security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 /* Special handling. Genfs but also in-core setxattr handler */
 407                 !strcmp(sb->s_type->name, "sysfs") ||
 408                 !strcmp(sb->s_type->name, "pstore") ||
 409                 !strcmp(sb->s_type->name, "debugfs") ||
 410                 !strcmp(sb->s_type->name, "rootfs");
 411 }
 412
 413 static int sb_finish_set_opts(struct super_block *sb)
 414 {
 415         struct superblock_security_struct *sbsec = sb->s_security;
 416         struct dentry *root = sb->s_root;
 417         struct inode *root_inode = d_backing_inode(root);
 418         int rc = 0;
 419
 420         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 421                 /* Make sure that the xattr handler exists and that no
 422                    error other than -ENODATA is returned by getxattr on
 423                    the root directory.  -ENODATA is ok, as this may be
 424                    the first boot of the SELinux kernel before we have
 425                    assigned xattr values to the filesystem. */
 426                 if (!root_inode->i_op->getxattr) {
 427                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 428                                "xattr support\n", sb->s_id, sb->s_type->name);
 429                         rc = -EOPNOTSUPP;
 430                         goto out;
 431                 }
 432                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 433                 if (rc < 0 && rc != -ENODATA) {
 434                         if (rc == -EOPNOTSUPP)
 435                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 436                                        "%s) has no security xattr handler\n",
 437                                        sb->s_id, sb->s_type->name);
 438                         else
 439                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 440                                        "%s) getxattr errno %d\n", sb->s_id,
 441                                        sb->s_type->name, -rc);
 442                         goto out;
 443                 }
 444         }
 445
 446         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 447                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 448                        sb->s_id, sb->s_type->name);
 449
 450         sbsec->flags |= SE_SBINITIALIZED;
 451         if (selinux_is_sblabel_mnt(sb))
 452                 sbsec->flags |= SBLABEL_MNT;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 list_del_init(&isec->list);
 469                 spin_unlock(&sbsec->isec_lock);
 470                 inode = igrab(inode);
 471                 if (inode) {
 472                         if (!IS_PRIVATE(inode))
 473                                 inode_doinit(inode);
 474                         iput(inode);
 475                 }
 476                 spin_lock(&sbsec->isec_lock);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         /* make sure we always check enough bits to cover the mask */
 507         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 508
 509         tmp = sbsec->flags & SE_MNTMASK;
 510         /* count the number of mount options for this sb */
 511         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 512                 if (tmp & 0x01)
 513                         opts->num_mnt_opts++;
 514                 tmp >>= 1;
 515         }
 516         /* Check if the Label support flag is set */
 517         if (sbsec->flags & SBLABEL_MNT)
 518                 opts->num_mnt_opts++;
 519
 520         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 521         if (!opts->mnt_opts) {
 522                 rc = -ENOMEM;
 523                 goto out_free;
 524         }
 525
 526         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 527         if (!opts->mnt_opts_flags) {
 528                 rc = -ENOMEM;
 529                 goto out_free;
 530         }
 531
 532         i = 0;
 533         if (sbsec->flags & FSCONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 539         }
 540         if (sbsec->flags & CONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 546         }
 547         if (sbsec->flags & DEFCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & ROOTCONTEXT_MNT) {
 555                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 556                 struct inode_security_struct *isec = root->i_security;
 557
 558                 rc = security_sid_to_context(isec->sid, &context, &len);
 559                 if (rc)
 560                         goto out_free;
 561                 opts->mnt_opts[i] = context;
 562                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 563         }
 564         if (sbsec->flags & SBLABEL_MNT) {
 565                 opts->mnt_opts[i] = NULL;
 566                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 567         }
 568
 569         BUG_ON(i != opts->num_mnt_opts);
 570
 571         return 0;
 572
 573 out_free:
 574         security_free_mnt_opts(opts);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 struct security_mnt_opts *opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         int rc = 0, i;
 609         struct superblock_security_struct *sbsec = sb->s_security;
 610         const char *name = sb->s_type->name;
 611         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 612         struct inode_security_struct *root_isec = inode->i_security;
 613         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 614         u32 defcontext_sid = 0;
 615         char **mount_options = opts->mnt_opts;
 616         int *flags = opts->mnt_opts_flags;
 617         int num_opts = opts->num_mnt_opts;
 618
 619         mutex_lock(&sbsec->lock);
 620
 621         if (!ss_initialized) {
 622                 if (!num_opts) {
 623                         /* Defer initialization until selinux_complete_init,
 624                            after the initial policy is loaded and the security
 625                            server is ready to handle calls. */
 626                         goto out;
 627                 }
 628                 rc = -EINVAL;
 629                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 630                         "before the security server is initialized\n");
 631                 goto out;
 632         }
 633         if (kern_flags && !set_kern_flags) {
 634                 /* Specifying internal flags without providing a place to
 635                  * place the results is not allowed */
 636                 rc = -EINVAL;
 637                 goto out;
 638         }
 639
 640         /*
 641          * Binary mount data FS will come through this function twice.  Once
 642          * from an explicit call and once from the generic calls from the vfs.
 643          * Since the generic VFS calls will not contain any security mount data
 644          * we need to skip the double mount verification.
 645          *
 646          * This does open a hole in which we will not notice if the first
 647          * mount using this sb set explict options and a second mount using
 648          * this sb does not set any security options.  (The first options
 649          * will be used for both mounts)
 650          */
 651         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 652             && (num_opts == 0))
 653                 goto out;
 654
 655         /*
 656          * parse the mount options, check if they are valid sids.
 657          * also check if someone is trying to mount the same sb more
 658          * than once with different security options.
 659          */
 660         for (i = 0; i < num_opts; i++) {
 661                 u32 sid;
 662
 663                 if (flags[i] == SBLABEL_MNT)
 664                         continue;
 665                 rc = security_context_to_sid(mount_options[i],
 666                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 667                 if (rc) {
 668                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 669                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 670                                mount_options[i], sb->s_id, name, rc);
 671                         goto out;
 672                 }
 673                 switch (flags[i]) {
 674                 case FSCONTEXT_MNT:
 675                         fscontext_sid = sid;
 676
 677                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 678                                         fscontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= FSCONTEXT_MNT;
 682                         break;
 683                 case CONTEXT_MNT:
 684                         context_sid = sid;
 685
 686                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 687                                         context_sid))
 688                                 goto out_double_mount;
 689
 690                         sbsec->flags |= CONTEXT_MNT;
 691                         break;
 692                 case ROOTCONTEXT_MNT:
 693                         rootcontext_sid = sid;
 694
 695                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 696                                         rootcontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= ROOTCONTEXT_MNT;
 700
 701                         break;
 702                 case DEFCONTEXT_MNT:
 703                         defcontext_sid = sid;
 704
 705                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 706                                         defcontext_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= DEFCONTEXT_MNT;
 710
 711                         break;
 712                 default:
 713                         rc = -EINVAL;
 714                         goto out;
 715                 }
 716         }
 717
 718         if (sbsec->flags & SE_SBINITIALIZED) {
 719                 /* previously mounted with options, but not on this attempt? */
 720                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 721                         goto out_double_mount;
 722                 rc = 0;
 723                 goto out;
 724         }
 725
 726         if (strcmp(sb->s_type->name, "proc") == 0)
 727                 sbsec->flags |= SE_SBPROC;
 728
 729         if (!sbsec->behavior) {
 730                 /*
 731                  * Determine the labeling behavior to use for this
 732                  * filesystem type.
 733                  */
 734                 rc = security_fs_use(sb);
 735                 if (rc) {
 736                         printk(KERN_WARNING
 737                                 "%s: security_fs_use(%s) returned %d\n",
 738                                         __func__, sb->s_type->name, rc);
 739                         goto out;
 740                 }
 741         }
 742         /* sets the context of the superblock for the fs being mounted. */
 743         if (fscontext_sid) {
 744                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 745                 if (rc)
 746                         goto out;
 747
 748                 sbsec->sid = fscontext_sid;
 749         }
 750
 751         /*
 752          * Switch to using mount point labeling behavior.
 753          * sets the label used on all file below the mountpoint, and will set
 754          * the superblock context if not already set.
 755          */
 756         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 757                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 758                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 759         }
 760
 761         if (context_sid) {
 762                 if (!fscontext_sid) {
 763                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 764                                                           cred);
 765                         if (rc)
 766                                 goto out;
 767                         sbsec->sid = context_sid;
 768                 } else {
 769                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 770                                                              cred);
 771                         if (rc)
 772                                 goto out;
 773                 }
 774                 if (!rootcontext_sid)
 775                         rootcontext_sid = context_sid;
 776
 777                 sbsec->mntpoint_sid = context_sid;
 778                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 779         }
 780
 781         if (rootcontext_sid) {
 782                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 783                                                      cred);
 784                 if (rc)
 785                         goto out;
 786
 787                 root_isec->sid = rootcontext_sid;
 788                 root_isec->initialized = 1;
 789         }
 790
 791         if (defcontext_sid) {
 792                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 793                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 794                         rc = -EINVAL;
 795                         printk(KERN_WARNING "SELinux: defcontext option is "
 796                                "invalid for this filesystem type\n");
 797                         goto out;
 798                 }
 799
 800                 if (defcontext_sid != sbsec->def_sid) {
 801                         rc = may_context_mount_inode_relabel(defcontext_sid,
 802                                                              sbsec, cred);
 803                         if (rc)
 804                                 goto out;
 805                 }
 806
 807                 sbsec->def_sid = defcontext_sid;
 808         }
 809
 810         rc = sb_finish_set_opts(sb);
 811 out:
 812         mutex_unlock(&sbsec->lock);
 813         return rc;
 814 out_double_mount:
 815         rc = -EINVAL;
 816         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 817                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 818         goto out;
 819 }
 820
 821 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 822                                     const struct super_block *newsb)
 823 {
 824         struct superblock_security_struct *old = oldsb->s_security;
 825         struct superblock_security_struct *new = newsb->s_security;
 826         char oldflags = old->flags & SE_MNTMASK;
 827         char newflags = new->flags & SE_MNTMASK;
 828
 829         if (oldflags != newflags)
 830                 goto mismatch;
 831         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 832                 goto mismatch;
 833         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 834                 goto mismatch;
 835         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 836                 goto mismatch;
 837         if (oldflags & ROOTCONTEXT_MNT) {
 838                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 839                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 840                 if (oldroot->sid != newroot->sid)
 841                         goto mismatch;
 842         }
 843         return 0;
 844 mismatch:
 845         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 846                             "different security settings for (dev %s, "
 847                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 848         return -EBUSY;
 849 }
 850
 851 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 852                                         struct super_block *newsb)
 853 {
 854         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 855         struct superblock_security_struct *newsbsec = newsb->s_security;
 856
 857         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 858         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 859         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 860
 861         /*
 862          * if the parent was able to be mounted it clearly had no special lsm
 863          * mount options.  thus we can safely deal with this superblock later
 864          */
 865         if (!ss_initialized)
 866                 return 0;
 867
 868         /* how can we clone if the old one wasn't set up?? */
 869         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 870
 871         /* if fs is reusing a sb, make sure that the contexts match */
 872         if (newsbsec->flags & SE_SBINITIALIZED)
 873                 return selinux_cmp_sb_context(oldsb, newsb);
 874
 875         mutex_lock(&newsbsec->lock);
 876
 877         newsbsec->flags = oldsbsec->flags;
 878
 879         newsbsec->sid = oldsbsec->sid;
 880         newsbsec->def_sid = oldsbsec->def_sid;
 881         newsbsec->behavior = oldsbsec->behavior;
 882
 883         if (set_context) {
 884                 u32 sid = oldsbsec->mntpoint_sid;
 885
 886                 if (!set_fscontext)
 887                         newsbsec->sid = sid;
 888                 if (!set_rootcontext) {
 889                         struct inode *newinode = d_backing_inode(newsb->s_root);
 890                         struct inode_security_struct *newisec = newinode->i_security;
 891                         newisec->sid = sid;
 892                 }
 893                 newsbsec->mntpoint_sid = sid;
 894         }
 895         if (set_rootcontext) {
 896                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 897                 const struct inode_security_struct *oldisec = oldinode->i_security;
 898                 struct inode *newinode = d_backing_inode(newsb->s_root);
 899                 struct inode_security_struct *newisec = newinode->i_security;
 900
 901                 newisec->sid = oldisec->sid;
 902         }
 903
 904         sb_finish_set_opts(newsb);
 905         mutex_unlock(&newsbsec->lock);
 906         return 0;
 907 }
 908
 909 static int selinux_parse_opts_str(char *options,
 910                                   struct security_mnt_opts *opts)
 911 {
 912         char *p;
 913         char *context = NULL, *defcontext = NULL;
 914         char *fscontext = NULL, *rootcontext = NULL;
 915         int rc, num_mnt_opts = 0;
 916
 917         opts->num_mnt_opts = 0;
 918
 919         /* Standard string-based options. */
 920         while ((p = strsep(&options, "|")) != NULL) {
 921                 int token;
 922                 substring_t args[MAX_OPT_ARGS];
 923
 924                 if (!*p)
 925                         continue;
 926
 927                 token = match_token(p, tokens, args);
 928
 929                 switch (token) {
 930                 case Opt_context:
 931                         if (context || defcontext) {
 932                                 rc = -EINVAL;
 933                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 934                                 goto out_err;
 935                         }
 936                         context = match_strdup(&args[0]);
 937                         if (!context) {
 938                                 rc = -ENOMEM;
 939                                 goto out_err;
 940                         }
 941                         break;
 942
 943                 case Opt_fscontext:
 944                         if (fscontext) {
 945                                 rc = -EINVAL;
 946                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 947                                 goto out_err;
 948                         }
 949                         fscontext = match_strdup(&args[0]);
 950                         if (!fscontext) {
 951                                 rc = -ENOMEM;
 952                                 goto out_err;
 953                         }
 954                         break;
 955
 956                 case Opt_rootcontext:
 957                         if (rootcontext) {
 958                                 rc = -EINVAL;
 959                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 960                                 goto out_err;
 961                         }
 962                         rootcontext = match_strdup(&args[0]);
 963                         if (!rootcontext) {
 964                                 rc = -ENOMEM;
 965                                 goto out_err;
 966                         }
 967                         break;
 968
 969                 case Opt_defcontext:
 970                         if (context || defcontext) {
 971                                 rc = -EINVAL;
 972                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 973                                 goto out_err;
 974                         }
 975                         defcontext = match_strdup(&args[0]);
 976                         if (!defcontext) {
 977                                 rc = -ENOMEM;
 978                                 goto out_err;
 979                         }
 980                         break;
 981                 case Opt_labelsupport:
 982                         break;
 983                 default:
 984                         rc = -EINVAL;
 985                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 986                         goto out_err;
 987
 988                 }
 989         }
 990
 991         rc = -ENOMEM;
 992         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 993         if (!opts->mnt_opts)
 994                 goto out_err;
 995
 996         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 997         if (!opts->mnt_opts_flags) {
 998                 kfree(opts->mnt_opts);
 999                 goto out_err;
1000         }
1001
1002         if (fscontext) {
1003                 opts->mnt_opts[num_mnt_opts] = fscontext;
1004                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1005         }
1006         if (context) {
1007                 opts->mnt_opts[num_mnt_opts] = context;
1008                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1009         }
1010         if (rootcontext) {
1011                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1012                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1013         }
1014         if (defcontext) {
1015                 opts->mnt_opts[num_mnt_opts] = defcontext;
1016                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1017         }
1018
1019         opts->num_mnt_opts = num_mnt_opts;
1020         return 0;
1021
1022 out_err:
1023         kfree(context);
1024         kfree(defcontext);
1025         kfree(fscontext);
1026         kfree(rootcontext);
1027         return rc;
1028 }
1029 /*
1030  * string mount options parsing and call set the sbsec
1031  */
1032 static int superblock_doinit(struct super_block *sb, void *data)
1033 {
1034         int rc = 0;
1035         char *options = data;
1036         struct security_mnt_opts opts;
1037
1038         security_init_mnt_opts(&opts);
1039
1040         if (!data)
1041                 goto out;
1042
1043         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1044
1045         rc = selinux_parse_opts_str(options, &opts);
1046         if (rc)
1047                 goto out_err;
1048
1049 out:
1050         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1051
1052 out_err:
1053         security_free_mnt_opts(&opts);
1054         return rc;
1055 }
1056
1057 static void selinux_write_opts(struct seq_file *m,
1058                                struct security_mnt_opts *opts)
1059 {
1060         int i;
1061         char *prefix;
1062
1063         for (i = 0; i < opts->num_mnt_opts; i++) {
1064                 char *has_comma;
1065
1066                 if (opts->mnt_opts[i])
1067                         has_comma = strchr(opts->mnt_opts[i], ',');
1068                 else
1069                         has_comma = NULL;
1070
1071                 switch (opts->mnt_opts_flags[i]) {
1072                 case CONTEXT_MNT:
1073                         prefix = CONTEXT_STR;
1074                         break;
1075                 case FSCONTEXT_MNT:
1076                         prefix = FSCONTEXT_STR;
1077                         break;
1078                 case ROOTCONTEXT_MNT:
1079                         prefix = ROOTCONTEXT_STR;
1080                         break;
1081                 case DEFCONTEXT_MNT:
1082                         prefix = DEFCONTEXT_STR;
1083                         break;
1084                 case SBLABEL_MNT:
1085                         seq_putc(m, ',');
1086                         seq_puts(m, LABELSUPP_STR);
1087                         continue;
1088                 default:
1089                         BUG();
1090                         return;
1091                 };
1092                 /* we need a comma before each option */
1093                 seq_putc(m, ',');
1094                 seq_puts(m, prefix);
1095                 if (has_comma)
1096                         seq_putc(m, '\"');
1097                 seq_puts(m, opts->mnt_opts[i]);
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100         }
1101 }
1102
1103 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1104 {
1105         struct security_mnt_opts opts;
1106         int rc;
1107
1108         rc = selinux_get_mnt_opts(sb, &opts);
1109         if (rc) {
1110                 /* before policy load we may get EINVAL, don't show anything */
1111                 if (rc == -EINVAL)
1112                         rc = 0;
1113                 return rc;
1114         }
1115
1116         selinux_write_opts(m, &opts);
1117
1118         security_free_mnt_opts(&opts);
1119
1120         return rc;
1121 }
1122
1123 static inline u16 inode_mode_to_security_class(umode_t mode)
1124 {
1125         switch (mode & S_IFMT) {
1126         case S_IFSOCK:
1127                 return SECCLASS_SOCK_FILE;
1128         case S_IFLNK:
1129                 return SECCLASS_LNK_FILE;
1130         case S_IFREG:
1131                 return SECCLASS_FILE;
1132         case S_IFBLK:
1133                 return SECCLASS_BLK_FILE;
1134         case S_IFDIR:
1135                 return SECCLASS_DIR;
1136         case S_IFCHR:
1137                 return SECCLASS_CHR_FILE;
1138         case S_IFIFO:
1139                 return SECCLASS_FIFO_FILE;
1140
1141         }
1142
1143         return SECCLASS_FILE;
1144 }
1145
1146 static inline int default_protocol_stream(int protocol)
1147 {
1148         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1149 }
1150
1151 static inline int default_protocol_dgram(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1154 }
1155
1156 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 {
1158         switch (family) {
1159         case PF_UNIX:
1160                 switch (type) {
1161                 case SOCK_STREAM:
1162                 case SOCK_SEQPACKET:
1163                         return SECCLASS_UNIX_STREAM_SOCKET;
1164                 case SOCK_DGRAM:
1165                         return SECCLASS_UNIX_DGRAM_SOCKET;
1166                 }
1167                 break;
1168         case PF_INET:
1169         case PF_INET6:
1170                 switch (type) {
1171                 case SOCK_STREAM:
1172                         if (default_protocol_stream(protocol))
1173                                 return SECCLASS_TCP_SOCKET;
1174                         else
1175                                 return SECCLASS_RAWIP_SOCKET;
1176                 case SOCK_DGRAM:
1177                         if (default_protocol_dgram(protocol))
1178                                 return SECCLASS_UDP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DCCP:
1182                         return SECCLASS_DCCP_SOCKET;
1183                 default:
1184                         return SECCLASS_RAWIP_SOCKET;
1185                 }
1186                 break;
1187         case PF_NETLINK:
1188                 switch (protocol) {
1189                 case NETLINK_ROUTE:
1190                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1191                 case NETLINK_FIREWALL:
1192                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1193                 case NETLINK_SOCK_DIAG:
1194                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1195                 case NETLINK_NFLOG:
1196                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1197                 case NETLINK_XFRM:
1198                         return SECCLASS_NETLINK_XFRM_SOCKET;
1199                 case NETLINK_SELINUX:
1200                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1201                 case NETLINK_AUDIT:
1202                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1203                 case NETLINK_IP6_FW:
1204                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1205                 case NETLINK_DNRTMSG:
1206                         return SECCLASS_NETLINK_DNRT_SOCKET;
1207                 case NETLINK_KOBJECT_UEVENT:
1208                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1209                 default:
1210                         return SECCLASS_NETLINK_SOCKET;
1211                 }
1212         case PF_PACKET:
1213                 return SECCLASS_PACKET_SOCKET;
1214         case PF_KEY:
1215                 return SECCLASS_KEY_SOCKET;
1216         case PF_APPLETALK:
1217                 return SECCLASS_APPLETALK_SOCKET;
1218         }
1219
1220         return SECCLASS_SOCKET;
1221 }
1222
1223 #ifdef CONFIG_PROC_FS
1224 static int selinux_proc_get_sid(struct dentry *dentry,
1225                                 u16 tclass,
1226                                 u32 *sid)
1227 {
1228         int rc;
1229         char *buffer, *path;
1230
1231         buffer = (char *)__get_free_page(GFP_KERNEL);
1232         if (!buffer)
1233                 return -ENOMEM;
1234
1235         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1236         if (IS_ERR(path))
1237                 rc = PTR_ERR(path);
1238         else {
1239                 /* each process gets a /proc/PID/ entry. Strip off the
1240                  * PID part to get a valid selinux labeling.
