security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         /*
 258          * As not all inode security structures are in a list, we check for
 259          * empty list outside of the lock to make sure that we won't waste
 260          * time taking a lock doing nothing.
 261          *
 262          * The list_del_init() function can be safely called more than once.
 263          * It should not be possible for this function to be called with
 264          * concurrent list_add(), but for better safety against future changes
 265          * in the code, we use list_empty_careful() here.
 266          */
 267         if (!list_empty_careful(&isec->list)) {
 268                 spin_lock(&sbsec->isec_lock);
 269                 list_del_init(&isec->list);
 270                 spin_unlock(&sbsec->isec_lock);
 271         }
 272
 273         /*
 274          * The inode may still be referenced in a path walk and
 275          * a call to selinux_inode_permission() can be made
 276          * after inode_free_security() is called. Ideally, the VFS
 277          * wouldn't do this, but fixing that is a much harder
 278          * job. For now, simply free the i_security via RCU, and
 279          * leave the current inode->i_security pointer intact.
 280          * The inode will be freed after the RCU grace period too.
 281          */
 282         call_rcu(&isec->rcu, inode_free_rcu);
 283 }
 284
 285 static int file_alloc_security(struct file *file)
 286 {
 287         struct file_security_struct *fsec;
 288         u32 sid = current_sid();
 289
 290         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 291         if (!fsec)
 292                 return -ENOMEM;
 293
 294         fsec->sid = sid;
 295         fsec->fown_sid = sid;
 296         file->f_security = fsec;
 297
 298         return 0;
 299 }
 300
 301 static void file_free_security(struct file *file)
 302 {
 303         struct file_security_struct *fsec = file->f_security;
 304         file->f_security = NULL;
 305         kfree(fsec);
 306 }
 307
 308 static int superblock_alloc_security(struct super_block *sb)
 309 {
 310         struct superblock_security_struct *sbsec;
 311
 312         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 313         if (!sbsec)
 314                 return -ENOMEM;
 315
 316         mutex_init(&sbsec->lock);
 317         INIT_LIST_HEAD(&sbsec->isec_head);
 318         spin_lock_init(&sbsec->isec_lock);
 319         sbsec->sb = sb;
 320         sbsec->sid = SECINITSID_UNLABELED;
 321         sbsec->def_sid = SECINITSID_FILE;
 322         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 323         sb->s_security = sbsec;
 324
 325         return 0;
 326 }
 327
 328 static void superblock_free_security(struct super_block *sb)
 329 {
 330         struct superblock_security_struct *sbsec = sb->s_security;
 331         sb->s_security = NULL;
 332         kfree(sbsec);
 333 }
 334
 335 /* The file system's label must be initialized prior to use. */
 336
 337 static const char *labeling_behaviors[7] = {
 338         "uses xattr",
 339         "uses transition SIDs",
 340         "uses task SIDs",
 341         "uses genfs_contexts",
 342         "not configured for labeling",
 343         "uses mountpoint labeling",
 344         "uses native labeling",
 345 };
 346
 347 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 348
 349 static inline int inode_doinit(struct inode *inode)
 350 {
 351         return inode_doinit_with_dentry(inode, NULL);
 352 }
 353
 354 enum {
 355         Opt_error = -1,
 356         Opt_context = 1,
 357         Opt_fscontext = 2,
 358         Opt_defcontext = 3,
 359         Opt_rootcontext = 4,
 360         Opt_labelsupport = 5,
 361         Opt_nextmntopt = 6,
 362 };
 363
 364 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 365
 366 static const match_table_t tokens = {
 367         {Opt_context, CONTEXT_STR "%s"},
 368         {Opt_fscontext, FSCONTEXT_STR "%s"},
 369         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 370         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 371         {Opt_labelsupport, LABELSUPP_STR},
 372         {Opt_error, NULL},
 373 };
 374
 375 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 376
 377 static int may_context_mount_sb_relabel(u32 sid,
 378                         struct superblock_security_struct *sbsec,
 379                         const struct cred *cred)
 380 {
 381         const struct task_security_struct *tsec = cred->security;
 382         int rc;
 383
 384         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 385                           FILESYSTEM__RELABELFROM, NULL);
 386         if (rc)
 387                 return rc;
 388
 389         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELTO, NULL);
 391         return rc;
 392 }
 393
 394 static int may_context_mount_inode_relabel(u32 sid,
 395                         struct superblock_security_struct *sbsec,
 396                         const struct cred *cred)
 397 {
 398         const struct task_security_struct *tsec = cred->security;
 399         int rc;
 400         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 401                           FILESYSTEM__RELABELFROM, NULL);
 402         if (rc)
 403                 return rc;
 404
 405         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 406                           FILESYSTEM__ASSOCIATE, NULL);
 407         return rc;
 408 }
 409
 410 static int selinux_is_sblabel_mnt(struct super_block *sb)
 411 {
 412         struct superblock_security_struct *sbsec = sb->s_security;
 413
 414         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 415                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 416                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 417                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 418                 /* Special handling. Genfs but also in-core setxattr handler */
 419                 !strcmp(sb->s_type->name, "sysfs") ||
 420                 !strcmp(sb->s_type->name, "pstore") ||
 421                 !strcmp(sb->s_type->name, "debugfs") ||
 422                 !strcmp(sb->s_type->name, "rootfs");
 423 }
 424
 425 static int sb_finish_set_opts(struct super_block *sb)
 426 {
 427         struct superblock_security_struct *sbsec = sb->s_security;
 428         struct dentry *root = sb->s_root;
 429         struct inode *root_inode = d_backing_inode(root);
 430         int rc = 0;
 431
 432         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 433                 /* Make sure that the xattr handler exists and that no
 434                    error other than -ENODATA is returned by getxattr on
 435                    the root directory.  -ENODATA is ok, as this may be
 436                    the first boot of the SELinux kernel before we have
 437                    assigned xattr values to the filesystem. */
 438                 if (!root_inode->i_op->getxattr) {
 439                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 440                                "xattr support\n", sb->s_id, sb->s_type->name);
 441                         rc = -EOPNOTSUPP;
 442                         goto out;
 443                 }
 444                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 445                 if (rc < 0 && rc != -ENODATA) {
 446                         if (rc == -EOPNOTSUPP)
 447                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 448                                        "%s) has no security xattr handler\n",
 449                                        sb->s_id, sb->s_type->name);
 450                         else
 451                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 452                                        "%s) getxattr errno %d\n", sb->s_id,
 453                                        sb->s_type->name, -rc);
 454                         goto out;
 455                 }
 456         }
 457
 458         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 459                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 460                        sb->s_id, sb->s_type->name);
 461
 462         sbsec->flags |= SE_SBINITIALIZED;
 463         if (selinux_is_sblabel_mnt(sb))
 464                 sbsec->flags |= SBLABEL_MNT;
 465
 466         /* Initialize the root inode. */
 467         rc = inode_doinit_with_dentry(root_inode, root);
 468
 469         /* Initialize any other inodes associated with the superblock, e.g.
 470            inodes created prior to initial policy load or inodes created
 471            during get_sb by a pseudo filesystem that directly
 472            populates itself. */
 473         spin_lock(&sbsec->isec_lock);
 474 next_inode:
 475         if (!list_empty(&sbsec->isec_head)) {
 476                 struct inode_security_struct *isec =
 477                                 list_entry(sbsec->isec_head.next,
 478                                            struct inode_security_struct, list);
 479                 struct inode *inode = isec->inode;
 480                 list_del_init(&isec->list);
 481                 spin_unlock(&sbsec->isec_lock);
 482                 inode = igrab(inode);
 483                 if (inode) {
 484                         if (!IS_PRIVATE(inode))
 485                                 inode_doinit(inode);
 486                         iput(inode);
 487                 }
 488                 spin_lock(&sbsec->isec_lock);
 489                 goto next_inode;
 490         }
 491         spin_unlock(&sbsec->isec_lock);
 492 out:
 493         return rc;
 494 }
 495
 496 /*
 497  * This function should allow an FS to ask what it's mount security
 498  * options were so it can use those later for submounts, displaying
 499  * mount options, or whatever.
 500  */
 501 static int selinux_get_mnt_opts(const struct super_block *sb,
 502                                 struct security_mnt_opts *opts)
 503 {
 504         int rc = 0, i;
 505         struct superblock_security_struct *sbsec = sb->s_security;
 506         char *context = NULL;
 507         u32 len;
 508         char tmp;
 509
 510         security_init_mnt_opts(opts);
 511
 512         if (!(sbsec->flags & SE_SBINITIALIZED))
 513                 return -EINVAL;
 514
 515         if (!ss_initialized)
 516                 return -EINVAL;
 517
 518         /* make sure we always check enough bits to cover the mask */
 519         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 520
 521         tmp = sbsec->flags & SE_MNTMASK;
 522         /* count the number of mount options for this sb */
 523         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 524                 if (tmp & 0x01)
 525                         opts->num_mnt_opts++;
 526                 tmp >>= 1;
 527         }
 528         /* Check if the Label support flag is set */
 529         if (sbsec->flags & SBLABEL_MNT)
 530                 opts->num_mnt_opts++;
 531
 532         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 533         if (!opts->mnt_opts) {
 534                 rc = -ENOMEM;
 535                 goto out_free;
 536         }
 537
 538         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 539         if (!opts->mnt_opts_flags) {
 540                 rc = -ENOMEM;
 541                 goto out_free;
 542         }
 543
 544         i = 0;
 545         if (sbsec->flags & FSCONTEXT_MNT) {
 546                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 551         }
 552         if (sbsec->flags & CONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 558         }
 559         if (sbsec->flags & DEFCONTEXT_MNT) {
 560                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 561                 if (rc)
 562                         goto out_free;
 563                 opts->mnt_opts[i] = context;
 564                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 565         }
 566         if (sbsec->flags & ROOTCONTEXT_MNT) {
 567                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 568                 struct inode_security_struct *isec = root->i_security;
 569
 570                 rc = security_sid_to_context(isec->sid, &context, &len);
 571                 if (rc)
 572                         goto out_free;
 573                 opts->mnt_opts[i] = context;
 574                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 575         }
 576         if (sbsec->flags & SBLABEL_MNT) {
 577                 opts->mnt_opts[i] = NULL;
 578                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 579         }
 580
 581         BUG_ON(i != opts->num_mnt_opts);
 582
 583         return 0;
 584
 585 out_free:
 586         security_free_mnt_opts(opts);
 587         return rc;
 588 }
 589
 590 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 591                       u32 old_sid, u32 new_sid)
 592 {
 593         char mnt_flags = sbsec->flags & SE_MNTMASK;
 594
 595         /* check if the old mount command had the same options */
 596         if (sbsec->flags & SE_SBINITIALIZED)
 597                 if (!(sbsec->flags & flag) ||
 598                     (old_sid != new_sid))
 599                         return 1;
 600
 601         /* check if we were passed the same options twice,
 602          * aka someone passed context=a,context=b
 603          */
 604         if (!(sbsec->flags & SE_SBINITIALIZED))
 605                 if (mnt_flags & flag)
 606                         return 1;
 607         return 0;
 608 }
 609
 610 /*
 611  * Allow filesystems with binary mount data to explicitly set mount point
 612  * labeling information.
 613  */
 614 static int selinux_set_mnt_opts(struct super_block *sb,
 615                                 struct security_mnt_opts *opts,
 616                                 unsigned long kern_flags,
 617                                 unsigned long *set_kern_flags)
 618 {
 619         const struct cred *cred = current_cred();
 620         int rc = 0, i;
 621         struct superblock_security_struct *sbsec = sb->s_security;
 622         const char *name = sb->s_type->name;
 623         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 624         struct inode_security_struct *root_isec = inode->i_security;
 625         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 626         u32 defcontext_sid = 0;
 627         char **mount_options = opts->mnt_opts;
 628         int *flags = opts->mnt_opts_flags;
 629         int num_opts = opts->num_mnt_opts;
 630
 631         mutex_lock(&sbsec->lock);
 632
 633         if (!ss_initialized) {
 634                 if (!num_opts) {
 635                         /* Defer initialization until selinux_complete_init,
 636                            after the initial policy is loaded and the security
 637                            server is ready to handle calls. */
 638                         goto out;
 639                 }
 640                 rc = -EINVAL;
 641                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 642                         "before the security server is initialized\n");
 643                 goto out;
 644         }
 645         if (kern_flags && !set_kern_flags) {
 646                 /* Specifying internal flags without providing a place to
 647                  * place the results is not allowed */
 648                 rc = -EINVAL;
 649                 goto out;
 650         }
 651
 652         /*
 653          * Binary mount data FS will come through this function twice.  Once
 654          * from an explicit call and once from the generic calls from the vfs.
 655          * Since the generic VFS calls will not contain any security mount data
 656          * we need to skip the double mount verification.
 657          *
 658          * This does open a hole in which we will not notice if the first
 659          * mount using this sb set explict options and a second mount using
 660          * this sb does not set any security options.  (The first options
 661          * will be used for both mounts)
 662          */
 663         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 664             && (num_opts == 0))
 665                 goto out;
 666
 667         /*
 668          * parse the mount options, check if they are valid sids.
 669          * also check if someone is trying to mount the same sb more
 670          * than once with different security options.
 671          */
 672         for (i = 0; i < num_opts; i++) {
 673                 u32 sid;
 674
 675                 if (flags[i] == SBLABEL_MNT)
 676                         continue;
 677                 rc = security_context_to_sid(mount_options[i],
 678                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 679                 if (rc) {
 680                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 681                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 682                                mount_options[i], sb->s_id, name, rc);
 683                         goto out;
 684                 }
 685                 switch (flags[i]) {
 686                 case FSCONTEXT_MNT:
 687                         fscontext_sid = sid;
 688
 689                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 690                                         fscontext_sid))
 691                                 goto out_double_mount;
 692
 693                         sbsec->flags |= FSCONTEXT_MNT;
 694                         break;
 695                 case CONTEXT_MNT:
 696                         context_sid = sid;
 697
 698                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 699                                         context_sid))
 700                                 goto out_double_mount;
 701
 702                         sbsec->flags |= CONTEXT_MNT;
 703                         break;
 704                 case ROOTCONTEXT_MNT:
 705                         rootcontext_sid = sid;
 706
 707                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 708                                         rootcontext_sid))
 709                                 goto out_double_mount;
 710
 711                         sbsec->flags |= ROOTCONTEXT_MNT;
 712
 713                         break;
 714                 case DEFCONTEXT_MNT:
 715                         defcontext_sid = sid;
 716
 717                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 718                                         defcontext_sid))
 719                                 goto out_double_mount;
 720
 721                         sbsec->flags |= DEFCONTEXT_MNT;
 722
 723                         break;
 724                 default:
 725                         rc = -EINVAL;
 726                         goto out;
 727                 }
 728         }
 729
 730         if (sbsec->flags & SE_SBINITIALIZED) {
 731                 /* previously mounted with options, but not on this attempt? */
 732                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 733                         goto out_double_mount;
 734                 rc = 0;
 735                 goto out;
 736         }
 737
 738         if (strcmp(sb->s_type->name, "proc") == 0)
 739                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 740
 741         if (!strcmp(sb->s_type->name, "debugfs") ||
 742             !strcmp(sb->s_type->name, "sysfs") ||
 743             !strcmp(sb->s_type->name, "pstore"))
 744                 sbsec->flags |= SE_SBGENFS;
 745
 746         if (!sbsec->behavior) {
 747                 /*
 748                  * Determine the labeling behavior to use for this
 749                  * filesystem type.
 750                  */
 751                 rc = security_fs_use(sb);
 752                 if (rc) {
 753                         printk(KERN_WARNING
 754                                 "%s: security_fs_use(%s) returned %d\n",
 755                                         __func__, sb->s_type->name, rc);
 756                         goto out;
 757                 }
 758         }
 759         /* sets the context of the superblock for the fs being mounted. */
 760         if (fscontext_sid) {
 761                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 762                 if (rc)
 763                         goto out;
 764
 765                 sbsec->sid = fscontext_sid;
 766         }
 767
 768         /*
 769          * Switch to using mount point labeling behavior.
 770          * sets the label used on all file below the mountpoint, and will set
 771          * the superblock context if not already set.
