security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         /*
 258          * As not all inode security structures are in a list, we check for
 259          * empty list outside of the lock to make sure that we won't waste
 260          * time taking a lock doing nothing.
 261          *
 262          * The list_del_init() function can be safely called more than once.
 263          * It should not be possible for this function to be called with
 264          * concurrent list_add(), but for better safety against future changes
 265          * in the code, we use list_empty_careful() here.
 266          */
 267         if (!list_empty_careful(&isec->list)) {
 268                 spin_lock(&sbsec->isec_lock);
 269                 list_del_init(&isec->list);
 270                 spin_unlock(&sbsec->isec_lock);
 271         }
 272
 273         /*
 274          * The inode may still be referenced in a path walk and
 275          * a call to selinux_inode_permission() can be made
 276          * after inode_free_security() is called. Ideally, the VFS
 277          * wouldn't do this, but fixing that is a much harder
 278          * job. For now, simply free the i_security via RCU, and
 279          * leave the current inode->i_security pointer intact.
 280          * The inode will be freed after the RCU grace period too.
 281          */
 282         call_rcu(&isec->rcu, inode_free_rcu);
 283 }
 284
 285 static int file_alloc_security(struct file *file)
 286 {
 287         struct file_security_struct *fsec;
 288         u32 sid = current_sid();
 289
 290         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 291         if (!fsec)
 292                 return -ENOMEM;
 293
 294         fsec->sid = sid;
 295         fsec->fown_sid = sid;
 296         file->f_security = fsec;
 297
 298         return 0;
 299 }
 300
 301 static void file_free_security(struct file *file)
 302 {
 303         struct file_security_struct *fsec = file->f_security;
 304         file->f_security = NULL;
 305         kfree(fsec);
 306 }
 307
 308 static int superblock_alloc_security(struct super_block *sb)
 309 {
 310         struct superblock_security_struct *sbsec;
 311
 312         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 313         if (!sbsec)
 314                 return -ENOMEM;
 315
 316         mutex_init(&sbsec->lock);
 317         INIT_LIST_HEAD(&sbsec->isec_head);
 318         spin_lock_init(&sbsec->isec_lock);
 319         sbsec->sb = sb;
 320         sbsec->sid = SECINITSID_UNLABELED;
 321         sbsec->def_sid = SECINITSID_FILE;
 322         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 323         sb->s_security = sbsec;
 324
 325         return 0;
 326 }
 327
 328 static void superblock_free_security(struct super_block *sb)
 329 {
 330         struct superblock_security_struct *sbsec = sb->s_security;
 331         sb->s_security = NULL;
 332         kfree(sbsec);
 333 }
 334
 335 /* The file system's label must be initialized prior to use. */
 336
 337 static const char *labeling_behaviors[7] = {
 338         "uses xattr",
 339         "uses transition SIDs",
 340         "uses task SIDs",
 341         "uses genfs_contexts",
 342         "not configured for labeling",
 343         "uses mountpoint labeling",
 344         "uses native labeling",
 345 };
 346
 347 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 348
 349 static inline int inode_doinit(struct inode *inode)
 350 {
 351         return inode_doinit_with_dentry(inode, NULL);
 352 }
 353
 354 enum {
 355         Opt_error = -1,
 356         Opt_context = 1,
 357         Opt_fscontext = 2,
 358         Opt_defcontext = 3,
 359         Opt_rootcontext = 4,
 360         Opt_labelsupport = 5,
 361         Opt_nextmntopt = 6,
 362 };
 363
 364 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 365
 366 static const match_table_t tokens = {
 367         {Opt_context, CONTEXT_STR "%s"},
 368         {Opt_fscontext, FSCONTEXT_STR "%s"},
 369         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 370         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 371         {Opt_labelsupport, LABELSUPP_STR},
 372         {Opt_error, NULL},
 373 };
 374
 375 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 376
 377 static int may_context_mount_sb_relabel(u32 sid,
 378                         struct superblock_security_struct *sbsec,
 379                         const struct cred *cred)
 380 {
 381         const struct task_security_struct *tsec = cred->security;
 382         int rc;
 383
 384         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 385                           FILESYSTEM__RELABELFROM, NULL);
 386         if (rc)
 387                 return rc;
 388
 389         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELTO, NULL);
 391         return rc;
 392 }
 393
 394 static int may_context_mount_inode_relabel(u32 sid,
 395                         struct superblock_security_struct *sbsec,
 396                         const struct cred *cred)
 397 {
 398         const struct task_security_struct *tsec = cred->security;
 399         int rc;
 400         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 401                           FILESYSTEM__RELABELFROM, NULL);
 402         if (rc)
 403                 return rc;
 404
 405         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 406                           FILESYSTEM__ASSOCIATE, NULL);
 407         return rc;
 408 }
 409
 410 static int selinux_is_sblabel_mnt(struct super_block *sb)
 411 {
 412         struct superblock_security_struct *sbsec = sb->s_security;
 413
 414         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 415                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 416                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 417                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 418                 /* Special handling. Genfs but also in-core setxattr handler */
 419                 !strcmp(sb->s_type->name, "sysfs") ||
 420                 !strcmp(sb->s_type->name, "pstore") ||
 421                 !strcmp(sb->s_type->name, "debugfs") ||
 422                 !strcmp(sb->s_type->name, "rootfs");
 423 }
 424
 425 static int sb_finish_set_opts(struct super_block *sb)
 426 {
 427         struct superblock_security_struct *sbsec = sb->s_security;
 428         struct dentry *root = sb->s_root;
 429         struct inode *root_inode = d_backing_inode(root);
 430         int rc = 0;
 431
 432         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 433                 /* Make sure that the xattr handler exists and that no
 434                    error other than -ENODATA is returned by getxattr on
 435                    the root directory.  -ENODATA is ok, as this may be
 436                    the first boot of the SELinux kernel before we have
 437                    assigned xattr values to the filesystem. */
 438                 if (!root_inode->i_op->getxattr) {
 439                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 440                                "xattr support\n", sb->s_id, sb->s_type->name);
 441                         rc = -EOPNOTSUPP;
 442                         goto out;
 443                 }
 444                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 445                 if (rc < 0 && rc != -ENODATA) {
 446                         if (rc == -EOPNOTSUPP)
 447                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 448                                        "%s) has no security xattr handler\n",
 449                                        sb->s_id, sb->s_type->name);
 450                         else
 451                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 452                                        "%s) getxattr errno %d\n", sb->s_id,
 453                                        sb->s_type->name, -rc);
 454                         goto out;
 455                 }
 456         }
 457
 458         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 459                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 460                        sb->s_id, sb->s_type->name);
 461
 462         sbsec->flags |= SE_SBINITIALIZED;
 463         if (selinux_is_sblabel_mnt(sb))
 464                 sbsec->flags |= SBLABEL_MNT;
 465
 466         /* Initialize the root inode. */
 467         rc = inode_doinit_with_dentry(root_inode, root);
 468
 469         /* Initialize any other inodes associated with the superblock, e.g.
 470            inodes created prior to initial policy load or inodes created
 471            during get_sb by a pseudo filesystem that directly
 472            populates itself. */
 473         spin_lock(&sbsec->isec_lock);
 474 next_inode:
 475         if (!list_empty(&sbsec->isec_head)) {
 476                 struct inode_security_struct *isec =
 477                                 list_entry(sbsec->isec_head.next,
 478                                            struct inode_security_struct, list);
 479                 struct inode *inode = isec->inode;
 480                 list_del_init(&isec->list);
 481                 spin_unlock(&sbsec->isec_lock);
 482                 inode = igrab(inode);
 483                 if (inode) {
 484                         if (!IS_PRIVATE(inode))
 485                                 inode_doinit(inode);
 486                         iput(inode);
 487                 }
 488                 spin_lock(&sbsec->isec_lock);
 489                 goto next_inode;
 490         }
 491         spin_unlock(&sbsec->isec_lock);
 492 out:
 493         return rc;
 494 }
 495
 496 /*
 497  * This function should allow an FS to ask what it's mount security
 498  * options were so it can use those later for submounts, displaying
 499  * mount options, or whatever.
 500  */
 501 static int selinux_get_mnt_opts(const struct super_block *sb,
 502                                 struct security_mnt_opts *opts)
 503 {
 504         int rc = 0, i;
 505         struct superblock_security_struct *sbsec = sb->s_security;
 506         char *context = NULL;
 507         u32 len;
 508         char tmp;
 509
 510         security_init_mnt_opts(opts);
 511
 512         if (!(sbsec->flags & SE_SBINITIALIZED))
 513                 return -EINVAL;
 514
 515         if (!ss_initialized)
 516                 return -EINVAL;
 517
 518         /* make sure we always check enough bits to cover the mask */
 519         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 520
 521         tmp = sbsec->flags & SE_MNTMASK;
 522         /* count the number of mount options for this sb */
 523         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 524                 if (tmp & 0x01)
 525                         opts->num_mnt_opts++;
 526                 tmp >>= 1;
 527         }
 528         /* Check if the Label support flag is set */
 529         if (sbsec->flags & SBLABEL_MNT)
 530                 opts->num_mnt_opts++;
 531
 532         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 533         if (!opts->mnt_opts) {
 534                 rc = -ENOMEM;
 535                 goto out_free;
 536         }
 537
 538         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 539         if (!opts->mnt_opts_flags) {
 540                 rc = -ENOMEM;
 541                 goto out_free;
 542         }
 543
 544         i = 0;
 545         if (sbsec->flags & FSCONTEXT_MNT) {
 546                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 551         }
 552         if (sbsec->flags & CONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 558         }
 559         if (sbsec->flags & DEFCONTEXT_MNT) {
 560                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 561                 if (rc)
 562                         goto out_free;
 563                 opts->mnt_opts[i] = context;
 564                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 565         }
 566         if (sbsec->flags & ROOTCONTEXT_MNT) {
 567                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 568                 struct inode_security_struct *isec = root->i_security;
 569
 570                 rc = security_sid_to_context(isec->sid, &context, &len);
 571                 if (rc)
 572                         goto out_free;
 573                 opts->mnt_opts[i] = context;
 574                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 575         }
 576         if (sbsec->flags & SBLABEL_MNT) {
 577                 opts->mnt_opts[i] = NULL;
 578                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 579         }
 580
 581         BUG_ON(i != opts->num_mnt_opts);
 582
 583         return 0;
 584
 585 out_free:
 586         security_free_mnt_opts(opts);
 587         return rc;
 588 }
 589
 590 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 591                       u32 old_sid, u32 new_sid)
 592 {
 593         char mnt_flags = sbsec->flags & SE_MNTMASK;
 594
 595         /* check if the old mount command had the same options */
 596         if (sbsec->flags & SE_SBINITIALIZED)
 597                 if (!(sbsec->flags & flag) ||
 598                     (old_sid != new_sid))
 599                         return 1;
 600
 601         /* check if we were passed the same options twice,
 602          * aka someone passed context=a,context=b
 603          */
 604         if (!(sbsec->flags & SE_SBINITIALIZED))
 605                 if (mnt_flags & flag)
 606                         return 1;
 607         return 0;
 608 }
 609
 610 /*
 611  * Allow filesystems with binary mount data to explicitly set mount point
 612  * labeling information.
 613  */
 614 static int selinux_set_mnt_opts(struct super_block *sb,
 615                                 struct security_mnt_opts *opts,
 616                                 unsigned long kern_flags,
 617                                 unsigned long *set_kern_flags)
 618 {
 619         const struct cred *cred = current_cred();
 620         int rc = 0, i;
 621         struct superblock_security_struct *sbsec = sb->s_security;
 622         const char *name = sb->s_type->name;
 623         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 624         struct inode_security_struct *root_isec = inode->i_security;
 625         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 626         u32 defcontext_sid = 0;
 627         char **mount_options = opts->mnt_opts;
 628         int *flags = opts->mnt_opts_flags;
 629         int num_opts = opts->num_mnt_opts;
 630
 631         mutex_lock(&sbsec->lock);
 632
 633         if (!ss_initialized) {
 634                 if (!num_opts) {
 635                         /* Defer initialization until selinux_complete_init,
 636                            after the initial policy is loaded and the security
 637                            server is ready to handle calls. */
 638                         goto out;
 639                 }
 640                 rc = -EINVAL;
 641                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 642                         "before the security server is initialized\n");
 643                 goto out;
 644         }
 645         if (kern_flags && !set_kern_flags) {
 646                 /* Specifying internal flags without providing a place to
 647                  * place the results is not allowed */
 648                 rc = -EINVAL;
 649                 goto out;
 650         }
 651
 652         /*
 653          * Binary mount data FS will come through this function twice.  Once
 654          * from an explicit call and once from the generic calls from the vfs.
 655          * Since the generic VFS calls will not contain any security mount data
 656          * we need to skip the double mount verification.
 657          *
 658          * This does open a hole in which we will not notice if the first
 659          * mount using this sb set explict options and a second mount using
 660          * this sb does not set any security options.  (The first options
 661          * will be used for both mounts)
 662          */
 663         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 664             && (num_opts == 0))
 665                 goto out;
 666
 667         /*
 668          * parse the mount options, check if they are valid sids.
 669          * also check if someone is trying to mount the same sb more
 670          * than once with different security options.
 671          */
 672         for (i = 0; i < num_opts; i++) {
 673                 u32 sid;
 674
 675                 if (flags[i] == SBLABEL_MNT)
 676                         continue;
 677                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 678                 if (rc) {
 679                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 680                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 681                                mount_options[i], sb->s_id, name, rc);
 682                         goto out;
 683                 }
 684                 switch (flags[i]) {
 685                 case FSCONTEXT_MNT:
 686                         fscontext_sid = sid;
 687
 688                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 689                                         fscontext_sid))
 690                                 goto out_double_mount;
 691
 692                         sbsec->flags |= FSCONTEXT_MNT;
 693                         break;
 694                 case CONTEXT_MNT:
 695                         context_sid = sid;
 696
 697                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 698                                         context_sid))
 699                                 goto out_double_mount;
 700
 701                         sbsec->flags |= CONTEXT_MNT;
 702                         break;
 703                 case ROOTCONTEXT_MNT:
 704                         rootcontext_sid = sid;
 705
 706                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 707                                         rootcontext_sid))
 708                                 goto out_double_mount;
 709
 710                         sbsec->flags |= ROOTCONTEXT_MNT;
 711
 712                         break;
 713                 case DEFCONTEXT_MNT:
 714                         defcontext_sid = sid;
 715
 716                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 717                                         defcontext_sid))
 718                                 goto out_double_mount;
 719
 720                         sbsec->flags |= DEFCONTEXT_MNT;
 721
 722                         break;
 723                 default:
 724                         rc = -EINVAL;
 725                         goto out;
 726                 }
 727         }
 728
 729         if (sbsec->flags & SE_SBINITIALIZED) {
 730                 /* previously mounted with options, but not on this attempt? */
 731                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 732                         goto out_double_mount;
 733                 rc = 0;
 734                 goto out;
 735         }
 736
 737         if (strcmp(sb->s_type->name, "proc") == 0)
 738                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 739
 740         if (!strcmp(sb->s_type->name, "debugfs") ||
 741             !strcmp(sb->s_type->name, "sysfs") ||
 742             !strcmp(sb->s_type->name, "pstore"))
 743                 sbsec->flags |= SE_SBGENFS;
 744
 745         if (!sbsec->behavior) {
 746                 /*
 747                  * Determine the labeling behavior to use for this
 748                  * filesystem type.
 749                  */
 750                 rc = security_fs_use(sb);
 751                 if (rc) {
 752                         printk(KERN_WARNING
 753                                 "%s: security_fs_use(%s) returned %d\n",
 754                                         __func__, sb->s_type->name, rc);
 755                         goto out;
 756                 }
 757         }
 758         /* sets the context of the superblock for the fs being mounted. */
 759         if (fscontext_sid) {
 760                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 761                 if (rc)
 762                         goto out;
 763
 764                 sbsec->sid = fscontext_sid;
 765         }
 766
 767         /*
 768          * Switch to using mount point labeling behavior.
 769          * sets the label used on all file below the mountpoint, and will set
 770          * the superblock context if not already set.