1241                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1242                 while (path[1] >= '0' && path[1] <= '9') {
1243                         path[1] = '/';
1244                         path++;
1245                 }
1246                 rc = security_genfs_sid("proc", path, tclass, sid);
1247         }
1248         free_page((unsigned long)buffer);
1249         return rc;
1250 }
1251 #else
1252 static int selinux_proc_get_sid(struct dentry *dentry,
1253                                 u16 tclass,
1254                                 u32 *sid)
1255 {
1256         return -EINVAL;
1257 }
1258 #endif
1259
1260 /* The inode's security attributes must be initialized before first use. */
1261 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1262 {
1263         struct superblock_security_struct *sbsec = NULL;
1264         struct inode_security_struct *isec = inode->i_security;
1265         u32 sid;
1266         struct dentry *dentry;
1267 #define INITCONTEXTLEN 255
1268         char *context = NULL;
1269         unsigned len = 0;
1270         int rc = 0;
1271
1272         if (isec->initialized)
1273                 goto out;
1274
1275         mutex_lock(&isec->lock);
1276         if (isec->initialized)
1277                 goto out_unlock;
1278
1279         sbsec = inode->i_sb->s_security;
1280         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1281                 /* Defer initialization until selinux_complete_init,
1282                    after the initial policy is loaded and the security
1283                    server is ready to handle calls. */
1284                 spin_lock(&sbsec->isec_lock);
1285                 if (list_empty(&isec->list))
1286                         list_add(&isec->list, &sbsec->isec_head);
1287                 spin_unlock(&sbsec->isec_lock);
1288                 goto out_unlock;
1289         }
1290
1291         switch (sbsec->behavior) {
1292         case SECURITY_FS_USE_NATIVE:
1293                 break;
1294         case SECURITY_FS_USE_XATTR:
1295                 if (!inode->i_op->getxattr) {
1296                         isec->sid = sbsec->def_sid;
1297                         break;
1298                 }
1299
1300                 /* Need a dentry, since the xattr API requires one.
1301                    Life would be simpler if we could just pass the inode. */
1302                 if (opt_dentry) {
1303                         /* Called from d_instantiate or d_splice_alias. */
1304                         dentry = dget(opt_dentry);
1305                 } else {
1306                         /* Called from selinux_complete_init, try to find a dentry. */
1307                         dentry = d_find_alias(inode);
1308                 }
1309                 if (!dentry) {
1310                         /*
1311                          * this is can be hit on boot when a file is accessed
1312                          * before the policy is loaded.  When we load policy we
1313                          * may find inodes that have no dentry on the
1314                          * sbsec->isec_head list.  No reason to complain as these
1315                          * will get fixed up the next time we go through
1316                          * inode_doinit with a dentry, before these inodes could
1317                          * be used again by userspace.
1318                          */
1319                         goto out_unlock;
1320                 }
1321
1322                 len = INITCONTEXTLEN;
1323                 context = kmalloc(len+1, GFP_NOFS);
1324                 if (!context) {
1325                         rc = -ENOMEM;
1326                         dput(dentry);
1327                         goto out_unlock;
1328                 }
1329                 context[len] = '\0';
1330                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1331                                            context, len);
1332                 if (rc == -ERANGE) {
1333                         kfree(context);
1334
1335                         /* Need a larger buffer.  Query for the right size. */
1336                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1337                                                    NULL, 0);
1338                         if (rc < 0) {
1339                                 dput(dentry);
1340                                 goto out_unlock;
1341                         }
1342                         len = rc;
1343                         context = kmalloc(len+1, GFP_NOFS);
1344                         if (!context) {
1345                                 rc = -ENOMEM;
1346                                 dput(dentry);
1347                                 goto out_unlock;
1348                         }
1349                         context[len] = '\0';
1350                         rc = inode->i_op->getxattr(dentry,
1351                                                    XATTR_NAME_SELINUX,
1352                                                    context, len);
1353                 }
1354                 dput(dentry);
1355                 if (rc < 0) {
1356                         if (rc != -ENODATA) {
1357                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1358                                        "%d for dev=%s ino=%ld\n", __func__,
1359                                        -rc, inode->i_sb->s_id, inode->i_ino);
1360                                 kfree(context);
1361                                 goto out_unlock;
1362                         }
1363                         /* Map ENODATA to the default file SID */
1364                         sid = sbsec->def_sid;
1365                         rc = 0;
1366                 } else {
1367                         rc = security_context_to_sid_default(context, rc, &sid,
1368                                                              sbsec->def_sid,
1369                                                              GFP_NOFS);
1370                         if (rc) {
1371                                 char *dev = inode->i_sb->s_id;
1372                                 unsigned long ino = inode->i_ino;
1373
1374                                 if (rc == -EINVAL) {
1375                                         if (printk_ratelimit())
1376                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1377                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1378                                                         "filesystem in question.\n", ino, dev, context);
1379                                 } else {
1380                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1381                                                "returned %d for dev=%s ino=%ld\n",
1382                                                __func__, context, -rc, dev, ino);
1383                                 }
1384                                 kfree(context);
1385                                 /* Leave with the unlabeled SID */
1386                                 rc = 0;
1387                                 break;
1388                         }
1389                 }
1390                 kfree(context);
1391                 isec->sid = sid;
1392                 break;
1393         case SECURITY_FS_USE_TASK:
1394                 isec->sid = isec->task_sid;
1395                 break;
1396         case SECURITY_FS_USE_TRANS:
1397                 /* Default to the fs SID. */
1398                 isec->sid = sbsec->sid;
1399
1400                 /* Try to obtain a transition SID. */
1401                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1402                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1403                                              isec->sclass, NULL, &sid);
1404                 if (rc)
1405                         goto out_unlock;
1406                 isec->sid = sid;
1407                 break;
1408         case SECURITY_FS_USE_MNTPOINT:
1409                 isec->sid = sbsec->mntpoint_sid;
1410                 break;
1411         default:
1412                 /* Default to the fs superblock SID. */
1413                 isec->sid = sbsec->sid;
1414
1415                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1416                         /* We must have a dentry to determine the label on
1417                          * procfs inodes */
1418                         if (opt_dentry)
1419                                 /* Called from d_instantiate or
1420                                  * d_splice_alias. */
1421                                 dentry = dget(opt_dentry);
1422                         else
1423                                 /* Called from selinux_complete_init, try to
1424                                  * find a dentry. */
1425                                 dentry = d_find_alias(inode);
1426                         /*
1427                          * This can be hit on boot when a file is accessed
1428                          * before the policy is loaded.  When we load policy we
1429                          * may find inodes that have no dentry on the
1430                          * sbsec->isec_head list.  No reason to complain as
1431                          * these will get fixed up the next time we go through
1432                          * inode_doinit() with a dentry, before these inodes
1433                          * could be used again by userspace.
1434                          */
1435                         if (!dentry)
1436                                 goto out_unlock;
1437                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1438                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1439                         dput(dentry);
1440                         if (rc)
1441                                 goto out_unlock;
1442                         isec->sid = sid;
1443                 }
1444                 break;
1445         }
1446
1447         isec->initialized = 1;
1448
1449 out_unlock:
1450         mutex_unlock(&isec->lock);
1451 out:
1452         if (isec->sclass == SECCLASS_FILE)
1453                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1454         return rc;
1455 }
1456
1457 /* Convert a Linux signal to an access vector. */
1458 static inline u32 signal_to_av(int sig)
1459 {
1460         u32 perm = 0;
1461
1462         switch (sig) {
1463         case SIGCHLD:
1464                 /* Commonly granted from child to parent. */
1465                 perm = PROCESS__SIGCHLD;
1466                 break;
1467         case SIGKILL:
1468                 /* Cannot be caught or ignored */
1469                 perm = PROCESS__SIGKILL;
1470                 break;
1471         case SIGSTOP:
1472                 /* Cannot be caught or ignored */
1473                 perm = PROCESS__SIGSTOP;
1474                 break;
1475         default:
1476                 /* All other signals. */
1477                 perm = PROCESS__SIGNAL;
1478                 break;
1479         }
1480
1481         return perm;
1482 }
1483
1484 /*
1485  * Check permission between a pair of credentials
1486  * fork check, ptrace check, etc.
1487  */
1488 static int cred_has_perm(const struct cred *actor,
1489                          const struct cred *target,
1490                          u32 perms)
1491 {
1492         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1493
1494         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1495 }
1496
1497 /*
1498  * Check permission between a pair of tasks, e.g. signal checks,
1499  * fork check, ptrace check, etc.
1500  * tsk1 is the actor and tsk2 is the target
1501  * - this uses the default subjective creds of tsk1
1502  */
1503 static int task_has_perm(const struct task_struct *tsk1,
1504                          const struct task_struct *tsk2,
1505                          u32 perms)
1506 {
1507         const struct task_security_struct *__tsec1, *__tsec2;
1508         u32 sid1, sid2;
1509
1510         rcu_read_lock();
1511         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1512         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1513         rcu_read_unlock();
1514         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1515 }
1516
1517 /*
1518  * Check permission between current and another task, e.g. signal checks,
1519  * fork check, ptrace check, etc.
1520  * current is the actor and tsk2 is the target
1521  * - this uses current's subjective creds
1522  */
1523 static int current_has_perm(const struct task_struct *tsk,
1524                             u32 perms)
1525 {
1526         u32 sid, tsid;
1527
1528         sid = current_sid();
1529         tsid = task_sid(tsk);
1530         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1531 }
1532
1533 #if CAP_LAST_CAP > 63
1534 #error Fix SELinux to handle capabilities > 63.
1535 #endif
1536
1537 /* Check whether a task is allowed to use a capability. */
1538 static int cred_has_capability(const struct cred *cred,
1539                                int cap, int audit)
1540 {
1541         struct common_audit_data ad;
1542         struct av_decision avd;
1543         u16 sclass;
1544         u32 sid = cred_sid(cred);
1545         u32 av = CAP_TO_MASK(cap);
1546         int rc;
1547
1548         ad.type = LSM_AUDIT_DATA_CAP;
1549         ad.u.cap = cap;
1550
1551         switch (CAP_TO_INDEX(cap)) {
1552         case 0:
1553                 sclass = SECCLASS_CAPABILITY;
1554                 break;
1555         case 1:
1556                 sclass = SECCLASS_CAPABILITY2;
1557                 break;
1558         default:
1559                 printk(KERN_ERR
1560                        "SELinux:  out of range capability %d\n", cap);
1561                 BUG();
1562                 return -EINVAL;
1563         }
1564
1565         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1566         if (audit == SECURITY_CAP_AUDIT) {
1567                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1568                 if (rc2)
1569                         return rc2;
1570         }
1571         return rc;
1572 }
1573
1574 /* Check whether a task is allowed to use a system operation. */
1575 static int task_has_system(struct task_struct *tsk,
1576                            u32 perms)
1577 {
1578         u32 sid = task_sid(tsk);
1579
1580         return avc_has_perm(sid, SECINITSID_KERNEL,
1581                             SECCLASS_SYSTEM, perms, NULL);
1582 }
1583
1584 /* Check whether a task has a particular permission to an inode.
1585    The 'adp' parameter is optional and allows other audit
1586    data to be passed (e.g. the dentry). */
1587 static int inode_has_perm(const struct cred *cred,
1588                           struct inode *inode,
1589                           u32 perms,
1590                           struct common_audit_data *adp)
1591 {
1592         struct inode_security_struct *isec;
1593         u32 sid;
1594
1595         validate_creds(cred);
1596
1597         if (unlikely(IS_PRIVATE(inode)))
1598                 return 0;
1599
1600         sid = cred_sid(cred);
1601         isec = inode->i_security;
1602
1603         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1604 }
1605
1606 /* Same as inode_has_perm, but pass explicit audit data containing
1607    the dentry to help the auditing code to more easily generate the
1608    pathname if needed. */
1609 static inline int dentry_has_perm(const struct cred *cred,
1610                                   struct dentry *dentry,
1611                                   u32 av)
1612 {
1613         struct inode *inode = d_backing_inode(dentry);
1614         struct common_audit_data ad;
1615
1616         ad.type = LSM_AUDIT_DATA_DENTRY;
1617         ad.u.dentry = dentry;
1618         return inode_has_perm(cred, inode, av, &ad);
1619 }
1620
1621 /* Same as inode_has_perm, but pass explicit audit data containing
1622    the path to help the auditing code to more easily generate the
1623    pathname if needed. */
1624 static inline int path_has_perm(const struct cred *cred,
1625                                 const struct path *path,
1626                                 u32 av)
1627 {
1628         struct inode *inode = d_backing_inode(path->dentry);
1629         struct common_audit_data ad;
1630
1631         ad.type = LSM_AUDIT_DATA_PATH;
1632         ad.u.path = *path;
1633         return inode_has_perm(cred, inode, av, &ad);
1634 }
1635
1636 /* Same as path_has_perm, but uses the inode from the file struct. */
1637 static inline int file_path_has_perm(const struct cred *cred,
1638                                      struct file *file,
1639                                      u32 av)
1640 {
1641         struct common_audit_data ad;
1642
1643         ad.type = LSM_AUDIT_DATA_PATH;
1644         ad.u.path = file->f_path;
1645         return inode_has_perm(cred, file_inode(file), av, &ad);
1646 }
1647
1648 /* Check whether a task can use an open file descriptor to
1649    access an inode in a given way.  Check access to the
1650    descriptor itself, and then use dentry_has_perm to
1651    check a particular permission to the file.
1652    Access to the descriptor is implicitly granted if it
1653    has the same SID as the process.  If av is zero, then
1654    access to the file is not checked, e.g. for cases
1655    where only the descriptor is affected like seek. */
1656 static int file_has_perm(const struct cred *cred,
1657                          struct file *file,
1658                          u32 av)
1659 {
1660         struct file_security_struct *fsec = file->f_security;
1661         struct inode *inode = file_inode(file);
1662         struct common_audit_data ad;
1663         u32 sid = cred_sid(cred);
1664         int rc;
1665
1666         ad.type = LSM_AUDIT_DATA_PATH;
1667         ad.u.path = file->f_path;
1668
1669         if (sid != fsec->sid) {
1670                 rc = avc_has_perm(sid, fsec->sid,
1671                                   SECCLASS_FD,
1672                                   FD__USE,
1673                                   &ad);
1674                 if (rc)
1675                         goto out;
1676         }
1677
1678         /* av is zero if only checking access to the descriptor. */
1679         rc = 0;
1680         if (av)
1681                 rc = inode_has_perm(cred, inode, av, &ad);
1682
1683 out:
1684         return rc;
1685 }
1686
1687 /* Check whether a task can create a file. */
1688 static int may_create(struct inode *dir,
1689                       struct dentry *dentry,
1690                       u16 tclass)
1691 {
1692         const struct task_security_struct *tsec = current_security();
1693         struct inode_security_struct *dsec;
1694         struct superblock_security_struct *sbsec;
1695         u32 sid, newsid;
1696         struct common_audit_data ad;
1697         int rc;
1698
1699         dsec = dir->i_security;
1700         sbsec = dir->i_sb->s_security;
1701
1702         sid = tsec->sid;
1703         newsid = tsec->create_sid;
1704
1705         ad.type = LSM_AUDIT_DATA_DENTRY;
1706         ad.u.dentry = dentry;
1707
1708         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1709                           DIR__ADD_NAME | DIR__SEARCH,
1710                           &ad);
1711         if (rc)
1712                 return rc;
1713
1714         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1715                 rc = security_transition_sid(sid, dsec->sid, tclass,
1716                                              &dentry->d_name, &newsid);
1717                 if (rc)
1718                         return rc;
1719         }
1720
1721         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1722         if (rc)
1723                 return rc;
1724
1725         return avc_has_perm(newsid, sbsec->sid,
1726                             SECCLASS_FILESYSTEM,
1727                             FILESYSTEM__ASSOCIATE, &ad);
1728 }
1729
1730 /* Check whether a task can create a key. */
1731 static int may_create_key(u32 ksid,
1732                           struct task_struct *ctx)
1733 {
1734         u32 sid = task_sid(ctx);
1735
1736         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1737 }
1738
1739 #define MAY_LINK        0
1740 #define MAY_UNLINK      1
1741 #define MAY_RMDIR       2
1742
1743 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1744 static int may_link(struct inode *dir,
1745                     struct dentry *dentry,
1746                     int kind)
1747
1748 {
1749         struct inode_security_struct *dsec, *isec;
1750         struct common_audit_data ad;
1751         u32 sid = current_sid();
1752         u32 av;
1753         int rc;
1754
1755         dsec = dir->i_security;
1756         isec = d_backing_inode(dentry)->i_security;
1757
1758         ad.type = LSM_AUDIT_DATA_DENTRY;
1759         ad.u.dentry = dentry;
1760
1761         av = DIR__SEARCH;
1762         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1763         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1764         if (rc)
1765                 return rc;
1766
1767         switch (kind) {
1768         case MAY_LINK:
1769                 av = FILE__LINK;
1770                 break;
1771         case MAY_UNLINK:
1772                 av = FILE__UNLINK;
1773                 break;
1774         case MAY_RMDIR:
1775                 av = DIR__RMDIR;
1776                 break;
1777         default:
1778                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1779                         __func__, kind);
1780                 return 0;
1781         }
1782
1783         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1784         return rc;
1785 }
1786
1787 static inline int may_rename(struct inode *old_dir,
1788                              struct dentry *old_dentry,
1789                              struct inode *new_dir,
1790                              struct dentry *new_dentry)
1791 {
1792         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1793         struct common_audit_data ad;
1794         u32 sid = current_sid();
1795         u32 av;
1796         int old_is_dir, new_is_dir;
1797         int rc;
1798
1799         old_dsec = old_dir->i_security;
1800         old_isec = d_backing_inode(old_dentry)->i_security;
1801         old_is_dir = d_is_dir(old_dentry);
1802         new_dsec = new_dir->i_security;
1803
1804         ad.type = LSM_AUDIT_DATA_DENTRY;
1805
1806         ad.u.dentry = old_dentry;
1807         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1808                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1809         if (rc)
1810                 return rc;
1811         rc = avc_has_perm(sid, old_isec->sid,
1812                           old_isec->sclass, FILE__RENAME, &ad);
1813         if (rc)
1814                 return rc;
1815         if (old_is_dir && new_dir != old_dir) {
1816                 rc = avc_has_perm(sid, old_isec->sid,
1817                                   old_isec->sclass, DIR__REPARENT, &ad);
1818                 if (rc)
1819                         return rc;
1820         }
1821
1822         ad.u.dentry = new_dentry;
1823         av = DIR__ADD_NAME | DIR__SEARCH;
1824         if (d_is_positive(new_dentry))
1825                 av |= DIR__REMOVE_NAME;
1826         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1827         if (rc)
1828                 return rc;
1829         if (d_is_positive(new_dentry)) {
1830                 new_isec = d_backing_inode(new_dentry)->i_security;
1831                 new_is_dir = d_is_dir(new_dentry);
1832                 rc = avc_has_perm(sid, new_isec->sid,
1833                                   new_isec->sclass,
1834                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1835                 if (rc)
1836                         return rc;
1837         }
1838
1839         return 0;
1840 }
1841
1842 /* Check whether a task can perform a filesystem operation. */
1843 static int superblock_has_perm(const struct cred *cred,
1844                                struct super_block *sb,
1845                                u32 perms,
1846                                struct common_audit_data *ad)
1847 {
1848         struct superblock_security_struct *sbsec;
1849         u32 sid = cred_sid(cred);
1850
1851         sbsec = sb->s_security;
1852         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1853 }
1854
1855 /* Convert a Linux mode and permission mask to an access vector. */
1856 static inline u32 file_mask_to_av(int mode, int mask)
1857 {
1858         u32 av = 0;
1859
1860         if (!S_ISDIR(mode)) {
1861                 if (mask & MAY_EXEC)
1862                         av |= FILE__EXECUTE;
1863                 if (mask & MAY_READ)
1864                         av |= FILE__READ;
1865
1866                 if (mask & MAY_APPEND)
1867                         av |= FILE__APPEND;
1868                 else if (mask & MAY_WRITE)
1869                         av |= FILE__WRITE;
1870
1871         } else {
1872                 if (mask & MAY_EXEC)
1873                         av |= DIR__SEARCH;
1874                 if (mask & MAY_WRITE)
1875                         av |= DIR__WRITE;
1876                 if (mask & MAY_READ)
1877                         av |= DIR__READ;
1878         }
1879
1880         return av;
1881 }
1882
1883 /* Convert a Linux file to an access vector. */
1884 static inline u32 file_to_av(struct file *file)
1885 {
1886         u32 av = 0;
1887
1888         if (file->f_mode & FMODE_READ)
1889                 av |= FILE__READ;
1890         if (file->f_mode & FMODE_WRITE) {
1891                 if (file->f_flags & O_APPEND)
1892                         av |= FILE__APPEND;
1893                 else
1894                         av |= FILE__WRITE;
1895         }
1896         if (!av) {
1897                 /*
1898                  * Special file opened with flags 3 for ioctl-only use.
