916         kfree(context);
 917         kfree(defcontext);
 918         kfree(fscontext);
 919         kfree(rootcontext);
 920         return rc;
 921 }
 922 /*
 923  * string mount options parsing and call set the sbsec
 924  */
 925 static int superblock_doinit(struct super_block *sb, void *data)
 926 {
 927         int rc = 0;
 928         char *options = data;
 929         struct security_mnt_opts opts;
 930
 931         security_init_mnt_opts(&opts);
 932
 933         if (!data)
 934                 goto out;
 935
 936         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 937
 938         rc = selinux_parse_opts_str(options, &opts);
 939         if (rc)
 940                 goto out_err;
 941
 942 out:
 943         rc = selinux_set_mnt_opts(sb, &opts);
 944
 945 out_err:
 946         security_free_mnt_opts(&opts);
 947         return rc;
 948 }
 949
 950 static inline u16 inode_mode_to_security_class(umode_t mode)
 951 {
 952         switch (mode & S_IFMT) {
 953         case S_IFSOCK:
 954                 return SECCLASS_SOCK_FILE;
 955         case S_IFLNK:
 956                 return SECCLASS_LNK_FILE;
 957         case S_IFREG:
 958                 return SECCLASS_FILE;
 959         case S_IFBLK:
 960                 return SECCLASS_BLK_FILE;
 961         case S_IFDIR:
 962                 return SECCLASS_DIR;
 963         case S_IFCHR:
 964                 return SECCLASS_CHR_FILE;
 965         case S_IFIFO:
 966                 return SECCLASS_FIFO_FILE;
 967
 968         }
 969
 970         return SECCLASS_FILE;
 971 }
 972
 973 static inline int default_protocol_stream(int protocol)
 974 {
 975         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 976 }
 977
 978 static inline int default_protocol_dgram(int protocol)
 979 {
 980         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 981 }
 982
 983 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 984 {
 985         switch (family) {
 986         case PF_UNIX:
 987                 switch (type) {
 988                 case SOCK_STREAM:
 989                 case SOCK_SEQPACKET:
 990                         return SECCLASS_UNIX_STREAM_SOCKET;
 991                 case SOCK_DGRAM:
 992                         return SECCLASS_UNIX_DGRAM_SOCKET;
 993                 }
 994                 break;
 995         case PF_INET:
 996         case PF_INET6:
 997                 switch (type) {
 998                 case SOCK_STREAM:
 999                         if (default_protocol_stream(protocol))
1000                                 return SECCLASS_TCP_SOCKET;
1001                         else
1002                                 return SECCLASS_RAWIP_SOCKET;
1003                 case SOCK_DGRAM:
1004                         if (default_protocol_dgram(protocol))
1005                                 return SECCLASS_UDP_SOCKET;
1006                         else
1007                                 return SECCLASS_RAWIP_SOCKET;
1008                 case SOCK_DCCP:
1009                         return SECCLASS_DCCP_SOCKET;
1010                 default:
1011                         return SECCLASS_RAWIP_SOCKET;
1012                 }
1013                 break;
1014         case PF_NETLINK:
1015                 switch (protocol) {
1016                 case NETLINK_ROUTE:
1017                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1018                 case NETLINK_FIREWALL:
1019                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1020                 case NETLINK_INET_DIAG:
1021                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1022                 case NETLINK_NFLOG:
1023                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1024                 case NETLINK_XFRM:
1025                         return SECCLASS_NETLINK_XFRM_SOCKET;
1026                 case NETLINK_SELINUX:
1027                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1028                 case NETLINK_AUDIT:
1029                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1030                 case NETLINK_IP6_FW:
1031                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1032                 case NETLINK_DNRTMSG:
1033                         return SECCLASS_NETLINK_DNRT_SOCKET;
1034                 case NETLINK_KOBJECT_UEVENT:
1035                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1036                 default:
1037                         return SECCLASS_NETLINK_SOCKET;
1038                 }
1039         case PF_PACKET:
1040                 return SECCLASS_PACKET_SOCKET;
1041         case PF_KEY:
1042                 return SECCLASS_KEY_SOCKET;
1043         case PF_APPLETALK:
1044                 return SECCLASS_APPLETALK_SOCKET;
1045         }
1046
1047         return SECCLASS_SOCKET;
1048 }
1049
1050 #ifdef CONFIG_PROC_FS
1051 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1052                                 u16 tclass,
1053                                 u32 *sid)
1054 {
1055         int buflen, rc;
1056         char *buffer, *path, *end;
1057
1058         buffer = (char*)__get_free_page(GFP_KERNEL);
1059         if (!buffer)
1060                 return -ENOMEM;
1061
1062         buflen = PAGE_SIZE;
1063         end = buffer+buflen;
1064         *--end = '\0';
1065         buflen--;
1066         path = end-1;
1067         *path = '/';
1068         while (de && de != de->parent) {
1069                 buflen -= de->namelen + 1;
1070                 if (buflen < 0)
1071                         break;
1072                 end -= de->namelen;
1073                 memcpy(end, de->name, de->namelen);
1074                 *--end = '/';
1075                 path = end;
1076                 de = de->parent;
1077         }
1078         rc = security_genfs_sid("proc", path, tclass, sid);
1079         free_page((unsigned long)buffer);
1080         return rc;
1081 }
1082 #else
1083 static int selinux_proc_get_sid(struct proc_dir_entry *de,
1084                                 u16 tclass,
1085                                 u32 *sid)
1086 {
1087         return -EINVAL;
1088 }
1089 #endif
1090
1091 /* The inode's security attributes must be initialized before first use. */
1092 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1093 {
1094         struct superblock_security_struct *sbsec = NULL;
1095         struct inode_security_struct *isec = inode->i_security;
1096         u32 sid;
1097         struct dentry *dentry;
1098 #define INITCONTEXTLEN 255
1099         char *context = NULL;
1100         unsigned len = 0;
1101         int rc = 0;
1102
1103         if (isec->initialized)
1104                 goto out;
1105
1106         mutex_lock(&isec->lock);
1107         if (isec->initialized)
1108                 goto out_unlock;
1109
1110         sbsec = inode->i_sb->s_security;
1111         if (!sbsec->initialized) {
1112                 /* Defer initialization until selinux_complete_init,
1113                    after the initial policy is loaded and the security
1114                    server is ready to handle calls. */
1115                 spin_lock(&sbsec->isec_lock);
1116                 if (list_empty(&isec->list))
1117                         list_add(&isec->list, &sbsec->isec_head);
1118                 spin_unlock(&sbsec->isec_lock);
1119                 goto out_unlock;
1120         }
1121
1122         switch (sbsec->behavior) {
1123         case SECURITY_FS_USE_XATTR:
1124                 if (!inode->i_op->getxattr) {
1125                         isec->sid = sbsec->def_sid;
1126                         break;
1127                 }
1128
1129                 /* Need a dentry, since the xattr API requires one.
1130                    Life would be simpler if we could just pass the inode. */
1131                 if (opt_dentry) {
1132                         /* Called from d_instantiate or d_splice_alias. */
1133                         dentry = dget(opt_dentry);
1134                 } else {
1135                         /* Called from selinux_complete_init, try to find a dentry. */
1136                         dentry = d_find_alias(inode);
1137                 }
1138                 if (!dentry) {
1139                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
1140                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
1141                                inode->i_ino);
1142                         goto out_unlock;
1143                 }
1144
1145                 len = INITCONTEXTLEN;
1146                 context = kmalloc(len, GFP_KERNEL);
1147                 if (!context) {
1148                         rc = -ENOMEM;
1149                         dput(dentry);
1150                         goto out_unlock;
1151                 }
1152                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1153                                            context, len);
1154                 if (rc == -ERANGE) {
1155                         /* Need a larger buffer.  Query for the right size. */
1156                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1157                                                    NULL, 0);
1158                         if (rc < 0) {
1159                                 dput(dentry);
1160                                 goto out_unlock;
1161                         }
1162                         kfree(context);
1163                         len = rc;
1164                         context = kmalloc(len, GFP_KERNEL);
1165                         if (!context) {
1166                                 rc = -ENOMEM;
1167                                 dput(dentry);
1168                                 goto out_unlock;
1169                         }
1170                         rc = inode->i_op->getxattr(dentry,
1171                                                    XATTR_NAME_SELINUX,
1172                                                    context, len);
1173                 }
1174                 dput(dentry);
1175                 if (rc < 0) {
1176                         if (rc != -ENODATA) {
1177                                 printk(KERN_WARNING "%s:  getxattr returned "
1178                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
1179                                        -rc, inode->i_sb->s_id, inode->i_ino);
1180                                 kfree(context);
1181                                 goto out_unlock;
1182                         }
1183                         /* Map ENODATA to the default file SID */
1184                         sid = sbsec->def_sid;
1185                         rc = 0;
1186                 } else {
1187                         rc = security_context_to_sid_default(context, rc, &sid,
1188                                                              sbsec->def_sid);
1189                         if (rc) {
1190                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
1191                                        "returned %d for dev=%s ino=%ld\n",
1192                                        __FUNCTION__, context, -rc,
1193                                        inode->i_sb->s_id, inode->i_ino);
1194                                 kfree(context);
1195                                 /* Leave with the unlabeled SID */
1196                                 rc = 0;
1197                                 break;
1198                         }
1199                 }
1200                 kfree(context);
1201                 isec->sid = sid;
1202                 break;
1203         case SECURITY_FS_USE_TASK:
1204                 isec->sid = isec->task_sid;
1205                 break;
1206         case SECURITY_FS_USE_TRANS:
1207                 /* Default to the fs SID. */
1208                 isec->sid = sbsec->sid;
1209
1210                 /* Try to obtain a transition SID. */
1211                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1212                 rc = security_transition_sid(isec->task_sid,
1213                                              sbsec->sid,
1214                                              isec->sclass,
1215                                              &sid);
1216                 if (rc)
1217                         goto out_unlock;
1218                 isec->sid = sid;
1219                 break;
1220         case SECURITY_FS_USE_MNTPOINT:
1221                 isec->sid = sbsec->mntpoint_sid;
1222                 break;
1223         default:
1224                 /* Default to the fs superblock SID. */
1225                 isec->sid = sbsec->sid;
1226
1227                 if (sbsec->proc) {
1228                         struct proc_inode *proci = PROC_I(inode);
1229                         if (proci->pde) {
1230                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1231                                 rc = selinux_proc_get_sid(proci->pde,
1232                                                           isec->sclass,
1233                                                           &sid);
1234                                 if (rc)
1235                                         goto out_unlock;
1236                                 isec->sid = sid;
1237                         }
1238                 }
1239                 break;
1240         }
1241
1242         isec->initialized = 1;
1243
1244 out_unlock:
1245         mutex_unlock(&isec->lock);
1246 out:
1247         if (isec->sclass == SECCLASS_FILE)
1248                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1249         return rc;
1250 }
1251
1252 /* Convert a Linux signal to an access vector. */
1253 static inline u32 signal_to_av(int sig)
1254 {
1255         u32 perm = 0;
1256
1257         switch (sig) {
1258         case SIGCHLD:
1259                 /* Commonly granted from child to parent. */
1260                 perm = PROCESS__SIGCHLD;
1261                 break;
1262         case SIGKILL:
1263                 /* Cannot be caught or ignored */
1264                 perm = PROCESS__SIGKILL;
1265                 break;
1266         case SIGSTOP:
1267                 /* Cannot be caught or ignored */
1268                 perm = PROCESS__SIGSTOP;
1269                 break;
1270         default:
1271                 /* All other signals. */
1272                 perm = PROCESS__SIGNAL;
1273                 break;
1274         }
1275
1276         return perm;
1277 }
1278
1279 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1280    fork check, ptrace check, etc. */
1281 static int task_has_perm(struct task_struct *tsk1,
1282                          struct task_struct *tsk2,
1283                          u32 perms)
1284 {
1285         struct task_security_struct *tsec1, *tsec2;
1286
1287         tsec1 = tsk1->security;
1288         tsec2 = tsk2->security;
1289         return avc_has_perm(tsec1->sid, tsec2->sid,
1290                             SECCLASS_PROCESS, perms, NULL);
1291 }
1292
1293 #if CAP_LAST_CAP > 63
1294 #error Fix SELinux to handle capabilities > 63.
1295 #endif
1296
1297 /* Check whether a task is allowed to use a capability. */
1298 static int task_has_capability(struct task_struct *tsk,
1299                                int cap)
1300 {
1301         struct task_security_struct *tsec;
1302         struct avc_audit_data ad;
1303         u16 sclass;
1304         u32 av = CAP_TO_MASK(cap);
1305
1306         tsec = tsk->security;
1307
1308         AVC_AUDIT_DATA_INIT(&ad,CAP);
1309         ad.tsk = tsk;
1310         ad.u.cap = cap;
1311
1312         switch (CAP_TO_INDEX(cap)) {
1313         case 0:
1314                 sclass = SECCLASS_CAPABILITY;
1315                 break;
1316         case 1:
1317                 sclass = SECCLASS_CAPABILITY2;
1318                 break;
1319         default:
1320                 printk(KERN_ERR
1321                        "SELinux:  out of range capability %d\n", cap);
1322                 BUG();
1323         }
1324         return avc_has_perm(tsec->sid, tsec->sid, sclass, av, &ad);
1325 }
1326
1327 /* Check whether a task is allowed to use a system operation. */
1328 static int task_has_system(struct task_struct *tsk,
1329                            u32 perms)
1330 {
1331         struct task_security_struct *tsec;
1332
1333         tsec = tsk->security;
1334
1335         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1336                             SECCLASS_SYSTEM, perms, NULL);
1337 }
1338
1339 /* Check whether a task has a particular permission to an inode.
1340    The 'adp' parameter is optional and allows other audit
1341    data to be passed (e.g. the dentry). */
1342 static int inode_has_perm(struct task_struct *tsk,
1343                           struct inode *inode,
1344                           u32 perms,
1345                           struct avc_audit_data *adp)
1346 {
1347         struct task_security_struct *tsec;
1348         struct inode_security_struct *isec;
1349         struct avc_audit_data ad;
1350
1351         if (unlikely (IS_PRIVATE (inode)))
1352                 return 0;
1353
1354         tsec = tsk->security;
1355         isec = inode->i_security;
1356
1357         if (!adp) {
1358                 adp = &ad;
1359                 AVC_AUDIT_DATA_INIT(&ad, FS);
1360                 ad.u.fs.inode = inode;
1361         }
1362
1363         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1364 }
1365
1366 /* Same as inode_has_perm, but pass explicit audit data containing
1367    the dentry to help the auditing code to more easily generate the
1368    pathname if needed. */
1369 static inline int dentry_has_perm(struct task_struct *tsk,
1370                                   struct vfsmount *mnt,
1371                                   struct dentry *dentry,
1372                                   u32 av)
1373 {
1374         struct inode *inode = dentry->d_inode;
1375         struct avc_audit_data ad;
1376         AVC_AUDIT_DATA_INIT(&ad,FS);
1377         ad.u.fs.path.mnt = mnt;
1378         ad.u.fs.path.dentry = dentry;
1379         return inode_has_perm(tsk, inode, av, &ad);
1380 }
1381
1382 /* Check whether a task can use an open file descriptor to
1383    access an inode in a given way.  Check access to the
1384    descriptor itself, and then use dentry_has_perm to
1385    check a particular permission to the file.