 771          */
 772         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 773                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 774                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 775         }
 776
 777         if (context_sid) {
 778                 if (!fscontext_sid) {
 779                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 780                                                           cred);
 781                         if (rc)
 782                                 goto out;
 783                         sbsec->sid = context_sid;
 784                 } else {
 785                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 786                                                              cred);
 787                         if (rc)
 788                                 goto out;
 789                 }
 790                 if (!rootcontext_sid)
 791                         rootcontext_sid = context_sid;
 792
 793                 sbsec->mntpoint_sid = context_sid;
 794                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 795         }
 796
 797         if (rootcontext_sid) {
 798                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 799                                                      cred);
 800                 if (rc)
 801                         goto out;
 802
 803                 root_isec->sid = rootcontext_sid;
 804                 root_isec->initialized = 1;
 805         }
 806
 807         if (defcontext_sid) {
 808                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 809                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 810                         rc = -EINVAL;
 811                         printk(KERN_WARNING "SELinux: defcontext option is "
 812                                "invalid for this filesystem type\n");
 813                         goto out;
 814                 }
 815
 816                 if (defcontext_sid != sbsec->def_sid) {
 817                         rc = may_context_mount_inode_relabel(defcontext_sid,
 818                                                              sbsec, cred);
 819                         if (rc)
 820                                 goto out;
 821                 }
 822
 823                 sbsec->def_sid = defcontext_sid;
 824         }
 825
 826         rc = sb_finish_set_opts(sb);
 827 out:
 828         mutex_unlock(&sbsec->lock);
 829         return rc;
 830 out_double_mount:
 831         rc = -EINVAL;
 832         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 833                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 834         goto out;
 835 }
 836
 837 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 838                                     const struct super_block *newsb)
 839 {
 840         struct superblock_security_struct *old = oldsb->s_security;
 841         struct superblock_security_struct *new = newsb->s_security;
 842         char oldflags = old->flags & SE_MNTMASK;
 843         char newflags = new->flags & SE_MNTMASK;
 844
 845         if (oldflags != newflags)
 846                 goto mismatch;
 847         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 848                 goto mismatch;
 849         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 850                 goto mismatch;
 851         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 852                 goto mismatch;
 853         if (oldflags & ROOTCONTEXT_MNT) {
 854                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 855                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 856                 if (oldroot->sid != newroot->sid)
 857                         goto mismatch;
 858         }
 859         return 0;
 860 mismatch:
 861         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 862                             "different security settings for (dev %s, "
 863                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 864         return -EBUSY;
 865 }
 866
 867 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 868                                         struct super_block *newsb)
 869 {
 870         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 871         struct superblock_security_struct *newsbsec = newsb->s_security;
 872
 873         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 874         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 875         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 876
 877         /*
 878          * if the parent was able to be mounted it clearly had no special lsm
 879          * mount options.  thus we can safely deal with this superblock later
 880          */
 881         if (!ss_initialized)
 882                 return 0;
 883
 884         /* how can we clone if the old one wasn't set up?? */
 885         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 886
 887         /* if fs is reusing a sb, make sure that the contexts match */
 888         if (newsbsec->flags & SE_SBINITIALIZED)
 889                 return selinux_cmp_sb_context(oldsb, newsb);
 890
 891         mutex_lock(&newsbsec->lock);
 892
 893         newsbsec->flags = oldsbsec->flags;
 894
 895         newsbsec->sid = oldsbsec->sid;
 896         newsbsec->def_sid = oldsbsec->def_sid;
 897         newsbsec->behavior = oldsbsec->behavior;
 898
 899         if (set_context) {
 900                 u32 sid = oldsbsec->mntpoint_sid;
 901
 902                 if (!set_fscontext)
 903                         newsbsec->sid = sid;
 904                 if (!set_rootcontext) {
 905                         struct inode *newinode = d_backing_inode(newsb->s_root);
 906                         struct inode_security_struct *newisec = newinode->i_security;
 907                         newisec->sid = sid;
 908                 }
 909                 newsbsec->mntpoint_sid = sid;
 910         }
 911         if (set_rootcontext) {
 912                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 913                 const struct inode_security_struct *oldisec = oldinode->i_security;
 914                 struct inode *newinode = d_backing_inode(newsb->s_root);
 915                 struct inode_security_struct *newisec = newinode->i_security;
 916
 917                 newisec->sid = oldisec->sid;
 918         }
 919
 920         sb_finish_set_opts(newsb);
 921         mutex_unlock(&newsbsec->lock);
 922         return 0;
 923 }
 924
 925 static int selinux_parse_opts_str(char *options,
 926                                   struct security_mnt_opts *opts)
 927 {
 928         char *p;
 929         char *context = NULL, *defcontext = NULL;
 930         char *fscontext = NULL, *rootcontext = NULL;
 931         int rc, num_mnt_opts = 0;
 932
 933         opts->num_mnt_opts = 0;
 934
 935         /* Standard string-based options. */
 936         while ((p = strsep(&options, "|")) != NULL) {
 937                 int token;
 938                 substring_t args[MAX_OPT_ARGS];
 939
 940                 if (!*p)
 941                         continue;
 942
 943                 token = match_token(p, tokens, args);
 944
 945                 switch (token) {
 946                 case Opt_context:
 947                         if (context || defcontext) {
 948                                 rc = -EINVAL;
 949                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 950                                 goto out_err;
 951                         }
 952                         context = match_strdup(&args[0]);
 953                         if (!context) {
 954                                 rc = -ENOMEM;
 955                                 goto out_err;
 956                         }
 957                         break;
 958
 959                 case Opt_fscontext:
 960                         if (fscontext) {
 961                                 rc = -EINVAL;
 962                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 963                                 goto out_err;
 964                         }
 965                         fscontext = match_strdup(&args[0]);
 966                         if (!fscontext) {
 967                                 rc = -ENOMEM;
 968                                 goto out_err;
 969                         }
 970                         break;
 971
 972                 case Opt_rootcontext:
 973                         if (rootcontext) {
 974                                 rc = -EINVAL;
 975                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 976                                 goto out_err;
 977                         }
 978                         rootcontext = match_strdup(&args[0]);
 979                         if (!rootcontext) {
 980                                 rc = -ENOMEM;
 981                                 goto out_err;
 982                         }
 983                         break;
 984
 985                 case Opt_defcontext:
 986                         if (context || defcontext) {
 987                                 rc = -EINVAL;
 988                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 989                                 goto out_err;
 990                         }
 991                         defcontext = match_strdup(&args[0]);
 992                         if (!defcontext) {
 993                                 rc = -ENOMEM;
 994                                 goto out_err;
 995                         }
 996                         break;
 997                 case Opt_labelsupport:
 998                         break;
 999                 default:
1000                         rc = -EINVAL;
1001                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1002                         goto out_err;
1003
1004                 }
1005         }
1006
1007         rc = -ENOMEM;
1008         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1009         if (!opts->mnt_opts)
1010                 goto out_err;
1011
1012         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1013         if (!opts->mnt_opts_flags) {
1014                 kfree(opts->mnt_opts);
1015                 goto out_err;
1016         }
1017
1018         if (fscontext) {
1019                 opts->mnt_opts[num_mnt_opts] = fscontext;
1020                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1021         }
1022         if (context) {
1023                 opts->mnt_opts[num_mnt_opts] = context;
1024                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1025         }
1026         if (rootcontext) {
1027                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1028                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1029         }
1030         if (defcontext) {
1031                 opts->mnt_opts[num_mnt_opts] = defcontext;
1032                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1033         }
1034
1035         opts->num_mnt_opts = num_mnt_opts;
1036         return 0;
1037
1038 out_err:
1039         kfree(context);
1040         kfree(defcontext);
1041         kfree(fscontext);
1042         kfree(rootcontext);
1043         return rc;
1044 }
1045 /*
1046  * string mount options parsing and call set the sbsec
1047  */
1048 static int superblock_doinit(struct super_block *sb, void *data)
1049 {
1050         int rc = 0;
1051         char *options = data;
1052         struct security_mnt_opts opts;
1053
1054         security_init_mnt_opts(&opts);
1055
1056         if (!data)
1057                 goto out;
1058
1059         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1060
1061         rc = selinux_parse_opts_str(options, &opts);
1062         if (rc)
1063                 goto out_err;
1064
1065 out:
1066         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1067
1068 out_err:
1069         security_free_mnt_opts(&opts);
1070         return rc;
1071 }
1072
1073 static void selinux_write_opts(struct seq_file *m,
1074                                struct security_mnt_opts *opts)
1075 {
1076         int i;
1077         char *prefix;
1078
1079         for (i = 0; i < opts->num_mnt_opts; i++) {
1080                 char *has_comma;
1081
1082                 if (opts->mnt_opts[i])
1083                         has_comma = strchr(opts->mnt_opts[i], ',');
1084                 else
1085                         has_comma = NULL;
1086
1087                 switch (opts->mnt_opts_flags[i]) {
1088                 case CONTEXT_MNT:
1089                         prefix = CONTEXT_STR;
1090                         break;
1091                 case FSCONTEXT_MNT:
1092                         prefix = FSCONTEXT_STR;
1093                         break;
1094                 case ROOTCONTEXT_MNT:
1095                         prefix = ROOTCONTEXT_STR;
1096                         break;
1097                 case DEFCONTEXT_MNT:
1098                         prefix = DEFCONTEXT_STR;
1099                         break;
1100                 case SBLABEL_MNT:
1101                         seq_putc(m, ',');
1102                         seq_puts(m, LABELSUPP_STR);
1103                         continue;
1104                 default:
1105                         BUG();
1106                         return;
1107                 };
1108                 /* we need a comma before each option */
1109                 seq_putc(m, ',');
1110                 seq_puts(m, prefix);
1111                 if (has_comma)
1112                         seq_putc(m, '\"');
1113                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1114                 if (has_comma)
1115                         seq_putc(m, '\"');
1116         }
1117 }
1118
1119 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1120 {
1121         struct security_mnt_opts opts;
1122         int rc;
1123
1124         rc = selinux_get_mnt_opts(sb, &opts);
1125         if (rc) {
1126                 /* before policy load we may get EINVAL, don't show anything */
1127                 if (rc == -EINVAL)
1128                         rc = 0;
1129                 return rc;
1130         }
1131
1132         selinux_write_opts(m, &opts);
1133
1134         security_free_mnt_opts(&opts);
1135
1136         return rc;
1137 }
1138
1139 static inline u16 inode_mode_to_security_class(umode_t mode)
1140 {
1141         switch (mode & S_IFMT) {
1142         case S_IFSOCK:
1143                 return SECCLASS_SOCK_FILE;
1144         case S_IFLNK:
1145                 return SECCLASS_LNK_FILE;
1146         case S_IFREG:
1147                 return SECCLASS_FILE;
1148         case S_IFBLK:
1149                 return SECCLASS_BLK_FILE;
1150         case S_IFDIR:
1151                 return SECCLASS_DIR;
1152         case S_IFCHR:
1153                 return SECCLASS_CHR_FILE;
1154         case S_IFIFO:
1155                 return SECCLASS_FIFO_FILE;
1156
1157         }
1158
1159         return SECCLASS_FILE;
1160 }
1161
1162 static inline int default_protocol_stream(int protocol)
1163 {
1164         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1165 }
1166
1167 static inline int default_protocol_dgram(int protocol)
1168 {
1169         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1170 }
1171
1172 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1173 {
1174         switch (family) {
1175         case PF_UNIX:
1176                 switch (type) {
1177                 case SOCK_STREAM:
1178                 case SOCK_SEQPACKET:
1179                         return SECCLASS_UNIX_STREAM_SOCKET;
1180                 case SOCK_DGRAM:
1181                         return SECCLASS_UNIX_DGRAM_SOCKET;
1182                 }
1183                 break;
1184         case PF_INET:
1185         case PF_INET6:
1186                 switch (type) {
1187                 case SOCK_STREAM:
1188                         if (default_protocol_stream(protocol))
1189                                 return SECCLASS_TCP_SOCKET;
1190                         else
1191                                 return SECCLASS_RAWIP_SOCKET;
1192                 case SOCK_DGRAM:
1193                         if (default_protocol_dgram(protocol))
1194                                 return SECCLASS_UDP_SOCKET;
1195                         else
1196                                 return SECCLASS_RAWIP_SOCKET;
1197                 case SOCK_DCCP:
1198                         return SECCLASS_DCCP_SOCKET;
1199                 default:
1200                         return SECCLASS_RAWIP_SOCKET;
1201                 }
1202                 break;
1203         case PF_NETLINK:
1204                 switch (protocol) {
1205                 case NETLINK_ROUTE:
1206                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1207                 case NETLINK_SOCK_DIAG:
1208                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1209                 case NETLINK_NFLOG:
1210                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1211                 case NETLINK_XFRM:
1212                         return SECCLASS_NETLINK_XFRM_SOCKET;
1213                 case NETLINK_SELINUX:
1214                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1215                 case NETLINK_ISCSI:
1216                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1217                 case NETLINK_AUDIT:
1218                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1219                 case NETLINK_FIB_LOOKUP:
1220                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1221                 case NETLINK_CONNECTOR:
1222                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1223                 case NETLINK_NETFILTER:
1224                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1225                 case NETLINK_DNRTMSG:
1226                         return SECCLASS_NETLINK_DNRT_SOCKET;
1227                 case NETLINK_KOBJECT_UEVENT:
1228                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1229                 case NETLINK_GENERIC:
1230                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1231                 case NETLINK_SCSITRANSPORT:
1232                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1233                 case NETLINK_RDMA:
1234                         return SECCLASS_NETLINK_RDMA_SOCKET;
1235                 case NETLINK_CRYPTO:
1236                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1237                 default:
1238                         return SECCLASS_NETLINK_SOCKET;
1239                 }
1240         case PF_PACKET:
1241                 return SECCLASS_PACKET_SOCKET;
1242         case PF_KEY:
1243                 return SECCLASS_KEY_SOCKET;
1244         case PF_APPLETALK:
1245                 return SECCLASS_APPLETALK_SOCKET;
1246         }
1247
1248         return SECCLASS_SOCKET;
1249 }
1250
1251 static int selinux_genfs_get_sid(struct dentry *dentry,
1252                                  u16 tclass,
1253                                  u16 flags,
1254                                  u32 *sid)
1255 {
1256         int rc;
1257         struct super_block *sb = dentry->d_inode->i_sb;
1258         char *buffer, *path;
1259
1260         buffer = (char *)__get_free_page(GFP_KERNEL);
1261         if (!buffer)
1262                 return -ENOMEM;
1263
1264         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1265         if (IS_ERR(path))
1266                 rc = PTR_ERR(path);
1267         else {
1268                 if (flags & SE_SBPROC) {
1269                         /* each process gets a /proc/PID/ entry. Strip off the
1270                          * PID part to get a valid selinux labeling.
1271                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1272                         while (path[1] >= '0' && path[1] <= '9') {
1273                                 path[1] = '/';
1274                                 path++;
1275                         }
1276                 }
1277                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1278         }
1279         free_page((unsigned long)buffer);
1280         return rc;
1281 }
1282
1283 /* The inode's security attributes must be initialized before first use. */
1284 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1285 {
1286         struct superblock_security_struct *sbsec = NULL;
1287         struct inode_security_struct *isec = inode->i_security;
1288         u32 sid;
1289         struct dentry *dentry;
1290 #define INITCONTEXTLEN 255
1291         char *context = NULL;
1292         unsigned len = 0;
1293         int rc = 0;
1294
1295         if (isec->initialized)
1296                 goto out;
1297
1298         mutex_lock(&isec->lock);
1299         if (isec->initialized)
1300                 goto out_unlock;
1301
1302         sbsec = inode->i_sb->s_security;
1303         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1304                 /* Defer initialization until selinux_complete_init,
1305                    after the initial policy is loaded and the security
1306                    server is ready to handle calls. */
1307                 spin_lock(&sbsec->isec_lock);
1308                 if (list_empty(&isec->list))
1309                         list_add(&isec->list, &sbsec->isec_head);
1310                 spin_unlock(&sbsec->isec_lock);
1311                 goto out_unlock;
1312         }
1313
1314         switch (sbsec->behavior) {
1315         case SECURITY_FS_USE_NATIVE:
1316                 break;
1317         case SECURITY_FS_USE_XATTR:
1318                 if (!inode->i_op->getxattr) {
1319                         isec->sid = sbsec->def_sid;
1320                         break;
1321                 }
1322
1323                 /* Need a dentry, since the xattr API requires one.
1324                    Life would be simpler if we could just pass the inode. */
1325                 if (opt_dentry) {
1326                         /* Called from d_instantiate or d_splice_alias. */
1327                         dentry = dget(opt_dentry);
1328                 } else {
1329                         /* Called from selinux_complete_init, try to find a dentry. */
1330                         dentry = d_find_alias(inode);
1331                 }
1332                 if (!dentry) {
1333                         /*
1334                          * this is can be hit on boot when a file is accessed
1335                          * before the policy is loaded.  When we load policy we
1336                          * may find inodes that have no dentry on the
1337                          * sbsec->isec_head list.  No reason to complain as these
1338                          * will get fixed up the next time we go through
1339                          * inode_doinit with a dentry, before these inodes could
1340                          * be used again by userspace.
1341                          */
1342                         goto out_unlock;
1343                 }
1344
1345                 len = INITCONTEXTLEN;
1346                 context = kmalloc(len+1, GFP_NOFS);
1347                 if (!context) {
1348                         rc = -ENOMEM;
1349                         dput(dentry);
1350                         goto out_unlock;
1351                 }
1352                 context[len] = '\0';
1353                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1354                                            context, len);
1355                 if (rc == -ERANGE) {
1356                         kfree(context);
1357
1358                         /* Need a larger buffer.  Query for the right size. */
1359                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1360                                                    NULL, 0);
1361                         if (rc < 0) {
1362                                 dput(dentry);
1363                                 goto out_unlock;
1364                         }
1365                         len = rc;
1366                         context = kmalloc(len+1, GFP_NOFS);
1367                         if (!context) {
1368                                 rc = -ENOMEM;
1369                                 dput(dentry);
1370                                 goto out_unlock;
1371                         }
1372                         context[len] = '\0';
1373                         rc = inode->i_op->getxattr(dentry,
1374                                                    XATTR_NAME_SELINUX,
1375                                                    context, len);
1376                 }
1377                 dput(dentry);
1378                 if (rc < 0) {
1379                         if (rc != -ENODATA) {
1380                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1381                                        "%d for dev=%s ino=%ld\n", __func__,
1382                                        -rc, inode->i_sb->s_id, inode->i_ino);
1383                                 kfree(context);
1384                                 goto out_unlock;
1385                         }
1386                         /* Map ENODATA to the default file SID */
1387                         sid = sbsec->def_sid;
1388                         rc = 0;
1389                 } else {
1390                         rc = security_context_to_sid_default(context, rc, &sid,
1391                                                              sbsec->def_sid,
1392                                                              GFP_NOFS);
1393                         if (rc) {
1394                                 char *dev = inode->i_sb->s_id;
1395                                 unsigned long ino = inode->i_ino;
1396
1397                                 if (rc == -EINVAL) {
1398                                         if (printk_ratelimit())
1399                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1400                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1401                                                         "filesystem in question.\n", ino, dev, context);
1402                                 } else {
1403                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1404                                                "returned %d for dev=%s ino=%ld\n",
1405                                                __func__, context, -rc, dev, ino);
1406                                 }
1407                                 kfree(context);
1408                                 /* Leave with the unlabeled SID */
1409                                 rc = 0;
1410                                 break;
1411                         }
1412                 }
1413                 kfree(context);
1414                 isec->sid = sid;
1415                 break;
1416         case SECURITY_FS_USE_TASK:
1417                 isec->sid = isec->task_sid;
1418                 break;
1419         case SECURITY_FS_USE_TRANS:
1420                 /* Default to the fs SID. */
1421                 isec->sid = sbsec->sid;
1422
1423                 /* Try to obtain a transition SID. */
1424                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1425                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1426                                              isec->sclass, NULL, &sid);
1427                 if (rc)
1428                         goto out_unlock;
1429                 isec->sid = sid;
1430                 break;
1431         case SECURITY_FS_USE_MNTPOINT:
1432                 isec->sid = sbsec->mntpoint_sid;
1433                 break;
1434         default:
1435                 /* Default to the fs superblock SID. */
1436                 isec->sid = sbsec->sid;
1437
1438                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1439                         /* We must have a dentry to determine the label on
1440                          * procfs inodes */
1441                         if (opt_dentry)
1442                                 /* Called from d_instantiate or
1443                                  * d_splice_alias. */
1444                                 dentry = dget(opt_dentry);
1445                         else
1446                                 /* Called from selinux_complete_init, try to
1447                                  * find a dentry. */
1448                                 dentry = d_find_alias(inode);
1449                         /*
1450                          * This can be hit on boot when a file is accessed
1451                          * before the policy is loaded.  When we load policy we
1452                          * may find inodes that have no dentry on the
1453                          * sbsec->isec_head list.  No reason to complain as
1454                          * these will get fixed up the next time we go through
1455                          * inode_doinit() with a dentry, before these inodes
1456                          * could be used again by userspace.
1457                          */
1458                         if (!dentry)
1459                                 goto out_unlock;
1460                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1461                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1462                                                    sbsec->flags, &sid);
1463                         dput(dentry);
1464                         if (rc)
1465                                 goto out_unlock;
1466                         isec->sid = sid;
1467                 }
1468                 break;
1469         }
1470
1471         isec->initialized = 1;
1472
1473 out_unlock:
1474         mutex_unlock(&isec->lock);
1475 out:
1476         if (isec->sclass == SECCLASS_FILE)
1477                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1478         return rc;
1479 }
1480
1481 /* Convert a Linux signal to an access vector. */
1482 static inline u32 signal_to_av(int sig)
1483 {
1484         u32 perm = 0;
1485
1486         switch (sig) {
1487         case SIGCHLD:
1488                 /* Commonly granted from child to parent. */
1489                 perm = PROCESS__SIGCHLD;
1490                 break;
1491         case SIGKILL:
1492                 /* Cannot be caught or ignored */
1493                 perm = PROCESS__SIGKILL;
1494                 break;
1495         case SIGSTOP:
1496                 /* Cannot be caught or ignored */
1497                 perm = PROCESS__SIGSTOP;
1498                 break;
1499         default:
1500                 /* All other signals. */
1501                 perm = PROCESS__SIGNAL;
1502                 break;
1503         }
1504
1505         return perm;
1506 }
1507
1508 /*
1509  * Check permission between a pair of credentials
1510  * fork check, ptrace check, etc.
1511  */
1512 static int cred_has_perm(const struct cred *actor,
1513                          const struct cred *target,
1514                          u32 perms)
1515 {
1516         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1517
1518         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1519 }
1520
1521 /*
1522  * Check permission between a pair of tasks, e.g. signal checks,
1523  * fork check, ptrace check, etc.
1524  * tsk1 is the actor and tsk2 is the target
1525  * - this uses the default subjective creds of tsk1
1526  */
1527 static int task_has_perm(const struct task_struct *tsk1,
1528                          const struct task_struct *tsk2,
1529                          u32 perms)
1530 {
1531         const struct task_security_struct *__tsec1, *__tsec2;
1532         u32 sid1, sid2;
1533
1534         rcu_read_lock();
1535         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1536         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1537         rcu_read_unlock();
1538         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1539 }
1540
1541 /*
1542  * Check permission between current and another task, e.g. signal checks,
1543  * fork check, ptrace check, etc.
1544  * current is the actor and tsk2 is the target
1545  * - this uses current's subjective creds
1546  */
1547 static int current_has_perm(const struct task_struct *tsk,
1548                             u32 perms)
1549 {
1550         u32 sid, tsid;
1551
1552         sid = current_sid();
1553         tsid = task_sid(tsk);
1554         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1555 }
1556
1557 #if CAP_LAST_CAP > 63
1558 #error Fix SELinux to handle capabilities > 63.
1559 #endif
1560
1561 /* Check whether a task is allowed to use a capability. */
1562 static int cred_has_capability(const struct cred *cred,
1563                                int cap, int audit)
1564 {
1565         struct common_audit_data ad;
1566         struct av_decision avd;
1567         u16 sclass;
1568         u32 sid = cred_sid(cred);
1569         u32 av = CAP_TO_MASK(cap);
1570         int rc;
1571
1572         ad.type = LSM_AUDIT_DATA_CAP;
1573         ad.u.cap = cap;
1574
1575         switch (CAP_TO_INDEX(cap)) {
1576         case 0:
1577                 sclass = SECCLASS_CAPABILITY;
1578                 break;
1579         case 1:
1580                 sclass = SECCLASS_CAPABILITY2;
1581                 break;
1582         default:
1583                 printk(KERN_ERR
1584                        "SELinux:  out of range capability %d\n", cap);
1585                 BUG();
1586                 return -EINVAL;
1587         }
1588
1589         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1590         if (audit == SECURITY_CAP_AUDIT) {
1591                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1592                 if (rc2)
1593                         return rc2;
1594         }
1595         return rc;
1596 }
1597
1598 /* Check whether a task is allowed to use a system operation. */
1599 static int task_has_system(struct task_struct *tsk,
1600                            u32 perms)
1601 {
1602         u32 sid = task_sid(tsk);
1603
1604         return avc_has_perm(sid, SECINITSID_KERNEL,
1605                             SECCLASS_SYSTEM, perms, NULL);
1606 }
1607
1608 /* Check whether a task has a particular permission to an inode.