1899                  */
1900                 av = FILE__IOCTL;
1901         }
1902
1903         return av;
1904 }
1905
1906 /*
1907  * Convert a file to an access vector and include the correct open
1908  * open permission.
1909  */
1910 static inline u32 open_file_to_av(struct file *file)
1911 {
1912         u32 av = file_to_av(file);
1913
1914         if (selinux_policycap_openperm)
1915                 av |= FILE__OPEN;
1916
1917         return av;
1918 }
1919
1920 /* Hook functions begin here. */
1921
1922 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1923 {
1924         u32 mysid = current_sid();
1925         u32 mgrsid = task_sid(mgr);
1926
1927         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1928                             BINDER__SET_CONTEXT_MGR, NULL);
1929 }
1930
1931 static int selinux_binder_transaction(struct task_struct *from,
1932                                       struct task_struct *to)
1933 {
1934         u32 mysid = current_sid();
1935         u32 fromsid = task_sid(from);
1936         u32 tosid = task_sid(to);
1937         int rc;
1938
1939         if (mysid != fromsid) {
1940                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1941                                   BINDER__IMPERSONATE, NULL);
1942                 if (rc)
1943                         return rc;
1944         }
1945
1946         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1947                             NULL);
1948 }
1949
1950 static int selinux_binder_transfer_binder(struct task_struct *from,
1951                                           struct task_struct *to)
1952 {
1953         u32 fromsid = task_sid(from);
1954         u32 tosid = task_sid(to);
1955
1956         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1957                             NULL);
1958 }
1959
1960 static int selinux_binder_transfer_file(struct task_struct *from,
1961                                         struct task_struct *to,
1962                                         struct file *file)
1963 {
1964         u32 sid = task_sid(to);
1965         struct file_security_struct *fsec = file->f_security;
1966         struct inode *inode = d_backing_inode(file->f_path.dentry);
1967         struct inode_security_struct *isec = inode->i_security;
1968         struct common_audit_data ad;
1969         int rc;
1970
1971         ad.type = LSM_AUDIT_DATA_PATH;
1972         ad.u.path = file->f_path;
1973
1974         if (sid != fsec->sid) {
1975                 rc = avc_has_perm(sid, fsec->sid,
1976                                   SECCLASS_FD,
1977                                   FD__USE,
1978                                   &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         if (unlikely(IS_PRIVATE(inode)))
1984                 return 0;
1985
1986         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1987                             &ad);
1988 }
1989
1990 static int selinux_ptrace_access_check(struct task_struct *child,
1991                                      unsigned int mode)
1992 {
1993         if (mode & PTRACE_MODE_READ) {
1994                 u32 sid = current_sid();
1995                 u32 csid = task_sid(child);
1996                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1997         }
1998
1999         return current_has_perm(child, PROCESS__PTRACE);
2000 }
2001
2002 static int selinux_ptrace_traceme(struct task_struct *parent)
2003 {
2004         return task_has_perm(parent, current, PROCESS__PTRACE);
2005 }
2006
2007 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2008                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2009 {
2010         return current_has_perm(target, PROCESS__GETCAP);
2011 }
2012
2013 static int selinux_capset(struct cred *new, const struct cred *old,
2014                           const kernel_cap_t *effective,
2015                           const kernel_cap_t *inheritable,
2016                           const kernel_cap_t *permitted)
2017 {
2018         return cred_has_perm(old, new, PROCESS__SETCAP);
2019 }
2020
2021 /*
2022  * (This comment used to live with the selinux_task_setuid hook,
2023  * which was removed).
2024  *
2025  * Since setuid only affects the current process, and since the SELinux
2026  * controls are not based on the Linux identity attributes, SELinux does not
2027  * need to control this operation.  However, SELinux does control the use of
2028  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2029  */
2030
2031 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2032                            int cap, int audit)
2033 {
2034         return cred_has_capability(cred, cap, audit);
2035 }
2036
2037 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2038 {
2039         const struct cred *cred = current_cred();
2040         int rc = 0;
2041
2042         if (!sb)
2043                 return 0;
2044
2045         switch (cmds) {
2046         case Q_SYNC:
2047         case Q_QUOTAON:
2048         case Q_QUOTAOFF:
2049         case Q_SETINFO:
2050         case Q_SETQUOTA:
2051                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2052                 break;
2053         case Q_GETFMT:
2054         case Q_GETINFO:
2055         case Q_GETQUOTA:
2056                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2057                 break;
2058         default:
2059                 rc = 0;  /* let the kernel handle invalid cmds */
2060                 break;
2061         }
2062         return rc;
2063 }
2064
2065 static int selinux_quota_on(struct dentry *dentry)
2066 {
2067         const struct cred *cred = current_cred();
2068
2069         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2070 }
2071
2072 static int selinux_syslog(int type)
2073 {
2074         int rc;
2075
2076         switch (type) {
2077         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2078         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2079                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2080                 break;
2081         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2082         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2083         /* Set level of messages printed to console */
2084         case SYSLOG_ACTION_CONSOLE_LEVEL:
2085                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2086                 break;
2087         case SYSLOG_ACTION_CLOSE:       /* Close log */
2088         case SYSLOG_ACTION_OPEN:        /* Open log */
2089         case SYSLOG_ACTION_READ:        /* Read from log */
2090         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2091         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2092         default:
2093                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2094                 break;
2095         }
2096         return rc;
2097 }
2098
2099 /*
2100  * Check that a process has enough memory to allocate a new virtual
2101  * mapping. 0 means there is enough memory for the allocation to
2102  * succeed and -ENOMEM implies there is not.
2103  *
2104  * Do not audit the selinux permission check, as this is applied to all
2105  * processes that allocate mappings.
2106  */
2107 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2108 {
2109         int rc, cap_sys_admin = 0;
2110
2111         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2112                                         SECURITY_CAP_NOAUDIT);
2113         if (rc == 0)
2114                 cap_sys_admin = 1;
2115
2116         return cap_sys_admin;
2117 }
2118
2119 /* binprm security operations */
2120
2121 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2122                             const struct task_security_struct *old_tsec,
2123                             const struct task_security_struct *new_tsec)
2124 {
2125         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2126         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2127         int rc;
2128
2129         if (!nnp && !nosuid)
2130                 return 0; /* neither NNP nor nosuid */
2131
2132         if (new_tsec->sid == old_tsec->sid)
2133                 return 0; /* No change in credentials */
2134
2135         /*
2136          * The only transitions we permit under NNP or nosuid
2137          * are transitions to bounded SIDs, i.e. SIDs that are
2138          * guaranteed to only be allowed a subset of the permissions
2139          * of the current SID.
2140          */
2141         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2142         if (rc) {
2143                 /*
2144                  * On failure, preserve the errno values for NNP vs nosuid.
2145                  * NNP:  Operation not permitted for caller.
2146                  * nosuid:  Permission denied to file.
2147                  */
2148                 if (nnp)
2149                         return -EPERM;
2150                 else
2151                         return -EACCES;
2152         }
2153         return 0;
2154 }
2155
2156 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2157 {
2158         const struct task_security_struct *old_tsec;
2159         struct task_security_struct *new_tsec;
2160         struct inode_security_struct *isec;
2161         struct common_audit_data ad;
2162         struct inode *inode = file_inode(bprm->file);
2163         int rc;
2164
2165         /* SELinux context only depends on initial program or script and not
2166          * the script interpreter */
2167         if (bprm->cred_prepared)
2168                 return 0;
2169
2170         old_tsec = current_security();
2171         new_tsec = bprm->cred->security;
2172         isec = inode->i_security;
2173
2174         /* Default to the current task SID. */
2175         new_tsec->sid = old_tsec->sid;
2176         new_tsec->osid = old_tsec->sid;
2177
2178         /* Reset fs, key, and sock SIDs on execve. */
2179         new_tsec->create_sid = 0;
2180         new_tsec->keycreate_sid = 0;
2181         new_tsec->sockcreate_sid = 0;
2182
2183         if (old_tsec->exec_sid) {
2184                 new_tsec->sid = old_tsec->exec_sid;
2185                 /* Reset exec SID on execve. */
2186                 new_tsec->exec_sid = 0;
2187
2188                 /* Fail on NNP or nosuid if not an allowed transition. */
2189                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2190                 if (rc)
2191                         return rc;
2192         } else {
2193                 /* Check for a default transition on this program. */
2194                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2195                                              SECCLASS_PROCESS, NULL,
2196                                              &new_tsec->sid);
2197                 if (rc)
2198                         return rc;
2199
2200                 /*
2201                  * Fallback to old SID on NNP or nosuid if not an allowed
2202                  * transition.
2203                  */
2204                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2205                 if (rc)
2206                         new_tsec->sid = old_tsec->sid;
2207         }
2208
2209         ad.type = LSM_AUDIT_DATA_PATH;
2210         ad.u.path = bprm->file->f_path;
2211
2212         if (new_tsec->sid == old_tsec->sid) {
2213                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2214                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2215                 if (rc)
2216                         return rc;
2217         } else {
2218                 /* Check permissions for the transition. */
2219                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2220                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2221                 if (rc)
2222                         return rc;
2223
2224                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2225                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2226                 if (rc)
2227                         return rc;
2228
2229                 /* Check for shared state */
2230                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2231                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2232                                           SECCLASS_PROCESS, PROCESS__SHARE,
2233                                           NULL);
2234                         if (rc)
2235                                 return -EPERM;
2236                 }
2237
2238                 /* Make sure that anyone attempting to ptrace over a task that
2239                  * changes its SID has the appropriate permit */
2240                 if (bprm->unsafe &
2241                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2242                         struct task_struct *tracer;
2243                         struct task_security_struct *sec;
2244                         u32 ptsid = 0;
2245
2246                         rcu_read_lock();
2247                         tracer = ptrace_parent(current);
2248                         if (likely(tracer != NULL)) {
2249                                 sec = __task_cred(tracer)->security;
2250                                 ptsid = sec->sid;
2251                         }
2252                         rcu_read_unlock();
2253
2254                         if (ptsid != 0) {
2255                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2256                                                   SECCLASS_PROCESS,
2257                                                   PROCESS__PTRACE, NULL);
2258                                 if (rc)
2259                                         return -EPERM;
2260                         }
2261                 }
2262
2263                 /* Clear any possibly unsafe personality bits on exec: */
2264                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2265         }
2266
2267         return 0;
2268 }
2269
2270 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2271 {
2272         const struct task_security_struct *tsec = current_security();
2273         u32 sid, osid;
2274         int atsecure = 0;
2275
2276         sid = tsec->sid;
2277         osid = tsec->osid;
2278
2279         if (osid != sid) {
2280                 /* Enable secure mode for SIDs transitions unless
2281                    the noatsecure permission is granted between
2282                    the two SIDs, i.e. ahp returns 0. */
2283                 atsecure = avc_has_perm(osid, sid,
2284                                         SECCLASS_PROCESS,
2285                                         PROCESS__NOATSECURE, NULL);
2286         }
2287
2288         return !!atsecure;
2289 }
2290
2291 static int match_file(const void *p, struct file *file, unsigned fd)
2292 {
2293         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2294 }
2295
2296 /* Derived from fs/exec.c:flush_old_files. */
2297 static inline void flush_unauthorized_files(const struct cred *cred,
2298                                             struct files_struct *files)
2299 {
2300         struct file *file, *devnull = NULL;
2301         struct tty_struct *tty;
2302         int drop_tty = 0;
2303         unsigned n;
2304
2305         tty = get_current_tty();
2306         if (tty) {
2307                 spin_lock(&tty_files_lock);
2308                 if (!list_empty(&tty->tty_files)) {
2309                         struct tty_file_private *file_priv;
2310
2311                         /* Revalidate access to controlling tty.
2312                            Use file_path_has_perm on the tty path directly
2313                            rather than using file_has_perm, as this particular
2314                            open file may belong to another process and we are
2315                            only interested in the inode-based check here. */
2316                         file_priv = list_first_entry(&tty->tty_files,
2317                                                 struct tty_file_private, list);
2318                         file = file_priv->file;
2319                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2320                                 drop_tty = 1;
2321                 }
2322                 spin_unlock(&tty_files_lock);
2323                 tty_kref_put(tty);
2324         }
2325         /* Reset controlling tty. */
2326         if (drop_tty)
2327                 no_tty();
2328
2329         /* Revalidate access to inherited open files. */
2330         n = iterate_fd(files, 0, match_file, cred);
2331         if (!n) /* none found? */
2332                 return;
2333
2334         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2335         if (IS_ERR(devnull))
2336                 devnull = NULL;
2337         /* replace all the matching ones with this */
2338         do {
2339                 replace_fd(n - 1, devnull, 0);
2340         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2341         if (devnull)
2342                 fput(devnull);
2343 }
2344
2345 /*
2346  * Prepare a process for imminent new credential changes due to exec
2347  */
2348 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2349 {
2350         struct task_security_struct *new_tsec;
2351         struct rlimit *rlim, *initrlim;
2352         int rc, i;
2353
2354         new_tsec = bprm->cred->security;
2355         if (new_tsec->sid == new_tsec->osid)
2356                 return;
2357
2358         /* Close files for which the new task SID is not authorized. */
2359         flush_unauthorized_files(bprm->cred, current->files);
2360
2361         /* Always clear parent death signal on SID transitions. */
2362         current->pdeath_signal = 0;
2363
2364         /* Check whether the new SID can inherit resource limits from the old
2365          * SID.  If not, reset all soft limits to the lower of the current
2366          * task's hard limit and the init task's soft limit.
2367          *
2368          * Note that the setting of hard limits (even to lower them) can be
2369          * controlled by the setrlimit check.  The inclusion of the init task's
2370          * soft limit into the computation is to avoid resetting soft limits
2371          * higher than the default soft limit for cases where the default is
2372          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2373          */
2374         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2375                           PROCESS__RLIMITINH, NULL);
2376         if (rc) {
2377                 /* protect against do_prlimit() */
2378                 task_lock(current);
2379                 for (i = 0; i < RLIM_NLIMITS; i++) {
2380                         rlim = current->signal->rlim + i;
2381                         initrlim = init_task.signal->rlim + i;
2382                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2383                 }
2384                 task_unlock(current);
2385                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2386         }
2387 }
2388
2389 /*
2390  * Clean up the process immediately after the installation of new credentials
2391  * due to exec
2392  */
2393 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2394 {
2395         const struct task_security_struct *tsec = current_security();
2396         struct itimerval itimer;
2397         u32 osid, sid;
2398         int rc, i;
2399
2400         osid = tsec->osid;
2401         sid = tsec->sid;
2402
2403         if (sid == osid)
2404                 return;
2405
2406         /* Check whether the new SID can inherit signal state from the old SID.
2407          * If not, clear itimers to avoid subsequent signal generation and
2408          * flush and unblock signals.
2409          *
2410          * This must occur _after_ the task SID has been updated so that any
2411          * kill done after the flush will be checked against the new SID.