1386    Access to the descriptor is implicitly granted if it
1387    has the same SID as the process.  If av is zero, then
1388    access to the file is not checked, e.g. for cases
1389    where only the descriptor is affected like seek. */
1390 static int file_has_perm(struct task_struct *tsk,
1391                                 struct file *file,
1392                                 u32 av)
1393 {
1394         struct task_security_struct *tsec = tsk->security;
1395         struct file_security_struct *fsec = file->f_security;
1396         struct inode *inode = file->f_path.dentry->d_inode;
1397         struct avc_audit_data ad;
1398         int rc;
1399
1400         AVC_AUDIT_DATA_INIT(&ad, FS);
1401         ad.u.fs.path = file->f_path;
1402
1403         if (tsec->sid != fsec->sid) {
1404                 rc = avc_has_perm(tsec->sid, fsec->sid,
1405                                   SECCLASS_FD,
1406                                   FD__USE,
1407                                   &ad);
1408                 if (rc)
1409                         return rc;
1410         }
1411
1412         /* av is zero if only checking access to the descriptor. */
1413         if (av)
1414                 return inode_has_perm(tsk, inode, av, &ad);
1415
1416         return 0;
1417 }
1418
1419 /* Check whether a task can create a file. */
1420 static int may_create(struct inode *dir,
1421                       struct dentry *dentry,
1422                       u16 tclass)
1423 {
1424         struct task_security_struct *tsec;
1425         struct inode_security_struct *dsec;
1426         struct superblock_security_struct *sbsec;
1427         u32 newsid;
1428         struct avc_audit_data ad;
1429         int rc;
1430
1431         tsec = current->security;
1432         dsec = dir->i_security;
1433         sbsec = dir->i_sb->s_security;
1434
1435         AVC_AUDIT_DATA_INIT(&ad, FS);
1436         ad.u.fs.path.dentry = dentry;
1437
1438         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1439                           DIR__ADD_NAME | DIR__SEARCH,
1440                           &ad);
1441         if (rc)
1442                 return rc;
1443
1444         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1445                 newsid = tsec->create_sid;
1446         } else {
1447                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1448                                              &newsid);
1449                 if (rc)
1450                         return rc;
1451         }
1452
1453         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1454         if (rc)
1455                 return rc;
1456
1457         return avc_has_perm(newsid, sbsec->sid,
1458                             SECCLASS_FILESYSTEM,
1459                             FILESYSTEM__ASSOCIATE, &ad);
1460 }
1461
1462 /* Check whether a task can create a key. */
1463 static int may_create_key(u32 ksid,
1464                           struct task_struct *ctx)
1465 {
1466         struct task_security_struct *tsec;
1467
1468         tsec = ctx->security;
1469
1470         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1471 }
1472
1473 #define MAY_LINK   0
1474 #define MAY_UNLINK 1
1475 #define MAY_RMDIR  2
1476
1477 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1478 static int may_link(struct inode *dir,
1479                     struct dentry *dentry,
1480                     int kind)
1481
1482 {
1483         struct task_security_struct *tsec;
1484         struct inode_security_struct *dsec, *isec;
1485         struct avc_audit_data ad;
1486         u32 av;
1487         int rc;
1488
1489         tsec = current->security;
1490         dsec = dir->i_security;
1491         isec = dentry->d_inode->i_security;
1492
1493         AVC_AUDIT_DATA_INIT(&ad, FS);
1494         ad.u.fs.path.dentry = dentry;
1495
1496         av = DIR__SEARCH;
1497         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1498         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1499         if (rc)
1500                 return rc;
1501
1502         switch (kind) {
1503         case MAY_LINK:
1504                 av = FILE__LINK;
1505                 break;
1506         case MAY_UNLINK:
1507                 av = FILE__UNLINK;
1508                 break;
1509         case MAY_RMDIR:
1510                 av = DIR__RMDIR;
1511                 break;
1512         default:
1513                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1514                 return 0;
1515         }
1516
1517         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1518         return rc;
1519 }
1520
1521 static inline int may_rename(struct inode *old_dir,
1522                              struct dentry *old_dentry,
1523                              struct inode *new_dir,
1524                              struct dentry *new_dentry)
1525 {
1526         struct task_security_struct *tsec;
1527         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1528         struct avc_audit_data ad;
1529         u32 av;
1530         int old_is_dir, new_is_dir;
1531         int rc;
1532
1533         tsec = current->security;
1534         old_dsec = old_dir->i_security;
1535         old_isec = old_dentry->d_inode->i_security;
1536         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1537         new_dsec = new_dir->i_security;
1538
1539         AVC_AUDIT_DATA_INIT(&ad, FS);
1540
1541         ad.u.fs.path.dentry = old_dentry;
1542         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1543                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1544         if (rc)
1545                 return rc;
1546         rc = avc_has_perm(tsec->sid, old_isec->sid,
1547                           old_isec->sclass, FILE__RENAME, &ad);
1548         if (rc)
1549                 return rc;
1550         if (old_is_dir && new_dir != old_dir) {
1551                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1552                                   old_isec->sclass, DIR__REPARENT, &ad);
1553                 if (rc)
1554                         return rc;
1555         }
1556
1557         ad.u.fs.path.dentry = new_dentry;
1558         av = DIR__ADD_NAME | DIR__SEARCH;
1559         if (new_dentry->d_inode)
1560                 av |= DIR__REMOVE_NAME;
1561         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1562         if (rc)
1563                 return rc;
1564         if (new_dentry->d_inode) {
1565                 new_isec = new_dentry->d_inode->i_security;
1566                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1567                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1568                                   new_isec->sclass,
1569                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1570                 if (rc)
1571                         return rc;
1572         }
1573
1574         return 0;
1575 }
1576
1577 /* Check whether a task can perform a filesystem operation. */
1578 static int superblock_has_perm(struct task_struct *tsk,
1579                                struct super_block *sb,
1580                                u32 perms,
1581                                struct avc_audit_data *ad)
1582 {
1583         struct task_security_struct *tsec;
1584         struct superblock_security_struct *sbsec;
1585
1586         tsec = tsk->security;
1587         sbsec = sb->s_security;
1588         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1589                             perms, ad);
1590 }
1591
1592 /* Convert a Linux mode and permission mask to an access vector. */
1593 static inline u32 file_mask_to_av(int mode, int mask)
1594 {
1595         u32 av = 0;
1596
1597         if ((mode & S_IFMT) != S_IFDIR) {
1598                 if (mask & MAY_EXEC)
1599                         av |= FILE__EXECUTE;
1600                 if (mask & MAY_READ)
1601                         av |= FILE__READ;
1602
1603                 if (mask & MAY_APPEND)
1604                         av |= FILE__APPEND;
1605                 else if (mask & MAY_WRITE)
1606                         av |= FILE__WRITE;
1607
1608         } else {
1609                 if (mask & MAY_EXEC)
1610                         av |= DIR__SEARCH;
1611                 if (mask & MAY_WRITE)
1612                         av |= DIR__WRITE;
1613                 if (mask & MAY_READ)
1614                         av |= DIR__READ;
1615         }
1616
1617         return av;
1618 }
1619
1620 /* Convert a Linux file to an access vector. */
1621 static inline u32 file_to_av(struct file *file)
1622 {
1623         u32 av = 0;
1624
1625         if (file->f_mode & FMODE_READ)
1626                 av |= FILE__READ;
1627         if (file->f_mode & FMODE_WRITE) {
1628                 if (file->f_flags & O_APPEND)
1629                         av |= FILE__APPEND;
1630                 else
1631                         av |= FILE__WRITE;
1632         }
1633         if (!av) {
1634                 /*
1635                  * Special file opened with flags 3 for ioctl-only use.
1636                  */
1637                 av = FILE__IOCTL;
1638         }
1639
1640         return av;
1641 }
1642
1643 /* Hook functions begin here. */
1644
1645 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1646 {
1647         struct task_security_struct *psec = parent->security;
1648         struct task_security_struct *csec = child->security;
1649         int rc;
1650
1651         rc = secondary_ops->ptrace(parent,child);
1652         if (rc)
1653                 return rc;
1654
1655         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1656         /* Save the SID of the tracing process for later use in apply_creds. */
1657         if (!(child->ptrace & PT_PTRACED) && !rc)
1658                 csec->ptrace_sid = psec->sid;
1659         return rc;
1660 }
1661
1662 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1663                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1664 {
1665         int error;
1666
1667         error = task_has_perm(current, target, PROCESS__GETCAP);
1668         if (error)
1669                 return error;
1670
1671         return secondary_ops->capget(target, effective, inheritable, permitted);
1672 }
1673
1674 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1675                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1676 {
1677         int error;
1678
1679         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1680         if (error)
1681                 return error;
1682
1683         return task_has_perm(current, target, PROCESS__SETCAP);
1684 }
1685
1686 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1687                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1688 {
1689         secondary_ops->capset_set(target, effective, inheritable, permitted);
1690 }
1691
1692 static int selinux_capable(struct task_struct *tsk, int cap)
1693 {
1694         int rc;
1695
1696         rc = secondary_ops->capable(tsk, cap);
1697         if (rc)
1698                 return rc;
1699
1700         return task_has_capability(tsk,cap);
1701 }
1702
1703 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1704 {
1705         int buflen, rc;
1706         char *buffer, *path, *end;
1707
1708         rc = -ENOMEM;
1709         buffer = (char*)__get_free_page(GFP_KERNEL);
1710         if (!buffer)
1711                 goto out;
1712
1713         buflen = PAGE_SIZE;
1714         end = buffer+buflen;
1715         *--end = '\0';
1716         buflen--;
1717         path = end-1;
1718         *path = '/';
1719         while (table) {
1720                 const char *name = table->procname;
1721                 size_t namelen = strlen(name);
1722                 buflen -= namelen + 1;
1723                 if (buflen < 0)
1724                         goto out_free;
1725                 end -= namelen;
1726                 memcpy(end, name, namelen);
1727                 *--end = '/';
1728                 path = end;
1729                 table = table->parent;
1730         }
1731         buflen -= 4;
1732         if (buflen < 0)
1733                 goto out_free;
1734         end -= 4;
1735         memcpy(end, "/sys", 4);
1736         path = end;
1737         rc = security_genfs_sid("proc", path, tclass, sid);
1738 out_free:
1739         free_page((unsigned long)buffer);
1740 out:
1741         return rc;
1742 }
1743
1744 static int selinux_sysctl(ctl_table *table, int op)
1745 {
1746         int error = 0;
1747         u32 av;
1748         struct task_security_struct *tsec;
1749         u32 tsid;
1750         int rc;
1751
1752         rc = secondary_ops->sysctl(table, op);
1753         if (rc)
1754                 return rc;
1755
1756         tsec = current->security;
1757
1758         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1759                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1760         if (rc) {
1761                 /* Default to the well-defined sysctl SID. */
1762                 tsid = SECINITSID_SYSCTL;
1763         }
1764
1765         /* The op values are "defined" in sysctl.c, thereby creating
1766          * a bad coupling between this module and sysctl.c */
1767         if(op == 001) {
1768                 error = avc_has_perm(tsec->sid, tsid,
1769                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1770         } else {
1771                 av = 0;
1772                 if (op & 004)
1773                         av |= FILE__READ;
1774                 if (op & 002)
1775                         av |= FILE__WRITE;
1776                 if (av)
1777                         error = avc_has_perm(tsec->sid, tsid,
1778                                              SECCLASS_FILE, av, NULL);
1779         }
1780
1781         return error;
1782 }
1783
1784 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1785 {
1786         int rc = 0;
1787
1788         if (!sb)
1789                 return 0;
1790
1791         switch (cmds) {
1792                 case Q_SYNC:
1793                 case Q_QUOTAON:
1794                 case Q_QUOTAOFF:
1795                 case Q_SETINFO:
1796                 case Q_SETQUOTA:
1797                         rc = superblock_has_perm(current,
1798                                                  sb,
1799                                                  FILESYSTEM__QUOTAMOD, NULL);
1800                         break;
1801                 case Q_GETFMT:
1802                 case Q_GETINFO:
1803                 case Q_GETQUOTA:
1804                         rc = superblock_has_perm(current,
1805                                                  sb,
1806                                                  FILESYSTEM__QUOTAGET, NULL);
1807                         break;
1808                 default:
1809                         rc = 0;  /* let the kernel handle invalid cmds */
1810                         break;
1811         }
1812         return rc;
1813 }
1814
1815 static int selinux_quota_on(struct dentry *dentry)
1816 {
1817         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1818 }
1819
1820 static int selinux_syslog(int type)
1821 {
1822         int rc;
1823
1824         rc = secondary_ops->syslog(type);
1825         if (rc)
1826                 return rc;
1827
1828         switch (type) {
1829                 case 3:         /* Read last kernel messages */
1830                 case 10:        /* Return size of the log buffer */
1831                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1832                         break;
1833                 case 6:         /* Disable logging to console */
1834                 case 7:         /* Enable logging to console */
1835                 case 8:         /* Set level of messages printed to console */
1836                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1837                         break;
1838                 case 0:         /* Close log */
1839                 case 1:         /* Open log */
1840                 case 2:         /* Read from log */
1841                 case 4:         /* Read/clear last kernel messages */
1842                 case 5:         /* Clear ring buffer */
1843                 default:
1844                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1845                         break;
1846         }
1847         return rc;
1848 }
1849
1850 /*
1851  * Check that a process has enough memory to allocate a new virtual
1852  * mapping. 0 means there is enough memory for the allocation to
1853  * succeed and -ENOMEM implies there is not.
1854  *
1855  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1856  * if the capability is granted, but __vm_enough_memory requires 1 if
1857  * the capability is granted.
1858  *
1859  * Do not audit the selinux permission check, as this is applied to all
1860  * processes that allocate mappings.
1861  */
1862 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1863 {
1864         int rc, cap_sys_admin = 0;
1865         struct task_security_struct *tsec = current->security;
1866
1867         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1868         if (rc == 0)
1869                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1870                                           SECCLASS_CAPABILITY,
1871                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1872                                           0,
1873                                           NULL);
1874
1875         if (rc == 0)
1876                 cap_sys_admin = 1;
1877
1878         return __vm_enough_memory(mm, pages, cap_sys_admin);
1879 }
1880
1881 /* binprm security operations */
1882
1883 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1884 {
1885         struct bprm_security_struct *bsec;
1886
1887         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1888         if (!bsec)
1889                 return -ENOMEM;
1890
1891         bsec->bprm = bprm;
1892         bsec->sid = SECINITSID_UNLABELED;
1893         bsec->set = 0;
1894
1895         bprm->security = bsec;
1896         return 0;
1897 }
1898
1899 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1900 {
1901         struct task_security_struct *tsec;
1902         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1903         struct inode_security_struct *isec;
1904         struct bprm_security_struct *bsec;
1905         u32 newsid;
1906         struct avc_audit_data ad;
1907         int rc;
1908
1909         rc = secondary_ops->bprm_set_security(bprm);
1910         if (rc)
1911                 return rc;
1912
1913         bsec = bprm->security;
1914
1915         if (bsec->set)
1916                 return 0;
1917
1918         tsec = current->security;
1919         isec = inode->i_security;
1920
1921         /* Default to the current task SID. */
1922         bsec->sid = tsec->sid;
1923
1924         /* Reset fs, key, and sock SIDs on execve. */
1925         tsec->create_sid = 0;
1926         tsec->keycreate_sid = 0;
1927         tsec->sockcreate_sid = 0;
1928
1929         if (tsec->exec_sid) {
1930                 newsid = tsec->exec_sid;
1931                 /* Reset exec SID on execve. */
1932                 tsec->exec_sid = 0;
1933         } else {
1934                 /* Check for a default transition on this program. */
1935                 rc = security_transition_sid(tsec->sid, isec->sid,
1936                                              SECCLASS_PROCESS, &newsid);
1937                 if (rc)
1938                         return rc;
1939         }
1940
1941         AVC_AUDIT_DATA_INIT(&ad, FS);
1942         ad.u.fs.path = bprm->file->f_path;
1943
1944         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1945                 newsid = tsec->sid;
1946
1947         if (tsec->sid == newsid) {
1948                 rc = avc_has_perm(tsec->sid, isec->sid,
1949                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1950                 if (rc)
1951                         return rc;
1952         } else {
1953                 /* Check permissions for the transition. */
1954                 rc = avc_has_perm(tsec->sid, newsid,
1955                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1956                 if (rc)
1957                         return rc;
1958
1959                 rc = avc_has_perm(newsid, isec->sid,
1960                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1961                 if (rc)
1962                         return rc;
1963
1964                 /* Clear any possibly unsafe personality bits on exec: */
1965                 current->personality &= ~PER_CLEAR_ON_SETID;
1966
1967                 /* Set the security field to the new SID. */
1968                 bsec->sid = newsid;
1969         }
1970
1971         bsec->set = 1;
1972         return 0;
1973 }
1974
1975 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1976 {
1977         return secondary_ops->bprm_check_security(bprm);
1978 }
1979
1980
1981 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1982 {
1983         struct task_security_struct *tsec = current->security;
1984         int atsecure = 0;
1985
1986         if (tsec->osid != tsec->sid) {
1987                 /* Enable secure mode for SIDs transitions unless
1988                    the noatsecure permission is granted between
1989                    the two SIDs, i.e. ahp returns 0. */
1990                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1991                                          SECCLASS_PROCESS,
1992                                          PROCESS__NOATSECURE, NULL);
1993         }
1994
1995         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1996 }
1997
1998 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1999 {
2000         kfree(bprm->security);
2001         bprm->security = NULL;
2002 }
2003
2004 extern struct vfsmount *selinuxfs_mount;
2005 extern struct dentry *selinux_null;
2006
2007 /* Derived from fs/exec.c:flush_old_files. */
2008 static inline void flush_unauthorized_files(struct files_struct * files)
2009 {
2010         struct avc_audit_data ad;
2011         struct file *file, *devnull = NULL;
2012         struct tty_struct *tty;
2013         struct fdtable *fdt;
2014         long j = -1;
2015         int drop_tty = 0;
2016
2017         mutex_lock(&tty_mutex);
2018         tty = get_current_tty();
2019         if (tty) {
2020                 file_list_lock();
2021                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
2022                 if (file) {
2023                         /* Revalidate access to controlling tty.
2024                            Use inode_has_perm on the tty inode directly rather
2025                            than using file_has_perm, as this particular open
2026                            file may belong to another process and we are only
2027                            interested in the inode-based check here. */
2028                         struct inode *inode = file->f_path.dentry->d_inode;
2029                         if (inode_has_perm(current, inode,
2030                                            FILE__READ | FILE__WRITE, NULL)) {
2031                                 drop_tty = 1;
2032                         }
2033                 }
2034                 file_list_unlock();
2035         }
2036         mutex_unlock(&tty_mutex);
2037         /* Reset controlling tty. */
2038         if (drop_tty)
2039                 no_tty();
2040
2041         /* Revalidate access to inherited open files. */
2042
2043         AVC_AUDIT_DATA_INIT(&ad,FS);
2044
2045         spin_lock(&files->file_lock);
2046         for (;;) {
2047                 unsigned long set, i;
2048                 int fd;
2049
2050                 j++;
2051                 i = j * __NFDBITS;
2052                 fdt = files_fdtable(files);
2053                 if (i >= fdt->max_fds)
2054                         break;
2055                 set = fdt->open_fds->fds_bits[j];
2056                 if (!set)
2057                         continue;
2058                 spin_unlock(&files->file_lock);
2059                 for ( ; set ; i++,set >>= 1) {
2060                         if (set & 1) {
2061                                 file = fget(i);
2062                                 if (!file)
2063                                         continue;
2064                                 if (file_has_perm(current,
2065                                                   file,
2066                                                   file_to_av(file))) {
2067                                         sys_close(i);
2068                                         fd = get_unused_fd();
2069                                         if (fd != i) {
2070                                                 if (fd >= 0)
2071                                                         put_unused_fd(fd);
2072                                                 fput(file);
2073                                                 continue;
2074                                         }
2075                                         if (devnull) {
2076                                                 get_file(devnull);
2077                                         } else {
2078                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
2079                                                 if (IS_ERR(devnull)) {
2080                                                         devnull = NULL;
2081                                                         put_unused_fd(fd);
2082                                                         fput(file);
2083                                                         continue;
2084                                                 }
2085                                         }
2086                                         fd_install(fd, devnull);
2087                                 }
2088                                 fput(file);
2089                         }
2090                 }
2091                 spin_lock(&files->file_lock);
2092
2093         }
2094         spin_unlock(&files->file_lock);
2095 }
2096
2097 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
2098 {
2099         struct task_security_struct *tsec;
2100         struct bprm_security_struct *bsec;
2101         u32 sid;
2102         int rc;
2103
2104         secondary_ops->bprm_apply_creds(bprm, unsafe);
2105
2106         tsec = current->security;
2107
2108         bsec = bprm->security;
2109         sid = bsec->sid;
2110
2111         tsec->osid = tsec->sid;
2112         bsec->unsafe = 0;
2113         if (tsec->sid != sid) {
2114                 /* Check for shared state.  If not ok, leave SID
2115                    unchanged and kill. */
2116                 if (unsafe & LSM_UNSAFE_SHARE) {
2117                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
2118                                         PROCESS__SHARE, NULL);
2119                         if (rc) {
2120                                 bsec->unsafe = 1;
2121                                 return;
2122                         }
2123                 }
2124
2125                 /* Check for ptracing, and update the task SID if ok.