1609    The 'adp' parameter is optional and allows other audit
1610    data to be passed (e.g. the dentry). */
1611 static int inode_has_perm(const struct cred *cred,
1612                           struct inode *inode,
1613                           u32 perms,
1614                           struct common_audit_data *adp)
1615 {
1616         struct inode_security_struct *isec;
1617         u32 sid;
1618
1619         validate_creds(cred);
1620
1621         if (unlikely(IS_PRIVATE(inode)))
1622                 return 0;
1623
1624         sid = cred_sid(cred);
1625         isec = inode->i_security;
1626
1627         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1628 }
1629
1630 /* Same as inode_has_perm, but pass explicit audit data containing
1631    the dentry to help the auditing code to more easily generate the
1632    pathname if needed. */
1633 static inline int dentry_has_perm(const struct cred *cred,
1634                                   struct dentry *dentry,
1635                                   u32 av)
1636 {
1637         struct inode *inode = d_backing_inode(dentry);
1638         struct common_audit_data ad;
1639
1640         ad.type = LSM_AUDIT_DATA_DENTRY;
1641         ad.u.dentry = dentry;
1642         return inode_has_perm(cred, inode, av, &ad);
1643 }
1644
1645 /* Same as inode_has_perm, but pass explicit audit data containing
1646    the path to help the auditing code to more easily generate the
1647    pathname if needed. */
1648 static inline int path_has_perm(const struct cred *cred,
1649                                 const struct path *path,
1650                                 u32 av)
1651 {
1652         struct inode *inode = d_backing_inode(path->dentry);
1653         struct common_audit_data ad;
1654
1655         ad.type = LSM_AUDIT_DATA_PATH;
1656         ad.u.path = *path;
1657         return inode_has_perm(cred, inode, av, &ad);
1658 }
1659
1660 /* Same as path_has_perm, but uses the inode from the file struct. */
1661 static inline int file_path_has_perm(const struct cred *cred,
1662                                      struct file *file,
1663                                      u32 av)
1664 {
1665         struct common_audit_data ad;
1666
1667         ad.type = LSM_AUDIT_DATA_PATH;
1668         ad.u.path = file->f_path;
1669         return inode_has_perm(cred, file_inode(file), av, &ad);
1670 }
1671
1672 /* Check whether a task can use an open file descriptor to
1673    access an inode in a given way.  Check access to the
1674    descriptor itself, and then use dentry_has_perm to
1675    check a particular permission to the file.
1676    Access to the descriptor is implicitly granted if it
1677    has the same SID as the process.  If av is zero, then
1678    access to the file is not checked, e.g. for cases
1679    where only the descriptor is affected like seek. */
1680 static int file_has_perm(const struct cred *cred,
1681                          struct file *file,
1682                          u32 av)
1683 {
1684         struct file_security_struct *fsec = file->f_security;
1685         struct inode *inode = file_inode(file);
1686         struct common_audit_data ad;
1687         u32 sid = cred_sid(cred);
1688         int rc;
1689
1690         ad.type = LSM_AUDIT_DATA_PATH;
1691         ad.u.path = file->f_path;
1692
1693         if (sid != fsec->sid) {
1694                 rc = avc_has_perm(sid, fsec->sid,
1695                                   SECCLASS_FD,
1696                                   FD__USE,
1697                                   &ad);
1698                 if (rc)
1699                         goto out;
1700         }
1701
1702         /* av is zero if only checking access to the descriptor. */
1703         rc = 0;
1704         if (av)
1705                 rc = inode_has_perm(cred, inode, av, &ad);
1706
1707 out:
1708         return rc;
1709 }
1710
1711 /*
1712  * Determine the label for an inode that might be unioned.
1713  */
1714 static int selinux_determine_inode_label(const struct inode *dir,
1715                                          const struct qstr *name,
1716                                          u16 tclass,
1717                                          u32 *_new_isid)
1718 {
1719         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1720         const struct inode_security_struct *dsec = dir->i_security;
1721         const struct task_security_struct *tsec = current_security();
1722
1723         if ((sbsec->flags & SE_SBINITIALIZED) &&
1724             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1725                 *_new_isid = sbsec->mntpoint_sid;
1726         } else if ((sbsec->flags & SBLABEL_MNT) &&
1727                    tsec->create_sid) {
1728                 *_new_isid = tsec->create_sid;
1729         } else {
1730                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1731                                                name, _new_isid);
1732         }
1733
1734         return 0;
1735 }
1736
1737 /* Check whether a task can create a file. */
1738 static int may_create(struct inode *dir,
1739                       struct dentry *dentry,
1740                       u16 tclass)
1741 {
1742         const struct task_security_struct *tsec = current_security();
1743         struct inode_security_struct *dsec;
1744         struct superblock_security_struct *sbsec;
1745         u32 sid, newsid;
1746         struct common_audit_data ad;
1747         int rc;
1748
1749         dsec = dir->i_security;
1750         sbsec = dir->i_sb->s_security;
1751
1752         sid = tsec->sid;
1753
1754         ad.type = LSM_AUDIT_DATA_DENTRY;
1755         ad.u.dentry = dentry;
1756
1757         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1758                           DIR__ADD_NAME | DIR__SEARCH,
1759                           &ad);
1760         if (rc)
1761                 return rc;
1762
1763         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1764                                            &newsid);
1765         if (rc)
1766                 return rc;
1767
1768         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1769         if (rc)
1770                 return rc;
1771
1772         return avc_has_perm(newsid, sbsec->sid,
1773                             SECCLASS_FILESYSTEM,
1774                             FILESYSTEM__ASSOCIATE, &ad);
1775 }
1776
1777 /* Check whether a task can create a key. */
1778 static int may_create_key(u32 ksid,
1779                           struct task_struct *ctx)
1780 {
1781         u32 sid = task_sid(ctx);
1782
1783         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1784 }
1785
1786 #define MAY_LINK        0
1787 #define MAY_UNLINK      1
1788 #define MAY_RMDIR       2
1789
1790 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1791 static int may_link(struct inode *dir,
1792                     struct dentry *dentry,
1793                     int kind)
1794
1795 {
1796         struct inode_security_struct *dsec, *isec;
1797         struct common_audit_data ad;
1798         u32 sid = current_sid();
1799         u32 av;
1800         int rc;
1801
1802         dsec = dir->i_security;
1803         isec = d_backing_inode(dentry)->i_security;
1804
1805         ad.type = LSM_AUDIT_DATA_DENTRY;
1806         ad.u.dentry = dentry;
1807
1808         av = DIR__SEARCH;
1809         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1810         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1811         if (rc)
1812                 return rc;
1813
1814         switch (kind) {
1815         case MAY_LINK:
1816                 av = FILE__LINK;
1817                 break;
1818         case MAY_UNLINK:
1819                 av = FILE__UNLINK;
1820                 break;
1821         case MAY_RMDIR:
1822                 av = DIR__RMDIR;
1823                 break;
1824         default:
1825                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1826                         __func__, kind);
1827                 return 0;
1828         }
1829
1830         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1831         return rc;
1832 }
1833
1834 static inline int may_rename(struct inode *old_dir,
1835                              struct dentry *old_dentry,
1836                              struct inode *new_dir,
1837                              struct dentry *new_dentry)
1838 {
1839         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1840         struct common_audit_data ad;
1841         u32 sid = current_sid();
1842         u32 av;
1843         int old_is_dir, new_is_dir;
1844         int rc;
1845
1846         old_dsec = old_dir->i_security;
1847         old_isec = d_backing_inode(old_dentry)->i_security;
1848         old_is_dir = d_is_dir(old_dentry);
1849         new_dsec = new_dir->i_security;
1850
1851         ad.type = LSM_AUDIT_DATA_DENTRY;
1852
1853         ad.u.dentry = old_dentry;
1854         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1855                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1856         if (rc)
1857                 return rc;
1858         rc = avc_has_perm(sid, old_isec->sid,
1859                           old_isec->sclass, FILE__RENAME, &ad);
1860         if (rc)
1861                 return rc;
1862         if (old_is_dir && new_dir != old_dir) {
1863                 rc = avc_has_perm(sid, old_isec->sid,
1864                                   old_isec->sclass, DIR__REPARENT, &ad);
1865                 if (rc)
1866                         return rc;
1867         }
1868
1869         ad.u.dentry = new_dentry;
1870         av = DIR__ADD_NAME | DIR__SEARCH;
1871         if (d_is_positive(new_dentry))
1872                 av |= DIR__REMOVE_NAME;
1873         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1874         if (rc)
1875                 return rc;
1876         if (d_is_positive(new_dentry)) {
1877                 new_isec = d_backing_inode(new_dentry)->i_security;
1878                 new_is_dir = d_is_dir(new_dentry);
1879                 rc = avc_has_perm(sid, new_isec->sid,
1880                                   new_isec->sclass,
1881                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1882                 if (rc)
1883                         return rc;
1884         }
1885
1886         return 0;
1887 }
1888
1889 /* Check whether a task can perform a filesystem operation. */
1890 static int superblock_has_perm(const struct cred *cred,
1891                                struct super_block *sb,
1892                                u32 perms,
1893                                struct common_audit_data *ad)
1894 {
1895         struct superblock_security_struct *sbsec;
1896         u32 sid = cred_sid(cred);
1897
1898         sbsec = sb->s_security;
1899         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1900 }
1901
1902 /* Convert a Linux mode and permission mask to an access vector. */
1903 static inline u32 file_mask_to_av(int mode, int mask)
1904 {
1905         u32 av = 0;
1906
1907         if (!S_ISDIR(mode)) {
1908                 if (mask & MAY_EXEC)
1909                         av |= FILE__EXECUTE;
1910                 if (mask & MAY_READ)
1911                         av |= FILE__READ;
1912
1913                 if (mask & MAY_APPEND)
1914                         av |= FILE__APPEND;
1915                 else if (mask & MAY_WRITE)
1916                         av |= FILE__WRITE;
1917
1918         } else {
1919                 if (mask & MAY_EXEC)
1920                         av |= DIR__SEARCH;
1921                 if (mask & MAY_WRITE)
1922                         av |= DIR__WRITE;
1923                 if (mask & MAY_READ)
1924                         av |= DIR__READ;
1925         }
1926
1927         return av;
1928 }
1929
1930 /* Convert a Linux file to an access vector. */
1931 static inline u32 file_to_av(struct file *file)
1932 {
1933         u32 av = 0;
1934
1935         if (file->f_mode & FMODE_READ)
1936                 av |= FILE__READ;
1937         if (file->f_mode & FMODE_WRITE) {
1938                 if (file->f_flags & O_APPEND)
1939                         av |= FILE__APPEND;
1940                 else
1941                         av |= FILE__WRITE;
1942         }
1943         if (!av) {
1944                 /*
1945                  * Special file opened with flags 3 for ioctl-only use.
1946                  */
1947                 av = FILE__IOCTL;
1948         }
1949
1950         return av;
1951 }
1952
1953 /*
1954  * Convert a file to an access vector and include the correct open
1955  * open permission.
1956  */
1957 static inline u32 open_file_to_av(struct file *file)
1958 {
1959         u32 av = file_to_av(file);
1960
1961         if (selinux_policycap_openperm)
1962                 av |= FILE__OPEN;
1963
1964         return av;
1965 }
1966
1967 /* Hook functions begin here. */
1968
1969 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1970 {
1971         u32 mysid = current_sid();
1972         u32 mgrsid = task_sid(mgr);
1973
1974         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1975                             BINDER__SET_CONTEXT_MGR, NULL);
1976 }
1977
1978 static int selinux_binder_transaction(struct task_struct *from,
1979                                       struct task_struct *to)
1980 {
1981         u32 mysid = current_sid();
1982         u32 fromsid = task_sid(from);
1983         u32 tosid = task_sid(to);
1984         int rc;
1985
1986         if (mysid != fromsid) {
1987                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1988                                   BINDER__IMPERSONATE, NULL);
1989                 if (rc)
1990                         return rc;
1991         }
1992
1993         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1994                             NULL);
1995 }
1996
1997 static int selinux_binder_transfer_binder(struct task_struct *from,
1998                                           struct task_struct *to)
1999 {
2000         u32 fromsid = task_sid(from);
2001         u32 tosid = task_sid(to);
2002
2003         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2004                             NULL);
2005 }
2006
2007 static int selinux_binder_transfer_file(struct task_struct *from,
2008                                         struct task_struct *to,
2009                                         struct file *file)
2010 {
2011         u32 sid = task_sid(to);
2012         struct file_security_struct *fsec = file->f_security;
2013         struct inode *inode = d_backing_inode(file->f_path.dentry);
2014         struct inode_security_struct *isec = inode->i_security;
2015         struct common_audit_data ad;
2016         int rc;
2017
2018         ad.type = LSM_AUDIT_DATA_PATH;
2019         ad.u.path = file->f_path;
2020
2021         if (sid != fsec->sid) {
2022                 rc = avc_has_perm(sid, fsec->sid,
2023                                   SECCLASS_FD,
2024                                   FD__USE,
2025                                   &ad);
2026                 if (rc)
2027                         return rc;
2028         }
2029
2030         if (unlikely(IS_PRIVATE(inode)))
2031                 return 0;
2032
2033         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2034                             &ad);
2035 }
2036
2037 static int selinux_ptrace_access_check(struct task_struct *child,
2038                                      unsigned int mode)
2039 {
2040         if (mode & PTRACE_MODE_READ) {
2041                 u32 sid = current_sid();
2042                 u32 csid = task_sid(child);
2043                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2044         }
2045
2046         return current_has_perm(child, PROCESS__PTRACE);
2047 }
2048
2049 static int selinux_ptrace_traceme(struct task_struct *parent)
2050 {
2051         return task_has_perm(parent, current, PROCESS__PTRACE);
2052 }
2053
2054 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2055                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2056 {
2057         return current_has_perm(target, PROCESS__GETCAP);
2058 }
2059
2060 static int selinux_capset(struct cred *new, const struct cred *old,
2061                           const kernel_cap_t *effective,
2062                           const kernel_cap_t *inheritable,
2063                           const kernel_cap_t *permitted)
2064 {
2065         return cred_has_perm(old, new, PROCESS__SETCAP);
2066 }
2067
2068 /*
2069  * (This comment used to live with the selinux_task_setuid hook,
2070  * which was removed).
2071  *
2072  * Since setuid only affects the current process, and since the SELinux
2073  * controls are not based on the Linux identity attributes, SELinux does not
2074  * need to control this operation.  However, SELinux does control the use of
2075  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2076  */
2077
2078 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2079                            int cap, int audit)
2080 {
2081         return cred_has_capability(cred, cap, audit);
2082 }
2083
2084 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2085 {
2086         const struct cred *cred = current_cred();
2087         int rc = 0;
2088
2089         if (!sb)
2090                 return 0;
2091
2092         switch (cmds) {
2093         case Q_SYNC:
2094         case Q_QUOTAON:
2095         case Q_QUOTAOFF:
2096         case Q_SETINFO:
2097         case Q_SETQUOTA:
2098                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2099                 break;
2100         case Q_GETFMT:
2101         case Q_GETINFO:
2102         case Q_GETQUOTA:
2103                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2104                 break;
2105         default:
2106                 rc = 0;  /* let the kernel handle invalid cmds */
2107                 break;
2108         }
2109         return rc;
2110 }
2111
2112 static int selinux_quota_on(struct dentry *dentry)
2113 {
2114         const struct cred *cred = current_cred();
2115
2116         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2117 }
2118
2119 static int selinux_syslog(int type)
2120 {
2121         int rc;
2122
2123         switch (type) {
2124         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2125         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2126                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2127                 break;
2128         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2129         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2130         /* Set level of messages printed to console */
2131         case SYSLOG_ACTION_CONSOLE_LEVEL:
2132                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2133                 break;
2134         case SYSLOG_ACTION_CLOSE:       /* Close log */
2135         case SYSLOG_ACTION_OPEN:        /* Open log */
2136         case SYSLOG_ACTION_READ:        /* Read from log */
2137         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2138         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2139         default:
2140                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2141                 break;
2142         }
2143         return rc;
2144 }
2145
2146 /*
2147  * Check that a process has enough memory to allocate a new virtual
2148  * mapping. 0 means there is enough memory for the allocation to
2149  * succeed and -ENOMEM implies there is not.
2150  *
2151  * Do not audit the selinux permission check, as this is applied to all
2152  * processes that allocate mappings.
2153  */
2154 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2155 {
2156         int rc, cap_sys_admin = 0;
2157
2158         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2159                                         SECURITY_CAP_NOAUDIT);
2160         if (rc == 0)
2161                 cap_sys_admin = 1;
2162
2163         return cap_sys_admin;
2164 }
2165
2166 /* binprm security operations */
2167
2168 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2169                             const struct task_security_struct *old_tsec,
2170                             const struct task_security_struct *new_tsec)
2171 {
2172         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2173         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2174         int rc;
2175
2176         if (!nnp && !nosuid)
2177                 return 0; /* neither NNP nor nosuid */
2178
2179         if (new_tsec->sid == old_tsec->sid)
2180                 return 0; /* No change in credentials */
2181
2182         /*
2183          * The only transitions we permit under NNP or nosuid
2184          * are transitions to bounded SIDs, i.e. SIDs that are
2185          * guaranteed to only be allowed a subset of the permissions
2186          * of the current SID.
2187          */
2188         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2189         if (rc) {
2190                 /*
2191                  * On failure, preserve the errno values for NNP vs nosuid.
2192                  * NNP:  Operation not permitted for caller.
2193                  * nosuid:  Permission denied to file.
2194                  */
2195                 if (nnp)
2196                         return -EPERM;
2197                 else
2198                         return -EACCES;
2199         }
2200         return 0;
2201 }
2202
2203 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2204 {
2205         const struct task_security_struct *old_tsec;
2206         struct task_security_struct *new_tsec;
2207         struct inode_security_struct *isec;
2208         struct common_audit_data ad;
2209         struct inode *inode = file_inode(bprm->file);
2210         int rc;
2211
2212         /* SELinux context only depends on initial program or script and not
2213          * the script interpreter */
2214         if (bprm->cred_prepared)
2215                 return 0;
2216
2217         old_tsec = current_security();
2218         new_tsec = bprm->cred->security;
2219         isec = inode->i_security;
2220
2221         /* Default to the current task SID. */
2222         new_tsec->sid = old_tsec->sid;
2223         new_tsec->osid = old_tsec->sid;
2224
2225         /* Reset fs, key, and sock SIDs on execve. */
2226         new_tsec->create_sid = 0;
2227         new_tsec->keycreate_sid = 0;
2228         new_tsec->sockcreate_sid = 0;
2229
2230         if (old_tsec->exec_sid) {
2231                 new_tsec->sid = old_tsec->exec_sid;
2232                 /* Reset exec SID on execve. */
2233                 new_tsec->exec_sid = 0;
2234
2235                 /* Fail on NNP or nosuid if not an allowed transition. */
2236                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2237                 if (rc)
2238                         return rc;
2239         } else {
2240                 /* Check for a default transition on this program. */
2241                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2242                                              SECCLASS_PROCESS, NULL,
2243                                              &new_tsec->sid);
2244                 if (rc)
2245                         return rc;
2246
2247                 /*
2248                  * Fallback to old SID on NNP or nosuid if not an allowed
2249                  * transition.
2250                  */
2251                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2252                 if (rc)
2253                         new_tsec->sid = old_tsec->sid;
2254         }
2255
2256         ad.type = LSM_AUDIT_DATA_PATH;
2257         ad.u.path = bprm->file->f_path;
2258
2259         if (new_tsec->sid == old_tsec->sid) {
2260                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2261                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2262                 if (rc)
2263                         return rc;
2264         } else {
2265                 /* Check permissions for the transition. */
2266                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2267                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2268                 if (rc)
2269                         return rc;
2270
2271                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2272                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2273                 if (rc)
2274                         return rc;
2275
2276                 /* Check for shared state */
2277                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2278                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2279                                           SECCLASS_PROCESS, PROCESS__SHARE,
2280                                           NULL);
2281                         if (rc)
2282                                 return -EPERM;
2283                 }
2284
2285                 /* Make sure that anyone attempting to ptrace over a task that
2286                  * changes its SID has the appropriate permit */
2287                 if (bprm->unsafe &
2288                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2289                         struct task_struct *tracer;
2290                         struct task_security_struct *sec;
2291                         u32 ptsid = 0;
2292
2293                         rcu_read_lock();
2294                         tracer = ptrace_parent(current);
2295                         if (likely(tracer != NULL)) {
2296                                 sec = __task_cred(tracer)->security;
2297                                 ptsid = sec->sid;
2298                         }
2299                         rcu_read_unlock();
2300
2301                         if (ptsid != 0) {
2302                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2303                                                   SECCLASS_PROCESS,
2304                                                   PROCESS__PTRACE, NULL);
2305                                 if (rc)
2306                                         return -EPERM;
2307                         }
2308                 }
2309
2310                 /* Clear any possibly unsafe personality bits on exec: */
2311                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2312         }
2313
2314         return 0;
2315 }
2316
2317 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2318 {
2319         const struct task_security_struct *tsec = current_security();
2320         u32 sid, osid;
2321         int atsecure = 0;
2322
2323         sid = tsec->sid;
2324         osid = tsec->osid;
2325
2326         if (osid != sid) {
2327                 /* Enable secure mode for SIDs transitions unless
2328                    the noatsecure permission is granted between
2329                    the two SIDs, i.e. ahp returns 0. */
2330                 atsecure = avc_has_perm(osid, sid,
2331                                         SECCLASS_PROCESS,
2332                                         PROCESS__NOATSECURE, NULL);
2333         }
2334
2335         return !!atsecure;
2336 }
2337
2338 static int match_file(const void *p, struct file *file, unsigned fd)
2339 {
2340         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2341 }
2342
2343 /* Derived from fs/exec.c:flush_old_files. */
2344 static inline void flush_unauthorized_files(const struct cred *cred,
2345                                             struct files_struct *files)
2346 {
2347         struct file *file, *devnull = NULL;
2348         struct tty_struct *tty;
2349         int drop_tty = 0;
2350         unsigned n;
2351
2352         tty = get_current_tty();
2353         if (tty) {
2354                 spin_lock(&tty_files_lock);
2355                 if (!list_empty(&tty->tty_files)) {
2356                         struct tty_file_private *file_priv;
2357
2358                         /* Revalidate access to controlling tty.