2412          */
2413         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2414         if (rc) {
2415                 memset(&itimer, 0, sizeof itimer);
2416                 for (i = 0; i < 3; i++)
2417                         do_setitimer(i, &itimer, NULL);
2418                 spin_lock_irq(&current->sighand->siglock);
2419                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2420                         __flush_signals(current);
2421                         flush_signal_handlers(current, 1);
2422                         sigemptyset(&current->blocked);
2423                 }
2424                 spin_unlock_irq(&current->sighand->siglock);
2425         }
2426
2427         /* Wake up the parent if it is waiting so that it can recheck
2428          * wait permission to the new task SID. */
2429         read_lock(&tasklist_lock);
2430         __wake_up_parent(current, current->real_parent);
2431         read_unlock(&tasklist_lock);
2432 }
2433
2434 /* superblock security operations */
2435
2436 static int selinux_sb_alloc_security(struct super_block *sb)
2437 {
2438         return superblock_alloc_security(sb);
2439 }
2440
2441 static void selinux_sb_free_security(struct super_block *sb)
2442 {
2443         superblock_free_security(sb);
2444 }
2445
2446 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2447 {
2448         if (plen > olen)
2449                 return 0;
2450
2451         return !memcmp(prefix, option, plen);
2452 }
2453
2454 static inline int selinux_option(char *option, int len)
2455 {
2456         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2457                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2458                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2459                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2460                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2461 }
2462
2463 static inline void take_option(char **to, char *from, int *first, int len)
2464 {
2465         if (!*first) {
2466                 **to = ',';
2467                 *to += 1;
2468         } else
2469                 *first = 0;
2470         memcpy(*to, from, len);
2471         *to += len;
2472 }
2473
2474 static inline void take_selinux_option(char **to, char *from, int *first,
2475                                        int len)
2476 {
2477         int current_size = 0;
2478
2479         if (!*first) {
2480                 **to = '|';
2481                 *to += 1;
2482         } else
2483                 *first = 0;
2484
2485         while (current_size < len) {
2486                 if (*from != '"') {
2487                         **to = *from;
2488                         *to += 1;
2489                 }
2490                 from += 1;
2491                 current_size += 1;
2492         }
2493 }
2494
2495 static int selinux_sb_copy_data(char *orig, char *copy)
2496 {
2497         int fnosec, fsec, rc = 0;
2498         char *in_save, *in_curr, *in_end;
2499         char *sec_curr, *nosec_save, *nosec;
2500         int open_quote = 0;
2501
2502         in_curr = orig;
2503         sec_curr = copy;
2504
2505         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2506         if (!nosec) {
2507                 rc = -ENOMEM;
2508                 goto out;
2509         }
2510
2511         nosec_save = nosec;
2512         fnosec = fsec = 1;
2513         in_save = in_end = orig;
2514
2515         do {
2516                 if (*in_end == '"')
2517                         open_quote = !open_quote;
2518                 if ((*in_end == ',' && open_quote == 0) ||
2519                                 *in_end == '\0') {
2520                         int len = in_end - in_curr;
2521
2522                         if (selinux_option(in_curr, len))
2523                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2524                         else
2525                                 take_option(&nosec, in_curr, &fnosec, len);
2526
2527                         in_curr = in_end + 1;
2528                 }
2529         } while (*in_end++);
2530
2531         strcpy(in_save, nosec_save);
2532         free_page((unsigned long)nosec_save);
2533 out:
2534         return rc;
2535 }
2536
2537 static int selinux_sb_remount(struct super_block *sb, void *data)
2538 {
2539         int rc, i, *flags;
2540         struct security_mnt_opts opts;
2541         char *secdata, **mount_options;
2542         struct superblock_security_struct *sbsec = sb->s_security;
2543
2544         if (!(sbsec->flags & SE_SBINITIALIZED))
2545                 return 0;
2546
2547         if (!data)
2548                 return 0;
2549
2550         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2551                 return 0;
2552
2553         security_init_mnt_opts(&opts);
2554         secdata = alloc_secdata();
2555         if (!secdata)
2556                 return -ENOMEM;
2557         rc = selinux_sb_copy_data(data, secdata);
2558         if (rc)
2559                 goto out_free_secdata;
2560
2561         rc = selinux_parse_opts_str(secdata, &opts);
2562         if (rc)
2563                 goto out_free_secdata;
2564
2565         mount_options = opts.mnt_opts;
2566         flags = opts.mnt_opts_flags;
2567
2568         for (i = 0; i < opts.num_mnt_opts; i++) {
2569                 u32 sid;
2570                 size_t len;
2571
2572                 if (flags[i] == SBLABEL_MNT)
2573                         continue;
2574                 len = strlen(mount_options[i]);
2575                 rc = security_context_to_sid(mount_options[i], len, &sid,
2576                                              GFP_KERNEL);
2577                 if (rc) {
2578                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2579                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2580                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2581                         goto out_free_opts;
2582                 }
2583                 rc = -EINVAL;
2584                 switch (flags[i]) {
2585                 case FSCONTEXT_MNT:
2586                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2587                                 goto out_bad_option;
2588                         break;
2589                 case CONTEXT_MNT:
2590                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2591                                 goto out_bad_option;
2592                         break;
2593                 case ROOTCONTEXT_MNT: {
2594                         struct inode_security_struct *root_isec;
2595                         root_isec = d_backing_inode(sb->s_root)->i_security;
2596
2597                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2598                                 goto out_bad_option;
2599                         break;
2600                 }
2601                 case DEFCONTEXT_MNT:
2602                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2603                                 goto out_bad_option;
2604                         break;
2605                 default:
2606                         goto out_free_opts;
2607                 }
2608         }
2609
2610         rc = 0;
2611 out_free_opts:
2612         security_free_mnt_opts(&opts);
2613 out_free_secdata:
2614         free_secdata(secdata);
2615         return rc;
2616 out_bad_option:
2617         printk(KERN_WARNING "SELinux: unable to change security options "
2618                "during remount (dev %s, type=%s)\n", sb->s_id,
2619                sb->s_type->name);
2620         goto out_free_opts;
2621 }
2622
2623 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2624 {
2625         const struct cred *cred = current_cred();
2626         struct common_audit_data ad;
2627         int rc;
2628
2629         rc = superblock_doinit(sb, data);
2630         if (rc)
2631                 return rc;
2632
2633         /* Allow all mounts performed by the kernel */
2634         if (flags & MS_KERNMOUNT)
2635                 return 0;
2636
2637         ad.type = LSM_AUDIT_DATA_DENTRY;
2638         ad.u.dentry = sb->s_root;
2639         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2640 }
2641
2642 static int selinux_sb_statfs(struct dentry *dentry)
2643 {
2644         const struct cred *cred = current_cred();
2645         struct common_audit_data ad;
2646
2647         ad.type = LSM_AUDIT_DATA_DENTRY;
2648         ad.u.dentry = dentry->d_sb->s_root;
2649         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2650 }
2651
2652 static int selinux_mount(const char *dev_name,
2653                          struct path *path,
2654                          const char *type,
2655                          unsigned long flags,
2656                          void *data)
2657 {
2658         const struct cred *cred = current_cred();
2659
2660         if (flags & MS_REMOUNT)
2661                 return superblock_has_perm(cred, path->dentry->d_sb,
2662                                            FILESYSTEM__REMOUNT, NULL);
2663         else
2664                 return path_has_perm(cred, path, FILE__MOUNTON);
2665 }
2666
2667 static int selinux_umount(struct vfsmount *mnt, int flags)
2668 {
2669         const struct cred *cred = current_cred();
2670
2671         return superblock_has_perm(cred, mnt->mnt_sb,
2672                                    FILESYSTEM__UNMOUNT, NULL);
2673 }
2674
2675 /* inode security operations */
2676
2677 static int selinux_inode_alloc_security(struct inode *inode)
2678 {
2679         return inode_alloc_security(inode);
2680 }
2681
2682 static void selinux_inode_free_security(struct inode *inode)
2683 {
2684         inode_free_security(inode);
2685 }
2686
2687 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2688                                         struct qstr *name, void **ctx,
2689                                         u32 *ctxlen)
2690 {
2691         const struct cred *cred = current_cred();
2692         struct task_security_struct *tsec;
2693         struct inode_security_struct *dsec;
2694         struct superblock_security_struct *sbsec;
2695         struct inode *dir = d_backing_inode(dentry->d_parent);
2696         u32 newsid;
2697         int rc;
2698
2699         tsec = cred->security;
2700         dsec = dir->i_security;
2701         sbsec = dir->i_sb->s_security;
2702
2703         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2704                 newsid = tsec->create_sid;
2705         } else {
2706                 rc = security_transition_sid(tsec->sid, dsec->sid,
2707                                              inode_mode_to_security_class(mode),
2708                                              name,
2709                                              &newsid);
2710                 if (rc) {
2711                         printk(KERN_WARNING
2712                                 "%s: security_transition_sid failed, rc=%d\n",
2713                                __func__, -rc);
2714                         return rc;
2715                 }
2716         }
2717
2718         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2719 }
2720
2721 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2722                                        const struct qstr *qstr,
2723                                        const char **name,
2724                                        void **value, size_t *len)
2725 {
2726         const struct task_security_struct *tsec = current_security();
2727         struct inode_security_struct *dsec;
2728         struct superblock_security_struct *sbsec;
2729         u32 sid, newsid, clen;
2730         int rc;
2731         char *context;
2732
2733         dsec = dir->i_security;
2734         sbsec = dir->i_sb->s_security;
2735
2736         sid = tsec->sid;
2737         newsid = tsec->create_sid;
2738
2739         if ((sbsec->flags & SE_SBINITIALIZED) &&
2740             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2741                 newsid = sbsec->mntpoint_sid;
2742         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2743                 rc = security_transition_sid(sid, dsec->sid,
2744                                              inode_mode_to_security_class(inode->i_mode),
2745                                              qstr, &newsid);
2746                 if (rc) {
2747                         printk(KERN_WARNING "%s:  "
2748                                "security_transition_sid failed, rc=%d (dev=%s "
2749                                "ino=%ld)\n",
2750                                __func__,
2751                                -rc, inode->i_sb->s_id, inode->i_ino);
2752                         return rc;
2753                 }
2754         }
2755
2756         /* Possibly defer initialization to selinux_complete_init. */
2757         if (sbsec->flags & SE_SBINITIALIZED) {
2758                 struct inode_security_struct *isec = inode->i_security;
2759                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2760                 isec->sid = newsid;
2761                 isec->initialized = 1;
2762         }
2763
2764         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2765                 return -EOPNOTSUPP;
2766
2767         if (name)
2768                 *name = XATTR_SELINUX_SUFFIX;
2769
2770         if (value && len) {
2771                 rc = security_sid_to_context_force(newsid, &context, &clen);
2772                 if (rc)
2773                         return rc;
2774                 *value = context;
2775                 *len = clen;
2776         }
2777
2778         return 0;
2779 }
2780
2781 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2782 {
2783         return may_create(dir, dentry, SECCLASS_FILE);
2784 }
2785
2786 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2787 {
2788         return may_link(dir, old_dentry, MAY_LINK);
2789 }
2790
2791 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2792 {
2793         return may_link(dir, dentry, MAY_UNLINK);
2794 }
2795
2796 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2797 {
2798         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2799 }
2800
2801 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2802 {
2803         return may_create(dir, dentry, SECCLASS_DIR);
2804 }
2805
2806 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2807 {
2808         return may_link(dir, dentry, MAY_RMDIR);
2809 }
2810
2811 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2812 {
2813         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2814 }
2815
2816 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2817                                 struct inode *new_inode, struct dentry *new_dentry)
2818 {
2819         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2820 }
2821
2822 static int selinux_inode_readlink(struct dentry *dentry)
2823 {
2824         const struct cred *cred = current_cred();
2825
2826         return dentry_has_perm(cred, dentry, FILE__READ);
2827 }
2828
2829 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2830 {
2831         const struct cred *cred = current_cred();
2832
2833         return dentry_has_perm(cred, dentry, FILE__READ);
2834 }
2835
2836 static noinline int audit_inode_permission(struct inode *inode,
2837                                            u32 perms, u32 audited, u32 denied,
2838                                            int result,
2839                                            unsigned flags)
2840 {
2841         struct common_audit_data ad;
2842         struct inode_security_struct *isec = inode->i_security;
2843         int rc;
2844
2845         ad.type = LSM_AUDIT_DATA_INODE;
2846         ad.u.inode = inode;
2847
2848         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2849                             audited, denied, result, &ad, flags);
2850         if (rc)
2851                 return rc;
2852         return 0;
2853 }
2854
2855 static int selinux_inode_permission(struct inode *inode, int mask)
2856 {
2857         const struct cred *cred = current_cred();
2858         u32 perms;
2859         bool from_access;
2860         unsigned flags = mask & MAY_NOT_BLOCK;
2861         struct inode_security_struct *isec;
2862         u32 sid;
2863         struct av_decision avd;
2864         int rc, rc2;
2865         u32 audited, denied;
2866
2867         from_access = mask & MAY_ACCESS;
2868         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2869
2870         /* No permission to check.  Existence test. */
2871         if (!mask)
2872                 return 0;
2873
2874         validate_creds(cred);
2875
2876         if (unlikely(IS_PRIVATE(inode)))
2877                 return 0;
2878
2879         perms = file_mask_to_av(inode->i_mode, mask);
2880
2881         sid = cred_sid(cred);
2882         isec = inode->i_security;
2883
2884         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2885         audited = avc_audit_required(perms, &avd, rc,
2886                                      from_access ? FILE__AUDIT_ACCESS : 0,
2887                                      &denied);
2888         if (likely(!audited))
2889                 return rc;
2890
2891         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2892         if (rc2)
2893                 return rc2;
2894         return rc;
2895 }
2896
2897 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2898 {
2899         const struct cred *cred = current_cred();
2900         unsigned int ia_valid = iattr->ia_valid;
2901         __u32 av = FILE__WRITE;
2902
2903         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2904         if (ia_valid & ATTR_FORCE) {
2905                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2906                               ATTR_FORCE);
2907                 if (!ia_valid)
2908                         return 0;
2909         }
2910
2911         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2912                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2913                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2914
2915         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2916                 av |= FILE__OPEN;
2917
2918         return dentry_has_perm(cred, dentry, av);
2919 }
2920
2921 static int selinux_inode_getattr(const struct path *path)
2922 {
2923         return path_has_perm(current_cred(), path, FILE__GETATTR);
2924 }
2925
2926 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2927 {
2928         const struct cred *cred = current_cred();
2929
2930         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2931                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2932                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2933                         if (!capable(CAP_SETFCAP))
2934                                 return -EPERM;
2935                 } else if (!capable(CAP_SYS_ADMIN)) {
2936                         /* A different attribute in the security namespace.
2937                            Restrict to administrator. */
2938                         return -EPERM;
2939                 }
2940         }
2941
2942         /* Not an attribute we recognize, so just check the
2943            ordinary setattr permission. */
2944         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2945 }
2946
2947 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2948                                   const void *value, size_t size, int flags)
2949 {
2950         struct inode *inode = d_backing_inode(dentry);
2951         struct inode_security_struct *isec = inode->i_security;
2952         struct superblock_security_struct *sbsec;
2953         struct common_audit_data ad;
2954         u32 newsid, sid = current_sid();
2955         int rc = 0;
2956
2957         if (strcmp(name, XATTR_NAME_SELINUX))
2958                 return selinux_inode_setotherxattr(dentry, name);
2959
2960         sbsec = inode->i_sb->s_security;
2961         if (!(sbsec->flags & SBLABEL_MNT))
2962                 return -EOPNOTSUPP;
2963
2964         if (!inode_owner_or_capable(inode))
2965                 return -EPERM;
2966
2967         ad.type = LSM_AUDIT_DATA_DENTRY;
2968         ad.u.dentry = dentry;
2969
2970         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2971                           FILE__RELABELFROM, &ad);
2972         if (rc)
2973                 return rc;
2974
2975         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2976         if (rc == -EINVAL) {
2977                 if (!capable(CAP_MAC_ADMIN)) {
2978                         struct audit_buffer *ab;
2979                         size_t audit_size;
2980                         const char *str;
2981
2982                         /* We strip a nul only if it is at the end, otherwise the
2983                          * context contains a nul and we should audit that */
2984                         if (value) {
2985                                 str = value;
2986                                 if (str[size - 1] == '\0')
2987                                         audit_size = size - 1;
2988                                 else
2989                                         audit_size = size;
2990                         } else {
2991                                 str = "";
2992                                 audit_size = 0;
2993                         }
2994                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2995                         audit_log_format(ab, "op=setxattr invalid_context=");
2996                         audit_log_n_untrustedstring(ab, value, audit_size);
2997                         audit_log_end(ab);
2998
2999                         return rc;
3000                 }
3001                 rc = security_context_to_sid_force(value, size, &newsid);
3002         }
3003         if (rc)
3004                 return rc;
3005
3006         rc = avc_has_perm(sid, newsid, isec->sclass,
3007                           FILE__RELABELTO, &ad);
3008         if (rc)
3009                 return rc;
3010
3011         rc = security_validate_transition(isec->sid, newsid, sid,
3012                                           isec->sclass);
3013         if (rc)
3014                 return rc;
3015
3016         return avc_has_perm(newsid,
3017                             sbsec->sid,
3018                             SECCLASS_FILESYSTEM,
3019                             FILESYSTEM__ASSOCIATE,
3020                             &ad);
3021 }
3022
3023 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3024                                         const void *value, size_t size,
3025                                         int flags)
3026 {
3027         struct inode *inode = d_backing_inode(dentry);
3028         struct inode_security_struct *isec = inode->i_security;
3029         u32 newsid;
3030         int rc;
3031
3032         if (strcmp(name, XATTR_NAME_SELINUX)) {
3033                 /* Not an attribute we recognize, so nothing to do. */
3034                 return;
3035         }
3036
3037         rc = security_context_to_sid_force(value, size, &newsid);
3038         if (rc) {
3039                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3040                        "for (%s, %lu), rc=%d\n",
3041                        inode->i_sb->s_id, inode->i_ino, -rc);
3042                 return;
3043         }
3044
3045         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3046         isec->sid = newsid;
3047         isec->initialized = 1;
3048
3049         return;
3050 }
3051
3052 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3053 {
3054         const struct cred *cred = current_cred();
3055
3056         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3057 }
3058
3059 static int selinux_inode_listxattr(struct dentry *dentry)
3060 {
3061         const struct cred *cred = current_cred();
3062
3063         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3064 }
3065
3066 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3067 {
3068         if (strcmp(name, XATTR_NAME_SELINUX))
3069                 return selinux_inode_setotherxattr(dentry, name);
3070
3071         /* No one is allowed to remove a SELinux security label.
3072            You can change the label, but all data must be labeled. */
3073         return -EACCES;
3074 }
3075
3076 /*
3077  * Copy the inode security context value to the user.
3078  *
3079  * Permission check is handled by selinux_inode_getxattr hook.
3080  */
3081 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3082 {
3083         u32 size;
3084         int error;
3085         char *context = NULL;
3086         struct inode_security_struct *isec = inode->i_security;
3087
3088         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3089                 return -EOPNOTSUPP;
3090
3091         /*
3092          * If the caller has CAP_MAC_ADMIN, then get the raw context
3093          * value even if it is not defined by current policy; otherwise,
3094          * use the in-core value under current policy.
3095          * Use the non-auditing forms of the permission checks since
3096          * getxattr may be called by unprivileged processes commonly
3097          * and lack of permission just means that we fall back to the
3098          * in-core context value, not a denial.
3099          */
3100         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3101                             SECURITY_CAP_NOAUDIT);
3102         if (!error)
3103                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3104                                             SECURITY_CAP_NOAUDIT);
3105         if (!error)
3106                 error = security_sid_to_context_force(isec->sid, &context,
3107                                                       &size);
3108         else
3109                 error = security_sid_to_context(isec->sid, &context, &size);
3110         if (error)
3111                 return error;
3112         error = size;
3113         if (alloc) {
3114                 *buffer = context;
3115                 goto out_nofree;
3116         }
3117         kfree(context);
3118 out_nofree:
3119         return error;
3120 }
3121
3122 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3123                                      const void *value, size_t size, int flags)
3124 {
3125         struct inode_security_struct *isec = inode->i_security;
3126         u32 newsid;
3127         int rc;
3128
3129         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3130                 return -EOPNOTSUPP;
3131
3132         if (!value || !size)
3133                 return -EACCES;
3134
3135         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3136         if (rc)
3137                 return rc;
3138
3139         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3140         isec->sid = newsid;
3141         isec->initialized = 1;
3142         return 0;
3143 }
3144
3145 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3146 {
3147         const int len = sizeof(XATTR_NAME_SELINUX);
3148         if (buffer && len <= buffer_size)
3149                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3150         return len;
3151 }
3152
3153 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3154 {
3155         struct inode_security_struct *isec = inode->i_security;
3156         *secid = isec->sid;
3157 }
3158
3159 /* file security operations */
3160
3161 static int selinux_revalidate_file_permission(struct file *file, int mask)
3162 {
3163         const struct cred *cred = current_cred();
3164         struct inode *inode = file_inode(file);
3165
3166         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3167         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3168                 mask |= MAY_APPEND;
3169
3170         return file_has_perm(cred, file,
3171                              file_mask_to_av(inode->i_mode, mask));
3172 }
3173
3174 static int selinux_file_permission(struct file *file, int mask)
3175 {
3176         struct inode *inode = file_inode(file);
3177         struct file_security_struct *fsec = file->f_security;
3178         struct inode_security_struct *isec = inode->i_security;
3179         u32 sid = current_sid();
3180
3181         if (!mask)
3182                 /* No permission to check.  Existence test. */
3183                 return 0;
3184
3185         if (sid == fsec->sid && fsec->isid == isec->sid &&
3186             fsec->pseqno == avc_policy_seqno())
3187                 /* No change since file_open check. */
3188                 return 0;
3189
3190         return selinux_revalidate_file_permission(file, mask);
3191 }
3192
3193 static int selinux_file_alloc_security(struct file *file)
3194 {
3195         return file_alloc_security(file);
3196 }
3197
3198 static void selinux_file_free_security(struct file *file)
3199 {
3200         file_free_security(file);
3201 }
3202
3203 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3204                               unsigned long arg)
3205 {
3206         const struct cred *cred = current_cred();
3207         int error = 0;
3208
3209         switch (cmd) {
3210         case FIONREAD:
3211         /* fall through */
3212         case FIBMAP:
3213         /* fall through */
3214         case FIGETBSZ:
3215         /* fall through */
3216         case FS_IOC_GETFLAGS:
3217         /* fall through */
3218         case FS_IOC_GETVERSION:
3219                 error = file_has_perm(cred, file, FILE__GETATTR);
3220                 break;
3221
3222         case FS_IOC_SETFLAGS:
3223         /* fall through */
3224         case FS_IOC_SETVERSION:
3225                 error = file_has_perm(cred, file, FILE__SETATTR);
3226                 break;
3227
3228         /* sys_ioctl() checks */
3229         case FIONBIO:
3230         /* fall through */
3231         case FIOASYNC:
3232                 error = file_has_perm(cred, file, 0);
3233                 break;
3234
3235         case KDSKBENT:
3236         case KDSKBSENT:
3237                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3238                                             SECURITY_CAP_AUDIT);
3239                 break;
3240
3241         /* default case assumes that the command will go
3242          * to the file's ioctl() function.
