security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define NUM_SEL_MNT_OPTS 5
  98
  99 extern struct security_operations *security_ops;
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!strict_strtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!strict_strtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (atomic_read(&selinux_secmark_refcount) > 0);
 147 }
 148
 149 static int selinux_netcache_avc_callback(u32 event)
 150 {
 151         if (event == AVC_CALLBACK_RESET) {
 152                 sel_netif_flush();
 153                 sel_netnode_flush();
 154                 sel_netport_flush();
 155                 synchronize_net();
 156         }
 157         return 0;
 158 }
 159
 160 /*
 161  * initialise the security for the init task
 162  */
 163 static void cred_init_security(void)
 164 {
 165         struct cred *cred = (struct cred *) current->real_cred;
 166         struct task_security_struct *tsec;
 167
 168         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 169         if (!tsec)
 170                 panic("SELinux:  Failed to initialize initial task.\n");
 171
 172         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 173         cred->security = tsec;
 174 }
 175
 176 /*
 177  * get the security ID of a set of credentials
 178  */
 179 static inline u32 cred_sid(const struct cred *cred)
 180 {
 181         const struct task_security_struct *tsec;
 182
 183         tsec = cred->security;
 184         return tsec->sid;
 185 }
 186
 187 /*
 188  * get the objective security ID of a task
 189  */
 190 static inline u32 task_sid(const struct task_struct *task)
 191 {
 192         u32 sid;
 193
 194         rcu_read_lock();
 195         sid = cred_sid(__task_cred(task));
 196         rcu_read_unlock();
 197         return sid;
 198 }
 199
 200 /*
 201  * get the subjective security ID of the current task
 202  */
 203 static inline u32 current_sid(void)
 204 {
 205         const struct task_security_struct *tsec = current_security();
 206
 207         return tsec->sid;
 208 }
 209
 210 /* Allocate and free functions for each kind of security blob. */
 211
 212 static int inode_alloc_security(struct inode *inode)
 213 {
 214         struct inode_security_struct *isec;
 215         u32 sid = current_sid();
 216
 217         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 218         if (!isec)
 219                 return -ENOMEM;
 220
 221         mutex_init(&isec->lock);
 222         INIT_LIST_HEAD(&isec->list);
 223         isec->inode = inode;
 224         isec->sid = SECINITSID_UNLABELED;
 225         isec->sclass = SECCLASS_FILE;
 226         isec->task_sid = sid;
 227         inode->i_security = isec;
 228
 229         return 0;
 230 }
 231
 232 static void inode_free_rcu(struct rcu_head *head)
 233 {
 234         struct inode_security_struct *isec;
 235
 236         isec = container_of(head, struct inode_security_struct, rcu);
 237         kmem_cache_free(sel_inode_cache, isec);
 238 }
 239
 240 static void inode_free_security(struct inode *inode)
 241 {
 242         struct inode_security_struct *isec = inode->i_security;
 243         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 244
 245         spin_lock(&sbsec->isec_lock);
 246         if (!list_empty(&isec->list))
 247                 list_del_init(&isec->list);
 248         spin_unlock(&sbsec->isec_lock);
 249
 250         /*
 251          * The inode may still be referenced in a path walk and
 252          * a call to selinux_inode_permission() can be made
 253          * after inode_free_security() is called. Ideally, the VFS
 254          * wouldn't do this, but fixing that is a much harder
 255          * job. For now, simply free the i_security via RCU, and
 256          * leave the current inode->i_security pointer intact.
 257          * The inode will be freed after the RCU grace period too.
 258          */
 259         call_rcu(&isec->rcu, inode_free_rcu);
 260 }
 261
 262 static int file_alloc_security(struct file *file)
 263 {
 264         struct file_security_struct *fsec;
 265         u32 sid = current_sid();
 266
 267         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 268         if (!fsec)
 269                 return -ENOMEM;
 270
 271         fsec->sid = sid;
 272         fsec->fown_sid = sid;
 273         file->f_security = fsec;
 274
 275         return 0;
 276 }
 277
 278 static void file_free_security(struct file *file)
 279 {
 280         struct file_security_struct *fsec = file->f_security;
 281         file->f_security = NULL;
 282         kfree(fsec);
 283 }
 284
 285 static int superblock_alloc_security(struct super_block *sb)
 286 {
 287         struct superblock_security_struct *sbsec;
 288
 289         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 290         if (!sbsec)
 291                 return -ENOMEM;
 292
 293         mutex_init(&sbsec->lock);
 294         INIT_LIST_HEAD(&sbsec->isec_head);
 295         spin_lock_init(&sbsec->isec_lock);
 296         sbsec->sb = sb;
 297         sbsec->sid = SECINITSID_UNLABELED;
 298         sbsec->def_sid = SECINITSID_FILE;
 299         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 300         sb->s_security = sbsec;
 301
 302         return 0;
 303 }
 304
 305 static void superblock_free_security(struct super_block *sb)
 306 {
 307         struct superblock_security_struct *sbsec = sb->s_security;
 308         sb->s_security = NULL;
 309         kfree(sbsec);
 310 }
 311
 312 /* The file system's label must be initialized prior to use. */
 313
 314 static const char *labeling_behaviors[6] = {
 315         "uses xattr",
 316         "uses transition SIDs",
 317         "uses task SIDs",
 318         "uses genfs_contexts",
 319         "not configured for labeling",
 320         "uses mountpoint labeling",
 321 };
 322
 323 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 324
 325 static inline int inode_doinit(struct inode *inode)
 326 {
 327         return inode_doinit_with_dentry(inode, NULL);
 328 }
 329
 330 enum {
 331         Opt_error = -1,
 332         Opt_context = 1,
 333         Opt_fscontext = 2,
 334         Opt_defcontext = 3,
 335         Opt_rootcontext = 4,
 336         Opt_labelsupport = 5,
 337 };
 338
 339 static const match_table_t tokens = {
 340         {Opt_context, CONTEXT_STR "%s"},
 341         {Opt_fscontext, FSCONTEXT_STR "%s"},
 342         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 343         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 344         {Opt_labelsupport, LABELSUPP_STR},
 345         {Opt_error, NULL},
 346 };
 347
 348 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 349
 350 static int may_context_mount_sb_relabel(u32 sid,
 351                         struct superblock_security_struct *sbsec,
 352                         const struct cred *cred)
 353 {
 354         const struct task_security_struct *tsec = cred->security;
 355         int rc;
 356
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__RELABELTO, NULL);
 364         return rc;
 365 }
 366
 367 static int may_context_mount_inode_relabel(u32 sid,
 368                         struct superblock_security_struct *sbsec,
 369                         const struct cred *cred)
 370 {
 371         const struct task_security_struct *tsec = cred->security;
 372         int rc;
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__ASSOCIATE, NULL);
 380         return rc;
 381 }
 382
 383 static int sb_finish_set_opts(struct super_block *sb)
 384 {
 385         struct superblock_security_struct *sbsec = sb->s_security;
 386         struct dentry *root = sb->s_root;
 387         struct inode *root_inode = root->d_inode;
 388         int rc = 0;
 389
 390         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 391                 /* Make sure that the xattr handler exists and that no
 392                    error other than -ENODATA is returned by getxattr on
 393                    the root directory.  -ENODATA is ok, as this may be
 394                    the first boot of the SELinux kernel before we have
 395                    assigned xattr values to the filesystem. */
 396                 if (!root_inode->i_op->getxattr) {
 397                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 398                                "xattr support\n", sb->s_id, sb->s_type->name);
 399                         rc = -EOPNOTSUPP;
 400                         goto out;
 401                 }
 402                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 403                 if (rc < 0 && rc != -ENODATA) {
 404                         if (rc == -EOPNOTSUPP)
 405                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 406                                        "%s) has no security xattr handler\n",
 407                                        sb->s_id, sb->s_type->name);
 408                         else
 409                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 410                                        "%s) getxattr errno %d\n", sb->s_id,
 411                                        sb->s_type->name, -rc);
 412                         goto out;
 413                 }
 414         }
 415
 416         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 417
 418         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 419                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 420                        sb->s_id, sb->s_type->name);
 421         else
 422                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 423                        sb->s_id, sb->s_type->name,
 424                        labeling_behaviors[sbsec->behavior-1]);
 425
 426         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 427             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 428             sbsec->behavior == SECURITY_FS_USE_NONE ||
 429             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 430                 sbsec->flags &= ~SE_SBLABELSUPP;
 431
 432         /* Special handling. Is genfs but also has in-core setxattr handler*/
 433         if (!strcmp(sb->s_type->name, "sysfs") ||
 434             !strcmp(sb->s_type->name, "pstore") ||
 435             !strcmp(sb->s_type->name, "debugfs") ||
 436             !strcmp(sb->s_type->name, "rootfs"))
 437                 sbsec->flags |= SE_SBLABELSUPP;
 438
 439         /* Initialize the root inode. */
 440         rc = inode_doinit_with_dentry(root_inode, root);
 441
 442         /* Initialize any other inodes associated with the superblock, e.g.
 443            inodes created prior to initial policy load or inodes created
 444            during get_sb by a pseudo filesystem that directly
 445            populates itself. */
 446         spin_lock(&sbsec->isec_lock);
 447 next_inode:
 448         if (!list_empty(&sbsec->isec_head)) {
 449                 struct inode_security_struct *isec =
 450                                 list_entry(sbsec->isec_head.next,
 451                                            struct inode_security_struct, list);
 452                 struct inode *inode = isec->inode;
 453                 spin_unlock(&sbsec->isec_lock);
 454                 inode = igrab(inode);
 455                 if (inode) {
 456                         if (!IS_PRIVATE(inode))
 457                                 inode_doinit(inode);
 458                         iput(inode);
 459                 }
 460                 spin_lock(&sbsec->isec_lock);
 461                 list_del_init(&isec->list);
 462                 goto next_inode;
 463         }
 464         spin_unlock(&sbsec->isec_lock);
 465 out:
 466         return rc;
 467 }
 468
 469 /*
 470  * This function should allow an FS to ask what it's mount security
 471  * options were so it can use those later for submounts, displaying
 472  * mount options, or whatever.
 473  */
 474 static int selinux_get_mnt_opts(const struct super_block *sb,
 475                                 struct security_mnt_opts *opts)
 476 {
 477         int rc = 0, i;
 478         struct superblock_security_struct *sbsec = sb->s_security;
 479         char *context = NULL;
 480         u32 len;
 481         char tmp;
 482
 483         security_init_mnt_opts(opts);
 484
 485         if (!(sbsec->flags & SE_SBINITIALIZED))
 486                 return -EINVAL;
 487
 488         if (!ss_initialized)
 489                 return -EINVAL;
 490
 491         tmp = sbsec->flags & SE_MNTMASK;
 492         /* count the number of mount options for this sb */
 493         for (i = 0; i < 8; i++) {
 494                 if (tmp & 0x01)
 495                         opts->num_mnt_opts++;
 496                 tmp >>= 1;
 497         }
 498         /* Check if the Label support flag is set */
 499         if (sbsec->flags & SE_SBLABELSUPP)
 500                 opts->num_mnt_opts++;
 501
 502         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 503         if (!opts->mnt_opts) {
 504                 rc = -ENOMEM;
 505                 goto out_free;
 506         }
 507
 508         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 509         if (!opts->mnt_opts_flags) {
 510                 rc = -ENOMEM;
 511                 goto out_free;
 512         }
 513
 514         i = 0;
 515         if (sbsec->flags & FSCONTEXT_MNT) {
 516                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 517                 if (rc)
 518                         goto out_free;
 519                 opts->mnt_opts[i] = context;
 520                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 521         }
 522         if (sbsec->flags & CONTEXT_MNT) {
 523                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 524                 if (rc)
 525                         goto out_free;
 526                 opts->mnt_opts[i] = context;
 527                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 528         }
 529         if (sbsec->flags & DEFCONTEXT_MNT) {
 530                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 531                 if (rc)
 532                         goto out_free;
 533                 opts->mnt_opts[i] = context;
 534                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 535         }
 536         if (sbsec->flags & ROOTCONTEXT_MNT) {
 537                 struct inode *root = sbsec->sb->s_root->d_inode;
 538                 struct inode_security_struct *isec = root->i_security;
 539
 540                 rc = security_sid_to_context(isec->sid, &context, &len);
 541                 if (rc)
 542                         goto out_free;
 543                 opts->mnt_opts[i] = context;
 544                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 545         }
 546         if (sbsec->flags & SE_SBLABELSUPP) {
 547                 opts->mnt_opts[i] = NULL;
 548                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 549         }
 550
 551         BUG_ON(i != opts->num_mnt_opts);
 552
 553         return 0;
 554
 555 out_free:
 556         security_free_mnt_opts(opts);
 557         return rc;
 558 }
 559
 560 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 561                       u32 old_sid, u32 new_sid)
 562 {
 563         char mnt_flags = sbsec->flags & SE_MNTMASK;
 564
 565         /* check if the old mount command had the same options */
 566         if (sbsec->flags & SE_SBINITIALIZED)
 567                 if (!(sbsec->flags & flag) ||
 568                     (old_sid != new_sid))
 569                         return 1;
 570
 571         /* check if we were passed the same options twice,
 572          * aka someone passed context=a,context=b
 573          */
 574         if (!(sbsec->flags & SE_SBINITIALIZED))
 575                 if (mnt_flags & flag)
 576                         return 1;
 577         return 0;
 578 }
 579
 580 /*
 581  * Allow filesystems with binary mount data to explicitly set mount point
 582  * labeling information.