2359                            Use file_path_has_perm on the tty path directly
2360                            rather than using file_has_perm, as this particular
2361                            open file may belong to another process and we are
2362                            only interested in the inode-based check here. */
2363                         file_priv = list_first_entry(&tty->tty_files,
2364                                                 struct tty_file_private, list);
2365                         file = file_priv->file;
2366                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2367                                 drop_tty = 1;
2368                 }
2369                 spin_unlock(&tty_files_lock);
2370                 tty_kref_put(tty);
2371         }
2372         /* Reset controlling tty. */
2373         if (drop_tty)
2374                 no_tty();
2375
2376         /* Revalidate access to inherited open files. */
2377         n = iterate_fd(files, 0, match_file, cred);
2378         if (!n) /* none found? */
2379                 return;
2380
2381         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2382         if (IS_ERR(devnull))
2383                 devnull = NULL;
2384         /* replace all the matching ones with this */
2385         do {
2386                 replace_fd(n - 1, devnull, 0);
2387         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2388         if (devnull)
2389                 fput(devnull);
2390 }
2391
2392 /*
2393  * Prepare a process for imminent new credential changes due to exec
2394  */
2395 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2396 {
2397         struct task_security_struct *new_tsec;
2398         struct rlimit *rlim, *initrlim;
2399         int rc, i;
2400
2401         new_tsec = bprm->cred->security;
2402         if (new_tsec->sid == new_tsec->osid)
2403                 return;
2404
2405         /* Close files for which the new task SID is not authorized. */
2406         flush_unauthorized_files(bprm->cred, current->files);
2407
2408         /* Always clear parent death signal on SID transitions. */
2409         current->pdeath_signal = 0;
2410
2411         /* Check whether the new SID can inherit resource limits from the old
2412          * SID.  If not, reset all soft limits to the lower of the current
2413          * task's hard limit and the init task's soft limit.
2414          *
2415          * Note that the setting of hard limits (even to lower them) can be
2416          * controlled by the setrlimit check.  The inclusion of the init task's
2417          * soft limit into the computation is to avoid resetting soft limits
2418          * higher than the default soft limit for cases where the default is
2419          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2420          */
2421         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2422                           PROCESS__RLIMITINH, NULL);
2423         if (rc) {
2424                 /* protect against do_prlimit() */
2425                 task_lock(current);
2426                 for (i = 0; i < RLIM_NLIMITS; i++) {
2427                         rlim = current->signal->rlim + i;
2428                         initrlim = init_task.signal->rlim + i;
2429                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2430                 }
2431                 task_unlock(current);
2432                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2433         }
2434 }
2435
2436 /*
2437  * Clean up the process immediately after the installation of new credentials
2438  * due to exec
2439  */
2440 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2441 {
2442         const struct task_security_struct *tsec = current_security();
2443         struct itimerval itimer;
2444         u32 osid, sid;
2445         int rc, i;
2446
2447         osid = tsec->osid;
2448         sid = tsec->sid;
2449
2450         if (sid == osid)
2451                 return;
2452
2453         /* Check whether the new SID can inherit signal state from the old SID.
2454          * If not, clear itimers to avoid subsequent signal generation and
2455          * flush and unblock signals.
2456          *
2457          * This must occur _after_ the task SID has been updated so that any
2458          * kill done after the flush will be checked against the new SID.
2459          */
2460         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2461         if (rc) {
2462                 memset(&itimer, 0, sizeof itimer);
2463                 for (i = 0; i < 3; i++)
2464                         do_setitimer(i, &itimer, NULL);
2465                 spin_lock_irq(&current->sighand->siglock);
2466                 if (!fatal_signal_pending(current)) {
2467                         flush_sigqueue(&current->pending);
2468                         flush_sigqueue(&current->signal->shared_pending);
2469                         flush_signal_handlers(current, 1);
2470                         sigemptyset(&current->blocked);
2471                         recalc_sigpending();
2472                 }
2473                 spin_unlock_irq(&current->sighand->siglock);
2474         }
2475
2476         /* Wake up the parent if it is waiting so that it can recheck
2477          * wait permission to the new task SID. */
2478         read_lock(&tasklist_lock);
2479         __wake_up_parent(current, current->real_parent);
2480         read_unlock(&tasklist_lock);
2481 }
2482
2483 /* superblock security operations */
2484
2485 static int selinux_sb_alloc_security(struct super_block *sb)
2486 {
2487         return superblock_alloc_security(sb);
2488 }
2489
2490 static void selinux_sb_free_security(struct super_block *sb)
2491 {
2492         superblock_free_security(sb);
2493 }
2494
2495 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2496 {
2497         if (plen > olen)
2498                 return 0;
2499
2500         return !memcmp(prefix, option, plen);
2501 }
2502
2503 static inline int selinux_option(char *option, int len)
2504 {
2505         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2506                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2507                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2508                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2510 }
2511
2512 static inline void take_option(char **to, char *from, int *first, int len)
2513 {
2514         if (!*first) {
2515                 **to = ',';
2516                 *to += 1;
2517         } else
2518                 *first = 0;
2519         memcpy(*to, from, len);
2520         *to += len;
2521 }
2522
2523 static inline void take_selinux_option(char **to, char *from, int *first,
2524                                        int len)
2525 {
2526         int current_size = 0;
2527
2528         if (!*first) {
2529                 **to = '|';
2530                 *to += 1;
2531         } else
2532                 *first = 0;
2533
2534         while (current_size < len) {
2535                 if (*from != '"') {
2536                         **to = *from;
2537                         *to += 1;
2538                 }
2539                 from += 1;
2540                 current_size += 1;
2541         }
2542 }
2543
2544 static int selinux_sb_copy_data(char *orig, char *copy)
2545 {
2546         int fnosec, fsec, rc = 0;
2547         char *in_save, *in_curr, *in_end;
2548         char *sec_curr, *nosec_save, *nosec;
2549         int open_quote = 0;
2550
2551         in_curr = orig;
2552         sec_curr = copy;
2553
2554         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2555         if (!nosec) {
2556                 rc = -ENOMEM;
2557                 goto out;
2558         }
2559
2560         nosec_save = nosec;
2561         fnosec = fsec = 1;
2562         in_save = in_end = orig;
2563
2564         do {
2565                 if (*in_end == '"')
2566                         open_quote = !open_quote;
2567                 if ((*in_end == ',' && open_quote == 0) ||
2568                                 *in_end == '\0') {
2569                         int len = in_end - in_curr;
2570
2571                         if (selinux_option(in_curr, len))
2572                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2573                         else
2574                                 take_option(&nosec, in_curr, &fnosec, len);
2575
2576                         in_curr = in_end + 1;
2577                 }
2578         } while (*in_end++);
2579
2580         strcpy(in_save, nosec_save);
2581         free_page((unsigned long)nosec_save);
2582 out:
2583         return rc;
2584 }
2585
2586 static int selinux_sb_remount(struct super_block *sb, void *data)
2587 {
2588         int rc, i, *flags;
2589         struct security_mnt_opts opts;
2590         char *secdata, **mount_options;
2591         struct superblock_security_struct *sbsec = sb->s_security;
2592
2593         if (!(sbsec->flags & SE_SBINITIALIZED))
2594                 return 0;
2595
2596         if (!data)
2597                 return 0;
2598
2599         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2600                 return 0;
2601
2602         security_init_mnt_opts(&opts);
2603         secdata = alloc_secdata();
2604         if (!secdata)
2605                 return -ENOMEM;
2606         rc = selinux_sb_copy_data(data, secdata);
2607         if (rc)
2608                 goto out_free_secdata;
2609
2610         rc = selinux_parse_opts_str(secdata, &opts);
2611         if (rc)
2612                 goto out_free_secdata;
2613
2614         mount_options = opts.mnt_opts;
2615         flags = opts.mnt_opts_flags;
2616
2617         for (i = 0; i < opts.num_mnt_opts; i++) {
2618                 u32 sid;
2619
2620                 if (flags[i] == SBLABEL_MNT)
2621                         continue;
2622                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2623                 if (rc) {
2624                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2625                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2626                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2627                         goto out_free_opts;
2628                 }
2629                 rc = -EINVAL;
2630                 switch (flags[i]) {
2631                 case FSCONTEXT_MNT:
2632                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2633                                 goto out_bad_option;
2634                         break;
2635                 case CONTEXT_MNT:
2636                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2637                                 goto out_bad_option;
2638                         break;
2639                 case ROOTCONTEXT_MNT: {
2640                         struct inode_security_struct *root_isec;
2641                         root_isec = d_backing_inode(sb->s_root)->i_security;
2642
2643                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2644                                 goto out_bad_option;
2645                         break;
2646                 }
2647                 case DEFCONTEXT_MNT:
2648                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2649                                 goto out_bad_option;
2650                         break;
2651                 default:
2652                         goto out_free_opts;
2653                 }
2654         }
2655
2656         rc = 0;
2657 out_free_opts:
2658         security_free_mnt_opts(&opts);
2659 out_free_secdata:
2660         free_secdata(secdata);
2661         return rc;
2662 out_bad_option:
2663         printk(KERN_WARNING "SELinux: unable to change security options "
2664                "during remount (dev %s, type=%s)\n", sb->s_id,
2665                sb->s_type->name);
2666         goto out_free_opts;
2667 }
2668
2669 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2670 {
2671         const struct cred *cred = current_cred();
2672         struct common_audit_data ad;
2673         int rc;
2674
2675         rc = superblock_doinit(sb, data);
2676         if (rc)
2677                 return rc;
2678
2679         /* Allow all mounts performed by the kernel */
2680         if (flags & MS_KERNMOUNT)
2681                 return 0;
2682
2683         ad.type = LSM_AUDIT_DATA_DENTRY;
2684         ad.u.dentry = sb->s_root;
2685         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2686 }
2687
2688 static int selinux_sb_statfs(struct dentry *dentry)
2689 {
2690         const struct cred *cred = current_cred();
2691         struct common_audit_data ad;
2692
2693         ad.type = LSM_AUDIT_DATA_DENTRY;
2694         ad.u.dentry = dentry->d_sb->s_root;
2695         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2696 }
2697
2698 static int selinux_mount(const char *dev_name,
2699                          struct path *path,
2700                          const char *type,
2701                          unsigned long flags,
2702                          void *data)
2703 {
2704         const struct cred *cred = current_cred();
2705
2706         if (flags & MS_REMOUNT)
2707                 return superblock_has_perm(cred, path->dentry->d_sb,
2708                                            FILESYSTEM__REMOUNT, NULL);
2709         else
2710                 return path_has_perm(cred, path, FILE__MOUNTON);
2711 }
2712
2713 static int selinux_umount(struct vfsmount *mnt, int flags)
2714 {
2715         const struct cred *cred = current_cred();
2716
2717         return superblock_has_perm(cred, mnt->mnt_sb,
2718                                    FILESYSTEM__UNMOUNT, NULL);
2719 }
2720
2721 /* inode security operations */
2722
2723 static int selinux_inode_alloc_security(struct inode *inode)
2724 {
2725         return inode_alloc_security(inode);
2726 }
2727
2728 static void selinux_inode_free_security(struct inode *inode)
2729 {
2730         inode_free_security(inode);
2731 }
2732
2733 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2734                                         struct qstr *name, void **ctx,
2735                                         u32 *ctxlen)
2736 {
2737         u32 newsid;
2738         int rc;
2739
2740         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2741                                            inode_mode_to_security_class(mode),
2742                                            &newsid);
2743         if (rc)
2744                 return rc;
2745
2746         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2747 }
2748
2749 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2750                                        const struct qstr *qstr,
2751                                        const char **name,
2752                                        void **value, size_t *len)
2753 {
2754         const struct task_security_struct *tsec = current_security();
2755         struct inode_security_struct *dsec;
2756         struct superblock_security_struct *sbsec;
2757         u32 sid, newsid, clen;
2758         int rc;
2759         char *context;
2760
2761         dsec = dir->i_security;
2762         sbsec = dir->i_sb->s_security;
2763
2764         sid = tsec->sid;
2765         newsid = tsec->create_sid;
2766
2767         rc = selinux_determine_inode_label(
2768                 dir, qstr,
2769                 inode_mode_to_security_class(inode->i_mode),
2770                 &newsid);
2771         if (rc)
2772                 return rc;
2773
2774         /* Possibly defer initialization to selinux_complete_init. */
2775         if (sbsec->flags & SE_SBINITIALIZED) {
2776                 struct inode_security_struct *isec = inode->i_security;
2777                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2778                 isec->sid = newsid;
2779                 isec->initialized = 1;
2780         }
2781
2782         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2783                 return -EOPNOTSUPP;
2784
2785         if (name)
2786                 *name = XATTR_SELINUX_SUFFIX;
2787
2788         if (value && len) {
2789                 rc = security_sid_to_context_force(newsid, &context, &clen);
2790                 if (rc)
2791                         return rc;
2792                 *value = context;
2793                 *len = clen;
2794         }
2795
2796         return 0;
2797 }
2798
2799 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2800 {
2801         return may_create(dir, dentry, SECCLASS_FILE);
2802 }
2803
2804 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2805 {
2806         return may_link(dir, old_dentry, MAY_LINK);
2807 }
2808
2809 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2810 {
2811         return may_link(dir, dentry, MAY_UNLINK);
2812 }
2813
2814 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2815 {
2816         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2817 }
2818
2819 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2820 {
2821         return may_create(dir, dentry, SECCLASS_DIR);
2822 }
2823
2824 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2825 {
2826         return may_link(dir, dentry, MAY_RMDIR);
2827 }
2828
2829 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2830 {
2831         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2832 }
2833
2834 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2835                                 struct inode *new_inode, struct dentry *new_dentry)
2836 {
2837         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2838 }
2839
2840 static int selinux_inode_readlink(struct dentry *dentry)
2841 {
2842         const struct cred *cred = current_cred();
2843
2844         return dentry_has_perm(cred, dentry, FILE__READ);
2845 }
2846
2847 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2848                                      bool rcu)
2849 {
2850         const struct cred *cred = current_cred();
2851         struct common_audit_data ad;
2852         struct inode_security_struct *isec;
2853         u32 sid;
2854
2855         validate_creds(cred);
2856
2857         ad.type = LSM_AUDIT_DATA_DENTRY;
2858         ad.u.dentry = dentry;
2859         sid = cred_sid(cred);
2860         isec = inode->i_security;
2861
2862         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2863                                   rcu ? MAY_NOT_BLOCK : 0);
2864 }
2865
2866 static noinline int audit_inode_permission(struct inode *inode,
2867                                            u32 perms, u32 audited, u32 denied,
2868                                            int result,
2869                                            unsigned flags)
2870 {
2871         struct common_audit_data ad;
2872         struct inode_security_struct *isec = inode->i_security;
2873         int rc;
2874
2875         ad.type = LSM_AUDIT_DATA_INODE;
2876         ad.u.inode = inode;
2877
2878         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2879                             audited, denied, result, &ad, flags);
2880         if (rc)
2881                 return rc;
2882         return 0;
2883 }
2884
2885 static int selinux_inode_permission(struct inode *inode, int mask)
2886 {
2887         const struct cred *cred = current_cred();
2888         u32 perms;
2889         bool from_access;
2890         unsigned flags = mask & MAY_NOT_BLOCK;
2891         struct inode_security_struct *isec;
2892         u32 sid;
2893         struct av_decision avd;
2894         int rc, rc2;
2895         u32 audited, denied;
2896
2897         from_access = mask & MAY_ACCESS;
2898         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2899
2900         /* No permission to check.  Existence test. */
2901         if (!mask)
2902                 return 0;
2903
2904         validate_creds(cred);
2905
2906         if (unlikely(IS_PRIVATE(inode)))
2907                 return 0;
2908
2909         perms = file_mask_to_av(inode->i_mode, mask);
2910
2911         sid = cred_sid(cred);
2912         isec = inode->i_security;
2913
2914         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2915         audited = avc_audit_required(perms, &avd, rc,
2916                                      from_access ? FILE__AUDIT_ACCESS : 0,
2917                                      &denied);
2918         if (likely(!audited))
2919                 return rc;
2920
2921         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2922         if (rc2)
2923                 return rc2;
2924         return rc;
2925 }
2926
2927 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2928 {
2929         const struct cred *cred = current_cred();
2930         unsigned int ia_valid = iattr->ia_valid;
2931         __u32 av = FILE__WRITE;
2932
2933         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2934         if (ia_valid & ATTR_FORCE) {
2935                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2936                               ATTR_FORCE);
2937                 if (!ia_valid)
2938                         return 0;
2939         }
2940
2941         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2942                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2943                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2944
2945         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2946                         && !(ia_valid & ATTR_FILE))
2947                 av |= FILE__OPEN;
2948
2949         return dentry_has_perm(cred, dentry, av);
2950 }
2951
2952 static int selinux_inode_getattr(const struct path *path)
2953 {
2954         return path_has_perm(current_cred(), path, FILE__GETATTR);
2955 }
2956
2957 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2958 {
2959         const struct cred *cred = current_cred();
2960
2961         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2962                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2963                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2964                         if (!capable(CAP_SETFCAP))
2965                                 return -EPERM;
2966                 } else if (!capable(CAP_SYS_ADMIN)) {
2967                         /* A different attribute in the security namespace.
2968                            Restrict to administrator. */
2969                         return -EPERM;
2970                 }
2971         }
2972
2973         /* Not an attribute we recognize, so just check the
2974            ordinary setattr permission. */
2975         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2976 }
2977
2978 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2979                                   const void *value, size_t size, int flags)
2980 {
2981         struct inode *inode = d_backing_inode(dentry);
2982         struct inode_security_struct *isec = inode->i_security;
2983         struct superblock_security_struct *sbsec;
2984         struct common_audit_data ad;
2985         u32 newsid, sid = current_sid();
2986         int rc = 0;
2987
2988         if (strcmp(name, XATTR_NAME_SELINUX))
2989                 return selinux_inode_setotherxattr(dentry, name);
2990
2991         sbsec = inode->i_sb->s_security;
2992         if (!(sbsec->flags & SBLABEL_MNT))
2993                 return -EOPNOTSUPP;
2994
2995         if (!inode_owner_or_capable(inode))
2996                 return -EPERM;
2997
2998         ad.type = LSM_AUDIT_DATA_DENTRY;
2999         ad.u.dentry = dentry;
3000
3001         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3002                           FILE__RELABELFROM, &ad);
3003         if (rc)
3004                 return rc;
3005
3006         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3007         if (rc == -EINVAL) {
3008                 if (!capable(CAP_MAC_ADMIN)) {
3009                         struct audit_buffer *ab;
3010                         size_t audit_size;
3011                         const char *str;
3012
3013                         /* We strip a nul only if it is at the end, otherwise the
3014                          * context contains a nul and we should audit that */
3015                         if (value) {
3016                                 str = value;
3017                                 if (str[size - 1] == '\0')
3018                                         audit_size = size - 1;
3019                                 else
3020                                         audit_size = size;
3021                         } else {
3022                                 str = "";
3023                                 audit_size = 0;
3024                         }
3025                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3026                         audit_log_format(ab, "op=setxattr invalid_context=");
3027                         audit_log_n_untrustedstring(ab, value, audit_size);
3028                         audit_log_end(ab);
3029
3030                         return rc;
3031                 }
3032                 rc = security_context_to_sid_force(value, size, &newsid);
3033         }
3034         if (rc)
3035                 return rc;
3036
3037         rc = avc_has_perm(sid, newsid, isec->sclass,
3038                           FILE__RELABELTO, &ad);
3039         if (rc)
3040                 return rc;
3041
3042         rc = security_validate_transition(isec->sid, newsid, sid,
3043                                           isec->sclass);
3044         if (rc)
3045                 return rc;
3046
3047         return avc_has_perm(newsid,
3048                             sbsec->sid,
3049                             SECCLASS_FILESYSTEM,
3050                             FILESYSTEM__ASSOCIATE,
3051                             &ad);
3052 }
3053
3054 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3055                                         const void *value, size_t size,
3056                                         int flags)
3057 {
3058         struct inode *inode = d_backing_inode(dentry);
3059         struct inode_security_struct *isec = inode->i_security;
3060         u32 newsid;
3061         int rc;
3062
3063         if (strcmp(name, XATTR_NAME_SELINUX)) {
3064                 /* Not an attribute we recognize, so nothing to do. */
3065                 return;
3066         }
3067
3068         rc = security_context_to_sid_force(value, size, &newsid);
3069         if (rc) {
3070                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3071                        "for (%s, %lu), rc=%d\n",
3072                        inode->i_sb->s_id, inode->i_ino, -rc);
3073                 return;
3074         }
3075
3076         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3077         isec->sid = newsid;
3078         isec->initialized = 1;
3079
3080         return;
3081 }
3082
3083 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3084 {
3085         const struct cred *cred = current_cred();
3086
3087         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3088 }
3089
3090 static int selinux_inode_listxattr(struct dentry *dentry)
3091 {
3092         const struct cred *cred = current_cred();
3093
3094         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3095 }
3096
3097 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3098 {
3099         if (strcmp(name, XATTR_NAME_SELINUX))
3100                 return selinux_inode_setotherxattr(dentry, name);
3101
3102         /* No one is allowed to remove a SELinux security label.