3243          */
3244         default:
3245                 error = file_has_perm(cred, file, FILE__IOCTL);
3246         }
3247         return error;
3248 }
3249
3250 static int default_noexec;
3251
3252 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3253 {
3254         const struct cred *cred = current_cred();
3255         int rc = 0;
3256
3257         if (default_noexec &&
3258             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3259                 /*
3260                  * We are making executable an anonymous mapping or a
3261                  * private file mapping that will also be writable.
3262                  * This has an additional check.
3263                  */
3264                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3265                 if (rc)
3266                         goto error;
3267         }
3268
3269         if (file) {
3270                 /* read access is always possible with a mapping */
3271                 u32 av = FILE__READ;
3272
3273                 /* write access only matters if the mapping is shared */
3274                 if (shared && (prot & PROT_WRITE))
3275                         av |= FILE__WRITE;
3276
3277                 if (prot & PROT_EXEC)
3278                         av |= FILE__EXECUTE;
3279
3280                 return file_has_perm(cred, file, av);
3281         }
3282
3283 error:
3284         return rc;
3285 }
3286
3287 static int selinux_mmap_addr(unsigned long addr)
3288 {
3289         int rc = 0;
3290
3291         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3292                 u32 sid = current_sid();
3293                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3294                                   MEMPROTECT__MMAP_ZERO, NULL);
3295         }
3296
3297         return rc;
3298 }
3299
3300 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3301                              unsigned long prot, unsigned long flags)
3302 {
3303         if (selinux_checkreqprot)
3304                 prot = reqprot;
3305
3306         return file_map_prot_check(file, prot,
3307                                    (flags & MAP_TYPE) == MAP_SHARED);
3308 }
3309
3310 static int selinux_file_mprotect(struct vm_area_struct *vma,
3311                                  unsigned long reqprot,
3312                                  unsigned long prot)
3313 {
3314         const struct cred *cred = current_cred();
3315
3316         if (selinux_checkreqprot)
3317                 prot = reqprot;
3318
3319         if (default_noexec &&
3320             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3321                 int rc = 0;
3322                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3323                     vma->vm_end <= vma->vm_mm->brk) {
3324                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3325                 } else if (!vma->vm_file &&
3326                            vma->vm_start <= vma->vm_mm->start_stack &&
3327                            vma->vm_end >= vma->vm_mm->start_stack) {
3328                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3329                 } else if (vma->vm_file && vma->anon_vma) {
3330                         /*
3331                          * We are making executable a file mapping that has
3332                          * had some COW done. Since pages might have been
3333                          * written, check ability to execute the possibly
3334                          * modified content.  This typically should only
3335                          * occur for text relocations.
3336                          */
3337                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3338                 }
3339                 if (rc)
3340                         return rc;
3341         }
3342
3343         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3344 }
3345
3346 static int selinux_file_lock(struct file *file, unsigned int cmd)
3347 {
3348         const struct cred *cred = current_cred();
3349
3350         return file_has_perm(cred, file, FILE__LOCK);
3351 }
3352
3353 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3354                               unsigned long arg)
3355 {
3356         const struct cred *cred = current_cred();
3357         int err = 0;
3358
3359         switch (cmd) {
3360         case F_SETFL:
3361                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3362                         err = file_has_perm(cred, file, FILE__WRITE);
3363                         break;
3364                 }
3365                 /* fall through */
3366         case F_SETOWN:
3367         case F_SETSIG:
3368         case F_GETFL:
3369         case F_GETOWN:
3370         case F_GETSIG:
3371         case F_GETOWNER_UIDS:
3372                 /* Just check FD__USE permission */
3373                 err = file_has_perm(cred, file, 0);
3374                 break;
3375         case F_GETLK:
3376         case F_SETLK:
3377         case F_SETLKW:
3378         case F_OFD_GETLK:
3379         case F_OFD_SETLK:
3380         case F_OFD_SETLKW:
3381 #if BITS_PER_LONG == 32
3382         case F_GETLK64:
3383         case F_SETLK64:
3384         case F_SETLKW64:
3385 #endif
3386                 err = file_has_perm(cred, file, FILE__LOCK);
3387                 break;
3388         }
3389
3390         return err;
3391 }
3392
3393 static void selinux_file_set_fowner(struct file *file)
3394 {
3395         struct file_security_struct *fsec;
3396
3397         fsec = file->f_security;
3398         fsec->fown_sid = current_sid();
3399 }
3400
3401 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3402                                        struct fown_struct *fown, int signum)
3403 {
3404         struct file *file;
3405         u32 sid = task_sid(tsk);
3406         u32 perm;
3407         struct file_security_struct *fsec;
3408
3409         /* struct fown_struct is never outside the context of a struct file */
3410         file = container_of(fown, struct file, f_owner);
3411
3412         fsec = file->f_security;
3413
3414         if (!signum)
3415                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3416         else
3417                 perm = signal_to_av(signum);
3418
3419         return avc_has_perm(fsec->fown_sid, sid,
3420                             SECCLASS_PROCESS, perm, NULL);
3421 }
3422
3423 static int selinux_file_receive(struct file *file)
3424 {
3425         const struct cred *cred = current_cred();
3426
3427         return file_has_perm(cred, file, file_to_av(file));
3428 }
3429
3430 static int selinux_file_open(struct file *file, const struct cred *cred)
3431 {
3432         struct file_security_struct *fsec;
3433         struct inode_security_struct *isec;
3434
3435         fsec = file->f_security;
3436         isec = file_inode(file)->i_security;
3437         /*
3438          * Save inode label and policy sequence number
3439          * at open-time so that selinux_file_permission
3440          * can determine whether revalidation is necessary.
3441          * Task label is already saved in the file security
3442          * struct as its SID.
3443          */
3444         fsec->isid = isec->sid;
3445         fsec->pseqno = avc_policy_seqno();
3446         /*
3447          * Since the inode label or policy seqno may have changed
3448          * between the selinux_inode_permission check and the saving
3449          * of state above, recheck that access is still permitted.
3450          * Otherwise, access might never be revalidated against the
3451          * new inode label or new policy.
3452          * This check is not redundant - do not remove.
3453          */
3454         return file_path_has_perm(cred, file, open_file_to_av(file));
3455 }
3456
3457 /* task security operations */
3458
3459 static int selinux_task_create(unsigned long clone_flags)
3460 {
3461         return current_has_perm(current, PROCESS__FORK);
3462 }
3463
3464 /*
3465  * allocate the SELinux part of blank credentials
3466  */
3467 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3468 {
3469         struct task_security_struct *tsec;
3470
3471         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3472         if (!tsec)
3473                 return -ENOMEM;
3474
3475         cred->security = tsec;
3476         return 0;
3477 }
3478
3479 /*
3480  * detach and free the LSM part of a set of credentials
3481  */
3482 static void selinux_cred_free(struct cred *cred)
3483 {
3484         struct task_security_struct *tsec = cred->security;
3485
3486         /*
3487          * cred->security == NULL if security_cred_alloc_blank() or
3488          * security_prepare_creds() returned an error.
3489          */
3490         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3491         cred->security = (void *) 0x7UL;
3492         kfree(tsec);
3493 }
3494
3495 /*
3496  * prepare a new set of credentials for modification
3497  */
3498 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3499                                 gfp_t gfp)
3500 {
3501         const struct task_security_struct *old_tsec;
3502         struct task_security_struct *tsec;
3503
3504         old_tsec = old->security;
3505
3506         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3507         if (!tsec)
3508                 return -ENOMEM;
3509
3510         new->security = tsec;
3511         return 0;
3512 }
3513
3514 /*
3515  * transfer the SELinux data to a blank set of creds
3516  */
3517 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3518 {
3519         const struct task_security_struct *old_tsec = old->security;
3520         struct task_security_struct *tsec = new->security;
3521
3522         *tsec = *old_tsec;
3523 }
3524
3525 /*
3526  * set the security data for a kernel service
3527  * - all the creation contexts are set to unlabelled
3528  */
3529 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3530 {
3531         struct task_security_struct *tsec = new->security;
3532         u32 sid = current_sid();
3533         int ret;
3534
3535         ret = avc_has_perm(sid, secid,
3536                            SECCLASS_KERNEL_SERVICE,
3537                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3538                            NULL);
3539         if (ret == 0) {
3540                 tsec->sid = secid;
3541                 tsec->create_sid = 0;
3542                 tsec->keycreate_sid = 0;
3543                 tsec->sockcreate_sid = 0;
3544         }
3545         return ret;
3546 }
3547
3548 /*
3549  * set the file creation context in a security record to the same as the
3550  * objective context of the specified inode
3551  */
3552 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3553 {
3554         struct inode_security_struct *isec = inode->i_security;
3555         struct task_security_struct *tsec = new->security;
3556         u32 sid = current_sid();
3557         int ret;
3558
3559         ret = avc_has_perm(sid, isec->sid,
3560                            SECCLASS_KERNEL_SERVICE,
3561                            KERNEL_SERVICE__CREATE_FILES_AS,
3562                            NULL);
3563
3564         if (ret == 0)
3565                 tsec->create_sid = isec->sid;
3566         return ret;
3567 }
3568
3569 static int selinux_kernel_module_request(char *kmod_name)
3570 {
3571         u32 sid;
3572         struct common_audit_data ad;
3573
3574         sid = task_sid(current);
3575
3576         ad.type = LSM_AUDIT_DATA_KMOD;
3577         ad.u.kmod_name = kmod_name;
3578
3579         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3580                             SYSTEM__MODULE_REQUEST, &ad);
3581 }
3582
3583 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3584 {
3585         return current_has_perm(p, PROCESS__SETPGID);
3586 }
3587
3588 static int selinux_task_getpgid(struct task_struct *p)
3589 {
3590         return current_has_perm(p, PROCESS__GETPGID);
3591 }
3592
3593 static int selinux_task_getsid(struct task_struct *p)
3594 {
3595         return current_has_perm(p, PROCESS__GETSESSION);
3596 }
3597
3598 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3599 {
3600         *secid = task_sid(p);
3601 }
3602
3603 static int selinux_task_setnice(struct task_struct *p, int nice)
3604 {
3605         return current_has_perm(p, PROCESS__SETSCHED);
3606 }
3607
3608 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3609 {
3610         return current_has_perm(p, PROCESS__SETSCHED);
3611 }
3612
3613 static int selinux_task_getioprio(struct task_struct *p)
3614 {
3615         return current_has_perm(p, PROCESS__GETSCHED);
3616 }
3617
3618 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3619                 struct rlimit *new_rlim)
3620 {
3621         struct rlimit *old_rlim = p->signal->rlim + resource;
3622
3623         /* Control the ability to change the hard limit (whether
3624            lowering or raising it), so that the hard limit can
3625            later be used as a safe reset point for the soft limit
3626            upon context transitions.  See selinux_bprm_committing_creds. */
3627         if (old_rlim->rlim_max != new_rlim->rlim_max)
3628                 return current_has_perm(p, PROCESS__SETRLIMIT);
3629
3630         return 0;
3631 }
3632
3633 static int selinux_task_setscheduler(struct task_struct *p)
3634 {
3635         return current_has_perm(p, PROCESS__SETSCHED);
3636 }
3637
3638 static int selinux_task_getscheduler(struct task_struct *p)
3639 {
3640         return current_has_perm(p, PROCESS__GETSCHED);
3641 }
3642
3643 static int selinux_task_movememory(struct task_struct *p)
3644 {
3645         return current_has_perm(p, PROCESS__SETSCHED);
3646 }
3647
3648 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3649                                 int sig, u32 secid)
3650 {
3651         u32 perm;
3652         int rc;
3653
3654         if (!sig)
3655                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3656         else
3657                 perm = signal_to_av(sig);
3658         if (secid)
3659                 rc = avc_has_perm(secid, task_sid(p),
3660                                   SECCLASS_PROCESS, perm, NULL);
3661         else
3662                 rc = current_has_perm(p, perm);
3663         return rc;
3664 }
3665
3666 static int selinux_task_wait(struct task_struct *p)
3667 {
3668         return task_has_perm(p, current, PROCESS__SIGCHLD);
3669 }
3670
3671 static void selinux_task_to_inode(struct task_struct *p,
3672                                   struct inode *inode)
3673 {
3674         struct inode_security_struct *isec = inode->i_security;
3675         u32 sid = task_sid(p);
3676
3677         isec->sid = sid;
3678         isec->initialized = 1;
3679 }
3680
3681 /* Returns error only if unable to parse addresses */
3682 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3683                         struct common_audit_data *ad, u8 *proto)
3684 {
3685         int offset, ihlen, ret = -EINVAL;
3686         struct iphdr _iph, *ih;
3687
3688         offset = skb_network_offset(skb);
3689         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3690         if (ih == NULL)
3691                 goto out;
3692
3693         ihlen = ih->ihl * 4;
3694         if (ihlen < sizeof(_iph))
3695                 goto out;
3696
3697         ad->u.net->v4info.saddr = ih->saddr;
3698         ad->u.net->v4info.daddr = ih->daddr;
3699         ret = 0;
3700
3701         if (proto)
3702                 *proto = ih->protocol;
3703
3704         switch (ih->protocol) {
3705         case IPPROTO_TCP: {
3706                 struct tcphdr _tcph, *th;
3707
3708                 if (ntohs(ih->frag_off) & IP_OFFSET)
3709                         break;
3710
3711                 offset += ihlen;
3712                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3713                 if (th == NULL)
3714                         break;
3715
3716                 ad->u.net->sport = th->source;
3717                 ad->u.net->dport = th->dest;
3718                 break;
3719         }
3720
3721         case IPPROTO_UDP: {
3722                 struct udphdr _udph, *uh;
3723
3724                 if (ntohs(ih->frag_off) & IP_OFFSET)
3725                         break;
3726
3727                 offset += ihlen;
3728                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3729                 if (uh == NULL)
3730                         break;
3731
3732                 ad->u.net->sport = uh->source;
3733                 ad->u.net->dport = uh->dest;
3734                 break;
3735         }
3736
3737         case IPPROTO_DCCP: {
3738                 struct dccp_hdr _dccph, *dh;
3739
3740                 if (ntohs(ih->frag_off) & IP_OFFSET)
3741                         break;
3742
3743                 offset += ihlen;
3744                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3745                 if (dh == NULL)
3746                         break;
3747
3748                 ad->u.net->sport = dh->dccph_sport;
3749                 ad->u.net->dport = dh->dccph_dport;
3750                 break;
3751         }
3752
3753         default:
3754                 break;
3755         }
3756 out:
3757         return ret;
3758 }
3759
3760 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3761
3762 /* Returns error only if unable to parse addresses */
3763 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3764                         struct common_audit_data *ad, u8 *proto)
3765 {
3766         u8 nexthdr;
3767         int ret = -EINVAL, offset;
3768         struct ipv6hdr _ipv6h, *ip6;
3769         __be16 frag_off;
3770
3771         offset = skb_network_offset(skb);
3772         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3773         if (ip6 == NULL)
3774                 goto out;
3775
3776         ad->u.net->v6info.saddr = ip6->saddr;
3777         ad->u.net->v6info.daddr = ip6->daddr;
3778         ret = 0;
3779
3780         nexthdr = ip6->nexthdr;
3781         offset += sizeof(_ipv6h);
3782         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3783         if (offset < 0)
3784                 goto out;
3785
3786         if (proto)
3787                 *proto = nexthdr;
3788
3789         switch (nexthdr) {
3790         case IPPROTO_TCP: {
3791                 struct tcphdr _tcph, *th;
3792
3793                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3794                 if (th == NULL)
3795                         break;
3796
3797                 ad->u.net->sport = th->source;
3798                 ad->u.net->dport = th->dest;
3799                 break;
3800         }
3801
3802         case IPPROTO_UDP: {
3803                 struct udphdr _udph, *uh;
3804
3805                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3806                 if (uh == NULL)
3807                         break;
3808
3809                 ad->u.net->sport = uh->source;
3810                 ad->u.net->dport = uh->dest;
3811                 break;
3812         }
3813
3814         case IPPROTO_DCCP: {
3815                 struct dccp_hdr _dccph, *dh;
3816
3817                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3818                 if (dh == NULL)
3819                         break;
3820
3821                 ad->u.net->sport = dh->dccph_sport;
3822                 ad->u.net->dport = dh->dccph_dport;
3823                 break;
3824         }
3825
3826         /* includes fragments */
3827         default:
3828                 break;
3829         }
3830 out:
3831         return ret;
3832 }
3833
3834 #endif /* IPV6 */
3835
3836 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3837                              char **_addrp, int src, u8 *proto)
3838 {
3839         char *addrp;
3840         int ret;
3841
3842         switch (ad->u.net->family) {
3843         case PF_INET:
3844                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3845                 if (ret)
3846                         goto parse_error;
3847                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3848                                        &ad->u.net->v4info.daddr);
3849                 goto okay;
3850
3851 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3852         case PF_INET6:
3853                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3854                 if (ret)
3855                         goto parse_error;
3856                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3857                                        &ad->u.net->v6info.daddr);
3858                 goto okay;
3859 #endif  /* IPV6 */
3860         default:
3861                 addrp = NULL;
3862                 goto okay;
3863         }
3864
3865 parse_error:
3866         printk(KERN_WARNING
3867                "SELinux: failure in selinux_parse_skb(),"
3868                " unable to parse packet\n");
3869         return ret;
3870
3871 okay:
3872         if (_addrp)
3873                 *_addrp = addrp;
3874         return 0;
3875 }
3876
3877 /**
3878  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3879  * @skb: the packet
3880  * @family: protocol family
3881  * @sid: the packet's peer label SID
3882  *
3883  * Description:
3884  * Check the various different forms of network peer labeling and determine
3885  * the peer label/SID for the packet; most of the magic actually occurs in
3886  * the security server function security_net_peersid_cmp().  The function
3887  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3888  * or -EACCES if @sid is invalid due to inconsistencies with the different
3889  * peer labels.
3890  *
3891  */
3892 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3893 {
3894         int err;
3895         u32 xfrm_sid;
3896         u32 nlbl_sid;
3897         u32 nlbl_type;
3898
3899         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3900         if (unlikely(err))
3901                 return -EACCES;
3902         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3903         if (unlikely(err))
3904                 return -EACCES;
3905
3906         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3907         if (unlikely(err)) {
3908                 printk(KERN_WARNING
3909                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3910                        " unable to determine packet's peer label\n");
3911                 return -EACCES;
3912         }
3913
3914         return 0;
3915 }
3916
3917 /**
3918  * selinux_conn_sid - Determine the child socket label for a connection
3919  * @sk_sid: the parent socket's SID
3920  * @skb_sid: the packet's SID
3921  * @conn_sid: the resulting connection SID
3922  *
3923  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3924  * combined with the MLS information from @skb_sid in order to create
3925  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3926  * of @sk_sid.  Returns zero on success, negative values on failure.