 583  */
 584 static int selinux_set_mnt_opts(struct super_block *sb,
 585                                 struct security_mnt_opts *opts)
 586 {
 587         const struct cred *cred = current_cred();
 588         int rc = 0, i;
 589         struct superblock_security_struct *sbsec = sb->s_security;
 590         const char *name = sb->s_type->name;
 591         struct inode *inode = sbsec->sb->s_root->d_inode;
 592         struct inode_security_struct *root_isec = inode->i_security;
 593         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 594         u32 defcontext_sid = 0;
 595         char **mount_options = opts->mnt_opts;
 596         int *flags = opts->mnt_opts_flags;
 597         int num_opts = opts->num_mnt_opts;
 598
 599         mutex_lock(&sbsec->lock);
 600
 601         if (!ss_initialized) {
 602                 if (!num_opts) {
 603                         /* Defer initialization until selinux_complete_init,
 604                            after the initial policy is loaded and the security
 605                            server is ready to handle calls. */
 606                         goto out;
 607                 }
 608                 rc = -EINVAL;
 609                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 610                         "before the security server is initialized\n");
 611                 goto out;
 612         }
 613
 614         /*
 615          * Binary mount data FS will come through this function twice.  Once
 616          * from an explicit call and once from the generic calls from the vfs.
 617          * Since the generic VFS calls will not contain any security mount data
 618          * we need to skip the double mount verification.
 619          *
 620          * This does open a hole in which we will not notice if the first
 621          * mount using this sb set explict options and a second mount using
 622          * this sb does not set any security options.  (The first options
 623          * will be used for both mounts)
 624          */
 625         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 626             && (num_opts == 0))
 627                 goto out;
 628
 629         /*
 630          * parse the mount options, check if they are valid sids.
 631          * also check if someone is trying to mount the same sb more
 632          * than once with different security options.
 633          */
 634         for (i = 0; i < num_opts; i++) {
 635                 u32 sid;
 636
 637                 if (flags[i] == SE_SBLABELSUPP)
 638                         continue;
 639                 rc = security_context_to_sid(mount_options[i],
 640                                              strlen(mount_options[i]), &sid);
 641                 if (rc) {
 642                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 643                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 644                                mount_options[i], sb->s_id, name, rc);
 645                         goto out;
 646                 }
 647                 switch (flags[i]) {
 648                 case FSCONTEXT_MNT:
 649                         fscontext_sid = sid;
 650
 651                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 652                                         fscontext_sid))
 653                                 goto out_double_mount;
 654
 655                         sbsec->flags |= FSCONTEXT_MNT;
 656                         break;
 657                 case CONTEXT_MNT:
 658                         context_sid = sid;
 659
 660                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 661                                         context_sid))
 662                                 goto out_double_mount;
 663
 664                         sbsec->flags |= CONTEXT_MNT;
 665                         break;
 666                 case ROOTCONTEXT_MNT:
 667                         rootcontext_sid = sid;
 668
 669                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 670                                         rootcontext_sid))
 671                                 goto out_double_mount;
 672
 673                         sbsec->flags |= ROOTCONTEXT_MNT;
 674
 675                         break;
 676                 case DEFCONTEXT_MNT:
 677                         defcontext_sid = sid;
 678
 679                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 680                                         defcontext_sid))
 681                                 goto out_double_mount;
 682
 683                         sbsec->flags |= DEFCONTEXT_MNT;
 684
 685                         break;
 686                 default:
 687                         rc = -EINVAL;
 688                         goto out;
 689                 }
 690         }
 691
 692         if (sbsec->flags & SE_SBINITIALIZED) {
 693                 /* previously mounted with options, but not on this attempt? */
 694                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 695                         goto out_double_mount;
 696                 rc = 0;
 697                 goto out;
 698         }
 699
 700         if (strcmp(sb->s_type->name, "proc") == 0)
 701                 sbsec->flags |= SE_SBPROC;
 702
 703         /* Determine the labeling behavior to use for this filesystem type. */
 704         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 705         if (rc) {
 706                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 707                        __func__, sb->s_type->name, rc);
 708                 goto out;
 709         }
 710
 711         /* sets the context of the superblock for the fs being mounted. */
 712         if (fscontext_sid) {
 713                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 714                 if (rc)
 715                         goto out;
 716
 717                 sbsec->sid = fscontext_sid;
 718         }
 719
 720         /*
 721          * Switch to using mount point labeling behavior.
 722          * sets the label used on all file below the mountpoint, and will set
 723          * the superblock context if not already set.
 724          */
 725         if (context_sid) {
 726                 if (!fscontext_sid) {
 727                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 728                                                           cred);
 729                         if (rc)
 730                                 goto out;
 731                         sbsec->sid = context_sid;
 732                 } else {
 733                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 734                                                              cred);
 735                         if (rc)
 736                                 goto out;
 737                 }
 738                 if (!rootcontext_sid)
 739                         rootcontext_sid = context_sid;
 740
 741                 sbsec->mntpoint_sid = context_sid;
 742                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 743         }
 744
 745         if (rootcontext_sid) {
 746                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 747                                                      cred);
 748                 if (rc)
 749                         goto out;
 750
 751                 root_isec->sid = rootcontext_sid;
 752                 root_isec->initialized = 1;
 753         }
 754
 755         if (defcontext_sid) {
 756                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 757                         rc = -EINVAL;
 758                         printk(KERN_WARNING "SELinux: defcontext option is "
 759                                "invalid for this filesystem type\n");
 760                         goto out;
 761                 }
 762
 763                 if (defcontext_sid != sbsec->def_sid) {
 764                         rc = may_context_mount_inode_relabel(defcontext_sid,
 765                                                              sbsec, cred);
 766                         if (rc)
 767                                 goto out;
 768                 }
 769
 770                 sbsec->def_sid = defcontext_sid;
 771         }
 772
 773         rc = sb_finish_set_opts(sb);
 774 out:
 775         mutex_unlock(&sbsec->lock);
 776         return rc;
 777 out_double_mount:
 778         rc = -EINVAL;
 779         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 780                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 781         goto out;
 782 }
 783
 784 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 785                                     const struct super_block *newsb)
 786 {
 787         struct superblock_security_struct *old = oldsb->s_security;
 788         struct superblock_security_struct *new = newsb->s_security;
 789         char oldflags = old->flags & SE_MNTMASK;
 790         char newflags = new->flags & SE_MNTMASK;
 791
 792         if (oldflags != newflags)
 793                 goto mismatch;
 794         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 795                 goto mismatch;
 796         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 797                 goto mismatch;
 798         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 799                 goto mismatch;
 800         if (oldflags & ROOTCONTEXT_MNT) {
 801                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 802                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 803                 if (oldroot->sid != newroot->sid)
 804                         goto mismatch;
 805         }
 806         return 0;
 807 mismatch:
 808         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 809                             "different security settings for (dev %s, "
 810                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 811         return -EBUSY;
 812 }
 813
 814 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 815                                         struct super_block *newsb)
 816 {
 817         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 818         struct superblock_security_struct *newsbsec = newsb->s_security;
 819
 820         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 821         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 822         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 823
 824         /*
 825          * if the parent was able to be mounted it clearly had no special lsm
 826          * mount options.  thus we can safely deal with this superblock later
 827          */
 828         if (!ss_initialized)
 829                 return 0;
 830
 831         /* how can we clone if the old one wasn't set up?? */
 832         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 833
 834         /* if fs is reusing a sb, make sure that the contexts match */
 835         if (newsbsec->flags & SE_SBINITIALIZED)
 836                 return selinux_cmp_sb_context(oldsb, newsb);
 837
 838         mutex_lock(&newsbsec->lock);
 839
 840         newsbsec->flags = oldsbsec->flags;
 841
 842         newsbsec->sid = oldsbsec->sid;
 843         newsbsec->def_sid = oldsbsec->def_sid;
 844         newsbsec->behavior = oldsbsec->behavior;
 845
 846         if (set_context) {
 847                 u32 sid = oldsbsec->mntpoint_sid;
 848
 849                 if (!set_fscontext)
 850                         newsbsec->sid = sid;
 851                 if (!set_rootcontext) {
 852                         struct inode *newinode = newsb->s_root->d_inode;
 853                         struct inode_security_struct *newisec = newinode->i_security;
 854                         newisec->sid = sid;
 855                 }
 856                 newsbsec->mntpoint_sid = sid;
 857         }
 858         if (set_rootcontext) {
 859                 const struct inode *oldinode = oldsb->s_root->d_inode;
 860                 const struct inode_security_struct *oldisec = oldinode->i_security;
 861                 struct inode *newinode = newsb->s_root->d_inode;
 862                 struct inode_security_struct *newisec = newinode->i_security;
 863
 864                 newisec->sid = oldisec->sid;
 865         }
 866
 867         sb_finish_set_opts(newsb);
 868         mutex_unlock(&newsbsec->lock);
 869         return 0;
 870 }
 871
 872 static int selinux_parse_opts_str(char *options,
 873                                   struct security_mnt_opts *opts)
 874 {
 875         char *p;
 876         char *context = NULL, *defcontext = NULL;
 877         char *fscontext = NULL, *rootcontext = NULL;
 878         int rc, num_mnt_opts = 0;
 879
 880         opts->num_mnt_opts = 0;
 881
 882         /* Standard string-based options. */
 883         while ((p = strsep(&options, "|")) != NULL) {
 884                 int token;
 885                 substring_t args[MAX_OPT_ARGS];
 886
 887                 if (!*p)
 888                         continue;
 889
 890                 token = match_token(p, tokens, args);
 891
 892                 switch (token) {
 893                 case Opt_context:
 894                         if (context || defcontext) {
 895                                 rc = -EINVAL;
 896                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 897                                 goto out_err;
 898                         }
 899                         context = match_strdup(&args[0]);
 900                         if (!context) {
 901                                 rc = -ENOMEM;
 902                                 goto out_err;
 903                         }
 904                         break;
 905
 906                 case Opt_fscontext:
 907                         if (fscontext) {
 908                                 rc = -EINVAL;
 909                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 910                                 goto out_err;
 911                         }
 912                         fscontext = match_strdup(&args[0]);