3103            You can change the label, but all data must be labeled. */
3104         return -EACCES;
3105 }
3106
3107 /*
3108  * Copy the inode security context value to the user.
3109  *
3110  * Permission check is handled by selinux_inode_getxattr hook.
3111  */
3112 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3113 {
3114         u32 size;
3115         int error;
3116         char *context = NULL;
3117         struct inode_security_struct *isec = inode->i_security;
3118
3119         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3120                 return -EOPNOTSUPP;
3121
3122         /*
3123          * If the caller has CAP_MAC_ADMIN, then get the raw context
3124          * value even if it is not defined by current policy; otherwise,
3125          * use the in-core value under current policy.
3126          * Use the non-auditing forms of the permission checks since
3127          * getxattr may be called by unprivileged processes commonly
3128          * and lack of permission just means that we fall back to the
3129          * in-core context value, not a denial.
3130          */
3131         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3132                             SECURITY_CAP_NOAUDIT);
3133         if (!error)
3134                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3135                                             SECURITY_CAP_NOAUDIT);
3136         if (!error)
3137                 error = security_sid_to_context_force(isec->sid, &context,
3138                                                       &size);
3139         else
3140                 error = security_sid_to_context(isec->sid, &context, &size);
3141         if (error)
3142                 return error;
3143         error = size;
3144         if (alloc) {
3145                 *buffer = context;
3146                 goto out_nofree;
3147         }
3148         kfree(context);
3149 out_nofree:
3150         return error;
3151 }
3152
3153 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3154                                      const void *value, size_t size, int flags)
3155 {
3156         struct inode_security_struct *isec = inode->i_security;
3157         u32 newsid;
3158         int rc;
3159
3160         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3161                 return -EOPNOTSUPP;
3162
3163         if (!value || !size)
3164                 return -EACCES;
3165
3166         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3167         if (rc)
3168                 return rc;
3169
3170         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3171         isec->sid = newsid;
3172         isec->initialized = 1;
3173         return 0;
3174 }
3175
3176 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3177 {
3178         const int len = sizeof(XATTR_NAME_SELINUX);
3179         if (buffer && len <= buffer_size)
3180                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3181         return len;
3182 }
3183
3184 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3185 {
3186         struct inode_security_struct *isec = inode->i_security;
3187         *secid = isec->sid;
3188 }
3189
3190 /* file security operations */
3191
3192 static int selinux_revalidate_file_permission(struct file *file, int mask)
3193 {
3194         const struct cred *cred = current_cred();
3195         struct inode *inode = file_inode(file);
3196
3197         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3198         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3199                 mask |= MAY_APPEND;
3200
3201         return file_has_perm(cred, file,
3202                              file_mask_to_av(inode->i_mode, mask));
3203 }
3204
3205 static int selinux_file_permission(struct file *file, int mask)
3206 {
3207         struct inode *inode = file_inode(file);
3208         struct file_security_struct *fsec = file->f_security;
3209         struct inode_security_struct *isec = inode->i_security;
3210         u32 sid = current_sid();
3211
3212         if (!mask)
3213                 /* No permission to check.  Existence test. */
3214                 return 0;
3215
3216         if (sid == fsec->sid && fsec->isid == isec->sid &&
3217             fsec->pseqno == avc_policy_seqno())
3218                 /* No change since file_open check. */
3219                 return 0;
3220
3221         return selinux_revalidate_file_permission(file, mask);
3222 }
3223
3224 static int selinux_file_alloc_security(struct file *file)
3225 {
3226         return file_alloc_security(file);
3227 }
3228
3229 static void selinux_file_free_security(struct file *file)
3230 {
3231         file_free_security(file);
3232 }
3233
3234 /*
3235  * Check whether a task has the ioctl permission and cmd
3236  * operation to an inode.
3237  */
3238 int ioctl_has_perm(const struct cred *cred, struct file *file,
3239                 u32 requested, u16 cmd)
3240 {
3241         struct common_audit_data ad;
3242         struct file_security_struct *fsec = file->f_security;
3243         struct inode *inode = file_inode(file);
3244         struct inode_security_struct *isec = inode->i_security;
3245         struct lsm_ioctlop_audit ioctl;
3246         u32 ssid = cred_sid(cred);
3247         int rc;
3248         u8 driver = cmd >> 8;
3249         u8 xperm = cmd & 0xff;
3250
3251         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3252         ad.u.op = &ioctl;
3253         ad.u.op->cmd = cmd;
3254         ad.u.op->path = file->f_path;
3255
3256         if (ssid != fsec->sid) {
3257                 rc = avc_has_perm(ssid, fsec->sid,
3258                                 SECCLASS_FD,
3259                                 FD__USE,
3260                                 &ad);
3261                 if (rc)
3262                         goto out;
3263         }
3264
3265         if (unlikely(IS_PRIVATE(inode)))
3266                 return 0;
3267
3268         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3269                         requested, driver, xperm, &ad);
3270 out:
3271         return rc;
3272 }
3273
3274 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3275                               unsigned long arg)
3276 {
3277         const struct cred *cred = current_cred();
3278         int error = 0;
3279
3280         switch (cmd) {
3281         case FIONREAD:
3282         /* fall through */
3283         case FIBMAP:
3284         /* fall through */
3285         case FIGETBSZ:
3286         /* fall through */
3287         case FS_IOC_GETFLAGS:
3288         /* fall through */
3289         case FS_IOC_GETVERSION:
3290                 error = file_has_perm(cred, file, FILE__GETATTR);
3291                 break;
3292
3293         case FS_IOC_SETFLAGS:
3294         /* fall through */
3295         case FS_IOC_SETVERSION:
3296                 error = file_has_perm(cred, file, FILE__SETATTR);
3297                 break;
3298
3299         /* sys_ioctl() checks */
3300         case FIONBIO:
3301         /* fall through */
3302         case FIOASYNC:
3303                 error = file_has_perm(cred, file, 0);
3304                 break;
3305
3306         case KDSKBENT:
3307         case KDSKBSENT:
3308                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3309                                             SECURITY_CAP_AUDIT);
3310                 break;
3311
3312         /* default case assumes that the command will go
3313          * to the file's ioctl() function.
3314          */
3315         default:
3316                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3317         }
3318         return error;
3319 }
3320
3321 static int default_noexec;
3322
3323 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3324 {
3325         const struct cred *cred = current_cred();
3326         int rc = 0;
3327
3328         if (default_noexec &&
3329             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3330                                    (!shared && (prot & PROT_WRITE)))) {
3331                 /*
3332                  * We are making executable an anonymous mapping or a
3333                  * private file mapping that will also be writable.
3334                  * This has an additional check.
3335                  */
3336                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3337                 if (rc)
3338                         goto error;
3339         }
3340
3341         if (file) {
3342                 /* read access is always possible with a mapping */
3343                 u32 av = FILE__READ;
3344
3345                 /* write access only matters if the mapping is shared */
3346                 if (shared && (prot & PROT_WRITE))
3347                         av |= FILE__WRITE;
3348
3349                 if (prot & PROT_EXEC)
3350                         av |= FILE__EXECUTE;
3351
3352                 return file_has_perm(cred, file, av);
3353         }
3354
3355 error:
3356         return rc;
3357 }
3358
3359 static int selinux_mmap_addr(unsigned long addr)
3360 {
3361         int rc = 0;
3362
3363         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3364                 u32 sid = current_sid();
3365                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3366                                   MEMPROTECT__MMAP_ZERO, NULL);
3367         }
3368
3369         return rc;
3370 }
3371
3372 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3373                              unsigned long prot, unsigned long flags)
3374 {
3375         if (selinux_checkreqprot)
3376                 prot = reqprot;
3377
3378         return file_map_prot_check(file, prot,
3379                                    (flags & MAP_TYPE) == MAP_SHARED);
3380 }
3381
3382 static int selinux_file_mprotect(struct vm_area_struct *vma,
3383                                  unsigned long reqprot,
3384                                  unsigned long prot)
3385 {
3386         const struct cred *cred = current_cred();
3387
3388         if (selinux_checkreqprot)
3389                 prot = reqprot;
3390
3391         if (default_noexec &&
3392             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3393                 int rc = 0;
3394                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3395                     vma->vm_end <= vma->vm_mm->brk) {
3396                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3397                 } else if (!vma->vm_file &&
3398                            vma->vm_start <= vma->vm_mm->start_stack &&
3399                            vma->vm_end >= vma->vm_mm->start_stack) {
3400                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3401                 } else if (vma->vm_file && vma->anon_vma) {
3402                         /*
3403                          * We are making executable a file mapping that has
3404                          * had some COW done. Since pages might have been
3405                          * written, check ability to execute the possibly
3406                          * modified content.  This typically should only
3407                          * occur for text relocations.
3408                          */
3409                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3410                 }
3411                 if (rc)
3412                         return rc;
3413         }
3414
3415         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3416 }
3417
3418 static int selinux_file_lock(struct file *file, unsigned int cmd)
3419 {
3420         const struct cred *cred = current_cred();
3421
3422         return file_has_perm(cred, file, FILE__LOCK);
3423 }
3424
3425 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3426                               unsigned long arg)
3427 {
3428         const struct cred *cred = current_cred();
3429         int err = 0;
3430
3431         switch (cmd) {
3432         case F_SETFL:
3433                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3434                         err = file_has_perm(cred, file, FILE__WRITE);
3435                         break;
3436                 }
3437                 /* fall through */
3438         case F_SETOWN:
3439         case F_SETSIG:
3440         case F_GETFL:
3441         case F_GETOWN:
3442         case F_GETSIG:
3443         case F_GETOWNER_UIDS:
3444                 /* Just check FD__USE permission */
3445                 err = file_has_perm(cred, file, 0);
3446                 break;
3447         case F_GETLK:
3448         case F_SETLK:
3449         case F_SETLKW:
3450         case F_OFD_GETLK:
3451         case F_OFD_SETLK:
3452         case F_OFD_SETLKW:
3453 #if BITS_PER_LONG == 32
3454         case F_GETLK64:
3455         case F_SETLK64:
3456         case F_SETLKW64:
3457 #endif
3458                 err = file_has_perm(cred, file, FILE__LOCK);
3459                 break;
3460         }
3461
3462         return err;
3463 }
3464
3465 static void selinux_file_set_fowner(struct file *file)
3466 {
3467         struct file_security_struct *fsec;
3468
3469         fsec = file->f_security;
3470         fsec->fown_sid = current_sid();
3471 }
3472
3473 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3474                                        struct fown_struct *fown, int signum)
3475 {
3476         struct file *file;
3477         u32 sid = task_sid(tsk);
3478         u32 perm;
3479         struct file_security_struct *fsec;
3480
3481         /* struct fown_struct is never outside the context of a struct file */
3482         file = container_of(fown, struct file, f_owner);
3483
3484         fsec = file->f_security;
3485
3486         if (!signum)
3487                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3488         else
3489                 perm = signal_to_av(signum);
3490
3491         return avc_has_perm(fsec->fown_sid, sid,
3492                             SECCLASS_PROCESS, perm, NULL);
3493 }
3494
3495 static int selinux_file_receive(struct file *file)
3496 {
3497         const struct cred *cred = current_cred();
3498
3499         return file_has_perm(cred, file, file_to_av(file));
3500 }
3501
3502 static int selinux_file_open(struct file *file, const struct cred *cred)
3503 {
3504         struct file_security_struct *fsec;
3505         struct inode_security_struct *isec;
3506
3507         fsec = file->f_security;
3508         isec = file_inode(file)->i_security;
3509         /*
3510          * Save inode label and policy sequence number
3511          * at open-time so that selinux_file_permission
3512          * can determine whether revalidation is necessary.
3513          * Task label is already saved in the file security
3514          * struct as its SID.
3515          */
3516         fsec->isid = isec->sid;
3517         fsec->pseqno = avc_policy_seqno();
3518         /*
3519          * Since the inode label or policy seqno may have changed
3520          * between the selinux_inode_permission check and the saving
3521          * of state above, recheck that access is still permitted.
3522          * Otherwise, access might never be revalidated against the
3523          * new inode label or new policy.
3524          * This check is not redundant - do not remove.
3525          */
3526         return file_path_has_perm(cred, file, open_file_to_av(file));
3527 }
3528
3529 /* task security operations */
3530
3531 static int selinux_task_create(unsigned long clone_flags)
3532 {
3533         return current_has_perm(current, PROCESS__FORK);
3534 }
3535
3536 /*
3537  * allocate the SELinux part of blank credentials
3538  */
3539 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3540 {
3541         struct task_security_struct *tsec;
3542
3543         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3544         if (!tsec)
3545                 return -ENOMEM;
3546
3547         cred->security = tsec;
3548         return 0;
3549 }
3550
3551 /*
3552  * detach and free the LSM part of a set of credentials
3553  */
3554 static void selinux_cred_free(struct cred *cred)
3555 {
3556         struct task_security_struct *tsec = cred->security;
3557
3558         /*
3559          * cred->security == NULL if security_cred_alloc_blank() or
3560          * security_prepare_creds() returned an error.
3561          */
3562         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3563         cred->security = (void *) 0x7UL;
3564         kfree(tsec);
3565 }
3566
3567 /*
3568  * prepare a new set of credentials for modification
3569  */
3570 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3571                                 gfp_t gfp)
3572 {
3573         const struct task_security_struct *old_tsec;
3574         struct task_security_struct *tsec;
3575
3576         old_tsec = old->security;
3577
3578         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3579         if (!tsec)
3580                 return -ENOMEM;
3581
3582         new->security = tsec;
3583         return 0;
3584 }
3585
3586 /*
3587  * transfer the SELinux data to a blank set of creds
3588  */
3589 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3590 {
3591         const struct task_security_struct *old_tsec = old->security;
3592         struct task_security_struct *tsec = new->security;
3593
3594         *tsec = *old_tsec;
3595 }
3596
3597 /*
3598  * set the security data for a kernel service
3599  * - all the creation contexts are set to unlabelled
3600  */
3601 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3602 {
3603         struct task_security_struct *tsec = new->security;
3604         u32 sid = current_sid();
3605         int ret;
3606
3607         ret = avc_has_perm(sid, secid,
3608                            SECCLASS_KERNEL_SERVICE,
3609                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3610                            NULL);
3611         if (ret == 0) {
3612                 tsec->sid = secid;
3613                 tsec->create_sid = 0;
3614                 tsec->keycreate_sid = 0;
3615                 tsec->sockcreate_sid = 0;
3616         }
3617         return ret;
3618 }
3619
3620 /*
3621  * set the file creation context in a security record to the same as the
3622  * objective context of the specified inode
3623  */
3624 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3625 {
3626         struct inode_security_struct *isec = inode->i_security;
3627         struct task_security_struct *tsec = new->security;
3628         u32 sid = current_sid();
3629         int ret;
3630
3631         ret = avc_has_perm(sid, isec->sid,
3632                            SECCLASS_KERNEL_SERVICE,
3633                            KERNEL_SERVICE__CREATE_FILES_AS,
3634                            NULL);
3635
3636         if (ret == 0)
3637                 tsec->create_sid = isec->sid;
3638         return ret;
3639 }
3640
3641 static int selinux_kernel_module_request(char *kmod_name)
3642 {
3643         u32 sid;
3644         struct common_audit_data ad;
3645
3646         sid = task_sid(current);
3647
3648         ad.type = LSM_AUDIT_DATA_KMOD;
3649         ad.u.kmod_name = kmod_name;
3650
3651         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3652                             SYSTEM__MODULE_REQUEST, &ad);
3653 }
3654
3655 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3656 {
3657         return current_has_perm(p, PROCESS__SETPGID);
3658 }
3659
3660 static int selinux_task_getpgid(struct task_struct *p)
3661 {
3662         return current_has_perm(p, PROCESS__GETPGID);
3663 }
3664
3665 static int selinux_task_getsid(struct task_struct *p)
3666 {
3667         return current_has_perm(p, PROCESS__GETSESSION);
3668 }
3669
3670 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3671 {
3672         *secid = task_sid(p);
3673 }
3674
3675 static int selinux_task_setnice(struct task_struct *p, int nice)
3676 {
3677         return current_has_perm(p, PROCESS__SETSCHED);
3678 }
3679
3680 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3681 {
3682         return current_has_perm(p, PROCESS__SETSCHED);
3683 }
3684
3685 static int selinux_task_getioprio(struct task_struct *p)
3686 {
3687         return current_has_perm(p, PROCESS__GETSCHED);
3688 }
3689
3690 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3691                 struct rlimit *new_rlim)
3692 {
3693         struct rlimit *old_rlim = p->signal->rlim + resource;
3694
3695         /* Control the ability to change the hard limit (whether
3696            lowering or raising it), so that the hard limit can
3697            later be used as a safe reset point for the soft limit
3698            upon context transitions.  See selinux_bprm_committing_creds. */
3699         if (old_rlim->rlim_max != new_rlim->rlim_max)
3700                 return current_has_perm(p, PROCESS__SETRLIMIT);
3701
3702         return 0;
3703 }
3704
3705 static int selinux_task_setscheduler(struct task_struct *p)
3706 {
3707         return current_has_perm(p, PROCESS__SETSCHED);
3708 }
3709
3710 static int selinux_task_getscheduler(struct task_struct *p)
3711 {
3712         return current_has_perm(p, PROCESS__GETSCHED);
3713 }
3714
3715 static int selinux_task_movememory(struct task_struct *p)
3716 {
3717         return current_has_perm(p, PROCESS__SETSCHED);
3718 }
3719
3720 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3721                                 int sig, u32 secid)
3722 {
3723         u32 perm;
3724         int rc;
3725
3726         if (!sig)
3727                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3728         else
3729                 perm = signal_to_av(sig);
3730         if (secid)
3731                 rc = avc_has_perm(secid, task_sid(p),
3732                                   SECCLASS_PROCESS, perm, NULL);
3733         else
3734                 rc = current_has_perm(p, perm);
3735         return rc;
3736 }
3737
3738 static int selinux_task_wait(struct task_struct *p)
3739 {
3740         return task_has_perm(p, current, PROCESS__SIGCHLD);
3741 }
3742
3743 static void selinux_task_to_inode(struct task_struct *p,
3744                                   struct inode *inode)
3745 {
3746         struct inode_security_struct *isec = inode->i_security;
3747         u32 sid = task_sid(p);
3748
3749         isec->sid = sid;
3750         isec->initialized = 1;
3751 }
3752
3753 /* Returns error only if unable to parse addresses */
3754 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3755                         struct common_audit_data *ad, u8 *proto)
3756 {
3757         int offset, ihlen, ret = -EINVAL;
3758         struct iphdr _iph, *ih;
3759
3760         offset = skb_network_offset(skb);
3761         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3762         if (ih == NULL)
3763                 goto out;
3764
3765         ihlen = ih->ihl * 4;
3766         if (ihlen < sizeof(_iph))
3767                 goto out;
3768
3769         ad->u.net->v4info.saddr = ih->saddr;
3770         ad->u.net->v4info.daddr = ih->daddr;
3771         ret = 0;
3772
3773         if (proto)
3774                 *proto = ih->protocol;
3775
3776         switch (ih->protocol) {
3777         case IPPROTO_TCP: {
3778                 struct tcphdr _tcph, *th;
3779
3780                 if (ntohs(ih->frag_off) & IP_OFFSET)
3781                         break;
3782
3783                 offset += ihlen;
3784                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3785                 if (th == NULL)
3786                         break;
3787
3788                 ad->u.net->sport = th->source;
3789                 ad->u.net->dport = th->dest;
3790                 break;
3791         }
3792
3793         case IPPROTO_UDP: {
3794                 struct udphdr _udph, *uh;
3795
3796                 if (ntohs(ih->frag_off) & IP_OFFSET)
3797                         break;
3798
3799                 offset += ihlen;
3800                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3801                 if (uh == NULL)
3802                         break;
3803
3804                 ad->u.net->sport = uh->source;
3805                 ad->u.net->dport = uh->dest;
3806                 break;
3807         }
3808
3809         case IPPROTO_DCCP: {
3810                 struct dccp_hdr _dccph, *dh;
3811
3812                 if (ntohs(ih->frag_off) & IP_OFFSET)
3813                         break;
3814
3815                 offset += ihlen;
3816                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3817                 if (dh == NULL)
3818                         break;
3819
3820                 ad->u.net->sport = dh->dccph_sport;
3821                 ad->u.net->dport = dh->dccph_dport;
3822                 break;
3823         }
3824
3825         default:
3826                 break;
3827         }
3828 out:
3829         return ret;
3830 }
3831
3832 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3833
3834 /* Returns error only if unable to parse addresses */
3835 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3836                         struct common_audit_data *ad, u8 *proto)
3837 {
3838         u8 nexthdr;
3839         int ret = -EINVAL, offset;
3840         struct ipv6hdr _ipv6h, *ip6;
3841         __be16 frag_off;
3842
3843         offset = skb_network_offset(skb);
3844         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3845         if (ip6 == NULL)
3846                 goto out;
3847
3848         ad->u.net->v6info.saddr = ip6->saddr;
3849         ad->u.net->v6info.daddr = ip6->daddr;
3850         ret = 0;
3851
3852         nexthdr = ip6->nexthdr;
3853         offset += sizeof(_ipv6h);
3854         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3855         if (offset < 0)
3856                 goto out;
3857
3858         if (proto)
3859                 *proto = nexthdr;
3860
3861         switch (nexthdr) {
3862         case IPPROTO_TCP: {
3863                 struct tcphdr _tcph, *th;
3864
3865                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3866                 if (th == NULL)
3867                         break;
3868
3869                 ad->u.net->sport = th->source;
3870                 ad->u.net->dport = th->dest;
3871                 break;
3872         }
3873
3874         case IPPROTO_UDP: {
3875                 struct udphdr _udph, *uh;
3876
3877                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3878                 if (uh == NULL)
3879                         break;
3880
3881                 ad->u.net->sport = uh->source;
3882                 ad->u.net->dport = uh->dest;
3883                 break;
3884         }
3885
3886         case IPPROTO_DCCP: {
3887                 struct dccp_hdr _dccph, *dh;
3888
3889                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3890                 if (dh == NULL)
3891                         break;
3892
3893                 ad->u.net->sport = dh->dccph_sport;
3894                 ad->u.net->dport = dh->dccph_dport;
3895                 break;
3896         }
3897
3898         /* includes fragments */
3899         default:
3900                 break;
3901         }
3902 out:
3903         return ret;
3904 }
3905
3906 #endif /* IPV6 */
3907
3908 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3909                              char **_addrp, int src, u8 *proto)
3910 {
3911         char *addrp;
3912         int ret;
3913
3914         switch (ad->u.net->family) {
3915         case PF_INET:
3916                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3917                 if (ret)
3918                         goto parse_error;
3919                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3920                                        &ad->u.net->v4info.daddr);
3921                 goto okay;
3922
3923 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3924         case PF_INET6:
3925                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3926                 if (ret)
3927                         goto parse_error;
3928                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3929                                        &ad->u.net->v6info.daddr);
3930                 goto okay;
3931 #endif  /* IPV6 */
3932         default:
3933                 addrp = NULL;
3934                 goto okay;
3935         }
3936
3937 parse_error:
3938         printk(KERN_WARNING
3939                "SELinux: failure in selinux_parse_skb(),"
3940                " unable to parse packet\n");
3941         return ret;
3942
3943 okay:
3944         if (_addrp)
3945                 *_addrp = addrp;
3946         return 0;
3947 }
3948
3949 /**
3950  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3951  * @skb: the packet
3952  * @family: protocol family
3953  * @sid: the packet's peer label SID
3954  *
3955  * Description:
3956  * Check the various different forms of network peer labeling and determine
3957  * the peer label/SID for the packet; most of the magic actually occurs in
3958  * the security server function security_net_peersid_cmp().  The function
3959  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3960  * or -EACCES if @sid is invalid due to inconsistencies with the different
3961  * peer labels.
