security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 /* Special handling. Genfs but also in-core setxattr handler */
 407                 !strcmp(sb->s_type->name, "sysfs") ||
 408                 !strcmp(sb->s_type->name, "pstore") ||
 409                 !strcmp(sb->s_type->name, "debugfs") ||
 410                 !strcmp(sb->s_type->name, "rootfs");
 411 }
 412
 413 static int sb_finish_set_opts(struct super_block *sb)
 414 {
 415         struct superblock_security_struct *sbsec = sb->s_security;
 416         struct dentry *root = sb->s_root;
 417         struct inode *root_inode = root->d_inode;
 418         int rc = 0;
 419
 420         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 421                 /* Make sure that the xattr handler exists and that no
 422                    error other than -ENODATA is returned by getxattr on
 423                    the root directory.  -ENODATA is ok, as this may be
 424                    the first boot of the SELinux kernel before we have
 425                    assigned xattr values to the filesystem. */
 426                 if (!root_inode->i_op->getxattr) {
 427                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 428                                "xattr support\n", sb->s_id, sb->s_type->name);
 429                         rc = -EOPNOTSUPP;
 430                         goto out;
 431                 }
 432                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 433                 if (rc < 0 && rc != -ENODATA) {
 434                         if (rc == -EOPNOTSUPP)
 435                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 436                                        "%s) has no security xattr handler\n",
 437                                        sb->s_id, sb->s_type->name);
 438                         else
 439                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 440                                        "%s) getxattr errno %d\n", sb->s_id,
 441                                        sb->s_type->name, -rc);
 442                         goto out;
 443                 }
 444         }
 445
 446         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 447                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 448                        sb->s_id, sb->s_type->name);
 449
 450         sbsec->flags |= SE_SBINITIALIZED;
 451         if (selinux_is_sblabel_mnt(sb))
 452                 sbsec->flags |= SBLABEL_MNT;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 list_del_init(&isec->list);
 469                 spin_unlock(&sbsec->isec_lock);
 470                 inode = igrab(inode);
 471                 if (inode) {
 472                         if (!IS_PRIVATE(inode))
 473                                 inode_doinit(inode);
 474                         iput(inode);
 475                 }
 476                 spin_lock(&sbsec->isec_lock);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         /* make sure we always check enough bits to cover the mask */
 507         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 508
 509         tmp = sbsec->flags & SE_MNTMASK;
 510         /* count the number of mount options for this sb */
 511         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 512                 if (tmp & 0x01)
 513                         opts->num_mnt_opts++;
 514                 tmp >>= 1;
 515         }
 516         /* Check if the Label support flag is set */
 517         if (sbsec->flags & SBLABEL_MNT)
 518                 opts->num_mnt_opts++;
 519
 520         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 521         if (!opts->mnt_opts) {
 522                 rc = -ENOMEM;
 523                 goto out_free;
 524         }
 525
 526         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 527         if (!opts->mnt_opts_flags) {
 528                 rc = -ENOMEM;
 529                 goto out_free;
 530         }
 531
 532         i = 0;
 533         if (sbsec->flags & FSCONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 539         }
 540         if (sbsec->flags & CONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 546         }
 547         if (sbsec->flags & DEFCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & ROOTCONTEXT_MNT) {
 555                 struct inode *root = sbsec->sb->s_root->d_inode;
 556                 struct inode_security_struct *isec = root->i_security;
 557
 558                 rc = security_sid_to_context(isec->sid, &context, &len);
 559                 if (rc)
 560                         goto out_free;
 561                 opts->mnt_opts[i] = context;
 562                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 563         }
 564         if (sbsec->flags & SBLABEL_MNT) {
 565                 opts->mnt_opts[i] = NULL;
 566                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 567         }
 568
 569         BUG_ON(i != opts->num_mnt_opts);
 570
 571         return 0;
 572
 573 out_free:
 574         security_free_mnt_opts(opts);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 struct security_mnt_opts *opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         int rc = 0, i;
 609         struct superblock_security_struct *sbsec = sb->s_security;
 610         const char *name = sb->s_type->name;
 611         struct inode *inode = sbsec->sb->s_root->d_inode;
 612         struct inode_security_struct *root_isec = inode->i_security;
 613         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 614         u32 defcontext_sid = 0;
 615         char **mount_options = opts->mnt_opts;
 616         int *flags = opts->mnt_opts_flags;
 617         int num_opts = opts->num_mnt_opts;
 618
 619         mutex_lock(&sbsec->lock);
 620
 621         if (!ss_initialized) {
 622                 if (!num_opts) {
 623                         /* Defer initialization until selinux_complete_init,
 624                            after the initial policy is loaded and the security
 625                            server is ready to handle calls. */
 626                         goto out;
 627                 }
 628                 rc = -EINVAL;
 629                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 630                         "before the security server is initialized\n");
 631                 goto out;
 632         }
 633         if (kern_flags && !set_kern_flags) {
 634                 /* Specifying internal flags without providing a place to
 635                  * place the results is not allowed */
 636                 rc = -EINVAL;
 637                 goto out;
 638         }
 639
 640         /*
 641          * Binary mount data FS will come through this function twice.  Once
 642          * from an explicit call and once from the generic calls from the vfs.
 643          * Since the generic VFS calls will not contain any security mount data
 644          * we need to skip the double mount verification.
 645          *
 646          * This does open a hole in which we will not notice if the first
 647          * mount using this sb set explict options and a second mount using
 648          * this sb does not set any security options.  (The first options
 649          * will be used for both mounts)
 650          */
 651         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 652             && (num_opts == 0))
 653                 goto out;
 654
 655         /*
 656          * parse the mount options, check if they are valid sids.
 657          * also check if someone is trying to mount the same sb more
 658          * than once with different security options.
 659          */
 660         for (i = 0; i < num_opts; i++) {
 661                 u32 sid;
 662
 663                 if (flags[i] == SBLABEL_MNT)
 664                         continue;
 665                 rc = security_context_to_sid(mount_options[i],
 666                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 667                 if (rc) {
 668                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 669                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 670                                mount_options[i], sb->s_id, name, rc);
 671                         goto out;
 672                 }
 673                 switch (flags[i]) {
 674                 case FSCONTEXT_MNT:
 675                         fscontext_sid = sid;
 676
 677                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 678                                         fscontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= FSCONTEXT_MNT;
 682                         break;
 683                 case CONTEXT_MNT:
 684                         context_sid = sid;
 685
 686                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 687                                         context_sid))
 688                                 goto out_double_mount;
 689
 690                         sbsec->flags |= CONTEXT_MNT;
 691                         break;
 692                 case ROOTCONTEXT_MNT:
 693                         rootcontext_sid = sid;
 694
 695                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 696                                         rootcontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= ROOTCONTEXT_MNT;
 700
 701                         break;
 702                 case DEFCONTEXT_MNT:
 703                         defcontext_sid = sid;
 704
 705                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 706                                         defcontext_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= DEFCONTEXT_MNT;
 710
 711                         break;
 712                 default:
 713                         rc = -EINVAL;
 714                         goto out;
 715                 }
 716         }
 717
 718         if (sbsec->flags & SE_SBINITIALIZED) {
 719                 /* previously mounted with options, but not on this attempt? */
 720                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 721                         goto out_double_mount;
 722                 rc = 0;
 723                 goto out;
 724         }
 725
 726         if (strcmp(sb->s_type->name, "proc") == 0)
 727                 sbsec->flags |= SE_SBPROC;
 728
 729         if (!sbsec->behavior) {
 730                 /*
 731                  * Determine the labeling behavior to use for this
 732                  * filesystem type.
 733                  */
 734                 rc = security_fs_use(sb);
 735                 if (rc) {
 736                         printk(KERN_WARNING
 737                                 "%s: security_fs_use(%s) returned %d\n",
 738                                         __func__, sb->s_type->name, rc);
 739                         goto out;
 740                 }
 741         }
 742         /* sets the context of the superblock for the fs being mounted. */
 743         if (fscontext_sid) {
 744                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 745                 if (rc)
 746                         goto out;
 747
 748                 sbsec->sid = fscontext_sid;
 749         }
 750
 751         /*
 752          * Switch to using mount point labeling behavior.
 753          * sets the label used on all file below the mountpoint, and will set
 754          * the superblock context if not already set.
 755          */
 756         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 757                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 758                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 759         }
 760
 761         if (context_sid) {
 762                 if (!fscontext_sid) {
 763                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 764                                                           cred);
 765                         if (rc)
 766                                 goto out;
 767                         sbsec->sid = context_sid;
 768                 } else {
 769                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 770                                                              cred);
 771                         if (rc)
 772                                 goto out;
 773                 }
 774                 if (!rootcontext_sid)
 775                         rootcontext_sid = context_sid;
 776
 777                 sbsec->mntpoint_sid = context_sid;
 778                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 779         }
 780
 781         if (rootcontext_sid) {
 782                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 783                                                      cred);
 784                 if (rc)
 785                         goto out;
 786
 787                 root_isec->sid = rootcontext_sid;
 788                 root_isec->initialized = 1;
 789         }
 790
 791         if (defcontext_sid) {
 792                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 793                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 794                         rc = -EINVAL;
 795                         printk(KERN_WARNING "SELinux: defcontext option is "
 796                                "invalid for this filesystem type\n");
 797                         goto out;
 798                 }
 799
 800                 if (defcontext_sid != sbsec->def_sid) {
 801                         rc = may_context_mount_inode_relabel(defcontext_sid,
 802                                                              sbsec, cred);
 803                         if (rc)
 804                                 goto out;
 805                 }
 806
 807                 sbsec->def_sid = defcontext_sid;
 808         }
 809
 810         rc = sb_finish_set_opts(sb);
 811 out:
 812         mutex_unlock(&sbsec->lock);
 813         return rc;
 814 out_double_mount:
 815         rc = -EINVAL;
 816         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 817                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 818         goto out;
 819 }
 820
 821 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 822                                     const struct super_block *newsb)
 823 {
 824         struct superblock_security_struct *old = oldsb->s_security;
 825         struct superblock_security_struct *new = newsb->s_security;
 826         char oldflags = old->flags & SE_MNTMASK;
 827         char newflags = new->flags & SE_MNTMASK;
 828
 829         if (oldflags != newflags)
 830                 goto mismatch;
 831         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 832                 goto mismatch;
 833         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 834                 goto mismatch;
 835         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 836                 goto mismatch;
 837         if (oldflags & ROOTCONTEXT_MNT) {
 838                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 839                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 840                 if (oldroot->sid != newroot->sid)
 841                         goto mismatch;
 842         }
 843         return 0;
 844 mismatch:
 845         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 846                             "different security settings for (dev %s, "
 847                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 848         return -EBUSY;
 849 }
 850
 851 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 852                                         struct super_block *newsb)
 853 {
 854         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 855         struct superblock_security_struct *newsbsec = newsb->s_security;
 856
 857         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 858         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 859         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 860
 861         /*
 862          * if the parent was able to be mounted it clearly had no special lsm
 863          * mount options.  thus we can safely deal with this superblock later
 864          */
 865         if (!ss_initialized)
 866                 return 0;
 867
 868         /* how can we clone if the old one wasn't set up?? */
 869         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 870
 871         /* if fs is reusing a sb, make sure that the contexts match */
 872         if (newsbsec->flags & SE_SBINITIALIZED)
 873                 return selinux_cmp_sb_context(oldsb, newsb);
 874
 875         mutex_lock(&newsbsec->lock);
 876
 877         newsbsec->flags = oldsbsec->flags;
 878
 879         newsbsec->sid = oldsbsec->sid;
 880         newsbsec->def_sid = oldsbsec->def_sid;
 881         newsbsec->behavior = oldsbsec->behavior;
 882
 883         if (set_context) {
 884                 u32 sid = oldsbsec->mntpoint_sid;
 885
 886                 if (!set_fscontext)
 887                         newsbsec->sid = sid;
 888                 if (!set_rootcontext) {
 889                         struct inode *newinode = newsb->s_root->d_inode;
 890                         struct inode_security_struct *newisec = newinode->i_security;
 891                         newisec->sid = sid;
 892                 }
 893                 newsbsec->mntpoint_sid = sid;
 894         }
 895         if (set_rootcontext) {
 896                 const struct inode *oldinode = oldsb->s_root->d_inode;
 897                 const struct inode_security_struct *oldisec = oldinode->i_security;
 898                 struct inode *newinode = newsb->s_root->d_inode;
 899                 struct inode_security_struct *newisec = newinode->i_security;
 900
 901                 newisec->sid = oldisec->sid;
 902         }
 903
 904         sb_finish_set_opts(newsb);
 905         mutex_unlock(&newsbsec->lock);
 906         return 0;
 907 }
 908
 909 static int selinux_parse_opts_str(char *options,
 910                                   struct security_mnt_opts *opts)
 911 {
 912         char *p;
 913         char *context = NULL, *defcontext = NULL;
 914         char *fscontext = NULL, *rootcontext = NULL;
 915         int rc, num_mnt_opts = 0;
 916
 917         opts->num_mnt_opts = 0;
 918
 919         /* Standard string-based options. */
 920         while ((p = strsep(&options, "|")) != NULL) {
 921                 int token;
 922                 substring_t args[MAX_OPT_ARGS];
 923
 924                 if (!*p)
 925                         continue;
 926
 927                 token = match_token(p, tokens, args);
 928
 929                 switch (token) {
 930                 case Opt_context:
 931                         if (context || defcontext) {
 932                                 rc = -EINVAL;
 933                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 934                                 goto out_err;
 935                         }
 936                         context = match_strdup(&args[0]);
 937                         if (!context) {
 938                                 rc = -ENOMEM;
 939                                 goto out_err;
 940                         }
 941                         break;
 942
 943                 case Opt_fscontext:
 944                         if (fscontext) {
 945                                 rc = -EINVAL;
 946                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 947                                 goto out_err;
 948                         }
 949                         fscontext = match_strdup(&args[0]);
 950                         if (!fscontext) {
 951                                 rc = -ENOMEM;
 952                                 goto out_err;
 953                         }
 954                         break;
 955
 956                 case Opt_rootcontext:
 957                         if (rootcontext) {
 958                                 rc = -EINVAL;
 959                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 960                                 goto out_err;
 961                         }
 962                         rootcontext = match_strdup(&args[0]);
 963                         if (!rootcontext) {
 964                                 rc = -ENOMEM;
 965                                 goto out_err;
 966                         }
 967                         break;
 968
 969                 case Opt_defcontext:
 970                         if (context || defcontext) {
 971                                 rc = -EINVAL;
 972                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 973                                 goto out_err;
 974                         }
 975                         defcontext = match_strdup(&args[0]);
 976                         if (!defcontext) {
 977                                 rc = -ENOMEM;
 978                                 goto out_err;
 979                         }
 980                         break;
 981                 case Opt_labelsupport:
 982                         break;
 983                 default:
 984                         rc = -EINVAL;
 985                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 986                         goto out_err;
 987
 988                 }
 989         }
 990
 991         rc = -ENOMEM;
 992         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 993         if (!opts->mnt_opts)
 994                 goto out_err;
 995
 996         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 997         if (!opts->mnt_opts_flags) {
 998                 kfree(opts->mnt_opts);
 999                 goto out_err;
1000         }
1001
1002         if (fscontext) {
1003                 opts->mnt_opts[num_mnt_opts] = fscontext;
1004                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1005         }
1006         if (context) {
1007                 opts->mnt_opts[num_mnt_opts] = context;
1008                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1009         }
1010         if (rootcontext) {
1011                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1012                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1013         }
1014         if (defcontext) {
1015                 opts->mnt_opts[num_mnt_opts] = defcontext;
1016                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1017         }
1018
1019         opts->num_mnt_opts = num_mnt_opts;
1020         return 0;
1021
1022 out_err:
1023         kfree(context);
1024         kfree(defcontext);
1025         kfree(fscontext);
1026         kfree(rootcontext);
1027         return rc;
1028 }
1029 /*
1030  * string mount options parsing and call set the sbsec
1031  */
1032 static int superblock_doinit(struct super_block *sb, void *data)
1033 {
1034         int rc = 0;
1035         char *options = data;
1036         struct security_mnt_opts opts;
1037
1038         security_init_mnt_opts(&opts);
1039
1040         if (!data)
1041                 goto out;
1042
1043         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1044
1045         rc = selinux_parse_opts_str(options, &opts);
1046         if (rc)
1047                 goto out_err;
1048
1049 out:
1050         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1051
1052 out_err:
1053         security_free_mnt_opts(&opts);
1054         return rc;
1055 }
1056
1057 static void selinux_write_opts(struct seq_file *m,
1058                                struct security_mnt_opts *opts)
1059 {
1060         int i;
1061         char *prefix;
1062
1063         for (i = 0; i < opts->num_mnt_opts; i++) {
1064                 char *has_comma;
1065
1066                 if (opts->mnt_opts[i])
1067                         has_comma = strchr(opts->mnt_opts[i], ',');
1068                 else
1069                         has_comma = NULL;
1070
1071                 switch (opts->mnt_opts_flags[i]) {
1072                 case CONTEXT_MNT:
1073                         prefix = CONTEXT_STR;
1074                         break;
1075                 case FSCONTEXT_MNT:
1076                         prefix = FSCONTEXT_STR;
1077                         break;
1078                 case ROOTCONTEXT_MNT:
1079                         prefix = ROOTCONTEXT_STR;
1080                         break;
1081                 case DEFCONTEXT_MNT:
1082                         prefix = DEFCONTEXT_STR;
1083                         break;
1084                 case SBLABEL_MNT:
1085                         seq_putc(m, ',');
1086                         seq_puts(m, LABELSUPP_STR);
1087                         continue;
1088                 default:
1089                         BUG();
1090                         return;
1091                 };
1092                 /* we need a comma before each option */
1093                 seq_putc(m, ',');
1094                 seq_puts(m, prefix);
1095                 if (has_comma)
1096                         seq_putc(m, '\"');
1097                 seq_puts(m, opts->mnt_opts[i]);
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100         }
1101 }
1102
1103 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1104 {
1105         struct security_mnt_opts opts;
1106         int rc;
1107
1108         rc = selinux_get_mnt_opts(sb, &opts);
1109         if (rc) {
1110                 /* before policy load we may get EINVAL, don't show anything */
1111                 if (rc == -EINVAL)
1112                         rc = 0;
1113                 return rc;
1114         }
1115
1116         selinux_write_opts(m, &opts);
1117
1118         security_free_mnt_opts(&opts);
1119
1120         return rc;
1121 }
1122
1123 static inline u16 inode_mode_to_security_class(umode_t mode)
1124 {
1125         switch (mode & S_IFMT) {
1126         case S_IFSOCK:
1127                 return SECCLASS_SOCK_FILE;
1128         case S_IFLNK:
1129                 return SECCLASS_LNK_FILE;
1130         case S_IFREG:
1131                 return SECCLASS_FILE;
1132         case S_IFBLK:
1133                 return SECCLASS_BLK_FILE;
1134         case S_IFDIR:
1135                 return SECCLASS_DIR;
1136         case S_IFCHR:
1137                 return SECCLASS_CHR_FILE;
1138         case S_IFIFO:
1139                 return SECCLASS_FIFO_FILE;
1140
1141         }
1142
1143         return SECCLASS_FILE;
1144 }
1145
1146 static inline int default_protocol_stream(int protocol)
1147 {
1148         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1149 }
1150
1151 static inline int default_protocol_dgram(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1154 }
1155
1156 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 {
1158         switch (family) {
1159         case PF_UNIX:
1160                 switch (type) {
1161                 case SOCK_STREAM:
1162                 case SOCK_SEQPACKET:
1163                         return SECCLASS_UNIX_STREAM_SOCKET;
1164                 case SOCK_DGRAM:
1165                         return SECCLASS_UNIX_DGRAM_SOCKET;
1166                 }
1167                 break;
1168         case PF_INET:
1169         case PF_INET6:
1170                 switch (type) {
1171                 case SOCK_STREAM:
1172                         if (default_protocol_stream(protocol))
1173                                 return SECCLASS_TCP_SOCKET;
1174                         else
1175                                 return SECCLASS_RAWIP_SOCKET;
1176                 case SOCK_DGRAM:
1177                         if (default_protocol_dgram(protocol))
1178                                 return SECCLASS_UDP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DCCP:
1182                         return SECCLASS_DCCP_SOCKET;
1183                 default:
1184                         return SECCLASS_RAWIP_SOCKET;
1185                 }
1186                 break;
1187         case PF_NETLINK:
1188                 switch (protocol) {
1189                 case NETLINK_ROUTE:
1190                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1191                 case NETLINK_FIREWALL:
1192                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1193                 case NETLINK_SOCK_DIAG:
1194                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1195                 case NETLINK_NFLOG:
1196                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1197                 case NETLINK_XFRM:
1198                         return SECCLASS_NETLINK_XFRM_SOCKET;
1199                 case NETLINK_SELINUX:
1200                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1201                 case NETLINK_AUDIT:
1202                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1203                 case NETLINK_IP6_FW:
1204                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1205                 case NETLINK_DNRTMSG:
1206                         return SECCLASS_NETLINK_DNRT_SOCKET;
1207                 case NETLINK_KOBJECT_UEVENT:
1208                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1209                 default:
1210                         return SECCLASS_NETLINK_SOCKET;
1211                 }
1212         case PF_PACKET:
1213                 return SECCLASS_PACKET_SOCKET;
1214         case PF_KEY:
1215                 return SECCLASS_KEY_SOCKET;
1216         case PF_APPLETALK:
1217                 return SECCLASS_APPLETALK_SOCKET;
1218         }
1219
1220         return SECCLASS_SOCKET;
1221 }
1222
1223 #ifdef CONFIG_PROC_FS
1224 static int selinux_proc_get_sid(struct dentry *dentry,
1225                                 u16 tclass,
1226                                 u32 *sid)
1227 {
1228         int rc;
1229         char *buffer, *path;
1230
1231         buffer = (char *)__get_free_page(GFP_KERNEL);
1232         if (!buffer)
1233                 return -ENOMEM;
1234
1235         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1236         if (IS_ERR(path))
1237                 rc = PTR_ERR(path);
1238         else {
1239                 /* each process gets a /proc/PID/ entry. Strip off the
1240                  * PID part to get a valid selinux labeling.