 913                         if (!fscontext) {
 914                                 rc = -ENOMEM;
 915                                 goto out_err;
 916                         }
 917                         break;
 918
 919                 case Opt_rootcontext:
 920                         if (rootcontext) {
 921                                 rc = -EINVAL;
 922                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 923                                 goto out_err;
 924                         }
 925                         rootcontext = match_strdup(&args[0]);
 926                         if (!rootcontext) {
 927                                 rc = -ENOMEM;
 928                                 goto out_err;
 929                         }
 930                         break;
 931
 932                 case Opt_defcontext:
 933                         if (context || defcontext) {
 934                                 rc = -EINVAL;
 935                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 936                                 goto out_err;
 937                         }
 938                         defcontext = match_strdup(&args[0]);
 939                         if (!defcontext) {
 940                                 rc = -ENOMEM;
 941                                 goto out_err;
 942                         }
 943                         break;
 944                 case Opt_labelsupport:
 945                         break;
 946                 default:
 947                         rc = -EINVAL;
 948                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 949                         goto out_err;
 950
 951                 }
 952         }
 953
 954         rc = -ENOMEM;
 955         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 956         if (!opts->mnt_opts)
 957                 goto out_err;
 958
 959         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 960         if (!opts->mnt_opts_flags) {
 961                 kfree(opts->mnt_opts);
 962                 goto out_err;
 963         }
 964
 965         if (fscontext) {
 966                 opts->mnt_opts[num_mnt_opts] = fscontext;
 967                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 968         }
 969         if (context) {
 970                 opts->mnt_opts[num_mnt_opts] = context;
 971                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 972         }
 973         if (rootcontext) {
 974                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 975                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 976         }
 977         if (defcontext) {
 978                 opts->mnt_opts[num_mnt_opts] = defcontext;
 979                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 980         }
 981
 982         opts->num_mnt_opts = num_mnt_opts;
 983         return 0;
 984
 985 out_err:
 986         kfree(context);
 987         kfree(defcontext);
 988         kfree(fscontext);
 989         kfree(rootcontext);
 990         return rc;
 991 }
 992 /*
 993  * string mount options parsing and call set the sbsec
 994  */
 995 static int superblock_doinit(struct super_block *sb, void *data)
 996 {
 997         int rc = 0;
 998         char *options = data;
 999         struct security_mnt_opts opts;
1000
1001         security_init_mnt_opts(&opts);
1002
1003         if (!data)
1004                 goto out;
1005
1006         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1007
1008         rc = selinux_parse_opts_str(options, &opts);
1009         if (rc)
1010                 goto out_err;
1011
1012 out:
1013         rc = selinux_set_mnt_opts(sb, &opts);
1014
1015 out_err:
1016         security_free_mnt_opts(&opts);
1017         return rc;
1018 }
1019
1020 static void selinux_write_opts(struct seq_file *m,
1021                                struct security_mnt_opts *opts)
1022 {
1023         int i;
1024         char *prefix;
1025
1026         for (i = 0; i < opts->num_mnt_opts; i++) {
1027                 char *has_comma;
1028
1029                 if (opts->mnt_opts[i])
1030                         has_comma = strchr(opts->mnt_opts[i], ',');
1031                 else
1032                         has_comma = NULL;
1033
1034                 switch (opts->mnt_opts_flags[i]) {
1035                 case CONTEXT_MNT:
1036                         prefix = CONTEXT_STR;
1037                         break;
1038                 case FSCONTEXT_MNT:
1039                         prefix = FSCONTEXT_STR;
1040                         break;
1041                 case ROOTCONTEXT_MNT:
1042                         prefix = ROOTCONTEXT_STR;
1043                         break;
1044                 case DEFCONTEXT_MNT:
1045                         prefix = DEFCONTEXT_STR;
1046                         break;
1047                 case SE_SBLABELSUPP:
1048                         seq_putc(m, ',');
1049                         seq_puts(m, LABELSUPP_STR);
1050                         continue;
1051                 default:
1052                         BUG();
1053                         return;
1054                 };
1055                 /* we need a comma before each option */
1056                 seq_putc(m, ',');
1057                 seq_puts(m, prefix);
1058                 if (has_comma)
1059                         seq_putc(m, '\"');
1060                 seq_puts(m, opts->mnt_opts[i]);
1061                 if (has_comma)
1062                         seq_putc(m, '\"');
1063         }
1064 }
1065
1066 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1067 {
1068         struct security_mnt_opts opts;
1069         int rc;
1070
1071         rc = selinux_get_mnt_opts(sb, &opts);
1072         if (rc) {
1073                 /* before policy load we may get EINVAL, don't show anything */
1074                 if (rc == -EINVAL)
1075                         rc = 0;
1076                 return rc;
1077         }
1078
1079         selinux_write_opts(m, &opts);
1080
1081         security_free_mnt_opts(&opts);
1082
1083         return rc;
1084 }
1085
1086 static inline u16 inode_mode_to_security_class(umode_t mode)
1087 {
1088         switch (mode & S_IFMT) {
1089         case S_IFSOCK:
1090                 return SECCLASS_SOCK_FILE;
1091         case S_IFLNK:
1092                 return SECCLASS_LNK_FILE;
1093         case S_IFREG:
1094                 return SECCLASS_FILE;
1095         case S_IFBLK:
1096                 return SECCLASS_BLK_FILE;
1097         case S_IFDIR:
1098                 return SECCLASS_DIR;
1099         case S_IFCHR:
1100                 return SECCLASS_CHR_FILE;
1101         case S_IFIFO:
1102                 return SECCLASS_FIFO_FILE;
1103
1104         }
1105
1106         return SECCLASS_FILE;
1107 }
1108
1109 static inline int default_protocol_stream(int protocol)
1110 {
1111         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1112 }
1113
1114 static inline int default_protocol_dgram(int protocol)
1115 {
1116         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1117 }
1118
1119 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1120 {
1121         switch (family) {
1122         case PF_UNIX:
1123                 switch (type) {
1124                 case SOCK_STREAM:
1125                 case SOCK_SEQPACKET:
1126                         return SECCLASS_UNIX_STREAM_SOCKET;
1127                 case SOCK_DGRAM:
1128                         return SECCLASS_UNIX_DGRAM_SOCKET;
1129                 }
1130                 break;
1131         case PF_INET:
1132         case PF_INET6:
1133                 switch (type) {
1134                 case SOCK_STREAM:
1135                         if (default_protocol_stream(protocol))
1136                                 return SECCLASS_TCP_SOCKET;
1137                         else
1138                                 return SECCLASS_RAWIP_SOCKET;
1139                 case SOCK_DGRAM:
1140                         if (default_protocol_dgram(protocol))
1141                                 return SECCLASS_UDP_SOCKET;
1142                         else
1143                                 return SECCLASS_RAWIP_SOCKET;
1144                 case SOCK_DCCP:
1145                         return SECCLASS_DCCP_SOCKET;
1146                 default:
1147                         return SECCLASS_RAWIP_SOCKET;
1148                 }
1149                 break;
1150         case PF_NETLINK:
1151                 switch (protocol) {
1152                 case NETLINK_ROUTE:
1153                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1154                 case NETLINK_FIREWALL:
1155                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1156                 case NETLINK_SOCK_DIAG:
1157                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1158                 case NETLINK_NFLOG:
1159                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1160                 case NETLINK_XFRM:
1161                         return SECCLASS_NETLINK_XFRM_SOCKET;
1162                 case NETLINK_SELINUX:
1163                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1164                 case NETLINK_AUDIT:
1165                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1166                 case NETLINK_IP6_FW:
1167                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1168                 case NETLINK_DNRTMSG:
1169                         return SECCLASS_NETLINK_DNRT_SOCKET;
1170                 case NETLINK_KOBJECT_UEVENT:
1171                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1172                 default:
1173                         return SECCLASS_NETLINK_SOCKET;
1174                 }
1175         case PF_PACKET:
1176                 return SECCLASS_PACKET_SOCKET;
1177         case PF_KEY:
1178                 return SECCLASS_KEY_SOCKET;
1179         case PF_APPLETALK:
1180                 return SECCLASS_APPLETALK_SOCKET;
1181         }
1182
1183         return SECCLASS_SOCKET;
1184 }
1185
1186 #ifdef CONFIG_PROC_FS
1187 static int selinux_proc_get_sid(struct dentry *dentry,
1188                                 u16 tclass,
1189                                 u32 *sid)
1190 {
1191         int rc;
1192         char *buffer, *path;
1193
1194         buffer = (char *)__get_free_page(GFP_KERNEL);
1195         if (!buffer)
1196                 return -ENOMEM;
1197
1198         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1199         if (IS_ERR(path))
1200                 rc = PTR_ERR(path);
1201         else {
1202                 /* each process gets a /proc/PID/ entry. Strip off the
1203                  * PID part to get a valid selinux labeling.
1204                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1205                 while (path[1] >= '0' && path[1] <= '9') {
1206                         path[1] = '/';
1207                         path++;
1208                 }
1209                 rc = security_genfs_sid("proc", path, tclass, sid);
1210         }
1211         free_page((unsigned long)buffer);
1212         return rc;
1213 }
1214 #else
1215 static int selinux_proc_get_sid(struct dentry *dentry,
1216                                 u16 tclass,
1217                                 u32 *sid)
1218 {
1219         return -EINVAL;
1220 }
1221 #endif
1222
1223 /* The inode's security attributes must be initialized before first use. */
1224 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1225 {
1226         struct superblock_security_struct *sbsec = NULL;
1227         struct inode_security_struct *isec = inode->i_security;
1228         u32 sid;
1229         struct dentry *dentry;
1230 #define INITCONTEXTLEN 255
1231         char *context = NULL;
1232         unsigned len = 0;
1233         int rc = 0;
1234
1235         if (isec->initialized)
1236                 goto out;
1237
1238         mutex_lock(&isec->lock);
1239         if (isec->initialized)
1240                 goto out_unlock;
1241
1242         sbsec = inode->i_sb->s_security;
1243         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1244                 /* Defer initialization until selinux_complete_init,
1245                    after the initial policy is loaded and the security
1246                    server is ready to handle calls. */
1247                 spin_lock(&sbsec->isec_lock);
1248                 if (list_empty(&isec->list))
1249                         list_add(&isec->list, &sbsec->isec_head);
1250                 spin_unlock(&sbsec->isec_lock);
1251                 goto out_unlock;
1252         }
1253
1254         switch (sbsec->behavior) {
1255         case SECURITY_FS_USE_XATTR:
1256                 if (!inode->i_op->getxattr) {
1257                         isec->sid = sbsec->def_sid;
1258                         break;
1259                 }
1260
1261                 /* Need a dentry, since the xattr API requires one.
1262                    Life would be simpler if we could just pass the inode. */
1263                 if (opt_dentry) {
1264                         /* Called from d_instantiate or d_splice_alias. */
1265                         dentry = dget(opt_dentry);
1266                 } else {
1267                         /* Called from selinux_complete_init, try to find a dentry. */
1268                         dentry = d_find_alias(inode);
1269                 }
1270                 if (!dentry) {
1271                         /*
1272                          * this is can be hit on boot when a file is accessed
1273                          * before the policy is loaded.  When we load policy we
1274                          * may find inodes that have no dentry on the
1275                          * sbsec->isec_head list.  No reason to complain as these
1276                          * will get fixed up the next time we go through
1277                          * inode_doinit with a dentry, before these inodes could
1278                          * be used again by userspace.