3962  *
3963  */
3964 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3965 {
3966         int err;
3967         u32 xfrm_sid;
3968         u32 nlbl_sid;
3969         u32 nlbl_type;
3970
3971         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3972         if (unlikely(err))
3973                 return -EACCES;
3974         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3975         if (unlikely(err))
3976                 return -EACCES;
3977
3978         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3979         if (unlikely(err)) {
3980                 printk(KERN_WARNING
3981                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3982                        " unable to determine packet's peer label\n");
3983                 return -EACCES;
3984         }
3985
3986         return 0;
3987 }
3988
3989 /**
3990  * selinux_conn_sid - Determine the child socket label for a connection
3991  * @sk_sid: the parent socket's SID
3992  * @skb_sid: the packet's SID
3993  * @conn_sid: the resulting connection SID
3994  *
3995  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3996  * combined with the MLS information from @skb_sid in order to create
3997  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3998  * of @sk_sid.  Returns zero on success, negative values on failure.
3999  *
4000  */
4001 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4002 {
4003         int err = 0;
4004
4005         if (skb_sid != SECSID_NULL)
4006                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4007         else
4008                 *conn_sid = sk_sid;
4009
4010         return err;
4011 }
4012
4013 /* socket security operations */
4014
4015 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4016                                  u16 secclass, u32 *socksid)
4017 {
4018         if (tsec->sockcreate_sid > SECSID_NULL) {
4019                 *socksid = tsec->sockcreate_sid;
4020                 return 0;
4021         }
4022
4023         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4024                                        socksid);
4025 }
4026
4027 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4028 {
4029         struct sk_security_struct *sksec = sk->sk_security;
4030         struct common_audit_data ad;
4031         struct lsm_network_audit net = {0,};
4032         u32 tsid = task_sid(task);
4033
4034         if (sksec->sid == SECINITSID_KERNEL)
4035                 return 0;
4036
4037         ad.type = LSM_AUDIT_DATA_NET;
4038         ad.u.net = &net;
4039         ad.u.net->sk = sk;
4040
4041         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4042 }
4043
4044 static int selinux_socket_create(int family, int type,
4045                                  int protocol, int kern)
4046 {
4047         const struct task_security_struct *tsec = current_security();
4048         u32 newsid;
4049         u16 secclass;
4050         int rc;
4051
4052         if (kern)
4053                 return 0;
4054
4055         secclass = socket_type_to_security_class(family, type, protocol);
4056         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4057         if (rc)
4058                 return rc;
4059
4060         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4061 }
4062
4063 static int selinux_socket_post_create(struct socket *sock, int family,
4064                                       int type, int protocol, int kern)
4065 {
4066         const struct task_security_struct *tsec = current_security();
4067         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4068         struct sk_security_struct *sksec;
4069         int err = 0;
4070
4071         isec->sclass = socket_type_to_security_class(family, type, protocol);
4072
4073         if (kern)
4074                 isec->sid = SECINITSID_KERNEL;
4075         else {
4076                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4077                 if (err)
4078                         return err;
4079         }
4080
4081         isec->initialized = 1;
4082
4083         if (sock->sk) {
4084                 sksec = sock->sk->sk_security;
4085                 sksec->sid = isec->sid;
4086                 sksec->sclass = isec->sclass;
4087                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4088         }
4089
4090         return err;
4091 }
4092
4093 /* Range of port numbers used to automatically bind.
4094    Need to determine whether we should perform a name_bind
4095    permission check between the socket and the port number. */
4096
4097 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4098 {
4099         struct sock *sk = sock->sk;
4100         u16 family;
4101         int err;
4102
4103         err = sock_has_perm(current, sk, SOCKET__BIND);
4104         if (err)
4105                 goto out;
4106
4107         /*
4108          * If PF_INET or PF_INET6, check name_bind permission for the port.
4109          * Multiple address binding for SCTP is not supported yet: we just
4110          * check the first address now.
4111          */
4112         family = sk->sk_family;
4113         if (family == PF_INET || family == PF_INET6) {
4114                 char *addrp;
4115                 struct sk_security_struct *sksec = sk->sk_security;
4116                 struct common_audit_data ad;
4117                 struct lsm_network_audit net = {0,};
4118                 struct sockaddr_in *addr4 = NULL;
4119                 struct sockaddr_in6 *addr6 = NULL;
4120                 unsigned short snum;
4121                 u32 sid, node_perm;
4122
4123                 if (family == PF_INET) {
4124                         addr4 = (struct sockaddr_in *)address;
4125                         snum = ntohs(addr4->sin_port);
4126                         addrp = (char *)&addr4->sin_addr.s_addr;
4127                 } else {
4128                         addr6 = (struct sockaddr_in6 *)address;
4129                         snum = ntohs(addr6->sin6_port);
4130                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4131                 }
4132
4133                 if (snum) {
4134                         int low, high;
4135
4136                         inet_get_local_port_range(sock_net(sk), &low, &high);
4137
4138                         if (snum < max(PROT_SOCK, low) || snum > high) {
4139                                 err = sel_netport_sid(sk->sk_protocol,
4140                                                       snum, &sid);
4141                                 if (err)
4142                                         goto out;
4143                                 ad.type = LSM_AUDIT_DATA_NET;
4144                                 ad.u.net = &net;
4145                                 ad.u.net->sport = htons(snum);
4146                                 ad.u.net->family = family;
4147                                 err = avc_has_perm(sksec->sid, sid,
4148                                                    sksec->sclass,
4149                                                    SOCKET__NAME_BIND, &ad);
4150                                 if (err)
4151                                         goto out;
4152                         }
4153                 }
4154
4155                 switch (sksec->sclass) {
4156                 case SECCLASS_TCP_SOCKET:
4157                         node_perm = TCP_SOCKET__NODE_BIND;
4158                         break;
4159
4160                 case SECCLASS_UDP_SOCKET:
4161                         node_perm = UDP_SOCKET__NODE_BIND;
4162                         break;
4163
4164                 case SECCLASS_DCCP_SOCKET:
4165                         node_perm = DCCP_SOCKET__NODE_BIND;
4166                         break;
4167
4168                 default:
4169                         node_perm = RAWIP_SOCKET__NODE_BIND;
4170                         break;
4171                 }
4172
4173                 err = sel_netnode_sid(addrp, family, &sid);
4174                 if (err)
4175                         goto out;
4176
4177                 ad.type = LSM_AUDIT_DATA_NET;
4178                 ad.u.net = &net;
4179                 ad.u.net->sport = htons(snum);
4180                 ad.u.net->family = family;
4181
4182                 if (family == PF_INET)
4183                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4184                 else
4185                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4186
4187                 err = avc_has_perm(sksec->sid, sid,
4188                                    sksec->sclass, node_perm, &ad);
4189                 if (err)
4190                         goto out;
4191         }
4192 out:
4193         return err;
4194 }
4195
4196 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4197 {
4198         struct sock *sk = sock->sk;
4199         struct sk_security_struct *sksec = sk->sk_security;
4200         int err;
4201
4202         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4203         if (err)
4204                 return err;
4205
4206         /*
4207          * If a TCP or DCCP socket, check name_connect permission for the port.
4208          */
4209         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4210             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4211                 struct common_audit_data ad;
4212                 struct lsm_network_audit net = {0,};
4213                 struct sockaddr_in *addr4 = NULL;
4214                 struct sockaddr_in6 *addr6 = NULL;
4215                 unsigned short snum;
4216                 u32 sid, perm;
4217
4218                 if (sk->sk_family == PF_INET) {
4219                         addr4 = (struct sockaddr_in *)address;
4220                         if (addrlen < sizeof(struct sockaddr_in))
4221                                 return -EINVAL;
4222                         snum = ntohs(addr4->sin_port);
4223                 } else {
4224                         addr6 = (struct sockaddr_in6 *)address;
4225                         if (addrlen < SIN6_LEN_RFC2133)
4226                                 return -EINVAL;
4227                         snum = ntohs(addr6->sin6_port);
4228                 }
4229
4230                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4231                 if (err)
4232                         goto out;
4233
4234                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4235                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4236
4237                 ad.type = LSM_AUDIT_DATA_NET;
4238                 ad.u.net = &net;
4239                 ad.u.net->dport = htons(snum);
4240                 ad.u.net->family = sk->sk_family;
4241                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4242                 if (err)
4243                         goto out;
4244         }
4245
4246         err = selinux_netlbl_socket_connect(sk, address);
4247
4248 out:
4249         return err;
4250 }
4251
4252 static int selinux_socket_listen(struct socket *sock, int backlog)
4253 {
4254         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4255 }
4256
4257 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4258 {
4259         int err;
4260         struct inode_security_struct *isec;
4261         struct inode_security_struct *newisec;
4262
4263         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4264         if (err)
4265                 return err;
4266
4267         newisec = SOCK_INODE(newsock)->i_security;
4268
4269         isec = SOCK_INODE(sock)->i_security;
4270         newisec->sclass = isec->sclass;
4271         newisec->sid = isec->sid;
4272         newisec->initialized = 1;
4273
4274         return 0;
4275 }
4276
4277 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4278                                   int size)
4279 {
4280         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4281 }
4282
4283 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4284                                   int size, int flags)
4285 {
4286         return sock_has_perm(current, sock->sk, SOCKET__READ);
4287 }
4288
4289 static int selinux_socket_getsockname(struct socket *sock)
4290 {
4291         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4292 }
4293
4294 static int selinux_socket_getpeername(struct socket *sock)
4295 {
4296         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4297 }
4298
4299 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4300 {
4301         int err;
4302
4303         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4304         if (err)
4305                 return err;
4306
4307         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4308 }
4309
4310 static int selinux_socket_getsockopt(struct socket *sock, int level,
4311                                      int optname)
4312 {
4313         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4314 }
4315
4316 static int selinux_socket_shutdown(struct socket *sock, int how)
4317 {
4318         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4319 }
4320
4321 static int selinux_socket_unix_stream_connect(struct sock *sock,
4322                                               struct sock *other,
4323                                               struct sock *newsk)
4324 {
4325         struct sk_security_struct *sksec_sock = sock->sk_security;
4326         struct sk_security_struct *sksec_other = other->sk_security;
4327         struct sk_security_struct *sksec_new = newsk->sk_security;
4328         struct common_audit_data ad;
4329         struct lsm_network_audit net = {0,};
4330         int err;
4331
4332         ad.type = LSM_AUDIT_DATA_NET;
4333         ad.u.net = &net;
4334         ad.u.net->sk = other;
4335
4336         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4337                            sksec_other->sclass,
4338                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4339         if (err)
4340                 return err;
4341
4342         /* server child socket */
4343         sksec_new->peer_sid = sksec_sock->sid;
4344         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4345                                     &sksec_new->sid);
4346         if (err)
4347                 return err;
4348
4349         /* connecting socket */
4350         sksec_sock->peer_sid = sksec_new->sid;
4351
4352         return 0;
4353 }
4354
4355 static int selinux_socket_unix_may_send(struct socket *sock,
4356                                         struct socket *other)
4357 {
4358         struct sk_security_struct *ssec = sock->sk->sk_security;
4359         struct sk_security_struct *osec = other->sk->sk_security;
4360         struct common_audit_data ad;
4361         struct lsm_network_audit net = {0,};
4362
4363         ad.type = LSM_AUDIT_DATA_NET;
4364         ad.u.net = &net;
4365         ad.u.net->sk = other->sk;
4366
4367         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4368                             &ad);
4369 }
4370
4371 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4372                                     char *addrp, u16 family, u32 peer_sid,
4373                                     struct common_audit_data *ad)
4374 {
4375         int err;
4376         u32 if_sid;
4377         u32 node_sid;
4378
4379         err = sel_netif_sid(ns, ifindex, &if_sid);
4380         if (err)
4381                 return err;
4382         err = avc_has_perm(peer_sid, if_sid,
4383                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4384         if (err)
4385                 return err;
4386
4387         err = sel_netnode_sid(addrp, family, &node_sid);
4388         if (err)
4389                 return err;
4390         return avc_has_perm(peer_sid, node_sid,
4391                             SECCLASS_NODE, NODE__RECVFROM, ad);
4392 }
4393
4394 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4395                                        u16 family)
4396 {
4397         int err = 0;
4398         struct sk_security_struct *sksec = sk->sk_security;
4399         u32 sk_sid = sksec->sid;
4400         struct common_audit_data ad;
4401         struct lsm_network_audit net = {0,};
4402         char *addrp;
4403
4404         ad.type = LSM_AUDIT_DATA_NET;
4405         ad.u.net = &net;
4406         ad.u.net->netif = skb->skb_iif;
4407         ad.u.net->family = family;
4408         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4409         if (err)
4410                 return err;
4411
4412         if (selinux_secmark_enabled()) {
4413                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4414                                    PACKET__RECV, &ad);
4415                 if (err)
4416                         return err;
4417         }
4418
4419         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4420         if (err)
4421                 return err;
4422         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4423
4424         return err;
4425 }
4426
4427 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4428 {
4429         int err;
4430         struct sk_security_struct *sksec = sk->sk_security;
4431         u16 family = sk->sk_family;
4432         u32 sk_sid = sksec->sid;
4433         struct common_audit_data ad;
4434         struct lsm_network_audit net = {0,};
4435         char *addrp;
4436         u8 secmark_active;
4437         u8 peerlbl_active;
4438
4439         if (family != PF_INET && family != PF_INET6)
4440                 return 0;
4441
4442         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4443         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4444                 family = PF_INET;
4445
4446         /* If any sort of compatibility mode is enabled then handoff processing
4447          * to the selinux_sock_rcv_skb_compat() function to deal with the
4448          * special handling.  We do this in an attempt to keep this function
4449          * as fast and as clean as possible. */
4450         if (!selinux_policycap_netpeer)
4451                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4452
4453         secmark_active = selinux_secmark_enabled();
4454         peerlbl_active = selinux_peerlbl_enabled();
4455         if (!secmark_active && !peerlbl_active)
4456                 return 0;
4457
4458         ad.type = LSM_AUDIT_DATA_NET;
4459         ad.u.net = &net;
4460         ad.u.net->netif = skb->skb_iif;
4461         ad.u.net->family = family;
4462         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4463         if (err)
4464                 return err;
4465
4466         if (peerlbl_active) {
4467                 u32 peer_sid;
4468
4469                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4470                 if (err)
4471                         return err;
4472                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4473                                                addrp, family, peer_sid, &ad);
4474                 if (err) {
4475                         selinux_netlbl_err(skb, err, 0);
4476                         return err;
4477                 }
4478                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4479                                    PEER__RECV, &ad);
4480                 if (err) {
4481                         selinux_netlbl_err(skb, err, 0);
4482                         return err;
4483                 }
4484         }
4485
4486         if (secmark_active) {
4487                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4488                                    PACKET__RECV, &ad);
4489                 if (err)
4490                         return err;
4491         }
4492
4493         return err;
4494 }
4495
4496 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4497                                             int __user *optlen, unsigned len)
4498 {
4499         int err = 0;
4500         char *scontext;
4501         u32 scontext_len;
4502         struct sk_security_struct *sksec = sock->sk->sk_security;
4503         u32 peer_sid = SECSID_NULL;
4504
4505         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4506             sksec->sclass == SECCLASS_TCP_SOCKET)
4507                 peer_sid = sksec->peer_sid;
4508         if (peer_sid == SECSID_NULL)
4509                 return -ENOPROTOOPT;
4510
4511         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4512         if (err)
4513                 return err;
4514
4515         if (scontext_len > len) {
4516                 err = -ERANGE;
4517                 goto out_len;
4518         }
4519
4520         if (copy_to_user(optval, scontext, scontext_len))
4521                 err = -EFAULT;
4522
4523 out_len:
4524         if (put_user(scontext_len, optlen))
4525                 err = -EFAULT;
4526         kfree(scontext);
4527         return err;
4528 }
4529
4530 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4531 {
4532         u32 peer_secid = SECSID_NULL;
4533         u16 family;
4534
4535         if (skb && skb->protocol == htons(ETH_P_IP))
4536                 family = PF_INET;
4537         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4538                 family = PF_INET6;
4539         else if (sock)
4540                 family = sock->sk->sk_family;
4541         else
4542                 goto out;
4543
4544         if (sock && family == PF_UNIX)
4545                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4546         else if (skb)
4547                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4548
4549 out:
4550         *secid = peer_secid;
4551         if (peer_secid == SECSID_NULL)
4552                 return -EINVAL;
4553         return 0;
4554 }
4555
4556 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4557 {
4558         struct sk_security_struct *sksec;
4559
4560         sksec = kzalloc(sizeof(*sksec), priority);
4561         if (!sksec)
4562                 return -ENOMEM;
4563
4564         sksec->peer_sid = SECINITSID_UNLABELED;
4565         sksec->sid = SECINITSID_UNLABELED;
4566         sksec->sclass = SECCLASS_SOCKET;
4567         selinux_netlbl_sk_security_reset(sksec);
4568         sk->sk_security = sksec;
4569
4570         return 0;
4571 }
4572
4573 static void selinux_sk_free_security(struct sock *sk)
4574 {
4575         struct sk_security_struct *sksec = sk->sk_security;
4576
4577         sk->sk_security = NULL;
4578         selinux_netlbl_sk_security_free(sksec);
4579         kfree(sksec);
4580 }
4581
4582 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4583 {
4584         struct sk_security_struct *sksec = sk->sk_security;
4585         struct sk_security_struct *newsksec = newsk->sk_security;
4586
4587         newsksec->sid = sksec->sid;
4588         newsksec->peer_sid = sksec->peer_sid;
4589         newsksec->sclass = sksec->sclass;
4590
4591         selinux_netlbl_sk_security_reset(newsksec);
4592 }
4593
4594 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4595 {
4596         if (!sk)
4597                 *secid = SECINITSID_ANY_SOCKET;
4598         else {
4599                 struct sk_security_struct *sksec = sk->sk_security;
4600
4601                 *secid = sksec->sid;
4602         }
4603 }
4604
4605 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4606 {
4607         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4608         struct sk_security_struct *sksec = sk->sk_security;
4609
4610         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4611             sk->sk_family == PF_UNIX)
4612                 isec->sid = sksec->sid;
4613         sksec->sclass = isec->sclass;
4614 }
4615
4616 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4617                                      struct request_sock *req)
4618 {
4619         struct sk_security_struct *sksec = sk->sk_security;
4620         int err;
4621         u16 family = req->rsk_ops->family;
4622         u32 connsid;
4623         u32 peersid;
4624
4625         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4626         if (err)
4627                 return err;
4628         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4629         if (err)
4630                 return err;
4631         req->secid = connsid;
4632         req->peer_secid = peersid;
4633
4634         return selinux_netlbl_inet_conn_request(req, family);
4635 }
4636
4637 static void selinux_inet_csk_clone(struct sock *newsk,
4638                                    const struct request_sock *req)
4639 {
4640         struct sk_security_struct *newsksec = newsk->sk_security;
4641
4642         newsksec->sid = req->secid;
4643         newsksec->peer_sid = req->peer_secid;
4644         /* NOTE: Ideally, we should also get the isec->sid for the
4645            new socket in sync, but we don't have the isec available yet.