2126                    Otherwise, leave SID unchanged and kill. */
2127                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2128                         rc = avc_has_perm(tsec->ptrace_sid, sid,
2129                                           SECCLASS_PROCESS, PROCESS__PTRACE,
2130                                           NULL);
2131                         if (rc) {
2132                                 bsec->unsafe = 1;
2133                                 return;
2134                         }
2135                 }
2136                 tsec->sid = sid;
2137         }
2138 }
2139
2140 /*
2141  * called after apply_creds without the task lock held
2142  */
2143 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
2144 {
2145         struct task_security_struct *tsec;
2146         struct rlimit *rlim, *initrlim;
2147         struct itimerval itimer;
2148         struct bprm_security_struct *bsec;
2149         int rc, i;
2150
2151         tsec = current->security;
2152         bsec = bprm->security;
2153
2154         if (bsec->unsafe) {
2155                 force_sig_specific(SIGKILL, current);
2156                 return;
2157         }
2158         if (tsec->osid == tsec->sid)
2159                 return;
2160
2161         /* Close files for which the new task SID is not authorized. */
2162         flush_unauthorized_files(current->files);
2163
2164         /* Check whether the new SID can inherit signal state
2165            from the old SID.  If not, clear itimers to avoid
2166            subsequent signal generation and flush and unblock
2167            signals. This must occur _after_ the task SID has
2168           been updated so that any kill done after the flush
2169           will be checked against the new SID. */
2170         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2171                           PROCESS__SIGINH, NULL);
2172         if (rc) {
2173                 memset(&itimer, 0, sizeof itimer);
2174                 for (i = 0; i < 3; i++)
2175                         do_setitimer(i, &itimer, NULL);
2176                 flush_signals(current);
2177                 spin_lock_irq(&current->sighand->siglock);
2178                 flush_signal_handlers(current, 1);
2179                 sigemptyset(&current->blocked);
2180                 recalc_sigpending();
2181                 spin_unlock_irq(&current->sighand->siglock);
2182         }
2183
2184         /* Always clear parent death signal on SID transitions. */
2185         current->pdeath_signal = 0;
2186
2187         /* Check whether the new SID can inherit resource limits
2188            from the old SID.  If not, reset all soft limits to
2189            the lower of the current task's hard limit and the init
2190            task's soft limit.  Note that the setting of hard limits
2191            (even to lower them) can be controlled by the setrlimit
2192            check. The inclusion of the init task's soft limit into
2193            the computation is to avoid resetting soft limits higher
2194            than the default soft limit for cases where the default
2195            is lower than the hard limit, e.g. RLIMIT_CORE or
2196            RLIMIT_STACK.*/
2197         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
2198                           PROCESS__RLIMITINH, NULL);
2199         if (rc) {
2200                 for (i = 0; i < RLIM_NLIMITS; i++) {
2201                         rlim = current->signal->rlim + i;
2202                         initrlim = init_task.signal->rlim+i;
2203                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
2204                 }
2205                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
2206                         /*
2207                          * This will cause RLIMIT_CPU calculations
2208                          * to be refigured.
2209                          */
2210                         current->it_prof_expires = jiffies_to_cputime(1);
2211                 }
2212         }
2213
2214         /* Wake up the parent if it is waiting so that it can
2215            recheck wait permission to the new task SID. */
2216         wake_up_interruptible(&current->parent->signal->wait_chldexit);
2217 }
2218
2219 /* superblock security operations */
2220
2221 static int selinux_sb_alloc_security(struct super_block *sb)
2222 {
2223         return superblock_alloc_security(sb);
2224 }
2225
2226 static void selinux_sb_free_security(struct super_block *sb)
2227 {
2228         superblock_free_security(sb);
2229 }
2230
2231 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2232 {
2233         if (plen > olen)
2234                 return 0;
2235
2236         return !memcmp(prefix, option, plen);
2237 }
2238
2239 static inline int selinux_option(char *option, int len)
2240 {
2241         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
2242                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
2243                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
2244                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
2245 }
2246
2247 static inline void take_option(char **to, char *from, int *first, int len)
2248 {
2249         if (!*first) {
2250                 **to = ',';
2251                 *to += 1;
2252         } else
2253                 *first = 0;
2254         memcpy(*to, from, len);
2255         *to += len;
2256 }
2257
2258 static inline void take_selinux_option(char **to, char *from, int *first,
2259                                        int len)
2260 {
2261         int current_size = 0;
2262
2263         if (!*first) {
2264                 **to = '|';
2265                 *to += 1;
2266         }
2267         else
2268                 *first = 0;
2269
2270         while (current_size < len) {
2271                 if (*from != '"') {
2272                         **to = *from;
2273                         *to += 1;
2274                 }
2275                 from += 1;
2276                 current_size += 1;
2277         }
2278 }
2279
2280 static int selinux_sb_copy_data(char *orig, char *copy)
2281 {
2282         int fnosec, fsec, rc = 0;
2283         char *in_save, *in_curr, *in_end;
2284         char *sec_curr, *nosec_save, *nosec;
2285         int open_quote = 0;
2286
2287         in_curr = orig;
2288         sec_curr = copy;
2289
2290         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2291         if (!nosec) {
2292                 rc = -ENOMEM;
2293                 goto out;
2294         }
2295
2296         nosec_save = nosec;
2297         fnosec = fsec = 1;
2298         in_save = in_end = orig;
2299
2300         do {
2301                 if (*in_end == '"')
2302                         open_quote = !open_quote;
2303                 if ((*in_end == ',' && open_quote == 0) ||
2304                                 *in_end == '\0') {
2305                         int len = in_end - in_curr;
2306
2307                         if (selinux_option(in_curr, len))
2308                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2309                         else
2310                                 take_option(&nosec, in_curr, &fnosec, len);
2311
2312                         in_curr = in_end + 1;
2313                 }
2314         } while (*in_end++);
2315
2316         strcpy(in_save, nosec_save);
2317         free_page((unsigned long)nosec_save);
2318 out:
2319         return rc;
2320 }
2321
2322 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2323 {
2324         struct avc_audit_data ad;
2325         int rc;
2326
2327         rc = superblock_doinit(sb, data);
2328         if (rc)
2329                 return rc;
2330
2331         AVC_AUDIT_DATA_INIT(&ad,FS);
2332         ad.u.fs.path.dentry = sb->s_root;
2333         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2334 }
2335
2336 static int selinux_sb_statfs(struct dentry *dentry)
2337 {
2338         struct avc_audit_data ad;
2339
2340         AVC_AUDIT_DATA_INIT(&ad,FS);
2341         ad.u.fs.path.dentry = dentry->d_sb->s_root;
2342         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2343 }
2344
2345 static int selinux_mount(char * dev_name,
2346                          struct nameidata *nd,
2347                          char * type,
2348                          unsigned long flags,
2349                          void * data)
2350 {
2351         int rc;
2352
2353         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2354         if (rc)
2355                 return rc;
2356
2357         if (flags & MS_REMOUNT)
2358                 return superblock_has_perm(current, nd->path.mnt->mnt_sb,
2359                                            FILESYSTEM__REMOUNT, NULL);
2360         else
2361                 return dentry_has_perm(current, nd->path.mnt, nd->path.dentry,
2362                                        FILE__MOUNTON);
2363 }
2364
2365 static int selinux_umount(struct vfsmount *mnt, int flags)
2366 {
2367         int rc;
2368
2369         rc = secondary_ops->sb_umount(mnt, flags);
2370         if (rc)
2371                 return rc;
2372
2373         return superblock_has_perm(current,mnt->mnt_sb,
2374                                    FILESYSTEM__UNMOUNT,NULL);
2375 }
2376
2377 /* inode security operations */
2378
2379 static int selinux_inode_alloc_security(struct inode *inode)
2380 {
2381         return inode_alloc_security(inode);
2382 }
2383
2384 static void selinux_inode_free_security(struct inode *inode)
2385 {
2386         inode_free_security(inode);
2387 }
2388
2389 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2390                                        char **name, void **value,
2391                                        size_t *len)
2392 {
2393         struct task_security_struct *tsec;
2394         struct inode_security_struct *dsec;
2395         struct superblock_security_struct *sbsec;
2396         u32 newsid, clen;
2397         int rc;
2398         char *namep = NULL, *context;
2399
2400         tsec = current->security;
2401         dsec = dir->i_security;
2402         sbsec = dir->i_sb->s_security;
2403
2404         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2405                 newsid = tsec->create_sid;
2406         } else {
2407                 rc = security_transition_sid(tsec->sid, dsec->sid,
2408                                              inode_mode_to_security_class(inode->i_mode),
2409                                              &newsid);
2410                 if (rc) {
2411                         printk(KERN_WARNING "%s:  "
2412                                "security_transition_sid failed, rc=%d (dev=%s "
2413                                "ino=%ld)\n",
2414                                __FUNCTION__,
2415                                -rc, inode->i_sb->s_id, inode->i_ino);
2416                         return rc;
2417                 }
2418         }
2419
2420         /* Possibly defer initialization to selinux_complete_init. */
2421         if (sbsec->initialized) {
2422                 struct inode_security_struct *isec = inode->i_security;
2423                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2424                 isec->sid = newsid;
2425                 isec->initialized = 1;
2426         }
2427
2428         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2429                 return -EOPNOTSUPP;
2430
2431         if (name) {
2432                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2433                 if (!namep)
2434                         return -ENOMEM;
2435                 *name = namep;
2436         }
2437
2438         if (value && len) {
2439                 rc = security_sid_to_context(newsid, &context, &clen);
2440                 if (rc) {
2441                         kfree(namep);
2442                         return rc;
2443                 }
2444                 *value = context;
2445                 *len = clen;
2446         }
2447
2448         return 0;
2449 }
2450
2451 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2452 {
2453         return may_create(dir, dentry, SECCLASS_FILE);
2454 }
2455
2456 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2457 {
2458         int rc;
2459
2460         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2461         if (rc)
2462                 return rc;
2463         return may_link(dir, old_dentry, MAY_LINK);
2464 }
2465
2466 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2467 {
2468         int rc;
2469
2470         rc = secondary_ops->inode_unlink(dir, dentry);
2471         if (rc)
2472                 return rc;
2473         return may_link(dir, dentry, MAY_UNLINK);
2474 }
2475
2476 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2477 {
2478         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2479 }
2480
2481 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2482 {
2483         return may_create(dir, dentry, SECCLASS_DIR);
2484 }
2485
2486 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2487 {
2488         return may_link(dir, dentry, MAY_RMDIR);
2489 }
2490
2491 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2492 {
2493         int rc;
2494
2495         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2496         if (rc)
2497                 return rc;
2498
2499         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2500 }
2501
2502 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2503                                 struct inode *new_inode, struct dentry *new_dentry)
2504 {
2505         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2506 }
2507
2508 static int selinux_inode_readlink(struct dentry *dentry)
2509 {
2510         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2511 }
2512
2513 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2514 {
2515         int rc;
2516
2517         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2518         if (rc)
2519                 return rc;
2520         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2521 }
2522
2523 static int selinux_inode_permission(struct inode *inode, int mask,
2524                                     struct nameidata *nd)
2525 {
2526         int rc;
2527
2528         rc = secondary_ops->inode_permission(inode, mask, nd);
2529         if (rc)
2530                 return rc;
2531
2532         if (!mask) {
2533                 /* No permission to check.  Existence test. */
2534                 return 0;
2535         }
2536
2537         return inode_has_perm(current, inode,
2538                                file_mask_to_av(inode->i_mode, mask), NULL);
2539 }
2540
2541 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2542 {
2543         int rc;
2544
2545         rc = secondary_ops->inode_setattr(dentry, iattr);
2546         if (rc)
2547                 return rc;
2548
2549         if (iattr->ia_valid & ATTR_FORCE)
2550                 return 0;
2551
2552         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2553                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2554                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2555
2556         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2557 }
2558
2559 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2560 {
2561         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2562 }
2563
2564 static int selinux_inode_setotherxattr(struct dentry *dentry, char *name)
2565 {
2566         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2567                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2568                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2569                         if (!capable(CAP_SETFCAP))
2570                                 return -EPERM;
2571                 } else if (!capable(CAP_SYS_ADMIN)) {
2572                         /* A different attribute in the security namespace.
2573                            Restrict to administrator. */
2574                         return -EPERM;
2575                 }
2576         }
2577
2578         /* Not an attribute we recognize, so just check the
2579            ordinary setattr permission. */
2580         return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2581 }
2582
2583 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2584 {
2585         struct task_security_struct *tsec = current->security;
2586         struct inode *inode = dentry->d_inode;
2587         struct inode_security_struct *isec = inode->i_security;
2588         struct superblock_security_struct *sbsec;
2589         struct avc_audit_data ad;
2590         u32 newsid;
2591         int rc = 0;
2592
2593         if (strcmp(name, XATTR_NAME_SELINUX))
2594                 return selinux_inode_setotherxattr(dentry, name);
2595
2596         sbsec = inode->i_sb->s_security;
2597         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2598                 return -EOPNOTSUPP;
2599
2600         if (!is_owner_or_cap(inode))
2601                 return -EPERM;
2602
2603         AVC_AUDIT_DATA_INIT(&ad,FS);
2604         ad.u.fs.path.dentry = dentry;
2605
2606         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2607                           FILE__RELABELFROM, &ad);
2608         if (rc)
2609                 return rc;
2610
2611         rc = security_context_to_sid(value, size, &newsid);
2612         if (rc)
2613                 return rc;
2614
2615         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2616                           FILE__RELABELTO, &ad);
2617         if (rc)
2618                 return rc;
2619
2620         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2621                                           isec->sclass);
2622         if (rc)
2623                 return rc;
2624
2625         return avc_has_perm(newsid,
2626                             sbsec->sid,
2627                             SECCLASS_FILESYSTEM,
2628                             FILESYSTEM__ASSOCIATE,
2629                             &ad);
2630 }
2631
2632 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2633                                         void *value, size_t size, int flags)
2634 {
2635         struct inode *inode = dentry->d_inode;
2636         struct inode_security_struct *isec = inode->i_security;
2637         u32 newsid;
2638         int rc;
2639
2640         if (strcmp(name, XATTR_NAME_SELINUX)) {
2641                 /* Not an attribute we recognize, so nothing to do. */
2642                 return;
2643         }
2644
2645         rc = security_context_to_sid(value, size, &newsid);
2646         if (rc) {
2647                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2648                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2649                 return;
2650         }
2651
2652         isec->sid = newsid;
2653         return;
2654 }
2655
2656 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2657 {
2658         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2659 }
2660
2661 static int selinux_inode_listxattr (struct dentry *dentry)
2662 {
2663         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2664 }
2665
2666 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2667 {
2668         if (strcmp(name, XATTR_NAME_SELINUX))
2669                 return selinux_inode_setotherxattr(dentry, name);
2670
2671         /* No one is allowed to remove a SELinux security label.
2672            You can change the label, but all data must be labeled. */
2673         return -EACCES;
2674 }
2675
2676 /*
2677  * Copy the in-core inode security context value to the user.  If the
2678  * getxattr() prior to this succeeded, check to see if we need to
2679  * canonicalize the value to be finally returned to the user.
2680  *
2681  * Permission check is handled by selinux_inode_getxattr hook.