1279                          */
1280                         goto out_unlock;
1281                 }
1282
1283                 len = INITCONTEXTLEN;
1284                 context = kmalloc(len+1, GFP_NOFS);
1285                 if (!context) {
1286                         rc = -ENOMEM;
1287                         dput(dentry);
1288                         goto out_unlock;
1289                 }
1290                 context[len] = '\0';
1291                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1292                                            context, len);
1293                 if (rc == -ERANGE) {
1294                         kfree(context);
1295
1296                         /* Need a larger buffer.  Query for the right size. */
1297                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1298                                                    NULL, 0);
1299                         if (rc < 0) {
1300                                 dput(dentry);
1301                                 goto out_unlock;
1302                         }
1303                         len = rc;
1304                         context = kmalloc(len+1, GFP_NOFS);
1305                         if (!context) {
1306                                 rc = -ENOMEM;
1307                                 dput(dentry);
1308                                 goto out_unlock;
1309                         }
1310                         context[len] = '\0';
1311                         rc = inode->i_op->getxattr(dentry,
1312                                                    XATTR_NAME_SELINUX,
1313                                                    context, len);
1314                 }
1315                 dput(dentry);
1316                 if (rc < 0) {
1317                         if (rc != -ENODATA) {
1318                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1319                                        "%d for dev=%s ino=%ld\n", __func__,
1320                                        -rc, inode->i_sb->s_id, inode->i_ino);
1321                                 kfree(context);
1322                                 goto out_unlock;
1323                         }
1324                         /* Map ENODATA to the default file SID */
1325                         sid = sbsec->def_sid;
1326                         rc = 0;
1327                 } else {
1328                         rc = security_context_to_sid_default(context, rc, &sid,
1329                                                              sbsec->def_sid,
1330                                                              GFP_NOFS);
1331                         if (rc) {
1332                                 char *dev = inode->i_sb->s_id;
1333                                 unsigned long ino = inode->i_ino;
1334
1335                                 if (rc == -EINVAL) {
1336                                         if (printk_ratelimit())
1337                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1338                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1339                                                         "filesystem in question.\n", ino, dev, context);
1340                                 } else {
1341                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1342                                                "returned %d for dev=%s ino=%ld\n",
1343                                                __func__, context, -rc, dev, ino);
1344                                 }
1345                                 kfree(context);
1346                                 /* Leave with the unlabeled SID */
1347                                 rc = 0;
1348                                 break;
1349                         }
1350                 }
1351                 kfree(context);
1352                 isec->sid = sid;
1353                 break;
1354         case SECURITY_FS_USE_TASK:
1355                 isec->sid = isec->task_sid;
1356                 break;
1357         case SECURITY_FS_USE_TRANS:
1358                 /* Default to the fs SID. */
1359                 isec->sid = sbsec->sid;
1360
1361                 /* Try to obtain a transition SID. */
1362                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1363                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1364                                              isec->sclass, NULL, &sid);
1365                 if (rc)
1366                         goto out_unlock;
1367                 isec->sid = sid;
1368                 break;
1369         case SECURITY_FS_USE_MNTPOINT:
1370                 isec->sid = sbsec->mntpoint_sid;
1371                 break;
1372         default:
1373                 /* Default to the fs superblock SID. */
1374                 isec->sid = sbsec->sid;
1375
1376                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1377                         if (opt_dentry) {
1378                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1379                                 rc = selinux_proc_get_sid(opt_dentry,
1380                                                           isec->sclass,
1381                                                           &sid);
1382                                 if (rc)
1383                                         goto out_unlock;
1384                                 isec->sid = sid;
1385                         }
1386                 }
1387                 break;
1388         }
1389
1390         isec->initialized = 1;
1391
1392 out_unlock:
1393         mutex_unlock(&isec->lock);
1394 out:
1395         if (isec->sclass == SECCLASS_FILE)
1396                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1397         return rc;
1398 }
1399
1400 /* Convert a Linux signal to an access vector. */
1401 static inline u32 signal_to_av(int sig)
1402 {
1403         u32 perm = 0;
1404
1405         switch (sig) {
1406         case SIGCHLD:
1407                 /* Commonly granted from child to parent. */
1408                 perm = PROCESS__SIGCHLD;
1409                 break;
1410         case SIGKILL:
1411                 /* Cannot be caught or ignored */
1412                 perm = PROCESS__SIGKILL;
1413                 break;
1414         case SIGSTOP:
1415                 /* Cannot be caught or ignored */
1416                 perm = PROCESS__SIGSTOP;
1417                 break;
1418         default:
1419                 /* All other signals. */
1420                 perm = PROCESS__SIGNAL;
1421                 break;
1422         }
1423
1424         return perm;
1425 }
1426
1427 /*
1428  * Check permission between a pair of credentials
1429  * fork check, ptrace check, etc.
1430  */
1431 static int cred_has_perm(const struct cred *actor,
1432                          const struct cred *target,
1433                          u32 perms)
1434 {
1435         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1436
1437         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1438 }
1439
1440 /*
1441  * Check permission between a pair of tasks, e.g. signal checks,
1442  * fork check, ptrace check, etc.
1443  * tsk1 is the actor and tsk2 is the target
1444  * - this uses the default subjective creds of tsk1
1445  */
1446 static int task_has_perm(const struct task_struct *tsk1,
1447                          const struct task_struct *tsk2,
1448                          u32 perms)
1449 {
1450         const struct task_security_struct *__tsec1, *__tsec2;
1451         u32 sid1, sid2;
1452
1453         rcu_read_lock();
1454         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1455         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1456         rcu_read_unlock();
1457         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1458 }
1459
1460 /*
1461  * Check permission between current and another task, e.g. signal checks,
1462  * fork check, ptrace check, etc.
1463  * current is the actor and tsk2 is the target
1464  * - this uses current's subjective creds
1465  */
1466 static int current_has_perm(const struct task_struct *tsk,
1467                             u32 perms)
1468 {
1469         u32 sid, tsid;
1470
1471         sid = current_sid();
1472         tsid = task_sid(tsk);
1473         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1474 }
1475
1476 #if CAP_LAST_CAP > 63
1477 #error Fix SELinux to handle capabilities > 63.
1478 #endif
1479
1480 /* Check whether a task is allowed to use a capability. */
1481 static int cred_has_capability(const struct cred *cred,
1482                                int cap, int audit)
1483 {
1484         struct common_audit_data ad;
1485         struct av_decision avd;
1486         u16 sclass;
1487         u32 sid = cred_sid(cred);
1488         u32 av = CAP_TO_MASK(cap);
1489         int rc;
1490
1491         ad.type = LSM_AUDIT_DATA_CAP;
1492         ad.u.cap = cap;
1493
1494         switch (CAP_TO_INDEX(cap)) {
1495         case 0:
1496                 sclass = SECCLASS_CAPABILITY;
1497                 break;
1498         case 1:
1499                 sclass = SECCLASS_CAPABILITY2;
1500                 break;
1501         default:
1502                 printk(KERN_ERR
1503                        "SELinux:  out of range capability %d\n", cap);
1504                 BUG();
1505                 return -EINVAL;
1506         }
1507
1508         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1509         if (audit == SECURITY_CAP_AUDIT) {
1510                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1511                 if (rc2)
1512                         return rc2;
1513         }
1514         return rc;
1515 }
1516
1517 /* Check whether a task is allowed to use a system operation. */
1518 static int task_has_system(struct task_struct *tsk,
1519                            u32 perms)
1520 {
1521         u32 sid = task_sid(tsk);
1522
1523         return avc_has_perm(sid, SECINITSID_KERNEL,
1524                             SECCLASS_SYSTEM, perms, NULL);
1525 }
1526
1527 /* Check whether a task has a particular permission to an inode.
1528    The 'adp' parameter is optional and allows other audit
1529    data to be passed (e.g. the dentry). */
1530 static int inode_has_perm(const struct cred *cred,
1531                           struct inode *inode,
1532                           u32 perms,
1533                           struct common_audit_data *adp,
1534                           unsigned flags)
1535 {
1536         struct inode_security_struct *isec;
1537         u32 sid;
1538
1539         validate_creds(cred);
1540
1541         if (unlikely(IS_PRIVATE(inode)))
1542                 return 0;
1543
1544         sid = cred_sid(cred);
1545         isec = inode->i_security;
1546
1547         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1548 }
1549
1550 /* Same as inode_has_perm, but pass explicit audit data containing
1551    the dentry to help the auditing code to more easily generate the
1552    pathname if needed. */
1553 static inline int dentry_has_perm(const struct cred *cred,
1554                                   struct dentry *dentry,
1555                                   u32 av)
1556 {
1557         struct inode *inode = dentry->d_inode;
1558         struct common_audit_data ad;
1559
1560         ad.type = LSM_AUDIT_DATA_DENTRY;
1561         ad.u.dentry = dentry;
1562         return inode_has_perm(cred, inode, av, &ad, 0);
1563 }
1564
1565 /* Same as inode_has_perm, but pass explicit audit data containing
1566    the path to help the auditing code to more easily generate the
1567    pathname if needed. */
1568 static inline int path_has_perm(const struct cred *cred,
1569                                 struct path *path,
1570                                 u32 av)
1571 {
1572         struct inode *inode = path->dentry->d_inode;
1573         struct common_audit_data ad;
1574
1575         ad.type = LSM_AUDIT_DATA_PATH;
1576         ad.u.path = *path;
1577         return inode_has_perm(cred, inode, av, &ad, 0);
1578 }
1579
1580 /* Check whether a task can use an open file descriptor to
1581    access an inode in a given way.  Check access to the
1582    descriptor itself, and then use dentry_has_perm to
1583    check a particular permission to the file.
1584    Access to the descriptor is implicitly granted if it
1585    has the same SID as the process.  If av is zero, then
1586    access to the file is not checked, e.g. for cases
1587    where only the descriptor is affected like seek. */
1588 static int file_has_perm(const struct cred *cred,
1589                          struct file *file,
1590                          u32 av)
1591 {
1592         struct file_security_struct *fsec = file->f_security;
1593         struct inode *inode = file_inode(file);
1594         struct common_audit_data ad;
1595         u32 sid = cred_sid(cred);
1596         int rc;
1597
1598         ad.type = LSM_AUDIT_DATA_PATH;
1599         ad.u.path = file->f_path;
1600
1601         if (sid != fsec->sid) {
1602                 rc = avc_has_perm(sid, fsec->sid,
1603                                   SECCLASS_FD,
1604                                   FD__USE,
1605                                   &ad);
1606                 if (rc)
1607                         goto out;
1608         }
1609
1610         /* av is zero if only checking access to the descriptor. */
1611         rc = 0;
1612         if (av)
1613                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1614
1615 out:
1616         return rc;
1617 }
1618
1619 /* Check whether a task can create a file. */
1620 static int may_create(struct inode *dir,
1621                       struct dentry *dentry,
1622                       u16 tclass)
1623 {
1624         const struct task_security_struct *tsec = current_security();
1625         struct inode_security_struct *dsec;
1626         struct superblock_security_struct *sbsec;
1627         u32 sid, newsid;
1628         struct common_audit_data ad;
1629         int rc;
1630
1631         dsec = dir->i_security;
1632         sbsec = dir->i_sb->s_security;
1633
1634         sid = tsec->sid;
1635         newsid = tsec->create_sid;
1636
1637         ad.type = LSM_AUDIT_DATA_DENTRY;
1638         ad.u.dentry = dentry;
1639
1640         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1641                           DIR__ADD_NAME | DIR__SEARCH,
1642                           &ad);
1643         if (rc)
1644                 return rc;
1645
1646         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1647                 rc = security_transition_sid(sid, dsec->sid, tclass,
1648                                              &dentry->d_name, &newsid);
1649                 if (rc)
1650                         return rc;
1651         }
1652
1653         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1654         if (rc)
1655                 return rc;
1656
1657         return avc_has_perm(newsid, sbsec->sid,
1658                             SECCLASS_FILESYSTEM,
1659                             FILESYSTEM__ASSOCIATE, &ad);
1660 }
1661
1662 /* Check whether a task can create a key. */
1663 static int may_create_key(u32 ksid,
1664                           struct task_struct *ctx)
1665 {
1666         u32 sid = task_sid(ctx);
1667
1668         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1669 }
1670