3927  *
3928  */
3929 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3930 {
3931         int err = 0;
3932
3933         if (skb_sid != SECSID_NULL)
3934                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3935         else
3936                 *conn_sid = sk_sid;
3937
3938         return err;
3939 }
3940
3941 /* socket security operations */
3942
3943 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3944                                  u16 secclass, u32 *socksid)
3945 {
3946         if (tsec->sockcreate_sid > SECSID_NULL) {
3947                 *socksid = tsec->sockcreate_sid;
3948                 return 0;
3949         }
3950
3951         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3952                                        socksid);
3953 }
3954
3955 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3956 {
3957         struct sk_security_struct *sksec = sk->sk_security;
3958         struct common_audit_data ad;
3959         struct lsm_network_audit net = {0,};
3960         u32 tsid = task_sid(task);
3961
3962         if (sksec->sid == SECINITSID_KERNEL)
3963                 return 0;
3964
3965         ad.type = LSM_AUDIT_DATA_NET;
3966         ad.u.net = &net;
3967         ad.u.net->sk = sk;
3968
3969         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3970 }
3971
3972 static int selinux_socket_create(int family, int type,
3973                                  int protocol, int kern)
3974 {
3975         const struct task_security_struct *tsec = current_security();
3976         u32 newsid;
3977         u16 secclass;
3978         int rc;
3979
3980         if (kern)
3981                 return 0;
3982
3983         secclass = socket_type_to_security_class(family, type, protocol);
3984         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3985         if (rc)
3986                 return rc;
3987
3988         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3989 }
3990
3991 static int selinux_socket_post_create(struct socket *sock, int family,
3992                                       int type, int protocol, int kern)
3993 {
3994         const struct task_security_struct *tsec = current_security();
3995         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3996         struct sk_security_struct *sksec;
3997         int err = 0;
3998
3999         isec->sclass = socket_type_to_security_class(family, type, protocol);
4000
4001         if (kern)
4002                 isec->sid = SECINITSID_KERNEL;
4003         else {
4004                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4005                 if (err)
4006                         return err;
4007         }
4008
4009         isec->initialized = 1;
4010
4011         if (sock->sk) {
4012                 sksec = sock->sk->sk_security;
4013                 sksec->sid = isec->sid;
4014                 sksec->sclass = isec->sclass;
4015                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4016         }
4017
4018         return err;
4019 }
4020
4021 /* Range of port numbers used to automatically bind.
4022    Need to determine whether we should perform a name_bind
4023    permission check between the socket and the port number. */
4024
4025 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4026 {
4027         struct sock *sk = sock->sk;
4028         u16 family;
4029         int err;
4030
4031         err = sock_has_perm(current, sk, SOCKET__BIND);
4032         if (err)
4033                 goto out;
4034
4035         /*
4036          * If PF_INET or PF_INET6, check name_bind permission for the port.
4037          * Multiple address binding for SCTP is not supported yet: we just
4038          * check the first address now.
4039          */
4040         family = sk->sk_family;
4041         if (family == PF_INET || family == PF_INET6) {
4042                 char *addrp;
4043                 struct sk_security_struct *sksec = sk->sk_security;
4044                 struct common_audit_data ad;
4045                 struct lsm_network_audit net = {0,};
4046                 struct sockaddr_in *addr4 = NULL;
4047                 struct sockaddr_in6 *addr6 = NULL;
4048                 unsigned short snum;
4049                 u32 sid, node_perm;
4050
4051                 if (family == PF_INET) {
4052                         addr4 = (struct sockaddr_in *)address;
4053                         snum = ntohs(addr4->sin_port);
4054                         addrp = (char *)&addr4->sin_addr.s_addr;
4055                 } else {
4056                         addr6 = (struct sockaddr_in6 *)address;
4057                         snum = ntohs(addr6->sin6_port);
4058                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4059                 }
4060
4061                 if (snum) {
4062                         int low, high;
4063
4064                         inet_get_local_port_range(sock_net(sk), &low, &high);
4065
4066                         if (snum < max(PROT_SOCK, low) || snum > high) {
4067                                 err = sel_netport_sid(sk->sk_protocol,
4068                                                       snum, &sid);
4069                                 if (err)
4070                                         goto out;
4071                                 ad.type = LSM_AUDIT_DATA_NET;
4072                                 ad.u.net = &net;
4073                                 ad.u.net->sport = htons(snum);
4074                                 ad.u.net->family = family;
4075                                 err = avc_has_perm(sksec->sid, sid,
4076                                                    sksec->sclass,
4077                                                    SOCKET__NAME_BIND, &ad);
4078                                 if (err)
4079                                         goto out;
4080                         }
4081                 }
4082
4083                 switch (sksec->sclass) {
4084                 case SECCLASS_TCP_SOCKET:
4085                         node_perm = TCP_SOCKET__NODE_BIND;
4086                         break;
4087
4088                 case SECCLASS_UDP_SOCKET:
4089                         node_perm = UDP_SOCKET__NODE_BIND;
4090                         break;
4091
4092                 case SECCLASS_DCCP_SOCKET:
4093                         node_perm = DCCP_SOCKET__NODE_BIND;
4094                         break;
4095
4096                 default:
4097                         node_perm = RAWIP_SOCKET__NODE_BIND;
4098                         break;
4099                 }
4100
4101                 err = sel_netnode_sid(addrp, family, &sid);
4102                 if (err)
4103                         goto out;
4104
4105                 ad.type = LSM_AUDIT_DATA_NET;
4106                 ad.u.net = &net;
4107                 ad.u.net->sport = htons(snum);
4108                 ad.u.net->family = family;
4109
4110                 if (family == PF_INET)
4111                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4112                 else
4113                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4114
4115                 err = avc_has_perm(sksec->sid, sid,
4116                                    sksec->sclass, node_perm, &ad);
4117                 if (err)
4118                         goto out;
4119         }
4120 out:
4121         return err;
4122 }
4123
4124 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4125 {
4126         struct sock *sk = sock->sk;
4127         struct sk_security_struct *sksec = sk->sk_security;
4128         int err;
4129
4130         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4131         if (err)
4132                 return err;
4133
4134         /*
4135          * If a TCP or DCCP socket, check name_connect permission for the port.
4136          */
4137         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4138             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4139                 struct common_audit_data ad;
4140                 struct lsm_network_audit net = {0,};
4141                 struct sockaddr_in *addr4 = NULL;
4142                 struct sockaddr_in6 *addr6 = NULL;
4143                 unsigned short snum;
4144                 u32 sid, perm;
4145
4146                 if (sk->sk_family == PF_INET) {
4147                         addr4 = (struct sockaddr_in *)address;
4148                         if (addrlen < sizeof(struct sockaddr_in))
4149                                 return -EINVAL;
4150                         snum = ntohs(addr4->sin_port);
4151                 } else {
4152                         addr6 = (struct sockaddr_in6 *)address;
4153                         if (addrlen < SIN6_LEN_RFC2133)
4154                                 return -EINVAL;
4155                         snum = ntohs(addr6->sin6_port);
4156                 }
4157
4158                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4159                 if (err)
4160                         goto out;
4161
4162                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4163                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4164
4165                 ad.type = LSM_AUDIT_DATA_NET;
4166                 ad.u.net = &net;
4167                 ad.u.net->dport = htons(snum);
4168                 ad.u.net->family = sk->sk_family;
4169                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4170                 if (err)
4171                         goto out;
4172         }
4173
4174         err = selinux_netlbl_socket_connect(sk, address);
4175
4176 out:
4177         return err;
4178 }
4179
4180 static int selinux_socket_listen(struct socket *sock, int backlog)
4181 {
4182         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4183 }
4184
4185 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4186 {
4187         int err;
4188         struct inode_security_struct *isec;
4189         struct inode_security_struct *newisec;
4190
4191         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4192         if (err)
4193                 return err;
4194
4195         newisec = SOCK_INODE(newsock)->i_security;
4196
4197         isec = SOCK_INODE(sock)->i_security;
4198         newisec->sclass = isec->sclass;
4199         newisec->sid = isec->sid;
4200         newisec->initialized = 1;
4201
4202         return 0;
4203 }
4204
4205 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4206                                   int size)
4207 {
4208         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4209 }
4210
4211 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4212                                   int size, int flags)
4213 {
4214         return sock_has_perm(current, sock->sk, SOCKET__READ);
4215 }
4216
4217 static int selinux_socket_getsockname(struct socket *sock)
4218 {
4219         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4220 }
4221
4222 static int selinux_socket_getpeername(struct socket *sock)
4223 {
4224         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4225 }
4226
4227 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4228 {
4229         int err;
4230
4231         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4232         if (err)
4233                 return err;
4234
4235         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4236 }
4237
4238 static int selinux_socket_getsockopt(struct socket *sock, int level,
4239                                      int optname)
4240 {
4241         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4242 }
4243
4244 static int selinux_socket_shutdown(struct socket *sock, int how)
4245 {
4246         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4247 }
4248
4249 static int selinux_socket_unix_stream_connect(struct sock *sock,
4250                                               struct sock *other,
4251                                               struct sock *newsk)
4252 {
4253         struct sk_security_struct *sksec_sock = sock->sk_security;
4254         struct sk_security_struct *sksec_other = other->sk_security;
4255         struct sk_security_struct *sksec_new = newsk->sk_security;
4256         struct common_audit_data ad;
4257         struct lsm_network_audit net = {0,};
4258         int err;
4259
4260         ad.type = LSM_AUDIT_DATA_NET;
4261         ad.u.net = &net;
4262         ad.u.net->sk = other;
4263
4264         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4265                            sksec_other->sclass,
4266                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4267         if (err)
4268                 return err;
4269
4270         /* server child socket */
4271         sksec_new->peer_sid = sksec_sock->sid;
4272         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4273                                     &sksec_new->sid);
4274         if (err)
4275                 return err;
4276
4277         /* connecting socket */
4278         sksec_sock->peer_sid = sksec_new->sid;
4279
4280         return 0;
4281 }
4282
4283 static int selinux_socket_unix_may_send(struct socket *sock,
4284                                         struct socket *other)
4285 {
4286         struct sk_security_struct *ssec = sock->sk->sk_security;
4287         struct sk_security_struct *osec = other->sk->sk_security;
4288         struct common_audit_data ad;
4289         struct lsm_network_audit net = {0,};
4290
4291         ad.type = LSM_AUDIT_DATA_NET;
4292         ad.u.net = &net;
4293         ad.u.net->sk = other->sk;
4294
4295         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4296                             &ad);
4297 }
4298
4299 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4300                                     char *addrp, u16 family, u32 peer_sid,
4301                                     struct common_audit_data *ad)
4302 {
4303         int err;
4304         u32 if_sid;
4305         u32 node_sid;
4306
4307         err = sel_netif_sid(ns, ifindex, &if_sid);
4308         if (err)
4309                 return err;
4310         err = avc_has_perm(peer_sid, if_sid,
4311                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4312         if (err)
4313                 return err;
4314
4315         err = sel_netnode_sid(addrp, family, &node_sid);
4316         if (err)
4317                 return err;
4318         return avc_has_perm(peer_sid, node_sid,
4319                             SECCLASS_NODE, NODE__RECVFROM, ad);
4320 }
4321
4322 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4323                                        u16 family)
4324 {
4325         int err = 0;
4326         struct sk_security_struct *sksec = sk->sk_security;
4327         u32 sk_sid = sksec->sid;
4328         struct common_audit_data ad;
4329         struct lsm_network_audit net = {0,};
4330         char *addrp;
4331
4332         ad.type = LSM_AUDIT_DATA_NET;
4333         ad.u.net = &net;
4334         ad.u.net->netif = skb->skb_iif;
4335         ad.u.net->family = family;
4336         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4337         if (err)
4338                 return err;
4339
4340         if (selinux_secmark_enabled()) {
4341                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4342                                    PACKET__RECV, &ad);
4343                 if (err)
4344                         return err;
4345         }
4346
4347         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4348         if (err)
4349                 return err;
4350         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4351
4352         return err;
4353 }
4354
4355 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4356 {
4357         int err;
4358         struct sk_security_struct *sksec = sk->sk_security;
4359         u16 family = sk->sk_family;
4360         u32 sk_sid = sksec->sid;
4361         struct common_audit_data ad;
4362         struct lsm_network_audit net = {0,};
4363         char *addrp;
4364         u8 secmark_active;
4365         u8 peerlbl_active;
4366
4367         if (family != PF_INET && family != PF_INET6)
4368                 return 0;
4369
4370         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4371         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4372                 family = PF_INET;
4373
4374         /* If any sort of compatibility mode is enabled then handoff processing
4375          * to the selinux_sock_rcv_skb_compat() function to deal with the
4376          * special handling.  We do this in an attempt to keep this function
4377          * as fast and as clean as possible. */
4378         if (!selinux_policycap_netpeer)
4379                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4380
4381         secmark_active = selinux_secmark_enabled();
4382         peerlbl_active = selinux_peerlbl_enabled();
4383         if (!secmark_active && !peerlbl_active)
4384                 return 0;
4385
4386         ad.type = LSM_AUDIT_DATA_NET;
4387         ad.u.net = &net;
4388         ad.u.net->netif = skb->skb_iif;
4389         ad.u.net->family = family;
4390         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4391         if (err)
4392                 return err;
4393
4394         if (peerlbl_active) {
4395                 u32 peer_sid;
4396
4397                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4398                 if (err)
4399                         return err;
4400                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4401                                                addrp, family, peer_sid, &ad);
4402                 if (err) {
4403                         selinux_netlbl_err(skb, err, 0);
4404                         return err;
4405                 }
4406                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4407                                    PEER__RECV, &ad);
4408                 if (err) {
4409                         selinux_netlbl_err(skb, err, 0);
4410                         return err;
4411                 }
4412         }
4413
4414         if (secmark_active) {
4415                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4416                                    PACKET__RECV, &ad);
4417                 if (err)
4418                         return err;
4419         }
4420
4421         return err;
4422 }
4423
4424 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4425                                             int __user *optlen, unsigned len)
4426 {
4427         int err = 0;
4428         char *scontext;
4429         u32 scontext_len;
4430         struct sk_security_struct *sksec = sock->sk->sk_security;
4431         u32 peer_sid = SECSID_NULL;
4432
4433         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4434             sksec->sclass == SECCLASS_TCP_SOCKET)
4435                 peer_sid = sksec->peer_sid;
4436         if (peer_sid == SECSID_NULL)
4437                 return -ENOPROTOOPT;
4438
4439         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4440         if (err)
4441                 return err;
4442
4443         if (scontext_len > len) {
4444                 err = -ERANGE;
4445                 goto out_len;
4446         }
4447
4448         if (copy_to_user(optval, scontext, scontext_len))
4449                 err = -EFAULT;
4450
4451 out_len:
4452         if (put_user(scontext_len, optlen))
4453                 err = -EFAULT;
4454         kfree(scontext);
4455         return err;
4456 }
4457
4458 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4459 {
4460         u32 peer_secid = SECSID_NULL;
4461         u16 family;
4462
4463         if (skb && skb->protocol == htons(ETH_P_IP))
4464                 family = PF_INET;
4465         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4466                 family = PF_INET6;
4467         else if (sock)
4468                 family = sock->sk->sk_family;
4469         else
4470                 goto out;
4471
4472         if (sock && family == PF_UNIX)
4473                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4474         else if (skb)
4475                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4476
4477 out:
4478         *secid = peer_secid;
4479         if (peer_secid == SECSID_NULL)
4480                 return -EINVAL;
4481         return 0;
4482 }
4483
4484 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4485 {
4486         struct sk_security_struct *sksec;
4487
4488         sksec = kzalloc(sizeof(*sksec), priority);
4489         if (!sksec)
4490                 return -ENOMEM;
4491
4492         sksec->peer_sid = SECINITSID_UNLABELED;
4493         sksec->sid = SECINITSID_UNLABELED;
4494         selinux_netlbl_sk_security_reset(sksec);
4495         sk->sk_security = sksec;
4496
4497         return 0;
4498 }
4499
4500 static void selinux_sk_free_security(struct sock *sk)
4501 {
4502         struct sk_security_struct *sksec = sk->sk_security;
4503
4504         sk->sk_security = NULL;
4505         selinux_netlbl_sk_security_free(sksec);
4506         kfree(sksec);
4507 }
4508
4509 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4510 {
4511         struct sk_security_struct *sksec = sk->sk_security;
4512         struct sk_security_struct *newsksec = newsk->sk_security;
4513
4514         newsksec->sid = sksec->sid;
4515         newsksec->peer_sid = sksec->peer_sid;
4516         newsksec->sclass = sksec->sclass;
4517
4518         selinux_netlbl_sk_security_reset(newsksec);
4519 }
4520
4521 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4522 {
4523         if (!sk)
4524                 *secid = SECINITSID_ANY_SOCKET;
4525         else {
4526                 struct sk_security_struct *sksec = sk->sk_security;
4527
4528                 *secid = sksec->sid;
4529         }
4530 }
4531
4532 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4533 {
4534         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4535         struct sk_security_struct *sksec = sk->sk_security;
4536
4537         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4538             sk->sk_family == PF_UNIX)
4539                 isec->sid = sksec->sid;
4540         sksec->sclass = isec->sclass;
4541 }
4542
4543 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4544                                      struct request_sock *req)
4545 {
4546         struct sk_security_struct *sksec = sk->sk_security;
4547         int err;
4548         u16 family = req->rsk_ops->family;
4549         u32 connsid;
4550         u32 peersid;
4551
4552         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4553         if (err)
4554                 return err;
4555         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4556         if (err)
4557                 return err;
4558         req->secid = connsid;
4559         req->peer_secid = peersid;
4560
4561         return selinux_netlbl_inet_conn_request(req, family);
4562 }
4563
4564 static void selinux_inet_csk_clone(struct sock *newsk,
4565                                    const struct request_sock *req)
4566 {
4567         struct sk_security_struct *newsksec = newsk->sk_security;
4568
4569         newsksec->sid = req->secid;
4570         newsksec->peer_sid = req->peer_secid;
4571         /* NOTE: Ideally, we should also get the isec->sid for the
4572            new socket in sync, but we don't have the isec available yet.