2682  */
2683 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2684 {
2685         u32 size;
2686         int error;
2687         char *context = NULL;
2688         struct inode_security_struct *isec = inode->i_security;
2689
2690         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2691                 return -EOPNOTSUPP;
2692
2693         error = security_sid_to_context(isec->sid, &context, &size);
2694         if (error)
2695                 return error;
2696         error = size;
2697         if (alloc) {
2698                 *buffer = context;
2699                 goto out_nofree;
2700         }
2701         kfree(context);
2702 out_nofree:
2703         return error;
2704 }
2705
2706 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2707                                      const void *value, size_t size, int flags)
2708 {
2709         struct inode_security_struct *isec = inode->i_security;
2710         u32 newsid;
2711         int rc;
2712
2713         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2714                 return -EOPNOTSUPP;
2715
2716         if (!value || !size)
2717                 return -EACCES;
2718
2719         rc = security_context_to_sid((void*)value, size, &newsid);
2720         if (rc)
2721                 return rc;
2722
2723         isec->sid = newsid;
2724         return 0;
2725 }
2726
2727 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2728 {
2729         const int len = sizeof(XATTR_NAME_SELINUX);
2730         if (buffer && len <= buffer_size)
2731                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2732         return len;
2733 }
2734
2735 static int selinux_inode_need_killpriv(struct dentry *dentry)
2736 {
2737         return secondary_ops->inode_need_killpriv(dentry);
2738 }
2739
2740 static int selinux_inode_killpriv(struct dentry *dentry)
2741 {
2742         return secondary_ops->inode_killpriv(dentry);
2743 }
2744
2745 /* file security operations */
2746
2747 static int selinux_revalidate_file_permission(struct file *file, int mask)
2748 {
2749         int rc;
2750         struct inode *inode = file->f_path.dentry->d_inode;
2751
2752         if (!mask) {
2753                 /* No permission to check.  Existence test. */
2754                 return 0;
2755         }
2756
2757         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2758         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2759                 mask |= MAY_APPEND;
2760
2761         rc = file_has_perm(current, file,
2762                            file_mask_to_av(inode->i_mode, mask));
2763         if (rc)
2764                 return rc;
2765
2766         return selinux_netlbl_inode_permission(inode, mask);
2767 }
2768
2769 static int selinux_file_permission(struct file *file, int mask)
2770 {
2771         struct inode *inode = file->f_path.dentry->d_inode;
2772         struct task_security_struct *tsec = current->security;
2773         struct file_security_struct *fsec = file->f_security;
2774         struct inode_security_struct *isec = inode->i_security;
2775
2776         if (!mask) {
2777                 /* No permission to check.  Existence test. */
2778                 return 0;
2779         }
2780
2781         if (tsec->sid == fsec->sid && fsec->isid == isec->sid
2782             && fsec->pseqno == avc_policy_seqno())
2783                 return selinux_netlbl_inode_permission(inode, mask);
2784
2785         return selinux_revalidate_file_permission(file, mask);
2786 }
2787
2788 static int selinux_file_alloc_security(struct file *file)
2789 {
2790         return file_alloc_security(file);
2791 }
2792
2793 static void selinux_file_free_security(struct file *file)
2794 {
2795         file_free_security(file);
2796 }
2797
2798 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2799                               unsigned long arg)
2800 {
2801         int error = 0;
2802
2803         switch (cmd) {
2804                 case FIONREAD:
2805                 /* fall through */
2806                 case FIBMAP:
2807                 /* fall through */
2808                 case FIGETBSZ:
2809                 /* fall through */
2810                 case EXT2_IOC_GETFLAGS:
2811                 /* fall through */
2812                 case EXT2_IOC_GETVERSION:
2813                         error = file_has_perm(current, file, FILE__GETATTR);
2814                         break;
2815
2816                 case EXT2_IOC_SETFLAGS:
2817                 /* fall through */
2818                 case EXT2_IOC_SETVERSION:
2819                         error = file_has_perm(current, file, FILE__SETATTR);
2820                         break;
2821
2822                 /* sys_ioctl() checks */
2823                 case FIONBIO:
2824                 /* fall through */
2825                 case FIOASYNC:
2826                         error = file_has_perm(current, file, 0);
2827                         break;
2828
2829                 case KDSKBENT:
2830                 case KDSKBSENT:
2831                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2832                         break;
2833
2834                 /* default case assumes that the command will go
2835                  * to the file's ioctl() function.
2836                  */
2837                 default:
2838                         error = file_has_perm(current, file, FILE__IOCTL);
2839
2840         }
2841         return error;
2842 }
2843
2844 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2845 {
2846 #ifndef CONFIG_PPC32
2847         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2848                 /*
2849                  * We are making executable an anonymous mapping or a
2850                  * private file mapping that will also be writable.
2851                  * This has an additional check.
2852                  */
2853                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2854                 if (rc)
2855                         return rc;
2856         }
2857 #endif
2858
2859         if (file) {
2860                 /* read access is always possible with a mapping */
2861                 u32 av = FILE__READ;
2862
2863                 /* write access only matters if the mapping is shared */
2864                 if (shared && (prot & PROT_WRITE))
2865                         av |= FILE__WRITE;
2866
2867                 if (prot & PROT_EXEC)
2868                         av |= FILE__EXECUTE;
2869
2870                 return file_has_perm(current, file, av);
2871         }
2872         return 0;
2873 }
2874
2875 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2876                              unsigned long prot, unsigned long flags,
2877                              unsigned long addr, unsigned long addr_only)
2878 {
2879         int rc = 0;
2880         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2881
2882         if (addr < mmap_min_addr)
2883                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2884                                   MEMPROTECT__MMAP_ZERO, NULL);
2885         if (rc || addr_only)
2886                 return rc;
2887
2888         if (selinux_checkreqprot)
2889                 prot = reqprot;
2890
2891         return file_map_prot_check(file, prot,
2892                                    (flags & MAP_TYPE) == MAP_SHARED);
2893 }
2894
2895 static int selinux_file_mprotect(struct vm_area_struct *vma,
2896                                  unsigned long reqprot,
2897                                  unsigned long prot)
2898 {
2899         int rc;
2900
2901         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2902         if (rc)
2903                 return rc;
2904
2905         if (selinux_checkreqprot)
2906                 prot = reqprot;
2907
2908 #ifndef CONFIG_PPC32
2909         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2910                 rc = 0;
2911                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2912                     vma->vm_end <= vma->vm_mm->brk) {
2913                         rc = task_has_perm(current, current,
2914                                            PROCESS__EXECHEAP);
2915                 } else if (!vma->vm_file &&
2916                            vma->vm_start <= vma->vm_mm->start_stack &&
2917                            vma->vm_end >= vma->vm_mm->start_stack) {
2918                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2919                 } else if (vma->vm_file && vma->anon_vma) {
2920                         /*
2921                          * We are making executable a file mapping that has
2922                          * had some COW done. Since pages might have been
2923                          * written, check ability to execute the possibly
2924                          * modified content.  This typically should only
2925                          * occur for text relocations.
2926                          */
2927                         rc = file_has_perm(current, vma->vm_file,
2928                                            FILE__EXECMOD);
2929                 }
2930                 if (rc)
2931                         return rc;
2932         }
2933 #endif
2934
2935         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2936 }
2937
2938 static int selinux_file_lock(struct file *file, unsigned int cmd)
2939 {
2940         return file_has_perm(current, file, FILE__LOCK);
2941 }
2942
2943 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2944                               unsigned long arg)
2945 {
2946         int err = 0;
2947
2948         switch (cmd) {
2949                 case F_SETFL:
2950                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2951                                 err = -EINVAL;
2952                                 break;
2953                         }
2954
2955                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2956                                 err = file_has_perm(current, file,FILE__WRITE);
2957                                 break;
2958                         }
2959                         /* fall through */
2960                 case F_SETOWN:
2961                 case F_SETSIG:
2962                 case F_GETFL:
2963                 case F_GETOWN:
2964                 case F_GETSIG:
2965                         /* Just check FD__USE permission */
2966                         err = file_has_perm(current, file, 0);
2967                         break;
2968                 case F_GETLK:
2969                 case F_SETLK:
2970                 case F_SETLKW:
2971 #if BITS_PER_LONG == 32
2972                 case F_GETLK64:
2973                 case F_SETLK64:
2974                 case F_SETLKW64:
2975 #endif
2976                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2977                                 err = -EINVAL;
2978                                 break;
2979                         }
2980                         err = file_has_perm(current, file, FILE__LOCK);
2981                         break;
2982         }
2983
2984         return err;
2985 }
2986
2987 static int selinux_file_set_fowner(struct file *file)
2988 {
2989         struct task_security_struct *tsec;
2990         struct file_security_struct *fsec;
2991
2992         tsec = current->security;
2993         fsec = file->f_security;
2994         fsec->fown_sid = tsec->sid;
2995
2996         return 0;
2997 }
2998
2999 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3000                                        struct fown_struct *fown, int signum)
3001 {
3002         struct file *file;
3003         u32 perm;
3004         struct task_security_struct *tsec;
3005         struct file_security_struct *fsec;
3006
3007         /* struct fown_struct is never outside the context of a struct file */
3008         file = container_of(fown, struct file, f_owner);
3009
3010         tsec = tsk->security;
3011         fsec = file->f_security;
3012
3013         if (!signum)
3014                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3015         else
3016                 perm = signal_to_av(signum);
3017
3018         return avc_has_perm(fsec->fown_sid, tsec->sid,
3019                             SECCLASS_PROCESS, perm, NULL);
3020 }
3021
3022 static int selinux_file_receive(struct file *file)
3023 {
3024         return file_has_perm(current, file, file_to_av(file));
3025 }
3026
3027 static int selinux_dentry_open(struct file *file)
3028 {
3029         struct file_security_struct *fsec;
3030         struct inode *inode;
3031         struct inode_security_struct *isec;
3032         inode = file->f_path.dentry->d_inode;
3033         fsec = file->f_security;
3034         isec = inode->i_security;
3035         /*
3036          * Save inode label and policy sequence number
3037          * at open-time so that selinux_file_permission
3038          * can determine whether revalidation is necessary.
3039          * Task label is already saved in the file security
3040          * struct as its SID.
3041          */
3042         fsec->isid = isec->sid;
3043         fsec->pseqno = avc_policy_seqno();
3044         /*
3045          * Since the inode label or policy seqno may have changed
3046          * between the selinux_inode_permission check and the saving
3047          * of state above, recheck that access is still permitted.
3048          * Otherwise, access might never be revalidated against the
3049          * new inode label or new policy.
3050          * This check is not redundant - do not remove.
3051          */
3052         return inode_has_perm(current, inode, file_to_av(file), NULL);
3053 }
3054
3055 /* task security operations */
3056
3057 static int selinux_task_create(unsigned long clone_flags)
3058 {
3059         int rc;
3060
3061         rc = secondary_ops->task_create(clone_flags);
3062         if (rc)
3063                 return rc;
3064
3065         return task_has_perm(current, current, PROCESS__FORK);
3066 }
3067
3068 static int selinux_task_alloc_security(struct task_struct *tsk)
3069 {
3070         struct task_security_struct *tsec1, *tsec2;
3071         int rc;
3072
3073         tsec1 = current->security;
3074
3075         rc = task_alloc_security(tsk);
3076         if (rc)
3077                 return rc;
3078         tsec2 = tsk->security;
3079
3080         tsec2->osid = tsec1->osid;
3081         tsec2->sid = tsec1->sid;
3082
3083         /* Retain the exec, fs, key, and sock SIDs across fork */
3084         tsec2->exec_sid = tsec1->exec_sid;
3085         tsec2->create_sid = tsec1->create_sid;
3086         tsec2->keycreate_sid = tsec1->keycreate_sid;
3087         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
3088
3089         /* Retain ptracer SID across fork, if any.
3090            This will be reset by the ptrace hook upon any
3091            subsequent ptrace_attach operations. */
3092         tsec2->ptrace_sid = tsec1->ptrace_sid;
3093
3094         return 0;
3095 }
3096
3097 static void selinux_task_free_security(struct task_struct *tsk)
3098 {
3099         task_free_security(tsk);
3100 }
3101
3102 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3103 {
3104         /* Since setuid only affects the current process, and
3105            since the SELinux controls are not based on the Linux
3106            identity attributes, SELinux does not need to control
3107            this operation.  However, SELinux does control the use
3108            of the CAP_SETUID and CAP_SETGID capabilities using the
3109            capable hook. */
3110         return 0;
3111 }
3112
3113 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
3114 {
3115         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
3116 }
3117
3118 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
3119 {
3120         /* See the comment for setuid above. */
3121         return 0;
3122 }
3123
3124 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3125 {
3126         return task_has_perm(current, p, PROCESS__SETPGID);
3127 }
3128
3129 static int selinux_task_getpgid(struct task_struct *p)
3130 {
3131         return task_has_perm(current, p, PROCESS__GETPGID);
3132 }
3133
3134 static int selinux_task_getsid(struct task_struct *p)
3135 {
3136         return task_has_perm(current, p, PROCESS__GETSESSION);
3137 }
3138
3139 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3140 {
3141         selinux_get_task_sid(p, secid);
3142 }
3143
3144 static int selinux_task_setgroups(struct group_info *group_info)
3145 {
3146         /* See the comment for setuid above. */
3147         return 0;
3148 }
3149
3150 static int selinux_task_setnice(struct task_struct *p, int nice)
3151 {
3152         int rc;
3153
3154         rc = secondary_ops->task_setnice(p, nice);
3155         if (rc)
3156                 return rc;
3157
3158         return task_has_perm(current,p, PROCESS__SETSCHED);
3159 }
3160
3161 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3162 {
3163         int rc;
3164
3165         rc = secondary_ops->task_setioprio(p, ioprio);
3166         if (rc)
3167                 return rc;
3168
3169         return task_has_perm(current, p, PROCESS__SETSCHED);
3170 }
3171
3172 static int selinux_task_getioprio(struct task_struct *p)
3173 {
3174         return task_has_perm(current, p, PROCESS__GETSCHED);
3175 }
3176
3177 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
3178 {
3179         struct rlimit *old_rlim = current->signal->rlim + resource;
3180         int rc;
3181
3182         rc = secondary_ops->task_setrlimit(resource, new_rlim);
3183         if (rc)
3184                 return rc;
3185
3186         /* Control the ability to change the hard limit (whether
3187            lowering or raising it), so that the hard limit can
3188            later be used as a safe reset point for the soft limit
3189            upon context transitions. See selinux_bprm_apply_creds. */
3190         if (old_rlim->rlim_max != new_rlim->rlim_max)
3191                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
3192
3193         return 0;
3194 }
3195
3196 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
3197 {
3198         int rc;
3199
3200         rc = secondary_ops->task_setscheduler(p, policy, lp);
3201         if (rc)
3202                 return rc;
3203
3204         return task_has_perm(current, p, PROCESS__SETSCHED);
3205 }
3206
3207 static int selinux_task_getscheduler(struct task_struct *p)
3208 {
3209         return task_has_perm(current, p, PROCESS__GETSCHED);
3210 }
3211
3212 static int selinux_task_movememory(struct task_struct *p)
3213 {
3214         return task_has_perm(current, p, PROCESS__SETSCHED);
3215 }
3216
3217 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3218                                 int sig, u32 secid)
3219 {
3220         u32 perm;
3221         int rc;
3222         struct task_security_struct *tsec;
3223
3224         rc = secondary_ops->task_kill(p, info, sig, secid);
3225         if (rc)
3226                 return rc;
3227
3228         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
3229                 return 0;
3230
3231         if (!sig)
3232                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3233         else
3234                 perm = signal_to_av(sig);
3235         tsec = p->security;
3236         if (secid)
3237                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
3238         else
3239                 rc = task_has_perm(current, p, perm);
3240         return rc;
3241 }
3242
3243 static int selinux_task_prctl(int option,
3244                               unsigned long arg2,
3245                               unsigned long arg3,
3246                               unsigned long arg4,
3247                               unsigned long arg5)
3248 {
3249         /* The current prctl operations do not appear to require
3250            any SELinux controls since they merely observe or modify
3251            the state of the current process. */
3252         return 0;
3253 }
3254
3255 static int selinux_task_wait(struct task_struct *p)
3256 {
3257         return task_has_perm(p, current, PROCESS__SIGCHLD);
3258 }
3259
3260 static void selinux_task_reparent_to_init(struct task_struct *p)
3261 {
3262         struct task_security_struct *tsec;
3263
3264         secondary_ops->task_reparent_to_init(p);
3265
3266         tsec = p->security;
3267         tsec->osid = tsec->sid;
3268         tsec->sid = SECINITSID_KERNEL;
3269         return;
3270 }
3271
3272 static void selinux_task_to_inode(struct task_struct *p,
3273                                   struct inode *inode)
3274 {
3275         struct task_security_struct *tsec = p->security;
3276         struct inode_security_struct *isec = inode->i_security;
3277
3278         isec->sid = tsec->sid;
3279         isec->initialized = 1;
3280         return;
3281 }
3282
3283 /* Returns error only if unable to parse addresses */
3284 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3285                         struct avc_audit_data *ad, u8 *proto)
3286 {
3287         int offset, ihlen, ret = -EINVAL;
3288         struct iphdr _iph, *ih;
3289
3290         offset = skb_network_offset(skb);
3291         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3292         if (ih == NULL)
3293                 goto out;
3294
3295         ihlen = ih->ihl * 4;
3296         if (ihlen < sizeof(_iph))
3297                 goto out;
3298
3299         ad->u.net.v4info.saddr = ih->saddr;
3300         ad->u.net.v4info.daddr = ih->daddr;
3301         ret = 0;
3302
3303         if (proto)
3304                 *proto = ih->protocol;
3305
3306         switch (ih->protocol) {
3307         case IPPROTO_TCP: {
3308                 struct tcphdr _tcph, *th;
3309
3310                 if (ntohs(ih->frag_off) & IP_OFFSET)
3311                         break;
3312
3313                 offset += ihlen;
3314                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3315                 if (th == NULL)
3316                         break;
3317
3318                 ad->u.net.sport = th->source;
3319                 ad->u.net.dport = th->dest;
3320                 break;
3321         }
3322
3323         case IPPROTO_UDP: {
3324                 struct udphdr _udph, *uh;
3325
3326                 if (ntohs(ih->frag_off) & IP_OFFSET)
3327                         break;
3328
3329                 offset += ihlen;
3330                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3331                 if (uh == NULL)
3332                         break;
3333
3334                 ad->u.net.sport = uh->source;
3335                 ad->u.net.dport = uh->dest;
3336                 break;
3337         }
3338
3339         case IPPROTO_DCCP: {
3340                 struct dccp_hdr _dccph, *dh;
3341
3342                 if (ntohs(ih->frag_off) & IP_OFFSET)
3343                         break;
3344
3345                 offset += ihlen;
3346                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3347                 if (dh == NULL)
3348                         break;
3349
3350                 ad->u.net.sport = dh->dccph_sport;
3351                 ad->u.net.dport = dh->dccph_dport;
3352                 break;
3353         }
3354
3355         default:
3356                 break;
3357         }
3358 out:
3359         return ret;
3360 }
3361
3362 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3363
3364 /* Returns error only if unable to parse addresses */
3365 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3366                         struct avc_audit_data *ad, u8 *proto)
3367 {
3368         u8 nexthdr;
3369         int ret = -EINVAL, offset;
3370         struct ipv6hdr _ipv6h, *ip6;
3371
3372         offset = skb_network_offset(skb);
3373         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3374         if (ip6 == NULL)
3375                 goto out;
3376
3377         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3378         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3379         ret = 0;
3380
3381         nexthdr = ip6->nexthdr;
3382         offset += sizeof(_ipv6h);
3383         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3384         if (offset < 0)
3385                 goto out;
3386
3387         if (proto)
3388                 *proto = nexthdr;
3389
3390         switch (nexthdr) {
3391         case IPPROTO_TCP: {
3392                 struct tcphdr _tcph, *th;
3393
3394                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3395                 if (th == NULL)
3396                         break;
3397
3398                 ad->u.net.sport = th->source;
3399                 ad->u.net.dport = th->dest;
3400                 break;
3401         }
3402
3403         case IPPROTO_UDP: {
3404                 struct udphdr _udph, *uh;
3405
3406                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3407                 if (uh == NULL)
3408                         break;
3409
3410                 ad->u.net.sport = uh->source;
3411                 ad->u.net.dport = uh->dest;
3412                 break;
3413         }
3414
3415         case IPPROTO_DCCP: {
3416                 struct dccp_hdr _dccph, *dh;
3417
3418                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3419                 if (dh == NULL)
3420                         break;
3421
3422                 ad->u.net.sport = dh->dccph_sport;
3423                 ad->u.net.dport = dh->dccph_dport;
3424                 break;
3425         }
3426
3427         /* includes fragments */
3428         default:
3429                 break;
3430         }
3431 out:
3432         return ret;
3433 }
3434
3435 #endif /* IPV6 */
3436
3437 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3438                              char **addrp, int src, u8 *proto)
3439 {
3440         int ret = 0;
3441
3442         switch (ad->u.net.family) {
3443         case PF_INET:
3444                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3445                 if (ret || !addrp)
3446                         break;
3447                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3448                                         &ad->u.net.v4info.daddr);
3449                 break;
3450
3451 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3452         case PF_INET6:
3453                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3454                 if (ret || !addrp)
3455                         break;
3456                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3457                                         &ad->u.net.v6info.daddr);
3458                 break;
3459 #endif  /* IPV6 */
3460         default:
3461                 break;
3462         }
3463
3464         if (unlikely(ret))
3465                 printk(KERN_WARNING
3466                        "SELinux: failure in selinux_parse_skb(),"
3467                        " unable to parse packet\n");
3468
3469         return ret;
3470 }
3471
3472 /**
3473  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3474  * @skb: the packet
3475  * @family: protocol family
3476  * @sid: the packet's peer label SID
3477  *
3478  * Description:
3479  * Check the various different forms of network peer labeling and determine
3480  * the peer label/SID for the packet; most of the magic actually occurs in
3481  * the security server function security_net_peersid_cmp().  The function
3482  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3483  * or -EACCES if @sid is invalid due to inconsistencies with the different
3484  * peer labels.