1241                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1242                 while (path[1] >= '0' && path[1] <= '9') {
1243                         path[1] = '/';
1244                         path++;
1245                 }
1246                 rc = security_genfs_sid("proc", path, tclass, sid);
1247         }
1248         free_page((unsigned long)buffer);
1249         return rc;
1250 }
1251 #else
1252 static int selinux_proc_get_sid(struct dentry *dentry,
1253                                 u16 tclass,
1254                                 u32 *sid)
1255 {
1256         return -EINVAL;
1257 }
1258 #endif
1259
1260 /* The inode's security attributes must be initialized before first use. */
1261 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1262 {
1263         struct superblock_security_struct *sbsec = NULL;
1264         struct inode_security_struct *isec = inode->i_security;
1265         u32 sid;
1266         struct dentry *dentry;
1267 #define INITCONTEXTLEN 255
1268         char *context = NULL;
1269         unsigned len = 0;
1270         int rc = 0;
1271
1272         if (isec->initialized)
1273                 goto out;
1274
1275         mutex_lock(&isec->lock);
1276         if (isec->initialized)
1277                 goto out_unlock;
1278
1279         sbsec = inode->i_sb->s_security;
1280         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1281                 /* Defer initialization until selinux_complete_init,
1282                    after the initial policy is loaded and the security
1283                    server is ready to handle calls. */
1284                 spin_lock(&sbsec->isec_lock);
1285                 if (list_empty(&isec->list))
1286                         list_add(&isec->list, &sbsec->isec_head);
1287                 spin_unlock(&sbsec->isec_lock);
1288                 goto out_unlock;
1289         }
1290
1291         switch (sbsec->behavior) {
1292         case SECURITY_FS_USE_NATIVE:
1293                 break;
1294         case SECURITY_FS_USE_XATTR:
1295                 if (!inode->i_op->getxattr) {
1296                         isec->sid = sbsec->def_sid;
1297                         break;
1298                 }
1299
1300                 /* Need a dentry, since the xattr API requires one.
1301                    Life would be simpler if we could just pass the inode. */
1302                 if (opt_dentry) {
1303                         /* Called from d_instantiate or d_splice_alias. */
1304                         dentry = dget(opt_dentry);
1305                 } else {
1306                         /* Called from selinux_complete_init, try to find a dentry. */
1307                         dentry = d_find_alias(inode);
1308                 }
1309                 if (!dentry) {
1310                         /*
1311                          * this is can be hit on boot when a file is accessed
1312                          * before the policy is loaded.  When we load policy we
1313                          * may find inodes that have no dentry on the
1314                          * sbsec->isec_head list.  No reason to complain as these
1315                          * will get fixed up the next time we go through
1316                          * inode_doinit with a dentry, before these inodes could
1317                          * be used again by userspace.
1318                          */
1319                         goto out_unlock;
1320                 }
1321
1322                 len = INITCONTEXTLEN;
1323                 context = kmalloc(len+1, GFP_NOFS);
1324                 if (!context) {
1325                         rc = -ENOMEM;
1326                         dput(dentry);
1327                         goto out_unlock;
1328                 }
1329                 context[len] = '\0';
1330                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1331                                            context, len);
1332                 if (rc == -ERANGE) {
1333                         kfree(context);
1334
1335                         /* Need a larger buffer.  Query for the right size. */
1336                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1337                                                    NULL, 0);
1338                         if (rc < 0) {
1339                                 dput(dentry);
1340                                 goto out_unlock;
1341                         }
1342                         len = rc;
1343                         context = kmalloc(len+1, GFP_NOFS);
1344                         if (!context) {
1345                                 rc = -ENOMEM;
1346                                 dput(dentry);
1347                                 goto out_unlock;
1348                         }
1349                         context[len] = '\0';
1350                         rc = inode->i_op->getxattr(dentry,
1351                                                    XATTR_NAME_SELINUX,
1352                                                    context, len);
1353                 }
1354                 dput(dentry);
1355                 if (rc < 0) {
1356                         if (rc != -ENODATA) {
1357                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1358                                        "%d for dev=%s ino=%ld\n", __func__,
1359                                        -rc, inode->i_sb->s_id, inode->i_ino);
1360                                 kfree(context);
1361                                 goto out_unlock;
1362                         }
1363                         /* Map ENODATA to the default file SID */
1364                         sid = sbsec->def_sid;
1365                         rc = 0;
1366                 } else {
1367                         rc = security_context_to_sid_default(context, rc, &sid,
1368                                                              sbsec->def_sid,
1369                                                              GFP_NOFS);
1370                         if (rc) {
1371                                 char *dev = inode->i_sb->s_id;
1372                                 unsigned long ino = inode->i_ino;
1373
1374                                 if (rc == -EINVAL) {
1375                                         if (printk_ratelimit())
1376                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1377                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1378                                                         "filesystem in question.\n", ino, dev, context);
1379                                 } else {
1380                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1381                                                "returned %d for dev=%s ino=%ld\n",
1382                                                __func__, context, -rc, dev, ino);
1383                                 }
1384                                 kfree(context);
1385                                 /* Leave with the unlabeled SID */
1386                                 rc = 0;
1387                                 break;
1388                         }
1389                 }
1390                 kfree(context);
1391                 isec->sid = sid;
1392                 break;
1393         case SECURITY_FS_USE_TASK:
1394                 isec->sid = isec->task_sid;
1395                 break;
1396         case SECURITY_FS_USE_TRANS:
1397                 /* Default to the fs SID. */
1398                 isec->sid = sbsec->sid;
1399
1400                 /* Try to obtain a transition SID. */
1401                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1402                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1403                                              isec->sclass, NULL, &sid);
1404                 if (rc)
1405                         goto out_unlock;
1406                 isec->sid = sid;
1407                 break;
1408         case SECURITY_FS_USE_MNTPOINT:
1409                 isec->sid = sbsec->mntpoint_sid;
1410                 break;
1411         default:
1412                 /* Default to the fs superblock SID. */
1413                 isec->sid = sbsec->sid;
1414
1415                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1416                         /* We must have a dentry to determine the label on
1417                          * procfs inodes */
1418                         if (opt_dentry)
1419                                 /* Called from d_instantiate or
1420                                  * d_splice_alias. */
1421                                 dentry = dget(opt_dentry);
1422                         else
1423                                 /* Called from selinux_complete_init, try to
1424                                  * find a dentry. */
1425                                 dentry = d_find_alias(inode);
1426                         /*
1427                          * This can be hit on boot when a file is accessed
1428                          * before the policy is loaded.  When we load policy we
1429                          * may find inodes that have no dentry on the
1430                          * sbsec->isec_head list.  No reason to complain as
1431                          * these will get fixed up the next time we go through
1432                          * inode_doinit() with a dentry, before these inodes
1433                          * could be used again by userspace.
1434                          */
1435                         if (!dentry)
1436                                 goto out_unlock;
1437                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1438                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1439                         dput(dentry);
1440                         if (rc)
1441                                 goto out_unlock;
1442                         isec->sid = sid;
1443                 }
1444                 break;
1445         }
1446
1447         isec->initialized = 1;
1448
1449 out_unlock:
1450         mutex_unlock(&isec->lock);
1451 out:
1452         if (isec->sclass == SECCLASS_FILE)
1453                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1454         return rc;
1455 }
1456
1457 /* Convert a Linux signal to an access vector. */
1458 static inline u32 signal_to_av(int sig)
1459 {
1460         u32 perm = 0;
1461
1462         switch (sig) {
1463         case SIGCHLD:
1464                 /* Commonly granted from child to parent. */
1465                 perm = PROCESS__SIGCHLD;
1466                 break;
1467         case SIGKILL:
1468                 /* Cannot be caught or ignored */
1469                 perm = PROCESS__SIGKILL;
1470                 break;
1471         case SIGSTOP:
1472                 /* Cannot be caught or ignored */
1473                 perm = PROCESS__SIGSTOP;
1474                 break;
1475         default:
1476                 /* All other signals. */
1477                 perm = PROCESS__SIGNAL;
1478                 break;
1479         }
1480
1481         return perm;
1482 }
1483
1484 /*
1485  * Check permission between a pair of credentials
1486  * fork check, ptrace check, etc.
1487  */
1488 static int cred_has_perm(const struct cred *actor,
1489                          const struct cred *target,
1490                          u32 perms)
1491 {
1492         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1493
1494         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1495 }
1496
1497 /*
1498  * Check permission between a pair of tasks, e.g. signal checks,
1499  * fork check, ptrace check, etc.
1500  * tsk1 is the actor and tsk2 is the target
1501  * - this uses the default subjective creds of tsk1
1502  */
1503 static int task_has_perm(const struct task_struct *tsk1,
1504                          const struct task_struct *tsk2,
1505                          u32 perms)
1506 {
1507         const struct task_security_struct *__tsec1, *__tsec2;
1508         u32 sid1, sid2;
1509
1510         rcu_read_lock();
1511         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1512         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1513         rcu_read_unlock();
1514         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1515 }
1516
1517 /*
1518  * Check permission between current and another task, e.g. signal checks,
1519  * fork check, ptrace check, etc.
1520  * current is the actor and tsk2 is the target
1521  * - this uses current's subjective creds
1522  */
1523 static int current_has_perm(const struct task_struct *tsk,
1524                             u32 perms)
1525 {
1526         u32 sid, tsid;
1527
1528         sid = current_sid();
1529         tsid = task_sid(tsk);
1530         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1531 }
1532
1533 #if CAP_LAST_CAP > 63
1534 #error Fix SELinux to handle capabilities > 63.
1535 #endif
1536
1537 /* Check whether a task is allowed to use a capability. */
1538 static int cred_has_capability(const struct cred *cred,
1539                                int cap, int audit)
1540 {
1541         struct common_audit_data ad;
1542         struct av_decision avd;
1543         u16 sclass;
1544         u32 sid = cred_sid(cred);
1545         u32 av = CAP_TO_MASK(cap);
1546         int rc;
1547
1548         ad.type = LSM_AUDIT_DATA_CAP;
1549         ad.u.cap = cap;
1550
1551         switch (CAP_TO_INDEX(cap)) {
1552         case 0:
1553                 sclass = SECCLASS_CAPABILITY;
1554                 break;
1555         case 1:
1556                 sclass = SECCLASS_CAPABILITY2;
1557                 break;
1558         default:
1559                 printk(KERN_ERR
1560                        "SELinux:  out of range capability %d\n", cap);
1561                 BUG();
1562                 return -EINVAL;
1563         }
1564
1565         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1566         if (audit == SECURITY_CAP_AUDIT) {
1567                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1568                 if (rc2)
1569                         return rc2;
1570         }
1571         return rc;
1572 }
1573
1574 /* Check whether a task is allowed to use a system operation. */
1575 static int task_has_system(struct task_struct *tsk,
1576                            u32 perms)
1577 {
1578         u32 sid = task_sid(tsk);
1579
1580         return avc_has_perm(sid, SECINITSID_KERNEL,
1581                             SECCLASS_SYSTEM, perms, NULL);
1582 }
1583
1584 /* Check whether a task has a particular permission to an inode.
1585    The 'adp' parameter is optional and allows other audit
1586    data to be passed (e.g. the dentry). */
1587 static int inode_has_perm(const struct cred *cred,
1588                           struct inode *inode,
1589                           u32 perms,
1590                           struct common_audit_data *adp)
1591 {
1592         struct inode_security_struct *isec;
1593         u32 sid;
1594
1595         validate_creds(cred);
1596
1597         if (unlikely(IS_PRIVATE(inode)))
1598                 return 0;
1599
1600         sid = cred_sid(cred);
1601         isec = inode->i_security;
1602
1603         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1604 }
1605
1606 /* Same as inode_has_perm, but pass explicit audit data containing
1607    the dentry to help the auditing code to more easily generate the
1608    pathname if needed. */
1609 static inline int dentry_has_perm(const struct cred *cred,
1610                                   struct dentry *dentry,
1611                                   u32 av)
1612 {
1613         struct inode *inode = dentry->d_inode;
1614         struct common_audit_data ad;
1615
1616         ad.type = LSM_AUDIT_DATA_DENTRY;
1617         ad.u.dentry = dentry;
1618         return inode_has_perm(cred, inode, av, &ad);
1619 }
1620
1621 /* Same as inode_has_perm, but pass explicit audit data containing
1622    the path to help the auditing code to more easily generate the
1623    pathname if needed. */
1624 static inline int path_has_perm(const struct cred *cred,
1625                                 struct path *path,
1626                                 u32 av)
1627 {
1628         struct inode *inode = path->dentry->d_inode;
1629         struct common_audit_data ad;
1630
1631         ad.type = LSM_AUDIT_DATA_PATH;
1632         ad.u.path = *path;
1633         return inode_has_perm(cred, inode, av, &ad);
1634 }
1635
1636 /* Same as path_has_perm, but uses the inode from the file struct. */
1637 static inline int file_path_has_perm(const struct cred *cred,
1638                                      struct file *file,
1639                                      u32 av)
1640 {
1641         struct common_audit_data ad;
1642
1643         ad.type = LSM_AUDIT_DATA_PATH;
1644         ad.u.path = file->f_path;
1645         return inode_has_perm(cred, file_inode(file), av, &ad);
1646 }
1647
1648 /* Check whether a task can use an open file descriptor to
1649    access an inode in a given way.  Check access to the
1650    descriptor itself, and then use dentry_has_perm to
1651    check a particular permission to the file.
1652    Access to the descriptor is implicitly granted if it
1653    has the same SID as the process.  If av is zero, then
1654    access to the file is not checked, e.g. for cases
1655    where only the descriptor is affected like seek. */
1656 static int file_has_perm(const struct cred *cred,
1657                          struct file *file,
1658                          u32 av)
1659 {
1660         struct file_security_struct *fsec = file->f_security;
1661         struct inode *inode = file_inode(file);
1662         struct common_audit_data ad;
1663         u32 sid = cred_sid(cred);
1664         int rc;
1665
1666         ad.type = LSM_AUDIT_DATA_PATH;
1667         ad.u.path = file->f_path;
1668
1669         if (sid != fsec->sid) {
1670                 rc = avc_has_perm(sid, fsec->sid,
1671                                   SECCLASS_FD,
1672                                   FD__USE,
1673                                   &ad);
1674                 if (rc)
1675                         goto out;
1676         }
1677
1678         /* av is zero if only checking access to the descriptor. */
1679         rc = 0;
1680         if (av)
1681                 rc = inode_has_perm(cred, inode, av, &ad);
1682
1683 out:
1684         return rc;
1685 }
1686
1687 /* Check whether a task can create a file. */
1688 static int may_create(struct inode *dir,
1689                       struct dentry *dentry,
1690                       u16 tclass)
1691 {
1692         const struct task_security_struct *tsec = current_security();
1693         struct inode_security_struct *dsec;
1694         struct superblock_security_struct *sbsec;
1695         u32 sid, newsid;
1696         struct common_audit_data ad;
1697         int rc;
1698
1699         dsec = dir->i_security;
1700         sbsec = dir->i_sb->s_security;
1701
1702         sid = tsec->sid;
1703         newsid = tsec->create_sid;
1704
1705         ad.type = LSM_AUDIT_DATA_DENTRY;
1706         ad.u.dentry = dentry;
1707
1708         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1709                           DIR__ADD_NAME | DIR__SEARCH,
1710                           &ad);
1711         if (rc)
1712                 return rc;
1713
1714         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1715                 rc = security_transition_sid(sid, dsec->sid, tclass,
1716                                              &dentry->d_name, &newsid);
1717                 if (rc)
1718                         return rc;
1719         }
1720
1721         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1722         if (rc)
1723                 return rc;
1724
1725         return avc_has_perm(newsid, sbsec->sid,
1726                             SECCLASS_FILESYSTEM,
1727                             FILESYSTEM__ASSOCIATE, &ad);
1728 }
1729
1730 /* Check whether a task can create a key. */
1731 static int may_create_key(u32 ksid,
1732                           struct task_struct *ctx)
1733 {
1734         u32 sid = task_sid(ctx);
1735
1736         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1737 }
1738
1739 #define MAY_LINK        0
1740 #define MAY_UNLINK      1
1741 #define MAY_RMDIR       2
1742
1743 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1744 static int may_link(struct inode *dir,
1745                     struct dentry *dentry,
1746                     int kind)
1747
1748 {
1749         struct inode_security_struct *dsec, *isec;
1750         struct common_audit_data ad;
1751         u32 sid = current_sid();
1752         u32 av;
1753         int rc;
1754
1755         dsec = dir->i_security;
1756         isec = dentry->d_inode->i_security;
1757
1758         ad.type = LSM_AUDIT_DATA_DENTRY;
1759         ad.u.dentry = dentry;
1760
1761         av = DIR__SEARCH;
1762         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1763         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1764         if (rc)
1765                 return rc;
1766
1767         switch (kind) {
1768         case MAY_LINK:
1769                 av = FILE__LINK;
1770                 break;
1771         case MAY_UNLINK:
1772                 av = FILE__UNLINK;
1773                 break;
1774         case MAY_RMDIR:
1775                 av = DIR__RMDIR;
1776                 break;
1777         default:
1778                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1779                         __func__, kind);
1780                 return 0;
1781         }
1782
1783         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1784         return rc;
1785 }
1786
1787 static inline int may_rename(struct inode *old_dir,
1788                              struct dentry *old_dentry,
1789                              struct inode *new_dir,
1790                              struct dentry *new_dentry)
1791 {
1792         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1793         struct common_audit_data ad;
1794         u32 sid = current_sid();
1795         u32 av;
1796         int old_is_dir, new_is_dir;
1797         int rc;
1798
1799         old_dsec = old_dir->i_security;
1800         old_isec = old_dentry->d_inode->i_security;
1801         old_is_dir = d_is_dir(old_dentry);
1802         new_dsec = new_dir->i_security;
1803
1804         ad.type = LSM_AUDIT_DATA_DENTRY;
1805
1806         ad.u.dentry = old_dentry;
1807         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1808                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1809         if (rc)
1810                 return rc;
1811         rc = avc_has_perm(sid, old_isec->sid,
1812                           old_isec->sclass, FILE__RENAME, &ad);
1813         if (rc)
1814                 return rc;
1815         if (old_is_dir && new_dir != old_dir) {
1816                 rc = avc_has_perm(sid, old_isec->sid,
1817                                   old_isec->sclass, DIR__REPARENT, &ad);
1818                 if (rc)
1819                         return rc;
1820         }
1821
1822         ad.u.dentry = new_dentry;
1823         av = DIR__ADD_NAME | DIR__SEARCH;
1824         if (d_is_positive(new_dentry))
1825                 av |= DIR__REMOVE_NAME;
1826         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1827         if (rc)
1828                 return rc;
1829         if (d_is_positive(new_dentry)) {
1830                 new_isec = new_dentry->d_inode->i_security;
1831                 new_is_dir = d_is_dir(new_dentry);
1832                 rc = avc_has_perm(sid, new_isec->sid,
1833                                   new_isec->sclass,
1834                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1835                 if (rc)
1836                         return rc;
1837         }
1838
1839         return 0;
1840 }
1841
1842 /* Check whether a task can perform a filesystem operation. */
1843 static int superblock_has_perm(const struct cred *cred,
1844                                struct super_block *sb,
1845                                u32 perms,
1846                                struct common_audit_data *ad)
1847 {
1848         struct superblock_security_struct *sbsec;
1849         u32 sid = cred_sid(cred);
1850
1851         sbsec = sb->s_security;
1852         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1853 }
1854
1855 /* Convert a Linux mode and permission mask to an access vector. */
1856 static inline u32 file_mask_to_av(int mode, int mask)
1857 {
1858         u32 av = 0;
1859
1860         if (!S_ISDIR(mode)) {
1861                 if (mask & MAY_EXEC)
1862                         av |= FILE__EXECUTE;
1863                 if (mask & MAY_READ)
1864                         av |= FILE__READ;
1865
1866                 if (mask & MAY_APPEND)
1867                         av |= FILE__APPEND;
1868                 else if (mask & MAY_WRITE)
1869                         av |= FILE__WRITE;
1870
1871         } else {
1872                 if (mask & MAY_EXEC)
1873                         av |= DIR__SEARCH;
1874                 if (mask & MAY_WRITE)
1875                         av |= DIR__WRITE;
1876                 if (mask & MAY_READ)
1877                         av |= DIR__READ;
1878         }
1879
1880         return av;
1881 }
1882
1883 /* Convert a Linux file to an access vector. */
1884 static inline u32 file_to_av(struct file *file)
1885 {
1886         u32 av = 0;
1887
1888         if (file->f_mode & FMODE_READ)
1889                 av |= FILE__READ;
1890         if (file->f_mode & FMODE_WRITE) {
1891                 if (file->f_flags & O_APPEND)
1892                         av |= FILE__APPEND;
1893                 else
1894                         av |= FILE__WRITE;
1895         }
1896         if (!av) {
1897                 /*
1898                  * Special file opened with flags 3 for ioctl-only use.