 772          */
 773         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 774                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 775                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 776         }
 777
 778         if (context_sid) {
 779                 if (!fscontext_sid) {
 780                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 781                                                           cred);
 782                         if (rc)
 783                                 goto out;
 784                         sbsec->sid = context_sid;
 785                 } else {
 786                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 787                                                              cred);
 788                         if (rc)
 789                                 goto out;
 790                 }
 791                 if (!rootcontext_sid)
 792                         rootcontext_sid = context_sid;
 793
 794                 sbsec->mntpoint_sid = context_sid;
 795                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 796         }
 797
 798         if (rootcontext_sid) {
 799                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 800                                                      cred);
 801                 if (rc)
 802                         goto out;
 803
 804                 root_isec->sid = rootcontext_sid;
 805                 root_isec->initialized = 1;
 806         }
 807
 808         if (defcontext_sid) {
 809                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 810                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 811                         rc = -EINVAL;
 812                         printk(KERN_WARNING "SELinux: defcontext option is "
 813                                "invalid for this filesystem type\n");
 814                         goto out;
 815                 }
 816
 817                 if (defcontext_sid != sbsec->def_sid) {
 818                         rc = may_context_mount_inode_relabel(defcontext_sid,
 819                                                              sbsec, cred);
 820                         if (rc)
 821                                 goto out;
 822                 }
 823
 824                 sbsec->def_sid = defcontext_sid;
 825         }
 826
 827         rc = sb_finish_set_opts(sb);
 828 out:
 829         mutex_unlock(&sbsec->lock);
 830         return rc;
 831 out_double_mount:
 832         rc = -EINVAL;
 833         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 834                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 835         goto out;
 836 }
 837
 838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 839                                     const struct super_block *newsb)
 840 {
 841         struct superblock_security_struct *old = oldsb->s_security;
 842         struct superblock_security_struct *new = newsb->s_security;
 843         char oldflags = old->flags & SE_MNTMASK;
 844         char newflags = new->flags & SE_MNTMASK;
 845
 846         if (oldflags != newflags)
 847                 goto mismatch;
 848         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 849                 goto mismatch;
 850         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 851                 goto mismatch;
 852         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 853                 goto mismatch;
 854         if (oldflags & ROOTCONTEXT_MNT) {
 855                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 856                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 857                 if (oldroot->sid != newroot->sid)
 858                         goto mismatch;
 859         }
 860         return 0;
 861 mismatch:
 862         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 863                             "different security settings for (dev %s, "
 864                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 865         return -EBUSY;
 866 }
 867
 868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 869                                         struct super_block *newsb)
 870 {
 871         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 872         struct superblock_security_struct *newsbsec = newsb->s_security;
 873
 874         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 875         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 876         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 877
 878         /*
 879          * if the parent was able to be mounted it clearly had no special lsm
 880          * mount options.  thus we can safely deal with this superblock later
 881          */
 882         if (!ss_initialized)
 883                 return 0;
 884
 885         /* how can we clone if the old one wasn't set up?? */
 886         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 887
 888         /* if fs is reusing a sb, make sure that the contexts match */
 889         if (newsbsec->flags & SE_SBINITIALIZED)
 890                 return selinux_cmp_sb_context(oldsb, newsb);
 891
 892         mutex_lock(&newsbsec->lock);
 893
 894         newsbsec->flags = oldsbsec->flags;
 895
 896         newsbsec->sid = oldsbsec->sid;
 897         newsbsec->def_sid = oldsbsec->def_sid;
 898         newsbsec->behavior = oldsbsec->behavior;
 899
 900         if (set_context) {
 901                 u32 sid = oldsbsec->mntpoint_sid;
 902
 903                 if (!set_fscontext)
 904                         newsbsec->sid = sid;
 905                 if (!set_rootcontext) {
 906                         struct inode *newinode = d_backing_inode(newsb->s_root);
 907                         struct inode_security_struct *newisec = newinode->i_security;
 908                         newisec->sid = sid;
 909                 }
 910                 newsbsec->mntpoint_sid = sid;
 911         }
 912         if (set_rootcontext) {
 913                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 914                 const struct inode_security_struct *oldisec = oldinode->i_security;
 915                 struct inode *newinode = d_backing_inode(newsb->s_root);
 916                 struct inode_security_struct *newisec = newinode->i_security;
 917
 918                 newisec->sid = oldisec->sid;
 919         }
 920
 921         sb_finish_set_opts(newsb);
 922         mutex_unlock(&newsbsec->lock);
 923         return 0;
 924 }
 925
 926 static int selinux_parse_opts_str(char *options,
 927                                   struct security_mnt_opts *opts)
 928 {
 929         char *p;
 930         char *context = NULL, *defcontext = NULL;
 931         char *fscontext = NULL, *rootcontext = NULL;
 932         int rc, num_mnt_opts = 0;
 933
 934         opts->num_mnt_opts = 0;
 935
 936         /* Standard string-based options. */
 937         while ((p = strsep(&options, "|")) != NULL) {
 938                 int token;
 939                 substring_t args[MAX_OPT_ARGS];
 940
 941                 if (!*p)
 942                         continue;
 943
 944                 token = match_token(p, tokens, args);
 945
 946                 switch (token) {
 947                 case Opt_context:
 948                         if (context || defcontext) {
 949                                 rc = -EINVAL;
 950                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 951                                 goto out_err;
 952                         }
 953                         context = match_strdup(&args[0]);
 954                         if (!context) {
 955                                 rc = -ENOMEM;
 956                                 goto out_err;
 957                         }
 958                         break;
 959
 960                 case Opt_fscontext:
 961                         if (fscontext) {
 962                                 rc = -EINVAL;
 963                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 964                                 goto out_err;
 965                         }
 966                         fscontext = match_strdup(&args[0]);
 967                         if (!fscontext) {
 968                                 rc = -ENOMEM;
 969                                 goto out_err;
 970                         }
 971                         break;
 972
 973                 case Opt_rootcontext:
 974                         if (rootcontext) {
 975                                 rc = -EINVAL;
 976                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 977                                 goto out_err;
 978                         }
 979                         rootcontext = match_strdup(&args[0]);
 980                         if (!rootcontext) {
 981                                 rc = -ENOMEM;
 982                                 goto out_err;
 983                         }
 984                         break;
 985
 986                 case Opt_defcontext:
 987                         if (context || defcontext) {
 988                                 rc = -EINVAL;
 989                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 990                                 goto out_err;
 991                         }
 992                         defcontext = match_strdup(&args[0]);
 993                         if (!defcontext) {
 994                                 rc = -ENOMEM;
 995                                 goto out_err;
 996                         }
 997                         break;
 998                 case Opt_labelsupport:
 999                         break;
1000                 default:
1001                         rc = -EINVAL;
1002                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1003                         goto out_err;
1004
1005                 }
1006         }
1007
1008         rc = -ENOMEM;
1009         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010         if (!opts->mnt_opts)
1011                 goto out_err;
1012
1013         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014         if (!opts->mnt_opts_flags) {
1015                 kfree(opts->mnt_opts);
1016                 goto out_err;
1017         }
1018
1019         if (fscontext) {
1020                 opts->mnt_opts[num_mnt_opts] = fscontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1022         }
1023         if (context) {
1024                 opts->mnt_opts[num_mnt_opts] = context;
1025                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1026         }
1027         if (rootcontext) {
1028                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1030         }
1031         if (defcontext) {
1032                 opts->mnt_opts[num_mnt_opts] = defcontext;
1033                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1034         }
1035
1036         opts->num_mnt_opts = num_mnt_opts;
1037         return 0;
1038
1039 out_err:
1040         kfree(context);
1041         kfree(defcontext);
1042         kfree(fscontext);
1043         kfree(rootcontext);
1044         return rc;
1045 }
1046 /*
1047  * string mount options parsing and call set the sbsec
1048  */
1049 static int superblock_doinit(struct super_block *sb, void *data)
1050 {
1051         int rc = 0;
1052         char *options = data;
1053         struct security_mnt_opts opts;
1054
1055         security_init_mnt_opts(&opts);
1056
1057         if (!data)
1058                 goto out;
1059
1060         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061
1062         rc = selinux_parse_opts_str(options, &opts);
1063         if (rc)
1064                 goto out_err;
1065
1066 out:
1067         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1068
1069 out_err:
1070         security_free_mnt_opts(&opts);
1071         return rc;
1072 }
1073
1074 static void selinux_write_opts(struct seq_file *m,
1075                                struct security_mnt_opts *opts)
1076 {
1077         int i;
1078         char *prefix;
1079
1080         for (i = 0; i < opts->num_mnt_opts; i++) {
1081                 char *has_comma;
1082
1083                 if (opts->mnt_opts[i])
1084                         has_comma = strchr(opts->mnt_opts[i], ',');
1085                 else
1086                         has_comma = NULL;
1087
1088                 switch (opts->mnt_opts_flags[i]) {
1089                 case CONTEXT_MNT:
1090                         prefix = CONTEXT_STR;
1091                         break;
1092                 case FSCONTEXT_MNT:
1093                         prefix = FSCONTEXT_STR;
1094                         break;
1095                 case ROOTCONTEXT_MNT:
1096                         prefix = ROOTCONTEXT_STR;
1097                         break;
1098                 case DEFCONTEXT_MNT:
1099                         prefix = DEFCONTEXT_STR;
1100                         break;
1101                 case SBLABEL_MNT:
1102                         seq_putc(m, ',');
1103                         seq_puts(m, LABELSUPP_STR);
1104                         continue;
1105                 default:
1106                         BUG();
1107                         return;
1108                 };
1109                 /* we need a comma before each option */
1110                 seq_putc(m, ',');
1111                 seq_puts(m, prefix);
1112                 if (has_comma)
1113                         seq_putc(m, '\"');
1114                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1115                 if (has_comma)
1116                         seq_putc(m, '\"');
1117         }
1118 }
1119
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121 {
1122         struct security_mnt_opts opts;
1123         int rc;
1124
1125         rc = selinux_get_mnt_opts(sb, &opts);
1126         if (rc) {
1127                 /* before policy load we may get EINVAL, don't show anything */
1128                 if (rc == -EINVAL)
1129                         rc = 0;
1130                 return rc;
1131         }
1132
1133         selinux_write_opts(m, &opts);
1134
1135         security_free_mnt_opts(&opts);
1136
1137         return rc;
1138 }
1139
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1141 {
1142         switch (mode & S_IFMT) {
1143         case S_IFSOCK:
1144                 return SECCLASS_SOCK_FILE;
1145         case S_IFLNK:
1146                 return SECCLASS_LNK_FILE;
1147         case S_IFREG:
1148                 return SECCLASS_FILE;
1149         case S_IFBLK:
1150                 return SECCLASS_BLK_FILE;
1151         case S_IFDIR:
1152                 return SECCLASS_DIR;
1153         case S_IFCHR:
1154                 return SECCLASS_CHR_FILE;
1155         case S_IFIFO:
1156                 return SECCLASS_FIFO_FILE;
1157
1158         }
1159
1160         return SECCLASS_FILE;
1161 }
1162
1163 static inline int default_protocol_stream(int protocol)
1164 {
1165         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166 }
1167
1168 static inline int default_protocol_dgram(int protocol)
1169 {
1170         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171 }
1172
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174 {
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                         return SECCLASS_UNIX_DGRAM_SOCKET;
1183                 }
1184                 break;
1185         case PF_INET:
1186         case PF_INET6:
1187                 switch (type) {
1188                 case SOCK_STREAM:
1189                         if (default_protocol_stream(protocol))
1190                                 return SECCLASS_TCP_SOCKET;
1191                         else
1192                                 return SECCLASS_RAWIP_SOCKET;
1193                 case SOCK_DGRAM:
1194                         if (default_protocol_dgram(protocol))
1195                                 return SECCLASS_UDP_SOCKET;
1196                         else
1197                                 return SECCLASS_RAWIP_SOCKET;
1198                 case SOCK_DCCP:
1199                         return SECCLASS_DCCP_SOCKET;
1200                 default:
1201                         return SECCLASS_RAWIP_SOCKET;
1202                 }
1203                 break;
1204         case PF_NETLINK:
1205                 switch (protocol) {
1206                 case NETLINK_ROUTE:
1207                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1208                 case NETLINK_SOCK_DIAG:
1209                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210                 case NETLINK_NFLOG:
1211                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1212                 case NETLINK_XFRM:
1213                         return SECCLASS_NETLINK_XFRM_SOCKET;
1214                 case NETLINK_SELINUX:
1215                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1216                 case NETLINK_ISCSI:
1217                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1218                 case NETLINK_AUDIT:
1219                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1220                 case NETLINK_FIB_LOOKUP:
1221                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222                 case NETLINK_CONNECTOR:
1223                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224                 case NETLINK_NETFILTER:
1225                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226                 case NETLINK_DNRTMSG:
1227                         return SECCLASS_NETLINK_DNRT_SOCKET;
1228                 case NETLINK_KOBJECT_UEVENT:
1229                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230                 case NETLINK_GENERIC:
1231                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1232                 case NETLINK_SCSITRANSPORT:
1233                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234                 case NETLINK_RDMA:
1235                         return SECCLASS_NETLINK_RDMA_SOCKET;
1236                 case NETLINK_CRYPTO:
1237                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1238                 default:
1239                         return SECCLASS_NETLINK_SOCKET;
1240                 }
1241         case PF_PACKET:
1242                 return SECCLASS_PACKET_SOCKET;
1243         case PF_KEY:
1244                 return SECCLASS_KEY_SOCKET;
1245         case PF_APPLETALK:
1246                 return SECCLASS_APPLETALK_SOCKET;
1247         }
1248
1249         return SECCLASS_SOCKET;
1250 }
1251
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1253                                  u16 tclass,
1254                                  u16 flags,
1255                                  u32 *sid)
1256 {
1257         int rc;
1258         struct super_block *sb = dentry->d_inode->i_sb;
1259         char *buffer, *path;
1260
1261         buffer = (char *)__get_free_page(GFP_KERNEL);
1262         if (!buffer)
1263                 return -ENOMEM;
1264
1265         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266         if (IS_ERR(path))
1267                 rc = PTR_ERR(path);
1268         else {
1269                 if (flags & SE_SBPROC) {
1270                         /* each process gets a /proc/PID/ entry. Strip off the
1271                          * PID part to get a valid selinux labeling.
1272                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273                         while (path[1] >= '0' && path[1] <= '9') {
1274                                 path[1] = '/';
1275                                 path++;
1276                         }
1277                 }
1278                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1279         }
1280         free_page((unsigned long)buffer);
1281         return rc;
1282 }
1283
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286 {
1287         struct superblock_security_struct *sbsec = NULL;
1288         struct inode_security_struct *isec = inode->i_security;
1289         u32 sid;
1290         struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292         char *context = NULL;
1293         unsigned len = 0;
1294         int rc = 0;
1295
1296         if (isec->initialized)
1297                 goto out;
1298
1299         mutex_lock(&isec->lock);
1300         if (isec->initialized)
1301                 goto out_unlock;
1302
1303         sbsec = inode->i_sb->s_security;
1304         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305                 /* Defer initialization until selinux_complete_init,
1306                    after the initial policy is loaded and the security
1307                    server is ready to handle calls. */
1308                 spin_lock(&sbsec->isec_lock);
1309                 if (list_empty(&isec->list))
1310                         list_add(&isec->list, &sbsec->isec_head);
1311                 spin_unlock(&sbsec->isec_lock);
1312                 goto out_unlock;
1313         }
1314
1315         switch (sbsec->behavior) {
1316         case SECURITY_FS_USE_NATIVE:
1317                 break;
1318         case SECURITY_FS_USE_XATTR:
1319                 if (!inode->i_op->getxattr) {
1320                         isec->sid = sbsec->def_sid;
1321                         break;
1322                 }
1323
1324                 /* Need a dentry, since the xattr API requires one.
1325                    Life would be simpler if we could just pass the inode. */
1326                 if (opt_dentry) {
1327                         /* Called from d_instantiate or d_splice_alias. */
1328                         dentry = dget(opt_dentry);
1329                 } else {
1330                         /* Called from selinux_complete_init, try to find a dentry. */
1331                         dentry = d_find_alias(inode);
1332                 }
1333                 if (!dentry) {
1334                         /*
1335                          * this is can be hit on boot when a file is accessed
1336                          * before the policy is loaded.  When we load policy we
1337                          * may find inodes that have no dentry on the
1338                          * sbsec->isec_head list.  No reason to complain as these
1339                          * will get fixed up the next time we go through
1340                          * inode_doinit with a dentry, before these inodes could
1341                          * be used again by userspace.
1342                          */
1343                         goto out_unlock;
1344                 }
1345
1346                 len = INITCONTEXTLEN;
1347                 context = kmalloc(len+1, GFP_NOFS);
1348                 if (!context) {
1349                         rc = -ENOMEM;
1350                         dput(dentry);
1351                         goto out_unlock;
1352                 }
1353                 context[len] = '\0';
1354                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355                                            context, len);
1356                 if (rc == -ERANGE) {
1357                         kfree(context);
1358
1359                         /* Need a larger buffer.  Query for the right size. */
1360                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361                                                    NULL, 0);
1362                         if (rc < 0) {
1363                                 dput(dentry);
1364                                 goto out_unlock;
1365                         }
1366                         len = rc;
1367                         context = kmalloc(len+1, GFP_NOFS);
1368                         if (!context) {
1369                                 rc = -ENOMEM;
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         context[len] = '\0';
1374                         rc = inode->i_op->getxattr(dentry,
1375                                                    XATTR_NAME_SELINUX,
1376                                                    context, len);
1377                 }
1378                 dput(dentry);
1379                 if (rc < 0) {
1380                         if (rc != -ENODATA) {
1381                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1382                                        "%d for dev=%s ino=%ld\n", __func__,
1383                                        -rc, inode->i_sb->s_id, inode->i_ino);
1384                                 kfree(context);
1385                                 goto out_unlock;
1386                         }
1387                         /* Map ENODATA to the default file SID */
1388                         sid = sbsec->def_sid;
1389                         rc = 0;
1390                 } else {
1391                         rc = security_context_to_sid_default(context, rc, &sid,
1392                                                              sbsec->def_sid,
1393                                                              GFP_NOFS);
1394                         if (rc) {
1395                                 char *dev = inode->i_sb->s_id;
1396                                 unsigned long ino = inode->i_ino;
1397
1398                                 if (rc == -EINVAL) {
1399                                         if (printk_ratelimit())
1400                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1402                                                         "filesystem in question.\n", ino, dev, context);
1403                                 } else {
1404                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1405                                                "returned %d for dev=%s ino=%ld\n",
1406                                                __func__, context, -rc, dev, ino);
1407                                 }
1408                                 kfree(context);
1409                                 /* Leave with the unlabeled SID */
1410                                 rc = 0;
1411                                 break;
1412                         }
1413                 }
1414                 kfree(context);
1415                 isec->sid = sid;
1416                 break;
1417         case SECURITY_FS_USE_TASK:
1418                 isec->sid = isec->task_sid;
1419                 break;
1420         case SECURITY_FS_USE_TRANS:
1421                 /* Default to the fs SID. */
1422                 isec->sid = sbsec->sid;
1423
1424                 /* Try to obtain a transition SID. */
1425                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427                                              isec->sclass, NULL, &sid);
1428                 if (rc)
1429                         goto out_unlock;
1430                 isec->sid = sid;
1431                 break;
1432         case SECURITY_FS_USE_MNTPOINT:
1433                 isec->sid = sbsec->mntpoint_sid;
1434                 break;
1435         default:
1436                 /* Default to the fs superblock SID. */
1437                 isec->sid = sbsec->sid;
1438
1439                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440                         /* We must have a dentry to determine the label on
1441                          * procfs inodes */
1442                         if (opt_dentry)
1443                                 /* Called from d_instantiate or
1444                                  * d_splice_alias. */
1445                                 dentry = dget(opt_dentry);
1446                         else
1447                                 /* Called from selinux_complete_init, try to
1448                                  * find a dentry. */
1449                                 dentry = d_find_alias(inode);
1450                         /*
1451                          * This can be hit on boot when a file is accessed
1452                          * before the policy is loaded.  When we load policy we
1453                          * may find inodes that have no dentry on the
1454                          * sbsec->isec_head list.  No reason to complain as
1455                          * these will get fixed up the next time we go through
1456                          * inode_doinit() with a dentry, before these inodes
1457                          * could be used again by userspace.
1458                          */
1459                         if (!dentry)
1460                                 goto out_unlock;
1461                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463                                                    sbsec->flags, &sid);
1464                         dput(dentry);
1465                         if (rc)
1466                                 goto out_unlock;
1467                         isec->sid = sid;
1468                 }
1469                 break;
1470         }
1471
1472         isec->initialized = 1;
1473
1474 out_unlock:
1475         mutex_unlock(&isec->lock);
1476 out:
1477         if (isec->sclass == SECCLASS_FILE)
1478                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1479         return rc;
1480 }
1481
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1484 {
1485         u32 perm = 0;
1486
1487         switch (sig) {
1488         case SIGCHLD:
1489                 /* Commonly granted from child to parent. */
1490                 perm = PROCESS__SIGCHLD;
1491                 break;
1492         case SIGKILL:
1493                 /* Cannot be caught or ignored */
1494                 perm = PROCESS__SIGKILL;
1495                 break;
1496         case SIGSTOP:
1497                 /* Cannot be caught or ignored */
1498                 perm = PROCESS__SIGSTOP;
1499                 break;
1500         default:
1501                 /* All other signals. */
1502                 perm = PROCESS__SIGNAL;
1503                 break;
1504         }
1505
1506         return perm;
1507 }
1508
1509 /*
1510  * Check permission between a pair of credentials
1511  * fork check, ptrace check, etc.
1512  */
1513 static int cred_has_perm(const struct cred *actor,
1514                          const struct cred *target,
1515                          u32 perms)
1516 {
1517         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518
1519         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523  * Check permission between a pair of tasks, e.g. signal checks,
1524  * fork check, ptrace check, etc.
1525  * tsk1 is the actor and tsk2 is the target
1526  * - this uses the default subjective creds of tsk1
1527  */
1528 static int task_has_perm(const struct task_struct *tsk1,
1529                          const struct task_struct *tsk2,
1530                          u32 perms)
1531 {
1532         const struct task_security_struct *__tsec1, *__tsec2;
1533         u32 sid1, sid2;
1534
1535         rcu_read_lock();
1536         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1537         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1538         rcu_read_unlock();
1539         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1540 }
1541
1542 /*
1543  * Check permission between current and another task, e.g. signal checks,
1544  * fork check, ptrace check, etc.
1545  * current is the actor and tsk2 is the target
1546  * - this uses current's subjective creds
1547  */
1548 static int current_has_perm(const struct task_struct *tsk,
1549                             u32 perms)
1550 {
1551         u32 sid, tsid;
1552
1553         sid = current_sid();
1554         tsid = task_sid(tsk);
1555         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556 }
1557
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1560 #endif
1561
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1564                                int cap, int audit)
1565 {
1566         struct common_audit_data ad;
1567         struct av_decision avd;
1568         u16 sclass;
1569         u32 sid = cred_sid(cred);
1570         u32 av = CAP_TO_MASK(cap);
1571         int rc;
1572
1573         ad.type = LSM_AUDIT_DATA_CAP;
1574         ad.u.cap = cap;
1575
1576         switch (CAP_TO_INDEX(cap)) {
1577         case 0:
1578                 sclass = SECCLASS_CAPABILITY;
1579                 break;
1580         case 1:
1581                 sclass = SECCLASS_CAPABILITY2;
1582                 break;
1583         default:
1584                 printk(KERN_ERR
1585                        "SELinux:  out of range capability %d\n", cap);
1586                 BUG();
1587                 return -EINVAL;
1588         }
1589
1590         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591         if (audit == SECURITY_CAP_AUDIT) {
1592                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1593                 if (rc2)
1594                         return rc2;
1595         }
1596         return rc;
1597 }
1598
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1601                            u32 perms)
1602 {
1603         u32 sid = task_sid(tsk);
1604
1605         return avc_has_perm(sid, SECINITSID_KERNEL,
1606                             SECCLASS_SYSTEM, perms, NULL);
1607 }
1608
1609 /* Check whether a task has a particular permission to an inode.
1610    The 'adp' parameter is optional and allows other audit
1611    data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613                           struct inode *inode,
1614                           u32 perms,
1615                           struct common_audit_data *adp)
1616 {
1617         struct inode_security_struct *isec;
1618         u32 sid;
1619
1620         validate_creds(cred);
1621
1622         if (unlikely(IS_PRIVATE(inode)))
1623                 return 0;
1624
1625         sid = cred_sid(cred);
1626         isec = inode->i_security;
1627
1628         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1629 }
1630
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632    the dentry to help the auditing code to more easily generate the
1633    pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635                                   struct dentry *dentry,
1636                                   u32 av)
1637 {
1638         struct inode *inode = d_backing_inode(dentry);
1639         struct common_audit_data ad;
1640
1641         ad.type = LSM_AUDIT_DATA_DENTRY;
1642         ad.u.dentry = dentry;
1643         return inode_has_perm(cred, inode, av, &ad);
1644 }
1645
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647    the path to help the auditing code to more easily generate the
1648    pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650                                 const struct path *path,
1651                                 u32 av)
1652 {
1653         struct inode *inode = d_backing_inode(path->dentry);
1654         struct common_audit_data ad;
1655
1656         ad.type = LSM_AUDIT_DATA_PATH;
1657         ad.u.path = *path;
1658         return inode_has_perm(cred, inode, av, &ad);
1659 }
1660
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1663                                      struct file *file,
1664                                      u32 av)
1665 {
1666         struct common_audit_data ad;
1667
1668         ad.type = LSM_AUDIT_DATA_PATH;
1669         ad.u.path = file->f_path;
1670         return inode_has_perm(cred, file_inode(file), av, &ad);
1671 }
1672
1673 /* Check whether a task can use an open file descriptor to
1674    access an inode in a given way.  Check access to the
1675    descriptor itself, and then use dentry_has_perm to
1676    check a particular permission to the file.