3485  *
3486  */
3487 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3488 {
3489         int err;
3490         u32 xfrm_sid;
3491         u32 nlbl_sid;
3492         u32 nlbl_type;
3493
3494         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3495         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3496
3497         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3498         if (unlikely(err)) {
3499                 printk(KERN_WARNING
3500                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3501                        " unable to determine packet's peer label\n");
3502                 return -EACCES;
3503         }
3504
3505         return 0;
3506 }
3507
3508 /* socket security operations */
3509 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3510                            u32 perms)
3511 {
3512         struct inode_security_struct *isec;
3513         struct task_security_struct *tsec;
3514         struct avc_audit_data ad;
3515         int err = 0;
3516
3517         tsec = task->security;
3518         isec = SOCK_INODE(sock)->i_security;
3519
3520         if (isec->sid == SECINITSID_KERNEL)
3521                 goto out;
3522
3523         AVC_AUDIT_DATA_INIT(&ad,NET);
3524         ad.u.net.sk = sock->sk;
3525         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3526
3527 out:
3528         return err;
3529 }
3530
3531 static int selinux_socket_create(int family, int type,
3532                                  int protocol, int kern)
3533 {
3534         int err = 0;
3535         struct task_security_struct *tsec;
3536         u32 newsid;
3537
3538         if (kern)
3539                 goto out;
3540
3541         tsec = current->security;
3542         newsid = tsec->sockcreate_sid ? : tsec->sid;
3543         err = avc_has_perm(tsec->sid, newsid,
3544                            socket_type_to_security_class(family, type,
3545                            protocol), SOCKET__CREATE, NULL);
3546
3547 out:
3548         return err;
3549 }
3550
3551 static int selinux_socket_post_create(struct socket *sock, int family,
3552                                       int type, int protocol, int kern)
3553 {
3554         int err = 0;
3555         struct inode_security_struct *isec;
3556         struct task_security_struct *tsec;
3557         struct sk_security_struct *sksec;
3558         u32 newsid;
3559
3560         isec = SOCK_INODE(sock)->i_security;
3561
3562         tsec = current->security;
3563         newsid = tsec->sockcreate_sid ? : tsec->sid;
3564         isec->sclass = socket_type_to_security_class(family, type, protocol);
3565         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3566         isec->initialized = 1;
3567
3568         if (sock->sk) {
3569                 sksec = sock->sk->sk_security;
3570                 sksec->sid = isec->sid;
3571                 sksec->sclass = isec->sclass;
3572                 err = selinux_netlbl_socket_post_create(sock);
3573         }
3574
3575         return err;
3576 }
3577
3578 /* Range of port numbers used to automatically bind.
3579    Need to determine whether we should perform a name_bind
3580    permission check between the socket and the port number. */
3581
3582 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3583 {
3584         u16 family;
3585         int err;
3586
3587         err = socket_has_perm(current, sock, SOCKET__BIND);
3588         if (err)
3589                 goto out;
3590
3591         /*
3592          * If PF_INET or PF_INET6, check name_bind permission for the port.
3593          * Multiple address binding for SCTP is not supported yet: we just
3594          * check the first address now.
3595          */
3596         family = sock->sk->sk_family;
3597         if (family == PF_INET || family == PF_INET6) {
3598                 char *addrp;
3599                 struct inode_security_struct *isec;
3600                 struct task_security_struct *tsec;
3601                 struct avc_audit_data ad;
3602                 struct sockaddr_in *addr4 = NULL;
3603                 struct sockaddr_in6 *addr6 = NULL;
3604                 unsigned short snum;
3605                 struct sock *sk = sock->sk;
3606                 u32 sid, node_perm, addrlen;
3607
3608                 tsec = current->security;
3609                 isec = SOCK_INODE(sock)->i_security;
3610
3611                 if (family == PF_INET) {
3612                         addr4 = (struct sockaddr_in *)address;
3613                         snum = ntohs(addr4->sin_port);
3614                         addrlen = sizeof(addr4->sin_addr.s_addr);
3615                         addrp = (char *)&addr4->sin_addr.s_addr;
3616                 } else {
3617                         addr6 = (struct sockaddr_in6 *)address;
3618                         snum = ntohs(addr6->sin6_port);
3619                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3620                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3621                 }
3622
3623                 if (snum) {
3624                         int low, high;
3625
3626                         inet_get_local_port_range(&low, &high);
3627
3628                         if (snum < max(PROT_SOCK, low) || snum > high) {
3629                                 err = security_port_sid(sk->sk_family,
3630                                                         sk->sk_type,
3631                                                         sk->sk_protocol, snum,
3632                                                         &sid);
3633                                 if (err)
3634                                         goto out;
3635                                 AVC_AUDIT_DATA_INIT(&ad,NET);
3636                                 ad.u.net.sport = htons(snum);
3637                                 ad.u.net.family = family;
3638                                 err = avc_has_perm(isec->sid, sid,
3639                                                    isec->sclass,
3640                                                    SOCKET__NAME_BIND, &ad);
3641                                 if (err)
3642                                         goto out;
3643                         }
3644                 }
3645
3646                 switch(isec->sclass) {
3647                 case SECCLASS_TCP_SOCKET:
3648                         node_perm = TCP_SOCKET__NODE_BIND;
3649                         break;
3650
3651                 case SECCLASS_UDP_SOCKET:
3652                         node_perm = UDP_SOCKET__NODE_BIND;
3653                         break;
3654
3655                 case SECCLASS_DCCP_SOCKET:
3656                         node_perm = DCCP_SOCKET__NODE_BIND;
3657                         break;
3658
3659                 default:
3660                         node_perm = RAWIP_SOCKET__NODE_BIND;
3661                         break;
3662                 }
3663
3664                 err = sel_netnode_sid(addrp, family, &sid);
3665                 if (err)
3666                         goto out;
3667
3668                 AVC_AUDIT_DATA_INIT(&ad,NET);
3669                 ad.u.net.sport = htons(snum);
3670                 ad.u.net.family = family;
3671
3672                 if (family == PF_INET)
3673                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3674                 else
3675                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3676
3677                 err = avc_has_perm(isec->sid, sid,
3678                                    isec->sclass, node_perm, &ad);
3679                 if (err)
3680                         goto out;
3681         }
3682 out:
3683         return err;
3684 }
3685
3686 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3687 {
3688         struct inode_security_struct *isec;
3689         int err;
3690
3691         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3692         if (err)
3693                 return err;
3694
3695         /*
3696          * If a TCP or DCCP socket, check name_connect permission for the port.
3697          */
3698         isec = SOCK_INODE(sock)->i_security;
3699         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3700             isec->sclass == SECCLASS_DCCP_SOCKET) {
3701                 struct sock *sk = sock->sk;
3702                 struct avc_audit_data ad;
3703                 struct sockaddr_in *addr4 = NULL;
3704                 struct sockaddr_in6 *addr6 = NULL;
3705                 unsigned short snum;
3706                 u32 sid, perm;
3707
3708                 if (sk->sk_family == PF_INET) {
3709                         addr4 = (struct sockaddr_in *)address;
3710                         if (addrlen < sizeof(struct sockaddr_in))
3711                                 return -EINVAL;
3712                         snum = ntohs(addr4->sin_port);
3713                 } else {
3714                         addr6 = (struct sockaddr_in6 *)address;
3715                         if (addrlen < SIN6_LEN_RFC2133)
3716                                 return -EINVAL;
3717                         snum = ntohs(addr6->sin6_port);
3718                 }
3719
3720                 err = security_port_sid(sk->sk_family, sk->sk_type,
3721                                         sk->sk_protocol, snum, &sid);
3722                 if (err)
3723                         goto out;
3724
3725                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3726                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3727
3728                 AVC_AUDIT_DATA_INIT(&ad,NET);
3729                 ad.u.net.dport = htons(snum);
3730                 ad.u.net.family = sk->sk_family;
3731                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3732                 if (err)
3733                         goto out;
3734         }
3735
3736 out:
3737         return err;
3738 }
3739
3740 static int selinux_socket_listen(struct socket *sock, int backlog)
3741 {
3742         return socket_has_perm(current, sock, SOCKET__LISTEN);
3743 }
3744
3745 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3746 {
3747         int err;
3748         struct inode_security_struct *isec;
3749         struct inode_security_struct *newisec;
3750
3751         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3752         if (err)
3753                 return err;
3754
3755         newisec = SOCK_INODE(newsock)->i_security;
3756
3757         isec = SOCK_INODE(sock)->i_security;
3758         newisec->sclass = isec->sclass;
3759         newisec->sid = isec->sid;
3760         newisec->initialized = 1;
3761
3762         return 0;
3763 }
3764
3765 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3766                                   int size)
3767 {
3768         int rc;
3769
3770         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3771         if (rc)
3772                 return rc;
3773
3774         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3775 }
3776
3777 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3778                                   int size, int flags)
3779 {
3780         return socket_has_perm(current, sock, SOCKET__READ);
3781 }
3782
3783 static int selinux_socket_getsockname(struct socket *sock)
3784 {
3785         return socket_has_perm(current, sock, SOCKET__GETATTR);
3786 }
3787
3788 static int selinux_socket_getpeername(struct socket *sock)
3789 {
3790         return socket_has_perm(current, sock, SOCKET__GETATTR);
3791 }
3792
3793 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3794 {
3795         int err;
3796
3797         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3798         if (err)
3799                 return err;
3800
3801         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3802 }
3803
3804 static int selinux_socket_getsockopt(struct socket *sock, int level,
3805                                      int optname)
3806 {
3807         return socket_has_perm(current, sock, SOCKET__GETOPT);
3808 }
3809
3810 static int selinux_socket_shutdown(struct socket *sock, int how)
3811 {
3812         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3813 }
3814
3815 static int selinux_socket_unix_stream_connect(struct socket *sock,
3816                                               struct socket *other,
3817                                               struct sock *newsk)
3818 {
3819         struct sk_security_struct *ssec;
3820         struct inode_security_struct *isec;
3821         struct inode_security_struct *other_isec;
3822         struct avc_audit_data ad;
3823         int err;
3824
3825         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3826         if (err)
3827                 return err;
3828
3829         isec = SOCK_INODE(sock)->i_security;
3830         other_isec = SOCK_INODE(other)->i_security;
3831
3832         AVC_AUDIT_DATA_INIT(&ad,NET);
3833         ad.u.net.sk = other->sk;
3834
3835         err = avc_has_perm(isec->sid, other_isec->sid,
3836                            isec->sclass,
3837                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3838         if (err)
3839                 return err;
3840
3841         /* connecting socket */
3842         ssec = sock->sk->sk_security;
3843         ssec->peer_sid = other_isec->sid;
3844
3845         /* server child socket */
3846         ssec = newsk->sk_security;
3847         ssec->peer_sid = isec->sid;
3848         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3849
3850         return err;
3851 }
3852
3853 static int selinux_socket_unix_may_send(struct socket *sock,
3854                                         struct socket *other)
3855 {
3856         struct inode_security_struct *isec;
3857         struct inode_security_struct *other_isec;
3858         struct avc_audit_data ad;
3859         int err;
3860
3861         isec = SOCK_INODE(sock)->i_security;
3862         other_isec = SOCK_INODE(other)->i_security;
3863
3864         AVC_AUDIT_DATA_INIT(&ad,NET);
3865         ad.u.net.sk = other->sk;
3866
3867         err = avc_has_perm(isec->sid, other_isec->sid,
3868                            isec->sclass, SOCKET__SENDTO, &ad);
3869         if (err)
3870                 return err;
3871
3872         return 0;
3873 }
3874
3875 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
3876                                     u32 peer_sid,
3877                                     struct avc_audit_data *ad)
3878 {
3879         int err;
3880         u32 if_sid;
3881         u32 node_sid;
3882
3883         err = sel_netif_sid(ifindex, &if_sid);
3884         if (err)
3885                 return err;
3886         err = avc_has_perm(peer_sid, if_sid,
3887                            SECCLASS_NETIF, NETIF__INGRESS, ad);
3888         if (err)
3889                 return err;
3890
3891         err = sel_netnode_sid(addrp, family, &node_sid);
3892         if (err)
3893                 return err;
3894         return avc_has_perm(peer_sid, node_sid,
3895                             SECCLASS_NODE, NODE__RECVFROM, ad);
3896 }
3897
3898 static int selinux_sock_rcv_skb_iptables_compat(struct sock *sk,
3899                                                 struct sk_buff *skb,
3900                                                 struct avc_audit_data *ad,
3901                                                 u16 family,
3902                                                 char *addrp)
3903 {
3904         int err;
3905         struct sk_security_struct *sksec = sk->sk_security;
3906         u16 sk_class;
3907         u32 netif_perm, node_perm, recv_perm;
3908         u32 port_sid, node_sid, if_sid, sk_sid;
3909
3910         sk_sid = sksec->sid;
3911         sk_class = sksec->sclass;
3912
3913         switch (sk_class) {
3914         case SECCLASS_UDP_SOCKET:
3915                 netif_perm = NETIF__UDP_RECV;
3916                 node_perm = NODE__UDP_RECV;
3917                 recv_perm = UDP_SOCKET__RECV_MSG;
3918                 break;
3919         case SECCLASS_TCP_SOCKET:
3920                 netif_perm = NETIF__TCP_RECV;
3921                 node_perm = NODE__TCP_RECV;
3922                 recv_perm = TCP_SOCKET__RECV_MSG;
3923                 break;
3924         case SECCLASS_DCCP_SOCKET:
3925                 netif_perm = NETIF__DCCP_RECV;
3926                 node_perm = NODE__DCCP_RECV;
3927                 recv_perm = DCCP_SOCKET__RECV_MSG;
3928                 break;
3929         default:
3930                 netif_perm = NETIF__RAWIP_RECV;
3931                 node_perm = NODE__RAWIP_RECV;
3932                 recv_perm = 0;
3933                 break;
3934         }
3935
3936         err = sel_netif_sid(skb->iif, &if_sid);
3937         if (err)
3938                 return err;
3939         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3940         if (err)
3941                 return err;
3942
3943         err = sel_netnode_sid(addrp, family, &node_sid);
3944         if (err)
3945                 return err;
3946         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3947         if (err)
3948                 return err;
3949
3950         if (!recv_perm)
3951                 return 0;
3952         err = security_port_sid(sk->sk_family, sk->sk_type,
3953                                 sk->sk_protocol, ntohs(ad->u.net.sport),
3954                                 &port_sid);
3955         if (unlikely(err)) {
3956                 printk(KERN_WARNING
3957                        "SELinux: failure in"
3958                        " selinux_sock_rcv_skb_iptables_compat(),"
3959                        " network port label not found\n");
3960                 return err;
3961         }
3962         return avc_has_perm(sk_sid, port_sid, sk_class, recv_perm, ad);
3963 }
3964
3965 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3966                                        struct avc_audit_data *ad,
3967                                        u16 family, char *addrp)
3968 {
3969         int err;
3970         struct sk_security_struct *sksec = sk->sk_security;
3971         u32 peer_sid;