1671 #define MAY_LINK        0
1672 #define MAY_UNLINK      1
1673 #define MAY_RMDIR       2
1674
1675 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1676 static int may_link(struct inode *dir,
1677                     struct dentry *dentry,
1678                     int kind)
1679
1680 {
1681         struct inode_security_struct *dsec, *isec;
1682         struct common_audit_data ad;
1683         u32 sid = current_sid();
1684         u32 av;
1685         int rc;
1686
1687         dsec = dir->i_security;
1688         isec = dentry->d_inode->i_security;
1689
1690         ad.type = LSM_AUDIT_DATA_DENTRY;
1691         ad.u.dentry = dentry;
1692
1693         av = DIR__SEARCH;
1694         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1695         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1696         if (rc)
1697                 return rc;
1698
1699         switch (kind) {
1700         case MAY_LINK:
1701                 av = FILE__LINK;
1702                 break;
1703         case MAY_UNLINK:
1704                 av = FILE__UNLINK;
1705                 break;
1706         case MAY_RMDIR:
1707                 av = DIR__RMDIR;
1708                 break;
1709         default:
1710                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1711                         __func__, kind);
1712                 return 0;
1713         }
1714
1715         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1716         return rc;
1717 }
1718
1719 static inline int may_rename(struct inode *old_dir,
1720                              struct dentry *old_dentry,
1721                              struct inode *new_dir,
1722                              struct dentry *new_dentry)
1723 {
1724         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1725         struct common_audit_data ad;
1726         u32 sid = current_sid();
1727         u32 av;
1728         int old_is_dir, new_is_dir;
1729         int rc;
1730
1731         old_dsec = old_dir->i_security;
1732         old_isec = old_dentry->d_inode->i_security;
1733         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1734         new_dsec = new_dir->i_security;
1735
1736         ad.type = LSM_AUDIT_DATA_DENTRY;
1737
1738         ad.u.dentry = old_dentry;
1739         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1740                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1741         if (rc)
1742                 return rc;
1743         rc = avc_has_perm(sid, old_isec->sid,
1744                           old_isec->sclass, FILE__RENAME, &ad);
1745         if (rc)
1746                 return rc;
1747         if (old_is_dir && new_dir != old_dir) {
1748                 rc = avc_has_perm(sid, old_isec->sid,
1749                                   old_isec->sclass, DIR__REPARENT, &ad);
1750                 if (rc)
1751                         return rc;
1752         }
1753
1754         ad.u.dentry = new_dentry;
1755         av = DIR__ADD_NAME | DIR__SEARCH;
1756         if (new_dentry->d_inode)
1757                 av |= DIR__REMOVE_NAME;
1758         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1759         if (rc)
1760                 return rc;
1761         if (new_dentry->d_inode) {
1762                 new_isec = new_dentry->d_inode->i_security;
1763                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1764                 rc = avc_has_perm(sid, new_isec->sid,
1765                                   new_isec->sclass,
1766                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1767                 if (rc)
1768                         return rc;
1769         }
1770
1771         return 0;
1772 }
1773
1774 /* Check whether a task can perform a filesystem operation. */
1775 static int superblock_has_perm(const struct cred *cred,
1776                                struct super_block *sb,
1777                                u32 perms,
1778                                struct common_audit_data *ad)
1779 {
1780         struct superblock_security_struct *sbsec;
1781         u32 sid = cred_sid(cred);
1782
1783         sbsec = sb->s_security;
1784         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1785 }
1786
1787 /* Convert a Linux mode and permission mask to an access vector. */
1788 static inline u32 file_mask_to_av(int mode, int mask)
1789 {
1790         u32 av = 0;
1791
1792         if (!S_ISDIR(mode)) {
1793                 if (mask & MAY_EXEC)
1794                         av |= FILE__EXECUTE;
1795                 if (mask & MAY_READ)
1796                         av |= FILE__READ;
1797
1798                 if (mask & MAY_APPEND)
1799                         av |= FILE__APPEND;
1800                 else if (mask & MAY_WRITE)
1801                         av |= FILE__WRITE;
1802
1803         } else {
1804                 if (mask & MAY_EXEC)
1805                         av |= DIR__SEARCH;
1806                 if (mask & MAY_WRITE)
1807                         av |= DIR__WRITE;
1808                 if (mask & MAY_READ)
1809                         av |= DIR__READ;
1810         }
1811
1812         return av;
1813 }
1814
1815 /* Convert a Linux file to an access vector. */
1816 static inline u32 file_to_av(struct file *file)
1817 {
1818         u32 av = 0;
1819
1820         if (file->f_mode & FMODE_READ)
1821                 av |= FILE__READ;
1822         if (file->f_mode & FMODE_WRITE) {
1823                 if (file->f_flags & O_APPEND)
1824                         av |= FILE__APPEND;
1825                 else
1826                         av |= FILE__WRITE;
1827         }
1828         if (!av) {
1829                 /*
1830                  * Special file opened with flags 3 for ioctl-only use.
1831                  */
1832                 av = FILE__IOCTL;
1833         }
1834
1835         return av;
1836 }
1837
1838 /*
1839  * Convert a file to an access vector and include the correct open
1840  * open permission.
1841  */
1842 static inline u32 open_file_to_av(struct file *file)
1843 {
1844         u32 av = file_to_av(file);
1845
1846         if (selinux_policycap_openperm)
1847                 av |= FILE__OPEN;
1848
1849         return av;
1850 }
1851
1852 /* Hook functions begin here. */
1853
1854 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1855 {
1856         u32 mysid = current_sid();
1857         u32 mgrsid = task_sid(mgr);
1858
1859         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
1860 }
1861
1862 static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)
1863 {
1864         u32 mysid = current_sid();
1865         u32 fromsid = task_sid(from);
1866         u32 tosid = task_sid(to);
1867         int rc;
1868
1869         if (mysid != fromsid) {
1870                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);
1871                 if (rc)
1872                         return rc;
1873         }
1874
1875         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);
1876 }
1877
1878 static int selinux_binder_transfer_binder(struct task_struct *from, struct task_struct *to)
1879 {
1880         u32 fromsid = task_sid(from);
1881         u32 tosid = task_sid(to);
1882         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
1883 }
1884
1885 static int selinux_binder_transfer_file(struct task_struct *from, struct task_struct *to, struct file *file)
1886 {
1887         u32 sid = task_sid(to);
1888         struct file_security_struct *fsec = file->f_security;
1889         struct inode *inode = file->f_path.dentry->d_inode;
1890         struct inode_security_struct *isec = inode->i_security;
1891         struct common_audit_data ad;
1892         struct selinux_audit_data sad = {0,};
1893         int rc;
1894
1895         ad.type = LSM_AUDIT_DATA_PATH;
1896         ad.u.path = file->f_path;
1897         ad.selinux_audit_data = &sad;
1898
1899         if (sid != fsec->sid) {
1900                 rc = avc_has_perm(sid, fsec->sid,
1901                                   SECCLASS_FD,
1902                                   FD__USE,
1903                                   &ad);
1904                 if (rc)
1905                         return rc;
1906         }
1907
1908         if (unlikely(IS_PRIVATE(inode)))
1909                 return 0;
1910
1911         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1912                             &ad);
1913 }
1914
1915 static int selinux_ptrace_access_check(struct task_struct *child,
1916                                      unsigned int mode)
1917 {
1918         int rc;
1919
1920         rc = cap_ptrace_access_check(child, mode);
1921         if (rc)
1922                 return rc;
1923
1924         if (mode & PTRACE_MODE_READ) {
1925                 u32 sid = current_sid();
1926                 u32 csid = task_sid(child);
1927                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1928         }
1929
1930         return current_has_perm(child, PROCESS__PTRACE);
1931 }
1932
1933 static int selinux_ptrace_traceme(struct task_struct *parent)
1934 {
1935         int rc;
1936
1937         rc = cap_ptrace_traceme(parent);
1938         if (rc)
1939                 return rc;
1940
1941         return task_has_perm(parent, current, PROCESS__PTRACE);
1942 }
1943
1944 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1945                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1946 {
1947         int error;
1948
1949         error = current_has_perm(target, PROCESS__GETCAP);
1950         if (error)
1951                 return error;
1952
1953         return cap_capget(target, effective, inheritable, permitted);
1954 }
1955
1956 static int selinux_capset(struct cred *new, const struct cred *old,
1957                           const kernel_cap_t *effective,
1958                           const kernel_cap_t *inheritable,
1959                           const kernel_cap_t *permitted)
1960 {
1961         int error;
1962
1963         error = cap_capset(new, old,
1964                                       effective, inheritable, permitted);
1965         if (error)
1966                 return error;
1967
1968         return cred_has_perm(old, new, PROCESS__SETCAP);
1969 }
1970
1971 /*
1972  * (This comment used to live with the selinux_task_setuid hook,
1973  * which was removed).
1974  *
1975  * Since setuid only affects the current process, and since the SELinux
1976  * controls are not based on the Linux identity attributes, SELinux does not
1977  * need to control this operation.  However, SELinux does control the use of
1978  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1979  */
1980
1981 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1982                            int cap, int audit)
1983 {
1984         int rc;
1985
1986         rc = cap_capable(cred, ns, cap, audit);
1987         if (rc)
1988                 return rc;
1989
1990         return cred_has_capability(cred, cap, audit);
1991 }
1992
1993 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1994 {
1995         const struct cred *cred = current_cred();
1996         int rc = 0;
1997
1998         if (!sb)
1999                 return 0;
2000
2001         switch (cmds) {
2002         case Q_SYNC:
2003         case Q_QUOTAON:
2004         case Q_QUOTAOFF:
2005         case Q_SETINFO:
2006         case Q_SETQUOTA:
2007                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2008                 break;
2009         case Q_GETFMT:
2010         case Q_GETINFO:
2011         case Q_GETQUOTA:
2012                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2013                 break;
2014         default:
2015                 rc = 0;  /* let the kernel handle invalid cmds */
2016                 break;
2017         }
2018         return rc;
2019 }
2020
2021 static int selinux_quota_on(struct dentry *dentry)
2022 {
2023         const struct cred *cred = current_cred();
2024
2025         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2026 }
2027
2028 static int selinux_syslog(int type)
2029 {
2030         int rc;
2031
2032         switch (type) {
2033         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2034         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2035                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2036                 break;
2037         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2038         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2039         /* Set level of messages printed to console */
2040         case SYSLOG_ACTION_CONSOLE_LEVEL:
2041                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2042                 break;
2043         case SYSLOG_ACTION_CLOSE:       /* Close log */
2044         case SYSLOG_ACTION_OPEN:        /* Open log */
2045         case SYSLOG_ACTION_READ:        /* Read from log */
2046         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2047         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2048         default:
2049                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2050                 break;
2051         }
2052         return rc;
2053 }
2054
2055 /*
2056  * Check that a process has enough memory to allocate a new virtual
2057  * mapping. 0 means there is enough memory for the allocation to
2058  * succeed and -ENOMEM implies there is not.
2059  *
2060  * Do not audit the selinux permission check, as this is applied to all
2061  * processes that allocate mappings.
2062  */
2063 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2064 {
2065         int rc, cap_sys_admin = 0;
2066
2067         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2068                              SECURITY_CAP_NOAUDIT);
2069         if (rc == 0)
2070                 cap_sys_admin = 1;
2071
2072         return __vm_enough_memory(mm, pages, cap_sys_admin);
2073 }
2074
2075 /* binprm security operations */
2076
2077 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2078 {
2079         const struct task_security_struct *old_tsec;
2080         struct task_security_struct *new_tsec;
2081         struct inode_security_struct *isec;
2082         struct common_audit_data ad;
2083         struct inode *inode = file_inode(bprm->file);
2084         int rc;
2085
2086         rc = cap_bprm_set_creds(bprm);
2087         if (rc)
2088                 return rc;
2089
2090         /* SELinux context only depends on initial program or script and not
2091          * the script interpreter */
2092         if (bprm->cred_prepared)
2093                 return 0;
2094
2095         old_tsec = current_security();
2096         new_tsec = bprm->cred->security;
2097         isec = inode->i_security;
2098
2099         /* Default to the current task SID. */
2100         new_tsec->sid = old_tsec->sid;
2101         new_tsec->osid = old_tsec->sid;
2102
2103         /* Reset fs, key, and sock SIDs on execve. */
2104         new_tsec->create_sid = 0;
2105         new_tsec->keycreate_sid = 0;
2106         new_tsec->sockcreate_sid = 0;
2107
2108         if (old_tsec->exec_sid) {
2109                 new_tsec->sid = old_tsec->exec_sid;
2110                 /* Reset exec SID on execve. */
2111                 new_tsec->exec_sid = 0;
2112
2113                 /*
2114                  * Minimize confusion: if no_new_privs and a transition is
2115                  * explicitly requested, then fail the exec.