1677    Access to the descriptor is implicitly granted if it
1678    has the same SID as the process.  If av is zero, then
1679    access to the file is not checked, e.g. for cases
1680    where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1682                          struct file *file,
1683                          u32 av)
1684 {
1685         struct file_security_struct *fsec = file->f_security;
1686         struct inode *inode = file_inode(file);
1687         struct common_audit_data ad;
1688         u32 sid = cred_sid(cred);
1689         int rc;
1690
1691         ad.type = LSM_AUDIT_DATA_PATH;
1692         ad.u.path = file->f_path;
1693
1694         if (sid != fsec->sid) {
1695                 rc = avc_has_perm(sid, fsec->sid,
1696                                   SECCLASS_FD,
1697                                   FD__USE,
1698                                   &ad);
1699                 if (rc)
1700                         goto out;
1701         }
1702
1703         /* av is zero if only checking access to the descriptor. */
1704         rc = 0;
1705         if (av)
1706                 rc = inode_has_perm(cred, inode, av, &ad);
1707
1708 out:
1709         return rc;
1710 }
1711
1712 /*
1713  * Determine the label for an inode that might be unioned.
1714  */
1715 static int selinux_determine_inode_label(const struct inode *dir,
1716                                          const struct qstr *name,
1717                                          u16 tclass,
1718                                          u32 *_new_isid)
1719 {
1720         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721         const struct inode_security_struct *dsec = dir->i_security;
1722         const struct task_security_struct *tsec = current_security();
1723
1724         if ((sbsec->flags & SE_SBINITIALIZED) &&
1725             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726                 *_new_isid = sbsec->mntpoint_sid;
1727         } else if ((sbsec->flags & SBLABEL_MNT) &&
1728                    tsec->create_sid) {
1729                 *_new_isid = tsec->create_sid;
1730         } else {
1731                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1732                                                name, _new_isid);
1733         }
1734
1735         return 0;
1736 }
1737
1738 /* Check whether a task can create a file. */
1739 static int may_create(struct inode *dir,
1740                       struct dentry *dentry,
1741                       u16 tclass)
1742 {
1743         const struct task_security_struct *tsec = current_security();
1744         struct inode_security_struct *dsec;
1745         struct superblock_security_struct *sbsec;
1746         u32 sid, newsid;
1747         struct common_audit_data ad;
1748         int rc;
1749
1750         dsec = dir->i_security;
1751         sbsec = dir->i_sb->s_security;
1752
1753         sid = tsec->sid;
1754
1755         ad.type = LSM_AUDIT_DATA_DENTRY;
1756         ad.u.dentry = dentry;
1757
1758         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1759                           DIR__ADD_NAME | DIR__SEARCH,
1760                           &ad);
1761         if (rc)
1762                 return rc;
1763
1764         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1765                                            &newsid);
1766         if (rc)
1767                 return rc;
1768
1769         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1770         if (rc)
1771                 return rc;
1772
1773         return avc_has_perm(newsid, sbsec->sid,
1774                             SECCLASS_FILESYSTEM,
1775                             FILESYSTEM__ASSOCIATE, &ad);
1776 }
1777
1778 /* Check whether a task can create a key. */
1779 static int may_create_key(u32 ksid,
1780                           struct task_struct *ctx)
1781 {
1782         u32 sid = task_sid(ctx);
1783
1784         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1785 }
1786
1787 #define MAY_LINK        0
1788 #define MAY_UNLINK      1
1789 #define MAY_RMDIR       2
1790
1791 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1792 static int may_link(struct inode *dir,
1793                     struct dentry *dentry,
1794                     int kind)
1795
1796 {
1797         struct inode_security_struct *dsec, *isec;
1798         struct common_audit_data ad;
1799         u32 sid = current_sid();
1800         u32 av;
1801         int rc;
1802
1803         dsec = dir->i_security;
1804         isec = d_backing_inode(dentry)->i_security;
1805
1806         ad.type = LSM_AUDIT_DATA_DENTRY;
1807         ad.u.dentry = dentry;
1808
1809         av = DIR__SEARCH;
1810         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1811         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1812         if (rc)
1813                 return rc;
1814
1815         switch (kind) {
1816         case MAY_LINK:
1817                 av = FILE__LINK;
1818                 break;
1819         case MAY_UNLINK:
1820                 av = FILE__UNLINK;
1821                 break;
1822         case MAY_RMDIR:
1823                 av = DIR__RMDIR;
1824                 break;
1825         default:
1826                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1827                         __func__, kind);
1828                 return 0;
1829         }
1830
1831         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1832         return rc;
1833 }
1834
1835 static inline int may_rename(struct inode *old_dir,
1836                              struct dentry *old_dentry,
1837                              struct inode *new_dir,
1838                              struct dentry *new_dentry)
1839 {
1840         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1841         struct common_audit_data ad;
1842         u32 sid = current_sid();
1843         u32 av;
1844         int old_is_dir, new_is_dir;
1845         int rc;
1846
1847         old_dsec = old_dir->i_security;
1848         old_isec = d_backing_inode(old_dentry)->i_security;
1849         old_is_dir = d_is_dir(old_dentry);
1850         new_dsec = new_dir->i_security;
1851
1852         ad.type = LSM_AUDIT_DATA_DENTRY;
1853
1854         ad.u.dentry = old_dentry;
1855         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1856                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1857         if (rc)
1858                 return rc;
1859         rc = avc_has_perm(sid, old_isec->sid,
1860                           old_isec->sclass, FILE__RENAME, &ad);
1861         if (rc)
1862                 return rc;
1863         if (old_is_dir && new_dir != old_dir) {
1864                 rc = avc_has_perm(sid, old_isec->sid,
1865                                   old_isec->sclass, DIR__REPARENT, &ad);
1866                 if (rc)
1867                         return rc;
1868         }
1869
1870         ad.u.dentry = new_dentry;
1871         av = DIR__ADD_NAME | DIR__SEARCH;
1872         if (d_is_positive(new_dentry))
1873                 av |= DIR__REMOVE_NAME;
1874         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1875         if (rc)
1876                 return rc;
1877         if (d_is_positive(new_dentry)) {
1878                 new_isec = d_backing_inode(new_dentry)->i_security;
1879                 new_is_dir = d_is_dir(new_dentry);
1880                 rc = avc_has_perm(sid, new_isec->sid,
1881                                   new_isec->sclass,
1882                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1883                 if (rc)
1884                         return rc;
1885         }
1886
1887         return 0;
1888 }
1889
1890 /* Check whether a task can perform a filesystem operation. */
1891 static int superblock_has_perm(const struct cred *cred,
1892                                struct super_block *sb,
1893                                u32 perms,
1894                                struct common_audit_data *ad)
1895 {
1896         struct superblock_security_struct *sbsec;
1897         u32 sid = cred_sid(cred);
1898
1899         sbsec = sb->s_security;
1900         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1901 }
1902
1903 /* Convert a Linux mode and permission mask to an access vector. */
1904 static inline u32 file_mask_to_av(int mode, int mask)
1905 {
1906         u32 av = 0;
1907
1908         if (!S_ISDIR(mode)) {
1909                 if (mask & MAY_EXEC)
1910                         av |= FILE__EXECUTE;
1911                 if (mask & MAY_READ)
1912                         av |= FILE__READ;
1913
1914                 if (mask & MAY_APPEND)
1915                         av |= FILE__APPEND;
1916                 else if (mask & MAY_WRITE)
1917                         av |= FILE__WRITE;
1918
1919         } else {
1920                 if (mask & MAY_EXEC)
1921                         av |= DIR__SEARCH;
1922                 if (mask & MAY_WRITE)
1923                         av |= DIR__WRITE;
1924                 if (mask & MAY_READ)
1925                         av |= DIR__READ;
1926         }
1927
1928         return av;
1929 }
1930
1931 /* Convert a Linux file to an access vector. */
1932 static inline u32 file_to_av(struct file *file)
1933 {
1934         u32 av = 0;
1935
1936         if (file->f_mode & FMODE_READ)
1937                 av |= FILE__READ;
1938         if (file->f_mode & FMODE_WRITE) {
1939                 if (file->f_flags & O_APPEND)
1940                         av |= FILE__APPEND;
1941                 else
1942                         av |= FILE__WRITE;
1943         }
1944         if (!av) {
1945                 /*
1946                  * Special file opened with flags 3 for ioctl-only use.
1947                  */
1948                 av = FILE__IOCTL;
1949         }
1950
1951         return av;
1952 }
1953
1954 /*
1955  * Convert a file to an access vector and include the correct open
1956  * open permission.
1957  */
1958 static inline u32 open_file_to_av(struct file *file)
1959 {
1960         u32 av = file_to_av(file);
1961
1962         if (selinux_policycap_openperm)
1963                 av |= FILE__OPEN;
1964
1965         return av;
1966 }
1967
1968 /* Hook functions begin here. */
1969
1970 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1971 {
1972         u32 mysid = current_sid();
1973         u32 mgrsid = task_sid(mgr);
1974
1975         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976                             BINDER__SET_CONTEXT_MGR, NULL);
1977 }
1978
1979 static int selinux_binder_transaction(struct task_struct *from,
1980                                       struct task_struct *to)
1981 {
1982         u32 mysid = current_sid();
1983         u32 fromsid = task_sid(from);
1984         u32 tosid = task_sid(to);
1985         int rc;
1986
1987         if (mysid != fromsid) {
1988                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989                                   BINDER__IMPERSONATE, NULL);
1990                 if (rc)
1991                         return rc;
1992         }
1993
1994         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1995                             NULL);
1996 }
1997
1998 static int selinux_binder_transfer_binder(struct task_struct *from,
1999                                           struct task_struct *to)
2000 {
2001         u32 fromsid = task_sid(from);
2002         u32 tosid = task_sid(to);
2003
2004         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2005                             NULL);
2006 }
2007
2008 static int selinux_binder_transfer_file(struct task_struct *from,
2009                                         struct task_struct *to,
2010                                         struct file *file)
2011 {
2012         u32 sid = task_sid(to);
2013         struct file_security_struct *fsec = file->f_security;
2014         struct inode *inode = d_backing_inode(file->f_path.dentry);
2015         struct inode_security_struct *isec = inode->i_security;
2016         struct common_audit_data ad;
2017         int rc;
2018
2019         ad.type = LSM_AUDIT_DATA_PATH;
2020         ad.u.path = file->f_path;
2021
2022         if (sid != fsec->sid) {
2023                 rc = avc_has_perm(sid, fsec->sid,
2024                                   SECCLASS_FD,
2025                                   FD__USE,
2026                                   &ad);
2027                 if (rc)
2028                         return rc;
2029         }
2030
2031         if (unlikely(IS_PRIVATE(inode)))
2032                 return 0;
2033
2034         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2035                             &ad);
2036 }
2037
2038 static int selinux_ptrace_access_check(struct task_struct *child,
2039                                      unsigned int mode)
2040 {
2041         if (mode & PTRACE_MODE_READ) {
2042                 u32 sid = current_sid();
2043                 u32 csid = task_sid(child);
2044                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2045         }
2046
2047         return current_has_perm(child, PROCESS__PTRACE);
2048 }
2049
2050 static int selinux_ptrace_traceme(struct task_struct *parent)
2051 {
2052         return task_has_perm(parent, current, PROCESS__PTRACE);
2053 }
2054
2055 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2056                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2057 {
2058         return current_has_perm(target, PROCESS__GETCAP);
2059 }
2060
2061 static int selinux_capset(struct cred *new, const struct cred *old,
2062                           const kernel_cap_t *effective,
2063                           const kernel_cap_t *inheritable,
2064                           const kernel_cap_t *permitted)
2065 {
2066         return cred_has_perm(old, new, PROCESS__SETCAP);
2067 }
2068
2069 /*
2070  * (This comment used to live with the selinux_task_setuid hook,
2071  * which was removed).
2072  *
2073  * Since setuid only affects the current process, and since the SELinux
2074  * controls are not based on the Linux identity attributes, SELinux does not
2075  * need to control this operation.  However, SELinux does control the use of
2076  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2077  */
2078
2079 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2080                            int cap, int audit)
2081 {
2082         return cred_has_capability(cred, cap, audit);
2083 }
2084
2085 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2086 {
2087         const struct cred *cred = current_cred();
2088         int rc = 0;
2089
2090         if (!sb)
2091                 return 0;
2092
2093         switch (cmds) {
2094         case Q_SYNC:
2095         case Q_QUOTAON:
2096         case Q_QUOTAOFF:
2097         case Q_SETINFO:
2098         case Q_SETQUOTA:
2099                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2100                 break;
2101         case Q_GETFMT:
2102         case Q_GETINFO:
2103         case Q_GETQUOTA:
2104                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2105                 break;
2106         default:
2107                 rc = 0;  /* let the kernel handle invalid cmds */
2108                 break;
2109         }
2110         return rc;
2111 }
2112
2113 static int selinux_quota_on(struct dentry *dentry)
2114 {
2115         const struct cred *cred = current_cred();
2116
2117         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2118 }
2119
2120 static int selinux_syslog(int type)
2121 {
2122         int rc;
2123
2124         switch (type) {
2125         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2126         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2127                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2128                 break;
2129         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2131         /* Set level of messages printed to console */
2132         case SYSLOG_ACTION_CONSOLE_LEVEL:
2133                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2134                 break;
2135         case SYSLOG_ACTION_CLOSE:       /* Close log */
2136         case SYSLOG_ACTION_OPEN:        /* Open log */
2137         case SYSLOG_ACTION_READ:        /* Read from log */
2138         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2139         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2140         default:
2141                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2142                 break;
2143         }
2144         return rc;
2145 }
2146
2147 /*
2148  * Check that a process has enough memory to allocate a new virtual
2149  * mapping. 0 means there is enough memory for the allocation to
2150  * succeed and -ENOMEM implies there is not.
2151  *
2152  * Do not audit the selinux permission check, as this is applied to all
2153  * processes that allocate mappings.
2154  */
2155 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2156 {
2157         int rc, cap_sys_admin = 0;
2158
2159         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160                                         SECURITY_CAP_NOAUDIT);
2161         if (rc == 0)
2162                 cap_sys_admin = 1;
2163
2164         return cap_sys_admin;
2165 }
2166
2167 /* binprm security operations */
2168
2169 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170                             const struct task_security_struct *old_tsec,
2171                             const struct task_security_struct *new_tsec)
2172 {
2173         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2175         int rc;
2176
2177         if (!nnp && !nosuid)
2178                 return 0; /* neither NNP nor nosuid */
2179
2180         if (new_tsec->sid == old_tsec->sid)
2181                 return 0; /* No change in credentials */
2182
2183         /*
2184          * The only transitions we permit under NNP or nosuid
2185          * are transitions to bounded SIDs, i.e. SIDs that are
2186          * guaranteed to only be allowed a subset of the permissions
2187          * of the current SID.
2188          */
2189         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2190         if (rc) {
2191                 /*
2192                  * On failure, preserve the errno values for NNP vs nosuid.
2193                  * NNP:  Operation not permitted for caller.
2194                  * nosuid:  Permission denied to file.
2195                  */
2196                 if (nnp)
2197                         return -EPERM;
2198                 else
2199                         return -EACCES;
2200         }
2201         return 0;
2202 }
2203
2204 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2205 {
2206         const struct task_security_struct *old_tsec;
2207         struct task_security_struct *new_tsec;
2208         struct inode_security_struct *isec;
2209         struct common_audit_data ad;
2210         struct inode *inode = file_inode(bprm->file);
2211         int rc;
2212
2213         /* SELinux context only depends on initial program or script and not
2214          * the script interpreter */
2215         if (bprm->cred_prepared)
2216                 return 0;
2217
2218         old_tsec = current_security();
2219         new_tsec = bprm->cred->security;
2220         isec = inode->i_security;
2221
2222         /* Default to the current task SID. */
2223         new_tsec->sid = old_tsec->sid;
2224         new_tsec->osid = old_tsec->sid;
2225
2226         /* Reset fs, key, and sock SIDs on execve. */
2227         new_tsec->create_sid = 0;
2228         new_tsec->keycreate_sid = 0;
2229         new_tsec->sockcreate_sid = 0;
2230
2231         if (old_tsec->exec_sid) {
2232                 new_tsec->sid = old_tsec->exec_sid;
2233                 /* Reset exec SID on execve. */
2234                 new_tsec->exec_sid = 0;
2235
2236                 /* Fail on NNP or nosuid if not an allowed transition. */
2237                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2238                 if (rc)
2239                         return rc;
2240         } else {
2241                 /* Check for a default transition on this program. */
2242                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2243                                              SECCLASS_PROCESS, NULL,
2244                                              &new_tsec->sid);
2245                 if (rc)
2246                         return rc;
2247
2248                 /*
2249                  * Fallback to old SID on NNP or nosuid if not an allowed
2250                  * transition.
2251                  */
2252                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253                 if (rc)
2254                         new_tsec->sid = old_tsec->sid;
2255         }
2256
2257         ad.type = LSM_AUDIT_DATA_PATH;
2258         ad.u.path = bprm->file->f_path;
2259
2260         if (new_tsec->sid == old_tsec->sid) {
2261                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2262                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2263                 if (rc)
2264                         return rc;
2265         } else {
2266                 /* Check permissions for the transition. */
2267                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2269                 if (rc)
2270                         return rc;
2271
2272                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2273                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2274                 if (rc)
2275                         return rc;
2276
2277                 /* Check for shared state */
2278                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280                                           SECCLASS_PROCESS, PROCESS__SHARE,
2281                                           NULL);
2282                         if (rc)
2283                                 return -EPERM;
2284                 }
2285
2286                 /* Make sure that anyone attempting to ptrace over a task that
2287                  * changes its SID has the appropriate permit */
2288                 if (bprm->unsafe &
2289                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290                         struct task_struct *tracer;
2291                         struct task_security_struct *sec;
2292                         u32 ptsid = 0;
2293
2294                         rcu_read_lock();
2295                         tracer = ptrace_parent(current);
2296                         if (likely(tracer != NULL)) {
2297                                 sec = __task_cred(tracer)->security;
2298                                 ptsid = sec->sid;
2299                         }
2300                         rcu_read_unlock();
2301
2302                         if (ptsid != 0) {
2303                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2304                                                   SECCLASS_PROCESS,
2305                                                   PROCESS__PTRACE, NULL);
2306                                 if (rc)
2307                                         return -EPERM;
2308                         }
2309                 }
2310
2311                 /* Clear any possibly unsafe personality bits on exec: */
2312                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2313         }
2314
2315         return 0;
2316 }
2317
2318 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2319 {
2320         const struct task_security_struct *tsec = current_security();
2321         u32 sid, osid;
2322         int atsecure = 0;
2323
2324         sid = tsec->sid;
2325         osid = tsec->osid;
2326
2327         if (osid != sid) {
2328                 /* Enable secure mode for SIDs transitions unless
2329                    the noatsecure permission is granted between
2330                    the two SIDs, i.e. ahp returns 0. */
2331                 atsecure = avc_has_perm(osid, sid,
2332                                         SECCLASS_PROCESS,
2333                                         PROCESS__NOATSECURE, NULL);
2334         }
2335
2336         return !!atsecure;
2337 }
2338
2339 static int match_file(const void *p, struct file *file, unsigned fd)
2340 {
2341         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2342 }
2343
2344 /* Derived from fs/exec.c:flush_old_files. */
2345 static inline void flush_unauthorized_files(const struct cred *cred,
2346                                             struct files_struct *files)
2347 {
2348         struct file *file, *devnull = NULL;
2349         struct tty_struct *tty;
2350         int drop_tty = 0;
2351         unsigned n;
2352
2353         tty = get_current_tty();
2354         if (tty) {
2355                 spin_lock(&tty_files_lock);
2356                 if (!list_empty(&tty->tty_files)) {
2357                         struct tty_file_private *file_priv;
2358
2359                         /* Revalidate access to controlling tty.
2360                            Use file_path_has_perm on the tty path directly
2361                            rather than using file_has_perm, as this particular
2362                            open file may belong to another process and we are
2363                            only interested in the inode-based check here. */
2364                         file_priv = list_first_entry(&tty->tty_files,
2365                                                 struct tty_file_private, list);
2366                         file = file_priv->file;
2367                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2368                                 drop_tty = 1;
2369                 }
2370                 spin_unlock(&tty_files_lock);
2371                 tty_kref_put(tty);
2372         }
2373         /* Reset controlling tty. */
2374         if (drop_tty)
2375                 no_tty();
2376
2377         /* Revalidate access to inherited open files. */
2378         n = iterate_fd(files, 0, match_file, cred);
2379         if (!n) /* none found? */
2380                 return;
2381
2382         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2383         if (IS_ERR(devnull))
2384                 devnull = NULL;
2385         /* replace all the matching ones with this */
2386         do {
2387                 replace_fd(n - 1, devnull, 0);
2388         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2389         if (devnull)
2390                 fput(devnull);
2391 }
2392
2393 /*
2394  * Prepare a process for imminent new credential changes due to exec
2395  */
2396 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2397 {
2398         struct task_security_struct *new_tsec;
2399         struct rlimit *rlim, *initrlim;
2400         int rc, i;
2401
2402         new_tsec = bprm->cred->security;
2403         if (new_tsec->sid == new_tsec->osid)
2404                 return;
2405
2406         /* Close files for which the new task SID is not authorized. */
2407         flush_unauthorized_files(bprm->cred, current->files);
2408
2409         /* Always clear parent death signal on SID transitions. */
2410         current->pdeath_signal = 0;
2411
2412         /* Check whether the new SID can inherit resource limits from the old
2413          * SID.  If not, reset all soft limits to the lower of the current
2414          * task's hard limit and the init task's soft limit.