1899                  */
1900                 av = FILE__IOCTL;
1901         }
1902
1903         return av;
1904 }
1905
1906 /*
1907  * Convert a file to an access vector and include the correct open
1908  * open permission.
1909  */
1910 static inline u32 open_file_to_av(struct file *file)
1911 {
1912         u32 av = file_to_av(file);
1913
1914         if (selinux_policycap_openperm)
1915                 av |= FILE__OPEN;
1916
1917         return av;
1918 }
1919
1920 /* Hook functions begin here. */
1921
1922 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1923 {
1924         u32 mysid = current_sid();
1925         u32 mgrsid = task_sid(mgr);
1926
1927         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1928                             BINDER__SET_CONTEXT_MGR, NULL);
1929 }
1930
1931 static int selinux_binder_transaction(struct task_struct *from,
1932                                       struct task_struct *to)
1933 {
1934         u32 mysid = current_sid();
1935         u32 fromsid = task_sid(from);
1936         u32 tosid = task_sid(to);
1937         int rc;
1938
1939         if (mysid != fromsid) {
1940                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1941                                   BINDER__IMPERSONATE, NULL);
1942                 if (rc)
1943                         return rc;
1944         }
1945
1946         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1947                             NULL);
1948 }
1949
1950 static int selinux_binder_transfer_binder(struct task_struct *from,
1951                                           struct task_struct *to)
1952 {
1953         u32 fromsid = task_sid(from);
1954         u32 tosid = task_sid(to);
1955
1956         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1957                             NULL);
1958 }
1959
1960 static int selinux_binder_transfer_file(struct task_struct *from,
1961                                         struct task_struct *to,
1962                                         struct file *file)
1963 {
1964         u32 sid = task_sid(to);
1965         struct file_security_struct *fsec = file->f_security;
1966         struct inode *inode = file->f_path.dentry->d_inode;
1967         struct inode_security_struct *isec = inode->i_security;
1968         struct common_audit_data ad;
1969         int rc;
1970
1971         ad.type = LSM_AUDIT_DATA_PATH;
1972         ad.u.path = file->f_path;
1973
1974         if (sid != fsec->sid) {
1975                 rc = avc_has_perm(sid, fsec->sid,
1976                                   SECCLASS_FD,
1977                                   FD__USE,
1978                                   &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         if (unlikely(IS_PRIVATE(inode)))
1984                 return 0;
1985
1986         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1987                             &ad);
1988 }
1989
1990 static int selinux_ptrace_access_check(struct task_struct *child,
1991                                      unsigned int mode)
1992 {
1993         int rc;
1994
1995         rc = cap_ptrace_access_check(child, mode);
1996         if (rc)
1997                 return rc;
1998
1999         if (mode & PTRACE_MODE_READ) {
2000                 u32 sid = current_sid();
2001                 u32 csid = task_sid(child);
2002                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2003         }
2004
2005         return current_has_perm(child, PROCESS__PTRACE);
2006 }
2007
2008 static int selinux_ptrace_traceme(struct task_struct *parent)
2009 {
2010         int rc;
2011
2012         rc = cap_ptrace_traceme(parent);
2013         if (rc)
2014                 return rc;
2015
2016         return task_has_perm(parent, current, PROCESS__PTRACE);
2017 }
2018
2019 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2020                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2021 {
2022         int error;
2023
2024         error = current_has_perm(target, PROCESS__GETCAP);
2025         if (error)
2026                 return error;
2027
2028         return cap_capget(target, effective, inheritable, permitted);
2029 }
2030
2031 static int selinux_capset(struct cred *new, const struct cred *old,
2032                           const kernel_cap_t *effective,
2033                           const kernel_cap_t *inheritable,
2034                           const kernel_cap_t *permitted)
2035 {
2036         int error;
2037
2038         error = cap_capset(new, old,
2039                                       effective, inheritable, permitted);
2040         if (error)
2041                 return error;
2042
2043         return cred_has_perm(old, new, PROCESS__SETCAP);
2044 }
2045
2046 /*
2047  * (This comment used to live with the selinux_task_setuid hook,
2048  * which was removed).
2049  *
2050  * Since setuid only affects the current process, and since the SELinux
2051  * controls are not based on the Linux identity attributes, SELinux does not
2052  * need to control this operation.  However, SELinux does control the use of
2053  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2054  */
2055
2056 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2057                            int cap, int audit)
2058 {
2059         int rc;
2060
2061         rc = cap_capable(cred, ns, cap, audit);
2062         if (rc)
2063                 return rc;
2064
2065         return cred_has_capability(cred, cap, audit);
2066 }
2067
2068 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2069 {
2070         const struct cred *cred = current_cred();
2071         int rc = 0;
2072
2073         if (!sb)
2074                 return 0;
2075
2076         switch (cmds) {
2077         case Q_SYNC:
2078         case Q_QUOTAON:
2079         case Q_QUOTAOFF:
2080         case Q_SETINFO:
2081         case Q_SETQUOTA:
2082                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2083                 break;
2084         case Q_GETFMT:
2085         case Q_GETINFO:
2086         case Q_GETQUOTA:
2087                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2088                 break;
2089         default:
2090                 rc = 0;  /* let the kernel handle invalid cmds */
2091                 break;
2092         }
2093         return rc;
2094 }
2095
2096 static int selinux_quota_on(struct dentry *dentry)
2097 {
2098         const struct cred *cred = current_cred();
2099
2100         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2101 }
2102
2103 static int selinux_syslog(int type)
2104 {
2105         int rc;
2106
2107         switch (type) {
2108         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2109         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2110                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2111                 break;
2112         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2113         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2114         /* Set level of messages printed to console */
2115         case SYSLOG_ACTION_CONSOLE_LEVEL:
2116                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2117                 break;
2118         case SYSLOG_ACTION_CLOSE:       /* Close log */
2119         case SYSLOG_ACTION_OPEN:        /* Open log */
2120         case SYSLOG_ACTION_READ:        /* Read from log */
2121         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2122         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2123         default:
2124                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2125                 break;
2126         }
2127         return rc;
2128 }
2129
2130 /*
2131  * Check that a process has enough memory to allocate a new virtual
2132  * mapping. 0 means there is enough memory for the allocation to
2133  * succeed and -ENOMEM implies there is not.
2134  *
2135  * Do not audit the selinux permission check, as this is applied to all
2136  * processes that allocate mappings.
2137  */
2138 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2139 {
2140         int rc, cap_sys_admin = 0;
2141
2142         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2143                              SECURITY_CAP_NOAUDIT);
2144         if (rc == 0)
2145                 cap_sys_admin = 1;
2146
2147         return __vm_enough_memory(mm, pages, cap_sys_admin);
2148 }
2149
2150 /* binprm security operations */
2151
2152 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2153                             const struct task_security_struct *old_tsec,
2154                             const struct task_security_struct *new_tsec)
2155 {
2156         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2157         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2158         int rc;
2159
2160         if (!nnp && !nosuid)
2161                 return 0; /* neither NNP nor nosuid */
2162
2163         if (new_tsec->sid == old_tsec->sid)
2164                 return 0; /* No change in credentials */
2165
2166         /*
2167          * The only transitions we permit under NNP or nosuid
2168          * are transitions to bounded SIDs, i.e. SIDs that are
2169          * guaranteed to only be allowed a subset of the permissions
2170          * of the current SID.
2171          */
2172         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2173         if (rc) {
2174                 /*
2175                  * On failure, preserve the errno values for NNP vs nosuid.
2176                  * NNP:  Operation not permitted for caller.
2177                  * nosuid:  Permission denied to file.
2178                  */
2179                 if (nnp)
2180                         return -EPERM;
2181                 else
2182                         return -EACCES;
2183         }
2184         return 0;
2185 }
2186
2187 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2188 {
2189         const struct task_security_struct *old_tsec;
2190         struct task_security_struct *new_tsec;
2191         struct inode_security_struct *isec;
2192         struct common_audit_data ad;
2193         struct inode *inode = file_inode(bprm->file);
2194         int rc;
2195
2196         rc = cap_bprm_set_creds(bprm);
2197         if (rc)
2198                 return rc;
2199
2200         /* SELinux context only depends on initial program or script and not
2201          * the script interpreter */
2202         if (bprm->cred_prepared)
2203                 return 0;
2204
2205         old_tsec = current_security();
2206         new_tsec = bprm->cred->security;
2207         isec = inode->i_security;
2208
2209         /* Default to the current task SID. */
2210         new_tsec->sid = old_tsec->sid;
2211         new_tsec->osid = old_tsec->sid;
2212
2213         /* Reset fs, key, and sock SIDs on execve. */
2214         new_tsec->create_sid = 0;
2215         new_tsec->keycreate_sid = 0;
2216         new_tsec->sockcreate_sid = 0;
2217
2218         if (old_tsec->exec_sid) {
2219                 new_tsec->sid = old_tsec->exec_sid;
2220                 /* Reset exec SID on execve. */
2221                 new_tsec->exec_sid = 0;
2222
2223                 /* Fail on NNP or nosuid if not an allowed transition. */
2224                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2225                 if (rc)
2226                         return rc;
2227         } else {
2228                 /* Check for a default transition on this program. */
2229                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2230                                              SECCLASS_PROCESS, NULL,
2231                                              &new_tsec->sid);
2232                 if (rc)
2233                         return rc;
2234
2235                 /*
2236                  * Fallback to old SID on NNP or nosuid if not an allowed
2237                  * transition.
2238                  */
2239                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2240                 if (rc)
2241                         new_tsec->sid = old_tsec->sid;
2242         }
2243
2244         ad.type = LSM_AUDIT_DATA_PATH;
2245         ad.u.path = bprm->file->f_path;
2246
2247         if (new_tsec->sid == old_tsec->sid) {
2248                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2249                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2250                 if (rc)
2251                         return rc;
2252         } else {
2253                 /* Check permissions for the transition. */
2254                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2255                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2256                 if (rc)
2257                         return rc;
2258
2259                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2260                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2261                 if (rc)
2262                         return rc;
2263
2264                 /* Check for shared state */
2265                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2266                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2267                                           SECCLASS_PROCESS, PROCESS__SHARE,
2268                                           NULL);
2269                         if (rc)
2270                                 return -EPERM;
2271                 }
2272
2273                 /* Make sure that anyone attempting to ptrace over a task that
2274                  * changes its SID has the appropriate permit */
2275                 if (bprm->unsafe &
2276                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2277                         struct task_struct *tracer;
2278                         struct task_security_struct *sec;
2279                         u32 ptsid = 0;
2280
2281                         rcu_read_lock();
2282                         tracer = ptrace_parent(current);
2283                         if (likely(tracer != NULL)) {
2284                                 sec = __task_cred(tracer)->security;
2285                                 ptsid = sec->sid;
2286                         }
2287                         rcu_read_unlock();
2288
2289                         if (ptsid != 0) {
2290                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2291                                                   SECCLASS_PROCESS,
2292                                                   PROCESS__PTRACE, NULL);
2293                                 if (rc)
2294                                         return -EPERM;
2295                         }
2296                 }
2297
2298                 /* Clear any possibly unsafe personality bits on exec: */
2299                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2300         }
2301
2302         return 0;
2303 }
2304
2305 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2306 {
2307         const struct task_security_struct *tsec = current_security();
2308         u32 sid, osid;
2309         int atsecure = 0;
2310
2311         sid = tsec->sid;
2312         osid = tsec->osid;
2313
2314         if (osid != sid) {
2315                 /* Enable secure mode for SIDs transitions unless
2316                    the noatsecure permission is granted between
2317                    the two SIDs, i.e. ahp returns 0. */
2318                 atsecure = avc_has_perm(osid, sid,
2319                                         SECCLASS_PROCESS,
2320                                         PROCESS__NOATSECURE, NULL);
2321         }
2322
2323         return (atsecure || cap_bprm_secureexec(bprm));
2324 }
2325
2326 static int match_file(const void *p, struct file *file, unsigned fd)
2327 {
2328         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2329 }
2330
2331 /* Derived from fs/exec.c:flush_old_files. */
2332 static inline void flush_unauthorized_files(const struct cred *cred,
2333                                             struct files_struct *files)
2334 {
2335         struct file *file, *devnull = NULL;
2336         struct tty_struct *tty;
2337         int drop_tty = 0;
2338         unsigned n;
2339
2340         tty = get_current_tty();
2341         if (tty) {
2342                 spin_lock(&tty_files_lock);
2343                 if (!list_empty(&tty->tty_files)) {
2344                         struct tty_file_private *file_priv;
2345
2346                         /* Revalidate access to controlling tty.
2347                            Use file_path_has_perm on the tty path directly
2348                            rather than using file_has_perm, as this particular
2349                            open file may belong to another process and we are
2350                            only interested in the inode-based check here. */
2351                         file_priv = list_first_entry(&tty->tty_files,
2352                                                 struct tty_file_private, list);
2353                         file = file_priv->file;
2354                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2355                                 drop_tty = 1;
2356                 }
2357                 spin_unlock(&tty_files_lock);
2358                 tty_kref_put(tty);
2359         }
2360         /* Reset controlling tty. */
2361         if (drop_tty)
2362                 no_tty();
2363
2364         /* Revalidate access to inherited open files. */
2365         n = iterate_fd(files, 0, match_file, cred);
2366         if (!n) /* none found? */
2367                 return;
2368
2369         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2370         if (IS_ERR(devnull))
2371                 devnull = NULL;
2372         /* replace all the matching ones with this */
2373         do {
2374                 replace_fd(n - 1, devnull, 0);
2375         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2376         if (devnull)
2377                 fput(devnull);
2378 }
2379
2380 /*
2381  * Prepare a process for imminent new credential changes due to exec
2382  */
2383 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2384 {
2385         struct task_security_struct *new_tsec;
2386         struct rlimit *rlim, *initrlim;
2387         int rc, i;
2388
2389         new_tsec = bprm->cred->security;
2390         if (new_tsec->sid == new_tsec->osid)
2391                 return;
2392
2393         /* Close files for which the new task SID is not authorized. */
2394         flush_unauthorized_files(bprm->cred, current->files);
2395
2396         /* Always clear parent death signal on SID transitions. */
2397         current->pdeath_signal = 0;
2398
2399         /* Check whether the new SID can inherit resource limits from the old
2400          * SID.  If not, reset all soft limits to the lower of the current
2401          * task's hard limit and the init task's soft limit.
2402          *
2403          * Note that the setting of hard limits (even to lower them) can be
2404          * controlled by the setrlimit check.  The inclusion of the init task's
2405          * soft limit into the computation is to avoid resetting soft limits
2406          * higher than the default soft limit for cases where the default is
2407          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2408          */
2409         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2410                           PROCESS__RLIMITINH, NULL);
2411         if (rc) {
2412                 /* protect against do_prlimit() */
2413                 task_lock(current);
2414                 for (i = 0; i < RLIM_NLIMITS; i++) {
2415                         rlim = current->signal->rlim + i;
2416                         initrlim = init_task.signal->rlim + i;
2417                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2418                 }
2419                 task_unlock(current);
2420                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2421         }
2422 }
2423
2424 /*
2425  * Clean up the process immediately after the installation of new credentials
2426  * due to exec
2427  */
2428 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2429 {
2430         const struct task_security_struct *tsec = current_security();
2431         struct itimerval itimer;
2432         u32 osid, sid;
2433         int rc, i;
2434
2435         osid = tsec->osid;
2436         sid = tsec->sid;
2437
2438         if (sid == osid)
2439                 return;
2440
2441         /* Check whether the new SID can inherit signal state from the old SID.
2442          * If not, clear itimers to avoid subsequent signal generation and
2443          * flush and unblock signals.
2444          *
2445          * This must occur _after_ the task SID has been updated so that any
2446          * kill done after the flush will be checked against the new SID.