2116                  */
2117                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2118                         return -EPERM;
2119         } else {
2120                 /* Check for a default transition on this program. */
2121                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2122                                              SECCLASS_PROCESS, NULL,
2123                                              &new_tsec->sid);
2124                 if (rc)
2125                         return rc;
2126         }
2127
2128         ad.type = LSM_AUDIT_DATA_PATH;
2129         ad.u.path = bprm->file->f_path;
2130
2131         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2132             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2133                 new_tsec->sid = old_tsec->sid;
2134
2135         if (new_tsec->sid == old_tsec->sid) {
2136                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2137                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2138                 if (rc)
2139                         return rc;
2140         } else {
2141                 /* Check permissions for the transition. */
2142                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2143                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2144                 if (rc)
2145                         return rc;
2146
2147                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2148                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2149                 if (rc)
2150                         return rc;
2151
2152                 /* Check for shared state */
2153                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2154                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155                                           SECCLASS_PROCESS, PROCESS__SHARE,
2156                                           NULL);
2157                         if (rc)
2158                                 return -EPERM;
2159                 }
2160
2161                 /* Make sure that anyone attempting to ptrace over a task that
2162                  * changes its SID has the appropriate permit */
2163                 if (bprm->unsafe &
2164                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2165                         struct task_struct *tracer;
2166                         struct task_security_struct *sec;
2167                         u32 ptsid = 0;
2168
2169                         rcu_read_lock();
2170                         tracer = ptrace_parent(current);
2171                         if (likely(tracer != NULL)) {
2172                                 sec = __task_cred(tracer)->security;
2173                                 ptsid = sec->sid;
2174                         }
2175                         rcu_read_unlock();
2176
2177                         if (ptsid != 0) {
2178                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2179                                                   SECCLASS_PROCESS,
2180                                                   PROCESS__PTRACE, NULL);
2181                                 if (rc)
2182                                         return -EPERM;
2183                         }
2184                 }
2185
2186                 /* Clear any possibly unsafe personality bits on exec: */
2187                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2188         }
2189
2190         return 0;
2191 }
2192
2193 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2194 {
2195         const struct task_security_struct *tsec = current_security();
2196         u32 sid, osid;
2197         int atsecure = 0;
2198
2199         sid = tsec->sid;
2200         osid = tsec->osid;
2201
2202         if (osid != sid) {
2203                 /* Enable secure mode for SIDs transitions unless
2204                    the noatsecure permission is granted between
2205                    the two SIDs, i.e. ahp returns 0. */
2206                 atsecure = avc_has_perm(osid, sid,
2207                                         SECCLASS_PROCESS,
2208                                         PROCESS__NOATSECURE, NULL);
2209         }
2210
2211         return (atsecure || cap_bprm_secureexec(bprm));
2212 }
2213
2214 static int match_file(const void *p, struct file *file, unsigned fd)
2215 {
2216         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2217 }
2218
2219 /* Derived from fs/exec.c:flush_old_files. */
2220 static inline void flush_unauthorized_files(const struct cred *cred,
2221                                             struct files_struct *files)
2222 {
2223         struct file *file, *devnull = NULL;
2224         struct tty_struct *tty;
2225         int drop_tty = 0;
2226         unsigned n;
2227
2228         tty = get_current_tty();
2229         if (tty) {
2230                 spin_lock(&tty_files_lock);
2231                 if (!list_empty(&tty->tty_files)) {
2232                         struct tty_file_private *file_priv;
2233
2234                         /* Revalidate access to controlling tty.
2235                            Use path_has_perm on the tty path directly rather
2236                            than using file_has_perm, as this particular open
2237                            file may belong to another process and we are only
2238                            interested in the inode-based check here. */
2239                         file_priv = list_first_entry(&tty->tty_files,
2240                                                 struct tty_file_private, list);
2241                         file = file_priv->file;
2242                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2243                                 drop_tty = 1;
2244                 }
2245                 spin_unlock(&tty_files_lock);
2246                 tty_kref_put(tty);
2247         }
2248         /* Reset controlling tty. */
2249         if (drop_tty)
2250                 no_tty();
2251
2252         /* Revalidate access to inherited open files. */
2253         n = iterate_fd(files, 0, match_file, cred);
2254         if (!n) /* none found? */
2255                 return;
2256
2257         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2258         if (IS_ERR(devnull))
2259                 devnull = NULL;
2260         /* replace all the matching ones with this */
2261         do {
2262                 replace_fd(n - 1, devnull, 0);
2263         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2264         if (devnull)
2265                 fput(devnull);
2266 }
2267
2268 /*
2269  * Prepare a process for imminent new credential changes due to exec
2270  */
2271 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2272 {
2273         struct task_security_struct *new_tsec;
2274         struct rlimit *rlim, *initrlim;
2275         int rc, i;
2276
2277         new_tsec = bprm->cred->security;
2278         if (new_tsec->sid == new_tsec->osid)
2279                 return;
2280
2281         /* Close files for which the new task SID is not authorized. */
2282         flush_unauthorized_files(bprm->cred, current->files);
2283
2284         /* Always clear parent death signal on SID transitions. */
2285         current->pdeath_signal = 0;
2286
2287         /* Check whether the new SID can inherit resource limits from the old
2288          * SID.  If not, reset all soft limits to the lower of the current
2289          * task's hard limit and the init task's soft limit.
2290          *
2291          * Note that the setting of hard limits (even to lower them) can be
2292          * controlled by the setrlimit check.  The inclusion of the init task's
2293          * soft limit into the computation is to avoid resetting soft limits
2294          * higher than the default soft limit for cases where the default is
2295          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2296          */
2297         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2298                           PROCESS__RLIMITINH, NULL);
2299         if (rc) {
2300                 /* protect against do_prlimit() */
2301                 task_lock(current);
2302                 for (i = 0; i < RLIM_NLIMITS; i++) {
2303                         rlim = current->signal->rlim + i;
2304                         initrlim = init_task.signal->rlim + i;
2305                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2306                 }
2307                 task_unlock(current);
2308                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2309         }
2310 }
2311
2312 /*
2313  * Clean up the process immediately after the installation of new credentials
2314  * due to exec
2315  */
2316 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2317 {
2318         const struct task_security_struct *tsec = current_security();
2319         struct itimerval itimer;
2320         u32 osid, sid;
2321         int rc, i;
2322
2323         osid = tsec->osid;
2324         sid = tsec->sid;
2325
2326         if (sid == osid)
2327                 return;
2328
2329         /* Check whether the new SID can inherit signal state from the old SID.
2330          * If not, clear itimers to avoid subsequent signal generation and
2331          * flush and unblock signals.
2332          *
2333          * This must occur _after_ the task SID has been updated so that any
2334          * kill done after the flush will be checked against the new SID.
2335          */
2336         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2337         if (rc) {
2338                 memset(&itimer, 0, sizeof itimer);
2339                 for (i = 0; i < 3; i++)
2340                         do_setitimer(i, &itimer, NULL);
2341                 spin_lock_irq(&current->sighand->siglock);
2342                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2343                         __flush_signals(current);
2344                         flush_signal_handlers(current, 1);
2345                         sigemptyset(&current->blocked);
2346                 }
2347                 spin_unlock_irq(&current->sighand->siglock);
2348         }
2349
2350         /* Wake up the parent if it is waiting so that it can recheck
2351          * wait permission to the new task SID. */
2352         read_lock(&tasklist_lock);
2353         __wake_up_parent(current, current->real_parent);
2354         read_unlock(&tasklist_lock);
2355 }
2356
2357 /* superblock security operations */
2358
2359 static int selinux_sb_alloc_security(struct super_block *sb)
2360 {
2361         return superblock_alloc_security(sb);
2362 }
2363
2364 static void selinux_sb_free_security(struct super_block *sb)
2365 {
2366         superblock_free_security(sb);
2367 }
2368
2369 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2370 {
2371         if (plen > olen)
2372                 return 0;
2373
2374         return !memcmp(prefix, option, plen);
2375 }
2376
2377 static inline int selinux_option(char *option, int len)
2378 {
2379         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2380                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2381                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2382                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2383                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2384 }
2385
2386 static inline void take_option(char **to, char *from, int *first, int len)
2387 {
2388         if (!*first) {
2389                 **to = ',';
2390                 *to += 1;
2391         } else
2392                 *first = 0;
2393         memcpy(*to, from, len);
2394         *to += len;
2395 }
2396
2397 static inline void take_selinux_option(char **to, char *from, int *first,
2398                                        int len)
2399 {
2400         int current_size = 0;
2401
2402         if (!*first) {
2403                 **to = '|';
2404                 *to += 1;
2405         } else
2406                 *first = 0;
2407
2408         while (current_size < len) {
2409                 if (*from != '"') {
2410                         **to = *from;
2411                         *to += 1;
2412                 }
2413                 from += 1;
2414                 current_size += 1;
2415         }
2416 }
2417
2418 static int selinux_sb_copy_data(char *orig, char *copy)
2419 {
2420         int fnosec, fsec, rc = 0;
2421         char *in_save, *in_curr, *in_end;
2422         char *sec_curr, *nosec_save, *nosec;
2423         int open_quote = 0;
2424
2425         in_curr = orig;
2426         sec_curr = copy;
2427
2428         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2429         if (!nosec) {
2430                 rc = -ENOMEM;
2431                 goto out;
2432         }
2433
2434         nosec_save = nosec;
2435         fnosec = fsec = 1;
2436         in_save = in_end = orig;
2437
2438         do {
2439                 if (*in_end == '"')
2440                         open_quote = !open_quote;
2441                 if ((*in_end == ',' && open_quote == 0) ||
2442                                 *in_end == '\0') {
2443                         int len = in_end - in_curr;
2444
2445                         if (selinux_option(in_curr, len))
2446                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2447                         else
2448                                 take_option(&nosec, in_curr, &fnosec, len);
2449
2450                         in_curr = in_end + 1;
2451                 }
2452         } while (*in_end++);
2453
2454         strcpy(in_save, nosec_save);
2455         free_page((unsigned long)nosec_save);
2456 out:
2457         return rc;
2458 }
2459
2460 static int selinux_sb_remount(struct super_block *sb, void *data)
2461 {
2462         int rc, i, *flags;
2463         struct security_mnt_opts opts;
2464         char *secdata, **mount_options;
2465         struct superblock_security_struct *sbsec = sb->s_security;
2466
2467         if (!(sbsec->flags & SE_SBINITIALIZED))
2468                 return 0;
2469
2470         if (!data)
2471                 return 0;
2472
2473         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2474                 return 0;
2475
2476         security_init_mnt_opts(&opts);
2477         secdata = alloc_secdata();
2478         if (!secdata)
2479                 return -ENOMEM;
2480         rc = selinux_sb_copy_data(data, secdata);
2481         if (rc)
2482                 goto out_free_secdata;
2483
2484         rc = selinux_parse_opts_str(secdata, &opts);
2485         if (rc)
2486                 goto out_free_secdata;
2487
2488         mount_options = opts.mnt_opts;
2489         flags = opts.mnt_opts_flags;
2490
2491         for (i = 0; i < opts.num_mnt_opts; i++) {
2492                 u32 sid;
2493                 size_t len;
2494
2495                 if (flags[i] == SE_SBLABELSUPP)
2496                         continue;
2497                 len = strlen(mount_options[i]);
2498                 rc = security_context_to_sid(mount_options[i], len, &sid);
2499                 if (rc) {
2500                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2501                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2502                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2503                         goto out_free_opts;
2504                 }
2505                 rc = -EINVAL;
2506                 switch (flags[i]) {
2507                 case FSCONTEXT_MNT:
2508                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2509                                 goto out_bad_option;
2510                         break;
2511                 case CONTEXT_MNT:
2512                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2513                                 goto out_bad_option;
2514                         break;
2515                 case ROOTCONTEXT_MNT: {
2516                         struct inode_security_struct *root_isec;
2517                         root_isec = sb->s_root->d_inode->i_security;
2518
2519                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2520                                 goto out_bad_option;