2415          *
2416          * Note that the setting of hard limits (even to lower them) can be
2417          * controlled by the setrlimit check.  The inclusion of the init task's
2418          * soft limit into the computation is to avoid resetting soft limits
2419          * higher than the default soft limit for cases where the default is
2420          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2421          */
2422         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423                           PROCESS__RLIMITINH, NULL);
2424         if (rc) {
2425                 /* protect against do_prlimit() */
2426                 task_lock(current);
2427                 for (i = 0; i < RLIM_NLIMITS; i++) {
2428                         rlim = current->signal->rlim + i;
2429                         initrlim = init_task.signal->rlim + i;
2430                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2431                 }
2432                 task_unlock(current);
2433                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2434         }
2435 }
2436
2437 /*
2438  * Clean up the process immediately after the installation of new credentials
2439  * due to exec
2440  */
2441 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2442 {
2443         const struct task_security_struct *tsec = current_security();
2444         struct itimerval itimer;
2445         u32 osid, sid;
2446         int rc, i;
2447
2448         osid = tsec->osid;
2449         sid = tsec->sid;
2450
2451         if (sid == osid)
2452                 return;
2453
2454         /* Check whether the new SID can inherit signal state from the old SID.
2455          * If not, clear itimers to avoid subsequent signal generation and
2456          * flush and unblock signals.
2457          *
2458          * This must occur _after_ the task SID has been updated so that any
2459          * kill done after the flush will be checked against the new SID.
2460          */
2461         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2462         if (rc) {
2463                 memset(&itimer, 0, sizeof itimer);
2464                 for (i = 0; i < 3; i++)
2465                         do_setitimer(i, &itimer, NULL);
2466                 spin_lock_irq(&current->sighand->siglock);
2467                 if (!fatal_signal_pending(current)) {
2468                         flush_sigqueue(&current->pending);
2469                         flush_sigqueue(&current->signal->shared_pending);
2470                         flush_signal_handlers(current, 1);
2471                         sigemptyset(&current->blocked);
2472                         recalc_sigpending();
2473                 }
2474                 spin_unlock_irq(&current->sighand->siglock);
2475         }
2476
2477         /* Wake up the parent if it is waiting so that it can recheck
2478          * wait permission to the new task SID. */
2479         read_lock(&tasklist_lock);
2480         __wake_up_parent(current, current->real_parent);
2481         read_unlock(&tasklist_lock);
2482 }
2483
2484 /* superblock security operations */
2485
2486 static int selinux_sb_alloc_security(struct super_block *sb)
2487 {
2488         return superblock_alloc_security(sb);
2489 }
2490
2491 static void selinux_sb_free_security(struct super_block *sb)
2492 {
2493         superblock_free_security(sb);
2494 }
2495
2496 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2497 {
2498         if (plen > olen)
2499                 return 0;
2500
2501         return !memcmp(prefix, option, plen);
2502 }
2503
2504 static inline int selinux_option(char *option, int len)
2505 {
2506         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2511 }
2512
2513 static inline void take_option(char **to, char *from, int *first, int len)
2514 {
2515         if (!*first) {
2516                 **to = ',';
2517                 *to += 1;
2518         } else
2519                 *first = 0;
2520         memcpy(*to, from, len);
2521         *to += len;
2522 }
2523
2524 static inline void take_selinux_option(char **to, char *from, int *first,
2525                                        int len)
2526 {
2527         int current_size = 0;
2528
2529         if (!*first) {
2530                 **to = '|';
2531                 *to += 1;
2532         } else
2533                 *first = 0;
2534
2535         while (current_size < len) {
2536                 if (*from != '"') {
2537                         **to = *from;
2538                         *to += 1;
2539                 }
2540                 from += 1;
2541                 current_size += 1;
2542         }
2543 }
2544
2545 static int selinux_sb_copy_data(char *orig, char *copy)
2546 {
2547         int fnosec, fsec, rc = 0;
2548         char *in_save, *in_curr, *in_end;
2549         char *sec_curr, *nosec_save, *nosec;
2550         int open_quote = 0;
2551
2552         in_curr = orig;
2553         sec_curr = copy;
2554
2555         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2556         if (!nosec) {
2557                 rc = -ENOMEM;
2558                 goto out;
2559         }
2560
2561         nosec_save = nosec;
2562         fnosec = fsec = 1;
2563         in_save = in_end = orig;
2564
2565         do {
2566                 if (*in_end == '"')
2567                         open_quote = !open_quote;
2568                 if ((*in_end == ',' && open_quote == 0) ||
2569                                 *in_end == '\0') {
2570                         int len = in_end - in_curr;
2571
2572                         if (selinux_option(in_curr, len))
2573                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2574                         else
2575                                 take_option(&nosec, in_curr, &fnosec, len);
2576
2577                         in_curr = in_end + 1;
2578                 }
2579         } while (*in_end++);
2580
2581         strcpy(in_save, nosec_save);
2582         free_page((unsigned long)nosec_save);
2583 out:
2584         return rc;
2585 }
2586
2587 static int selinux_sb_remount(struct super_block *sb, void *data)
2588 {
2589         int rc, i, *flags;
2590         struct security_mnt_opts opts;
2591         char *secdata, **mount_options;
2592         struct superblock_security_struct *sbsec = sb->s_security;
2593
2594         if (!(sbsec->flags & SE_SBINITIALIZED))
2595                 return 0;
2596
2597         if (!data)
2598                 return 0;
2599
2600         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2601                 return 0;
2602
2603         security_init_mnt_opts(&opts);
2604         secdata = alloc_secdata();
2605         if (!secdata)
2606                 return -ENOMEM;
2607         rc = selinux_sb_copy_data(data, secdata);
2608         if (rc)
2609                 goto out_free_secdata;
2610
2611         rc = selinux_parse_opts_str(secdata, &opts);
2612         if (rc)
2613                 goto out_free_secdata;
2614
2615         mount_options = opts.mnt_opts;
2616         flags = opts.mnt_opts_flags;
2617
2618         for (i = 0; i < opts.num_mnt_opts; i++) {
2619                 u32 sid;
2620                 size_t len;
2621
2622                 if (flags[i] == SBLABEL_MNT)
2623                         continue;
2624                 len = strlen(mount_options[i]);
2625                 rc = security_context_to_sid(mount_options[i], len, &sid,
2626                                              GFP_KERNEL);
2627                 if (rc) {
2628                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2629                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2630                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2631                         goto out_free_opts;
2632                 }
2633                 rc = -EINVAL;
2634                 switch (flags[i]) {
2635                 case FSCONTEXT_MNT:
2636                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2637                                 goto out_bad_option;
2638                         break;
2639                 case CONTEXT_MNT:
2640                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2641                                 goto out_bad_option;
2642                         break;
2643                 case ROOTCONTEXT_MNT: {
2644                         struct inode_security_struct *root_isec;
2645                         root_isec = d_backing_inode(sb->s_root)->i_security;
2646
2647                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2648                                 goto out_bad_option;
2649                         break;
2650                 }
2651                 case DEFCONTEXT_MNT:
2652                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2653                                 goto out_bad_option;
2654                         break;
2655                 default:
2656                         goto out_free_opts;
2657                 }
2658         }
2659
2660         rc = 0;
2661 out_free_opts:
2662         security_free_mnt_opts(&opts);
2663 out_free_secdata:
2664         free_secdata(secdata);
2665         return rc;
2666 out_bad_option:
2667         printk(KERN_WARNING "SELinux: unable to change security options "
2668                "during remount (dev %s, type=%s)\n", sb->s_id,
2669                sb->s_type->name);
2670         goto out_free_opts;
2671 }
2672
2673 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2674 {
2675         const struct cred *cred = current_cred();
2676         struct common_audit_data ad;
2677         int rc;
2678
2679         rc = superblock_doinit(sb, data);
2680         if (rc)
2681                 return rc;
2682
2683         /* Allow all mounts performed by the kernel */
2684         if (flags & MS_KERNMOUNT)
2685                 return 0;
2686
2687         ad.type = LSM_AUDIT_DATA_DENTRY;
2688         ad.u.dentry = sb->s_root;
2689         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2690 }
2691
2692 static int selinux_sb_statfs(struct dentry *dentry)
2693 {
2694         const struct cred *cred = current_cred();
2695         struct common_audit_data ad;
2696
2697         ad.type = LSM_AUDIT_DATA_DENTRY;
2698         ad.u.dentry = dentry->d_sb->s_root;
2699         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2700 }
2701
2702 static int selinux_mount(const char *dev_name,
2703                          struct path *path,
2704                          const char *type,
2705                          unsigned long flags,
2706                          void *data)
2707 {
2708         const struct cred *cred = current_cred();
2709
2710         if (flags & MS_REMOUNT)
2711                 return superblock_has_perm(cred, path->dentry->d_sb,
2712                                            FILESYSTEM__REMOUNT, NULL);
2713         else
2714                 return path_has_perm(cred, path, FILE__MOUNTON);
2715 }
2716
2717 static int selinux_umount(struct vfsmount *mnt, int flags)
2718 {
2719         const struct cred *cred = current_cred();
2720
2721         return superblock_has_perm(cred, mnt->mnt_sb,
2722                                    FILESYSTEM__UNMOUNT, NULL);
2723 }
2724
2725 /* inode security operations */
2726
2727 static int selinux_inode_alloc_security(struct inode *inode)
2728 {
2729         return inode_alloc_security(inode);
2730 }
2731
2732 static void selinux_inode_free_security(struct inode *inode)
2733 {
2734         inode_free_security(inode);
2735 }
2736
2737 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2738                                         struct qstr *name, void **ctx,
2739                                         u32 *ctxlen)
2740 {
2741         u32 newsid;
2742         int rc;
2743
2744         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2745                                            inode_mode_to_security_class(mode),
2746                                            &newsid);
2747         if (rc)
2748                 return rc;
2749
2750         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2751 }
2752
2753 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2754                                        const struct qstr *qstr,
2755                                        const char **name,
2756                                        void **value, size_t *len)
2757 {
2758         const struct task_security_struct *tsec = current_security();
2759         struct inode_security_struct *dsec;
2760         struct superblock_security_struct *sbsec;
2761         u32 sid, newsid, clen;
2762         int rc;
2763         char *context;
2764
2765         dsec = dir->i_security;
2766         sbsec = dir->i_sb->s_security;
2767
2768         sid = tsec->sid;
2769         newsid = tsec->create_sid;
2770
2771         rc = selinux_determine_inode_label(
2772                 dir, qstr,
2773                 inode_mode_to_security_class(inode->i_mode),
2774                 &newsid);
2775         if (rc)
2776                 return rc;
2777
2778         /* Possibly defer initialization to selinux_complete_init. */
2779         if (sbsec->flags & SE_SBINITIALIZED) {
2780                 struct inode_security_struct *isec = inode->i_security;
2781                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2782                 isec->sid = newsid;
2783                 isec->initialized = 1;
2784         }
2785
2786         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2787                 return -EOPNOTSUPP;
2788
2789         if (name)
2790                 *name = XATTR_SELINUX_SUFFIX;
2791
2792         if (value && len) {
2793                 rc = security_sid_to_context_force(newsid, &context, &clen);
2794                 if (rc)
2795                         return rc;
2796                 *value = context;
2797                 *len = clen;
2798         }
2799
2800         return 0;
2801 }
2802
2803 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2804 {
2805         return may_create(dir, dentry, SECCLASS_FILE);
2806 }
2807
2808 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2809 {
2810         return may_link(dir, old_dentry, MAY_LINK);
2811 }
2812
2813 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2814 {
2815         return may_link(dir, dentry, MAY_UNLINK);
2816 }
2817
2818 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2819 {
2820         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2821 }
2822
2823 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2824 {
2825         return may_create(dir, dentry, SECCLASS_DIR);
2826 }
2827
2828 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2829 {
2830         return may_link(dir, dentry, MAY_RMDIR);
2831 }
2832
2833 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2834 {
2835         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2836 }
2837
2838 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2839                                 struct inode *new_inode, struct dentry *new_dentry)
2840 {
2841         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2842 }
2843
2844 static int selinux_inode_readlink(struct dentry *dentry)
2845 {
2846         const struct cred *cred = current_cred();
2847
2848         return dentry_has_perm(cred, dentry, FILE__READ);
2849 }
2850
2851 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2852                                      bool rcu)
2853 {
2854         const struct cred *cred = current_cred();
2855         struct common_audit_data ad;
2856         struct inode_security_struct *isec;
2857         u32 sid;
2858
2859         validate_creds(cred);
2860
2861         ad.type = LSM_AUDIT_DATA_DENTRY;
2862         ad.u.dentry = dentry;
2863         sid = cred_sid(cred);
2864         isec = inode->i_security;
2865
2866         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2867                                   rcu ? MAY_NOT_BLOCK : 0);
2868 }
2869
2870 static noinline int audit_inode_permission(struct inode *inode,
2871                                            u32 perms, u32 audited, u32 denied,
2872                                            int result,
2873                                            unsigned flags)
2874 {
2875         struct common_audit_data ad;
2876         struct inode_security_struct *isec = inode->i_security;
2877         int rc;
2878
2879         ad.type = LSM_AUDIT_DATA_INODE;
2880         ad.u.inode = inode;
2881
2882         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2883                             audited, denied, result, &ad, flags);
2884         if (rc)
2885                 return rc;
2886         return 0;
2887 }
2888
2889 static int selinux_inode_permission(struct inode *inode, int mask)
2890 {
2891         const struct cred *cred = current_cred();
2892         u32 perms;
2893         bool from_access;
2894         unsigned flags = mask & MAY_NOT_BLOCK;
2895         struct inode_security_struct *isec;
2896         u32 sid;
2897         struct av_decision avd;
2898         int rc, rc2;
2899         u32 audited, denied;
2900
2901         from_access = mask & MAY_ACCESS;
2902         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2903
2904         /* No permission to check.  Existence test. */
2905         if (!mask)
2906                 return 0;
2907
2908         validate_creds(cred);
2909
2910         if (unlikely(IS_PRIVATE(inode)))
2911                 return 0;
2912
2913         perms = file_mask_to_av(inode->i_mode, mask);
2914
2915         sid = cred_sid(cred);
2916         isec = inode->i_security;
2917
2918         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2919         audited = avc_audit_required(perms, &avd, rc,
2920                                      from_access ? FILE__AUDIT_ACCESS : 0,
2921                                      &denied);
2922         if (likely(!audited))
2923                 return rc;
2924
2925         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2926         if (rc2)
2927                 return rc2;
2928         return rc;
2929 }
2930
2931 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2932 {
2933         const struct cred *cred = current_cred();
2934         unsigned int ia_valid = iattr->ia_valid;
2935         __u32 av = FILE__WRITE;
2936
2937         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2938         if (ia_valid & ATTR_FORCE) {
2939                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2940                               ATTR_FORCE);
2941                 if (!ia_valid)
2942                         return 0;
2943         }
2944
2945         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2946                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2947                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2948
2949         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2950                         && !(ia_valid & ATTR_FILE))
2951                 av |= FILE__OPEN;
2952
2953         return dentry_has_perm(cred, dentry, av);
2954 }
2955
2956 static int selinux_inode_getattr(const struct path *path)
2957 {
2958         return path_has_perm(current_cred(), path, FILE__GETATTR);
2959 }
2960
2961 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2962 {
2963         const struct cred *cred = current_cred();
2964
2965         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2966                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2967                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2968                         if (!capable(CAP_SETFCAP))
2969                                 return -EPERM;
2970                 } else if (!capable(CAP_SYS_ADMIN)) {
2971                         /* A different attribute in the security namespace.
2972                            Restrict to administrator. */
2973                         return -EPERM;
2974                 }
2975         }
2976
2977         /* Not an attribute we recognize, so just check the
2978            ordinary setattr permission. */
2979         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2980 }
2981
2982 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2983                                   const void *value, size_t size, int flags)
2984 {
2985         struct inode *inode = d_backing_inode(dentry);
2986         struct inode_security_struct *isec = inode->i_security;
2987         struct superblock_security_struct *sbsec;
2988         struct common_audit_data ad;
2989         u32 newsid, sid = current_sid();
2990         int rc = 0;
2991
2992         if (strcmp(name, XATTR_NAME_SELINUX))
2993                 return selinux_inode_setotherxattr(dentry, name);
2994
2995         sbsec = inode->i_sb->s_security;
2996         if (!(sbsec->flags & SBLABEL_MNT))
2997                 return -EOPNOTSUPP;
2998
2999         if (!inode_owner_or_capable(inode))
3000                 return -EPERM;
3001
3002         ad.type = LSM_AUDIT_DATA_DENTRY;
3003         ad.u.dentry = dentry;
3004
3005         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3006                           FILE__RELABELFROM, &ad);
3007         if (rc)
3008                 return rc;
3009
3010         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3011         if (rc == -EINVAL) {
3012                 if (!capable(CAP_MAC_ADMIN)) {
3013                         struct audit_buffer *ab;
3014                         size_t audit_size;
3015                         const char *str;
3016
3017                         /* We strip a nul only if it is at the end, otherwise the
3018                          * context contains a nul and we should audit that */
3019                         if (value) {
3020                                 str = value;
3021                                 if (str[size - 1] == '\0')
3022                                         audit_size = size - 1;
3023                                 else
3024                                         audit_size = size;
3025                         } else {
3026                                 str = "";
3027                                 audit_size = 0;
3028                         }
3029                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3030                         audit_log_format(ab, "op=setxattr invalid_context=");
3031                         audit_log_n_untrustedstring(ab, value, audit_size);
3032                         audit_log_end(ab);
3033
3034                         return rc;
3035                 }
3036                 rc = security_context_to_sid_force(value, size, &newsid);
3037         }
3038         if (rc)
3039                 return rc;
3040
3041         rc = avc_has_perm(sid, newsid, isec->sclass,
3042                           FILE__RELABELTO, &ad);
3043         if (rc)
3044                 return rc;
3045
3046         rc = security_validate_transition(isec->sid, newsid, sid,
3047                                           isec->sclass);
3048         if (rc)
3049                 return rc;
3050
3051         return avc_has_perm(newsid,
3052                             sbsec->sid,
3053                             SECCLASS_FILESYSTEM,
3054                             FILESYSTEM__ASSOCIATE,
3055                             &ad);
3056 }
3057
3058 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3059                                         const void *value, size_t size,
3060                                         int flags)
3061 {
3062         struct inode *inode = d_backing_inode(dentry);
3063         struct inode_security_struct *isec = inode->i_security;
3064         u32 newsid;
3065         int rc;
3066
3067         if (strcmp(name, XATTR_NAME_SELINUX)) {
3068                 /* Not an attribute we recognize, so nothing to do. */
3069                 return;
3070         }
3071
3072         rc = security_context_to_sid_force(value, size, &newsid);
3073         if (rc) {
3074                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3075                        "for (%s, %lu), rc=%d\n",
3076                        inode->i_sb->s_id, inode->i_ino, -rc);
3077                 return;
3078         }
3079
3080         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3081         isec->sid = newsid;
3082         isec->initialized = 1;
3083
3084         return;
3085 }
3086
3087 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3088 {
3089         const struct cred *cred = current_cred();
3090
3091         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3092 }
3093
3094 static int selinux_inode_listxattr(struct dentry *dentry)
3095 {
3096         const struct cred *cred = current_cred();
3097
3098         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3099 }
3100
3101 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3102 {
3103         if (strcmp(name, XATTR_NAME_SELINUX))
3104                 return selinux_inode_setotherxattr(dentry, name);
3105
3106         /* No one is allowed to remove a SELinux security label.
3107            You can change the label, but all data must be labeled. */
3108         return -EACCES;
3109 }
3110
3111 /*
3112  * Copy the inode security context value to the user.
3113  *
3114  * Permission check is handled by selinux_inode_getxattr hook.
3115  */
3116 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3117 {
3118         u32 size;
3119         int error;
3120         char *context = NULL;
3121         struct inode_security_struct *isec = inode->i_security;
3122
3123         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3124                 return -EOPNOTSUPP;
3125
3126         /*
3127          * If the caller has CAP_MAC_ADMIN, then get the raw context
3128          * value even if it is not defined by current policy; otherwise,
3129          * use the in-core value under current policy.
3130          * Use the non-auditing forms of the permission checks since
3131          * getxattr may be called by unprivileged processes commonly
3132          * and lack of permission just means that we fall back to the
3133          * in-core context value, not a denial.