2447          */
2448         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2449         if (rc) {
2450                 memset(&itimer, 0, sizeof itimer);
2451                 for (i = 0; i < 3; i++)
2452                         do_setitimer(i, &itimer, NULL);
2453                 spin_lock_irq(&current->sighand->siglock);
2454                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2455                         __flush_signals(current);
2456                         flush_signal_handlers(current, 1);
2457                         sigemptyset(&current->blocked);
2458                 }
2459                 spin_unlock_irq(&current->sighand->siglock);
2460         }
2461
2462         /* Wake up the parent if it is waiting so that it can recheck
2463          * wait permission to the new task SID. */
2464         read_lock(&tasklist_lock);
2465         __wake_up_parent(current, current->real_parent);
2466         read_unlock(&tasklist_lock);
2467 }
2468
2469 /* superblock security operations */
2470
2471 static int selinux_sb_alloc_security(struct super_block *sb)
2472 {
2473         return superblock_alloc_security(sb);
2474 }
2475
2476 static void selinux_sb_free_security(struct super_block *sb)
2477 {
2478         superblock_free_security(sb);
2479 }
2480
2481 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2482 {
2483         if (plen > olen)
2484                 return 0;
2485
2486         return !memcmp(prefix, option, plen);
2487 }
2488
2489 static inline int selinux_option(char *option, int len)
2490 {
2491         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2492                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2493                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2494                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2495                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2496 }
2497
2498 static inline void take_option(char **to, char *from, int *first, int len)
2499 {
2500         if (!*first) {
2501                 **to = ',';
2502                 *to += 1;
2503         } else
2504                 *first = 0;
2505         memcpy(*to, from, len);
2506         *to += len;
2507 }
2508
2509 static inline void take_selinux_option(char **to, char *from, int *first,
2510                                        int len)
2511 {
2512         int current_size = 0;
2513
2514         if (!*first) {
2515                 **to = '|';
2516                 *to += 1;
2517         } else
2518                 *first = 0;
2519
2520         while (current_size < len) {
2521                 if (*from != '"') {
2522                         **to = *from;
2523                         *to += 1;
2524                 }
2525                 from += 1;
2526                 current_size += 1;
2527         }
2528 }
2529
2530 static int selinux_sb_copy_data(char *orig, char *copy)
2531 {
2532         int fnosec, fsec, rc = 0;
2533         char *in_save, *in_curr, *in_end;
2534         char *sec_curr, *nosec_save, *nosec;
2535         int open_quote = 0;
2536
2537         in_curr = orig;
2538         sec_curr = copy;
2539
2540         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2541         if (!nosec) {
2542                 rc = -ENOMEM;
2543                 goto out;
2544         }
2545
2546         nosec_save = nosec;
2547         fnosec = fsec = 1;
2548         in_save = in_end = orig;
2549
2550         do {
2551                 if (*in_end == '"')
2552                         open_quote = !open_quote;
2553                 if ((*in_end == ',' && open_quote == 0) ||
2554                                 *in_end == '\0') {
2555                         int len = in_end - in_curr;
2556
2557                         if (selinux_option(in_curr, len))
2558                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2559                         else
2560                                 take_option(&nosec, in_curr, &fnosec, len);
2561
2562                         in_curr = in_end + 1;
2563                 }
2564         } while (*in_end++);
2565
2566         strcpy(in_save, nosec_save);
2567         free_page((unsigned long)nosec_save);
2568 out:
2569         return rc;
2570 }
2571
2572 static int selinux_sb_remount(struct super_block *sb, void *data)
2573 {
2574         int rc, i, *flags;
2575         struct security_mnt_opts opts;
2576         char *secdata, **mount_options;
2577         struct superblock_security_struct *sbsec = sb->s_security;
2578
2579         if (!(sbsec->flags & SE_SBINITIALIZED))
2580                 return 0;
2581
2582         if (!data)
2583                 return 0;
2584
2585         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2586                 return 0;
2587
2588         security_init_mnt_opts(&opts);
2589         secdata = alloc_secdata();
2590         if (!secdata)
2591                 return -ENOMEM;
2592         rc = selinux_sb_copy_data(data, secdata);
2593         if (rc)
2594                 goto out_free_secdata;
2595
2596         rc = selinux_parse_opts_str(secdata, &opts);
2597         if (rc)
2598                 goto out_free_secdata;
2599
2600         mount_options = opts.mnt_opts;
2601         flags = opts.mnt_opts_flags;
2602
2603         for (i = 0; i < opts.num_mnt_opts; i++) {
2604                 u32 sid;
2605                 size_t len;
2606
2607                 if (flags[i] == SBLABEL_MNT)
2608                         continue;
2609                 len = strlen(mount_options[i]);
2610                 rc = security_context_to_sid(mount_options[i], len, &sid,
2611                                              GFP_KERNEL);
2612                 if (rc) {
2613                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2614                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2615                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2616                         goto out_free_opts;
2617                 }
2618                 rc = -EINVAL;
2619                 switch (flags[i]) {
2620                 case FSCONTEXT_MNT:
2621                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2622                                 goto out_bad_option;
2623                         break;
2624                 case CONTEXT_MNT:
2625                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2626                                 goto out_bad_option;
2627                         break;
2628                 case ROOTCONTEXT_MNT: {
2629                         struct inode_security_struct *root_isec;
2630                         root_isec = sb->s_root->d_inode->i_security;
2631
2632                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2633                                 goto out_bad_option;
2634                         break;
2635                 }
2636                 case DEFCONTEXT_MNT:
2637                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2638                                 goto out_bad_option;
2639                         break;
2640                 default:
2641                         goto out_free_opts;
2642                 }
2643         }
2644
2645         rc = 0;
2646 out_free_opts:
2647         security_free_mnt_opts(&opts);
2648 out_free_secdata:
2649         free_secdata(secdata);
2650         return rc;
2651 out_bad_option:
2652         printk(KERN_WARNING "SELinux: unable to change security options "
2653                "during remount (dev %s, type=%s)\n", sb->s_id,
2654                sb->s_type->name);
2655         goto out_free_opts;
2656 }
2657
2658 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2659 {
2660         const struct cred *cred = current_cred();
2661         struct common_audit_data ad;
2662         int rc;
2663
2664         rc = superblock_doinit(sb, data);
2665         if (rc)
2666                 return rc;
2667
2668         /* Allow all mounts performed by the kernel */
2669         if (flags & MS_KERNMOUNT)
2670                 return 0;
2671
2672         ad.type = LSM_AUDIT_DATA_DENTRY;
2673         ad.u.dentry = sb->s_root;
2674         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2675 }
2676
2677 static int selinux_sb_statfs(struct dentry *dentry)
2678 {
2679         const struct cred *cred = current_cred();
2680         struct common_audit_data ad;
2681
2682         ad.type = LSM_AUDIT_DATA_DENTRY;
2683         ad.u.dentry = dentry->d_sb->s_root;
2684         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2685 }
2686
2687 static int selinux_mount(const char *dev_name,
2688                          struct path *path,
2689                          const char *type,
2690                          unsigned long flags,
2691                          void *data)
2692 {
2693         const struct cred *cred = current_cred();
2694
2695         if (flags & MS_REMOUNT)
2696                 return superblock_has_perm(cred, path->dentry->d_sb,
2697                                            FILESYSTEM__REMOUNT, NULL);
2698         else
2699                 return path_has_perm(cred, path, FILE__MOUNTON);
2700 }
2701
2702 static int selinux_umount(struct vfsmount *mnt, int flags)
2703 {
2704         const struct cred *cred = current_cred();
2705
2706         return superblock_has_perm(cred, mnt->mnt_sb,
2707                                    FILESYSTEM__UNMOUNT, NULL);
2708 }
2709
2710 /* inode security operations */
2711
2712 static int selinux_inode_alloc_security(struct inode *inode)
2713 {
2714         return inode_alloc_security(inode);
2715 }
2716
2717 static void selinux_inode_free_security(struct inode *inode)
2718 {
2719         inode_free_security(inode);
2720 }
2721
2722 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2723                                         struct qstr *name, void **ctx,
2724                                         u32 *ctxlen)
2725 {
2726         const struct cred *cred = current_cred();
2727         struct task_security_struct *tsec;
2728         struct inode_security_struct *dsec;
2729         struct superblock_security_struct *sbsec;
2730         struct inode *dir = dentry->d_parent->d_inode;
2731         u32 newsid;
2732         int rc;
2733
2734         tsec = cred->security;
2735         dsec = dir->i_security;
2736         sbsec = dir->i_sb->s_security;
2737
2738         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2739                 newsid = tsec->create_sid;
2740         } else {
2741                 rc = security_transition_sid(tsec->sid, dsec->sid,
2742                                              inode_mode_to_security_class(mode),
2743                                              name,
2744                                              &newsid);
2745                 if (rc) {
2746                         printk(KERN_WARNING
2747                                 "%s: security_transition_sid failed, rc=%d\n",
2748                                __func__, -rc);
2749                         return rc;
2750                 }
2751         }
2752
2753         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2754 }
2755
2756 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2757                                        const struct qstr *qstr,
2758                                        const char **name,
2759                                        void **value, size_t *len)
2760 {
2761         const struct task_security_struct *tsec = current_security();
2762         struct inode_security_struct *dsec;
2763         struct superblock_security_struct *sbsec;
2764         u32 sid, newsid, clen;
2765         int rc;
2766         char *context;
2767
2768         dsec = dir->i_security;
2769         sbsec = dir->i_sb->s_security;
2770
2771         sid = tsec->sid;
2772         newsid = tsec->create_sid;
2773
2774         if ((sbsec->flags & SE_SBINITIALIZED) &&
2775             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2776                 newsid = sbsec->mntpoint_sid;
2777         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2778                 rc = security_transition_sid(sid, dsec->sid,
2779                                              inode_mode_to_security_class(inode->i_mode),
2780                                              qstr, &newsid);
2781                 if (rc) {
2782                         printk(KERN_WARNING "%s:  "
2783                                "security_transition_sid failed, rc=%d (dev=%s "
2784                                "ino=%ld)\n",
2785                                __func__,
2786                                -rc, inode->i_sb->s_id, inode->i_ino);
2787                         return rc;
2788                 }
2789         }
2790
2791         /* Possibly defer initialization to selinux_complete_init. */
2792         if (sbsec->flags & SE_SBINITIALIZED) {
2793                 struct inode_security_struct *isec = inode->i_security;
2794                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2795                 isec->sid = newsid;
2796                 isec->initialized = 1;
2797         }
2798
2799         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2800                 return -EOPNOTSUPP;
2801
2802         if (name)
2803                 *name = XATTR_SELINUX_SUFFIX;
2804
2805         if (value && len) {
2806                 rc = security_sid_to_context_force(newsid, &context, &clen);
2807                 if (rc)
2808                         return rc;
2809                 *value = context;
2810                 *len = clen;
2811         }
2812
2813         return 0;
2814 }
2815
2816 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2817 {
2818         return may_create(dir, dentry, SECCLASS_FILE);
2819 }
2820
2821 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2822 {
2823         return may_link(dir, old_dentry, MAY_LINK);
2824 }
2825
2826 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2827 {
2828         return may_link(dir, dentry, MAY_UNLINK);
2829 }
2830
2831 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2832 {
2833         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2834 }
2835
2836 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2837 {
2838         return may_create(dir, dentry, SECCLASS_DIR);
2839 }
2840
2841 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2842 {
2843         return may_link(dir, dentry, MAY_RMDIR);
2844 }
2845
2846 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2847 {
2848         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2849 }
2850
2851 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2852                                 struct inode *new_inode, struct dentry *new_dentry)
2853 {
2854         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2855 }
2856
2857 static int selinux_inode_readlink(struct dentry *dentry)
2858 {
2859         const struct cred *cred = current_cred();
2860
2861         return dentry_has_perm(cred, dentry, FILE__READ);
2862 }
2863
2864 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2865 {
2866         const struct cred *cred = current_cred();
2867
2868         return dentry_has_perm(cred, dentry, FILE__READ);
2869 }
2870
2871 static noinline int audit_inode_permission(struct inode *inode,
2872                                            u32 perms, u32 audited, u32 denied,
2873                                            int result,
2874                                            unsigned flags)
2875 {
2876         struct common_audit_data ad;
2877         struct inode_security_struct *isec = inode->i_security;
2878         int rc;
2879
2880         ad.type = LSM_AUDIT_DATA_INODE;
2881         ad.u.inode = inode;
2882
2883         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2884                             audited, denied, result, &ad, flags);
2885         if (rc)
2886                 return rc;
2887         return 0;
2888 }
2889
2890 static int selinux_inode_permission(struct inode *inode, int mask)
2891 {
2892         const struct cred *cred = current_cred();
2893         u32 perms;
2894         bool from_access;
2895         unsigned flags = mask & MAY_NOT_BLOCK;
2896         struct inode_security_struct *isec;
2897         u32 sid;
2898         struct av_decision avd;
2899         int rc, rc2;
2900         u32 audited, denied;
2901
2902         from_access = mask & MAY_ACCESS;
2903         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2904
2905         /* No permission to check.  Existence test. */
2906         if (!mask)
2907                 return 0;
2908
2909         validate_creds(cred);
2910
2911         if (unlikely(IS_PRIVATE(inode)))
2912                 return 0;
2913
2914         perms = file_mask_to_av(inode->i_mode, mask);
2915
2916         sid = cred_sid(cred);
2917         isec = inode->i_security;
2918
2919         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2920         audited = avc_audit_required(perms, &avd, rc,
2921                                      from_access ? FILE__AUDIT_ACCESS : 0,
2922                                      &denied);
2923         if (likely(!audited))
2924                 return rc;
2925
2926         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2927         if (rc2)
2928                 return rc2;
2929         return rc;
2930 }
2931
2932 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2933 {
2934         const struct cred *cred = current_cred();
2935         unsigned int ia_valid = iattr->ia_valid;
2936         __u32 av = FILE__WRITE;
2937
2938         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2939         if (ia_valid & ATTR_FORCE) {
2940                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2941                               ATTR_FORCE);
2942                 if (!ia_valid)
2943                         return 0;
2944         }
2945
2946         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2947                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2948                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2949
2950         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2951                 av |= FILE__OPEN;
2952
2953         return dentry_has_perm(cred, dentry, av);
2954 }
2955
2956 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2957 {
2958         const struct cred *cred = current_cred();
2959         struct path path;
2960
2961         path.dentry = dentry;
2962         path.mnt = mnt;
2963
2964         return path_has_perm(cred, &path, FILE__GETATTR);
2965 }
2966
2967 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2968 {
2969         const struct cred *cred = current_cred();
2970
2971         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2972                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2973                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2974                         if (!capable(CAP_SETFCAP))
2975                                 return -EPERM;
2976                 } else if (!capable(CAP_SYS_ADMIN)) {
2977                         /* A different attribute in the security namespace.
2978                            Restrict to administrator. */
2979                         return -EPERM;
2980                 }
2981         }
2982
2983         /* Not an attribute we recognize, so just check the
2984            ordinary setattr permission. */
2985         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2986 }
2987
2988 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2989                                   const void *value, size_t size, int flags)
2990 {
2991         struct inode *inode = dentry->d_inode;
2992         struct inode_security_struct *isec = inode->i_security;
2993         struct superblock_security_struct *sbsec;
2994         struct common_audit_data ad;
2995         u32 newsid, sid = current_sid();
2996         int rc = 0;
2997
2998         if (strcmp(name, XATTR_NAME_SELINUX))
2999                 return selinux_inode_setotherxattr(dentry, name);
3000
3001         sbsec = inode->i_sb->s_security;
3002         if (!(sbsec->flags & SBLABEL_MNT))
3003                 return -EOPNOTSUPP;
3004
3005         if (!inode_owner_or_capable(inode))
3006                 return -EPERM;
3007
3008         ad.type = LSM_AUDIT_DATA_DENTRY;
3009         ad.u.dentry = dentry;
3010
3011         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3012                           FILE__RELABELFROM, &ad);
3013         if (rc)
3014                 return rc;
3015
3016         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3017         if (rc == -EINVAL) {
3018                 if (!capable(CAP_MAC_ADMIN)) {
3019                         struct audit_buffer *ab;
3020                         size_t audit_size;
3021                         const char *str;
3022
3023                         /* We strip a nul only if it is at the end, otherwise the
3024                          * context contains a nul and we should audit that */
3025                         if (value) {
3026                                 str = value;
3027                                 if (str[size - 1] == '\0')
3028                                         audit_size = size - 1;
3029                                 else
3030                                         audit_size = size;
3031                         } else {
3032                                 str = "";
3033                                 audit_size = 0;
3034                         }
3035                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3036                         audit_log_format(ab, "op=setxattr invalid_context=");
3037                         audit_log_n_untrustedstring(ab, value, audit_size);
3038                         audit_log_end(ab);
3039
3040                         return rc;
3041                 }
3042                 rc = security_context_to_sid_force(value, size, &newsid);
3043         }
3044         if (rc)
3045                 return rc;
3046
3047         rc = avc_has_perm(sid, newsid, isec->sclass,
3048                           FILE__RELABELTO, &ad);
3049         if (rc)
3050                 return rc;
3051
3052         rc = security_validate_transition(isec->sid, newsid, sid,
3053                                           isec->sclass);
3054         if (rc)
3055                 return rc;
3056
3057         return avc_has_perm(newsid,
3058                             sbsec->sid,
3059                             SECCLASS_FILESYSTEM,
3060                             FILESYSTEM__ASSOCIATE,
3061                             &ad);
3062 }
3063
3064 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3065                                         const void *value, size_t size,
3066                                         int flags)
3067 {
3068         struct inode *inode = dentry->d_inode;
3069         struct inode_security_struct *isec = inode->i_security;
3070         u32 newsid;
3071         int rc;
3072
3073         if (strcmp(name, XATTR_NAME_SELINUX)) {
3074                 /* Not an attribute we recognize, so nothing to do. */
3075                 return;
3076         }
3077
3078         rc = security_context_to_sid_force(value, size, &newsid);
3079         if (rc) {
3080                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3081                        "for (%s, %lu), rc=%d\n",
3082                        inode->i_sb->s_id, inode->i_ino, -rc);
3083                 return;
3084         }
3085
3086         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3087         isec->sid = newsid;
3088         isec->initialized = 1;
3089
3090         return;
3091 }
3092
3093 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3094 {
3095         const struct cred *cred = current_cred();
3096
3097         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3098 }
3099
3100 static int selinux_inode_listxattr(struct dentry *dentry)
3101 {
3102         const struct cred *cred = current_cred();
3103
3104         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3105 }
3106
3107 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3108 {
3109         if (strcmp(name, XATTR_NAME_SELINUX))
3110                 return selinux_inode_setotherxattr(dentry, name);
3111
3112         /* No one is allowed to remove a SELinux security label.
3113            You can change the label, but all data must be labeled. */
3114         return -EACCES;
3115 }
3116
3117 /*
3118  * Copy the inode security context value to the user.
3119  *
3120  * Permission check is handled by selinux_inode_getxattr hook.
3121  */
3122 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3123 {
3124         u32 size;
3125         int error;
3126         char *context = NULL;
3127         struct inode_security_struct *isec = inode->i_security;
3128
3129         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3130                 return -EOPNOTSUPP;
3131
3132         /*
3133          * If the caller has CAP_MAC_ADMIN, then get the raw context
3134          * value even if it is not defined by current policy; otherwise,
3135          * use the in-core value under current policy.
3136          * Use the non-auditing forms of the permission checks since
3137          * getxattr may be called by unprivileged processes commonly
3138          * and lack of permission just means that we fall back to the
3139          * in-core context value, not a denial.
3140          */
3141         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3142                                 SECURITY_CAP_NOAUDIT);
3143         if (!error)
3144                 error = security_sid_to_context_force(isec->sid, &context,
3145                                                       &size);
3146         else
3147                 error = security_sid_to_context(isec->sid, &context, &size);
3148         if (error)
3149                 return error;
3150         error = size;
3151         if (alloc) {
3152                 *buffer = context;
3153                 goto out_nofree;
3154         }
3155         kfree(context);
3156 out_nofree:
3157         return error;
3158 }
3159
3160 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3161                                      const void *value, size_t size, int flags)
3162 {
3163         struct inode_security_struct *isec = inode->i_security;
3164         u32 newsid;
3165         int rc;
3166
3167         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3168                 return -EOPNOTSUPP;
3169
3170         if (!value || !size)
3171                 return -EACCES;
3172
3173         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3174         if (rc)
3175                 return rc;
3176
3177         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3178         isec->sid = newsid;
3179         isec->initialized = 1;
3180         return 0;
3181 }
3182
3183 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3184 {
3185         const int len = sizeof(XATTR_NAME_SELINUX);
3186         if (buffer && len <= buffer_size)
3187                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3188         return len;
3189 }
3190
3191 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3192 {
3193         struct inode_security_struct *isec = inode->i_security;
3194         *secid = isec->sid;
3195 }
3196
3197 /* file security operations */
3198
3199 static int selinux_revalidate_file_permission(struct file *file, int mask)
3200 {
3201         const struct cred *cred = current_cred();
3202         struct inode *inode = file_inode(file);
3203
3204         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3205         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3206                 mask |= MAY_APPEND;
3207
3208         return file_has_perm(cred, file,
3209                              file_mask_to_av(inode->i_mode, mask));
3210 }
3211
3212 static int selinux_file_permission(struct file *file, int mask)
3213 {
3214         struct inode *inode = file_inode(file);
3215         struct file_security_struct *fsec = file->f_security;
3216         struct inode_security_struct *isec = inode->i_security;
3217         u32 sid = current_sid();
3218
3219         if (!mask)
3220                 /* No permission to check.  Existence test. */
3221                 return 0;
3222
3223         if (sid == fsec->sid && fsec->isid == isec->sid &&
3224             fsec->pseqno == avc_policy_seqno())
3225                 /* No change since file_open check. */
3226                 return 0;
3227
3228         return selinux_revalidate_file_permission(file, mask);
3229 }
3230
3231 static int selinux_file_alloc_security(struct file *file)
3232 {
3233         return file_alloc_security(file);
3234 }
3235
3236 static void selinux_file_free_security(struct file *file)
3237 {
3238         file_free_security(file);
3239 }
3240
3241 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3242                               unsigned long arg)
3243 {
3244         const struct cred *cred = current_cred();
3245         int error = 0;
3246
3247         switch (cmd) {
3248         case FIONREAD:
3249         /* fall through */
3250         case FIBMAP:
3251         /* fall through */
3252         case FIGETBSZ:
3253         /* fall through */
3254         case FS_IOC_GETFLAGS:
3255         /* fall through */
3256         case FS_IOC_GETVERSION:
3257                 error = file_has_perm(cred, file, FILE__GETATTR);
3258                 break;
3259
3260         case FS_IOC_SETFLAGS:
3261         /* fall through */
3262         case FS_IOC_SETVERSION:
3263                 error = file_has_perm(cred, file, FILE__SETATTR);
3264                 break;
3265
3266         /* sys_ioctl() checks */
3267         case FIONBIO:
3268         /* fall through */
3269         case FIOASYNC:
3270                 error = file_has_perm(cred, file, 0);
3271                 break;
3272
3273         case KDSKBENT:
3274         case KDSKBSENT:
3275                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3276                                             SECURITY_CAP_AUDIT);
3277                 break;
3278
3279         /* default case assumes that the command will go
3280          * to the file's ioctl() function.
3281          */
3282         default:
3283                 error = file_has_perm(cred, file, FILE__IOCTL);
3284         }
3285         return error;
3286 }
3287
3288 static int default_noexec;
3289
3290 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3291 {
3292         const struct cred *cred = current_cred();
3293         int rc = 0;
3294
3295         if (default_noexec &&
3296             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3297                 /*
3298                  * We are making executable an anonymous mapping or a
3299                  * private file mapping that will also be writable.
3300                  * This has an additional check.
3301                  */
3302                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3303                 if (rc)
3304                         goto error;
3305         }
3306
3307         if (file) {
3308                 /* read access is always possible with a mapping */
3309                 u32 av = FILE__READ;
3310
3311                 /* write access only matters if the mapping is shared */
3312                 if (shared && (prot & PROT_WRITE))
3313                         av |= FILE__WRITE;
3314
3315                 if (prot & PROT_EXEC)
3316                         av |= FILE__EXECUTE;
3317
3318                 return file_has_perm(cred, file, av);
3319         }
3320
3321 error:
3322         return rc;
3323 }
3324
3325 static int selinux_mmap_addr(unsigned long addr)
3326 {
3327         int rc;
3328
3329         /* do DAC check on address space usage */
3330         rc = cap_mmap_addr(addr);
3331         if (rc)
3332                 return rc;
3333
3334         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3335                 u32 sid = current_sid();
3336                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3337                                   MEMPROTECT__MMAP_ZERO, NULL);
3338         }
3339
3340         return rc;
3341 }
3342
3343 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3344                              unsigned long prot, unsigned long flags)
3345 {
3346         if (selinux_checkreqprot)
3347                 prot = reqprot;
3348
3349         return file_map_prot_check(file, prot,
3350                                    (flags & MAP_TYPE) == MAP_SHARED);
3351 }
3352
3353 static int selinux_file_mprotect(struct vm_area_struct *vma,
3354                                  unsigned long reqprot,
3355                                  unsigned long prot)
3356 {
3357         const struct cred *cred = current_cred();
3358
3359         if (selinux_checkreqprot)
3360                 prot = reqprot;
3361
3362         if (default_noexec &&
3363             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3364                 int rc = 0;
3365                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3366                     vma->vm_end <= vma->vm_mm->brk) {
3367                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3368                 } else if (!vma->vm_file &&
3369                            vma->vm_start <= vma->vm_mm->start_stack &&
3370                            vma->vm_end >= vma->vm_mm->start_stack) {
3371                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3372                 } else if (vma->vm_file && vma->anon_vma) {
3373                         /*
3374                          * We are making executable a file mapping that has
3375                          * had some COW done. Since pages might have been
3376                          * written, check ability to execute the possibly
3377                          * modified content.  This typically should only
3378                          * occur for text relocations.