3972         u32 sk_sid = sksec->sid;
3973
3974         if (selinux_compat_net)
3975                 err = selinux_sock_rcv_skb_iptables_compat(sk, skb, ad,
3976                                                            family, addrp);
3977         else
3978                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
3979                                    PACKET__RECV, ad);
3980         if (err)
3981                 return err;
3982
3983         if (selinux_policycap_netpeer) {
3984                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
3985                 if (err)
3986                         return err;
3987                 err = avc_has_perm(sk_sid, peer_sid,
3988                                    SECCLASS_PEER, PEER__RECV, ad);
3989         } else {
3990                 err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, ad);
3991                 if (err)
3992                         return err;
3993                 err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, ad);
3994         }
3995
3996         return err;
3997 }
3998
3999 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4000 {
4001         int err;
4002         struct sk_security_struct *sksec = sk->sk_security;
4003         u16 family = sk->sk_family;
4004         u32 sk_sid = sksec->sid;
4005         struct avc_audit_data ad;
4006         char *addrp;
4007
4008         if (family != PF_INET && family != PF_INET6)
4009                 return 0;
4010
4011         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4012         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4013                 family = PF_INET;
4014
4015         AVC_AUDIT_DATA_INIT(&ad, NET);
4016         ad.u.net.netif = skb->iif;
4017         ad.u.net.family = family;
4018         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4019         if (err)
4020                 return err;
4021
4022         /* If any sort of compatibility mode is enabled then handoff processing
4023          * to the selinux_sock_rcv_skb_compat() function to deal with the
4024          * special handling.  We do this in an attempt to keep this function
4025          * as fast and as clean as possible. */
4026         if (selinux_compat_net || !selinux_policycap_netpeer)
4027                 return selinux_sock_rcv_skb_compat(sk, skb, &ad,
4028                                                    family, addrp);
4029
4030         if (netlbl_enabled() || selinux_xfrm_enabled()) {
4031                 u32 peer_sid;
4032
4033                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4034                 if (err)
4035                         return err;
4036                 err = selinux_inet_sys_rcv_skb(skb->iif, addrp, family,
4037                                                peer_sid, &ad);
4038                 if (err)
4039                         return err;
4040                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4041                                    PEER__RECV, &ad);
4042         }
4043
4044         if (selinux_secmark_enabled()) {
4045                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4046                                    PACKET__RECV, &ad);
4047                 if (err)
4048                         return err;
4049         }
4050
4051         return err;
4052 }
4053
4054 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4055                                             int __user *optlen, unsigned len)
4056 {
4057         int err = 0;
4058         char *scontext;
4059         u32 scontext_len;
4060         struct sk_security_struct *ssec;
4061         struct inode_security_struct *isec;
4062         u32 peer_sid = SECSID_NULL;
4063
4064         isec = SOCK_INODE(sock)->i_security;
4065
4066         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4067             isec->sclass == SECCLASS_TCP_SOCKET) {
4068                 ssec = sock->sk->sk_security;
4069                 peer_sid = ssec->peer_sid;
4070         }
4071         if (peer_sid == SECSID_NULL) {
4072                 err = -ENOPROTOOPT;
4073                 goto out;
4074         }
4075
4076         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4077
4078         if (err)
4079                 goto out;
4080
4081         if (scontext_len > len) {
4082                 err = -ERANGE;
4083                 goto out_len;
4084         }
4085
4086         if (copy_to_user(optval, scontext, scontext_len))
4087                 err = -EFAULT;
4088
4089 out_len:
4090         if (put_user(scontext_len, optlen))
4091                 err = -EFAULT;
4092
4093         kfree(scontext);
4094 out:
4095         return err;
4096 }
4097
4098 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4099 {
4100         u32 peer_secid = SECSID_NULL;
4101         u16 family;
4102
4103         if (sock)
4104                 family = sock->sk->sk_family;
4105         else if (skb && skb->sk)
4106                 family = skb->sk->sk_family;
4107         else
4108                 goto out;
4109
4110         if (sock && family == PF_UNIX)
4111                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
4112         else if (skb)
4113                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4114
4115 out:
4116         *secid = peer_secid;
4117         if (peer_secid == SECSID_NULL)
4118                 return -EINVAL;
4119         return 0;
4120 }
4121
4122 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4123 {
4124         return sk_alloc_security(sk, family, priority);
4125 }
4126
4127 static void selinux_sk_free_security(struct sock *sk)
4128 {
4129         sk_free_security(sk);
4130 }
4131
4132 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4133 {
4134         struct sk_security_struct *ssec = sk->sk_security;
4135         struct sk_security_struct *newssec = newsk->sk_security;
4136
4137         newssec->sid = ssec->sid;
4138         newssec->peer_sid = ssec->peer_sid;
4139         newssec->sclass = ssec->sclass;
4140
4141         selinux_netlbl_sk_security_clone(ssec, newssec);
4142 }
4143
4144 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4145 {
4146         if (!sk)
4147                 *secid = SECINITSID_ANY_SOCKET;
4148         else {
4149                 struct sk_security_struct *sksec = sk->sk_security;
4150
4151                 *secid = sksec->sid;
4152         }
4153 }
4154
4155 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
4156 {
4157         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4158         struct sk_security_struct *sksec = sk->sk_security;
4159
4160         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4161             sk->sk_family == PF_UNIX)
4162                 isec->sid = sksec->sid;
4163         sksec->sclass = isec->sclass;
4164
4165         selinux_netlbl_sock_graft(sk, parent);
4166 }
4167
4168 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4169                                      struct request_sock *req)
4170 {
4171         struct sk_security_struct *sksec = sk->sk_security;
4172         int err;
4173         u32 newsid;
4174         u32 peersid;
4175
4176         err = selinux_skb_peerlbl_sid(skb, sk->sk_family, &peersid);
4177         if (err)
4178                 return err;
4179         if (peersid == SECSID_NULL) {
4180                 req->secid = sksec->sid;
4181                 req->peer_secid = SECSID_NULL;
4182                 return 0;
4183         }
4184
4185         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4186         if (err)
4187                 return err;
4188
4189         req->secid = newsid;
4190         req->peer_secid = peersid;
4191         return 0;
4192 }
4193
4194 static void selinux_inet_csk_clone(struct sock *newsk,
4195                                    const struct request_sock *req)
4196 {
4197         struct sk_security_struct *newsksec = newsk->sk_security;
4198
4199         newsksec->sid = req->secid;
4200         newsksec->peer_sid = req->peer_secid;
4201         /* NOTE: Ideally, we should also get the isec->sid for the
4202            new socket in sync, but we don't have the isec available yet.
4203            So we will wait until sock_graft to do it, by which
4204            time it will have been created and available. */
4205
4206         /* We don't need to take any sort of lock here as we are the only
4207          * thread with access to newsksec */
4208         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
4209 }
4210
4211 static void selinux_inet_conn_established(struct sock *sk,
4212                                 struct sk_buff *skb)
4213 {
4214         struct sk_security_struct *sksec = sk->sk_security;
4215
4216         selinux_skb_peerlbl_sid(skb, sk->sk_family, &sksec->peer_sid);
4217 }
4218
4219 static void selinux_req_classify_flow(const struct request_sock *req,
4220                                       struct flowi *fl)
4221 {
4222         fl->secid = req->secid;
4223 }
4224
4225 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4226 {
4227         int err = 0;
4228         u32 perm;
4229         struct nlmsghdr *nlh;
4230         struct socket *sock = sk->sk_socket;
4231         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4232
4233         if (skb->len < NLMSG_SPACE(0)) {
4234                 err = -EINVAL;
4235                 goto out;
4236         }
4237         nlh = nlmsg_hdr(skb);
4238
4239         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
4240         if (err) {
4241                 if (err == -EINVAL) {
4242                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4243                                   "SELinux:  unrecognized netlink message"
4244                                   " type=%hu for sclass=%hu\n",
4245                                   nlh->nlmsg_type, isec->sclass);
4246                         if (!selinux_enforcing)
4247                                 err = 0;
4248                 }
4249
4250                 /* Ignore */
4251                 if (err == -ENOENT)
4252                         err = 0;
4253                 goto out;
4254         }
4255
4256         err = socket_has_perm(current, sock, perm);
4257 out:
4258         return err;
4259 }
4260
4261 #ifdef CONFIG_NETFILTER
4262
4263 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4264                                        u16 family)
4265 {
4266         char *addrp;
4267         u32 peer_sid;
4268         struct avc_audit_data ad;
4269         u8 secmark_active;
4270         u8 peerlbl_active;
4271
4272         if (!selinux_policycap_netpeer)
4273                 return NF_ACCEPT;
4274
4275         secmark_active = selinux_secmark_enabled();
4276         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4277         if (!secmark_active && !peerlbl_active)
4278                 return NF_ACCEPT;
4279
4280         AVC_AUDIT_DATA_INIT(&ad, NET);
4281         ad.u.net.netif = ifindex;
4282         ad.u.net.family = family;
4283         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4284                 return NF_DROP;
4285
4286         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4287                 return NF_DROP;
4288
4289         if (peerlbl_active)
4290                 if (selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4291                                              peer_sid, &ad) != 0)
4292                         return NF_DROP;
4293
4294         if (secmark_active)
4295                 if (avc_has_perm(peer_sid, skb->secmark,
4296                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4297                         return NF_DROP;
4298
4299         return NF_ACCEPT;
4300 }
4301
4302 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4303                                          struct sk_buff *skb,
4304                                          const struct net_device *in,
4305                                          const struct net_device *out,
4306                                          int (*okfn)(struct sk_buff *))
4307 {
4308         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4309 }
4310
4311 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4312 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4313                                          struct sk_buff *skb,
4314                                          const struct net_device *in,
4315                                          const struct net_device *out,
4316                                          int (*okfn)(struct sk_buff *))
4317 {
4318         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4319 }
4320 #endif  /* IPV6 */
4321
4322 static int selinux_ip_postroute_iptables_compat(struct sock *sk,
4323                                                 int ifindex,
4324                                                 struct avc_audit_data *ad,
4325                                                 u16 family, char *addrp)
4326 {
4327         int err;
4328         struct sk_security_struct *sksec = sk->sk_security;
4329         u16 sk_class;
4330         u32 netif_perm, node_perm, send_perm;
4331         u32 port_sid, node_sid, if_sid, sk_sid;
4332
4333         sk_sid = sksec->sid;
4334         sk_class = sksec->sclass;
4335
4336         switch (sk_class) {
4337         case SECCLASS_UDP_SOCKET:
4338                 netif_perm = NETIF__UDP_SEND;
4339                 node_perm = NODE__UDP_SEND;
4340                 send_perm = UDP_SOCKET__SEND_MSG;
4341                 break;
4342         case SECCLASS_TCP_SOCKET:
4343                 netif_perm = NETIF__TCP_SEND;
4344                 node_perm = NODE__TCP_SEND;
4345                 send_perm = TCP_SOCKET__SEND_MSG;
4346                 break;
4347         case SECCLASS_DCCP_SOCKET:
4348                 netif_perm = NETIF__DCCP_SEND;
4349                 node_perm = NODE__DCCP_SEND;
4350                 send_perm = DCCP_SOCKET__SEND_MSG;
4351                 break;
4352         default:
4353                 netif_perm = NETIF__RAWIP_SEND;
4354                 node_perm = NODE__RAWIP_SEND;
4355                 send_perm = 0;
4356                 break;
4357         }
4358
4359         err = sel_netif_sid(ifindex, &if_sid);
4360         if (err)
4361                 return err;
4362         err = avc_has_perm(sk_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
4363                 return err;
4364
4365         err = sel_netnode_sid(addrp, family, &node_sid);
4366         if (err)
4367                 return err;
4368         err = avc_has_perm(sk_sid, node_sid, SECCLASS_NODE, node_perm, ad);
4369         if (err)
4370                 return err;
4371
4372         if (send_perm != 0)
4373                 return 0;
4374
4375         err = security_port_sid(sk->sk_family, sk->sk_type,
4376                                 sk->sk_protocol, ntohs(ad->u.net.dport),
4377                                 &port_sid);
4378         if (unlikely(err)) {
4379                 printk(KERN_WARNING
4380                        "SELinux: failure in"
4381                        " selinux_ip_postroute_iptables_compat(),"
4382                        " network port label not found\n");
4383                 return err;
4384         }
4385         return avc_has_perm(sk_sid, port_sid, sk_class, send_perm, ad);
4386 }
4387
4388 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4389                                                 int ifindex,
4390                                                 struct avc_audit_data *ad,
4391                                                 u16 family,
4392                                                 char *addrp,
4393                                                 u8 proto)
4394 {
4395         struct sock *sk = skb->sk;
4396         struct sk_security_struct *sksec;
4397
4398         if (sk == NULL)
4399                 return NF_ACCEPT;
4400         sksec = sk->sk_security;
4401
4402         if (selinux_compat_net) {
4403                 if (selinux_ip_postroute_iptables_compat(skb->sk, ifindex,
4404                                                          ad, family, addrp))
4405                         return NF_DROP;
4406         } else {
4407                 if (avc_has_perm(sksec->sid, skb->secmark,
4408                                  SECCLASS_PACKET, PACKET__SEND, ad))
4409                         return NF_DROP;
4410         }
4411
4412         if (selinux_policycap_netpeer)
4413                 if (selinux_xfrm_postroute_last(sksec->sid, skb, ad, proto))
4414                         return NF_DROP;
4415
4416         return NF_ACCEPT;
4417 }
4418
4419 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4420                                          u16 family)
4421 {
4422         u32 secmark_perm;
4423         u32 peer_sid;
4424         struct sock *sk;
4425         struct avc_audit_data ad;
4426         char *addrp;
4427         u8 proto;
4428         u8 secmark_active;
4429         u8 peerlbl_active;
4430
4431         AVC_AUDIT_DATA_INIT(&ad, NET);
4432         ad.u.net.netif = ifindex;
4433         ad.u.net.family = family;
4434         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4435                 return NF_DROP;
4436
4437         /* If any sort of compatibility mode is enabled then handoff processing
4438          * to the selinux_ip_postroute_compat() function to deal with the
4439          * special handling.  We do this in an attempt to keep this function
4440          * as fast and as clean as possible. */
4441         if (selinux_compat_net || !selinux_policycap_netpeer)
4442                 return selinux_ip_postroute_compat(skb, ifindex, &ad,
4443                                                    family, addrp, proto);
4444
4445         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4446          * packet transformation so allow the packet to pass without any checks
4447          * since we'll have another chance to perform access control checks
4448          * when the packet is on it's final way out.