3134          */
3135         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3136                             SECURITY_CAP_NOAUDIT);
3137         if (!error)
3138                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3139                                             SECURITY_CAP_NOAUDIT);
3140         if (!error)
3141                 error = security_sid_to_context_force(isec->sid, &context,
3142                                                       &size);
3143         else
3144                 error = security_sid_to_context(isec->sid, &context, &size);
3145         if (error)
3146                 return error;
3147         error = size;
3148         if (alloc) {
3149                 *buffer = context;
3150                 goto out_nofree;
3151         }
3152         kfree(context);
3153 out_nofree:
3154         return error;
3155 }
3156
3157 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3158                                      const void *value, size_t size, int flags)
3159 {
3160         struct inode_security_struct *isec = inode->i_security;
3161         u32 newsid;
3162         int rc;
3163
3164         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3165                 return -EOPNOTSUPP;
3166
3167         if (!value || !size)
3168                 return -EACCES;
3169
3170         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3171         if (rc)
3172                 return rc;
3173
3174         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3175         isec->sid = newsid;
3176         isec->initialized = 1;
3177         return 0;
3178 }
3179
3180 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3181 {
3182         const int len = sizeof(XATTR_NAME_SELINUX);
3183         if (buffer && len <= buffer_size)
3184                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3185         return len;
3186 }
3187
3188 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3189 {
3190         struct inode_security_struct *isec = inode->i_security;
3191         *secid = isec->sid;
3192 }
3193
3194 /* file security operations */
3195
3196 static int selinux_revalidate_file_permission(struct file *file, int mask)
3197 {
3198         const struct cred *cred = current_cred();
3199         struct inode *inode = file_inode(file);
3200
3201         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3202         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3203                 mask |= MAY_APPEND;
3204
3205         return file_has_perm(cred, file,
3206                              file_mask_to_av(inode->i_mode, mask));
3207 }
3208
3209 static int selinux_file_permission(struct file *file, int mask)
3210 {
3211         struct inode *inode = file_inode(file);
3212         struct file_security_struct *fsec = file->f_security;
3213         struct inode_security_struct *isec = inode->i_security;
3214         u32 sid = current_sid();
3215
3216         if (!mask)
3217                 /* No permission to check.  Existence test. */
3218                 return 0;
3219
3220         if (sid == fsec->sid && fsec->isid == isec->sid &&
3221             fsec->pseqno == avc_policy_seqno())
3222                 /* No change since file_open check. */
3223                 return 0;
3224
3225         return selinux_revalidate_file_permission(file, mask);
3226 }
3227
3228 static int selinux_file_alloc_security(struct file *file)
3229 {
3230         return file_alloc_security(file);
3231 }
3232
3233 static void selinux_file_free_security(struct file *file)
3234 {
3235         file_free_security(file);
3236 }
3237
3238 /*
3239  * Check whether a task has the ioctl permission and cmd
3240  * operation to an inode.
3241  */
3242 int ioctl_has_perm(const struct cred *cred, struct file *file,
3243                 u32 requested, u16 cmd)
3244 {
3245         struct common_audit_data ad;
3246         struct file_security_struct *fsec = file->f_security;
3247         struct inode *inode = file_inode(file);
3248         struct inode_security_struct *isec = inode->i_security;
3249         struct lsm_ioctlop_audit ioctl;
3250         u32 ssid = cred_sid(cred);
3251         int rc;
3252         u8 driver = cmd >> 8;
3253         u8 xperm = cmd & 0xff;
3254
3255         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3256         ad.u.op = &ioctl;
3257         ad.u.op->cmd = cmd;
3258         ad.u.op->path = file->f_path;
3259
3260         if (ssid != fsec->sid) {
3261                 rc = avc_has_perm(ssid, fsec->sid,
3262                                 SECCLASS_FD,
3263                                 FD__USE,
3264                                 &ad);
3265                 if (rc)
3266                         goto out;
3267         }
3268
3269         if (unlikely(IS_PRIVATE(inode)))
3270                 return 0;
3271
3272         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3273                         requested, driver, xperm, &ad);
3274 out:
3275         return rc;
3276 }
3277
3278 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3279                               unsigned long arg)
3280 {
3281         const struct cred *cred = current_cred();
3282         int error = 0;
3283
3284         switch (cmd) {
3285         case FIONREAD:
3286         /* fall through */
3287         case FIBMAP:
3288         /* fall through */
3289         case FIGETBSZ:
3290         /* fall through */
3291         case FS_IOC_GETFLAGS:
3292         /* fall through */
3293         case FS_IOC_GETVERSION:
3294                 error = file_has_perm(cred, file, FILE__GETATTR);
3295                 break;
3296
3297         case FS_IOC_SETFLAGS:
3298         /* fall through */
3299         case FS_IOC_SETVERSION:
3300                 error = file_has_perm(cred, file, FILE__SETATTR);
3301                 break;
3302
3303         /* sys_ioctl() checks */
3304         case FIONBIO:
3305         /* fall through */
3306         case FIOASYNC:
3307                 error = file_has_perm(cred, file, 0);
3308                 break;
3309
3310         case KDSKBENT:
3311         case KDSKBSENT:
3312                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3313                                             SECURITY_CAP_AUDIT);
3314                 break;
3315
3316         /* default case assumes that the command will go
3317          * to the file's ioctl() function.
3318          */
3319         default:
3320                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3321         }
3322         return error;
3323 }
3324
3325 static int default_noexec;
3326
3327 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3328 {
3329         const struct cred *cred = current_cred();
3330         int rc = 0;
3331
3332         if (default_noexec &&
3333             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3334                                    (!shared && (prot & PROT_WRITE)))) {
3335                 /*
3336                  * We are making executable an anonymous mapping or a
3337                  * private file mapping that will also be writable.
3338                  * This has an additional check.
3339                  */
3340                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3341                 if (rc)
3342                         goto error;
3343         }
3344
3345         if (file) {
3346                 /* read access is always possible with a mapping */
3347                 u32 av = FILE__READ;
3348
3349                 /* write access only matters if the mapping is shared */
3350                 if (shared && (prot & PROT_WRITE))
3351                         av |= FILE__WRITE;
3352
3353                 if (prot & PROT_EXEC)
3354                         av |= FILE__EXECUTE;
3355
3356                 return file_has_perm(cred, file, av);
3357         }
3358
3359 error:
3360         return rc;
3361 }
3362
3363 static int selinux_mmap_addr(unsigned long addr)
3364 {
3365         int rc = 0;
3366
3367         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3368                 u32 sid = current_sid();
3369                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3370                                   MEMPROTECT__MMAP_ZERO, NULL);
3371         }
3372
3373         return rc;
3374 }
3375
3376 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3377                              unsigned long prot, unsigned long flags)
3378 {
3379         if (selinux_checkreqprot)
3380                 prot = reqprot;
3381
3382         return file_map_prot_check(file, prot,
3383                                    (flags & MAP_TYPE) == MAP_SHARED);
3384 }
3385
3386 static int selinux_file_mprotect(struct vm_area_struct *vma,
3387                                  unsigned long reqprot,
3388                                  unsigned long prot)
3389 {
3390         const struct cred *cred = current_cred();
3391
3392         if (selinux_checkreqprot)
3393                 prot = reqprot;
3394
3395         if (default_noexec &&
3396             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3397                 int rc = 0;
3398                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3399                     vma->vm_end <= vma->vm_mm->brk) {
3400                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3401                 } else if (!vma->vm_file &&
3402                            vma->vm_start <= vma->vm_mm->start_stack &&
3403                            vma->vm_end >= vma->vm_mm->start_stack) {
3404                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3405                 } else if (vma->vm_file && vma->anon_vma) {
3406                         /*
3407                          * We are making executable a file mapping that has
3408                          * had some COW done. Since pages might have been
3409                          * written, check ability to execute the possibly
3410                          * modified content.  This typically should only
3411                          * occur for text relocations.
3412                          */
3413                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3414                 }
3415                 if (rc)
3416                         return rc;
3417         }
3418
3419         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3420 }
3421
3422 static int selinux_file_lock(struct file *file, unsigned int cmd)
3423 {
3424         const struct cred *cred = current_cred();
3425
3426         return file_has_perm(cred, file, FILE__LOCK);
3427 }
3428
3429 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3430                               unsigned long arg)
3431 {
3432         const struct cred *cred = current_cred();
3433         int err = 0;
3434
3435         switch (cmd) {
3436         case F_SETFL:
3437                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3438                         err = file_has_perm(cred, file, FILE__WRITE);
3439                         break;
3440                 }
3441                 /* fall through */
3442         case F_SETOWN:
3443         case F_SETSIG:
3444         case F_GETFL:
3445         case F_GETOWN:
3446         case F_GETSIG:
3447         case F_GETOWNER_UIDS:
3448                 /* Just check FD__USE permission */
3449                 err = file_has_perm(cred, file, 0);
3450                 break;
3451         case F_GETLK:
3452         case F_SETLK:
3453         case F_SETLKW:
3454         case F_OFD_GETLK:
3455         case F_OFD_SETLK:
3456         case F_OFD_SETLKW:
3457 #if BITS_PER_LONG == 32
3458         case F_GETLK64:
3459         case F_SETLK64:
3460         case F_SETLKW64:
3461 #endif
3462                 err = file_has_perm(cred, file, FILE__LOCK);
3463                 break;
3464         }
3465
3466         return err;
3467 }
3468
3469 static void selinux_file_set_fowner(struct file *file)
3470 {
3471         struct file_security_struct *fsec;
3472
3473         fsec = file->f_security;
3474         fsec->fown_sid = current_sid();
3475 }
3476
3477 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3478                                        struct fown_struct *fown, int signum)
3479 {
3480         struct file *file;
3481         u32 sid = task_sid(tsk);
3482         u32 perm;
3483         struct file_security_struct *fsec;
3484
3485         /* struct fown_struct is never outside the context of a struct file */
3486         file = container_of(fown, struct file, f_owner);
3487
3488         fsec = file->f_security;
3489
3490         if (!signum)
3491                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3492         else
3493                 perm = signal_to_av(signum);
3494
3495         return avc_has_perm(fsec->fown_sid, sid,
3496                             SECCLASS_PROCESS, perm, NULL);
3497 }
3498
3499 static int selinux_file_receive(struct file *file)
3500 {
3501         const struct cred *cred = current_cred();
3502
3503         return file_has_perm(cred, file, file_to_av(file));
3504 }
3505
3506 static int selinux_file_open(struct file *file, const struct cred *cred)
3507 {
3508         struct file_security_struct *fsec;
3509         struct inode_security_struct *isec;
3510
3511         fsec = file->f_security;
3512         isec = file_inode(file)->i_security;
3513         /*
3514          * Save inode label and policy sequence number
3515          * at open-time so that selinux_file_permission
3516          * can determine whether revalidation is necessary.
3517          * Task label is already saved in the file security
3518          * struct as its SID.
3519          */
3520         fsec->isid = isec->sid;
3521         fsec->pseqno = avc_policy_seqno();
3522         /*
3523          * Since the inode label or policy seqno may have changed
3524          * between the selinux_inode_permission check and the saving
3525          * of state above, recheck that access is still permitted.
3526          * Otherwise, access might never be revalidated against the
3527          * new inode label or new policy.
3528          * This check is not redundant - do not remove.
3529          */
3530         return file_path_has_perm(cred, file, open_file_to_av(file));
3531 }
3532
3533 /* task security operations */
3534
3535 static int selinux_task_create(unsigned long clone_flags)
3536 {
3537         return current_has_perm(current, PROCESS__FORK);
3538 }
3539
3540 /*
3541  * allocate the SELinux part of blank credentials
3542  */
3543 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3544 {
3545         struct task_security_struct *tsec;
3546
3547         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3548         if (!tsec)
3549                 return -ENOMEM;
3550
3551         cred->security = tsec;
3552         return 0;
3553 }
3554
3555 /*
3556  * detach and free the LSM part of a set of credentials
3557  */
3558 static void selinux_cred_free(struct cred *cred)
3559 {
3560         struct task_security_struct *tsec = cred->security;
3561
3562         /*
3563          * cred->security == NULL if security_cred_alloc_blank() or
3564          * security_prepare_creds() returned an error.
3565          */
3566         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3567         cred->security = (void *) 0x7UL;
3568         kfree(tsec);
3569 }
3570
3571 /*
3572  * prepare a new set of credentials for modification
3573  */
3574 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3575                                 gfp_t gfp)
3576 {
3577         const struct task_security_struct *old_tsec;
3578         struct task_security_struct *tsec;
3579
3580         old_tsec = old->security;
3581
3582         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3583         if (!tsec)
3584                 return -ENOMEM;
3585
3586         new->security = tsec;
3587         return 0;
3588 }
3589
3590 /*
3591  * transfer the SELinux data to a blank set of creds
3592  */
3593 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3594 {
3595         const struct task_security_struct *old_tsec = old->security;
3596         struct task_security_struct *tsec = new->security;
3597
3598         *tsec = *old_tsec;
3599 }
3600
3601 /*
3602  * set the security data for a kernel service
3603  * - all the creation contexts are set to unlabelled
3604  */
3605 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3606 {
3607         struct task_security_struct *tsec = new->security;
3608         u32 sid = current_sid();
3609         int ret;
3610
3611         ret = avc_has_perm(sid, secid,
3612                            SECCLASS_KERNEL_SERVICE,
3613                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3614                            NULL);
3615         if (ret == 0) {
3616                 tsec->sid = secid;
3617                 tsec->create_sid = 0;
3618                 tsec->keycreate_sid = 0;
3619                 tsec->sockcreate_sid = 0;
3620         }
3621         return ret;
3622 }
3623
3624 /*
3625  * set the file creation context in a security record to the same as the
3626  * objective context of the specified inode
3627  */
3628 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3629 {
3630         struct inode_security_struct *isec = inode->i_security;
3631         struct task_security_struct *tsec = new->security;
3632         u32 sid = current_sid();
3633         int ret;
3634
3635         ret = avc_has_perm(sid, isec->sid,
3636                            SECCLASS_KERNEL_SERVICE,
3637                            KERNEL_SERVICE__CREATE_FILES_AS,
3638                            NULL);
3639
3640         if (ret == 0)
3641                 tsec->create_sid = isec->sid;
3642         return ret;
3643 }
3644
3645 static int selinux_kernel_module_request(char *kmod_name)
3646 {
3647         u32 sid;
3648         struct common_audit_data ad;
3649
3650         sid = task_sid(current);
3651
3652         ad.type = LSM_AUDIT_DATA_KMOD;
3653         ad.u.kmod_name = kmod_name;
3654
3655         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3656                             SYSTEM__MODULE_REQUEST, &ad);
3657 }
3658
3659 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3660 {
3661         return current_has_perm(p, PROCESS__SETPGID);
3662 }
3663
3664 static int selinux_task_getpgid(struct task_struct *p)
3665 {
3666         return current_has_perm(p, PROCESS__GETPGID);
3667 }
3668
3669 static int selinux_task_getsid(struct task_struct *p)
3670 {
3671         return current_has_perm(p, PROCESS__GETSESSION);
3672 }
3673
3674 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3675 {
3676         *secid = task_sid(p);
3677 }
3678
3679 static int selinux_task_setnice(struct task_struct *p, int nice)
3680 {
3681         return current_has_perm(p, PROCESS__SETSCHED);
3682 }
3683
3684 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3685 {
3686         return current_has_perm(p, PROCESS__SETSCHED);
3687 }
3688
3689 static int selinux_task_getioprio(struct task_struct *p)
3690 {
3691         return current_has_perm(p, PROCESS__GETSCHED);
3692 }
3693
3694 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3695                 struct rlimit *new_rlim)
3696 {
3697         struct rlimit *old_rlim = p->signal->rlim + resource;
3698
3699         /* Control the ability to change the hard limit (whether
3700            lowering or raising it), so that the hard limit can
3701            later be used as a safe reset point for the soft limit
3702            upon context transitions.  See selinux_bprm_committing_creds. */
3703         if (old_rlim->rlim_max != new_rlim->rlim_max)
3704                 return current_has_perm(p, PROCESS__SETRLIMIT);
3705
3706         return 0;
3707 }
3708
3709 static int selinux_task_setscheduler(struct task_struct *p)
3710 {
3711         return current_has_perm(p, PROCESS__SETSCHED);
3712 }
3713
3714 static int selinux_task_getscheduler(struct task_struct *p)
3715 {
3716         return current_has_perm(p, PROCESS__GETSCHED);
3717 }
3718
3719 static int selinux_task_movememory(struct task_struct *p)
3720 {
3721         return current_has_perm(p, PROCESS__SETSCHED);
3722 }
3723
3724 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3725                                 int sig, u32 secid)
3726 {
3727         u32 perm;
3728         int rc;
3729
3730         if (!sig)
3731                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3732         else
3733                 perm = signal_to_av(sig);
3734         if (secid)
3735                 rc = avc_has_perm(secid, task_sid(p),
3736                                   SECCLASS_PROCESS, perm, NULL);
3737         else
3738                 rc = current_has_perm(p, perm);
3739         return rc;
3740 }
3741
3742 static int selinux_task_wait(struct task_struct *p)
3743 {
3744         return task_has_perm(p, current, PROCESS__SIGCHLD);
3745 }
3746
3747 static void selinux_task_to_inode(struct task_struct *p,
3748                                   struct inode *inode)
3749 {
3750         struct inode_security_struct *isec = inode->i_security;
3751         u32 sid = task_sid(p);
3752
3753         isec->sid = sid;
3754         isec->initialized = 1;
3755 }
3756
3757 /* Returns error only if unable to parse addresses */
3758 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3759                         struct common_audit_data *ad, u8 *proto)
3760 {
3761         int offset, ihlen, ret = -EINVAL;
3762         struct iphdr _iph, *ih;
3763
3764         offset = skb_network_offset(skb);
3765         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3766         if (ih == NULL)
3767                 goto out;
3768
3769         ihlen = ih->ihl * 4;
3770         if (ihlen < sizeof(_iph))
3771                 goto out;
3772
3773         ad->u.net->v4info.saddr = ih->saddr;
3774         ad->u.net->v4info.daddr = ih->daddr;
3775         ret = 0;
3776
3777         if (proto)
3778                 *proto = ih->protocol;
3779
3780         switch (ih->protocol) {
3781         case IPPROTO_TCP: {
3782                 struct tcphdr _tcph, *th;
3783
3784                 if (ntohs(ih->frag_off) & IP_OFFSET)
3785                         break;
3786
3787                 offset += ihlen;
3788                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3789                 if (th == NULL)
3790                         break;
3791
3792                 ad->u.net->sport = th->source;
3793                 ad->u.net->dport = th->dest;
3794                 break;
3795         }
3796
3797         case IPPROTO_UDP: {
3798                 struct udphdr _udph, *uh;
3799
3800                 if (ntohs(ih->frag_off) & IP_OFFSET)
3801                         break;
3802
3803                 offset += ihlen;
3804                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3805                 if (uh == NULL)
3806                         break;
3807
3808                 ad->u.net->sport = uh->source;
3809                 ad->u.net->dport = uh->dest;
3810                 break;
3811         }
3812
3813         case IPPROTO_DCCP: {
3814                 struct dccp_hdr _dccph, *dh;
3815
3816                 if (ntohs(ih->frag_off) & IP_OFFSET)
3817                         break;
3818
3819                 offset += ihlen;
3820                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3821                 if (dh == NULL)
3822                         break;
3823
3824                 ad->u.net->sport = dh->dccph_sport;
3825                 ad->u.net->dport = dh->dccph_dport;
3826                 break;
3827         }
3828
3829         default:
3830                 break;
3831         }
3832 out:
3833         return ret;
3834 }
3835
3836 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3837
3838 /* Returns error only if unable to parse addresses */
3839 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3840                         struct common_audit_data *ad, u8 *proto)
3841 {
3842         u8 nexthdr;
3843         int ret = -EINVAL, offset;
3844         struct ipv6hdr _ipv6h, *ip6;
3845         __be16 frag_off;
3846
3847         offset = skb_network_offset(skb);
3848         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3849         if (ip6 == NULL)
3850                 goto out;
3851
3852         ad->u.net->v6info.saddr = ip6->saddr;
3853         ad->u.net->v6info.daddr = ip6->daddr;
3854         ret = 0;
3855
3856         nexthdr = ip6->nexthdr;
3857         offset += sizeof(_ipv6h);
3858         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3859         if (offset < 0)
3860                 goto out;
3861
3862         if (proto)
3863                 *proto = nexthdr;
3864
3865         switch (nexthdr) {
3866         case IPPROTO_TCP: {
3867                 struct tcphdr _tcph, *th;
3868
3869                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3870                 if (th == NULL)
3871                         break;
3872
3873                 ad->u.net->sport = th->source;
3874                 ad->u.net->dport = th->dest;
3875                 break;
3876         }
3877
3878         case IPPROTO_UDP: {
3879                 struct udphdr _udph, *uh;
3880
3881                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3882                 if (uh == NULL)
3883                         break;
3884
3885                 ad->u.net->sport = uh->source;
3886                 ad->u.net->dport = uh->dest;
3887                 break;
3888         }
3889
3890         case IPPROTO_DCCP: {
3891                 struct dccp_hdr _dccph, *dh;
3892
3893                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3894                 if (dh == NULL)
3895                         break;
3896
3897                 ad->u.net->sport = dh->dccph_sport;
3898                 ad->u.net->dport = dh->dccph_dport;
3899                 break;
3900         }
3901
3902         /* includes fragments */
3903         default:
3904                 break;
3905         }
3906 out:
3907         return ret;
3908 }
3909
3910 #endif /* IPV6 */
3911
3912 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3913                              char **_addrp, int src, u8 *proto)
3914 {
3915         char *addrp;
3916         int ret;
3917
3918         switch (ad->u.net->family) {
3919         case PF_INET:
3920                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3921                 if (ret)
3922                         goto parse_error;
3923                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3924                                        &ad->u.net->v4info.daddr);
3925                 goto okay;
3926
3927 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3928         case PF_INET6:
3929                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3930                 if (ret)
3931                         goto parse_error;
3932                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3933                                        &ad->u.net->v6info.daddr);
3934                 goto okay;
3935 #endif  /* IPV6 */
3936         default:
3937                 addrp = NULL;
3938                 goto okay;
3939         }
3940
3941 parse_error:
3942         printk(KERN_WARNING
3943                "SELinux: failure in selinux_parse_skb(),"
3944                " unable to parse packet\n");
3945         return ret;
3946
3947 okay:
3948         if (_addrp)
3949                 *_addrp = addrp;
3950         return 0;
3951 }
3952
3953 /**
3954  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3955  * @skb: the packet
3956  * @family: protocol family
3957  * @sid: the packet's peer label SID
3958  *
3959  * Description:
3960  * Check the various different forms of network peer labeling and determine
3961  * the peer label/SID for the packet; most of the magic actually occurs in
3962  * the security server function security_net_peersid_cmp().  The function
3963  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3964  * or -EACCES if @sid is invalid due to inconsistencies with the different
3965  * peer labels.