3379                          */
3380                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3381                 }
3382                 if (rc)
3383                         return rc;
3384         }
3385
3386         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3387 }
3388
3389 static int selinux_file_lock(struct file *file, unsigned int cmd)
3390 {
3391         const struct cred *cred = current_cred();
3392
3393         return file_has_perm(cred, file, FILE__LOCK);
3394 }
3395
3396 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3397                               unsigned long arg)
3398 {
3399         const struct cred *cred = current_cred();
3400         int err = 0;
3401
3402         switch (cmd) {
3403         case F_SETFL:
3404                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3405                         err = file_has_perm(cred, file, FILE__WRITE);
3406                         break;
3407                 }
3408                 /* fall through */
3409         case F_SETOWN:
3410         case F_SETSIG:
3411         case F_GETFL:
3412         case F_GETOWN:
3413         case F_GETSIG:
3414         case F_GETOWNER_UIDS:
3415                 /* Just check FD__USE permission */
3416                 err = file_has_perm(cred, file, 0);
3417                 break;
3418         case F_GETLK:
3419         case F_SETLK:
3420         case F_SETLKW:
3421         case F_OFD_GETLK:
3422         case F_OFD_SETLK:
3423         case F_OFD_SETLKW:
3424 #if BITS_PER_LONG == 32
3425         case F_GETLK64:
3426         case F_SETLK64:
3427         case F_SETLKW64:
3428 #endif
3429                 err = file_has_perm(cred, file, FILE__LOCK);
3430                 break;
3431         }
3432
3433         return err;
3434 }
3435
3436 static void selinux_file_set_fowner(struct file *file)
3437 {
3438         struct file_security_struct *fsec;
3439
3440         fsec = file->f_security;
3441         fsec->fown_sid = current_sid();
3442 }
3443
3444 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3445                                        struct fown_struct *fown, int signum)
3446 {
3447         struct file *file;
3448         u32 sid = task_sid(tsk);
3449         u32 perm;
3450         struct file_security_struct *fsec;
3451
3452         /* struct fown_struct is never outside the context of a struct file */
3453         file = container_of(fown, struct file, f_owner);
3454
3455         fsec = file->f_security;
3456
3457         if (!signum)
3458                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3459         else
3460                 perm = signal_to_av(signum);
3461
3462         return avc_has_perm(fsec->fown_sid, sid,
3463                             SECCLASS_PROCESS, perm, NULL);
3464 }
3465
3466 static int selinux_file_receive(struct file *file)
3467 {
3468         const struct cred *cred = current_cred();
3469
3470         return file_has_perm(cred, file, file_to_av(file));
3471 }
3472
3473 static int selinux_file_open(struct file *file, const struct cred *cred)
3474 {
3475         struct file_security_struct *fsec;
3476         struct inode_security_struct *isec;
3477
3478         fsec = file->f_security;
3479         isec = file_inode(file)->i_security;
3480         /*
3481          * Save inode label and policy sequence number
3482          * at open-time so that selinux_file_permission
3483          * can determine whether revalidation is necessary.
3484          * Task label is already saved in the file security
3485          * struct as its SID.
3486          */
3487         fsec->isid = isec->sid;
3488         fsec->pseqno = avc_policy_seqno();
3489         /*
3490          * Since the inode label or policy seqno may have changed
3491          * between the selinux_inode_permission check and the saving
3492          * of state above, recheck that access is still permitted.
3493          * Otherwise, access might never be revalidated against the
3494          * new inode label or new policy.
3495          * This check is not redundant - do not remove.
3496          */
3497         return file_path_has_perm(cred, file, open_file_to_av(file));
3498 }
3499
3500 /* task security operations */
3501
3502 static int selinux_task_create(unsigned long clone_flags)
3503 {
3504         return current_has_perm(current, PROCESS__FORK);
3505 }
3506
3507 /*
3508  * allocate the SELinux part of blank credentials
3509  */
3510 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3511 {
3512         struct task_security_struct *tsec;
3513
3514         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3515         if (!tsec)
3516                 return -ENOMEM;
3517
3518         cred->security = tsec;
3519         return 0;
3520 }
3521
3522 /*
3523  * detach and free the LSM part of a set of credentials
3524  */
3525 static void selinux_cred_free(struct cred *cred)
3526 {
3527         struct task_security_struct *tsec = cred->security;
3528
3529         /*
3530          * cred->security == NULL if security_cred_alloc_blank() or
3531          * security_prepare_creds() returned an error.
3532          */
3533         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3534         cred->security = (void *) 0x7UL;
3535         kfree(tsec);
3536 }
3537
3538 /*
3539  * prepare a new set of credentials for modification
3540  */
3541 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3542                                 gfp_t gfp)
3543 {
3544         const struct task_security_struct *old_tsec;
3545         struct task_security_struct *tsec;
3546
3547         old_tsec = old->security;
3548
3549         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3550         if (!tsec)
3551                 return -ENOMEM;
3552
3553         new->security = tsec;
3554         return 0;
3555 }
3556
3557 /*
3558  * transfer the SELinux data to a blank set of creds
3559  */
3560 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3561 {
3562         const struct task_security_struct *old_tsec = old->security;
3563         struct task_security_struct *tsec = new->security;
3564
3565         *tsec = *old_tsec;
3566 }
3567
3568 /*
3569  * set the security data for a kernel service
3570  * - all the creation contexts are set to unlabelled
3571  */
3572 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3573 {
3574         struct task_security_struct *tsec = new->security;
3575         u32 sid = current_sid();
3576         int ret;
3577
3578         ret = avc_has_perm(sid, secid,
3579                            SECCLASS_KERNEL_SERVICE,
3580                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3581                            NULL);
3582         if (ret == 0) {
3583                 tsec->sid = secid;
3584                 tsec->create_sid = 0;
3585                 tsec->keycreate_sid = 0;
3586                 tsec->sockcreate_sid = 0;
3587         }
3588         return ret;
3589 }
3590
3591 /*
3592  * set the file creation context in a security record to the same as the
3593  * objective context of the specified inode
3594  */
3595 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3596 {
3597         struct inode_security_struct *isec = inode->i_security;
3598         struct task_security_struct *tsec = new->security;
3599         u32 sid = current_sid();
3600         int ret;
3601
3602         ret = avc_has_perm(sid, isec->sid,
3603                            SECCLASS_KERNEL_SERVICE,
3604                            KERNEL_SERVICE__CREATE_FILES_AS,
3605                            NULL);
3606
3607         if (ret == 0)
3608                 tsec->create_sid = isec->sid;
3609         return ret;
3610 }
3611
3612 static int selinux_kernel_module_request(char *kmod_name)
3613 {
3614         u32 sid;
3615         struct common_audit_data ad;
3616
3617         sid = task_sid(current);
3618
3619         ad.type = LSM_AUDIT_DATA_KMOD;
3620         ad.u.kmod_name = kmod_name;
3621
3622         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3623                             SYSTEM__MODULE_REQUEST, &ad);
3624 }
3625
3626 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3627 {
3628         return current_has_perm(p, PROCESS__SETPGID);
3629 }
3630
3631 static int selinux_task_getpgid(struct task_struct *p)
3632 {
3633         return current_has_perm(p, PROCESS__GETPGID);
3634 }
3635
3636 static int selinux_task_getsid(struct task_struct *p)
3637 {
3638         return current_has_perm(p, PROCESS__GETSESSION);
3639 }
3640
3641 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3642 {
3643         *secid = task_sid(p);
3644 }
3645
3646 static int selinux_task_setnice(struct task_struct *p, int nice)
3647 {
3648         int rc;
3649
3650         rc = cap_task_setnice(p, nice);
3651         if (rc)
3652                 return rc;
3653
3654         return current_has_perm(p, PROCESS__SETSCHED);
3655 }
3656
3657 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3658 {
3659         int rc;
3660
3661         rc = cap_task_setioprio(p, ioprio);
3662         if (rc)
3663                 return rc;
3664
3665         return current_has_perm(p, PROCESS__SETSCHED);
3666 }
3667
3668 static int selinux_task_getioprio(struct task_struct *p)
3669 {
3670         return current_has_perm(p, PROCESS__GETSCHED);
3671 }
3672
3673 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3674                 struct rlimit *new_rlim)
3675 {
3676         struct rlimit *old_rlim = p->signal->rlim + resource;
3677
3678         /* Control the ability to change the hard limit (whether
3679            lowering or raising it), so that the hard limit can
3680            later be used as a safe reset point for the soft limit
3681            upon context transitions.  See selinux_bprm_committing_creds. */
3682         if (old_rlim->rlim_max != new_rlim->rlim_max)
3683                 return current_has_perm(p, PROCESS__SETRLIMIT);
3684
3685         return 0;
3686 }
3687
3688 static int selinux_task_setscheduler(struct task_struct *p)
3689 {
3690         int rc;
3691
3692         rc = cap_task_setscheduler(p);
3693         if (rc)
3694                 return rc;
3695
3696         return current_has_perm(p, PROCESS__SETSCHED);
3697 }
3698
3699 static int selinux_task_getscheduler(struct task_struct *p)
3700 {
3701         return current_has_perm(p, PROCESS__GETSCHED);
3702 }
3703
3704 static int selinux_task_movememory(struct task_struct *p)
3705 {
3706         return current_has_perm(p, PROCESS__SETSCHED);
3707 }
3708
3709 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3710                                 int sig, u32 secid)
3711 {
3712         u32 perm;
3713         int rc;
3714
3715         if (!sig)
3716                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3717         else
3718                 perm = signal_to_av(sig);
3719         if (secid)
3720                 rc = avc_has_perm(secid, task_sid(p),
3721                                   SECCLASS_PROCESS, perm, NULL);
3722         else
3723                 rc = current_has_perm(p, perm);
3724         return rc;
3725 }
3726
3727 static int selinux_task_wait(struct task_struct *p)
3728 {
3729         return task_has_perm(p, current, PROCESS__SIGCHLD);
3730 }
3731
3732 static void selinux_task_to_inode(struct task_struct *p,
3733                                   struct inode *inode)
3734 {
3735         struct inode_security_struct *isec = inode->i_security;
3736         u32 sid = task_sid(p);
3737
3738         isec->sid = sid;
3739         isec->initialized = 1;
3740 }
3741
3742 /* Returns error only if unable to parse addresses */
3743 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3744                         struct common_audit_data *ad, u8 *proto)
3745 {
3746         int offset, ihlen, ret = -EINVAL;
3747         struct iphdr _iph, *ih;
3748
3749         offset = skb_network_offset(skb);
3750         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3751         if (ih == NULL)
3752                 goto out;
3753
3754         ihlen = ih->ihl * 4;
3755         if (ihlen < sizeof(_iph))
3756                 goto out;
3757
3758         ad->u.net->v4info.saddr = ih->saddr;
3759         ad->u.net->v4info.daddr = ih->daddr;
3760         ret = 0;
3761
3762         if (proto)
3763                 *proto = ih->protocol;
3764
3765         switch (ih->protocol) {
3766         case IPPROTO_TCP: {
3767                 struct tcphdr _tcph, *th;
3768
3769                 if (ntohs(ih->frag_off) & IP_OFFSET)
3770                         break;
3771
3772                 offset += ihlen;
3773                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3774                 if (th == NULL)
3775                         break;
3776
3777                 ad->u.net->sport = th->source;
3778                 ad->u.net->dport = th->dest;
3779                 break;
3780         }
3781
3782         case IPPROTO_UDP: {
3783                 struct udphdr _udph, *uh;
3784
3785                 if (ntohs(ih->frag_off) & IP_OFFSET)
3786                         break;
3787
3788                 offset += ihlen;
3789                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3790                 if (uh == NULL)
3791                         break;
3792
3793                 ad->u.net->sport = uh->source;
3794                 ad->u.net->dport = uh->dest;
3795                 break;
3796         }
3797
3798         case IPPROTO_DCCP: {
3799                 struct dccp_hdr _dccph, *dh;
3800
3801                 if (ntohs(ih->frag_off) & IP_OFFSET)
3802                         break;
3803
3804                 offset += ihlen;
3805                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3806                 if (dh == NULL)
3807                         break;
3808
3809                 ad->u.net->sport = dh->dccph_sport;
3810                 ad->u.net->dport = dh->dccph_dport;
3811                 break;
3812         }
3813
3814         default:
3815                 break;
3816         }
3817 out:
3818         return ret;
3819 }
3820
3821 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3822
3823 /* Returns error only if unable to parse addresses */
3824 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3825                         struct common_audit_data *ad, u8 *proto)
3826 {
3827         u8 nexthdr;
3828         int ret = -EINVAL, offset;
3829         struct ipv6hdr _ipv6h, *ip6;
3830         __be16 frag_off;
3831
3832         offset = skb_network_offset(skb);
3833         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3834         if (ip6 == NULL)
3835                 goto out;
3836
3837         ad->u.net->v6info.saddr = ip6->saddr;
3838         ad->u.net->v6info.daddr = ip6->daddr;
3839         ret = 0;
3840
3841         nexthdr = ip6->nexthdr;
3842         offset += sizeof(_ipv6h);
3843         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3844         if (offset < 0)
3845                 goto out;
3846
3847         if (proto)
3848                 *proto = nexthdr;
3849
3850         switch (nexthdr) {
3851         case IPPROTO_TCP: {
3852                 struct tcphdr _tcph, *th;
3853
3854                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3855                 if (th == NULL)
3856                         break;
3857
3858                 ad->u.net->sport = th->source;
3859                 ad->u.net->dport = th->dest;
3860                 break;
3861         }
3862
3863         case IPPROTO_UDP: {
3864                 struct udphdr _udph, *uh;
3865
3866                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3867                 if (uh == NULL)
3868                         break;
3869
3870                 ad->u.net->sport = uh->source;
3871                 ad->u.net->dport = uh->dest;
3872                 break;
3873         }
3874
3875         case IPPROTO_DCCP: {
3876                 struct dccp_hdr _dccph, *dh;
3877
3878                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3879                 if (dh == NULL)
3880                         break;
3881
3882                 ad->u.net->sport = dh->dccph_sport;
3883                 ad->u.net->dport = dh->dccph_dport;
3884                 break;
3885         }
3886
3887         /* includes fragments */
3888         default:
3889                 break;
3890         }
3891 out:
3892         return ret;
3893 }
3894
3895 #endif /* IPV6 */
3896
3897 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3898                              char **_addrp, int src, u8 *proto)
3899 {
3900         char *addrp;
3901         int ret;
3902
3903         switch (ad->u.net->family) {
3904         case PF_INET:
3905                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3906                 if (ret)
3907                         goto parse_error;
3908                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3909                                        &ad->u.net->v4info.daddr);
3910                 goto okay;
3911
3912 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3913         case PF_INET6:
3914                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3915                 if (ret)
3916                         goto parse_error;
3917                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3918                                        &ad->u.net->v6info.daddr);
3919                 goto okay;
3920 #endif  /* IPV6 */
3921         default:
3922                 addrp = NULL;
3923                 goto okay;
3924         }
3925
3926 parse_error:
3927         printk(KERN_WARNING
3928                "SELinux: failure in selinux_parse_skb(),"
3929                " unable to parse packet\n");
3930         return ret;
3931
3932 okay:
3933         if (_addrp)
3934                 *_addrp = addrp;
3935         return 0;
3936 }
3937
3938 /**
3939  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3940  * @skb: the packet
3941  * @family: protocol family
3942  * @sid: the packet's peer label SID
3943  *
3944  * Description:
3945  * Check the various different forms of network peer labeling and determine
3946  * the peer label/SID for the packet; most of the magic actually occurs in
3947  * the security server function security_net_peersid_cmp().  The function
3948  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3949  * or -EACCES if @sid is invalid due to inconsistencies with the different
3950  * peer labels.
3951  *
3952  */
3953 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3954 {
3955         int err;
3956         u32 xfrm_sid;
3957         u32 nlbl_sid;
3958         u32 nlbl_type;
3959
3960         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3961         if (unlikely(err))
3962                 return -EACCES;
3963         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3964         if (unlikely(err))
3965                 return -EACCES;
3966
3967         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3968         if (unlikely(err)) {
3969                 printk(KERN_WARNING
3970                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3971                        " unable to determine packet's peer label\n");
3972                 return -EACCES;
3973         }
3974
3975         return 0;
3976 }
3977
3978 /**
3979  * selinux_conn_sid - Determine the child socket label for a connection
3980  * @sk_sid: the parent socket's SID
3981  * @skb_sid: the packet's SID
3982  * @conn_sid: the resulting connection SID
3983  *
3984  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3985  * combined with the MLS information from @skb_sid in order to create
3986  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3987  * of @sk_sid.  Returns zero on success, negative values on failure.
3988  *
3989  */
3990 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3991 {
3992         int err = 0;
3993
3994         if (skb_sid != SECSID_NULL)
3995                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3996         else
3997                 *conn_sid = sk_sid;
3998
3999         return err;
4000 }
4001
4002 /* socket security operations */
4003
4004 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4005                                  u16 secclass, u32 *socksid)
4006 {
4007         if (tsec->sockcreate_sid > SECSID_NULL) {
4008                 *socksid = tsec->sockcreate_sid;
4009                 return 0;
4010         }
4011
4012         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4013                                        socksid);
4014 }
4015
4016 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4017 {
4018         struct sk_security_struct *sksec = sk->sk_security;
4019         struct common_audit_data ad;
4020         struct lsm_network_audit net = {0,};
4021         u32 tsid = task_sid(task);
4022
4023         if (sksec->sid == SECINITSID_KERNEL)
4024                 return 0;
4025
4026         ad.type = LSM_AUDIT_DATA_NET;
4027         ad.u.net = &net;
4028         ad.u.net->sk = sk;
4029
4030         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4031 }
4032
4033 static int selinux_socket_create(int family, int type,
4034                                  int protocol, int kern)
4035 {
4036         const struct task_security_struct *tsec = current_security();
4037         u32 newsid;
4038         u16 secclass;
4039         int rc;
4040
4041         if (kern)
4042                 return 0;
4043
4044         secclass = socket_type_to_security_class(family, type, protocol);
4045         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4046         if (rc)
4047                 return rc;
4048
4049         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4050 }
4051
4052 static int selinux_socket_post_create(struct socket *sock, int family,
4053                                       int type, int protocol, int kern)
4054 {
4055         const struct task_security_struct *tsec = current_security();
4056         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4057         struct sk_security_struct *sksec;
4058         int err = 0;
4059
4060         isec->sclass = socket_type_to_security_class(family, type, protocol);
4061
4062         if (kern)
4063                 isec->sid = SECINITSID_KERNEL;
4064         else {
4065                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4066                 if (err)
4067                         return err;
4068         }
4069
4070         isec->initialized = 1;
4071
4072         if (sock->sk) {
4073                 sksec = sock->sk->sk_security;
4074                 sksec->sid = isec->sid;
4075                 sksec->sclass = isec->sclass;
4076                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4077         }
4078
4079         return err;
4080 }
4081
4082 /* Range of port numbers used to automatically bind.
4083    Need to determine whether we should perform a name_bind
4084    permission check between the socket and the port number. */
4085
4086 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4087 {
4088         struct sock *sk = sock->sk;
4089         u16 family;
4090         int err;
4091
4092         err = sock_has_perm(current, sk, SOCKET__BIND);
4093         if (err)
4094                 goto out;
4095
4096         /*
4097          * If PF_INET or PF_INET6, check name_bind permission for the port.
4098          * Multiple address binding for SCTP is not supported yet: we just
4099          * check the first address now.