4449          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4450          *       is NULL, in this case go ahead and apply access control. */
4451         if (skb->dst != NULL && skb->dst->xfrm != NULL)
4452                 return NF_ACCEPT;
4453
4454         secmark_active = selinux_secmark_enabled();
4455         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4456         if (!secmark_active && !peerlbl_active)
4457                 return NF_ACCEPT;
4458
4459         /* if the packet is locally generated (skb->sk != NULL) then use the
4460          * socket's label as the peer label, otherwise the packet is being
4461          * forwarded through this system and we need to fetch the peer label
4462          * directly from the packet */
4463         sk = skb->sk;
4464         if (sk) {
4465                 struct sk_security_struct *sksec = sk->sk_security;
4466                 peer_sid = sksec->sid;
4467                 secmark_perm = PACKET__SEND;
4468         } else {
4469                 if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4470                                 return NF_DROP;
4471                 secmark_perm = PACKET__FORWARD_OUT;
4472         }
4473
4474         if (secmark_active)
4475                 if (avc_has_perm(peer_sid, skb->secmark,
4476                                  SECCLASS_PACKET, secmark_perm, &ad))
4477                         return NF_DROP;
4478
4479         if (peerlbl_active) {
4480                 u32 if_sid;
4481                 u32 node_sid;
4482
4483                 if (sel_netif_sid(ifindex, &if_sid))
4484                         return NF_DROP;
4485                 if (avc_has_perm(peer_sid, if_sid,
4486                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4487                         return NF_DROP;
4488
4489                 if (sel_netnode_sid(addrp, family, &node_sid))
4490                         return NF_DROP;
4491                 if (avc_has_perm(peer_sid, node_sid,
4492                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4493                         return NF_DROP;
4494         }
4495
4496         return NF_ACCEPT;
4497 }
4498
4499 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4500                                            struct sk_buff *skb,
4501                                            const struct net_device *in,
4502                                            const struct net_device *out,
4503                                            int (*okfn)(struct sk_buff *))
4504 {
4505         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4506 }
4507
4508 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4509 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4510                                            struct sk_buff *skb,
4511                                            const struct net_device *in,
4512                                            const struct net_device *out,
4513                                            int (*okfn)(struct sk_buff *))
4514 {
4515         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4516 }
4517 #endif  /* IPV6 */
4518
4519 #endif  /* CONFIG_NETFILTER */
4520
4521 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4522 {
4523         int err;
4524
4525         err = secondary_ops->netlink_send(sk, skb);
4526         if (err)
4527                 return err;
4528
4529         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4530                 err = selinux_nlmsg_perm(sk, skb);
4531
4532         return err;
4533 }
4534
4535 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4536 {
4537         int err;
4538         struct avc_audit_data ad;
4539
4540         err = secondary_ops->netlink_recv(skb, capability);
4541         if (err)
4542                 return err;
4543
4544         AVC_AUDIT_DATA_INIT(&ad, CAP);
4545         ad.u.cap = capability;
4546
4547         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4548                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4549 }
4550
4551 static int ipc_alloc_security(struct task_struct *task,
4552                               struct kern_ipc_perm *perm,
4553                               u16 sclass)
4554 {
4555         struct task_security_struct *tsec = task->security;
4556         struct ipc_security_struct *isec;
4557
4558         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4559         if (!isec)
4560                 return -ENOMEM;
4561
4562         isec->sclass = sclass;
4563         isec->ipc_perm = perm;
4564         isec->sid = tsec->sid;
4565         perm->security = isec;
4566
4567         return 0;
4568 }
4569
4570 static void ipc_free_security(struct kern_ipc_perm *perm)
4571 {
4572         struct ipc_security_struct *isec = perm->security;
4573         perm->security = NULL;
4574         kfree(isec);
4575 }
4576
4577 static int msg_msg_alloc_security(struct msg_msg *msg)
4578 {
4579         struct msg_security_struct *msec;
4580
4581         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4582         if (!msec)
4583                 return -ENOMEM;
4584
4585         msec->msg = msg;
4586         msec->sid = SECINITSID_UNLABELED;
4587         msg->security = msec;
4588
4589         return 0;
4590 }
4591
4592 static void msg_msg_free_security(struct msg_msg *msg)
4593 {
4594         struct msg_security_struct *msec = msg->security;
4595
4596         msg->security = NULL;
4597         kfree(msec);
4598 }
4599
4600 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4601                         u32 perms)
4602 {
4603         struct task_security_struct *tsec;
4604         struct ipc_security_struct *isec;
4605         struct avc_audit_data ad;
4606
4607         tsec = current->security;
4608         isec = ipc_perms->security;
4609
4610         AVC_AUDIT_DATA_INIT(&ad, IPC);
4611         ad.u.ipc_id = ipc_perms->key;
4612
4613         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4614 }
4615
4616 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4617 {
4618         return msg_msg_alloc_security(msg);
4619 }
4620
4621 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4622 {
4623         msg_msg_free_security(msg);
4624 }
4625
4626 /* message queue security operations */
4627 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4628 {
4629         struct task_security_struct *tsec;
4630         struct ipc_security_struct *isec;
4631         struct avc_audit_data ad;
4632         int rc;
4633
4634         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4635         if (rc)
4636                 return rc;
4637
4638         tsec = current->security;
4639         isec = msq->q_perm.security;
4640
4641         AVC_AUDIT_DATA_INIT(&ad, IPC);
4642         ad.u.ipc_id = msq->q_perm.key;
4643
4644         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4645                           MSGQ__CREATE, &ad);
4646         if (rc) {
4647                 ipc_free_security(&msq->q_perm);
4648                 return rc;
4649         }
4650         return 0;
4651 }
4652
4653 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4654 {
4655         ipc_free_security(&msq->q_perm);
4656 }
4657
4658 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4659 {
4660         struct task_security_struct *tsec;
4661         struct ipc_security_struct *isec;
4662         struct avc_audit_data ad;
4663
4664         tsec = current->security;
4665         isec = msq->q_perm.security;
4666
4667         AVC_AUDIT_DATA_INIT(&ad, IPC);
4668         ad.u.ipc_id = msq->q_perm.key;
4669
4670         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4671                             MSGQ__ASSOCIATE, &ad);
4672 }
4673
4674 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4675 {
4676         int err;
4677         int perms;
4678
4679         switch(cmd) {
4680         case IPC_INFO:
4681         case MSG_INFO:
4682                 /* No specific object, just general system-wide information. */
4683                 return task_has_system(current, SYSTEM__IPC_INFO);
4684         case IPC_STAT:
4685         case MSG_STAT:
4686                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4687                 break;
4688         case IPC_SET:
4689                 perms = MSGQ__SETATTR;
4690                 break;
4691         case IPC_RMID:
4692                 perms = MSGQ__DESTROY;
4693                 break;
4694         default:
4695                 return 0;
4696         }
4697
4698         err = ipc_has_perm(&msq->q_perm, perms);
4699         return err;
4700 }
4701
4702 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4703 {
4704         struct task_security_struct *tsec;
4705         struct ipc_security_struct *isec;
4706         struct msg_security_struct *msec;
4707         struct avc_audit_data ad;
4708         int rc;
4709
4710         tsec = current->security;
4711         isec = msq->q_perm.security;
4712         msec = msg->security;
4713
4714         /*
4715          * First time through, need to assign label to the message
4716          */
4717         if (msec->sid == SECINITSID_UNLABELED) {
4718                 /*
4719                  * Compute new sid based on current process and
4720                  * message queue this message will be stored in
4721                  */
4722                 rc = security_transition_sid(tsec->sid,
4723                                              isec->sid,
4724                                              SECCLASS_MSG,
4725                                              &msec->sid);
4726                 if (rc)
4727                         return rc;
4728         }
4729
4730         AVC_AUDIT_DATA_INIT(&ad, IPC);
4731         ad.u.ipc_id = msq->q_perm.key;
4732
4733         /* Can this process write to the queue? */
4734         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4735                           MSGQ__WRITE, &ad);
4736         if (!rc)
4737                 /* Can this process send the message */
4738                 rc = avc_has_perm(tsec->sid, msec->sid,
4739                                   SECCLASS_MSG, MSG__SEND, &ad);
4740         if (!rc)
4741                 /* Can the message be put in the queue? */
4742                 rc = avc_has_perm(msec->sid, isec->sid,
4743                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4744
4745         return rc;
4746 }
4747
4748 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4749                                     struct task_struct *target,
4750                                     long type, int mode)
4751 {
4752         struct task_security_struct *tsec;
4753         struct ipc_security_struct *isec;
4754         struct msg_security_struct *msec;
4755         struct avc_audit_data ad;
4756         int rc;
4757
4758         tsec = target->security;
4759         isec = msq->q_perm.security;
4760         msec = msg->security;
4761
4762         AVC_AUDIT_DATA_INIT(&ad, IPC);
4763         ad.u.ipc_id = msq->q_perm.key;
4764
4765         rc = avc_has_perm(tsec->sid, isec->sid,
4766                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4767         if (!rc)
4768                 rc = avc_has_perm(tsec->sid, msec->sid,
4769                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4770         return rc;
4771 }
4772
4773 /* Shared Memory security operations */
4774 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4775 {
4776         struct task_security_struct *tsec;
4777         struct ipc_security_struct *isec;
4778         struct avc_audit_data ad;
4779         int rc;
4780
4781         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4782         if (rc)
4783                 return rc;
4784
4785         tsec = current->security;
4786         isec = shp->shm_perm.security;
4787
4788         AVC_AUDIT_DATA_INIT(&ad, IPC);
4789         ad.u.ipc_id = shp->shm_perm.key;
4790
4791         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4792                           SHM__CREATE, &ad);
4793         if (rc) {
4794                 ipc_free_security(&shp->shm_perm);
4795                 return rc;
4796         }
4797         return 0;
4798 }
4799
4800 static void selinux_shm_free_security(struct shmid_kernel *shp)
4801 {
4802         ipc_free_security(&shp->shm_perm);
4803 }
4804
4805 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4806 {
4807         struct task_security_struct *tsec;
4808         struct ipc_security_struct *isec;
4809         struct avc_audit_data ad;
4810
4811         tsec = current->security;
4812         isec = shp->shm_perm.security;
4813
4814         AVC_AUDIT_DATA_INIT(&ad, IPC);
4815         ad.u.ipc_id = shp->shm_perm.key;
4816
4817         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4818                             SHM__ASSOCIATE, &ad);
4819 }
4820
4821 /* Note, at this point, shp is locked down */
4822 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4823 {
4824         int perms;
4825         int err;
4826
4827         switch(cmd) {
4828         case IPC_INFO:
4829         case SHM_INFO:
4830                 /* No specific object, just general system-wide information. */
4831                 return task_has_system(current, SYSTEM__IPC_INFO);
4832         case IPC_STAT:
4833         case SHM_STAT:
4834                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4835                 break;
4836         case IPC_SET:
4837                 perms = SHM__SETATTR;
4838                 break;
4839         case SHM_LOCK:
4840         case SHM_UNLOCK:
4841                 perms = SHM__LOCK;
4842                 break;
4843         case IPC_RMID:
4844                 perms = SHM__DESTROY;
4845                 break;
4846         default:
4847                 return 0;
4848         }
4849
4850         err = ipc_has_perm(&shp->shm_perm, perms);
4851         return err;
4852 }
4853
4854 static int selinux_shm_shmat(struct shmid_kernel *shp,
4855                              char __user *shmaddr, int shmflg)
4856 {
4857         u32 perms;
4858         int rc;
4859
4860         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4861         if (rc)
4862                 return rc;
4863
4864         if (shmflg & SHM_RDONLY)
4865                 perms = SHM__READ;
4866         else
4867                 perms = SHM__READ | SHM__WRITE;
4868
4869         return ipc_has_perm(&shp->shm_perm, perms);
4870 }
4871
4872 /* Semaphore security operations */
4873 static int selinux_sem_alloc_security(struct sem_array *sma)
4874 {
4875         struct task_security_struct *tsec;
4876         struct ipc_security_struct *isec;
4877         struct avc_audit_data ad;
4878         int rc;
4879
4880         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4881         if (rc)
4882                 return rc;
4883
4884         tsec = current->security;
4885         isec = sma->sem_perm.security;
4886
4887         AVC_AUDIT_DATA_INIT(&ad, IPC);
4888         ad.u.ipc_id = sma->sem_perm.key;
4889
4890         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4891                           SEM__CREATE, &ad);
4892         if (rc) {
4893                 ipc_free_security(&sma->sem_perm);
4894                 return rc;
4895         }
4896         return 0;
4897 }
4898
4899 static void selinux_sem_free_security(struct sem_array *sma)
4900 {
4901         ipc_free_security(&sma->sem_perm);
4902 }
4903
4904 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4905 {
4906         struct task_security_struct *tsec;
4907         struct ipc_security_struct *isec;
4908         struct avc_audit_data ad;
4909
4910         tsec = current->security;
4911         isec = sma->sem_perm.security;
4912
4913         AVC_AUDIT_DATA_INIT(&ad, IPC);
4914         ad.u.ipc_id = sma->sem_perm.key;
4915
4916         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4917                             SEM__ASSOCIATE, &ad);
4918 }
4919
4920 /* Note, at this point, sma is locked down */
4921 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4922 {
4923         int err;
4924         u32 perms;
4925
4926         switch(cmd) {
4927         case IPC_INFO:
4928         case SEM_INFO:
4929                 /* No specific object, just general system-wide information. */
4930                 return task_has_system(current, SYSTEM__IPC_INFO);
4931         case GETPID:
4932         case GETNCNT:
4933         case GETZCNT:
4934                 perms = SEM__GETATTR;
4935                 break;
4936         case GETVAL:
4937         case GETALL:
4938                 perms = SEM__READ;
4939                 break;
4940         case SETVAL:
4941         case SETALL:
4942                 perms = SEM__WRITE;
4943                 break;
4944         case IPC_RMID:
4945                 perms = SEM__DESTROY;
4946                 break;
4947         case IPC_SET:
4948                 perms = SEM__SETATTR;
4949                 break;
4950         case IPC_STAT:
4951         case SEM_STAT:
4952                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4953                 break;
4954         default:
4955                 return 0;
4956         }
4957
4958         err = ipc_has_perm(&sma->sem_perm, perms);
4959         return err;
4960 }
4961
4962 static int selinux_sem_semop(struct sem_array *sma,
4963                              struct sembuf *sops, unsigned nsops, int alter)
4964 {
4965         u32 perms;
4966
4967         if (alter)
4968                 perms = SEM__READ | SEM__WRITE;
4969         else
4970                 perms = SEM__READ;
4971
4972         return ipc_has_perm(&sma->sem_perm, perms);
4973 }
4974
4975 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4976 {
4977         u32 av = 0;
4978
4979         av = 0;
4980         if (flag & S_IRUGO)
4981                 av |= IPC__UNIX_READ;
4982         if (flag & S_IWUGO)
4983                 av |= IPC__UNIX_WRITE;
4984
4985         if (av == 0)
4986                 return 0;
4987
4988         return ipc_has_perm(ipcp, av);
4989 }
4990
4991 /* module stacking operations */
4992 static int selinux_register_security (const char *name, struct security_operations *ops)
4993 {
4994         if (secondary_ops != original_ops) {
4995                 printk(KERN_ERR "%s:  There is already a secondary security "
4996                        "module registered.\n", __FUNCTION__);
4997                 return -EINVAL;
4998         }
4999
5000         secondary_ops = ops;
5001
5002         printk(KERN_INFO "%s:  Registering secondary module %s\n",
5003                __FUNCTION__,
5004                name);
5005
5006         return 0;
5007 }
5008
5009 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
5010 {
5011         if (inode)
5012                 inode_doinit_with_dentry(inode, dentry);
5013 }
5014
5015 static int selinux_getprocattr(struct task_struct *p,
5016                                char *name, char **value)
5017 {
5018         struct task_security_struct *tsec;
5019         u32 sid;
5020         int error;
5021         unsigned len;
5022
5023         if (current != p) {
5024                 error = task_has_perm(current, p, PROCESS__GETATTR);
5025                 if (error)
5026                         return error;
5027         }
5028
5029         tsec = p->security;
5030
5031         if (!strcmp(name, "current"))
5032                 sid = tsec->sid;
5033         else if (!strcmp(name, "prev"))
5034                 sid = tsec->osid;
5035         else if (!strcmp(name, "exec"))
5036                 sid = tsec->exec_sid;
5037         else if (!strcmp(name, "fscreate"))
5038                 sid = tsec->create_sid;
5039         else if (!strcmp(name, "keycreate"))
5040                 sid = tsec->keycreate_sid;
5041         else if (!strcmp(name, "sockcreate"))
5042                 sid = tsec->sockcreate_sid;
5043         else
5044                 return -EINVAL;
5045
5046         if (!sid)
5047                 return 0;
5048
5049         error = security_sid_to_context(sid, value, &len);
5050         if (error)
5051                 return error;
5052         return len;
5053 }
5054
5055 static int selinux_setprocattr(struct task_struct *p,
5056                                char *name, void *value, size_t size)
5057 {
5058         struct task_security_struct *tsec;
5059         u32 sid = 0;
5060         int error;
5061         char *str = value;
5062
5063         if (current != p) {
5064                 /* SELinux only allows a process to change its own
5065                    security attributes. */
5066                 return -EACCES;
5067         }
5068
5069         /*
5070          * Basic control over ability to set these attributes at all.
5071          * current == p, but we'll pass them separately in case the
5072          * above restriction is ever removed.
5073          */
5074         if (!strcmp(name, "exec"))
5075                 error = task_has_perm(current, p, PROCESS__SETEXEC);
5076         else if (!strcmp(name, "fscreate"))
5077                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
5078         else if (!strcmp(name, "keycreate"))
5079                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
5080         else if (!strcmp(name, "sockcreate"))
5081                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
5082         else if (!strcmp(name, "current"))
5083                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
5084         else
5085                 error = -EINVAL;
5086         if (error)
5087                 return error;
5088
5089         /* Obtain a SID for the context, if one was specified. */
5090         if (size && str[1] && str[1] != '\n') {
5091                 if (str[size-1] == '\n') {
5092                         str[size-1] = 0;
5093                         size--;
5094                 }
5095                 error = security_context_to_sid(value, size, &sid);
5096                 if (error)
5097                         return error;
5098         }
5099
5100         /* Permission checking based on the specified context is
5101            performed during the actual operation (execve,
5102            open/mkdir/...), when we know the full context of the
5103            operation.  See selinux_bprm_set_security for the execve
5104            checks and may_create for the file creation checks. The
5105            operation will then fail if the context is not permitted. */
5106         tsec = p->security;
5107         if (!strcmp(name, "exec"))
5108                 tsec->exec_sid = sid;
5109         else if (!strcmp(name, "fscreate"))
5110                 tsec->create_sid = sid;
5111         else if (!strcmp(name, "keycreate")) {
5112                 error = may_create_key(sid, p);
5113                 if (error)
5114                         return error;
5115                 tsec->keycreate_sid = sid;
5116         } else if (!strcmp(name, "sockcreate"))
5117                 tsec->sockcreate_sid = sid;
5118         else if (!strcmp(name, "current")) {
5119                 struct av_decision avd;
5120
5121                 if (sid == 0)
5122                         return -EINVAL;
5123
5124                 /* Only allow single threaded processes to change context */
5125                 if (atomic_read(&p->mm->mm_users) != 1) {
5126                         struct task_struct *g, *t;
5127                         struct mm_struct *mm = p->mm;
5128                         read_lock(&tasklist_lock);
5129                         do_each_thread(g, t)
5130                                 if (t->mm == mm && t != p) {
5131                                         read_unlock(&tasklist_lock);
5132                                         return -EPERM;
5133                                 }
5134                         while_each_thread(g, t);
5135                         read_unlock(&tasklist_lock);
5136                 }
5137
5138                 /* Check permissions for the transition. */
5139                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5140                                      PROCESS__DYNTRANSITION, NULL);
5141                 if (error)
5142                         return error;
5143
5144                 /* Check for ptracing, and update the task SID if ok.