4573            So we will wait until sock_graft to do it, by which
4574            time it will have been created and available. */
4575
4576         /* We don't need to take any sort of lock here as we are the only
4577          * thread with access to newsksec */
4578         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4579 }
4580
4581 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4582 {
4583         u16 family = sk->sk_family;
4584         struct sk_security_struct *sksec = sk->sk_security;
4585
4586         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4587         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4588                 family = PF_INET;
4589
4590         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4591 }
4592
4593 static int selinux_secmark_relabel_packet(u32 sid)
4594 {
4595         const struct task_security_struct *__tsec;
4596         u32 tsid;
4597
4598         __tsec = current_security();
4599         tsid = __tsec->sid;
4600
4601         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4602 }
4603
4604 static void selinux_secmark_refcount_inc(void)
4605 {
4606         atomic_inc(&selinux_secmark_refcount);
4607 }
4608
4609 static void selinux_secmark_refcount_dec(void)
4610 {
4611         atomic_dec(&selinux_secmark_refcount);
4612 }
4613
4614 static void selinux_req_classify_flow(const struct request_sock *req,
4615                                       struct flowi *fl)
4616 {
4617         fl->flowi_secid = req->secid;
4618 }
4619
4620 static int selinux_tun_dev_alloc_security(void **security)
4621 {
4622         struct tun_security_struct *tunsec;
4623
4624         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4625         if (!tunsec)
4626                 return -ENOMEM;
4627         tunsec->sid = current_sid();
4628
4629         *security = tunsec;
4630         return 0;
4631 }
4632
4633 static void selinux_tun_dev_free_security(void *security)
4634 {
4635         kfree(security);
4636 }
4637
4638 static int selinux_tun_dev_create(void)
4639 {
4640         u32 sid = current_sid();
4641
4642         /* we aren't taking into account the "sockcreate" SID since the socket
4643          * that is being created here is not a socket in the traditional sense,
4644          * instead it is a private sock, accessible only to the kernel, and
4645          * representing a wide range of network traffic spanning multiple
4646          * connections unlike traditional sockets - check the TUN driver to
4647          * get a better understanding of why this socket is special */
4648
4649         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4650                             NULL);
4651 }
4652
4653 static int selinux_tun_dev_attach_queue(void *security)
4654 {
4655         struct tun_security_struct *tunsec = security;
4656
4657         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4658                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4659 }
4660
4661 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4662 {
4663         struct tun_security_struct *tunsec = security;
4664         struct sk_security_struct *sksec = sk->sk_security;
4665
4666         /* we don't currently perform any NetLabel based labeling here and it
4667          * isn't clear that we would want to do so anyway; while we could apply
4668          * labeling without the support of the TUN user the resulting labeled
4669          * traffic from the other end of the connection would almost certainly
4670          * cause confusion to the TUN user that had no idea network labeling
4671          * protocols were being used */
4672
4673         sksec->sid = tunsec->sid;
4674         sksec->sclass = SECCLASS_TUN_SOCKET;
4675
4676         return 0;
4677 }
4678
4679 static int selinux_tun_dev_open(void *security)
4680 {
4681         struct tun_security_struct *tunsec = security;
4682         u32 sid = current_sid();
4683         int err;
4684
4685         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4686                            TUN_SOCKET__RELABELFROM, NULL);
4687         if (err)
4688                 return err;
4689         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4690                            TUN_SOCKET__RELABELTO, NULL);
4691         if (err)
4692                 return err;
4693         tunsec->sid = sid;
4694
4695         return 0;
4696 }
4697
4698 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4699 {
4700         int err = 0;
4701         u32 perm;
4702         struct nlmsghdr *nlh;
4703         struct sk_security_struct *sksec = sk->sk_security;
4704
4705         if (skb->len < NLMSG_HDRLEN) {
4706                 err = -EINVAL;
4707                 goto out;
4708         }
4709         nlh = nlmsg_hdr(skb);
4710
4711         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4712         if (err) {
4713                 if (err == -EINVAL) {
4714                         printk(KERN_WARNING
4715                                "SELinux: unrecognized netlink message:"
4716                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4717                                sk->sk_protocol, nlh->nlmsg_type,
4718                                secclass_map[sksec->sclass - 1].name);
4719                         if (!selinux_enforcing || security_get_allow_unknown())
4720                                 err = 0;
4721                 }
4722
4723                 /* Ignore */
4724                 if (err == -ENOENT)
4725                         err = 0;
4726                 goto out;
4727         }
4728
4729         err = sock_has_perm(current, sk, perm);
4730 out:
4731         return err;
4732 }
4733
4734 #ifdef CONFIG_NETFILTER
4735
4736 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4737                                        const struct net_device *indev,
4738                                        u16 family)
4739 {
4740         int err;
4741         char *addrp;
4742         u32 peer_sid;
4743         struct common_audit_data ad;
4744         struct lsm_network_audit net = {0,};
4745         u8 secmark_active;
4746         u8 netlbl_active;
4747         u8 peerlbl_active;
4748
4749         if (!selinux_policycap_netpeer)
4750                 return NF_ACCEPT;
4751
4752         secmark_active = selinux_secmark_enabled();
4753         netlbl_active = netlbl_enabled();
4754         peerlbl_active = selinux_peerlbl_enabled();
4755         if (!secmark_active && !peerlbl_active)
4756                 return NF_ACCEPT;
4757
4758         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4759                 return NF_DROP;
4760
4761         ad.type = LSM_AUDIT_DATA_NET;
4762         ad.u.net = &net;
4763         ad.u.net->netif = indev->ifindex;
4764         ad.u.net->family = family;
4765         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4766                 return NF_DROP;
4767
4768         if (peerlbl_active) {
4769                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4770                                                addrp, family, peer_sid, &ad);
4771                 if (err) {
4772                         selinux_netlbl_err(skb, err, 1);
4773                         return NF_DROP;
4774                 }
4775         }
4776
4777         if (secmark_active)
4778                 if (avc_has_perm(peer_sid, skb->secmark,
4779                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4780                         return NF_DROP;
4781
4782         if (netlbl_active)
4783                 /* we do this in the FORWARD path and not the POST_ROUTING
4784                  * path because we want to make sure we apply the necessary
4785                  * labeling before IPsec is applied so we can leverage AH
4786                  * protection */
4787                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4788                         return NF_DROP;
4789
4790         return NF_ACCEPT;
4791 }
4792
4793 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4794                                          struct sk_buff *skb,
4795                                          const struct nf_hook_state *state)
4796 {
4797         return selinux_ip_forward(skb, state->in, PF_INET);
4798 }
4799
4800 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4801 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4802                                          struct sk_buff *skb,
4803                                          const struct nf_hook_state *state)
4804 {
4805         return selinux_ip_forward(skb, state->in, PF_INET6);
4806 }
4807 #endif  /* IPV6 */
4808
4809 static unsigned int selinux_ip_output(struct sk_buff *skb,
4810                                       u16 family)
4811 {
4812         struct sock *sk;
4813         u32 sid;
4814
4815         if (!netlbl_enabled())
4816                 return NF_ACCEPT;
4817
4818         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4819          * because we want to make sure we apply the necessary labeling
4820          * before IPsec is applied so we can leverage AH protection */
4821         sk = skb->sk;
4822         if (sk) {
4823                 struct sk_security_struct *sksec;
4824
4825                 if (sk->sk_state == TCP_LISTEN)
4826                         /* if the socket is the listening state then this
4827                          * packet is a SYN-ACK packet which means it needs to
4828                          * be labeled based on the connection/request_sock and
4829                          * not the parent socket.  unfortunately, we can't
4830                          * lookup the request_sock yet as it isn't queued on
4831                          * the parent socket until after the SYN-ACK is sent.
4832                          * the "solution" is to simply pass the packet as-is
4833                          * as any IP option based labeling should be copied
4834                          * from the initial connection request (in the IP
4835                          * layer).  it is far from ideal, but until we get a
4836                          * security label in the packet itself this is the
4837                          * best we can do. */
4838                         return NF_ACCEPT;
4839
4840                 /* standard practice, label using the parent socket */
4841                 sksec = sk->sk_security;
4842                 sid = sksec->sid;
4843         } else
4844                 sid = SECINITSID_KERNEL;
4845         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4846                 return NF_DROP;
4847
4848         return NF_ACCEPT;
4849 }
4850
4851 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4852                                         struct sk_buff *skb,
4853                                         const struct nf_hook_state *state)
4854 {
4855         return selinux_ip_output(skb, PF_INET);
4856 }
4857
4858 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4859                                                 int ifindex,
4860                                                 u16 family)
4861 {
4862         struct sock *sk = skb->sk;
4863         struct sk_security_struct *sksec;
4864         struct common_audit_data ad;
4865         struct lsm_network_audit net = {0,};
4866         char *addrp;
4867         u8 proto;
4868
4869         if (sk == NULL)
4870                 return NF_ACCEPT;
4871         sksec = sk->sk_security;
4872
4873         ad.type = LSM_AUDIT_DATA_NET;
4874         ad.u.net = &net;
4875         ad.u.net->netif = ifindex;
4876         ad.u.net->family = family;
4877         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4878                 return NF_DROP;
4879
4880         if (selinux_secmark_enabled())
4881                 if (avc_has_perm(sksec->sid, skb->secmark,
4882                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4883                         return NF_DROP_ERR(-ECONNREFUSED);
4884
4885         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4886                 return NF_DROP_ERR(-ECONNREFUSED);
4887
4888         return NF_ACCEPT;
4889 }
4890
4891 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4892                                          const struct net_device *outdev,
4893                                          u16 family)
4894 {
4895         u32 secmark_perm;
4896         u32 peer_sid;
4897         int ifindex = outdev->ifindex;
4898         struct sock *sk;
4899         struct common_audit_data ad;
4900         struct lsm_network_audit net = {0,};
4901         char *addrp;
4902         u8 secmark_active;
4903         u8 peerlbl_active;
4904
4905         /* If any sort of compatibility mode is enabled then handoff processing
4906          * to the selinux_ip_postroute_compat() function to deal with the
4907          * special handling.  We do this in an attempt to keep this function
4908          * as fast and as clean as possible. */
4909         if (!selinux_policycap_netpeer)
4910                 return selinux_ip_postroute_compat(skb, ifindex, family);
4911
4912         secmark_active = selinux_secmark_enabled();
4913         peerlbl_active = selinux_peerlbl_enabled();
4914         if (!secmark_active && !peerlbl_active)
4915                 return NF_ACCEPT;
4916
4917         sk = skb->sk;
4918
4919 #ifdef CONFIG_XFRM
4920         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4921          * packet transformation so allow the packet to pass without any checks
4922          * since we'll have another chance to perform access control checks
4923          * when the packet is on it's final way out.
4924          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4925          *       is NULL, in this case go ahead and apply access control.
4926          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4927          *       TCP listening state we cannot wait until the XFRM processing
4928          *       is done as we will miss out on the SA label if we do;
4929          *       unfortunately, this means more work, but it is only once per
4930          *       connection. */
4931         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4932             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4933                 return NF_ACCEPT;
4934 #endif
4935
4936         if (sk == NULL) {
4937                 /* Without an associated socket the packet is either coming
4938                  * from the kernel or it is being forwarded; check the packet
4939                  * to determine which and if the packet is being forwarded
4940                  * query the packet directly to determine the security label. */
4941                 if (skb->skb_iif) {
4942                         secmark_perm = PACKET__FORWARD_OUT;
4943                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4944                                 return NF_DROP;
4945                 } else {
4946                         secmark_perm = PACKET__SEND;
4947                         peer_sid = SECINITSID_KERNEL;
4948                 }
4949         } else if (sk->sk_state == TCP_LISTEN) {
4950                 /* Locally generated packet but the associated socket is in the
4951                  * listening state which means this is a SYN-ACK packet.  In
4952                  * this particular case the correct security label is assigned
4953                  * to the connection/request_sock but unfortunately we can't
4954                  * query the request_sock as it isn't queued on the parent
4955                  * socket until after the SYN-ACK packet is sent; the only
4956                  * viable choice is to regenerate the label like we do in
4957                  * selinux_inet_conn_request().  See also selinux_ip_output()
4958                  * for similar problems. */
4959                 u32 skb_sid;
4960                 struct sk_security_struct *sksec = sk->sk_security;
4961                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4962                         return NF_DROP;
4963                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4964                  * and the packet has been through at least one XFRM
4965                  * transformation then we must be dealing with the "final"
4966                  * form of labeled IPsec packet; since we've already applied
4967                  * all of our access controls on this packet we can safely
4968                  * pass the packet. */
4969                 if (skb_sid == SECSID_NULL) {
4970                         switch (family) {
4971                         case PF_INET:
4972                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4973                                         return NF_ACCEPT;
4974                                 break;
4975                         case PF_INET6:
4976                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4977                                         return NF_ACCEPT;
4978                                 break;
4979                         default:
4980                                 return NF_DROP_ERR(-ECONNREFUSED);
4981                         }
4982                 }
4983                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4984                         return NF_DROP;
4985                 secmark_perm = PACKET__SEND;
4986         } else {
4987                 /* Locally generated packet, fetch the security label from the
4988                  * associated socket. */
4989                 struct sk_security_struct *sksec = sk->sk_security;
4990                 peer_sid = sksec->sid;
4991                 secmark_perm = PACKET__SEND;
4992         }
4993
4994         ad.type = LSM_AUDIT_DATA_NET;
4995         ad.u.net = &net;
4996         ad.u.net->netif = ifindex;
4997         ad.u.net->family = family;
4998         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4999                 return NF_DROP;
5000
5001         if (secmark_active)
5002                 if (avc_has_perm(peer_sid, skb->secmark,
5003                                  SECCLASS_PACKET, secmark_perm, &ad))
5004                         return NF_DROP_ERR(-ECONNREFUSED);
5005
5006         if (peerlbl_active) {
5007                 u32 if_sid;
5008                 u32 node_sid;
5009
5010                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5011                         return NF_DROP;
5012                 if (avc_has_perm(peer_sid, if_sid,
5013                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5014                         return NF_DROP_ERR(-ECONNREFUSED);
5015
5016                 if (sel_netnode_sid(addrp, family, &node_sid))
5017                         return NF_DROP;
5018                 if (avc_has_perm(peer_sid, node_sid,
5019                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5020                         return NF_DROP_ERR(-ECONNREFUSED);
5021         }
5022
5023         return NF_ACCEPT;
5024 }
5025
5026 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5027                                            struct sk_buff *skb,
5028                                            const struct nf_hook_state *state)
5029 {
5030         return selinux_ip_postroute(skb, state->out, PF_INET);
5031 }
5032
5033 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5034 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5035                                            struct sk_buff *skb,
5036                                            const struct nf_hook_state *state)
5037 {
5038         return selinux_ip_postroute(skb, state->out, PF_INET6);
5039 }
5040 #endif  /* IPV6 */
5041
5042 #endif  /* CONFIG_NETFILTER */
5043
5044 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5045 {
5046         return selinux_nlmsg_perm(sk, skb);
5047 }
5048
5049 static int ipc_alloc_security(struct task_struct *task,
5050                               struct kern_ipc_perm *perm,
5051                               u16 sclass)
5052 {
5053         struct ipc_security_struct *isec;
5054         u32 sid;
5055
5056         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5057         if (!isec)
5058                 return -ENOMEM;
5059
5060         sid = task_sid(task);
5061         isec->sclass = sclass;
5062         isec->sid = sid;
5063         perm->security = isec;
5064
5065         return 0;
5066 }
5067
5068 static void ipc_free_security(struct kern_ipc_perm *perm)
5069 {
5070         struct ipc_security_struct *isec = perm->security;
5071         perm->security = NULL;
5072         kfree(isec);
5073 }
5074
5075 static int msg_msg_alloc_security(struct msg_msg *msg)
5076 {
5077         struct msg_security_struct *msec;
5078
5079         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5080         if (!msec)
5081                 return -ENOMEM;
5082
5083         msec->sid = SECINITSID_UNLABELED;
5084         msg->security = msec;
5085
5086         return 0;
5087 }
5088
5089 static void msg_msg_free_security(struct msg_msg *msg)
5090 {
5091         struct msg_security_struct *msec = msg->security;
5092
5093         msg->security = NULL;
5094         kfree(msec);
5095 }
5096
5097 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5098                         u32 perms)
5099 {
5100         struct ipc_security_struct *isec;
5101         struct common_audit_data ad;
5102         u32 sid = current_sid();
5103
5104         isec = ipc_perms->security;
5105
5106         ad.type = LSM_AUDIT_DATA_IPC;
5107         ad.u.ipc_id = ipc_perms->key;
5108
5109         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5110 }
5111
5112 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5113 {
5114         return msg_msg_alloc_security(msg);
5115 }
5116
5117 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5118 {
5119         msg_msg_free_security(msg);
5120 }
5121
5122 /* message queue security operations */
5123 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5124 {
5125         struct ipc_security_struct *isec;
5126         struct common_audit_data ad;
5127         u32 sid = current_sid();
5128         int rc;
5129
5130         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5131         if (rc)
5132                 return rc;
5133
5134         isec = msq->q_perm.security;
5135
5136         ad.type = LSM_AUDIT_DATA_IPC;
5137         ad.u.ipc_id = msq->q_perm.key;
5138
5139         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5140                           MSGQ__CREATE, &ad);
5141         if (rc) {
5142                 ipc_free_security(&msq->q_perm);
5143                 return rc;
5144         }
5145         return 0;
5146 }
5147
5148 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5149 {
5150         ipc_free_security(&msq->q_perm);
5151 }
5152
5153 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5154 {
5155         struct ipc_security_struct *isec;
5156         struct common_audit_data ad;
5157         u32 sid = current_sid();
5158
5159         isec = msq->q_perm.security;
5160
5161         ad.type = LSM_AUDIT_DATA_IPC;
5162         ad.u.ipc_id = msq->q_perm.key;
5163
5164         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5165                             MSGQ__ASSOCIATE, &ad);
5166 }
5167
5168 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5169 {
5170         int err;
5171         int perms;
5172
5173         switch (cmd) {
5174         case IPC_INFO:
5175         case MSG_INFO:
5176                 /* No specific object, just general system-wide information. */
5177                 return task_has_system(current, SYSTEM__IPC_INFO);
5178         case IPC_STAT:
5179         case MSG_STAT:
5180                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5181                 break;
5182         case IPC_SET:
5183                 perms = MSGQ__SETATTR;
5184                 break;
5185         case IPC_RMID:
5186                 perms = MSGQ__DESTROY;
5187                 break;
5188         default:
5189                 return 0;
5190         }
5191
5192         err = ipc_has_perm(&msq->q_perm, perms);
5193         return err;
5194 }
5195
5196 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5197 {
5198         struct ipc_security_struct *isec;
5199         struct msg_security_struct *msec;
5200         struct common_audit_data ad;
5201         u32 sid = current_sid();
5202         int rc;
5203
5204         isec = msq->q_perm.security;
5205         msec = msg->security;
5206
5207         /*
5208          * First time through, need to assign label to the message
5209          */
5210         if (msec->sid == SECINITSID_UNLABELED) {
5211                 /*
5212                  * Compute new sid based on current process and
5213                  * message queue this message will be stored in
5214                  */
5215                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5216                                              NULL, &msec->sid);
5217                 if (rc)
5218                         return rc;
5219         }
5220
5221         ad.type = LSM_AUDIT_DATA_IPC;
5222         ad.u.ipc_id = msq->q_perm.key;
5223
5224         /* Can this process write to the queue? */
5225         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5226                           MSGQ__WRITE, &ad);
5227         if (!rc)
5228                 /* Can this process send the message */
5229                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5230                                   MSG__SEND, &ad);
5231         if (!rc)
5232                 /* Can the message be put in the queue? */
5233                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5234                                   MSGQ__ENQUEUE, &ad);
5235
5236         return rc;
5237 }
5238
5239 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5240                                     struct task_struct *target,
5241                                     long type, int mode)
5242 {
5243         struct ipc_security_struct *isec;
5244         struct msg_security_struct *msec;
5245         struct common_audit_data ad;
5246         u32 sid = task_sid(target);
5247         int rc;
5248
5249         isec = msq->q_perm.security;
5250         msec = msg->security;
5251
5252         ad.type = LSM_AUDIT_DATA_IPC;
5253         ad.u.ipc_id = msq->q_perm.key;
5254
5255         rc = avc_has_perm(sid, isec->sid,
5256                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5257         if (!rc)
5258                 rc = avc_has_perm(sid, msec->sid,
5259                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5260         return rc;
5261 }
5262
5263 /* Shared Memory security operations */
5264 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5265 {
5266         struct ipc_security_struct *isec;
5267         struct common_audit_data ad;
5268         u32 sid = current_sid();
5269         int rc;
5270
5271         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5272         if (rc)
5273                 return rc;
5274
5275         isec = shp->shm_perm.security;
5276
5277         ad.type = LSM_AUDIT_DATA_IPC;
5278         ad.u.ipc_id = shp->shm_perm.key;
5279
5280         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5281                           SHM__CREATE, &ad);
5282         if (rc) {
5283                 ipc_free_security(&shp->shm_perm);
5284                 return rc;
5285         }
5286         return 0;
5287 }
5288
5289 static void selinux_shm_free_security(struct shmid_kernel *shp)
5290 {
5291         ipc_free_security(&shp->shm_perm);
5292 }
5293
5294 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5295 {
5296         struct ipc_security_struct *isec;
5297         struct common_audit_data ad;
5298         u32 sid = current_sid();
5299
5300         isec = shp->shm_perm.security;
5301
5302         ad.type = LSM_AUDIT_DATA_IPC;
5303         ad.u.ipc_id = shp->shm_perm.key;
5304
5305         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5306                             SHM__ASSOCIATE, &ad);
5307 }
5308
5309 /* Note, at this point, shp is locked down */
5310 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5311 {
5312         int perms;
5313         int err;
5314
5315         switch (cmd) {
5316         case IPC_INFO:
5317         case SHM_INFO:
5318                 /* No specific object, just general system-wide information. */
5319                 return task_has_system(current, SYSTEM__IPC_INFO);
5320         case IPC_STAT:
5321         case SHM_STAT:
5322                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5323                 break;
5324         case IPC_SET:
5325                 perms = SHM__SETATTR;
5326                 break;
5327         case SHM_LOCK:
5328         case SHM_UNLOCK:
5329                 perms = SHM__LOCK;
5330                 break;
5331         case IPC_RMID:
5332                 perms = SHM__DESTROY;
5333                 break;
5334         default:
5335                 return 0;
5336         }
5337
5338         err = ipc_has_perm(&shp->shm_perm, perms);
5339         return err;
5340 }
5341
5342 static int selinux_shm_shmat(struct shmid_kernel *shp,
5343                              char __user *shmaddr, int shmflg)
5344 {
5345         u32 perms;
5346
5347         if (shmflg & SHM_RDONLY)
5348                 perms = SHM__READ;
5349         else
5350                 perms = SHM__READ | SHM__WRITE;
5351
5352         return ipc_has_perm(&shp->shm_perm, perms);
5353 }
5354
5355 /* Semaphore security operations */
5356 static int selinux_sem_alloc_security(struct sem_array *sma)
5357 {
5358         struct ipc_security_struct *isec;
5359         struct common_audit_data ad;
5360         u32 sid = current_sid();
5361         int rc;
5362
5363         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5364         if (rc)
5365                 return rc;
5366
5367         isec = sma->sem_perm.security;
5368
5369         ad.type = LSM_AUDIT_DATA_IPC;
5370         ad.u.ipc_id = sma->sem_perm.key;
5371
5372         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5373                           SEM__CREATE, &ad);
5374         if (rc) {
5375                 ipc_free_security(&sma->sem_perm);
5376                 return rc;
5377         }
5378         return 0;
5379 }
5380
5381 static void selinux_sem_free_security(struct sem_array *sma)
5382 {
5383         ipc_free_security(&sma->sem_perm);
5384 }
5385
5386 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5387 {
5388         struct ipc_security_struct *isec;
5389         struct common_audit_data ad;
5390         u32 sid = current_sid();
5391
5392         isec = sma->sem_perm.security;
5393
5394         ad.type = LSM_AUDIT_DATA_IPC;
5395         ad.u.ipc_id = sma->sem_perm.key;
5396
5397         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5398                             SEM__ASSOCIATE, &ad);
5399 }
5400
5401 /* Note, at this point, sma is locked down */