4100          */
4101         family = sk->sk_family;
4102         if (family == PF_INET || family == PF_INET6) {
4103                 char *addrp;
4104                 struct sk_security_struct *sksec = sk->sk_security;
4105                 struct common_audit_data ad;
4106                 struct lsm_network_audit net = {0,};
4107                 struct sockaddr_in *addr4 = NULL;
4108                 struct sockaddr_in6 *addr6 = NULL;
4109                 unsigned short snum;
4110                 u32 sid, node_perm;
4111
4112                 if (family == PF_INET) {
4113                         addr4 = (struct sockaddr_in *)address;
4114                         snum = ntohs(addr4->sin_port);
4115                         addrp = (char *)&addr4->sin_addr.s_addr;
4116                 } else {
4117                         addr6 = (struct sockaddr_in6 *)address;
4118                         snum = ntohs(addr6->sin6_port);
4119                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4120                 }
4121
4122                 if (snum) {
4123                         int low, high;
4124
4125                         inet_get_local_port_range(sock_net(sk), &low, &high);
4126
4127                         if (snum < max(PROT_SOCK, low) || snum > high) {
4128                                 err = sel_netport_sid(sk->sk_protocol,
4129                                                       snum, &sid);
4130                                 if (err)
4131                                         goto out;
4132                                 ad.type = LSM_AUDIT_DATA_NET;
4133                                 ad.u.net = &net;
4134                                 ad.u.net->sport = htons(snum);
4135                                 ad.u.net->family = family;
4136                                 err = avc_has_perm(sksec->sid, sid,
4137                                                    sksec->sclass,
4138                                                    SOCKET__NAME_BIND, &ad);
4139                                 if (err)
4140                                         goto out;
4141                         }
4142                 }
4143
4144                 switch (sksec->sclass) {
4145                 case SECCLASS_TCP_SOCKET:
4146                         node_perm = TCP_SOCKET__NODE_BIND;
4147                         break;
4148
4149                 case SECCLASS_UDP_SOCKET:
4150                         node_perm = UDP_SOCKET__NODE_BIND;
4151                         break;
4152
4153                 case SECCLASS_DCCP_SOCKET:
4154                         node_perm = DCCP_SOCKET__NODE_BIND;
4155                         break;
4156
4157                 default:
4158                         node_perm = RAWIP_SOCKET__NODE_BIND;
4159                         break;
4160                 }
4161
4162                 err = sel_netnode_sid(addrp, family, &sid);
4163                 if (err)
4164                         goto out;
4165
4166                 ad.type = LSM_AUDIT_DATA_NET;
4167                 ad.u.net = &net;
4168                 ad.u.net->sport = htons(snum);
4169                 ad.u.net->family = family;
4170
4171                 if (family == PF_INET)
4172                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4173                 else
4174                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4175
4176                 err = avc_has_perm(sksec->sid, sid,
4177                                    sksec->sclass, node_perm, &ad);
4178                 if (err)
4179                         goto out;
4180         }
4181 out:
4182         return err;
4183 }
4184
4185 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4186 {
4187         struct sock *sk = sock->sk;
4188         struct sk_security_struct *sksec = sk->sk_security;
4189         int err;
4190
4191         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4192         if (err)
4193                 return err;
4194
4195         /*
4196          * If a TCP or DCCP socket, check name_connect permission for the port.
4197          */
4198         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4199             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4200                 struct common_audit_data ad;
4201                 struct lsm_network_audit net = {0,};
4202                 struct sockaddr_in *addr4 = NULL;
4203                 struct sockaddr_in6 *addr6 = NULL;
4204                 unsigned short snum;
4205                 u32 sid, perm;
4206
4207                 if (sk->sk_family == PF_INET) {
4208                         addr4 = (struct sockaddr_in *)address;
4209                         if (addrlen < sizeof(struct sockaddr_in))
4210                                 return -EINVAL;
4211                         snum = ntohs(addr4->sin_port);
4212                 } else {
4213                         addr6 = (struct sockaddr_in6 *)address;
4214                         if (addrlen < SIN6_LEN_RFC2133)
4215                                 return -EINVAL;
4216                         snum = ntohs(addr6->sin6_port);
4217                 }
4218
4219                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4220                 if (err)
4221                         goto out;
4222
4223                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4224                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4225
4226                 ad.type = LSM_AUDIT_DATA_NET;
4227                 ad.u.net = &net;
4228                 ad.u.net->dport = htons(snum);
4229                 ad.u.net->family = sk->sk_family;
4230                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4231                 if (err)
4232                         goto out;
4233         }
4234
4235         err = selinux_netlbl_socket_connect(sk, address);
4236
4237 out:
4238         return err;
4239 }
4240
4241 static int selinux_socket_listen(struct socket *sock, int backlog)
4242 {
4243         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4244 }
4245
4246 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4247 {
4248         int err;
4249         struct inode_security_struct *isec;
4250         struct inode_security_struct *newisec;
4251
4252         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4253         if (err)
4254                 return err;
4255
4256         newisec = SOCK_INODE(newsock)->i_security;
4257
4258         isec = SOCK_INODE(sock)->i_security;
4259         newisec->sclass = isec->sclass;
4260         newisec->sid = isec->sid;
4261         newisec->initialized = 1;
4262
4263         return 0;
4264 }
4265
4266 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4267                                   int size)
4268 {
4269         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4270 }
4271
4272 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4273                                   int size, int flags)
4274 {
4275         return sock_has_perm(current, sock->sk, SOCKET__READ);
4276 }
4277
4278 static int selinux_socket_getsockname(struct socket *sock)
4279 {
4280         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4281 }
4282
4283 static int selinux_socket_getpeername(struct socket *sock)
4284 {
4285         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4286 }
4287
4288 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4289 {
4290         int err;
4291
4292         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4293         if (err)
4294                 return err;
4295
4296         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4297 }
4298
4299 static int selinux_socket_getsockopt(struct socket *sock, int level,
4300                                      int optname)
4301 {
4302         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4303 }
4304
4305 static int selinux_socket_shutdown(struct socket *sock, int how)
4306 {
4307         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4308 }
4309
4310 static int selinux_socket_unix_stream_connect(struct sock *sock,
4311                                               struct sock *other,
4312                                               struct sock *newsk)
4313 {
4314         struct sk_security_struct *sksec_sock = sock->sk_security;
4315         struct sk_security_struct *sksec_other = other->sk_security;
4316         struct sk_security_struct *sksec_new = newsk->sk_security;
4317         struct common_audit_data ad;
4318         struct lsm_network_audit net = {0,};
4319         int err;
4320
4321         ad.type = LSM_AUDIT_DATA_NET;
4322         ad.u.net = &net;
4323         ad.u.net->sk = other;
4324
4325         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4326                            sksec_other->sclass,
4327                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4328         if (err)
4329                 return err;
4330
4331         /* server child socket */
4332         sksec_new->peer_sid = sksec_sock->sid;
4333         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4334                                     &sksec_new->sid);
4335         if (err)
4336                 return err;
4337
4338         /* connecting socket */
4339         sksec_sock->peer_sid = sksec_new->sid;
4340
4341         return 0;
4342 }
4343
4344 static int selinux_socket_unix_may_send(struct socket *sock,
4345                                         struct socket *other)
4346 {
4347         struct sk_security_struct *ssec = sock->sk->sk_security;
4348         struct sk_security_struct *osec = other->sk->sk_security;
4349         struct common_audit_data ad;
4350         struct lsm_network_audit net = {0,};
4351
4352         ad.type = LSM_AUDIT_DATA_NET;
4353         ad.u.net = &net;
4354         ad.u.net->sk = other->sk;
4355
4356         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4357                             &ad);
4358 }
4359
4360 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4361                                     char *addrp, u16 family, u32 peer_sid,
4362                                     struct common_audit_data *ad)
4363 {
4364         int err;
4365         u32 if_sid;
4366         u32 node_sid;
4367
4368         err = sel_netif_sid(ns, ifindex, &if_sid);
4369         if (err)
4370                 return err;
4371         err = avc_has_perm(peer_sid, if_sid,
4372                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4373         if (err)
4374                 return err;
4375
4376         err = sel_netnode_sid(addrp, family, &node_sid);
4377         if (err)
4378                 return err;
4379         return avc_has_perm(peer_sid, node_sid,
4380                             SECCLASS_NODE, NODE__RECVFROM, ad);
4381 }
4382
4383 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4384                                        u16 family)
4385 {
4386         int err = 0;
4387         struct sk_security_struct *sksec = sk->sk_security;
4388         u32 sk_sid = sksec->sid;
4389         struct common_audit_data ad;
4390         struct lsm_network_audit net = {0,};
4391         char *addrp;
4392
4393         ad.type = LSM_AUDIT_DATA_NET;
4394         ad.u.net = &net;
4395         ad.u.net->netif = skb->skb_iif;
4396         ad.u.net->family = family;
4397         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4398         if (err)
4399                 return err;
4400
4401         if (selinux_secmark_enabled()) {
4402                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4403                                    PACKET__RECV, &ad);
4404                 if (err)
4405                         return err;
4406         }
4407
4408         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4409         if (err)
4410                 return err;
4411         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4412
4413         return err;
4414 }
4415
4416 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4417 {
4418         int err;
4419         struct sk_security_struct *sksec = sk->sk_security;
4420         u16 family = sk->sk_family;
4421         u32 sk_sid = sksec->sid;
4422         struct common_audit_data ad;
4423         struct lsm_network_audit net = {0,};
4424         char *addrp;
4425         u8 secmark_active;
4426         u8 peerlbl_active;
4427
4428         if (family != PF_INET && family != PF_INET6)
4429                 return 0;
4430
4431         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4432         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4433                 family = PF_INET;
4434
4435         /* If any sort of compatibility mode is enabled then handoff processing
4436          * to the selinux_sock_rcv_skb_compat() function to deal with the
4437          * special handling.  We do this in an attempt to keep this function
4438          * as fast and as clean as possible. */
4439         if (!selinux_policycap_netpeer)
4440                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4441
4442         secmark_active = selinux_secmark_enabled();
4443         peerlbl_active = selinux_peerlbl_enabled();
4444         if (!secmark_active && !peerlbl_active)
4445                 return 0;
4446
4447         ad.type = LSM_AUDIT_DATA_NET;
4448         ad.u.net = &net;
4449         ad.u.net->netif = skb->skb_iif;
4450         ad.u.net->family = family;
4451         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4452         if (err)
4453                 return err;
4454
4455         if (peerlbl_active) {
4456                 u32 peer_sid;
4457
4458                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4459                 if (err)
4460                         return err;
4461                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4462                                                addrp, family, peer_sid, &ad);
4463                 if (err) {
4464                         selinux_netlbl_err(skb, err, 0);
4465                         return err;
4466                 }
4467                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4468                                    PEER__RECV, &ad);
4469                 if (err) {
4470                         selinux_netlbl_err(skb, err, 0);
4471                         return err;
4472                 }
4473         }
4474
4475         if (secmark_active) {
4476                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4477                                    PACKET__RECV, &ad);
4478                 if (err)
4479                         return err;
4480         }
4481
4482         return err;
4483 }
4484
4485 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4486                                             int __user *optlen, unsigned len)
4487 {
4488         int err = 0;
4489         char *scontext;
4490         u32 scontext_len;
4491         struct sk_security_struct *sksec = sock->sk->sk_security;
4492         u32 peer_sid = SECSID_NULL;
4493
4494         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4495             sksec->sclass == SECCLASS_TCP_SOCKET)
4496                 peer_sid = sksec->peer_sid;
4497         if (peer_sid == SECSID_NULL)
4498                 return -ENOPROTOOPT;
4499
4500         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4501         if (err)
4502                 return err;
4503
4504         if (scontext_len > len) {
4505                 err = -ERANGE;
4506                 goto out_len;
4507         }
4508
4509         if (copy_to_user(optval, scontext, scontext_len))
4510                 err = -EFAULT;
4511
4512 out_len:
4513         if (put_user(scontext_len, optlen))
4514                 err = -EFAULT;
4515         kfree(scontext);
4516         return err;
4517 }
4518
4519 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4520 {
4521         u32 peer_secid = SECSID_NULL;
4522         u16 family;
4523
4524         if (skb && skb->protocol == htons(ETH_P_IP))
4525                 family = PF_INET;
4526         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4527                 family = PF_INET6;
4528         else if (sock)
4529                 family = sock->sk->sk_family;
4530         else
4531                 goto out;
4532
4533         if (sock && family == PF_UNIX)
4534                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4535         else if (skb)
4536                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4537
4538 out:
4539         *secid = peer_secid;
4540         if (peer_secid == SECSID_NULL)
4541                 return -EINVAL;
4542         return 0;
4543 }
4544
4545 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4546 {
4547         struct sk_security_struct *sksec;
4548
4549         sksec = kzalloc(sizeof(*sksec), priority);
4550         if (!sksec)
4551                 return -ENOMEM;
4552
4553         sksec->peer_sid = SECINITSID_UNLABELED;
4554         sksec->sid = SECINITSID_UNLABELED;
4555         selinux_netlbl_sk_security_reset(sksec);
4556         sk->sk_security = sksec;
4557
4558         return 0;
4559 }
4560
4561 static void selinux_sk_free_security(struct sock *sk)
4562 {
4563         struct sk_security_struct *sksec = sk->sk_security;
4564
4565         sk->sk_security = NULL;
4566         selinux_netlbl_sk_security_free(sksec);
4567         kfree(sksec);
4568 }
4569
4570 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4571 {
4572         struct sk_security_struct *sksec = sk->sk_security;
4573         struct sk_security_struct *newsksec = newsk->sk_security;
4574
4575         newsksec->sid = sksec->sid;
4576         newsksec->peer_sid = sksec->peer_sid;
4577         newsksec->sclass = sksec->sclass;
4578
4579         selinux_netlbl_sk_security_reset(newsksec);
4580 }
4581
4582 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4583 {
4584         if (!sk)
4585                 *secid = SECINITSID_ANY_SOCKET;
4586         else {
4587                 struct sk_security_struct *sksec = sk->sk_security;
4588
4589                 *secid = sksec->sid;
4590         }
4591 }
4592
4593 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4594 {
4595         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4596         struct sk_security_struct *sksec = sk->sk_security;
4597
4598         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4599             sk->sk_family == PF_UNIX)
4600                 isec->sid = sksec->sid;
4601         sksec->sclass = isec->sclass;
4602 }
4603
4604 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4605                                      struct request_sock *req)
4606 {
4607         struct sk_security_struct *sksec = sk->sk_security;
4608         int err;
4609         u16 family = req->rsk_ops->family;
4610         u32 connsid;
4611         u32 peersid;
4612
4613         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4614         if (err)
4615                 return err;
4616         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4617         if (err)
4618                 return err;
4619         req->secid = connsid;
4620         req->peer_secid = peersid;
4621
4622         return selinux_netlbl_inet_conn_request(req, family);
4623 }
4624
4625 static void selinux_inet_csk_clone(struct sock *newsk,
4626                                    const struct request_sock *req)
4627 {
4628         struct sk_security_struct *newsksec = newsk->sk_security;
4629
4630         newsksec->sid = req->secid;
4631         newsksec->peer_sid = req->peer_secid;
4632         /* NOTE: Ideally, we should also get the isec->sid for the
4633            new socket in sync, but we don't have the isec available yet.
4634            So we will wait until sock_graft to do it, by which
4635            time it will have been created and available. */
4636
4637         /* We don't need to take any sort of lock here as we are the only
4638          * thread with access to newsksec */
4639         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4640 }
4641
4642 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4643 {
4644         u16 family = sk->sk_family;
4645         struct sk_security_struct *sksec = sk->sk_security;
4646
4647         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4648         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4649                 family = PF_INET;
4650
4651         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4652 }
4653
4654 static int selinux_secmark_relabel_packet(u32 sid)
4655 {
4656         const struct task_security_struct *__tsec;
4657         u32 tsid;
4658
4659         __tsec = current_security();
4660         tsid = __tsec->sid;
4661
4662         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4663 }
4664
4665 static void selinux_secmark_refcount_inc(void)
4666 {
4667         atomic_inc(&selinux_secmark_refcount);
4668 }
4669
4670 static void selinux_secmark_refcount_dec(void)
4671 {
4672         atomic_dec(&selinux_secmark_refcount);
4673 }
4674
4675 static void selinux_req_classify_flow(const struct request_sock *req,
4676                                       struct flowi *fl)
4677 {
4678         fl->flowi_secid = req->secid;
4679 }
4680
4681 static int selinux_tun_dev_alloc_security(void **security)
4682 {
4683         struct tun_security_struct *tunsec;
4684
4685         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4686         if (!tunsec)
4687                 return -ENOMEM;
4688         tunsec->sid = current_sid();
4689
4690         *security = tunsec;
4691         return 0;
4692 }
4693
4694 static void selinux_tun_dev_free_security(void *security)
4695 {
4696         kfree(security);
4697 }
4698
4699 static int selinux_tun_dev_create(void)
4700 {
4701         u32 sid = current_sid();
4702
4703         /* we aren't taking into account the "sockcreate" SID since the socket
4704          * that is being created here is not a socket in the traditional sense,
4705          * instead it is a private sock, accessible only to the kernel, and
4706          * representing a wide range of network traffic spanning multiple
4707          * connections unlike traditional sockets - check the TUN driver to
4708          * get a better understanding of why this socket is special */
4709
4710         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4711                             NULL);
4712 }
4713
4714 static int selinux_tun_dev_attach_queue(void *security)
4715 {
4716         struct tun_security_struct *tunsec = security;
4717
4718         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4719                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4720 }
4721
4722 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4723 {
4724         struct tun_security_struct *tunsec = security;
4725         struct sk_security_struct *sksec = sk->sk_security;
4726
4727         /* we don't currently perform any NetLabel based labeling here and it
4728          * isn't clear that we would want to do so anyway; while we could apply
4729          * labeling without the support of the TUN user the resulting labeled
4730          * traffic from the other end of the connection would almost certainly
4731          * cause confusion to the TUN user that had no idea network labeling
4732          * protocols were being used */
4733
4734         sksec->sid = tunsec->sid;
4735         sksec->sclass = SECCLASS_TUN_SOCKET;
4736
4737         return 0;
4738 }
4739
4740 static int selinux_tun_dev_open(void *security)
4741 {
4742         struct tun_security_struct *tunsec = security;
4743         u32 sid = current_sid();
4744         int err;
4745
4746         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4747                            TUN_SOCKET__RELABELFROM, NULL);
4748         if (err)
4749                 return err;
4750         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4751                            TUN_SOCKET__RELABELTO, NULL);
4752         if (err)
4753                 return err;
4754         tunsec->sid = sid;
4755
4756         return 0;
4757 }
4758
4759 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4760 {
4761         int err = 0;
4762         u32 perm;
4763         struct nlmsghdr *nlh;
4764         struct sk_security_struct *sksec = sk->sk_security;
4765
4766         if (skb->len < NLMSG_HDRLEN) {
4767                 err = -EINVAL;
4768                 goto out;
4769         }
4770         nlh = nlmsg_hdr(skb);
4771
4772         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4773         if (err) {
4774                 if (err == -EINVAL) {
4775                         printk(KERN_WARNING
4776                                "SELinux: unrecognized netlink message:"
4777                                " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4778                                sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4779                         if (!selinux_enforcing || security_get_allow_unknown())
4780                                 err = 0;
4781                 }
4782
4783                 /* Ignore */
4784                 if (err == -ENOENT)
4785                         err = 0;
4786                 goto out;
4787         }
4788
4789         err = sock_has_perm(current, sk, perm);
4790 out:
4791         return err;
4792 }
4793
4794 #ifdef CONFIG_NETFILTER
4795
4796 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4797                                        const struct net_device *indev,
4798                                        u16 family)
4799 {
4800         int err;
4801         char *addrp;
4802         u32 peer_sid;
4803         struct common_audit_data ad;
4804         struct lsm_network_audit net = {0,};
4805         u8 secmark_active;
4806         u8 netlbl_active;
4807         u8 peerlbl_active;
4808
4809         if (!selinux_policycap_netpeer)
4810                 return NF_ACCEPT;
4811
4812         secmark_active = selinux_secmark_enabled();
4813         netlbl_active = netlbl_enabled();
4814         peerlbl_active = selinux_peerlbl_enabled();
4815         if (!secmark_active && !peerlbl_active)
4816                 return NF_ACCEPT;
4817
4818         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4819                 return NF_DROP;
4820
4821         ad.type = LSM_AUDIT_DATA_NET;
4822         ad.u.net = &net;
4823         ad.u.net->netif = indev->ifindex;
4824         ad.u.net->family = family;
4825         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4826                 return NF_DROP;
4827
4828         if (peerlbl_active) {
4829                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4830                                                addrp, family, peer_sid, &ad);
4831                 if (err) {
4832                         selinux_netlbl_err(skb, err, 1);
4833                         return NF_DROP;
4834                 }
4835         }
4836
4837         if (secmark_active)
4838                 if (avc_has_perm(peer_sid, skb->secmark,
4839                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4840                         return NF_DROP;
4841
4842         if (netlbl_active)
4843                 /* we do this in the FORWARD path and not the POST_ROUTING
4844                  * path because we want to make sure we apply the necessary
4845                  * labeling before IPsec is applied so we can leverage AH
4846                  * protection */
4847                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4848                         return NF_DROP;
4849
4850         return NF_ACCEPT;
4851 }
4852
4853 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4854                                          struct sk_buff *skb,
4855                                          const struct nf_hook_state *state)
4856 {
4857         return selinux_ip_forward(skb, state->in, PF_INET);
4858 }
4859
4860 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4861 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4862                                          struct sk_buff *skb,
4863                                          const struct nf_hook_state *state)
4864 {
4865         return selinux_ip_forward(skb, state->in, PF_INET6);
4866 }
4867 #endif  /* IPV6 */
4868
4869 static unsigned int selinux_ip_output(struct sk_buff *skb,
4870                                       u16 family)
4871 {
4872         struct sock *sk;
4873         u32 sid;
4874
4875         if (!netlbl_enabled())
4876                 return NF_ACCEPT;
4877
4878         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4879          * because we want to make sure we apply the necessary labeling
4880          * before IPsec is applied so we can leverage AH protection */
4881         sk = skb->sk;
4882         if (sk) {
4883                 struct sk_security_struct *sksec;
4884
4885                 if (sk->sk_state == TCP_LISTEN)
4886                         /* if the socket is the listening state then this
4887                          * packet is a SYN-ACK packet which means it needs to
4888                          * be labeled based on the connection/request_sock and
4889                          * not the parent socket.  unfortunately, we can't
4890                          * lookup the request_sock yet as it isn't queued on
4891                          * the parent socket until after the SYN-ACK is sent.