2521                         break;
2522                 }
2523                 case DEFCONTEXT_MNT:
2524                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2525                                 goto out_bad_option;
2526                         break;
2527                 default:
2528                         goto out_free_opts;
2529                 }
2530         }
2531
2532         rc = 0;
2533 out_free_opts:
2534         security_free_mnt_opts(&opts);
2535 out_free_secdata:
2536         free_secdata(secdata);
2537         return rc;
2538 out_bad_option:
2539         printk(KERN_WARNING "SELinux: unable to change security options "
2540                "during remount (dev %s, type=%s)\n", sb->s_id,
2541                sb->s_type->name);
2542         goto out_free_opts;
2543 }
2544
2545 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2546 {
2547         const struct cred *cred = current_cred();
2548         struct common_audit_data ad;
2549         int rc;
2550
2551         rc = superblock_doinit(sb, data);
2552         if (rc)
2553                 return rc;
2554
2555         /* Allow all mounts performed by the kernel */
2556         if (flags & MS_KERNMOUNT)
2557                 return 0;
2558
2559         ad.type = LSM_AUDIT_DATA_DENTRY;
2560         ad.u.dentry = sb->s_root;
2561         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2562 }
2563
2564 static int selinux_sb_statfs(struct dentry *dentry)
2565 {
2566         const struct cred *cred = current_cred();
2567         struct common_audit_data ad;
2568
2569         ad.type = LSM_AUDIT_DATA_DENTRY;
2570         ad.u.dentry = dentry->d_sb->s_root;
2571         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2572 }
2573
2574 static int selinux_mount(const char *dev_name,
2575                          struct path *path,
2576                          const char *type,
2577                          unsigned long flags,
2578                          void *data)
2579 {
2580         const struct cred *cred = current_cred();
2581
2582         if (flags & MS_REMOUNT)
2583                 return superblock_has_perm(cred, path->dentry->d_sb,
2584                                            FILESYSTEM__REMOUNT, NULL);
2585         else
2586                 return path_has_perm(cred, path, FILE__MOUNTON);
2587 }
2588
2589 static int selinux_umount(struct vfsmount *mnt, int flags)
2590 {
2591         const struct cred *cred = current_cred();
2592
2593         return superblock_has_perm(cred, mnt->mnt_sb,
2594                                    FILESYSTEM__UNMOUNT, NULL);
2595 }
2596
2597 /* inode security operations */
2598
2599 static int selinux_inode_alloc_security(struct inode *inode)
2600 {
2601         return inode_alloc_security(inode);
2602 }
2603
2604 static void selinux_inode_free_security(struct inode *inode)
2605 {
2606         inode_free_security(inode);
2607 }
2608
2609 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2610                                        const struct qstr *qstr, char **name,
2611                                        void **value, size_t *len)
2612 {
2613         const struct task_security_struct *tsec = current_security();
2614         struct inode_security_struct *dsec;
2615         struct superblock_security_struct *sbsec;
2616         u32 sid, newsid, clen;
2617         int rc;
2618         char *namep = NULL, *context;
2619
2620         dsec = dir->i_security;
2621         sbsec = dir->i_sb->s_security;
2622
2623         sid = tsec->sid;
2624         newsid = tsec->create_sid;
2625
2626         if ((sbsec->flags & SE_SBINITIALIZED) &&
2627             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2628                 newsid = sbsec->mntpoint_sid;
2629         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2630                 rc = security_transition_sid(sid, dsec->sid,
2631                                              inode_mode_to_security_class(inode->i_mode),
2632                                              qstr, &newsid);
2633                 if (rc) {
2634                         printk(KERN_WARNING "%s:  "
2635                                "security_transition_sid failed, rc=%d (dev=%s "
2636                                "ino=%ld)\n",
2637                                __func__,
2638                                -rc, inode->i_sb->s_id, inode->i_ino);
2639                         return rc;
2640                 }
2641         }
2642
2643         /* Possibly defer initialization to selinux_complete_init. */
2644         if (sbsec->flags & SE_SBINITIALIZED) {
2645                 struct inode_security_struct *isec = inode->i_security;
2646                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2647                 isec->sid = newsid;
2648                 isec->initialized = 1;
2649         }
2650
2651         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2652                 return -EOPNOTSUPP;
2653
2654         if (name) {
2655                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2656                 if (!namep)
2657                         return -ENOMEM;
2658                 *name = namep;
2659         }
2660
2661         if (value && len) {
2662                 rc = security_sid_to_context_force(newsid, &context, &clen);
2663                 if (rc) {
2664                         kfree(namep);
2665                         return rc;
2666                 }
2667                 *value = context;
2668                 *len = clen;
2669         }
2670
2671         return 0;
2672 }
2673
2674 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2675 {
2676         return may_create(dir, dentry, SECCLASS_FILE);
2677 }
2678
2679 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2680 {
2681         return may_link(dir, old_dentry, MAY_LINK);
2682 }
2683
2684 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2685 {
2686         return may_link(dir, dentry, MAY_UNLINK);
2687 }
2688
2689 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2690 {
2691         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2692 }
2693
2694 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2695 {
2696         return may_create(dir, dentry, SECCLASS_DIR);
2697 }
2698
2699 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2700 {
2701         return may_link(dir, dentry, MAY_RMDIR);
2702 }
2703
2704 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2705 {
2706         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2707 }
2708
2709 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2710                                 struct inode *new_inode, struct dentry *new_dentry)
2711 {
2712         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2713 }
2714
2715 static int selinux_inode_readlink(struct dentry *dentry)
2716 {
2717         const struct cred *cred = current_cred();
2718
2719         return dentry_has_perm(cred, dentry, FILE__READ);
2720 }
2721
2722 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2723 {
2724         const struct cred *cred = current_cred();
2725
2726         return dentry_has_perm(cred, dentry, FILE__READ);
2727 }
2728
2729 static noinline int audit_inode_permission(struct inode *inode,
2730                                            u32 perms, u32 audited, u32 denied,
2731                                            int result,
2732                                            unsigned flags)
2733 {
2734         struct common_audit_data ad;
2735         struct inode_security_struct *isec = inode->i_security;
2736         int rc;
2737
2738         ad.type = LSM_AUDIT_DATA_INODE;
2739         ad.u.inode = inode;
2740
2741         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2742                             audited, denied, result, &ad, flags);
2743         if (rc)
2744                 return rc;
2745         return 0;
2746 }
2747
2748 static int selinux_inode_permission(struct inode *inode, int mask)
2749 {
2750         const struct cred *cred = current_cred();
2751         u32 perms;
2752         bool from_access;
2753         unsigned flags = mask & MAY_NOT_BLOCK;
2754         struct inode_security_struct *isec;
2755         u32 sid;
2756         struct av_decision avd;
2757         int rc, rc2;
2758         u32 audited, denied;
2759
2760         from_access = mask & MAY_ACCESS;
2761         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2762
2763         /* No permission to check.  Existence test. */
2764         if (!mask)
2765                 return 0;
2766
2767         validate_creds(cred);
2768
2769         if (unlikely(IS_PRIVATE(inode)))
2770                 return 0;
2771
2772         perms = file_mask_to_av(inode->i_mode, mask);
2773
2774         sid = cred_sid(cred);
2775         isec = inode->i_security;
2776
2777         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2778         audited = avc_audit_required(perms, &avd, rc,
2779                                      from_access ? FILE__AUDIT_ACCESS : 0,
2780                                      &denied);
2781         if (likely(!audited))
2782                 return rc;
2783
2784         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2785         if (rc2)
2786                 return rc2;
2787         return rc;
2788 }
2789
2790 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2791 {
2792         const struct cred *cred = current_cred();
2793         unsigned int ia_valid = iattr->ia_valid;
2794         __u32 av = FILE__WRITE;
2795
2796         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2797         if (ia_valid & ATTR_FORCE) {
2798                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2799                               ATTR_FORCE);
2800                 if (!ia_valid)
2801                         return 0;
2802         }
2803
2804         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2805                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2806                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2807
2808         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2809                 av |= FILE__OPEN;
2810
2811         return dentry_has_perm(cred, dentry, av);
2812 }
2813
2814 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2815 {
2816         const struct cred *cred = current_cred();
2817         struct path path;
2818
2819         path.dentry = dentry;
2820         path.mnt = mnt;
2821
2822         return path_has_perm(cred, &path, FILE__GETATTR);
2823 }
2824
2825 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2826 {
2827         const struct cred *cred = current_cred();
2828
2829         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2830                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2831                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2832                         if (!capable(CAP_SETFCAP))
2833                                 return -EPERM;
2834                 } else if (!capable(CAP_SYS_ADMIN)) {
2835                         /* A different attribute in the security namespace.
2836                            Restrict to administrator. */
2837                         return -EPERM;
2838                 }
2839         }
2840
2841         /* Not an attribute we recognize, so just check the
2842            ordinary setattr permission. */
2843         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2844 }
2845
2846 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2847                                   const void *value, size_t size, int flags)
2848 {
2849         struct inode *inode = dentry->d_inode;
2850         struct inode_security_struct *isec = inode->i_security;
2851         struct superblock_security_struct *sbsec;
2852         struct common_audit_data ad;
2853         u32 newsid, sid = current_sid();
2854         int rc = 0;
2855
2856         if (strcmp(name, XATTR_NAME_SELINUX))
2857                 return selinux_inode_setotherxattr(dentry, name);
2858
2859         sbsec = inode->i_sb->s_security;
2860         if (!(sbsec->flags & SE_SBLABELSUPP))
2861                 return -EOPNOTSUPP;
2862
2863         if (!inode_owner_or_capable(inode))
2864                 return -EPERM;
2865
2866         ad.type = LSM_AUDIT_DATA_DENTRY;
2867         ad.u.dentry = dentry;
2868
2869         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2870                           FILE__RELABELFROM, &ad);
2871         if (rc)
2872                 return rc;
2873
2874         rc = security_context_to_sid(value, size, &newsid);
2875         if (rc == -EINVAL) {
2876                 if (!capable(CAP_MAC_ADMIN)) {
2877                         struct audit_buffer *ab;
2878                         size_t audit_size;
2879                         const char *str;
2880
2881                         /* We strip a nul only if it is at the end, otherwise the
2882                          * context contains a nul and we should audit that */
2883                         if (value) {
2884                                 str = value;
2885                                 if (str[size - 1] == '\0')
2886                                         audit_size = size - 1;
2887                                 else
2888                                         audit_size = size;
2889                         } else {
2890                                 str = "";
2891                                 audit_size = 0;
2892                         }
2893                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2894                         audit_log_format(ab, "op=setxattr invalid_context=");
2895                         audit_log_n_untrustedstring(ab, value, audit_size);
2896                         audit_log_end(ab);
2897
2898                         return rc;
2899                 }
2900                 rc = security_context_to_sid_force(value, size, &newsid);
2901         }
2902         if (rc)
2903                 return rc;
2904
2905         rc = avc_has_perm(sid, newsid, isec->sclass,
2906                           FILE__RELABELTO, &ad);
2907         if (rc)
2908                 return rc;
2909
2910         rc = security_validate_transition(isec->sid, newsid, sid,
2911                                           isec->sclass);
2912         if (rc)
2913                 return rc;
2914
2915         return avc_has_perm(newsid,
2916                             sbsec->sid,
2917                             SECCLASS_FILESYSTEM,
2918                             FILESYSTEM__ASSOCIATE,
2919                             &ad);
2920 }
2921
2922 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2923                                         const void *value, size_t size,
2924                                         int flags)
2925 {
2926         struct inode *inode = dentry->d_inode;
2927         struct inode_security_struct *isec = inode->i_security;
2928         u32 newsid;
2929         int rc;
2930
2931         if (strcmp(name, XATTR_NAME_SELINUX)) {
2932                 /* Not an attribute we recognize, so nothing to do. */
2933                 return;
2934         }
2935
2936         rc = security_context_to_sid_force(value, size, &newsid);
2937         if (rc) {
2938                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2939                        "for (%s, %lu), rc=%d\n",
2940                        inode->i_sb->s_id, inode->i_ino, -rc);
2941                 return;
2942         }
2943
2944         isec->sid = newsid;
2945         return;
2946 }
2947
2948 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2949 {
2950         const struct cred *cred = current_cred();
2951
2952         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2953 }
2954
2955 static int selinux_inode_listxattr(struct dentry *dentry)
2956 {
2957         const struct cred *cred = current_cred();
2958
2959         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2960 }
2961
2962 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2963 {
2964         if (strcmp(name, XATTR_NAME_SELINUX))
2965                 return selinux_inode_setotherxattr(dentry, name);
2966
2967         /* No one is allowed to remove a SELinux security label.