4646            So we will wait until sock_graft to do it, by which
4647            time it will have been created and available. */
4648
4649         /* We don't need to take any sort of lock here as we are the only
4650          * thread with access to newsksec */
4651         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4652 }
4653
4654 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4655 {
4656         u16 family = sk->sk_family;
4657         struct sk_security_struct *sksec = sk->sk_security;
4658
4659         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4660         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4661                 family = PF_INET;
4662
4663         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4664 }
4665
4666 static int selinux_secmark_relabel_packet(u32 sid)
4667 {
4668         const struct task_security_struct *__tsec;
4669         u32 tsid;
4670
4671         __tsec = current_security();
4672         tsid = __tsec->sid;
4673
4674         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4675 }
4676
4677 static void selinux_secmark_refcount_inc(void)
4678 {
4679         atomic_inc(&selinux_secmark_refcount);
4680 }
4681
4682 static void selinux_secmark_refcount_dec(void)
4683 {
4684         atomic_dec(&selinux_secmark_refcount);
4685 }
4686
4687 static void selinux_req_classify_flow(const struct request_sock *req,
4688                                       struct flowi *fl)
4689 {
4690         fl->flowi_secid = req->secid;
4691 }
4692
4693 static int selinux_tun_dev_alloc_security(void **security)
4694 {
4695         struct tun_security_struct *tunsec;
4696
4697         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4698         if (!tunsec)
4699                 return -ENOMEM;
4700         tunsec->sid = current_sid();
4701
4702         *security = tunsec;
4703         return 0;
4704 }
4705
4706 static void selinux_tun_dev_free_security(void *security)
4707 {
4708         kfree(security);
4709 }
4710
4711 static int selinux_tun_dev_create(void)
4712 {
4713         u32 sid = current_sid();
4714
4715         /* we aren't taking into account the "sockcreate" SID since the socket
4716          * that is being created here is not a socket in the traditional sense,
4717          * instead it is a private sock, accessible only to the kernel, and
4718          * representing a wide range of network traffic spanning multiple
4719          * connections unlike traditional sockets - check the TUN driver to
4720          * get a better understanding of why this socket is special */
4721
4722         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4723                             NULL);
4724 }
4725
4726 static int selinux_tun_dev_attach_queue(void *security)
4727 {
4728         struct tun_security_struct *tunsec = security;
4729
4730         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4731                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4732 }
4733
4734 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4735 {
4736         struct tun_security_struct *tunsec = security;
4737         struct sk_security_struct *sksec = sk->sk_security;
4738
4739         /* we don't currently perform any NetLabel based labeling here and it
4740          * isn't clear that we would want to do so anyway; while we could apply
4741          * labeling without the support of the TUN user the resulting labeled
4742          * traffic from the other end of the connection would almost certainly
4743          * cause confusion to the TUN user that had no idea network labeling
4744          * protocols were being used */
4745
4746         sksec->sid = tunsec->sid;
4747         sksec->sclass = SECCLASS_TUN_SOCKET;
4748
4749         return 0;
4750 }
4751
4752 static int selinux_tun_dev_open(void *security)
4753 {
4754         struct tun_security_struct *tunsec = security;
4755         u32 sid = current_sid();
4756         int err;
4757
4758         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4759                            TUN_SOCKET__RELABELFROM, NULL);
4760         if (err)
4761                 return err;
4762         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4763                            TUN_SOCKET__RELABELTO, NULL);
4764         if (err)
4765                 return err;
4766         tunsec->sid = sid;
4767
4768         return 0;
4769 }
4770
4771 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4772 {
4773         int err = 0;
4774         u32 perm;
4775         struct nlmsghdr *nlh;
4776         struct sk_security_struct *sksec = sk->sk_security;
4777
4778         if (skb->len < NLMSG_HDRLEN) {
4779                 err = -EINVAL;
4780                 goto out;
4781         }
4782         nlh = nlmsg_hdr(skb);
4783
4784         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4785         if (err) {
4786                 if (err == -EINVAL) {
4787                         printk(KERN_WARNING
4788                                "SELinux: unrecognized netlink message:"
4789                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4790                                sk->sk_protocol, nlh->nlmsg_type,
4791                                secclass_map[sksec->sclass - 1].name);
4792                         if (!selinux_enforcing || security_get_allow_unknown())
4793                                 err = 0;
4794                 }
4795
4796                 /* Ignore */
4797                 if (err == -ENOENT)
4798                         err = 0;
4799                 goto out;
4800         }
4801
4802         err = sock_has_perm(current, sk, perm);
4803 out:
4804         return err;
4805 }
4806
4807 #ifdef CONFIG_NETFILTER
4808
4809 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4810                                        const struct net_device *indev,
4811                                        u16 family)
4812 {
4813         int err;
4814         char *addrp;
4815         u32 peer_sid;
4816         struct common_audit_data ad;
4817         struct lsm_network_audit net = {0,};
4818         u8 secmark_active;
4819         u8 netlbl_active;
4820         u8 peerlbl_active;
4821
4822         if (!selinux_policycap_netpeer)
4823                 return NF_ACCEPT;
4824
4825         secmark_active = selinux_secmark_enabled();
4826         netlbl_active = netlbl_enabled();
4827         peerlbl_active = selinux_peerlbl_enabled();
4828         if (!secmark_active && !peerlbl_active)
4829                 return NF_ACCEPT;
4830
4831         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4832                 return NF_DROP;
4833
4834         ad.type = LSM_AUDIT_DATA_NET;
4835         ad.u.net = &net;
4836         ad.u.net->netif = indev->ifindex;
4837         ad.u.net->family = family;
4838         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4839                 return NF_DROP;
4840
4841         if (peerlbl_active) {
4842                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4843                                                addrp, family, peer_sid, &ad);
4844                 if (err) {
4845                         selinux_netlbl_err(skb, err, 1);
4846                         return NF_DROP;
4847                 }
4848         }
4849
4850         if (secmark_active)
4851                 if (avc_has_perm(peer_sid, skb->secmark,
4852                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4853                         return NF_DROP;
4854
4855         if (netlbl_active)
4856                 /* we do this in the FORWARD path and not the POST_ROUTING
4857                  * path because we want to make sure we apply the necessary
4858                  * labeling before IPsec is applied so we can leverage AH
4859                  * protection */
4860                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4861                         return NF_DROP;
4862
4863         return NF_ACCEPT;
4864 }
4865
4866 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4867                                          struct sk_buff *skb,
4868                                          const struct nf_hook_state *state)
4869 {
4870         return selinux_ip_forward(skb, state->in, PF_INET);
4871 }
4872
4873 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4874 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4875                                          struct sk_buff *skb,
4876                                          const struct nf_hook_state *state)
4877 {
4878         return selinux_ip_forward(skb, state->in, PF_INET6);
4879 }
4880 #endif  /* IPV6 */
4881
4882 static unsigned int selinux_ip_output(struct sk_buff *skb,
4883                                       u16 family)
4884 {
4885         struct sock *sk;
4886         u32 sid;
4887
4888         if (!netlbl_enabled())
4889                 return NF_ACCEPT;
4890
4891         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4892          * because we want to make sure we apply the necessary labeling
4893          * before IPsec is applied so we can leverage AH protection */
4894         sk = skb->sk;
4895         if (sk) {
4896                 struct sk_security_struct *sksec;
4897
4898                 if (sk->sk_state == TCP_LISTEN)
4899                         /* if the socket is the listening state then this
4900                          * packet is a SYN-ACK packet which means it needs to
4901                          * be labeled based on the connection/request_sock and
4902                          * not the parent socket.  unfortunately, we can't
4903                          * lookup the request_sock yet as it isn't queued on
4904                          * the parent socket until after the SYN-ACK is sent.
4905                          * the "solution" is to simply pass the packet as-is
4906                          * as any IP option based labeling should be copied
4907                          * from the initial connection request (in the IP
4908                          * layer).  it is far from ideal, but until we get a
4909                          * security label in the packet itself this is the
4910                          * best we can do. */
4911                         return NF_ACCEPT;
4912
4913                 /* standard practice, label using the parent socket */
4914                 sksec = sk->sk_security;
4915                 sid = sksec->sid;
4916         } else
4917                 sid = SECINITSID_KERNEL;
4918         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4919                 return NF_DROP;
4920
4921         return NF_ACCEPT;
4922 }
4923
4924 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4925                                         struct sk_buff *skb,
4926                                         const struct nf_hook_state *state)
4927 {
4928         return selinux_ip_output(skb, PF_INET);
4929 }
4930
4931 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4932                                                 int ifindex,
4933                                                 u16 family)
4934 {
4935         struct sock *sk = skb->sk;
4936         struct sk_security_struct *sksec;
4937         struct common_audit_data ad;
4938         struct lsm_network_audit net = {0,};
4939         char *addrp;
4940         u8 proto;
4941
4942         if (sk == NULL)
4943                 return NF_ACCEPT;
4944         sksec = sk->sk_security;
4945
4946         ad.type = LSM_AUDIT_DATA_NET;
4947         ad.u.net = &net;
4948         ad.u.net->netif = ifindex;
4949         ad.u.net->family = family;
4950         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4951                 return NF_DROP;
4952
4953         if (selinux_secmark_enabled())
4954                 if (avc_has_perm(sksec->sid, skb->secmark,
4955                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4956                         return NF_DROP_ERR(-ECONNREFUSED);
4957
4958         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4959                 return NF_DROP_ERR(-ECONNREFUSED);
4960
4961         return NF_ACCEPT;
4962 }
4963
4964 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4965                                          const struct net_device *outdev,
4966                                          u16 family)
4967 {
4968         u32 secmark_perm;
4969         u32 peer_sid;
4970         int ifindex = outdev->ifindex;
4971         struct sock *sk;
4972         struct common_audit_data ad;
4973         struct lsm_network_audit net = {0,};
4974         char *addrp;
4975         u8 secmark_active;
4976         u8 peerlbl_active;
4977
4978         /* If any sort of compatibility mode is enabled then handoff processing
4979          * to the selinux_ip_postroute_compat() function to deal with the
4980          * special handling.  We do this in an attempt to keep this function
4981          * as fast and as clean as possible. */
4982         if (!selinux_policycap_netpeer)
4983                 return selinux_ip_postroute_compat(skb, ifindex, family);
4984
4985         secmark_active = selinux_secmark_enabled();
4986         peerlbl_active = selinux_peerlbl_enabled();
4987         if (!secmark_active && !peerlbl_active)
4988                 return NF_ACCEPT;
4989
4990         sk = skb->sk;
4991
4992 #ifdef CONFIG_XFRM
4993         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4994          * packet transformation so allow the packet to pass without any checks
4995          * since we'll have another chance to perform access control checks
4996          * when the packet is on it's final way out.
4997          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4998          *       is NULL, in this case go ahead and apply access control.
4999          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5000          *       TCP listening state we cannot wait until the XFRM processing
5001          *       is done as we will miss out on the SA label if we do;
5002          *       unfortunately, this means more work, but it is only once per
5003          *       connection. */
5004         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5005             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5006                 return NF_ACCEPT;
5007 #endif
5008
5009         if (sk == NULL) {
5010                 /* Without an associated socket the packet is either coming
5011                  * from the kernel or it is being forwarded; check the packet
5012                  * to determine which and if the packet is being forwarded
5013                  * query the packet directly to determine the security label. */
5014                 if (skb->skb_iif) {
5015                         secmark_perm = PACKET__FORWARD_OUT;
5016                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5017                                 return NF_DROP;
5018                 } else {
5019                         secmark_perm = PACKET__SEND;
5020                         peer_sid = SECINITSID_KERNEL;
5021                 }
5022         } else if (sk->sk_state == TCP_LISTEN) {
5023                 /* Locally generated packet but the associated socket is in the
5024                  * listening state which means this is a SYN-ACK packet.  In
5025                  * this particular case the correct security label is assigned
5026                  * to the connection/request_sock but unfortunately we can't
5027                  * query the request_sock as it isn't queued on the parent
5028                  * socket until after the SYN-ACK packet is sent; the only
5029                  * viable choice is to regenerate the label like we do in
5030                  * selinux_inet_conn_request().  See also selinux_ip_output()
5031                  * for similar problems. */
5032                 u32 skb_sid;
5033                 struct sk_security_struct *sksec = sk->sk_security;
5034                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5035                         return NF_DROP;
5036                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5037                  * and the packet has been through at least one XFRM
5038                  * transformation then we must be dealing with the "final"
5039                  * form of labeled IPsec packet; since we've already applied
5040                  * all of our access controls on this packet we can safely
5041                  * pass the packet. */
5042                 if (skb_sid == SECSID_NULL) {
5043                         switch (family) {
5044                         case PF_INET:
5045                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5046                                         return NF_ACCEPT;
5047                                 break;
5048                         case PF_INET6:
5049                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5050                                         return NF_ACCEPT;
5051                                 break;
5052                         default:
5053                                 return NF_DROP_ERR(-ECONNREFUSED);
5054                         }
5055                 }
5056                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5057                         return NF_DROP;
5058                 secmark_perm = PACKET__SEND;
5059         } else {
5060                 /* Locally generated packet, fetch the security label from the
5061                  * associated socket. */
5062                 struct sk_security_struct *sksec = sk->sk_security;
5063                 peer_sid = sksec->sid;
5064                 secmark_perm = PACKET__SEND;
5065         }
5066
5067         ad.type = LSM_AUDIT_DATA_NET;
5068         ad.u.net = &net;
5069         ad.u.net->netif = ifindex;
5070         ad.u.net->family = family;
5071         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5072                 return NF_DROP;
5073
5074         if (secmark_active)
5075                 if (avc_has_perm(peer_sid, skb->secmark,
5076                                  SECCLASS_PACKET, secmark_perm, &ad))
5077                         return NF_DROP_ERR(-ECONNREFUSED);
5078
5079         if (peerlbl_active) {
5080                 u32 if_sid;
5081                 u32 node_sid;
5082
5083                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5084                         return NF_DROP;
5085                 if (avc_has_perm(peer_sid, if_sid,
5086                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5087                         return NF_DROP_ERR(-ECONNREFUSED);
5088
5089                 if (sel_netnode_sid(addrp, family, &node_sid))
5090                         return NF_DROP;
5091                 if (avc_has_perm(peer_sid, node_sid,
5092                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5093                         return NF_DROP_ERR(-ECONNREFUSED);
5094         }
5095
5096         return NF_ACCEPT;
5097 }
5098
5099 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5100                                            struct sk_buff *skb,
5101                                            const struct nf_hook_state *state)
5102 {
5103         return selinux_ip_postroute(skb, state->out, PF_INET);
5104 }
5105
5106 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5107 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5108                                            struct sk_buff *skb,
5109                                            const struct nf_hook_state *state)
5110 {
5111         return selinux_ip_postroute(skb, state->out, PF_INET6);
5112 }
5113 #endif  /* IPV6 */
5114
5115 #endif  /* CONFIG_NETFILTER */
5116
5117 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5118 {
5119         return selinux_nlmsg_perm(sk, skb);
5120 }
5121
5122 static int ipc_alloc_security(struct task_struct *task,
5123                               struct kern_ipc_perm *perm,
5124                               u16 sclass)
5125 {
5126         struct ipc_security_struct *isec;
5127         u32 sid;
5128
5129         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5130         if (!isec)
5131                 return -ENOMEM;
5132
5133         sid = task_sid(task);
5134         isec->sclass = sclass;
5135         isec->sid = sid;
5136         perm->security = isec;
5137
5138         return 0;
5139 }
5140
5141 static void ipc_free_security(struct kern_ipc_perm *perm)
5142 {
5143         struct ipc_security_struct *isec = perm->security;
5144         perm->security = NULL;
5145         kfree(isec);
5146 }
5147
5148 static int msg_msg_alloc_security(struct msg_msg *msg)
5149 {
5150         struct msg_security_struct *msec;
5151
5152         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5153         if (!msec)
5154                 return -ENOMEM;
5155
5156         msec->sid = SECINITSID_UNLABELED;
5157         msg->security = msec;
5158
5159         return 0;
5160 }
5161
5162 static void msg_msg_free_security(struct msg_msg *msg)
5163 {
5164         struct msg_security_struct *msec = msg->security;
5165
5166         msg->security = NULL;
5167         kfree(msec);
5168 }
5169
5170 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5171                         u32 perms)
5172 {
5173         struct ipc_security_struct *isec;
5174         struct common_audit_data ad;
5175         u32 sid = current_sid();
5176
5177         isec = ipc_perms->security;
5178
5179         ad.type = LSM_AUDIT_DATA_IPC;
5180         ad.u.ipc_id = ipc_perms->key;
5181
5182         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5183 }
5184
5185 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5186 {
5187         return msg_msg_alloc_security(msg);
5188 }
5189
5190 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5191 {
5192         msg_msg_free_security(msg);
5193 }
5194
5195 /* message queue security operations */
5196 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5197 {
5198         struct ipc_security_struct *isec;
5199         struct common_audit_data ad;
5200         u32 sid = current_sid();
5201         int rc;
5202
5203         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5204         if (rc)
5205                 return rc;
5206
5207         isec = msq->q_perm.security;
5208
5209         ad.type = LSM_AUDIT_DATA_IPC;
5210         ad.u.ipc_id = msq->q_perm.key;
5211
5212         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5213                           MSGQ__CREATE, &ad);
5214         if (rc) {
5215                 ipc_free_security(&msq->q_perm);
5216                 return rc;
5217         }
5218         return 0;
5219 }
5220
5221 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5222 {
5223         ipc_free_security(&msq->q_perm);
5224 }
5225
5226 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5227 {
5228         struct ipc_security_struct *isec;
5229         struct common_audit_data ad;
5230         u32 sid = current_sid();
5231
5232         isec = msq->q_perm.security;
5233
5234         ad.type = LSM_AUDIT_DATA_IPC;
5235         ad.u.ipc_id = msq->q_perm.key;
5236
5237         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5238                             MSGQ__ASSOCIATE, &ad);
5239 }
5240
5241 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5242 {
5243         int err;
5244         int perms;
5245
5246         switch (cmd) {
5247         case IPC_INFO:
5248         case MSG_INFO:
5249                 /* No specific object, just general system-wide information. */
5250                 return task_has_system(current, SYSTEM__IPC_INFO);
5251         case IPC_STAT:
5252         case MSG_STAT:
5253                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5254                 break;
5255         case IPC_SET:
5256                 perms = MSGQ__SETATTR;
5257                 break;
5258         case IPC_RMID:
5259                 perms = MSGQ__DESTROY;
5260                 break;
5261         default:
5262                 return 0;
5263         }
5264
5265         err = ipc_has_perm(&msq->q_perm, perms);
5266         return err;
5267 }
5268
5269 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5270 {
5271         struct ipc_security_struct *isec;
5272         struct msg_security_struct *msec;
5273         struct common_audit_data ad;
5274         u32 sid = current_sid();
5275         int rc;
5276
5277         isec = msq->q_perm.security;
5278         msec = msg->security;
5279
5280         /*
5281          * First time through, need to assign label to the message
5282          */
5283         if (msec->sid == SECINITSID_UNLABELED) {
5284                 /*
5285                  * Compute new sid based on current process and
5286                  * message queue this message will be stored in
5287                  */
5288                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5289                                              NULL, &msec->sid);
5290                 if (rc)
5291                         return rc;
5292         }
5293
5294         ad.type = LSM_AUDIT_DATA_IPC;
5295         ad.u.ipc_id = msq->q_perm.key;
5296
5297         /* Can this process write to the queue? */
5298         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5299                           MSGQ__WRITE, &ad);
5300         if (!rc)
5301                 /* Can this process send the message */
5302                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5303                                   MSG__SEND, &ad);
5304         if (!rc)
5305                 /* Can the message be put in the queue? */
5306                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5307                                   MSGQ__ENQUEUE, &ad);
5308
5309         return rc;
5310 }
5311
5312 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5313                                     struct task_struct *target,
5314                                     long type, int mode)
5315 {
5316         struct ipc_security_struct *isec;
5317         struct msg_security_struct *msec;
5318         struct common_audit_data ad;
5319         u32 sid = task_sid(target);
5320         int rc;
5321
5322         isec = msq->q_perm.security;
5323         msec = msg->security;
5324
5325         ad.type = LSM_AUDIT_DATA_IPC;
5326         ad.u.ipc_id = msq->q_perm.key;
5327
5328         rc = avc_has_perm(sid, isec->sid,
5329                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5330         if (!rc)
5331                 rc = avc_has_perm(sid, msec->sid,
5332                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5333         return rc;
5334 }
5335
5336 /* Shared Memory security operations */
5337 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5338 {
5339         struct ipc_security_struct *isec;
5340         struct common_audit_data ad;
5341         u32 sid = current_sid();
5342         int rc;
5343
5344         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5345         if (rc)
5346                 return rc;
5347
5348         isec = shp->shm_perm.security;
5349
5350         ad.type = LSM_AUDIT_DATA_IPC;
5351         ad.u.ipc_id = shp->shm_perm.key;
5352
5353         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5354                           SHM__CREATE, &ad);
5355         if (rc) {
5356                 ipc_free_security(&shp->shm_perm);
5357                 return rc;
5358         }
5359         return 0;
5360 }
5361
5362 static void selinux_shm_free_security(struct shmid_kernel *shp)
5363 {
5364         ipc_free_security(&shp->shm_perm);
5365 }
5366
5367 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5368 {
5369         struct ipc_security_struct *isec;
5370         struct common_audit_data ad;
5371         u32 sid = current_sid();
5372
5373         isec = shp->shm_perm.security;
5374
5375         ad.type = LSM_AUDIT_DATA_IPC;
5376         ad.u.ipc_id = shp->shm_perm.key;
5377
5378         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5379                             SHM__ASSOCIATE, &ad);
5380 }
5381
5382 /* Note, at this point, shp is locked down */
5383 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5384 {
5385         int perms;
5386         int err;
5387
5388         switch (cmd) {
5389         case IPC_INFO:
5390         case SHM_INFO:
5391                 /* No specific object, just general system-wide information. */
5392                 return task_has_system(current, SYSTEM__IPC_INFO);
5393         case IPC_STAT:
5394         case SHM_STAT:
5395                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5396                 break;
5397         case IPC_SET:
5398                 perms = SHM__SETATTR;
5399                 break;
5400         case SHM_LOCK:
5401         case SHM_UNLOCK:
5402                 perms = SHM__LOCK;
5403                 break;
5404         case IPC_RMID:
5405                 perms = SHM__DESTROY;
5406                 break;
5407         default:
5408                 return 0;
5409         }
5410
5411         err = ipc_has_perm(&shp->shm_perm, perms);
5412         return err;
5413 }
5414
5415 static int selinux_shm_shmat(struct shmid_kernel *shp,
5416                              char __user *shmaddr, int shmflg)
5417 {
5418         u32 perms;
5419
5420         if (shmflg & SHM_RDONLY)
5421                 perms = SHM__READ;
5422         else
5423                 perms = SHM__READ | SHM__WRITE;
5424
5425         return ipc_has_perm(&shp->shm_perm, perms);
5426 }
5427
5428 /* Semaphore security operations */
5429 static int selinux_sem_alloc_security(struct sem_array *sma)
5430 {
5431         struct ipc_security_struct *isec;
5432         struct common_audit_data ad;
5433         u32 sid = current_sid();
5434         int rc;
5435
5436         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5437         if (rc)
5438                 return rc;
5439
5440         isec = sma->sem_perm.security;
5441
5442         ad.type = LSM_AUDIT_DATA_IPC;
5443         ad.u.ipc_id = sma->sem_perm.key;
5444
5445         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5446                           SEM__CREATE, &ad);
5447         if (rc) {
5448                 ipc_free_security(&sma->sem_perm);
5449                 return rc;
5450         }
5451         return 0;
5452 }
5453
5454 static void selinux_sem_free_security(struct sem_array *sma)
5455 {
5456         ipc_free_security(&sma->sem_perm);
5457 }
5458
5459 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5460 {
5461         struct ipc_security_struct *isec;
5462         struct common_audit_data ad;
5463         u32 sid = current_sid();
5464
5465         isec = sma->sem_perm.security;
5466
5467         ad.type = LSM_AUDIT_DATA_IPC;
5468         ad.u.ipc_id = sma->sem_perm.key;
5469
5470         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5471                             SEM__ASSOCIATE, &ad);
5472 }
5473