4892                          * the "solution" is to simply pass the packet as-is
4893                          * as any IP option based labeling should be copied
4894                          * from the initial connection request (in the IP
4895                          * layer).  it is far from ideal, but until we get a
4896                          * security label in the packet itself this is the
4897                          * best we can do. */
4898                         return NF_ACCEPT;
4899
4900                 /* standard practice, label using the parent socket */
4901                 sksec = sk->sk_security;
4902                 sid = sksec->sid;
4903         } else
4904                 sid = SECINITSID_KERNEL;
4905         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4906                 return NF_DROP;
4907
4908         return NF_ACCEPT;
4909 }
4910
4911 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4912                                         struct sk_buff *skb,
4913                                         const struct nf_hook_state *state)
4914 {
4915         return selinux_ip_output(skb, PF_INET);
4916 }
4917
4918 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4919                                                 int ifindex,
4920                                                 u16 family)
4921 {
4922         struct sock *sk = skb->sk;
4923         struct sk_security_struct *sksec;
4924         struct common_audit_data ad;
4925         struct lsm_network_audit net = {0,};
4926         char *addrp;
4927         u8 proto;
4928
4929         if (sk == NULL)
4930                 return NF_ACCEPT;
4931         sksec = sk->sk_security;
4932
4933         ad.type = LSM_AUDIT_DATA_NET;
4934         ad.u.net = &net;
4935         ad.u.net->netif = ifindex;
4936         ad.u.net->family = family;
4937         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4938                 return NF_DROP;
4939
4940         if (selinux_secmark_enabled())
4941                 if (avc_has_perm(sksec->sid, skb->secmark,
4942                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4943                         return NF_DROP_ERR(-ECONNREFUSED);
4944
4945         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4946                 return NF_DROP_ERR(-ECONNREFUSED);
4947
4948         return NF_ACCEPT;
4949 }
4950
4951 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4952                                          const struct net_device *outdev,
4953                                          u16 family)
4954 {
4955         u32 secmark_perm;
4956         u32 peer_sid;
4957         int ifindex = outdev->ifindex;
4958         struct sock *sk;
4959         struct common_audit_data ad;
4960         struct lsm_network_audit net = {0,};
4961         char *addrp;
4962         u8 secmark_active;
4963         u8 peerlbl_active;
4964
4965         /* If any sort of compatibility mode is enabled then handoff processing
4966          * to the selinux_ip_postroute_compat() function to deal with the
4967          * special handling.  We do this in an attempt to keep this function
4968          * as fast and as clean as possible. */
4969         if (!selinux_policycap_netpeer)
4970                 return selinux_ip_postroute_compat(skb, ifindex, family);
4971
4972         secmark_active = selinux_secmark_enabled();
4973         peerlbl_active = selinux_peerlbl_enabled();
4974         if (!secmark_active && !peerlbl_active)
4975                 return NF_ACCEPT;
4976
4977         sk = skb->sk;
4978
4979 #ifdef CONFIG_XFRM
4980         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4981          * packet transformation so allow the packet to pass without any checks
4982          * since we'll have another chance to perform access control checks
4983          * when the packet is on it's final way out.
4984          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4985          *       is NULL, in this case go ahead and apply access control.
4986          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4987          *       TCP listening state we cannot wait until the XFRM processing
4988          *       is done as we will miss out on the SA label if we do;
4989          *       unfortunately, this means more work, but it is only once per
4990          *       connection. */
4991         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4992             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4993                 return NF_ACCEPT;
4994 #endif
4995
4996         if (sk == NULL) {
4997                 /* Without an associated socket the packet is either coming
4998                  * from the kernel or it is being forwarded; check the packet
4999                  * to determine which and if the packet is being forwarded
5000                  * query the packet directly to determine the security label. */
5001                 if (skb->skb_iif) {
5002                         secmark_perm = PACKET__FORWARD_OUT;
5003                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5004                                 return NF_DROP;
5005                 } else {
5006                         secmark_perm = PACKET__SEND;
5007                         peer_sid = SECINITSID_KERNEL;
5008                 }
5009         } else if (sk->sk_state == TCP_LISTEN) {
5010                 /* Locally generated packet but the associated socket is in the
5011                  * listening state which means this is a SYN-ACK packet.  In
5012                  * this particular case the correct security label is assigned
5013                  * to the connection/request_sock but unfortunately we can't
5014                  * query the request_sock as it isn't queued on the parent
5015                  * socket until after the SYN-ACK packet is sent; the only
5016                  * viable choice is to regenerate the label like we do in
5017                  * selinux_inet_conn_request().  See also selinux_ip_output()
5018                  * for similar problems. */
5019                 u32 skb_sid;
5020                 struct sk_security_struct *sksec = sk->sk_security;
5021                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5022                         return NF_DROP;
5023                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5024                  * and the packet has been through at least one XFRM
5025                  * transformation then we must be dealing with the "final"
5026                  * form of labeled IPsec packet; since we've already applied
5027                  * all of our access controls on this packet we can safely
5028                  * pass the packet. */
5029                 if (skb_sid == SECSID_NULL) {
5030                         switch (family) {
5031                         case PF_INET:
5032                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5033                                         return NF_ACCEPT;
5034                                 break;
5035                         case PF_INET6:
5036                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5037                                         return NF_ACCEPT;
5038                                 break;
5039                         default:
5040                                 return NF_DROP_ERR(-ECONNREFUSED);
5041                         }
5042                 }
5043                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5044                         return NF_DROP;
5045                 secmark_perm = PACKET__SEND;
5046         } else {
5047                 /* Locally generated packet, fetch the security label from the
5048                  * associated socket. */
5049                 struct sk_security_struct *sksec = sk->sk_security;
5050                 peer_sid = sksec->sid;
5051                 secmark_perm = PACKET__SEND;
5052         }
5053
5054         ad.type = LSM_AUDIT_DATA_NET;
5055         ad.u.net = &net;
5056         ad.u.net->netif = ifindex;
5057         ad.u.net->family = family;
5058         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5059                 return NF_DROP;
5060
5061         if (secmark_active)
5062                 if (avc_has_perm(peer_sid, skb->secmark,
5063                                  SECCLASS_PACKET, secmark_perm, &ad))
5064                         return NF_DROP_ERR(-ECONNREFUSED);
5065
5066         if (peerlbl_active) {
5067                 u32 if_sid;
5068                 u32 node_sid;
5069
5070                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5071                         return NF_DROP;
5072                 if (avc_has_perm(peer_sid, if_sid,
5073                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5074                         return NF_DROP_ERR(-ECONNREFUSED);
5075
5076                 if (sel_netnode_sid(addrp, family, &node_sid))
5077                         return NF_DROP;
5078                 if (avc_has_perm(peer_sid, node_sid,
5079                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5080                         return NF_DROP_ERR(-ECONNREFUSED);
5081         }
5082
5083         return NF_ACCEPT;
5084 }
5085
5086 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5087                                            struct sk_buff *skb,
5088                                            const struct nf_hook_state *state)
5089 {
5090         return selinux_ip_postroute(skb, state->out, PF_INET);
5091 }
5092
5093 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5094 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5095                                            struct sk_buff *skb,
5096                                            const struct nf_hook_state *state)
5097 {
5098         return selinux_ip_postroute(skb, state->out, PF_INET6);
5099 }
5100 #endif  /* IPV6 */
5101
5102 #endif  /* CONFIG_NETFILTER */
5103
5104 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5105 {
5106         int err;
5107
5108         err = cap_netlink_send(sk, skb);
5109         if (err)
5110                 return err;
5111
5112         return selinux_nlmsg_perm(sk, skb);
5113 }
5114
5115 static int ipc_alloc_security(struct task_struct *task,
5116                               struct kern_ipc_perm *perm,
5117                               u16 sclass)
5118 {
5119         struct ipc_security_struct *isec;
5120         u32 sid;
5121
5122         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5123         if (!isec)
5124                 return -ENOMEM;
5125
5126         sid = task_sid(task);
5127         isec->sclass = sclass;
5128         isec->sid = sid;
5129         perm->security = isec;
5130
5131         return 0;
5132 }
5133
5134 static void ipc_free_security(struct kern_ipc_perm *perm)
5135 {
5136         struct ipc_security_struct *isec = perm->security;
5137         perm->security = NULL;
5138         kfree(isec);
5139 }
5140
5141 static int msg_msg_alloc_security(struct msg_msg *msg)
5142 {
5143         struct msg_security_struct *msec;
5144
5145         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5146         if (!msec)
5147                 return -ENOMEM;
5148
5149         msec->sid = SECINITSID_UNLABELED;
5150         msg->security = msec;
5151
5152         return 0;
5153 }
5154
5155 static void msg_msg_free_security(struct msg_msg *msg)
5156 {
5157         struct msg_security_struct *msec = msg->security;
5158
5159         msg->security = NULL;
5160         kfree(msec);
5161 }
5162
5163 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5164                         u32 perms)
5165 {
5166         struct ipc_security_struct *isec;
5167         struct common_audit_data ad;
5168         u32 sid = current_sid();
5169
5170         isec = ipc_perms->security;
5171
5172         ad.type = LSM_AUDIT_DATA_IPC;
5173         ad.u.ipc_id = ipc_perms->key;
5174
5175         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5176 }
5177
5178 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5179 {
5180         return msg_msg_alloc_security(msg);
5181 }
5182
5183 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5184 {
5185         msg_msg_free_security(msg);
5186 }
5187
5188 /* message queue security operations */
5189 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5190 {
5191         struct ipc_security_struct *isec;
5192         struct common_audit_data ad;
5193         u32 sid = current_sid();
5194         int rc;
5195
5196         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5197         if (rc)
5198                 return rc;
5199
5200         isec = msq->q_perm.security;
5201
5202         ad.type = LSM_AUDIT_DATA_IPC;
5203         ad.u.ipc_id = msq->q_perm.key;
5204
5205         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5206                           MSGQ__CREATE, &ad);
5207         if (rc) {
5208                 ipc_free_security(&msq->q_perm);
5209                 return rc;
5210         }
5211         return 0;
5212 }
5213
5214 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5215 {
5216         ipc_free_security(&msq->q_perm);
5217 }
5218
5219 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5220 {
5221         struct ipc_security_struct *isec;
5222         struct common_audit_data ad;
5223         u32 sid = current_sid();
5224
5225         isec = msq->q_perm.security;
5226
5227         ad.type = LSM_AUDIT_DATA_IPC;
5228         ad.u.ipc_id = msq->q_perm.key;
5229
5230         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5231                             MSGQ__ASSOCIATE, &ad);
5232 }
5233
5234 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5235 {
5236         int err;
5237         int perms;
5238
5239         switch (cmd) {
5240         case IPC_INFO:
5241         case MSG_INFO:
5242                 /* No specific object, just general system-wide information. */
5243                 return task_has_system(current, SYSTEM__IPC_INFO);
5244         case IPC_STAT:
5245         case MSG_STAT:
5246                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5247                 break;
5248         case IPC_SET:
5249                 perms = MSGQ__SETATTR;
5250                 break;
5251         case IPC_RMID:
5252                 perms = MSGQ__DESTROY;
5253                 break;
5254         default:
5255                 return 0;
5256         }
5257
5258         err = ipc_has_perm(&msq->q_perm, perms);
5259         return err;
5260 }
5261
5262 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5263 {
5264         struct ipc_security_struct *isec;
5265         struct msg_security_struct *msec;
5266         struct common_audit_data ad;
5267         u32 sid = current_sid();
5268         int rc;
5269
5270         isec = msq->q_perm.security;
5271         msec = msg->security;
5272
5273         /*
5274          * First time through, need to assign label to the message
5275          */
5276         if (msec->sid == SECINITSID_UNLABELED) {
5277                 /*
5278                  * Compute new sid based on current process and
5279                  * message queue this message will be stored in
5280                  */
5281                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5282                                              NULL, &msec->sid);
5283                 if (rc)
5284                         return rc;
5285         }
5286
5287         ad.type = LSM_AUDIT_DATA_IPC;
5288         ad.u.ipc_id = msq->q_perm.key;
5289
5290         /* Can this process write to the queue? */
5291         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5292                           MSGQ__WRITE, &ad);
5293         if (!rc)
5294                 /* Can this process send the message */
5295                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5296                                   MSG__SEND, &ad);
5297         if (!rc)
5298                 /* Can the message be put in the queue? */
5299                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5300                                   MSGQ__ENQUEUE, &ad);
5301
5302         return rc;
5303 }
5304
5305 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5306                                     struct task_struct *target,
5307                                     long type, int mode)
5308 {
5309         struct ipc_security_struct *isec;
5310         struct msg_security_struct *msec;
5311         struct common_audit_data ad;
5312         u32 sid = task_sid(target);
5313         int rc;
5314
5315         isec = msq->q_perm.security;
5316         msec = msg->security;
5317
5318         ad.type = LSM_AUDIT_DATA_IPC;
5319         ad.u.ipc_id = msq->q_perm.key;
5320
5321         rc = avc_has_perm(sid, isec->sid,
5322                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5323         if (!rc)
5324                 rc = avc_has_perm(sid, msec->sid,
5325                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5326         return rc;
5327 }
5328
5329 /* Shared Memory security operations */
5330 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5331 {
5332         struct ipc_security_struct *isec;
5333         struct common_audit_data ad;
5334         u32 sid = current_sid();
5335         int rc;
5336
5337         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5338         if (rc)
5339                 return rc;
5340
5341         isec = shp->shm_perm.security;
5342
5343         ad.type = LSM_AUDIT_DATA_IPC;
5344         ad.u.ipc_id = shp->shm_perm.key;
5345
5346         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5347                           SHM__CREATE, &ad);
5348         if (rc) {
5349                 ipc_free_security(&shp->shm_perm);
5350                 return rc;
5351         }
5352         return 0;
5353 }
5354
5355 static void selinux_shm_free_security(struct shmid_kernel *shp)
5356 {
5357         ipc_free_security(&shp->shm_perm);
5358 }
5359
5360 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5361 {
5362         struct ipc_security_struct *isec;
5363         struct common_audit_data ad;
5364         u32 sid = current_sid();
5365
5366         isec = shp->shm_perm.security;
5367
5368         ad.type = LSM_AUDIT_DATA_IPC;
5369         ad.u.ipc_id = shp->shm_perm.key;
5370
5371         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5372                             SHM__ASSOCIATE, &ad);
5373 }
5374
5375 /* Note, at this point, shp is locked down */
5376 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5377 {
5378         int perms;
5379         int err;
5380
5381         switch (cmd) {
5382         case IPC_INFO:
5383         case SHM_INFO:
5384                 /* No specific object, just general system-wide information. */
5385                 return task_has_system(current, SYSTEM__IPC_INFO);
5386         case IPC_STAT:
5387         case SHM_STAT:
5388                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5389                 break;
5390         case IPC_SET:
5391                 perms = SHM__SETATTR;
5392                 break;
5393         case SHM_LOCK:
5394         case SHM_UNLOCK:
5395                 perms = SHM__LOCK;
5396                 break;
5397         case IPC_RMID:
5398                 perms = SHM__DESTROY;
5399                 break;
5400         default:
5401                 return 0;
5402         }
5403
5404         err = ipc_has_perm(&shp->shm_perm, perms);
5405         return err;
5406 }
5407
5408 static int selinux_shm_shmat(struct shmid_kernel *shp,
5409                              char __user *shmaddr, int shmflg)
5410 {
5411         u32 perms;
5412
5413         if (shmflg & SHM_RDONLY)
5414                 perms = SHM__READ;
5415         else
5416                 perms = SHM__READ | SHM__WRITE;
5417
5418         return ipc_has_perm(&shp->shm_perm, perms);
5419 }
5420
5421 /* Semaphore security operations */
5422 static int selinux_sem_alloc_security(struct sem_array *sma)
5423 {
5424         struct ipc_security_struct *isec;
5425         struct common_audit_data ad;
5426         u32 sid = current_sid();
5427         int rc;
5428
5429         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5430         if (rc)
5431                 return rc;
5432
5433         isec = sma->sem_perm.security;
5434
5435         ad.type = LSM_AUDIT_DATA_IPC;
5436         ad.u.ipc_id = sma->sem_perm.key;
5437
5438         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5439                           SEM__CREATE, &ad);
5440         if (rc) {
5441                 ipc_free_security(&sma->sem_perm);
5442                 return rc;
5443         }
5444         return 0;
5445 }
5446
5447 static void selinux_sem_free_security(struct sem_array *sma)
5448 {
5449         ipc_free_security(&sma->sem_perm);
5450 }
5451
5452 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5453 {
5454         struct ipc_security_struct *isec;
5455         struct common_audit_data ad;
5456         u32 sid = current_sid();
5457
5458         isec = sma->sem_perm.security;
5459
5460         ad.type = LSM_AUDIT_DATA_IPC;
5461         ad.u.ipc_id = sma->sem_perm.key;
5462
5463         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5464                             SEM__ASSOCIATE, &ad);
5465 }
5466
5467 /* Note, at this point, sma is locked down */
5468 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5469 {
5470         int err;
5471         u32 perms;
5472
5473         switch (cmd) {
5474         case IPC_INFO:
5475         case SEM_INFO:
5476                 /* No specific object, just general system-wide information. */
5477                 return task_has_system(current, SYSTEM__IPC_INFO);
5478         case GETPID:
5479         case GETNCNT:
5480         case GETZCNT:
5481                 perms = SEM__GETATTR;
5482                 break;
5483         case GETVAL:
5484         case GETALL:
5485                 perms = SEM__READ;
5486                 break;
5487         case SETVAL:
5488         case SETALL:
5489                 perms = SEM__WRITE;
5490                 break;
5491         case IPC_RMID:
5492                 perms = SEM__DESTROY;
5493                 break;
5494         case IPC_SET:
5495                 perms = SEM__SETATTR;
5496                 break;
5497         case IPC_STAT:
5498         case SEM_STAT:
5499                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5500                 break;
5501         default:
5502                 return 0;
5503         }
5504
5505         err = ipc_has_perm(&sma->sem_perm, perms);
5506         return err;
5507 }
5508
5509 static int selinux_sem_semop(struct sem_array *sma,
5510                              struct sembuf *sops, unsigned nsops, int alter)
5511 {
5512         u32 perms;
5513
5514         if (alter)
5515                 perms = SEM__READ | SEM__WRITE;
5516         else
5517                 perms = SEM__READ;
5518
5519         return ipc_has_perm(&sma->sem_perm, perms);
5520 }
5521
5522 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5523 {
5524         u32 av = 0;
5525
5526         av = 0;
5527         if (flag & S_IRUGO)
5528                 av |= IPC__UNIX_READ;
5529         if (flag & S_IWUGO)
5530                 av |= IPC__UNIX_WRITE;
5531
5532         if (av == 0)
5533                 return 0;
5534
5535         return ipc_has_perm(ipcp, av);
5536 }
5537
5538 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5539 {
5540         struct ipc_security_struct *isec = ipcp->security;
5541         *secid = isec->sid;
5542 }
5543
5544 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5545 {
5546         if (inode)
5547                 inode_doinit_with_dentry(inode, dentry);
5548 }
5549
5550 static int selinux_getprocattr(struct task_struct *p,
5551                                char *name, char **value)
5552 {
5553         const struct task_security_struct *__tsec;
5554         u32 sid;
5555         int error;
5556         unsigned len;
5557
5558         if (current != p) {
5559                 error = current_has_perm(p, PROCESS__GETATTR);
5560                 if (error)
5561                         return error;
5562         }
5563
5564         rcu_read_lock();
5565         __tsec = __task_cred(p)->security;
5566
5567         if (!strcmp(name, "current"))
5568                 sid = __tsec->sid;
5569         else if (!strcmp(name, "prev"))
5570                 sid = __tsec->osid;
5571         else if (!strcmp(name, "exec"))
5572                 sid = __tsec->exec_sid;
5573         else if (!strcmp(name, "fscreate"))
5574                 sid = __tsec->create_sid;
5575         else if (!strcmp(name, "keycreate"))
5576                 sid = __tsec->keycreate_sid;
5577         else if (!strcmp(name, "sockcreate"))
5578                 sid = __tsec->sockcreate_sid;
5579         else
5580                 goto invalid;
5581         rcu_read_unlock();
5582
5583         if (!sid)
5584                 return 0;
5585
5586         error = security_sid_to_context(sid, value, &len);
5587         if (error)
5588                 return error;
5589         return len;
5590
5591 invalid:
5592         rcu_read_unlock();
5593         return -EINVAL;
5594 }
5595
5596 static int selinux_setprocattr(struct task_struct *p,
5597                                char *name, void *value, size_t size)
5598 {
5599         struct task_security_struct *tsec;
5600         struct task_struct *tracer;
5601         struct cred *new;
5602         u32 sid = 0, ptsid;
5603         int error;
5604         char *str = value;
5605
5606         if (current != p) {
5607                 /* SELinux only allows a process to change its own
5608                    security attributes. */
5609                 return -EACCES;
5610         }
5611
5612         /*
5613          * Basic control over ability to set these attributes at all.