5402 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5403 {
5404         int err;
5405         u32 perms;
5406
5407         switch (cmd) {
5408         case IPC_INFO:
5409         case SEM_INFO:
5410                 /* No specific object, just general system-wide information. */
5411                 return task_has_system(current, SYSTEM__IPC_INFO);
5412         case GETPID:
5413         case GETNCNT:
5414         case GETZCNT:
5415                 perms = SEM__GETATTR;
5416                 break;
5417         case GETVAL:
5418         case GETALL:
5419                 perms = SEM__READ;
5420                 break;
5421         case SETVAL:
5422         case SETALL:
5423                 perms = SEM__WRITE;
5424                 break;
5425         case IPC_RMID:
5426                 perms = SEM__DESTROY;
5427                 break;
5428         case IPC_SET:
5429                 perms = SEM__SETATTR;
5430                 break;
5431         case IPC_STAT:
5432         case SEM_STAT:
5433                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5434                 break;
5435         default:
5436                 return 0;
5437         }
5438
5439         err = ipc_has_perm(&sma->sem_perm, perms);
5440         return err;
5441 }
5442
5443 static int selinux_sem_semop(struct sem_array *sma,
5444                              struct sembuf *sops, unsigned nsops, int alter)
5445 {
5446         u32 perms;
5447
5448         if (alter)
5449                 perms = SEM__READ | SEM__WRITE;
5450         else
5451                 perms = SEM__READ;
5452
5453         return ipc_has_perm(&sma->sem_perm, perms);
5454 }
5455
5456 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5457 {
5458         u32 av = 0;
5459
5460         av = 0;
5461         if (flag & S_IRUGO)
5462                 av |= IPC__UNIX_READ;
5463         if (flag & S_IWUGO)
5464                 av |= IPC__UNIX_WRITE;
5465
5466         if (av == 0)
5467                 return 0;
5468
5469         return ipc_has_perm(ipcp, av);
5470 }
5471
5472 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5473 {
5474         struct ipc_security_struct *isec = ipcp->security;
5475         *secid = isec->sid;
5476 }
5477
5478 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5479 {
5480         if (inode)
5481                 inode_doinit_with_dentry(inode, dentry);
5482 }
5483
5484 static int selinux_getprocattr(struct task_struct *p,
5485                                char *name, char **value)
5486 {
5487         const struct task_security_struct *__tsec;
5488         u32 sid;
5489         int error;
5490         unsigned len;
5491
5492         if (current != p) {
5493                 error = current_has_perm(p, PROCESS__GETATTR);
5494                 if (error)
5495                         return error;
5496         }
5497
5498         rcu_read_lock();
5499         __tsec = __task_cred(p)->security;
5500
5501         if (!strcmp(name, "current"))
5502                 sid = __tsec->sid;
5503         else if (!strcmp(name, "prev"))
5504                 sid = __tsec->osid;
5505         else if (!strcmp(name, "exec"))
5506                 sid = __tsec->exec_sid;
5507         else if (!strcmp(name, "fscreate"))
5508                 sid = __tsec->create_sid;
5509         else if (!strcmp(name, "keycreate"))
5510                 sid = __tsec->keycreate_sid;
5511         else if (!strcmp(name, "sockcreate"))
5512                 sid = __tsec->sockcreate_sid;
5513         else
5514                 goto invalid;
5515         rcu_read_unlock();
5516
5517         if (!sid)
5518                 return 0;
5519
5520         error = security_sid_to_context(sid, value, &len);
5521         if (error)
5522                 return error;
5523         return len;
5524
5525 invalid:
5526         rcu_read_unlock();
5527         return -EINVAL;
5528 }
5529
5530 static int selinux_setprocattr(struct task_struct *p,
5531                                char *name, void *value, size_t size)
5532 {
5533         struct task_security_struct *tsec;
5534         struct task_struct *tracer;
5535         struct cred *new;
5536         u32 sid = 0, ptsid;
5537         int error;
5538         char *str = value;
5539
5540         if (current != p) {
5541                 /* SELinux only allows a process to change its own
5542                    security attributes. */
5543                 return -EACCES;
5544         }
5545
5546         /*
5547          * Basic control over ability to set these attributes at all.
5548          * current == p, but we'll pass them separately in case the
5549          * above restriction is ever removed.
5550          */
5551         if (!strcmp(name, "exec"))
5552                 error = current_has_perm(p, PROCESS__SETEXEC);
5553         else if (!strcmp(name, "fscreate"))
5554                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5555         else if (!strcmp(name, "keycreate"))
5556                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5557         else if (!strcmp(name, "sockcreate"))
5558                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5559         else if (!strcmp(name, "current"))
5560                 error = current_has_perm(p, PROCESS__SETCURRENT);
5561         else
5562                 error = -EINVAL;
5563         if (error)
5564                 return error;
5565
5566         /* Obtain a SID for the context, if one was specified. */
5567         if (size && str[1] && str[1] != '\n') {
5568                 if (str[size-1] == '\n') {
5569                         str[size-1] = 0;
5570                         size--;
5571                 }
5572                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5573                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5574                         if (!capable(CAP_MAC_ADMIN)) {
5575                                 struct audit_buffer *ab;
5576                                 size_t audit_size;
5577
5578                                 /* We strip a nul only if it is at the end, otherwise the
5579                                  * context contains a nul and we should audit that */
5580                                 if (str[size - 1] == '\0')
5581                                         audit_size = size - 1;
5582                                 else
5583                                         audit_size = size;
5584                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5585                                 audit_log_format(ab, "op=fscreate invalid_context=");
5586                                 audit_log_n_untrustedstring(ab, value, audit_size);
5587                                 audit_log_end(ab);
5588
5589                                 return error;
5590                         }
5591                         error = security_context_to_sid_force(value, size,
5592                                                               &sid);
5593                 }
5594                 if (error)
5595                         return error;
5596         }
5597
5598         new = prepare_creds();
5599         if (!new)
5600                 return -ENOMEM;
5601
5602         /* Permission checking based on the specified context is
5603            performed during the actual operation (execve,
5604            open/mkdir/...), when we know the full context of the
5605            operation.  See selinux_bprm_set_creds for the execve
5606            checks and may_create for the file creation checks. The
5607            operation will then fail if the context is not permitted. */
5608         tsec = new->security;
5609         if (!strcmp(name, "exec")) {
5610                 tsec->exec_sid = sid;
5611         } else if (!strcmp(name, "fscreate")) {
5612                 tsec->create_sid = sid;
5613         } else if (!strcmp(name, "keycreate")) {
5614                 error = may_create_key(sid, p);
5615                 if (error)
5616                         goto abort_change;
5617                 tsec->keycreate_sid = sid;
5618         } else if (!strcmp(name, "sockcreate")) {
5619                 tsec->sockcreate_sid = sid;
5620         } else if (!strcmp(name, "current")) {
5621                 error = -EINVAL;
5622                 if (sid == 0)
5623                         goto abort_change;
5624
5625                 /* Only allow single threaded processes to change context */
5626                 error = -EPERM;
5627                 if (!current_is_single_threaded()) {
5628                         error = security_bounded_transition(tsec->sid, sid);
5629                         if (error)
5630                                 goto abort_change;
5631                 }
5632
5633                 /* Check permissions for the transition. */
5634                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5635                                      PROCESS__DYNTRANSITION, NULL);
5636                 if (error)
5637                         goto abort_change;
5638
5639                 /* Check for ptracing, and update the task SID if ok.
5640                    Otherwise, leave SID unchanged and fail. */
5641                 ptsid = 0;
5642                 rcu_read_lock();
5643                 tracer = ptrace_parent(p);
5644                 if (tracer)
5645                         ptsid = task_sid(tracer);
5646                 rcu_read_unlock();
5647
5648                 if (tracer) {
5649                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5650                                              PROCESS__PTRACE, NULL);
5651                         if (error)
5652                                 goto abort_change;
5653                 }
5654
5655                 tsec->sid = sid;
5656         } else {
5657                 error = -EINVAL;
5658                 goto abort_change;
5659         }
5660
5661         commit_creds(new);
5662         return size;
5663
5664 abort_change:
5665         abort_creds(new);
5666         return error;
5667 }
5668
5669 static int selinux_ismaclabel(const char *name)
5670 {
5671         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5672 }
5673
5674 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5675 {
5676         return security_sid_to_context(secid, secdata, seclen);
5677 }
5678
5679 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5680 {
5681         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5682 }
5683
5684 static void selinux_release_secctx(char *secdata, u32 seclen)
5685 {
5686         kfree(secdata);
5687 }
5688
5689 /*
5690  *      called with inode->i_mutex locked
5691  */
5692 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5693 {
5694         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5695 }
5696
5697 /*
5698  *      called with inode->i_mutex locked
5699  */
5700 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5701 {
5702         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5703 }
5704
5705 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5706 {
5707         int len = 0;
5708         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5709                                                 ctx, true);
5710         if (len < 0)
5711                 return len;
5712         *ctxlen = len;
5713         return 0;
5714 }
5715 #ifdef CONFIG_KEYS
5716
5717 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5718                              unsigned long flags)
5719 {
5720         const struct task_security_struct *tsec;
5721         struct key_security_struct *ksec;
5722
5723         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5724         if (!ksec)
5725                 return -ENOMEM;
5726
5727         tsec = cred->security;
5728         if (tsec->keycreate_sid)
5729                 ksec->sid = tsec->keycreate_sid;
5730         else
5731                 ksec->sid = tsec->sid;
5732
5733         k->security = ksec;
5734         return 0;
5735 }
5736
5737 static void selinux_key_free(struct key *k)
5738 {
5739         struct key_security_struct *ksec = k->security;
5740
5741         k->security = NULL;
5742         kfree(ksec);
5743 }
5744
5745 static int selinux_key_permission(key_ref_t key_ref,
5746                                   const struct cred *cred,
5747                                   unsigned perm)
5748 {
5749         struct key *key;
5750         struct key_security_struct *ksec;
5751         u32 sid;
5752
5753         /* if no specific permissions are requested, we skip the
5754            permission check. No serious, additional covert channels
5755            appear to be created. */
5756         if (perm == 0)
5757                 return 0;
5758
5759         sid = cred_sid(cred);
5760
5761         key = key_ref_to_ptr(key_ref);
5762         ksec = key->security;
5763
5764         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5765 }
5766
5767 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5768 {
5769         struct key_security_struct *ksec = key->security;
5770         char *context = NULL;
5771         unsigned len;
5772         int rc;
5773
5774         rc = security_sid_to_context(ksec->sid, &context, &len);
5775         if (!rc)
5776                 rc = len;
5777         *_buffer = context;
5778         return rc;
5779 }
5780
5781 #endif
5782
5783 static struct security_hook_list selinux_hooks[] = {
5784         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5785         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5786         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5787         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5788
5789         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5790         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5791         LSM_HOOK_INIT(capget, selinux_capget),
5792         LSM_HOOK_INIT(capset, selinux_capset),
5793         LSM_HOOK_INIT(capable, selinux_capable),
5794         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5795         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5796         LSM_HOOK_INIT(syslog, selinux_syslog),
5797         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5798
5799         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5800
5801         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5802         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5803         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5804         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5805
5806         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5807         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5808         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5809         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5810         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5811         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5812         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5813         LSM_HOOK_INIT(sb_mount, selinux_mount),
5814         LSM_HOOK_INIT(sb_umount, selinux_umount),
5815         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5816         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5817         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5818
5819         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5820
5821         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5822         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5823         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5824         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5825         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5826         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5827         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5828         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5829         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5830         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5831         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5832         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5833         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5834         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5835         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5836         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5837         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5838         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5839         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5840         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5841         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5842         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5843         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5844         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5845         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5846
5847         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5848         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5849         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5850         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5851         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5852         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5853         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5854         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5855         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5856         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5857         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5858         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5859
5860         LSM_HOOK_INIT(file_open, selinux_file_open),
5861
5862         LSM_HOOK_INIT(task_create, selinux_task_create),
5863         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5864         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5865         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5866         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5867         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5868         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5869         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5870         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5871         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5872         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5873         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5874         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5875         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5876         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5877         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5878         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5879         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5880         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5881         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5882         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5883         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5884
5885         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5886         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5887
5888         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5889         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5890
5891         LSM_HOOK_INIT(msg_queue_alloc_security,
5892                         selinux_msg_queue_alloc_security),
5893         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5894         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5895         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5896         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5897         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5898
5899         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5900         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5901         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5902         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5903         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5904
5905         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5906         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5907         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5908         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5909         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5910
5911         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5912
5913         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5914         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5915
5916         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5917         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5918         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5919         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5920         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5921         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5922         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5923
5924         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5925         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5926
5927         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5928         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5929         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5930         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
5931         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
5932         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
5933         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
5934         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
5935         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
5936         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
5937         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
5938         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
5939         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
5940         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
5941         LSM_HOOK_INIT(socket_getpeersec_stream,
5942                         selinux_socket_getpeersec_stream),
5943         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
5944         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
5945         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
5946         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
5947         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
5948         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
5949         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
5950         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
5951         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
5952         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
5953         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
5954         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
5955         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
5956         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
5957         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
5958         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
5959         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
5960         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
5961         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
5962
5963 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5964         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
5965         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
5966         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
5967         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
5968         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
5969         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
5970                         selinux_xfrm_state_alloc_acquire),
5971         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
5972         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
5973         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
5974         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
5975                         selinux_xfrm_state_pol_flow_match),
5976         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
5977 #endif
5978
5979 #ifdef CONFIG_KEYS
5980         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
5981         LSM_HOOK_INIT(key_free, selinux_key_free),
5982         LSM_HOOK_INIT(key_permission, selinux_key_permission),
5983         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
5984 #endif
5985
5986 #ifdef CONFIG_AUDIT
5987         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
5988         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
5989         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
5990         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
5991 #endif
5992 };
5993
5994 static __init int selinux_init(void)
5995 {
5996         if (!security_module_enable("selinux")) {
5997                 selinux_enabled = 0;
5998                 return 0;
5999         }
6000
6001         if (!selinux_enabled) {
6002                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6003                 return 0;
6004         }
6005
6006         printk(KERN_INFO "SELinux:  Initializing.\n");
6007
6008         /* Set the security state for the initial task. */
6009         cred_init_security();
6010
6011         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6012
6013         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6014                                             sizeof(struct inode_security_struct),
6015                                             0, SLAB_PANIC, NULL);
6016         avc_init();
6017
6018         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6019
6020         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6021                 panic("SELinux: Unable to register AVC netcache callback\n");
6022
6023         if (selinux_enforcing)
6024                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6025         else
6026                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6027
6028         return 0;
6029 }
6030
6031 static void delayed_superblock_init(struct super_block *sb, void *unused)
6032 {
6033         superblock_doinit(sb, NULL);
6034 }
6035
6036 void selinux_complete_init(void)
6037 {
6038         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6039
6040         /* Set up any superblocks initialized prior to the policy load. */
6041         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6042         iterate_supers(delayed_superblock_init, NULL);
6043 }
6044
6045 /* SELinux requires early initialization in order to label
6046    all processes and objects when they are created. */
6047 security_initcall(selinux_init);
6048
6049 #if defined(CONFIG_NETFILTER)
6050
6051 static struct nf_hook_ops selinux_nf_ops[] = {
6052         {
6053                 .hook =         selinux_ipv4_postroute,
6054                 .owner =        THIS_MODULE,
6055                 .pf =           NFPROTO_IPV4,
6056                 .hooknum =      NF_INET_POST_ROUTING,
6057                 .priority =     NF_IP_PRI_SELINUX_LAST,
6058         },
6059         {
6060                 .hook =         selinux_ipv4_forward,
6061                 .owner =        THIS_MODULE,
6062                 .pf =           NFPROTO_IPV4,
6063                 .hooknum =      NF_INET_FORWARD,
6064                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6065         },
6066         {
6067                 .hook =         selinux_ipv4_output,
6068                 .owner =        THIS_MODULE,
6069                 .pf =           NFPROTO_IPV4,
6070                 .hooknum =      NF_INET_LOCAL_OUT,
6071                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6072         },
6073 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6074         {
6075                 .hook =         selinux_ipv6_postroute,
6076                 .owner =        THIS_MODULE,
6077                 .pf =           NFPROTO_IPV6,
6078                 .hooknum =      NF_INET_POST_ROUTING,
6079                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6080         },
6081         {
6082                 .hook =         selinux_ipv6_forward,
6083                 .owner =        THIS_MODULE,
6084                 .pf =           NFPROTO_IPV6,
6085                 .hooknum =      NF_INET_FORWARD,
6086                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6087         },
6088 #endif  /* IPV6 */
6089 };
6090
6091 static int __init selinux_nf_ip_init(void)
6092 {
6093         int err;
6094
6095         if (!selinux_enabled)
6096                 return 0;
6097
6098         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6099
6100         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6101         if (err)
6102                 panic("SELinux: nf_register_hooks: error %d\n", err);
6103
6104         return 0;
6105 }
6106
6107 __initcall(selinux_nf_ip_init);
6108
6109 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6110 static void selinux_nf_ip_exit(void)
6111 {
6112         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6113
6114         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6115 }
6116 #endif
6117
6118 #else /* CONFIG_NETFILTER */
6119
6120 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6121 #define selinux_nf_ip_exit()
6122 #endif
6123
6124 #endif /* CONFIG_NETFILTER */
6125
6126 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6127 static int selinux_disabled;
6128
6129 int selinux_disable(void)
6130 {
6131         if (ss_initialized) {
6132                 /* Not permitted after initial policy load. */
6133                 return -EINVAL;
6134         }
6135
6136         if (selinux_disabled) {
6137                 /* Only do this once. */
6138                 return -EINVAL;
6139         }
6140
6141         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6142
6143         selinux_disabled = 1;
6144         selinux_enabled = 0;
6145
6146         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6147
6148         /* Try to destroy the avc node cache */
6149         avc_disable();
6150
6151         /* Unregister netfilter hooks. */
6152         selinux_nf_ip_exit();
6153
6154         /* Unregister selinuxfs. */
6155         exit_sel_fs();
6156
6157         return 0;
6158 }
6159 #endif