3966  *
3967  */
3968 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3969 {
3970         int err;
3971         u32 xfrm_sid;
3972         u32 nlbl_sid;
3973         u32 nlbl_type;
3974
3975         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3976         if (unlikely(err))
3977                 return -EACCES;
3978         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3979         if (unlikely(err))
3980                 return -EACCES;
3981
3982         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3983         if (unlikely(err)) {
3984                 printk(KERN_WARNING
3985                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3986                        " unable to determine packet's peer label\n");
3987                 return -EACCES;
3988         }
3989
3990         return 0;
3991 }
3992
3993 /**
3994  * selinux_conn_sid - Determine the child socket label for a connection
3995  * @sk_sid: the parent socket's SID
3996  * @skb_sid: the packet's SID
3997  * @conn_sid: the resulting connection SID
3998  *
3999  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4000  * combined with the MLS information from @skb_sid in order to create
4001  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4002  * of @sk_sid.  Returns zero on success, negative values on failure.
4003  *
4004  */
4005 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4006 {
4007         int err = 0;
4008
4009         if (skb_sid != SECSID_NULL)
4010                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4011         else
4012                 *conn_sid = sk_sid;
4013
4014         return err;
4015 }
4016
4017 /* socket security operations */
4018
4019 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4020                                  u16 secclass, u32 *socksid)
4021 {
4022         if (tsec->sockcreate_sid > SECSID_NULL) {
4023                 *socksid = tsec->sockcreate_sid;
4024                 return 0;
4025         }
4026
4027         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4028                                        socksid);
4029 }
4030
4031 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4032 {
4033         struct sk_security_struct *sksec = sk->sk_security;
4034         struct common_audit_data ad;
4035         struct lsm_network_audit net = {0,};
4036         u32 tsid = task_sid(task);
4037
4038         if (sksec->sid == SECINITSID_KERNEL)
4039                 return 0;
4040
4041         ad.type = LSM_AUDIT_DATA_NET;
4042         ad.u.net = &net;
4043         ad.u.net->sk = sk;
4044
4045         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4046 }
4047
4048 static int selinux_socket_create(int family, int type,
4049                                  int protocol, int kern)
4050 {
4051         const struct task_security_struct *tsec = current_security();
4052         u32 newsid;
4053         u16 secclass;
4054         int rc;
4055
4056         if (kern)
4057                 return 0;
4058
4059         secclass = socket_type_to_security_class(family, type, protocol);
4060         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4061         if (rc)
4062                 return rc;
4063
4064         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4065 }
4066
4067 static int selinux_socket_post_create(struct socket *sock, int family,
4068                                       int type, int protocol, int kern)
4069 {
4070         const struct task_security_struct *tsec = current_security();
4071         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4072         struct sk_security_struct *sksec;
4073         int err = 0;
4074
4075         isec->sclass = socket_type_to_security_class(family, type, protocol);
4076
4077         if (kern)
4078                 isec->sid = SECINITSID_KERNEL;
4079         else {
4080                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4081                 if (err)
4082                         return err;
4083         }
4084
4085         isec->initialized = 1;
4086
4087         if (sock->sk) {
4088                 sksec = sock->sk->sk_security;
4089                 sksec->sid = isec->sid;
4090                 sksec->sclass = isec->sclass;
4091                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4092         }
4093
4094         return err;
4095 }
4096
4097 /* Range of port numbers used to automatically bind.
4098    Need to determine whether we should perform a name_bind
4099    permission check between the socket and the port number. */
4100
4101 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4102 {
4103         struct sock *sk = sock->sk;
4104         u16 family;
4105         int err;
4106
4107         err = sock_has_perm(current, sk, SOCKET__BIND);
4108         if (err)
4109                 goto out;
4110
4111         /*
4112          * If PF_INET or PF_INET6, check name_bind permission for the port.
4113          * Multiple address binding for SCTP is not supported yet: we just
4114          * check the first address now.
4115          */
4116         family = sk->sk_family;
4117         if (family == PF_INET || family == PF_INET6) {
4118                 char *addrp;
4119                 struct sk_security_struct *sksec = sk->sk_security;
4120                 struct common_audit_data ad;
4121                 struct lsm_network_audit net = {0,};
4122                 struct sockaddr_in *addr4 = NULL;
4123                 struct sockaddr_in6 *addr6 = NULL;
4124                 unsigned short snum;
4125                 u32 sid, node_perm;
4126
4127                 if (family == PF_INET) {
4128                         addr4 = (struct sockaddr_in *)address;
4129                         snum = ntohs(addr4->sin_port);
4130                         addrp = (char *)&addr4->sin_addr.s_addr;
4131                 } else {
4132                         addr6 = (struct sockaddr_in6 *)address;
4133                         snum = ntohs(addr6->sin6_port);
4134                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4135                 }
4136
4137                 if (snum) {
4138                         int low, high;
4139
4140                         inet_get_local_port_range(sock_net(sk), &low, &high);
4141
4142                         if (snum < max(PROT_SOCK, low) || snum > high) {
4143                                 err = sel_netport_sid(sk->sk_protocol,
4144                                                       snum, &sid);
4145                                 if (err)
4146                                         goto out;
4147                                 ad.type = LSM_AUDIT_DATA_NET;
4148                                 ad.u.net = &net;
4149                                 ad.u.net->sport = htons(snum);
4150                                 ad.u.net->family = family;
4151                                 err = avc_has_perm(sksec->sid, sid,
4152                                                    sksec->sclass,
4153                                                    SOCKET__NAME_BIND, &ad);
4154                                 if (err)
4155                                         goto out;
4156                         }
4157                 }
4158
4159                 switch (sksec->sclass) {
4160                 case SECCLASS_TCP_SOCKET:
4161                         node_perm = TCP_SOCKET__NODE_BIND;
4162                         break;
4163
4164                 case SECCLASS_UDP_SOCKET:
4165                         node_perm = UDP_SOCKET__NODE_BIND;
4166                         break;
4167
4168                 case SECCLASS_DCCP_SOCKET:
4169                         node_perm = DCCP_SOCKET__NODE_BIND;
4170                         break;
4171
4172                 default:
4173                         node_perm = RAWIP_SOCKET__NODE_BIND;
4174                         break;
4175                 }
4176
4177                 err = sel_netnode_sid(addrp, family, &sid);
4178                 if (err)
4179                         goto out;
4180
4181                 ad.type = LSM_AUDIT_DATA_NET;
4182                 ad.u.net = &net;
4183                 ad.u.net->sport = htons(snum);
4184                 ad.u.net->family = family;
4185
4186                 if (family == PF_INET)
4187                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4188                 else
4189                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4190
4191                 err = avc_has_perm(sksec->sid, sid,
4192                                    sksec->sclass, node_perm, &ad);
4193                 if (err)
4194                         goto out;
4195         }
4196 out:
4197         return err;
4198 }
4199
4200 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4201 {
4202         struct sock *sk = sock->sk;
4203         struct sk_security_struct *sksec = sk->sk_security;
4204         int err;
4205
4206         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4207         if (err)
4208                 return err;
4209
4210         /*
4211          * If a TCP or DCCP socket, check name_connect permission for the port.
4212          */
4213         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4214             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4215                 struct common_audit_data ad;
4216                 struct lsm_network_audit net = {0,};
4217                 struct sockaddr_in *addr4 = NULL;
4218                 struct sockaddr_in6 *addr6 = NULL;
4219                 unsigned short snum;
4220                 u32 sid, perm;
4221
4222                 if (sk->sk_family == PF_INET) {
4223                         addr4 = (struct sockaddr_in *)address;
4224                         if (addrlen < sizeof(struct sockaddr_in))
4225                                 return -EINVAL;
4226                         snum = ntohs(addr4->sin_port);
4227                 } else {
4228                         addr6 = (struct sockaddr_in6 *)address;
4229                         if (addrlen < SIN6_LEN_RFC2133)
4230                                 return -EINVAL;
4231                         snum = ntohs(addr6->sin6_port);
4232                 }
4233
4234                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4235                 if (err)
4236                         goto out;
4237
4238                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4239                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4240
4241                 ad.type = LSM_AUDIT_DATA_NET;
4242                 ad.u.net = &net;
4243                 ad.u.net->dport = htons(snum);
4244                 ad.u.net->family = sk->sk_family;
4245                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4246                 if (err)
4247                         goto out;
4248         }
4249
4250         err = selinux_netlbl_socket_connect(sk, address);
4251
4252 out:
4253         return err;
4254 }
4255
4256 static int selinux_socket_listen(struct socket *sock, int backlog)
4257 {
4258         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4259 }
4260
4261 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4262 {
4263         int err;
4264         struct inode_security_struct *isec;
4265         struct inode_security_struct *newisec;
4266
4267         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4268         if (err)
4269                 return err;
4270
4271         newisec = SOCK_INODE(newsock)->i_security;
4272
4273         isec = SOCK_INODE(sock)->i_security;
4274         newisec->sclass = isec->sclass;
4275         newisec->sid = isec->sid;
4276         newisec->initialized = 1;
4277
4278         return 0;
4279 }
4280
4281 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4282                                   int size)
4283 {
4284         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4285 }
4286
4287 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4288                                   int size, int flags)
4289 {
4290         return sock_has_perm(current, sock->sk, SOCKET__READ);
4291 }
4292
4293 static int selinux_socket_getsockname(struct socket *sock)
4294 {
4295         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4296 }
4297
4298 static int selinux_socket_getpeername(struct socket *sock)
4299 {
4300         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4301 }
4302
4303 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4304 {
4305         int err;
4306
4307         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4308         if (err)
4309                 return err;
4310
4311         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4312 }
4313
4314 static int selinux_socket_getsockopt(struct socket *sock, int level,
4315                                      int optname)
4316 {
4317         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4318 }
4319
4320 static int selinux_socket_shutdown(struct socket *sock, int how)
4321 {
4322         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4323 }
4324
4325 static int selinux_socket_unix_stream_connect(struct sock *sock,
4326                                               struct sock *other,
4327                                               struct sock *newsk)
4328 {
4329         struct sk_security_struct *sksec_sock = sock->sk_security;
4330         struct sk_security_struct *sksec_other = other->sk_security;
4331         struct sk_security_struct *sksec_new = newsk->sk_security;
4332         struct common_audit_data ad;
4333         struct lsm_network_audit net = {0,};
4334         int err;
4335
4336         ad.type = LSM_AUDIT_DATA_NET;
4337         ad.u.net = &net;
4338         ad.u.net->sk = other;
4339
4340         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4341                            sksec_other->sclass,
4342                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4343         if (err)
4344                 return err;
4345
4346         /* server child socket */
4347         sksec_new->peer_sid = sksec_sock->sid;
4348         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4349                                     &sksec_new->sid);
4350         if (err)
4351                 return err;
4352
4353         /* connecting socket */
4354         sksec_sock->peer_sid = sksec_new->sid;
4355
4356         return 0;
4357 }
4358
4359 static int selinux_socket_unix_may_send(struct socket *sock,
4360                                         struct socket *other)
4361 {
4362         struct sk_security_struct *ssec = sock->sk->sk_security;
4363         struct sk_security_struct *osec = other->sk->sk_security;
4364         struct common_audit_data ad;
4365         struct lsm_network_audit net = {0,};
4366
4367         ad.type = LSM_AUDIT_DATA_NET;
4368         ad.u.net = &net;
4369         ad.u.net->sk = other->sk;
4370
4371         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4372                             &ad);
4373 }
4374
4375 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4376                                     char *addrp, u16 family, u32 peer_sid,
4377                                     struct common_audit_data *ad)
4378 {
4379         int err;
4380         u32 if_sid;
4381         u32 node_sid;
4382
4383         err = sel_netif_sid(ns, ifindex, &if_sid);
4384         if (err)
4385                 return err;
4386         err = avc_has_perm(peer_sid, if_sid,
4387                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4388         if (err)
4389                 return err;
4390
4391         err = sel_netnode_sid(addrp, family, &node_sid);
4392         if (err)
4393                 return err;
4394         return avc_has_perm(peer_sid, node_sid,
4395                             SECCLASS_NODE, NODE__RECVFROM, ad);
4396 }
4397
4398 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4399                                        u16 family)
4400 {
4401         int err = 0;
4402         struct sk_security_struct *sksec = sk->sk_security;
4403         u32 sk_sid = sksec->sid;
4404         struct common_audit_data ad;
4405         struct lsm_network_audit net = {0,};
4406         char *addrp;
4407
4408         ad.type = LSM_AUDIT_DATA_NET;
4409         ad.u.net = &net;
4410         ad.u.net->netif = skb->skb_iif;
4411         ad.u.net->family = family;
4412         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4413         if (err)
4414                 return err;
4415
4416         if (selinux_secmark_enabled()) {
4417                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4418                                    PACKET__RECV, &ad);
4419                 if (err)
4420                         return err;
4421         }
4422
4423         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4424         if (err)
4425                 return err;
4426         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4427
4428         return err;
4429 }
4430
4431 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4432 {
4433         int err;
4434         struct sk_security_struct *sksec = sk->sk_security;
4435         u16 family = sk->sk_family;
4436         u32 sk_sid = sksec->sid;
4437         struct common_audit_data ad;
4438         struct lsm_network_audit net = {0,};
4439         char *addrp;
4440         u8 secmark_active;
4441         u8 peerlbl_active;
4442
4443         if (family != PF_INET && family != PF_INET6)
4444                 return 0;
4445
4446         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4447         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4448                 family = PF_INET;
4449
4450         /* If any sort of compatibility mode is enabled then handoff processing
4451          * to the selinux_sock_rcv_skb_compat() function to deal with the
4452          * special handling.  We do this in an attempt to keep this function
4453          * as fast and as clean as possible. */
4454         if (!selinux_policycap_netpeer)
4455                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4456
4457         secmark_active = selinux_secmark_enabled();
4458         peerlbl_active = selinux_peerlbl_enabled();
4459         if (!secmark_active && !peerlbl_active)
4460                 return 0;
4461
4462         ad.type = LSM_AUDIT_DATA_NET;
4463         ad.u.net = &net;
4464         ad.u.net->netif = skb->skb_iif;
4465         ad.u.net->family = family;
4466         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4467         if (err)
4468                 return err;
4469
4470         if (peerlbl_active) {
4471                 u32 peer_sid;
4472
4473                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4474                 if (err)
4475                         return err;
4476                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4477                                                addrp, family, peer_sid, &ad);
4478                 if (err) {
4479                         selinux_netlbl_err(skb, err, 0);
4480                         return err;
4481                 }
4482                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4483                                    PEER__RECV, &ad);
4484                 if (err) {
4485                         selinux_netlbl_err(skb, err, 0);
4486                         return err;
4487                 }
4488         }
4489
4490         if (secmark_active) {
4491                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4492                                    PACKET__RECV, &ad);
4493                 if (err)
4494                         return err;
4495         }
4496
4497         return err;
4498 }
4499
4500 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4501                                             int __user *optlen, unsigned len)
4502 {
4503         int err = 0;
4504         char *scontext;
4505         u32 scontext_len;
4506         struct sk_security_struct *sksec = sock->sk->sk_security;
4507         u32 peer_sid = SECSID_NULL;
4508
4509         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4510             sksec->sclass == SECCLASS_TCP_SOCKET)
4511                 peer_sid = sksec->peer_sid;
4512         if (peer_sid == SECSID_NULL)
4513                 return -ENOPROTOOPT;
4514
4515         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4516         if (err)
4517                 return err;
4518
4519         if (scontext_len > len) {
4520                 err = -ERANGE;
4521                 goto out_len;
4522         }
4523
4524         if (copy_to_user(optval, scontext, scontext_len))
4525                 err = -EFAULT;
4526
4527 out_len:
4528         if (put_user(scontext_len, optlen))
4529                 err = -EFAULT;
4530         kfree(scontext);
4531         return err;
4532 }
4533
4534 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4535 {
4536         u32 peer_secid = SECSID_NULL;
4537         u16 family;
4538
4539         if (skb && skb->protocol == htons(ETH_P_IP))
4540                 family = PF_INET;
4541         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4542                 family = PF_INET6;
4543         else if (sock)
4544                 family = sock->sk->sk_family;
4545         else
4546                 goto out;
4547
4548         if (sock && family == PF_UNIX)
4549                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4550         else if (skb)
4551                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4552
4553 out:
4554         *secid = peer_secid;
4555         if (peer_secid == SECSID_NULL)
4556                 return -EINVAL;
4557         return 0;
4558 }
4559
4560 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4561 {
4562         struct sk_security_struct *sksec;
4563
4564         sksec = kzalloc(sizeof(*sksec), priority);
4565         if (!sksec)
4566                 return -ENOMEM;
4567
4568         sksec->peer_sid = SECINITSID_UNLABELED;
4569         sksec->sid = SECINITSID_UNLABELED;
4570         sksec->sclass = SECCLASS_SOCKET;
4571         selinux_netlbl_sk_security_reset(sksec);
4572         sk->sk_security = sksec;
4573
4574         return 0;
4575 }
4576
4577 static void selinux_sk_free_security(struct sock *sk)
4578 {
4579         struct sk_security_struct *sksec = sk->sk_security;
4580
4581         sk->sk_security = NULL;
4582         selinux_netlbl_sk_security_free(sksec);
4583         kfree(sksec);
4584 }
4585
4586 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4587 {
4588         struct sk_security_struct *sksec = sk->sk_security;
4589         struct sk_security_struct *newsksec = newsk->sk_security;
4590
4591         newsksec->sid = sksec->sid;
4592         newsksec->peer_sid = sksec->peer_sid;
4593         newsksec->sclass = sksec->sclass;
4594
4595         selinux_netlbl_sk_security_reset(newsksec);
4596 }
4597
4598 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4599 {
4600         if (!sk)
4601                 *secid = SECINITSID_ANY_SOCKET;
4602         else {
4603                 struct sk_security_struct *sksec = sk->sk_security;
4604
4605                 *secid = sksec->sid;
4606         }
4607 }
4608
4609 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4610 {
4611         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4612         struct sk_security_struct *sksec = sk->sk_security;
4613
4614         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4615             sk->sk_family == PF_UNIX)
4616                 isec->sid = sksec->sid;
4617         sksec->sclass = isec->sclass;
4618 }
4619
4620 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4621                                      struct request_sock *req)
4622 {
4623         struct sk_security_struct *sksec = sk->sk_security;
4624         int err;
4625         u16 family = req->rsk_ops->family;
4626         u32 connsid;
4627         u32 peersid;
4628
4629         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4630         if (err)
4631                 return err;
4632         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4633         if (err)
4634                 return err;
4635         req->secid = connsid;
4636         req->peer_secid = peersid;
4637
4638         return selinux_netlbl_inet_conn_request(req, family);
4639 }
4640
4641 static void selinux_inet_csk_clone(struct sock *newsk,
4642                                    const struct request_sock *req)
4643 {
4644         struct sk_security_struct *newsksec = newsk->sk_security;
4645
4646         newsksec->sid = req->secid;
4647         newsksec->peer_sid = req->peer_secid;
4648         /* NOTE: Ideally, we should also get the isec->sid for the
4649            new socket in sync, but we don't have the isec available yet.