5614          * current == p, but we'll pass them separately in case the
5615          * above restriction is ever removed.
5616          */
5617         if (!strcmp(name, "exec"))
5618                 error = current_has_perm(p, PROCESS__SETEXEC);
5619         else if (!strcmp(name, "fscreate"))
5620                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5621         else if (!strcmp(name, "keycreate"))
5622                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5623         else if (!strcmp(name, "sockcreate"))
5624                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5625         else if (!strcmp(name, "current"))
5626                 error = current_has_perm(p, PROCESS__SETCURRENT);
5627         else
5628                 error = -EINVAL;
5629         if (error)
5630                 return error;
5631
5632         /* Obtain a SID for the context, if one was specified. */
5633         if (size && str[1] && str[1] != '\n') {
5634                 if (str[size-1] == '\n') {
5635                         str[size-1] = 0;
5636                         size--;
5637                 }
5638                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5639                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5640                         if (!capable(CAP_MAC_ADMIN)) {
5641                                 struct audit_buffer *ab;
5642                                 size_t audit_size;
5643
5644                                 /* We strip a nul only if it is at the end, otherwise the
5645                                  * context contains a nul and we should audit that */
5646                                 if (str[size - 1] == '\0')
5647                                         audit_size = size - 1;
5648                                 else
5649                                         audit_size = size;
5650                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5651                                 audit_log_format(ab, "op=fscreate invalid_context=");
5652                                 audit_log_n_untrustedstring(ab, value, audit_size);
5653                                 audit_log_end(ab);
5654
5655                                 return error;
5656                         }
5657                         error = security_context_to_sid_force(value, size,
5658                                                               &sid);
5659                 }
5660                 if (error)
5661                         return error;
5662         }
5663
5664         new = prepare_creds();
5665         if (!new)
5666                 return -ENOMEM;
5667
5668         /* Permission checking based on the specified context is
5669            performed during the actual operation (execve,
5670            open/mkdir/...), when we know the full context of the
5671            operation.  See selinux_bprm_set_creds for the execve
5672            checks and may_create for the file creation checks. The
5673            operation will then fail if the context is not permitted. */
5674         tsec = new->security;
5675         if (!strcmp(name, "exec")) {
5676                 tsec->exec_sid = sid;
5677         } else if (!strcmp(name, "fscreate")) {
5678                 tsec->create_sid = sid;
5679         } else if (!strcmp(name, "keycreate")) {
5680                 error = may_create_key(sid, p);
5681                 if (error)
5682                         goto abort_change;
5683                 tsec->keycreate_sid = sid;
5684         } else if (!strcmp(name, "sockcreate")) {
5685                 tsec->sockcreate_sid = sid;
5686         } else if (!strcmp(name, "current")) {
5687                 error = -EINVAL;
5688                 if (sid == 0)
5689                         goto abort_change;
5690
5691                 /* Only allow single threaded processes to change context */
5692                 error = -EPERM;
5693                 if (!current_is_single_threaded()) {
5694                         error = security_bounded_transition(tsec->sid, sid);
5695                         if (error)
5696                                 goto abort_change;
5697                 }
5698
5699                 /* Check permissions for the transition. */
5700                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5701                                      PROCESS__DYNTRANSITION, NULL);
5702                 if (error)
5703                         goto abort_change;
5704
5705                 /* Check for ptracing, and update the task SID if ok.
5706                    Otherwise, leave SID unchanged and fail. */
5707                 ptsid = 0;
5708                 rcu_read_lock();
5709                 tracer = ptrace_parent(p);
5710                 if (tracer)
5711                         ptsid = task_sid(tracer);
5712                 rcu_read_unlock();
5713
5714                 if (tracer) {
5715                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5716                                              PROCESS__PTRACE, NULL);
5717                         if (error)
5718                                 goto abort_change;
5719                 }
5720
5721                 tsec->sid = sid;
5722         } else {
5723                 error = -EINVAL;
5724                 goto abort_change;
5725         }
5726
5727         commit_creds(new);
5728         return size;
5729
5730 abort_change:
5731         abort_creds(new);
5732         return error;
5733 }
5734
5735 static int selinux_ismaclabel(const char *name)
5736 {
5737         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5738 }
5739
5740 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5741 {
5742         return security_sid_to_context(secid, secdata, seclen);
5743 }
5744
5745 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5746 {
5747         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5748 }
5749
5750 static void selinux_release_secctx(char *secdata, u32 seclen)
5751 {
5752         kfree(secdata);
5753 }
5754
5755 /*
5756  *      called with inode->i_mutex locked
5757  */
5758 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5759 {
5760         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5761 }
5762
5763 /*
5764  *      called with inode->i_mutex locked
5765  */
5766 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5767 {
5768         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5769 }
5770
5771 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5772 {
5773         int len = 0;
5774         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5775                                                 ctx, true);
5776         if (len < 0)
5777                 return len;
5778         *ctxlen = len;
5779         return 0;
5780 }
5781 #ifdef CONFIG_KEYS
5782
5783 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5784                              unsigned long flags)
5785 {
5786         const struct task_security_struct *tsec;
5787         struct key_security_struct *ksec;
5788
5789         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5790         if (!ksec)
5791                 return -ENOMEM;
5792
5793         tsec = cred->security;
5794         if (tsec->keycreate_sid)
5795                 ksec->sid = tsec->keycreate_sid;
5796         else
5797                 ksec->sid = tsec->sid;
5798
5799         k->security = ksec;
5800         return 0;
5801 }
5802
5803 static void selinux_key_free(struct key *k)
5804 {
5805         struct key_security_struct *ksec = k->security;
5806
5807         k->security = NULL;
5808         kfree(ksec);
5809 }
5810
5811 static int selinux_key_permission(key_ref_t key_ref,
5812                                   const struct cred *cred,
5813                                   unsigned perm)
5814 {
5815         struct key *key;
5816         struct key_security_struct *ksec;
5817         u32 sid;
5818
5819         /* if no specific permissions are requested, we skip the
5820            permission check. No serious, additional covert channels
5821            appear to be created. */
5822         if (perm == 0)
5823                 return 0;
5824
5825         sid = cred_sid(cred);
5826
5827         key = key_ref_to_ptr(key_ref);
5828         ksec = key->security;
5829
5830         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5831 }
5832
5833 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5834 {
5835         struct key_security_struct *ksec = key->security;
5836         char *context = NULL;
5837         unsigned len;
5838         int rc;
5839
5840         rc = security_sid_to_context(ksec->sid, &context, &len);
5841         if (!rc)
5842                 rc = len;
5843         *_buffer = context;
5844         return rc;
5845 }
5846
5847 #endif
5848
5849 static struct security_operations selinux_ops = {
5850         .name =                         "selinux",
5851
5852         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5853         .binder_transaction =           selinux_binder_transaction,
5854         .binder_transfer_binder =       selinux_binder_transfer_binder,
5855         .binder_transfer_file =         selinux_binder_transfer_file,
5856
5857         .ptrace_access_check =          selinux_ptrace_access_check,
5858         .ptrace_traceme =               selinux_ptrace_traceme,
5859         .capget =                       selinux_capget,
5860         .capset =                       selinux_capset,
5861         .capable =                      selinux_capable,
5862         .quotactl =                     selinux_quotactl,
5863         .quota_on =                     selinux_quota_on,
5864         .syslog =                       selinux_syslog,
5865         .vm_enough_memory =             selinux_vm_enough_memory,
5866
5867         .netlink_send =                 selinux_netlink_send,
5868
5869         .bprm_set_creds =               selinux_bprm_set_creds,
5870         .bprm_committing_creds =        selinux_bprm_committing_creds,
5871         .bprm_committed_creds =         selinux_bprm_committed_creds,
5872         .bprm_secureexec =              selinux_bprm_secureexec,
5873
5874         .sb_alloc_security =            selinux_sb_alloc_security,
5875         .sb_free_security =             selinux_sb_free_security,
5876         .sb_copy_data =                 selinux_sb_copy_data,
5877         .sb_remount =                   selinux_sb_remount,
5878         .sb_kern_mount =                selinux_sb_kern_mount,
5879         .sb_show_options =              selinux_sb_show_options,
5880         .sb_statfs =                    selinux_sb_statfs,
5881         .sb_mount =                     selinux_mount,
5882         .sb_umount =                    selinux_umount,
5883         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5884         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5885         .sb_parse_opts_str =            selinux_parse_opts_str,
5886
5887         .dentry_init_security =         selinux_dentry_init_security,
5888
5889         .inode_alloc_security =         selinux_inode_alloc_security,
5890         .inode_free_security =          selinux_inode_free_security,
5891         .inode_init_security =          selinux_inode_init_security,
5892         .inode_create =                 selinux_inode_create,
5893         .inode_link =                   selinux_inode_link,
5894         .inode_unlink =                 selinux_inode_unlink,
5895         .inode_symlink =                selinux_inode_symlink,
5896         .inode_mkdir =                  selinux_inode_mkdir,
5897         .inode_rmdir =                  selinux_inode_rmdir,
5898         .inode_mknod =                  selinux_inode_mknod,
5899         .inode_rename =                 selinux_inode_rename,
5900         .inode_readlink =               selinux_inode_readlink,
5901         .inode_follow_link =            selinux_inode_follow_link,
5902         .inode_permission =             selinux_inode_permission,
5903         .inode_setattr =                selinux_inode_setattr,
5904         .inode_getattr =                selinux_inode_getattr,
5905         .inode_setxattr =               selinux_inode_setxattr,
5906         .inode_post_setxattr =          selinux_inode_post_setxattr,
5907         .inode_getxattr =               selinux_inode_getxattr,
5908         .inode_listxattr =              selinux_inode_listxattr,
5909         .inode_removexattr =            selinux_inode_removexattr,
5910         .inode_getsecurity =            selinux_inode_getsecurity,
5911         .inode_setsecurity =            selinux_inode_setsecurity,
5912         .inode_listsecurity =           selinux_inode_listsecurity,
5913         .inode_getsecid =               selinux_inode_getsecid,
5914
5915         .file_permission =              selinux_file_permission,
5916         .file_alloc_security =          selinux_file_alloc_security,
5917         .file_free_security =           selinux_file_free_security,
5918         .file_ioctl =                   selinux_file_ioctl,
5919         .mmap_file =                    selinux_mmap_file,
5920         .mmap_addr =                    selinux_mmap_addr,
5921         .file_mprotect =                selinux_file_mprotect,
5922         .file_lock =                    selinux_file_lock,
5923         .file_fcntl =                   selinux_file_fcntl,
5924         .file_set_fowner =              selinux_file_set_fowner,
5925         .file_send_sigiotask =          selinux_file_send_sigiotask,
5926         .file_receive =                 selinux_file_receive,
5927
5928         .file_open =                    selinux_file_open,
5929
5930         .task_create =                  selinux_task_create,
5931         .cred_alloc_blank =             selinux_cred_alloc_blank,
5932         .cred_free =                    selinux_cred_free,
5933         .cred_prepare =                 selinux_cred_prepare,
5934         .cred_transfer =                selinux_cred_transfer,
5935         .kernel_act_as =                selinux_kernel_act_as,
5936         .kernel_create_files_as =       selinux_kernel_create_files_as,
5937         .kernel_module_request =        selinux_kernel_module_request,
5938         .task_setpgid =                 selinux_task_setpgid,
5939         .task_getpgid =                 selinux_task_getpgid,
5940         .task_getsid =                  selinux_task_getsid,
5941         .task_getsecid =                selinux_task_getsecid,
5942         .task_setnice =                 selinux_task_setnice,
5943         .task_setioprio =               selinux_task_setioprio,
5944         .task_getioprio =               selinux_task_getioprio,
5945         .task_setrlimit =               selinux_task_setrlimit,
5946         .task_setscheduler =            selinux_task_setscheduler,
5947         .task_getscheduler =            selinux_task_getscheduler,
5948         .task_movememory =              selinux_task_movememory,
5949         .task_kill =                    selinux_task_kill,
5950         .task_wait =                    selinux_task_wait,
5951         .task_to_inode =                selinux_task_to_inode,
5952
5953         .ipc_permission =               selinux_ipc_permission,
5954         .ipc_getsecid =                 selinux_ipc_getsecid,
5955
5956         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5957         .msg_msg_free_security =        selinux_msg_msg_free_security,
5958
5959         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5960         .msg_queue_free_security =      selinux_msg_queue_free_security,
5961         .msg_queue_associate =          selinux_msg_queue_associate,
5962         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5963         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5964         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5965
5966         .shm_alloc_security =           selinux_shm_alloc_security,
5967         .shm_free_security =            selinux_shm_free_security,
5968         .shm_associate =                selinux_shm_associate,
5969         .shm_shmctl =                   selinux_shm_shmctl,
5970         .shm_shmat =                    selinux_shm_shmat,
5971
5972         .sem_alloc_security =           selinux_sem_alloc_security,
5973         .sem_free_security =            selinux_sem_free_security,
5974         .sem_associate =                selinux_sem_associate,
5975         .sem_semctl =                   selinux_sem_semctl,
5976         .sem_semop =                    selinux_sem_semop,
5977
5978         .d_instantiate =                selinux_d_instantiate,
5979
5980         .getprocattr =                  selinux_getprocattr,
5981         .setprocattr =                  selinux_setprocattr,
5982
5983         .ismaclabel =                   selinux_ismaclabel,
5984         .secid_to_secctx =              selinux_secid_to_secctx,
5985         .secctx_to_secid =              selinux_secctx_to_secid,
5986         .release_secctx =               selinux_release_secctx,
5987         .inode_notifysecctx =           selinux_inode_notifysecctx,
5988         .inode_setsecctx =              selinux_inode_setsecctx,
5989         .inode_getsecctx =              selinux_inode_getsecctx,
5990
5991         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5992         .unix_may_send =                selinux_socket_unix_may_send,
5993
5994         .socket_create =                selinux_socket_create,
5995         .socket_post_create =           selinux_socket_post_create,
5996         .socket_bind =                  selinux_socket_bind,
5997         .socket_connect =               selinux_socket_connect,
5998         .socket_listen =                selinux_socket_listen,
5999         .socket_accept =                selinux_socket_accept,
6000         .socket_sendmsg =               selinux_socket_sendmsg,
6001         .socket_recvmsg =               selinux_socket_recvmsg,
6002         .socket_getsockname =           selinux_socket_getsockname,
6003         .socket_getpeername =           selinux_socket_getpeername,
6004         .socket_getsockopt =            selinux_socket_getsockopt,
6005         .socket_setsockopt =            selinux_socket_setsockopt,
6006         .socket_shutdown =              selinux_socket_shutdown,
6007         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
6008         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
6009         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
6010         .sk_alloc_security =            selinux_sk_alloc_security,
6011         .sk_free_security =             selinux_sk_free_security,
6012         .sk_clone_security =            selinux_sk_clone_security,
6013         .sk_getsecid =                  selinux_sk_getsecid,
6014         .sock_graft =                   selinux_sock_graft,
6015         .inet_conn_request =            selinux_inet_conn_request,
6016         .inet_csk_clone =               selinux_inet_csk_clone,
6017         .inet_conn_established =        selinux_inet_conn_established,
6018         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
6019         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
6020         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
6021         .req_classify_flow =            selinux_req_classify_flow,
6022         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
6023         .tun_dev_free_security =        selinux_tun_dev_free_security,
6024         .tun_dev_create =               selinux_tun_dev_create,
6025         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
6026         .tun_dev_attach =               selinux_tun_dev_attach,
6027         .tun_dev_open =                 selinux_tun_dev_open,
6028
6029 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6030         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
6031         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
6032         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
6033         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
6034         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
6035         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
6036         .xfrm_state_free_security =     selinux_xfrm_state_free,
6037         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
6038         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
6039         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
6040         .xfrm_decode_session =          selinux_xfrm_decode_session,
6041 #endif
6042
6043 #ifdef CONFIG_KEYS
6044         .key_alloc =                    selinux_key_alloc,
6045         .key_free =                     selinux_key_free,
6046         .key_permission =               selinux_key_permission,
6047         .key_getsecurity =              selinux_key_getsecurity,
6048 #endif
6049
6050 #ifdef CONFIG_AUDIT
6051         .audit_rule_init =              selinux_audit_rule_init,
6052         .audit_rule_known =             selinux_audit_rule_known,
6053         .audit_rule_match =             selinux_audit_rule_match,
6054         .audit_rule_free =              selinux_audit_rule_free,
6055 #endif
6056 };
6057
6058 static __init int selinux_init(void)
6059 {
6060         if (!security_module_enable(&selinux_ops)) {
6061                 selinux_enabled = 0;
6062                 return 0;
6063         }
6064
6065         if (!selinux_enabled) {
6066                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6067                 return 0;
6068         }
6069
6070         printk(KERN_INFO "SELinux:  Initializing.\n");
6071
6072         /* Set the security state for the initial task. */
6073         cred_init_security();
6074
6075         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6076
6077         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6078                                             sizeof(struct inode_security_struct),
6079                                             0, SLAB_PANIC, NULL);
6080         avc_init();
6081
6082         if (register_security(&selinux_ops))
6083                 panic("SELinux: Unable to register with kernel.\n");
6084
6085         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6086                 panic("SELinux: Unable to register AVC netcache callback\n");
6087
6088         if (selinux_enforcing)
6089                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6090         else
6091                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6092
6093         return 0;
6094 }
6095
6096 static void delayed_superblock_init(struct super_block *sb, void *unused)
6097 {
6098         superblock_doinit(sb, NULL);
6099 }
6100
6101 void selinux_complete_init(void)
6102 {
6103         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6104
6105         /* Set up any superblocks initialized prior to the policy load. */
6106         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6107         iterate_supers(delayed_superblock_init, NULL);
6108 }
6109
6110 /* SELinux requires early initialization in order to label
6111    all processes and objects when they are created. */
6112 security_initcall(selinux_init);
6113
6114 #if defined(CONFIG_NETFILTER)
6115
6116 static struct nf_hook_ops selinux_nf_ops[] = {
6117         {
6118                 .hook =         selinux_ipv4_postroute,
6119                 .owner =        THIS_MODULE,
6120                 .pf =           NFPROTO_IPV4,
6121                 .hooknum =      NF_INET_POST_ROUTING,
6122                 .priority =     NF_IP_PRI_SELINUX_LAST,
6123         },
6124         {
6125                 .hook =         selinux_ipv4_forward,
6126                 .owner =        THIS_MODULE,
6127                 .pf =           NFPROTO_IPV4,
6128                 .hooknum =      NF_INET_FORWARD,
6129                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6130         },
6131         {
6132                 .hook =         selinux_ipv4_output,
6133                 .owner =        THIS_MODULE,
6134                 .pf =           NFPROTO_IPV4,
6135                 .hooknum =      NF_INET_LOCAL_OUT,
6136                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6137         },
6138 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6139         {
6140                 .hook =         selinux_ipv6_postroute,
6141                 .owner =        THIS_MODULE,
6142                 .pf =           NFPROTO_IPV6,
6143                 .hooknum =      NF_INET_POST_ROUTING,
6144                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6145         },
6146         {
6147                 .hook =         selinux_ipv6_forward,
6148                 .owner =        THIS_MODULE,
6149                 .pf =           NFPROTO_IPV6,
6150                 .hooknum =      NF_INET_FORWARD,
6151                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6152         },
6153 #endif  /* IPV6 */
6154 };
6155
6156 static int __init selinux_nf_ip_init(void)
6157 {
6158         int err;
6159
6160         if (!selinux_enabled)
6161                 return 0;
6162
6163         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6164
6165         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6166         if (err)
6167                 panic("SELinux: nf_register_hooks: error %d\n", err);
6168
6169         return 0;
6170 }
6171
6172 __initcall(selinux_nf_ip_init);
6173
6174 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6175 static void selinux_nf_ip_exit(void)
6176 {
6177         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6178
6179         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6180 }
6181 #endif
6182
6183 #else /* CONFIG_NETFILTER */
6184
6185 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6186 #define selinux_nf_ip_exit()
6187 #endif
6188
6189 #endif /* CONFIG_NETFILTER */
6190
6191 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6192 static int selinux_disabled;
6193
6194 int selinux_disable(void)
6195 {
6196         if (ss_initialized) {
6197                 /* Not permitted after initial policy load. */
6198                 return -EINVAL;
6199         }
6200
6201         if (selinux_disabled) {
6202                 /* Only do this once. */
6203                 return -EINVAL;
6204         }
6205
6206         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6207
6208         selinux_disabled = 1;
6209         selinux_enabled = 0;
6210
6211         reset_security_ops();
6212
6213         /* Try to destroy the avc node cache */
6214         avc_disable();
6215
6216         /* Unregister netfilter hooks. */
6217         selinux_nf_ip_exit();
6218
6219         /* Unregister selinuxfs. */
6220         exit_sel_fs();
6221
6222         return 0;
6223 }
6224 #endif