5474 /* Note, at this point, sma is locked down */
5475 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5476 {
5477         int err;
5478         u32 perms;
5479
5480         switch (cmd) {
5481         case IPC_INFO:
5482         case SEM_INFO:
5483                 /* No specific object, just general system-wide information. */
5484                 return task_has_system(current, SYSTEM__IPC_INFO);
5485         case GETPID:
5486         case GETNCNT:
5487         case GETZCNT:
5488                 perms = SEM__GETATTR;
5489                 break;
5490         case GETVAL:
5491         case GETALL:
5492                 perms = SEM__READ;
5493                 break;
5494         case SETVAL:
5495         case SETALL:
5496                 perms = SEM__WRITE;
5497                 break;
5498         case IPC_RMID:
5499                 perms = SEM__DESTROY;
5500                 break;
5501         case IPC_SET:
5502                 perms = SEM__SETATTR;
5503                 break;
5504         case IPC_STAT:
5505         case SEM_STAT:
5506                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5507                 break;
5508         default:
5509                 return 0;
5510         }
5511
5512         err = ipc_has_perm(&sma->sem_perm, perms);
5513         return err;
5514 }
5515
5516 static int selinux_sem_semop(struct sem_array *sma,
5517                              struct sembuf *sops, unsigned nsops, int alter)
5518 {
5519         u32 perms;
5520
5521         if (alter)
5522                 perms = SEM__READ | SEM__WRITE;
5523         else
5524                 perms = SEM__READ;
5525
5526         return ipc_has_perm(&sma->sem_perm, perms);
5527 }
5528
5529 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5530 {
5531         u32 av = 0;
5532
5533         av = 0;
5534         if (flag & S_IRUGO)
5535                 av |= IPC__UNIX_READ;
5536         if (flag & S_IWUGO)
5537                 av |= IPC__UNIX_WRITE;
5538
5539         if (av == 0)
5540                 return 0;
5541
5542         return ipc_has_perm(ipcp, av);
5543 }
5544
5545 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5546 {
5547         struct ipc_security_struct *isec = ipcp->security;
5548         *secid = isec->sid;
5549 }
5550
5551 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5552 {
5553         if (inode)
5554                 inode_doinit_with_dentry(inode, dentry);
5555 }
5556
5557 static int selinux_getprocattr(struct task_struct *p,
5558                                char *name, char **value)
5559 {
5560         const struct task_security_struct *__tsec;
5561         u32 sid;
5562         int error;
5563         unsigned len;
5564
5565         if (current != p) {
5566                 error = current_has_perm(p, PROCESS__GETATTR);
5567                 if (error)
5568                         return error;
5569         }
5570
5571         rcu_read_lock();
5572         __tsec = __task_cred(p)->security;
5573
5574         if (!strcmp(name, "current"))
5575                 sid = __tsec->sid;
5576         else if (!strcmp(name, "prev"))
5577                 sid = __tsec->osid;
5578         else if (!strcmp(name, "exec"))
5579                 sid = __tsec->exec_sid;
5580         else if (!strcmp(name, "fscreate"))
5581                 sid = __tsec->create_sid;
5582         else if (!strcmp(name, "keycreate"))
5583                 sid = __tsec->keycreate_sid;
5584         else if (!strcmp(name, "sockcreate"))
5585                 sid = __tsec->sockcreate_sid;
5586         else
5587                 goto invalid;
5588         rcu_read_unlock();
5589
5590         if (!sid)
5591                 return 0;
5592
5593         error = security_sid_to_context(sid, value, &len);
5594         if (error)
5595                 return error;
5596         return len;
5597
5598 invalid:
5599         rcu_read_unlock();
5600         return -EINVAL;
5601 }
5602
5603 static int selinux_setprocattr(struct task_struct *p,
5604                                char *name, void *value, size_t size)
5605 {
5606         struct task_security_struct *tsec;
5607         struct task_struct *tracer;
5608         struct cred *new;
5609         u32 sid = 0, ptsid;
5610         int error;
5611         char *str = value;
5612
5613         if (current != p) {
5614                 /* SELinux only allows a process to change its own
5615                    security attributes. */
5616                 return -EACCES;
5617         }
5618
5619         /*
5620          * Basic control over ability to set these attributes at all.
5621          * current == p, but we'll pass them separately in case the
5622          * above restriction is ever removed.
5623          */
5624         if (!strcmp(name, "exec"))
5625                 error = current_has_perm(p, PROCESS__SETEXEC);
5626         else if (!strcmp(name, "fscreate"))
5627                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5628         else if (!strcmp(name, "keycreate"))
5629                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5630         else if (!strcmp(name, "sockcreate"))
5631                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5632         else if (!strcmp(name, "current"))
5633                 error = current_has_perm(p, PROCESS__SETCURRENT);
5634         else
5635                 error = -EINVAL;
5636         if (error)
5637                 return error;
5638
5639         /* Obtain a SID for the context, if one was specified. */
5640         if (size && str[1] && str[1] != '\n') {
5641                 if (str[size-1] == '\n') {
5642                         str[size-1] = 0;
5643                         size--;
5644                 }
5645                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5646                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5647                         if (!capable(CAP_MAC_ADMIN)) {
5648                                 struct audit_buffer *ab;
5649                                 size_t audit_size;
5650
5651                                 /* We strip a nul only if it is at the end, otherwise the
5652                                  * context contains a nul and we should audit that */
5653                                 if (str[size - 1] == '\0')
5654                                         audit_size = size - 1;
5655                                 else
5656                                         audit_size = size;
5657                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5658                                 audit_log_format(ab, "op=fscreate invalid_context=");
5659                                 audit_log_n_untrustedstring(ab, value, audit_size);
5660                                 audit_log_end(ab);
5661
5662                                 return error;
5663                         }
5664                         error = security_context_to_sid_force(value, size,
5665                                                               &sid);
5666                 }
5667                 if (error)
5668                         return error;
5669         }
5670
5671         new = prepare_creds();
5672         if (!new)
5673                 return -ENOMEM;
5674
5675         /* Permission checking based on the specified context is
5676            performed during the actual operation (execve,
5677            open/mkdir/...), when we know the full context of the
5678            operation.  See selinux_bprm_set_creds for the execve
5679            checks and may_create for the file creation checks. The
5680            operation will then fail if the context is not permitted. */
5681         tsec = new->security;
5682         if (!strcmp(name, "exec")) {
5683                 tsec->exec_sid = sid;
5684         } else if (!strcmp(name, "fscreate")) {
5685                 tsec->create_sid = sid;
5686         } else if (!strcmp(name, "keycreate")) {
5687                 error = may_create_key(sid, p);
5688                 if (error)
5689                         goto abort_change;
5690                 tsec->keycreate_sid = sid;
5691         } else if (!strcmp(name, "sockcreate")) {
5692                 tsec->sockcreate_sid = sid;
5693         } else if (!strcmp(name, "current")) {
5694                 error = -EINVAL;
5695                 if (sid == 0)
5696                         goto abort_change;
5697
5698                 /* Only allow single threaded processes to change context */
5699                 error = -EPERM;
5700                 if (!current_is_single_threaded()) {
5701                         error = security_bounded_transition(tsec->sid, sid);
5702                         if (error)
5703                                 goto abort_change;
5704                 }
5705
5706                 /* Check permissions for the transition. */
5707                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5708                                      PROCESS__DYNTRANSITION, NULL);
5709                 if (error)
5710                         goto abort_change;
5711
5712                 /* Check for ptracing, and update the task SID if ok.
5713                    Otherwise, leave SID unchanged and fail. */
5714                 ptsid = 0;
5715                 rcu_read_lock();
5716                 tracer = ptrace_parent(p);
5717                 if (tracer)
5718                         ptsid = task_sid(tracer);
5719                 rcu_read_unlock();
5720
5721                 if (tracer) {
5722                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5723                                              PROCESS__PTRACE, NULL);
5724                         if (error)
5725                                 goto abort_change;
5726                 }
5727
5728                 tsec->sid = sid;
5729         } else {
5730                 error = -EINVAL;
5731                 goto abort_change;
5732         }
5733
5734         commit_creds(new);
5735         return size;
5736
5737 abort_change:
5738         abort_creds(new);
5739         return error;
5740 }
5741
5742 static int selinux_ismaclabel(const char *name)
5743 {
5744         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5745 }
5746
5747 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5748 {
5749         return security_sid_to_context(secid, secdata, seclen);
5750 }
5751
5752 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5753 {
5754         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5755 }
5756
5757 static void selinux_release_secctx(char *secdata, u32 seclen)
5758 {
5759         kfree(secdata);
5760 }
5761
5762 /*
5763  *      called with inode->i_mutex locked
5764  */
5765 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5766 {
5767         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5768 }
5769
5770 /*
5771  *      called with inode->i_mutex locked
5772  */
5773 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5774 {
5775         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5776 }
5777
5778 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5779 {
5780         int len = 0;
5781         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5782                                                 ctx, true);
5783         if (len < 0)
5784                 return len;
5785         *ctxlen = len;
5786         return 0;
5787 }
5788 #ifdef CONFIG_KEYS
5789
5790 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5791                              unsigned long flags)
5792 {
5793         const struct task_security_struct *tsec;
5794         struct key_security_struct *ksec;
5795
5796         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5797         if (!ksec)
5798                 return -ENOMEM;
5799
5800         tsec = cred->security;
5801         if (tsec->keycreate_sid)
5802                 ksec->sid = tsec->keycreate_sid;
5803         else
5804                 ksec->sid = tsec->sid;
5805
5806         k->security = ksec;
5807         return 0;
5808 }
5809
5810 static void selinux_key_free(struct key *k)
5811 {
5812         struct key_security_struct *ksec = k->security;
5813
5814         k->security = NULL;
5815         kfree(ksec);
5816 }
5817
5818 static int selinux_key_permission(key_ref_t key_ref,
5819                                   const struct cred *cred,
5820                                   unsigned perm)
5821 {
5822         struct key *key;
5823         struct key_security_struct *ksec;
5824         u32 sid;
5825
5826         /* if no specific permissions are requested, we skip the
5827            permission check. No serious, additional covert channels
5828            appear to be created. */
5829         if (perm == 0)
5830                 return 0;
5831
5832         sid = cred_sid(cred);
5833
5834         key = key_ref_to_ptr(key_ref);
5835         ksec = key->security;
5836
5837         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5838 }
5839
5840 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5841 {
5842         struct key_security_struct *ksec = key->security;
5843         char *context = NULL;
5844         unsigned len;
5845         int rc;
5846
5847         rc = security_sid_to_context(ksec->sid, &context, &len);
5848         if (!rc)
5849                 rc = len;
5850         *_buffer = context;
5851         return rc;
5852 }
5853
5854 #endif
5855
5856 static struct security_hook_list selinux_hooks[] = {
5857         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5858         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5859         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5860         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5861
5862         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5863         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5864         LSM_HOOK_INIT(capget, selinux_capget),
5865         LSM_HOOK_INIT(capset, selinux_capset),
5866         LSM_HOOK_INIT(capable, selinux_capable),
5867         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5868         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5869         LSM_HOOK_INIT(syslog, selinux_syslog),
5870         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5871
5872         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5873
5874         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5875         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5876         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5877         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5878
5879         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5880         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5881         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5882         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5883         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5884         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5885         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5886         LSM_HOOK_INIT(sb_mount, selinux_mount),
5887         LSM_HOOK_INIT(sb_umount, selinux_umount),
5888         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5889         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5890         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5891
5892         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5893
5894         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5895         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5896         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5897         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5898         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5899         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5900         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5901         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5902         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5903         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5904         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5905         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5906         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5907         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5908         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5909         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5910         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5911         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5912         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5913         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5914         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5915         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5916         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5917         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5918         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5919
5920         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5921         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5922         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5923         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5924         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5925         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5926         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5927         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5928         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5929         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5930         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5931         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5932
5933         LSM_HOOK_INIT(file_open, selinux_file_open),
5934
5935         LSM_HOOK_INIT(task_create, selinux_task_create),
5936         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5937         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5938         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5939         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5940         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5941         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5942         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5943         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5944         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5945         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5946         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5947         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5948         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5949         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5950         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5951         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5952         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5953         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5954         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5955         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5956         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5957
5958         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5959         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5960
5961         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5962         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5963
5964         LSM_HOOK_INIT(msg_queue_alloc_security,
5965                         selinux_msg_queue_alloc_security),
5966         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5967         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5968         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5969         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5970         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5971
5972         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5973         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5974         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5975         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5976         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5977
5978         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5979         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5980         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5981         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5982         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5983
5984         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5985
5986         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5987         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5988
5989         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5990         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5991         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5992         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5993         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5994         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5995         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5996
5997         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5998         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5999
6000         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6001         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6002         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6003         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6004         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6005         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6006         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6007         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6008         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6009         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6010         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6011         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6012         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6013         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6014         LSM_HOOK_INIT(socket_getpeersec_stream,
6015                         selinux_socket_getpeersec_stream),
6016         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6017         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6018         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6019         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6020         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6021         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6022         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6023         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6024         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6025         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6026         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6027         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6028         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6029         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6030         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6031         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6032         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6033         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6034         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6035
6036 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6037         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6038         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6039         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6040         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6041         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6042         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6043                         selinux_xfrm_state_alloc_acquire),
6044         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6045         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6046         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6047         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6048                         selinux_xfrm_state_pol_flow_match),
6049         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6050 #endif
6051
6052 #ifdef CONFIG_KEYS
6053         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6054         LSM_HOOK_INIT(key_free, selinux_key_free),
6055         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6056         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6057 #endif
6058
6059 #ifdef CONFIG_AUDIT
6060         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6061         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6062         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6063         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6064 #endif
6065 };
6066
6067 static __init int selinux_init(void)
6068 {
6069         if (!security_module_enable("selinux")) {
6070                 selinux_enabled = 0;
6071                 return 0;
6072         }
6073
6074         if (!selinux_enabled) {
6075                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6076                 return 0;
6077         }
6078
6079         printk(KERN_INFO "SELinux:  Initializing.\n");
6080
6081         /* Set the security state for the initial task. */
6082         cred_init_security();
6083
6084         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6085
6086         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6087                                             sizeof(struct inode_security_struct),
6088                                             0, SLAB_PANIC, NULL);
6089         avc_init();
6090
6091         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6092
6093         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6094                 panic("SELinux: Unable to register AVC netcache callback\n");
6095
6096         if (selinux_enforcing)
6097                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6098         else
6099                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6100
6101         return 0;
6102 }
6103
6104 static void delayed_superblock_init(struct super_block *sb, void *unused)
6105 {
6106         superblock_doinit(sb, NULL);
6107 }
6108
6109 void selinux_complete_init(void)
6110 {
6111         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6112
6113         /* Set up any superblocks initialized prior to the policy load. */
6114         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6115         iterate_supers(delayed_superblock_init, NULL);
6116 }
6117
6118 /* SELinux requires early initialization in order to label
6119    all processes and objects when they are created. */
6120 security_initcall(selinux_init);
6121
6122 #if defined(CONFIG_NETFILTER)
6123
6124 static struct nf_hook_ops selinux_nf_ops[] = {
6125         {
6126                 .hook =         selinux_ipv4_postroute,
6127                 .owner =        THIS_MODULE,
6128                 .pf =           NFPROTO_IPV4,
6129                 .hooknum =      NF_INET_POST_ROUTING,
6130                 .priority =     NF_IP_PRI_SELINUX_LAST,
6131         },
6132         {
6133                 .hook =         selinux_ipv4_forward,
6134                 .owner =        THIS_MODULE,
6135                 .pf =           NFPROTO_IPV4,
6136                 .hooknum =      NF_INET_FORWARD,
6137                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6138         },
6139         {
6140                 .hook =         selinux_ipv4_output,
6141                 .owner =        THIS_MODULE,
6142                 .pf =           NFPROTO_IPV4,
6143                 .hooknum =      NF_INET_LOCAL_OUT,
6144                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6145         },
6146 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6147         {
6148                 .hook =         selinux_ipv6_postroute,
6149                 .owner =        THIS_MODULE,
6150                 .pf =           NFPROTO_IPV6,
6151                 .hooknum =      NF_INET_POST_ROUTING,
6152                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6153         },
6154         {
6155                 .hook =         selinux_ipv6_forward,
6156                 .owner =        THIS_MODULE,
6157                 .pf =           NFPROTO_IPV6,
6158                 .hooknum =      NF_INET_FORWARD,
6159                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6160         },
6161 #endif  /* IPV6 */
6162 };
6163
6164 static int __init selinux_nf_ip_init(void)
6165 {
6166         int err;
6167
6168         if (!selinux_enabled)
6169                 return 0;
6170
6171         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6172
6173         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6174         if (err)
6175                 panic("SELinux: nf_register_hooks: error %d\n", err);
6176
6177         return 0;
6178 }
6179
6180 __initcall(selinux_nf_ip_init);
6181
6182 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6183 static void selinux_nf_ip_exit(void)
6184 {
6185         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6186
6187         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6188 }
6189 #endif
6190
6191 #else /* CONFIG_NETFILTER */
6192
6193 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6194 #define selinux_nf_ip_exit()
6195 #endif
6196
6197 #endif /* CONFIG_NETFILTER */
6198
6199 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6200 static int selinux_disabled;
6201
6202 int selinux_disable(void)
6203 {
6204         if (ss_initialized) {
6205                 /* Not permitted after initial policy load. */
6206                 return -EINVAL;
6207         }
6208
6209         if (selinux_disabled) {
6210                 /* Only do this once. */
6211                 return -EINVAL;
6212         }
6213
6214         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6215
6216         selinux_disabled = 1;
6217         selinux_enabled = 0;
6218
6219         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6220
6221         /* Try to destroy the avc node cache */
6222         avc_disable();
6223
6224         /* Unregister netfilter hooks. */
6225         selinux_nf_ip_exit();
6226
6227         /* Unregister selinuxfs. */
6228         exit_sel_fs();
6229
6230         return 0;
6231 }
6232 #endif