4650            So we will wait until sock_graft to do it, by which
4651            time it will have been created and available. */
4652
4653         /* We don't need to take any sort of lock here as we are the only
4654          * thread with access to newsksec */
4655         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4656 }
4657
4658 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4659 {
4660         u16 family = sk->sk_family;
4661         struct sk_security_struct *sksec = sk->sk_security;
4662
4663         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4664         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4665                 family = PF_INET;
4666
4667         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4668 }
4669
4670 static int selinux_secmark_relabel_packet(u32 sid)
4671 {
4672         const struct task_security_struct *__tsec;
4673         u32 tsid;
4674
4675         __tsec = current_security();
4676         tsid = __tsec->sid;
4677
4678         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4679 }
4680
4681 static void selinux_secmark_refcount_inc(void)
4682 {
4683         atomic_inc(&selinux_secmark_refcount);
4684 }
4685
4686 static void selinux_secmark_refcount_dec(void)
4687 {
4688         atomic_dec(&selinux_secmark_refcount);
4689 }
4690
4691 static void selinux_req_classify_flow(const struct request_sock *req,
4692                                       struct flowi *fl)
4693 {
4694         fl->flowi_secid = req->secid;
4695 }
4696
4697 static int selinux_tun_dev_alloc_security(void **security)
4698 {
4699         struct tun_security_struct *tunsec;
4700
4701         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4702         if (!tunsec)
4703                 return -ENOMEM;
4704         tunsec->sid = current_sid();
4705
4706         *security = tunsec;
4707         return 0;
4708 }
4709
4710 static void selinux_tun_dev_free_security(void *security)
4711 {
4712         kfree(security);
4713 }
4714
4715 static int selinux_tun_dev_create(void)
4716 {
4717         u32 sid = current_sid();
4718
4719         /* we aren't taking into account the "sockcreate" SID since the socket
4720          * that is being created here is not a socket in the traditional sense,
4721          * instead it is a private sock, accessible only to the kernel, and
4722          * representing a wide range of network traffic spanning multiple
4723          * connections unlike traditional sockets - check the TUN driver to
4724          * get a better understanding of why this socket is special */
4725
4726         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4727                             NULL);
4728 }
4729
4730 static int selinux_tun_dev_attach_queue(void *security)
4731 {
4732         struct tun_security_struct *tunsec = security;
4733
4734         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4735                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4736 }
4737
4738 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4739 {
4740         struct tun_security_struct *tunsec = security;
4741         struct sk_security_struct *sksec = sk->sk_security;
4742
4743         /* we don't currently perform any NetLabel based labeling here and it
4744          * isn't clear that we would want to do so anyway; while we could apply
4745          * labeling without the support of the TUN user the resulting labeled
4746          * traffic from the other end of the connection would almost certainly
4747          * cause confusion to the TUN user that had no idea network labeling
4748          * protocols were being used */
4749
4750         sksec->sid = tunsec->sid;
4751         sksec->sclass = SECCLASS_TUN_SOCKET;
4752
4753         return 0;
4754 }
4755
4756 static int selinux_tun_dev_open(void *security)
4757 {
4758         struct tun_security_struct *tunsec = security;
4759         u32 sid = current_sid();
4760         int err;
4761
4762         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4763                            TUN_SOCKET__RELABELFROM, NULL);
4764         if (err)
4765                 return err;
4766         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4767                            TUN_SOCKET__RELABELTO, NULL);
4768         if (err)
4769                 return err;
4770         tunsec->sid = sid;
4771
4772         return 0;
4773 }
4774
4775 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4776 {
4777         int err = 0;
4778         u32 perm;
4779         struct nlmsghdr *nlh;
4780         struct sk_security_struct *sksec = sk->sk_security;
4781
4782         if (skb->len < NLMSG_HDRLEN) {
4783                 err = -EINVAL;
4784                 goto out;
4785         }
4786         nlh = nlmsg_hdr(skb);
4787
4788         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4789         if (err) {
4790                 if (err == -EINVAL) {
4791                         printk(KERN_WARNING
4792                                "SELinux: unrecognized netlink message:"
4793                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4794                                sk->sk_protocol, nlh->nlmsg_type,
4795                                secclass_map[sksec->sclass - 1].name);
4796                         if (!selinux_enforcing || security_get_allow_unknown())
4797                                 err = 0;
4798                 }
4799
4800                 /* Ignore */
4801                 if (err == -ENOENT)
4802                         err = 0;
4803                 goto out;
4804         }
4805
4806         err = sock_has_perm(current, sk, perm);
4807 out:
4808         return err;
4809 }
4810
4811 #ifdef CONFIG_NETFILTER
4812
4813 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4814                                        const struct net_device *indev,
4815                                        u16 family)
4816 {
4817         int err;
4818         char *addrp;
4819         u32 peer_sid;
4820         struct common_audit_data ad;
4821         struct lsm_network_audit net = {0,};
4822         u8 secmark_active;
4823         u8 netlbl_active;
4824         u8 peerlbl_active;
4825
4826         if (!selinux_policycap_netpeer)
4827                 return NF_ACCEPT;
4828
4829         secmark_active = selinux_secmark_enabled();
4830         netlbl_active = netlbl_enabled();
4831         peerlbl_active = selinux_peerlbl_enabled();
4832         if (!secmark_active && !peerlbl_active)
4833                 return NF_ACCEPT;
4834
4835         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4836                 return NF_DROP;
4837
4838         ad.type = LSM_AUDIT_DATA_NET;
4839         ad.u.net = &net;
4840         ad.u.net->netif = indev->ifindex;
4841         ad.u.net->family = family;
4842         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4843                 return NF_DROP;
4844
4845         if (peerlbl_active) {
4846                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4847                                                addrp, family, peer_sid, &ad);
4848                 if (err) {
4849                         selinux_netlbl_err(skb, err, 1);
4850                         return NF_DROP;
4851                 }
4852         }
4853
4854         if (secmark_active)
4855                 if (avc_has_perm(peer_sid, skb->secmark,
4856                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4857                         return NF_DROP;
4858
4859         if (netlbl_active)
4860                 /* we do this in the FORWARD path and not the POST_ROUTING
4861                  * path because we want to make sure we apply the necessary
4862                  * labeling before IPsec is applied so we can leverage AH
4863                  * protection */
4864                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4865                         return NF_DROP;
4866
4867         return NF_ACCEPT;
4868 }
4869
4870 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4871                                          struct sk_buff *skb,
4872                                          const struct nf_hook_state *state)
4873 {
4874         return selinux_ip_forward(skb, state->in, PF_INET);
4875 }
4876
4877 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4878 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4879                                          struct sk_buff *skb,
4880                                          const struct nf_hook_state *state)
4881 {
4882         return selinux_ip_forward(skb, state->in, PF_INET6);
4883 }
4884 #endif  /* IPV6 */
4885
4886 static unsigned int selinux_ip_output(struct sk_buff *skb,
4887                                       u16 family)
4888 {
4889         struct sock *sk;
4890         u32 sid;
4891
4892         if (!netlbl_enabled())
4893                 return NF_ACCEPT;
4894
4895         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4896          * because we want to make sure we apply the necessary labeling
4897          * before IPsec is applied so we can leverage AH protection */
4898         sk = skb->sk;
4899         if (sk) {
4900                 struct sk_security_struct *sksec;
4901
4902                 if (sk->sk_state == TCP_LISTEN)
4903                         /* if the socket is the listening state then this
4904                          * packet is a SYN-ACK packet which means it needs to
4905                          * be labeled based on the connection/request_sock and
4906                          * not the parent socket.  unfortunately, we can't
4907                          * lookup the request_sock yet as it isn't queued on
4908                          * the parent socket until after the SYN-ACK is sent.
4909                          * the "solution" is to simply pass the packet as-is
4910                          * as any IP option based labeling should be copied
4911                          * from the initial connection request (in the IP
4912                          * layer).  it is far from ideal, but until we get a
4913                          * security label in the packet itself this is the
4914                          * best we can do. */
4915                         return NF_ACCEPT;
4916
4917                 /* standard practice, label using the parent socket */
4918                 sksec = sk->sk_security;
4919                 sid = sksec->sid;
4920         } else
4921                 sid = SECINITSID_KERNEL;
4922         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4923                 return NF_DROP;
4924
4925         return NF_ACCEPT;
4926 }
4927
4928 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4929                                         struct sk_buff *skb,
4930                                         const struct nf_hook_state *state)
4931 {
4932         return selinux_ip_output(skb, PF_INET);
4933 }
4934
4935 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4936                                                 int ifindex,
4937                                                 u16 family)
4938 {
4939         struct sock *sk = skb->sk;
4940         struct sk_security_struct *sksec;
4941         struct common_audit_data ad;
4942         struct lsm_network_audit net = {0,};
4943         char *addrp;
4944         u8 proto;
4945
4946         if (sk == NULL)
4947                 return NF_ACCEPT;
4948         sksec = sk->sk_security;
4949
4950         ad.type = LSM_AUDIT_DATA_NET;
4951         ad.u.net = &net;
4952         ad.u.net->netif = ifindex;
4953         ad.u.net->family = family;
4954         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4955                 return NF_DROP;
4956
4957         if (selinux_secmark_enabled())
4958                 if (avc_has_perm(sksec->sid, skb->secmark,
4959                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4960                         return NF_DROP_ERR(-ECONNREFUSED);
4961
4962         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4963                 return NF_DROP_ERR(-ECONNREFUSED);
4964
4965         return NF_ACCEPT;
4966 }
4967
4968 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4969                                          const struct net_device *outdev,
4970                                          u16 family)
4971 {
4972         u32 secmark_perm;
4973         u32 peer_sid;
4974         int ifindex = outdev->ifindex;
4975         struct sock *sk;
4976         struct common_audit_data ad;
4977         struct lsm_network_audit net = {0,};
4978         char *addrp;
4979         u8 secmark_active;
4980         u8 peerlbl_active;
4981
4982         /* If any sort of compatibility mode is enabled then handoff processing
4983          * to the selinux_ip_postroute_compat() function to deal with the
4984          * special handling.  We do this in an attempt to keep this function
4985          * as fast and as clean as possible. */
4986         if (!selinux_policycap_netpeer)
4987                 return selinux_ip_postroute_compat(skb, ifindex, family);
4988
4989         secmark_active = selinux_secmark_enabled();
4990         peerlbl_active = selinux_peerlbl_enabled();
4991         if (!secmark_active && !peerlbl_active)
4992                 return NF_ACCEPT;
4993
4994         sk = skb->sk;
4995
4996 #ifdef CONFIG_XFRM
4997         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4998          * packet transformation so allow the packet to pass without any checks
4999          * since we'll have another chance to perform access control checks
5000          * when the packet is on it's final way out.
5001          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5002          *       is NULL, in this case go ahead and apply access control.
5003          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5004          *       TCP listening state we cannot wait until the XFRM processing
5005          *       is done as we will miss out on the SA label if we do;
5006          *       unfortunately, this means more work, but it is only once per
5007          *       connection. */
5008         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5009             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5010                 return NF_ACCEPT;
5011 #endif
5012
5013         if (sk == NULL) {
5014                 /* Without an associated socket the packet is either coming
5015                  * from the kernel or it is being forwarded; check the packet
5016                  * to determine which and if the packet is being forwarded
5017                  * query the packet directly to determine the security label. */
5018                 if (skb->skb_iif) {
5019                         secmark_perm = PACKET__FORWARD_OUT;
5020                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5021                                 return NF_DROP;
5022                 } else {
5023                         secmark_perm = PACKET__SEND;
5024                         peer_sid = SECINITSID_KERNEL;
5025                 }
5026         } else if (sk->sk_state == TCP_LISTEN) {
5027                 /* Locally generated packet but the associated socket is in the
5028                  * listening state which means this is a SYN-ACK packet.  In
5029                  * this particular case the correct security label is assigned
5030                  * to the connection/request_sock but unfortunately we can't
5031                  * query the request_sock as it isn't queued on the parent
5032                  * socket until after the SYN-ACK packet is sent; the only
5033                  * viable choice is to regenerate the label like we do in
5034                  * selinux_inet_conn_request().  See also selinux_ip_output()
5035                  * for similar problems. */
5036                 u32 skb_sid;
5037                 struct sk_security_struct *sksec = sk->sk_security;
5038                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5039                         return NF_DROP;
5040                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5041                  * and the packet has been through at least one XFRM
5042                  * transformation then we must be dealing with the "final"
5043                  * form of labeled IPsec packet; since we've already applied
5044                  * all of our access controls on this packet we can safely
5045                  * pass the packet. */
5046                 if (skb_sid == SECSID_NULL) {
5047                         switch (family) {
5048                         case PF_INET:
5049                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5050                                         return NF_ACCEPT;
5051                                 break;
5052                         case PF_INET6:
5053                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5054                                         return NF_ACCEPT;
5055                                 break;
5056                         default:
5057                                 return NF_DROP_ERR(-ECONNREFUSED);
5058                         }
5059                 }
5060                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5061                         return NF_DROP;
5062                 secmark_perm = PACKET__SEND;
5063         } else {
5064                 /* Locally generated packet, fetch the security label from the
5065                  * associated socket. */
5066                 struct sk_security_struct *sksec = sk->sk_security;
5067                 peer_sid = sksec->sid;
5068                 secmark_perm = PACKET__SEND;
5069         }
5070
5071         ad.type = LSM_AUDIT_DATA_NET;
5072         ad.u.net = &net;
5073         ad.u.net->netif = ifindex;
5074         ad.u.net->family = family;
5075         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5076                 return NF_DROP;
5077
5078         if (secmark_active)
5079                 if (avc_has_perm(peer_sid, skb->secmark,
5080                                  SECCLASS_PACKET, secmark_perm, &ad))
5081                         return NF_DROP_ERR(-ECONNREFUSED);
5082
5083         if (peerlbl_active) {
5084                 u32 if_sid;
5085                 u32 node_sid;
5086
5087                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5088                         return NF_DROP;
5089                 if (avc_has_perm(peer_sid, if_sid,
5090                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5091                         return NF_DROP_ERR(-ECONNREFUSED);
5092
5093                 if (sel_netnode_sid(addrp, family, &node_sid))
5094                         return NF_DROP;
5095                 if (avc_has_perm(peer_sid, node_sid,
5096                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5097                         return NF_DROP_ERR(-ECONNREFUSED);
5098         }
5099
5100         return NF_ACCEPT;
5101 }
5102
5103 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5104                                            struct sk_buff *skb,
5105                                            const struct nf_hook_state *state)
5106 {
5107         return selinux_ip_postroute(skb, state->out, PF_INET);
5108 }
5109
5110 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5111 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5112                                            struct sk_buff *skb,
5113                                            const struct nf_hook_state *state)
5114 {
5115         return selinux_ip_postroute(skb, state->out, PF_INET6);
5116 }
5117 #endif  /* IPV6 */
5118
5119 #endif  /* CONFIG_NETFILTER */
5120
5121 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5122 {
5123         return selinux_nlmsg_perm(sk, skb);
5124 }
5125
5126 static int ipc_alloc_security(struct task_struct *task,
5127                               struct kern_ipc_perm *perm,
5128                               u16 sclass)
5129 {
5130         struct ipc_security_struct *isec;
5131         u32 sid;
5132
5133         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5134         if (!isec)
5135                 return -ENOMEM;
5136
5137         sid = task_sid(task);
5138         isec->sclass = sclass;
5139         isec->sid = sid;
5140         perm->security = isec;
5141
5142         return 0;
5143 }
5144
5145 static void ipc_free_security(struct kern_ipc_perm *perm)
5146 {
5147         struct ipc_security_struct *isec = perm->security;
5148         perm->security = NULL;
5149         kfree(isec);
5150 }
5151
5152 static int msg_msg_alloc_security(struct msg_msg *msg)
5153 {
5154         struct msg_security_struct *msec;
5155
5156         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5157         if (!msec)
5158                 return -ENOMEM;
5159
5160         msec->sid = SECINITSID_UNLABELED;
5161         msg->security = msec;
5162
5163         return 0;
5164 }
5165
5166 static void msg_msg_free_security(struct msg_msg *msg)
5167 {
5168         struct msg_security_struct *msec = msg->security;
5169
5170         msg->security = NULL;
5171         kfree(msec);
5172 }
5173
5174 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5175                         u32 perms)
5176 {
5177         struct ipc_security_struct *isec;
5178         struct common_audit_data ad;
5179         u32 sid = current_sid();
5180
5181         isec = ipc_perms->security;
5182
5183         ad.type = LSM_AUDIT_DATA_IPC;
5184         ad.u.ipc_id = ipc_perms->key;
5185
5186         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5187 }
5188
5189 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5190 {
5191         return msg_msg_alloc_security(msg);
5192 }
5193
5194 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5195 {
5196         msg_msg_free_security(msg);
5197 }
5198
5199 /* message queue security operations */
5200 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5201 {
5202         struct ipc_security_struct *isec;
5203         struct common_audit_data ad;
5204         u32 sid = current_sid();
5205         int rc;
5206
5207         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5208         if (rc)
5209                 return rc;
5210
5211         isec = msq->q_perm.security;
5212
5213         ad.type = LSM_AUDIT_DATA_IPC;
5214         ad.u.ipc_id = msq->q_perm.key;
5215
5216         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5217                           MSGQ__CREATE, &ad);
5218         if (rc) {
5219                 ipc_free_security(&msq->q_perm);
5220                 return rc;
5221         }
5222         return 0;
5223 }
5224
5225 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5226 {
5227         ipc_free_security(&msq->q_perm);
5228 }
5229
5230 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5231 {
5232         struct ipc_security_struct *isec;
5233         struct common_audit_data ad;
5234         u32 sid = current_sid();
5235
5236         isec = msq->q_perm.security;
5237
5238         ad.type = LSM_AUDIT_DATA_IPC;
5239         ad.u.ipc_id = msq->q_perm.key;
5240
5241         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5242                             MSGQ__ASSOCIATE, &ad);
5243 }
5244
5245 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5246 {
5247         int err;
5248         int perms;
5249
5250         switch (cmd) {
5251         case IPC_INFO:
5252         case MSG_INFO:
5253                 /* No specific object, just general system-wide information. */
5254                 return task_has_system(current, SYSTEM__IPC_INFO);
5255         case IPC_STAT:
5256         case MSG_STAT:
5257                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5258                 break;
5259         case IPC_SET:
5260                 perms = MSGQ__SETATTR;
5261                 break;
5262         case IPC_RMID:
5263                 perms = MSGQ__DESTROY;
5264                 break;
5265         default:
5266                 return 0;
5267         }
5268
5269         err = ipc_has_perm(&msq->q_perm, perms);
5270         return err;
5271 }
5272
5273 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5274 {
5275         struct ipc_security_struct *isec;
5276         struct msg_security_struct *msec;
5277         struct common_audit_data ad;
5278         u32 sid = current_sid();
5279         int rc;
5280
5281         isec = msq->q_perm.security;
5282         msec = msg->security;
5283
5284         /*
5285          * First time through, need to assign label to the message
5286          */
5287         if (msec->sid == SECINITSID_UNLABELED) {
5288                 /*
5289                  * Compute new sid based on current process and
5290                  * message queue this message will be stored in
5291                  */
5292                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5293                                              NULL, &msec->sid);
5294                 if (rc)
5295                         return rc;
5296         }
5297
5298         ad.type = LSM_AUDIT_DATA_IPC;
5299         ad.u.ipc_id = msq->q_perm.key;
5300
5301         /* Can this process write to the queue? */
5302         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5303                           MSGQ__WRITE, &ad);
5304         if (!rc)
5305                 /* Can this process send the message */
5306                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5307                                   MSG__SEND, &ad);
5308         if (!rc)
5309                 /* Can the message be put in the queue? */
5310                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5311                                   MSGQ__ENQUEUE, &ad);
5312
5313         return rc;
5314 }
5315
5316 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5317                                     struct task_struct *target,
5318                                     long type, int mode)
5319 {
5320         struct ipc_security_struct *isec;
5321         struct msg_security_struct *msec;
5322         struct common_audit_data ad;
5323         u32 sid = task_sid(target);
5324         int rc;
5325
5326         isec = msq->q_perm.security;
5327         msec = msg->security;
5328
5329         ad.type = LSM_AUDIT_DATA_IPC;
5330         ad.u.ipc_id = msq->q_perm.key;
5331
5332         rc = avc_has_perm(sid, isec->sid,
5333                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5334         if (!rc)
5335                 rc = avc_has_perm(sid, msec->sid,
5336                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5337         return rc;
5338 }
5339
5340 /* Shared Memory security operations */
5341 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5342 {
5343         struct ipc_security_struct *isec;
5344         struct common_audit_data ad;
5345         u32 sid = current_sid();
5346         int rc;
5347
5348         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5349         if (rc)
5350                 return rc;
5351
5352         isec = shp->shm_perm.security;
5353
5354         ad.type = LSM_AUDIT_DATA_IPC;
5355         ad.u.ipc_id = shp->shm_perm.key;
5356
5357         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5358                           SHM__CREATE, &ad);
5359         if (rc) {
5360                 ipc_free_security(&shp->shm_perm);
5361                 return rc;
5362         }
5363         return 0;
5364 }
5365
5366 static void selinux_shm_free_security(struct shmid_kernel *shp)
5367 {
5368         ipc_free_security(&shp->shm_perm);
5369 }
5370
5371 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5372 {
5373         struct ipc_security_struct *isec;
5374         struct common_audit_data ad;
5375         u32 sid = current_sid();
5376
5377         isec = shp->shm_perm.security;
5378
5379         ad.type = LSM_AUDIT_DATA_IPC;
5380         ad.u.ipc_id = shp->shm_perm.key;
5381
5382         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5383                             SHM__ASSOCIATE, &ad);
5384 }
5385
5386 /* Note, at this point, shp is locked down */
5387 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5388 {
5389         int perms;
5390         int err;
5391
5392         switch (cmd) {
5393         case IPC_INFO:
5394         case SHM_INFO:
5395                 /* No specific object, just general system-wide information. */
5396                 return task_has_system(current, SYSTEM__IPC_INFO);
5397         case IPC_STAT:
5398         case SHM_STAT:
5399                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5400                 break;
5401         case IPC_SET:
5402                 perms = SHM__SETATTR;
5403                 break;
5404         case SHM_LOCK:
5405         case SHM_UNLOCK:
5406                 perms = SHM__LOCK;
5407                 break;
5408         case IPC_RMID:
5409                 perms = SHM__DESTROY;
5410                 break;
5411         default:
5412                 return 0;
5413         }
5414
5415         err = ipc_has_perm(&shp->shm_perm, perms);
5416         return err;
5417 }
5418
5419 static int selinux_shm_shmat(struct shmid_kernel *shp,
5420                              char __user *shmaddr, int shmflg)
5421 {
5422         u32 perms;
5423
5424         if (shmflg & SHM_RDONLY)
5425                 perms = SHM__READ;
5426         else
5427                 perms = SHM__READ | SHM__WRITE;
5428
5429         return ipc_has_perm(&shp->shm_perm, perms);
5430 }
5431
5432 /* Semaphore security operations */
5433 static int selinux_sem_alloc_security(struct sem_array *sma)
5434 {
5435         struct ipc_security_struct *isec;
5436         struct common_audit_data ad;
5437         u32 sid = current_sid();
5438         int rc;
5439
5440         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5441         if (rc)
5442                 return rc;
5443
5444         isec = sma->sem_perm.security;
5445
5446         ad.type = LSM_AUDIT_DATA_IPC;
5447         ad.u.ipc_id = sma->sem_perm.key;
5448
5449         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5450                           SEM__CREATE, &ad);
5451         if (rc) {
5452                 ipc_free_security(&sma->sem_perm);
5453                 return rc;
5454         }
5455         return 0;
5456 }
5457
5458 static void selinux_sem_free_security(struct sem_array *sma)
5459 {
5460         ipc_free_security(&sma->sem_perm);
5461 }
5462
5463 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5464 {
5465         struct ipc_security_struct *isec;
5466         struct common_audit_data ad;
5467         u32 sid = current_sid();
5468
5469         isec = sma->sem_perm.security;
5470
5471         ad.type = LSM_AUDIT_DATA_IPC;
5472         ad.u.ipc_id = sma->sem_perm.key;
5473
5474         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5475                             SEM__ASSOCIATE, &ad);
5476 }
5477