5145                    Otherwise, leave SID unchanged and fail. */
5146                 task_lock(p);
5147                 if (p->ptrace & PT_PTRACED) {
5148                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
5149                                                      SECCLASS_PROCESS,
5150                                                      PROCESS__PTRACE, 0, &avd);
5151                         if (!error)
5152                                 tsec->sid = sid;
5153                         task_unlock(p);
5154                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
5155                                   PROCESS__PTRACE, &avd, error, NULL);
5156                         if (error)
5157                                 return error;
5158                 } else {
5159                         tsec->sid = sid;
5160                         task_unlock(p);
5161                 }
5162         }
5163         else
5164                 return -EINVAL;
5165
5166         return size;
5167 }
5168
5169 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5170 {
5171         return security_sid_to_context(secid, secdata, seclen);
5172 }
5173
5174 static int selinux_secctx_to_secid(char *secdata, u32 seclen, u32 *secid)
5175 {
5176         return security_context_to_sid(secdata, seclen, secid);
5177 }
5178
5179 static void selinux_release_secctx(char *secdata, u32 seclen)
5180 {
5181         kfree(secdata);
5182 }
5183
5184 #ifdef CONFIG_KEYS
5185
5186 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
5187                              unsigned long flags)
5188 {
5189         struct task_security_struct *tsec = tsk->security;
5190         struct key_security_struct *ksec;
5191
5192         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5193         if (!ksec)
5194                 return -ENOMEM;
5195
5196         ksec->obj = k;
5197         if (tsec->keycreate_sid)
5198                 ksec->sid = tsec->keycreate_sid;
5199         else
5200                 ksec->sid = tsec->sid;
5201         k->security = ksec;
5202
5203         return 0;
5204 }
5205
5206 static void selinux_key_free(struct key *k)
5207 {
5208         struct key_security_struct *ksec = k->security;
5209
5210         k->security = NULL;
5211         kfree(ksec);
5212 }
5213
5214 static int selinux_key_permission(key_ref_t key_ref,
5215                             struct task_struct *ctx,
5216                             key_perm_t perm)
5217 {
5218         struct key *key;
5219         struct task_security_struct *tsec;
5220         struct key_security_struct *ksec;
5221
5222         key = key_ref_to_ptr(key_ref);
5223
5224         tsec = ctx->security;
5225         ksec = key->security;
5226
5227         /* if no specific permissions are requested, we skip the
5228            permission check. No serious, additional covert channels
5229            appear to be created. */
5230         if (perm == 0)
5231                 return 0;
5232
5233         return avc_has_perm(tsec->sid, ksec->sid,
5234                             SECCLASS_KEY, perm, NULL);
5235 }
5236
5237 #endif
5238
5239 static struct security_operations selinux_ops = {
5240         .ptrace =                       selinux_ptrace,
5241         .capget =                       selinux_capget,
5242         .capset_check =                 selinux_capset_check,
5243         .capset_set =                   selinux_capset_set,
5244         .sysctl =                       selinux_sysctl,
5245         .capable =                      selinux_capable,
5246         .quotactl =                     selinux_quotactl,
5247         .quota_on =                     selinux_quota_on,
5248         .syslog =                       selinux_syslog,
5249         .vm_enough_memory =             selinux_vm_enough_memory,
5250
5251         .netlink_send =                 selinux_netlink_send,
5252         .netlink_recv =                 selinux_netlink_recv,
5253
5254         .bprm_alloc_security =          selinux_bprm_alloc_security,
5255         .bprm_free_security =           selinux_bprm_free_security,
5256         .bprm_apply_creds =             selinux_bprm_apply_creds,
5257         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
5258         .bprm_set_security =            selinux_bprm_set_security,
5259         .bprm_check_security =          selinux_bprm_check_security,
5260         .bprm_secureexec =              selinux_bprm_secureexec,
5261
5262         .sb_alloc_security =            selinux_sb_alloc_security,
5263         .sb_free_security =             selinux_sb_free_security,
5264         .sb_copy_data =                 selinux_sb_copy_data,
5265         .sb_kern_mount =                selinux_sb_kern_mount,
5266         .sb_statfs =                    selinux_sb_statfs,
5267         .sb_mount =                     selinux_mount,
5268         .sb_umount =                    selinux_umount,
5269         .sb_get_mnt_opts =              selinux_get_mnt_opts,
5270         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5271         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5272         .sb_parse_opts_str =            selinux_parse_opts_str,
5273
5274
5275         .inode_alloc_security =         selinux_inode_alloc_security,
5276         .inode_free_security =          selinux_inode_free_security,
5277         .inode_init_security =          selinux_inode_init_security,
5278         .inode_create =                 selinux_inode_create,
5279         .inode_link =                   selinux_inode_link,
5280         .inode_unlink =                 selinux_inode_unlink,
5281         .inode_symlink =                selinux_inode_symlink,
5282         .inode_mkdir =                  selinux_inode_mkdir,
5283         .inode_rmdir =                  selinux_inode_rmdir,
5284         .inode_mknod =                  selinux_inode_mknod,
5285         .inode_rename =                 selinux_inode_rename,
5286         .inode_readlink =               selinux_inode_readlink,
5287         .inode_follow_link =            selinux_inode_follow_link,
5288         .inode_permission =             selinux_inode_permission,
5289         .inode_setattr =                selinux_inode_setattr,
5290         .inode_getattr =                selinux_inode_getattr,
5291         .inode_setxattr =               selinux_inode_setxattr,
5292         .inode_post_setxattr =          selinux_inode_post_setxattr,
5293         .inode_getxattr =               selinux_inode_getxattr,
5294         .inode_listxattr =              selinux_inode_listxattr,
5295         .inode_removexattr =            selinux_inode_removexattr,
5296         .inode_getsecurity =            selinux_inode_getsecurity,
5297         .inode_setsecurity =            selinux_inode_setsecurity,
5298         .inode_listsecurity =           selinux_inode_listsecurity,
5299         .inode_need_killpriv =          selinux_inode_need_killpriv,
5300         .inode_killpriv =               selinux_inode_killpriv,
5301
5302         .file_permission =              selinux_file_permission,
5303         .file_alloc_security =          selinux_file_alloc_security,
5304         .file_free_security =           selinux_file_free_security,
5305         .file_ioctl =                   selinux_file_ioctl,
5306         .file_mmap =                    selinux_file_mmap,
5307         .file_mprotect =                selinux_file_mprotect,
5308         .file_lock =                    selinux_file_lock,
5309         .file_fcntl =                   selinux_file_fcntl,
5310         .file_set_fowner =              selinux_file_set_fowner,
5311         .file_send_sigiotask =          selinux_file_send_sigiotask,
5312         .file_receive =                 selinux_file_receive,
5313
5314         .dentry_open =                  selinux_dentry_open,
5315
5316         .task_create =                  selinux_task_create,
5317         .task_alloc_security =          selinux_task_alloc_security,
5318         .task_free_security =           selinux_task_free_security,
5319         .task_setuid =                  selinux_task_setuid,
5320         .task_post_setuid =             selinux_task_post_setuid,
5321         .task_setgid =                  selinux_task_setgid,
5322         .task_setpgid =                 selinux_task_setpgid,
5323         .task_getpgid =                 selinux_task_getpgid,
5324         .task_getsid =                  selinux_task_getsid,
5325         .task_getsecid =                selinux_task_getsecid,
5326         .task_setgroups =               selinux_task_setgroups,
5327         .task_setnice =                 selinux_task_setnice,
5328         .task_setioprio =               selinux_task_setioprio,
5329         .task_getioprio =               selinux_task_getioprio,
5330         .task_setrlimit =               selinux_task_setrlimit,
5331         .task_setscheduler =            selinux_task_setscheduler,
5332         .task_getscheduler =            selinux_task_getscheduler,
5333         .task_movememory =              selinux_task_movememory,
5334         .task_kill =                    selinux_task_kill,
5335         .task_wait =                    selinux_task_wait,
5336         .task_prctl =                   selinux_task_prctl,
5337         .task_reparent_to_init =        selinux_task_reparent_to_init,
5338         .task_to_inode =                selinux_task_to_inode,
5339
5340         .ipc_permission =               selinux_ipc_permission,
5341
5342         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5343         .msg_msg_free_security =        selinux_msg_msg_free_security,
5344
5345         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5346         .msg_queue_free_security =      selinux_msg_queue_free_security,
5347         .msg_queue_associate =          selinux_msg_queue_associate,
5348         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5349         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5350         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5351
5352         .shm_alloc_security =           selinux_shm_alloc_security,
5353         .shm_free_security =            selinux_shm_free_security,
5354         .shm_associate =                selinux_shm_associate,
5355         .shm_shmctl =                   selinux_shm_shmctl,
5356         .shm_shmat =                    selinux_shm_shmat,
5357
5358         .sem_alloc_security =           selinux_sem_alloc_security,
5359         .sem_free_security =            selinux_sem_free_security,
5360         .sem_associate =                selinux_sem_associate,
5361         .sem_semctl =                   selinux_sem_semctl,
5362         .sem_semop =                    selinux_sem_semop,
5363
5364         .register_security =            selinux_register_security,
5365
5366         .d_instantiate =                selinux_d_instantiate,
5367
5368         .getprocattr =                  selinux_getprocattr,
5369         .setprocattr =                  selinux_setprocattr,
5370
5371         .secid_to_secctx =              selinux_secid_to_secctx,
5372         .secctx_to_secid =              selinux_secctx_to_secid,
5373         .release_secctx =               selinux_release_secctx,
5374
5375         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5376         .unix_may_send =                selinux_socket_unix_may_send,
5377
5378         .socket_create =                selinux_socket_create,
5379         .socket_post_create =           selinux_socket_post_create,
5380         .socket_bind =                  selinux_socket_bind,
5381         .socket_connect =               selinux_socket_connect,
5382         .socket_listen =                selinux_socket_listen,
5383         .socket_accept =                selinux_socket_accept,
5384         .socket_sendmsg =               selinux_socket_sendmsg,
5385         .socket_recvmsg =               selinux_socket_recvmsg,
5386         .socket_getsockname =           selinux_socket_getsockname,
5387         .socket_getpeername =           selinux_socket_getpeername,
5388         .socket_getsockopt =            selinux_socket_getsockopt,
5389         .socket_setsockopt =            selinux_socket_setsockopt,
5390         .socket_shutdown =              selinux_socket_shutdown,
5391         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5392         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5393         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5394         .sk_alloc_security =            selinux_sk_alloc_security,
5395         .sk_free_security =             selinux_sk_free_security,
5396         .sk_clone_security =            selinux_sk_clone_security,
5397         .sk_getsecid =                  selinux_sk_getsecid,
5398         .sock_graft =                   selinux_sock_graft,
5399         .inet_conn_request =            selinux_inet_conn_request,
5400         .inet_csk_clone =               selinux_inet_csk_clone,
5401         .inet_conn_established =        selinux_inet_conn_established,
5402         .req_classify_flow =            selinux_req_classify_flow,
5403
5404 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5405         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5406         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5407         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5408         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5409         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5410         .xfrm_state_free_security =     selinux_xfrm_state_free,
5411         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5412         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5413         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5414         .xfrm_decode_session =          selinux_xfrm_decode_session,
5415 #endif
5416
5417 #ifdef CONFIG_KEYS
5418         .key_alloc =                    selinux_key_alloc,
5419         .key_free =                     selinux_key_free,
5420         .key_permission =               selinux_key_permission,
5421 #endif
5422 };
5423
5424 static __init int selinux_init(void)
5425 {
5426         struct task_security_struct *tsec;
5427
5428         if (!selinux_enabled) {
5429                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5430                 return 0;
5431         }
5432
5433         printk(KERN_INFO "SELinux:  Initializing.\n");
5434
5435         /* Set the security state for the initial task. */
5436         if (task_alloc_security(current))
5437                 panic("SELinux:  Failed to initialize initial task.\n");
5438         tsec = current->security;
5439         tsec->osid = tsec->sid = SECINITSID_KERNEL;
5440
5441         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5442                                             sizeof(struct inode_security_struct),
5443                                             0, SLAB_PANIC, NULL);
5444         avc_init();
5445
5446         original_ops = secondary_ops = security_ops;
5447         if (!secondary_ops)
5448                 panic ("SELinux: No initial security operations\n");
5449         if (register_security (&selinux_ops))
5450                 panic("SELinux: Unable to register with kernel.\n");
5451
5452         if (selinux_enforcing) {
5453                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5454         } else {
5455                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5456         }
5457
5458 #ifdef CONFIG_KEYS
5459         /* Add security information to initial keyrings */
5460         selinux_key_alloc(&root_user_keyring, current,
5461                           KEY_ALLOC_NOT_IN_QUOTA);
5462         selinux_key_alloc(&root_session_keyring, current,
5463                           KEY_ALLOC_NOT_IN_QUOTA);
5464 #endif
5465
5466         return 0;
5467 }
5468
5469 void selinux_complete_init(void)
5470 {
5471         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5472
5473         /* Set up any superblocks initialized prior to the policy load. */
5474         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5475         spin_lock(&sb_lock);
5476         spin_lock(&sb_security_lock);
5477 next_sb:
5478         if (!list_empty(&superblock_security_head)) {
5479                 struct superblock_security_struct *sbsec =
5480                                 list_entry(superblock_security_head.next,
5481                                            struct superblock_security_struct,
5482                                            list);
5483                 struct super_block *sb = sbsec->sb;
5484                 sb->s_count++;
5485                 spin_unlock(&sb_security_lock);
5486                 spin_unlock(&sb_lock);
5487                 down_read(&sb->s_umount);
5488                 if (sb->s_root)
5489                         superblock_doinit(sb, NULL);
5490                 drop_super(sb);
5491                 spin_lock(&sb_lock);
5492                 spin_lock(&sb_security_lock);
5493                 list_del_init(&sbsec->list);
5494                 goto next_sb;
5495         }
5496         spin_unlock(&sb_security_lock);
5497         spin_unlock(&sb_lock);
5498 }
5499
5500 /* SELinux requires early initialization in order to label
5501    all processes and objects when they are created. */
5502 security_initcall(selinux_init);
5503
5504 #if defined(CONFIG_NETFILTER)
5505
5506 static struct nf_hook_ops selinux_ipv4_ops[] = {
5507         {
5508                 .hook =         selinux_ipv4_postroute,
5509                 .owner =        THIS_MODULE,
5510                 .pf =           PF_INET,
5511                 .hooknum =      NF_INET_POST_ROUTING,
5512                 .priority =     NF_IP_PRI_SELINUX_LAST,
5513         },
5514         {
5515                 .hook =         selinux_ipv4_forward,
5516                 .owner =        THIS_MODULE,
5517                 .pf =           PF_INET,
5518                 .hooknum =      NF_INET_FORWARD,
5519                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5520         }
5521 };
5522
5523 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5524
5525 static struct nf_hook_ops selinux_ipv6_ops[] = {
5526         {
5527                 .hook =         selinux_ipv6_postroute,
5528                 .owner =        THIS_MODULE,
5529                 .pf =           PF_INET6,
5530                 .hooknum =      NF_INET_POST_ROUTING,
5531                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5532         },
5533         {
5534                 .hook =         selinux_ipv6_forward,
5535                 .owner =        THIS_MODULE,
5536                 .pf =           PF_INET6,
5537                 .hooknum =      NF_INET_FORWARD,
5538                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5539         }
5540 };
5541
5542 #endif  /* IPV6 */
5543
5544 static int __init selinux_nf_ip_init(void)
5545 {
5546         int err = 0;
5547         u32 iter;
5548
5549         if (!selinux_enabled)
5550                 goto out;
5551
5552         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5553
5554         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++) {
5555                 err = nf_register_hook(&selinux_ipv4_ops[iter]);
5556                 if (err)
5557                         panic("SELinux: nf_register_hook for IPv4: error %d\n",
5558                               err);
5559         }
5560
5561 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5562         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++) {
5563                 err = nf_register_hook(&selinux_ipv6_ops[iter]);
5564                 if (err)
5565                         panic("SELinux: nf_register_hook for IPv6: error %d\n",
5566                               err);
5567         }
5568 #endif  /* IPV6 */
5569
5570 out:
5571         return err;
5572 }
5573
5574 __initcall(selinux_nf_ip_init);
5575
5576 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5577 static void selinux_nf_ip_exit(void)
5578 {
5579         u32 iter;
5580
5581         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5582
5583         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv4_ops); iter++)
5584                 nf_unregister_hook(&selinux_ipv4_ops[iter]);
5585 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5586         for (iter = 0; iter < ARRAY_SIZE(selinux_ipv6_ops); iter++)
5587                 nf_unregister_hook(&selinux_ipv6_ops[iter]);
5588 #endif  /* IPV6 */
5589 }
5590 #endif
5591
5592 #else /* CONFIG_NETFILTER */
5593
5594 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5595 #define selinux_nf_ip_exit()
5596 #endif
5597
5598 #endif /* CONFIG_NETFILTER */
5599
5600 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5601 int selinux_disable(void)
5602 {
5603         extern void exit_sel_fs(void);
5604         static int selinux_disabled = 0;
5605
5606         if (ss_initialized) {
5607                 /* Not permitted after initial policy load. */
5608                 return -EINVAL;
5609         }
5610
5611         if (selinux_disabled) {
5612                 /* Only do this once. */
5613                 return -EINVAL;
5614         }
5615
5616         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5617
5618         selinux_disabled = 1;
5619         selinux_enabled = 0;
5620
5621         /* Reset security_ops to the secondary module, dummy or capability. */
5622         security_ops = secondary_ops;
5623
5624         /* Unregister netfilter hooks. */
5625         selinux_nf_ip_exit();
5626
5627         /* Unregister selinuxfs. */
5628         exit_sel_fs();
5629
5630         return 0;
5631 }
5632 #endif
5633
5634