5478 /* Note, at this point, sma is locked down */
5479 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5480 {
5481         int err;
5482         u32 perms;
5483
5484         switch (cmd) {
5485         case IPC_INFO:
5486         case SEM_INFO:
5487                 /* No specific object, just general system-wide information. */
5488                 return task_has_system(current, SYSTEM__IPC_INFO);
5489         case GETPID:
5490         case GETNCNT:
5491         case GETZCNT:
5492                 perms = SEM__GETATTR;
5493                 break;
5494         case GETVAL:
5495         case GETALL:
5496                 perms = SEM__READ;
5497                 break;
5498         case SETVAL:
5499         case SETALL:
5500                 perms = SEM__WRITE;
5501                 break;
5502         case IPC_RMID:
5503                 perms = SEM__DESTROY;
5504                 break;
5505         case IPC_SET:
5506                 perms = SEM__SETATTR;
5507                 break;
5508         case IPC_STAT:
5509         case SEM_STAT:
5510                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5511                 break;
5512         default:
5513                 return 0;
5514         }
5515
5516         err = ipc_has_perm(&sma->sem_perm, perms);
5517         return err;
5518 }
5519
5520 static int selinux_sem_semop(struct sem_array *sma,
5521                              struct sembuf *sops, unsigned nsops, int alter)
5522 {
5523         u32 perms;
5524
5525         if (alter)
5526                 perms = SEM__READ | SEM__WRITE;
5527         else
5528                 perms = SEM__READ;
5529
5530         return ipc_has_perm(&sma->sem_perm, perms);
5531 }
5532
5533 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5534 {
5535         u32 av = 0;
5536
5537         av = 0;
5538         if (flag & S_IRUGO)
5539                 av |= IPC__UNIX_READ;
5540         if (flag & S_IWUGO)
5541                 av |= IPC__UNIX_WRITE;
5542
5543         if (av == 0)
5544                 return 0;
5545
5546         return ipc_has_perm(ipcp, av);
5547 }
5548
5549 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5550 {
5551         struct ipc_security_struct *isec = ipcp->security;
5552         *secid = isec->sid;
5553 }
5554
5555 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5556 {
5557         if (inode)
5558                 inode_doinit_with_dentry(inode, dentry);
5559 }
5560
5561 static int selinux_getprocattr(struct task_struct *p,
5562                                char *name, char **value)
5563 {
5564         const struct task_security_struct *__tsec;
5565         u32 sid;
5566         int error;
5567         unsigned len;
5568
5569         if (current != p) {
5570                 error = current_has_perm(p, PROCESS__GETATTR);
5571                 if (error)
5572                         return error;
5573         }
5574
5575         rcu_read_lock();
5576         __tsec = __task_cred(p)->security;
5577
5578         if (!strcmp(name, "current"))
5579                 sid = __tsec->sid;
5580         else if (!strcmp(name, "prev"))
5581                 sid = __tsec->osid;
5582         else if (!strcmp(name, "exec"))
5583                 sid = __tsec->exec_sid;
5584         else if (!strcmp(name, "fscreate"))
5585                 sid = __tsec->create_sid;
5586         else if (!strcmp(name, "keycreate"))
5587                 sid = __tsec->keycreate_sid;
5588         else if (!strcmp(name, "sockcreate"))
5589                 sid = __tsec->sockcreate_sid;
5590         else
5591                 goto invalid;
5592         rcu_read_unlock();
5593
5594         if (!sid)
5595                 return 0;
5596
5597         error = security_sid_to_context(sid, value, &len);
5598         if (error)
5599                 return error;
5600         return len;
5601
5602 invalid:
5603         rcu_read_unlock();
5604         return -EINVAL;
5605 }
5606
5607 static int selinux_setprocattr(struct task_struct *p,
5608                                char *name, void *value, size_t size)
5609 {
5610         struct task_security_struct *tsec;
5611         struct task_struct *tracer;
5612         struct cred *new;
5613         u32 sid = 0, ptsid;
5614         int error;
5615         char *str = value;
5616
5617         if (current != p) {
5618                 /* SELinux only allows a process to change its own
5619                    security attributes. */
5620                 return -EACCES;
5621         }
5622
5623         /*
5624          * Basic control over ability to set these attributes at all.
5625          * current == p, but we'll pass them separately in case the
5626          * above restriction is ever removed.
5627          */
5628         if (!strcmp(name, "exec"))
5629                 error = current_has_perm(p, PROCESS__SETEXEC);
5630         else if (!strcmp(name, "fscreate"))
5631                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5632         else if (!strcmp(name, "keycreate"))
5633                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5634         else if (!strcmp(name, "sockcreate"))
5635                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5636         else if (!strcmp(name, "current"))
5637                 error = current_has_perm(p, PROCESS__SETCURRENT);
5638         else
5639                 error = -EINVAL;
5640         if (error)
5641                 return error;
5642
5643         /* Obtain a SID for the context, if one was specified. */
5644         if (size && str[1] && str[1] != '\n') {
5645                 if (str[size-1] == '\n') {
5646                         str[size-1] = 0;
5647                         size--;
5648                 }
5649                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5650                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5651                         if (!capable(CAP_MAC_ADMIN)) {
5652                                 struct audit_buffer *ab;
5653                                 size_t audit_size;
5654
5655                                 /* We strip a nul only if it is at the end, otherwise the
5656                                  * context contains a nul and we should audit that */
5657                                 if (str[size - 1] == '\0')
5658                                         audit_size = size - 1;
5659                                 else
5660                                         audit_size = size;
5661                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5662                                 audit_log_format(ab, "op=fscreate invalid_context=");
5663                                 audit_log_n_untrustedstring(ab, value, audit_size);
5664                                 audit_log_end(ab);
5665
5666                                 return error;
5667                         }
5668                         error = security_context_to_sid_force(value, size,
5669                                                               &sid);
5670                 }
5671                 if (error)
5672                         return error;
5673         }
5674
5675         new = prepare_creds();
5676         if (!new)
5677                 return -ENOMEM;
5678
5679         /* Permission checking based on the specified context is
5680            performed during the actual operation (execve,
5681            open/mkdir/...), when we know the full context of the
5682            operation.  See selinux_bprm_set_creds for the execve
5683            checks and may_create for the file creation checks. The
5684            operation will then fail if the context is not permitted. */
5685         tsec = new->security;
5686         if (!strcmp(name, "exec")) {
5687                 tsec->exec_sid = sid;
5688         } else if (!strcmp(name, "fscreate")) {
5689                 tsec->create_sid = sid;
5690         } else if (!strcmp(name, "keycreate")) {
5691                 error = may_create_key(sid, p);
5692                 if (error)
5693                         goto abort_change;
5694                 tsec->keycreate_sid = sid;
5695         } else if (!strcmp(name, "sockcreate")) {
5696                 tsec->sockcreate_sid = sid;
5697         } else if (!strcmp(name, "current")) {
5698                 error = -EINVAL;
5699                 if (sid == 0)
5700                         goto abort_change;
5701
5702                 /* Only allow single threaded processes to change context */
5703                 error = -EPERM;
5704                 if (!current_is_single_threaded()) {
5705                         error = security_bounded_transition(tsec->sid, sid);
5706                         if (error)
5707                                 goto abort_change;
5708                 }
5709
5710                 /* Check permissions for the transition. */
5711                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5712                                      PROCESS__DYNTRANSITION, NULL);
5713                 if (error)
5714                         goto abort_change;
5715
5716                 /* Check for ptracing, and update the task SID if ok.
5717                    Otherwise, leave SID unchanged and fail. */
5718                 ptsid = 0;
5719                 rcu_read_lock();
5720                 tracer = ptrace_parent(p);
5721                 if (tracer)
5722                         ptsid = task_sid(tracer);
5723                 rcu_read_unlock();
5724
5725                 if (tracer) {
5726                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5727                                              PROCESS__PTRACE, NULL);
5728                         if (error)
5729                                 goto abort_change;
5730                 }
5731
5732                 tsec->sid = sid;
5733         } else {
5734                 error = -EINVAL;
5735                 goto abort_change;
5736         }
5737
5738         commit_creds(new);
5739         return size;
5740
5741 abort_change:
5742         abort_creds(new);
5743         return error;
5744 }
5745
5746 static int selinux_ismaclabel(const char *name)
5747 {
5748         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5749 }
5750
5751 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5752 {
5753         return security_sid_to_context(secid, secdata, seclen);
5754 }
5755
5756 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5757 {
5758         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5759 }
5760
5761 static void selinux_release_secctx(char *secdata, u32 seclen)
5762 {
5763         kfree(secdata);
5764 }
5765
5766 /*
5767  *      called with inode->i_mutex locked
5768  */
5769 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5770 {
5771         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5772 }
5773
5774 /*
5775  *      called with inode->i_mutex locked
5776  */
5777 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5778 {
5779         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5780 }
5781
5782 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5783 {
5784         int len = 0;
5785         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5786                                                 ctx, true);
5787         if (len < 0)
5788                 return len;
5789         *ctxlen = len;
5790         return 0;
5791 }
5792 #ifdef CONFIG_KEYS
5793
5794 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5795                              unsigned long flags)
5796 {
5797         const struct task_security_struct *tsec;
5798         struct key_security_struct *ksec;
5799
5800         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5801         if (!ksec)
5802                 return -ENOMEM;
5803
5804         tsec = cred->security;
5805         if (tsec->keycreate_sid)
5806                 ksec->sid = tsec->keycreate_sid;
5807         else
5808                 ksec->sid = tsec->sid;
5809
5810         k->security = ksec;
5811         return 0;
5812 }
5813
5814 static void selinux_key_free(struct key *k)
5815 {
5816         struct key_security_struct *ksec = k->security;
5817
5818         k->security = NULL;
5819         kfree(ksec);
5820 }
5821
5822 static int selinux_key_permission(key_ref_t key_ref,
5823                                   const struct cred *cred,
5824                                   unsigned perm)
5825 {
5826         struct key *key;
5827         struct key_security_struct *ksec;
5828         u32 sid;
5829
5830         /* if no specific permissions are requested, we skip the
5831            permission check. No serious, additional covert channels
5832            appear to be created. */
5833         if (perm == 0)
5834                 return 0;
5835
5836         sid = cred_sid(cred);
5837
5838         key = key_ref_to_ptr(key_ref);
5839         ksec = key->security;
5840
5841         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5842 }
5843
5844 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5845 {
5846         struct key_security_struct *ksec = key->security;
5847         char *context = NULL;
5848         unsigned len;
5849         int rc;
5850
5851         rc = security_sid_to_context(ksec->sid, &context, &len);
5852         if (!rc)
5853                 rc = len;
5854         *_buffer = context;
5855         return rc;
5856 }
5857
5858 #endif
5859
5860 static struct security_hook_list selinux_hooks[] = {
5861         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5862         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5863         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5864         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5865
5866         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5867         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5868         LSM_HOOK_INIT(capget, selinux_capget),
5869         LSM_HOOK_INIT(capset, selinux_capset),
5870         LSM_HOOK_INIT(capable, selinux_capable),
5871         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5872         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5873         LSM_HOOK_INIT(syslog, selinux_syslog),
5874         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5875
5876         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5877
5878         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5879         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5880         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5881         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5882
5883         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5884         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5885         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5886         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5887         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5888         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5889         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5890         LSM_HOOK_INIT(sb_mount, selinux_mount),
5891         LSM_HOOK_INIT(sb_umount, selinux_umount),
5892         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5893         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5894         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5895
5896         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5897
5898         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5899         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5900         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5901         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5902         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5903         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5904         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5905         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5906         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5907         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5908         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5909         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5910         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5911         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5912         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5913         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5914         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5915         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5916         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5917         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5918         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5919         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5920         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5921         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5922         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5923
5924         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5925         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5926         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5927         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5928         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5929         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5930         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5931         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5932         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5933         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5934         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5935         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5936
5937         LSM_HOOK_INIT(file_open, selinux_file_open),
5938
5939         LSM_HOOK_INIT(task_create, selinux_task_create),
5940         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5941         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5942         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5943         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5944         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5945         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5946         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5947         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5948         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5949         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5950         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5951         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5952         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5953         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5954         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5955         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5956         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5957         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5958         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5959         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5960         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5961
5962         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5963         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5964
5965         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5966         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5967
5968         LSM_HOOK_INIT(msg_queue_alloc_security,
5969                         selinux_msg_queue_alloc_security),
5970         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5971         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5972         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5973         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5974         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5975
5976         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5977         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5978         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5979         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5980         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5981
5982         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5983         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5984         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5985         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5986         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5987
5988         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5989
5990         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5991         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5992
5993         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5994         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5995         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5996         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5997         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5998         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5999         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6000
6001         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6002         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6003
6004         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6005         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6006         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6007         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6008         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6009         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6010         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6011         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6012         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6013         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6014         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6015         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6016         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6017         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6018         LSM_HOOK_INIT(socket_getpeersec_stream,
6019                         selinux_socket_getpeersec_stream),
6020         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6021         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6022         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6023         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6024         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6025         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6026         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6027         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6028         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6029         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6030         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6031         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6032         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6033         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6034         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6035         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6036         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6037         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6038         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6039
6040 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6041         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6042         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6043         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6044         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6045         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6046         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6047                         selinux_xfrm_state_alloc_acquire),
6048         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6049         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6050         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6051         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6052                         selinux_xfrm_state_pol_flow_match),
6053         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6054 #endif
6055
6056 #ifdef CONFIG_KEYS
6057         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6058         LSM_HOOK_INIT(key_free, selinux_key_free),
6059         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6060         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6061 #endif
6062
6063 #ifdef CONFIG_AUDIT
6064         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6065         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6066         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6067         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6068 #endif
6069 };
6070
6071 static __init int selinux_init(void)
6072 {
6073         if (!security_module_enable("selinux")) {
6074                 selinux_enabled = 0;
6075                 return 0;
6076         }
6077
6078         if (!selinux_enabled) {
6079                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6080                 return 0;
6081         }
6082
6083         printk(KERN_INFO "SELinux:  Initializing.\n");
6084
6085         /* Set the security state for the initial task. */
6086         cred_init_security();
6087
6088         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6089
6090         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6091                                             sizeof(struct inode_security_struct),
6092                                             0, SLAB_PANIC, NULL);
6093         avc_init();
6094
6095         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6096
6097         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6098                 panic("SELinux: Unable to register AVC netcache callback\n");
6099
6100         if (selinux_enforcing)
6101                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6102         else
6103                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6104
6105         return 0;
6106 }
6107
6108 static void delayed_superblock_init(struct super_block *sb, void *unused)
6109 {
6110         superblock_doinit(sb, NULL);
6111 }
6112
6113 void selinux_complete_init(void)
6114 {
6115         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6116
6117         /* Set up any superblocks initialized prior to the policy load. */
6118         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6119         iterate_supers(delayed_superblock_init, NULL);
6120 }
6121
6122 /* SELinux requires early initialization in order to label
6123    all processes and objects when they are created. */
6124 security_initcall(selinux_init);
6125
6126 #if defined(CONFIG_NETFILTER)
6127
6128 static struct nf_hook_ops selinux_nf_ops[] = {
6129         {
6130                 .hook =         selinux_ipv4_postroute,
6131                 .owner =        THIS_MODULE,
6132                 .pf =           NFPROTO_IPV4,
6133                 .hooknum =      NF_INET_POST_ROUTING,
6134                 .priority =     NF_IP_PRI_SELINUX_LAST,
6135         },
6136         {
6137                 .hook =         selinux_ipv4_forward,
6138                 .owner =        THIS_MODULE,
6139                 .pf =           NFPROTO_IPV4,
6140                 .hooknum =      NF_INET_FORWARD,
6141                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6142         },
6143         {
6144                 .hook =         selinux_ipv4_output,
6145                 .owner =        THIS_MODULE,
6146                 .pf =           NFPROTO_IPV4,
6147                 .hooknum =      NF_INET_LOCAL_OUT,
6148                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6149         },
6150 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6151         {
6152                 .hook =         selinux_ipv6_postroute,
6153                 .owner =        THIS_MODULE,
6154                 .pf =           NFPROTO_IPV6,
6155                 .hooknum =      NF_INET_POST_ROUTING,
6156                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6157         },
6158         {
6159                 .hook =         selinux_ipv6_forward,
6160                 .owner =        THIS_MODULE,
6161                 .pf =           NFPROTO_IPV6,
6162                 .hooknum =      NF_INET_FORWARD,
6163                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6164         },
6165 #endif  /* IPV6 */
6166 };
6167
6168 static int __init selinux_nf_ip_init(void)
6169 {
6170         int err;
6171
6172         if (!selinux_enabled)
6173                 return 0;
6174
6175         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6176
6177         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6178         if (err)
6179                 panic("SELinux: nf_register_hooks: error %d\n", err);
6180
6181         return 0;
6182 }
6183
6184 __initcall(selinux_nf_ip_init);
6185
6186 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6187 static void selinux_nf_ip_exit(void)
6188 {
6189         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6190
6191         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6192 }
6193 #endif
6194
6195 #else /* CONFIG_NETFILTER */
6196
6197 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6198 #define selinux_nf_ip_exit()
6199 #endif
6200
6201 #endif /* CONFIG_NETFILTER */
6202
6203 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6204 static int selinux_disabled;
6205
6206 int selinux_disable(void)
6207 {
6208         if (ss_initialized) {
6209                 /* Not permitted after initial policy load. */
6210                 return -EINVAL;
6211         }
6212
6213         if (selinux_disabled) {
6214                 /* Only do this once. */
6215                 return -EINVAL;
6216         }
6217
6218         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6219
6220         selinux_disabled = 1;
6221         selinux_enabled = 0;
6222
6223         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6224
6225         /* Try to destroy the avc node cache */
6226         avc_disable();
6227
6228         /* Unregister netfilter hooks. */
6229         selinux_nf_ip_exit();
6230
6231         /* Unregister selinuxfs. */
6232         exit_sel_fs();
6233
6234         return 0;
6235 }
6236 #endif