2968            You can change the label, but all data must be labeled. */
2969         return -EACCES;
2970 }
2971
2972 /*
2973  * Copy the inode security context value to the user.
2974  *
2975  * Permission check is handled by selinux_inode_getxattr hook.
2976  */
2977 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2978 {
2979         u32 size;
2980         int error;
2981         char *context = NULL;
2982         struct inode_security_struct *isec = inode->i_security;
2983
2984         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2985                 return -EOPNOTSUPP;
2986
2987         /*
2988          * If the caller has CAP_MAC_ADMIN, then get the raw context
2989          * value even if it is not defined by current policy; otherwise,
2990          * use the in-core value under current policy.
2991          * Use the non-auditing forms of the permission checks since
2992          * getxattr may be called by unprivileged processes commonly
2993          * and lack of permission just means that we fall back to the
2994          * in-core context value, not a denial.
2995          */
2996         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2997                                 SECURITY_CAP_NOAUDIT);
2998         if (!error)
2999                 error = security_sid_to_context_force(isec->sid, &context,
3000                                                       &size);
3001         else
3002                 error = security_sid_to_context(isec->sid, &context, &size);
3003         if (error)
3004                 return error;
3005         error = size;
3006         if (alloc) {
3007                 *buffer = context;
3008                 goto out_nofree;
3009         }
3010         kfree(context);
3011 out_nofree:
3012         return error;
3013 }
3014
3015 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3016                                      const void *value, size_t size, int flags)
3017 {
3018         struct inode_security_struct *isec = inode->i_security;
3019         u32 newsid;
3020         int rc;
3021
3022         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3023                 return -EOPNOTSUPP;
3024
3025         if (!value || !size)
3026                 return -EACCES;
3027
3028         rc = security_context_to_sid((void *)value, size, &newsid);
3029         if (rc)
3030                 return rc;
3031
3032         isec->sid = newsid;
3033         isec->initialized = 1;
3034         return 0;
3035 }
3036
3037 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3038 {
3039         const int len = sizeof(XATTR_NAME_SELINUX);
3040         if (buffer && len <= buffer_size)
3041                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3042         return len;
3043 }
3044
3045 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3046 {
3047         struct inode_security_struct *isec = inode->i_security;
3048         *secid = isec->sid;
3049 }
3050
3051 /* file security operations */
3052
3053 static int selinux_revalidate_file_permission(struct file *file, int mask)
3054 {
3055         const struct cred *cred = current_cred();
3056         struct inode *inode = file_inode(file);
3057
3058         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3059         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3060                 mask |= MAY_APPEND;
3061
3062         return file_has_perm(cred, file,
3063                              file_mask_to_av(inode->i_mode, mask));
3064 }
3065
3066 static int selinux_file_permission(struct file *file, int mask)
3067 {
3068         struct inode *inode = file_inode(file);
3069         struct file_security_struct *fsec = file->f_security;
3070         struct inode_security_struct *isec = inode->i_security;
3071         u32 sid = current_sid();
3072
3073         if (!mask)
3074                 /* No permission to check.  Existence test. */
3075                 return 0;
3076
3077         if (sid == fsec->sid && fsec->isid == isec->sid &&
3078             fsec->pseqno == avc_policy_seqno())
3079                 /* No change since file_open check. */
3080                 return 0;
3081
3082         return selinux_revalidate_file_permission(file, mask);
3083 }
3084
3085 static int selinux_file_alloc_security(struct file *file)
3086 {
3087         return file_alloc_security(file);
3088 }
3089
3090 static void selinux_file_free_security(struct file *file)
3091 {
3092         file_free_security(file);
3093 }
3094
3095 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3096                               unsigned long arg)
3097 {
3098         const struct cred *cred = current_cred();
3099         int error = 0;
3100
3101         switch (cmd) {
3102         case FIONREAD:
3103         /* fall through */
3104         case FIBMAP:
3105         /* fall through */
3106         case FIGETBSZ:
3107         /* fall through */
3108         case FS_IOC_GETFLAGS:
3109         /* fall through */
3110         case FS_IOC_GETVERSION:
3111                 error = file_has_perm(cred, file, FILE__GETATTR);
3112                 break;
3113
3114         case FS_IOC_SETFLAGS:
3115         /* fall through */
3116         case FS_IOC_SETVERSION:
3117                 error = file_has_perm(cred, file, FILE__SETATTR);
3118                 break;
3119
3120         /* sys_ioctl() checks */
3121         case FIONBIO:
3122         /* fall through */
3123         case FIOASYNC:
3124                 error = file_has_perm(cred, file, 0);
3125                 break;
3126
3127         case KDSKBENT:
3128         case KDSKBSENT:
3129                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3130                                             SECURITY_CAP_AUDIT);
3131                 break;
3132
3133         /* default case assumes that the command will go
3134          * to the file's ioctl() function.
3135          */
3136         default:
3137                 error = file_has_perm(cred, file, FILE__IOCTL);
3138         }
3139         return error;
3140 }
3141
3142 static int default_noexec;
3143
3144 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3145 {
3146         const struct cred *cred = current_cred();
3147         int rc = 0;
3148
3149         if (default_noexec &&
3150             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3151                 /*
3152                  * We are making executable an anonymous mapping or a
3153                  * private file mapping that will also be writable.
3154                  * This has an additional check.
3155                  */
3156                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3157                 if (rc)
3158                         goto error;
3159         }
3160
3161         if (file) {
3162                 /* read access is always possible with a mapping */
3163                 u32 av = FILE__READ;
3164
3165                 /* write access only matters if the mapping is shared */
3166                 if (shared && (prot & PROT_WRITE))
3167                         av |= FILE__WRITE;
3168
3169                 if (prot & PROT_EXEC)
3170                         av |= FILE__EXECUTE;
3171
3172                 return file_has_perm(cred, file, av);
3173         }
3174
3175 error:
3176         return rc;
3177 }
3178
3179 static int selinux_mmap_addr(unsigned long addr)
3180 {
3181         int rc;
3182
3183         /* do DAC check on address space usage */
3184         rc = cap_mmap_addr(addr);
3185         if (rc)
3186                 return rc;
3187
3188         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3189                 u32 sid = current_sid();
3190                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3191                                   MEMPROTECT__MMAP_ZERO, NULL);
3192         }
3193
3194         return rc;
3195 }
3196
3197 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3198                              unsigned long prot, unsigned long flags)
3199 {
3200         if (selinux_checkreqprot)
3201                 prot = reqprot;
3202
3203         return file_map_prot_check(file, prot,
3204                                    (flags & MAP_TYPE) == MAP_SHARED);
3205 }
3206
3207 static int selinux_file_mprotect(struct vm_area_struct *vma,
3208                                  unsigned long reqprot,
3209                                  unsigned long prot)
3210 {
3211         const struct cred *cred = current_cred();
3212
3213         if (selinux_checkreqprot)
3214                 prot = reqprot;
3215
3216         if (default_noexec &&
3217             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3218                 int rc = 0;
3219                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3220                     vma->vm_end <= vma->vm_mm->brk) {
3221                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3222                 } else if (!vma->vm_file &&
3223                            vma->vm_start <= vma->vm_mm->start_stack &&
3224                            vma->vm_end >= vma->vm_mm->start_stack) {
3225                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3226                 } else if (vma->vm_file && vma->anon_vma) {
3227                         /*
3228                          * We are making executable a file mapping that has
3229                          * had some COW done. Since pages might have been
3230                          * written, check ability to execute the possibly
3231                          * modified content.  This typically should only
3232                          * occur for text relocations.
3233                          */
3234                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3235                 }
3236                 if (rc)
3237                         return rc;
3238         }
3239
3240         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3241 }
3242
3243 static int selinux_file_lock(struct file *file, unsigned int cmd)
3244 {
3245         const struct cred *cred = current_cred();
3246
3247         return file_has_perm(cred, file, FILE__LOCK);
3248 }
3249
3250 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3251                               unsigned long arg)
3252 {
3253         const struct cred *cred = current_cred();
3254         int err = 0;
3255
3256         switch (cmd) {
3257         case F_SETFL:
3258                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3259                         err = file_has_perm(cred, file, FILE__WRITE);
3260                         break;
3261                 }
3262                 /* fall through */
3263         case F_SETOWN:
3264         case F_SETSIG:
3265         case F_GETFL:
3266         case F_GETOWN:
3267         case F_GETSIG:
3268         case F_GETOWNER_UIDS:
3269                 /* Just check FD__USE permission */
3270                 err = file_has_perm(cred, file, 0);
3271                 break;
3272         case F_GETLK:
3273         case F_SETLK:
3274         case F_SETLKW:
3275 #if BITS_PER_LONG == 32
3276         case F_GETLK64:
3277         case F_SETLK64:
3278         case F_SETLKW64:
3279 #endif
3280                 err = file_has_perm(cred, file, FILE__LOCK);
3281                 break;
3282         }
3283
3284         return err;
3285 }
3286
3287 static int selinux_file_set_fowner(struct file *file)
3288 {
3289         struct file_security_struct *fsec;
3290
3291         fsec = file->f_security;
3292         fsec->fown_sid = current_sid();
3293
3294         return 0;
3295 }
3296
3297 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3298                                        struct fown_struct *fown, int signum)
3299 {
3300         struct file *file;
3301         u32 sid = task_sid(tsk);
3302         u32 perm;
3303         struct file_security_struct *fsec;
3304
3305         /* struct fown_struct is never outside the context of a struct file */
3306         file = container_of(fown, struct file, f_owner);
3307
3308         fsec = file->f_security;
3309
3310         if (!signum)
3311                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3312         else
3313                 perm = signal_to_av(signum);
3314
3315         return avc_has_perm(fsec->fown_sid, sid,
3316                             SECCLASS_PROCESS, perm, NULL);
3317 }
3318
3319 static int selinux_file_receive(struct file *file)
3320 {
3321         const struct cred *cred = current_cred();
3322
3323         return file_has_perm(cred, file, file_to_av(file));
3324 }
3325
3326 static int selinux_file_open(struct file *file, const struct cred *cred)
3327 {
3328         struct file_security_struct *fsec;
3329         struct inode_security_struct *isec;
3330
3331         fsec = file->f_security;
3332         isec = file_inode(file)->i_security;
3333         /*
3334          * Save inode label and policy sequence number
3335          * at open-time so that selinux_file_permission
3336          * can determine whether revalidation is necessary.
3337          * Task label is already saved in the file security
3338          * struct as its SID.
3339          */
3340         fsec->isid = isec->sid;
3341         fsec->pseqno = avc_policy_seqno();
3342         /*
3343          * Since the inode label or policy seqno may have changed
3344          * between the selinux_inode_permission check and the saving
3345          * of state above, recheck that access is still permitted.
3346          * Otherwise, access might never be revalidated against the
3347          * new inode label or new policy.
3348          * This check is not redundant - do not remove.
3349          */
3350         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3351 }
3352
3353 /* task security operations */
3354
3355 static int selinux_task_create(unsigned long clone_flags)
3356 {
3357         return current_has_perm(current, PROCESS__FORK);
3358 }
3359
3360 /*
3361  * allocate the SELinux part of blank credentials
3362  */
3363 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3364 {
3365         struct task_security_struct *tsec;
3366
3367         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3368         if (!tsec)
3369                 return -ENOMEM;
3370
3371         cred->security = tsec;
3372         return 0;
3373 }
3374
3375 /*
3376  * detach and free the LSM part of a set of credentials
3377  */
3378 static void selinux_cred_free(struct cred *cred)
3379 {
3380         struct task_security_struct *tsec = cred->security;
3381
3382         /*
3383          * cred->security == NULL if security_cred_alloc_blank() or
3384          * security_prepare_creds() returned an error.
3385          */
3386         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3387         cred->security = (void *) 0x7UL;
3388         kfree(tsec);
3389 }
3390
3391 /*
3392  * prepare a new set of credentials for modification
3393  */
3394 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3395                                 gfp_t gfp)
3396 {
3397         const struct task_security_struct *old_tsec;
3398         struct task_security_struct *tsec;
3399
3400         old_tsec = old->security;
3401
3402         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3403         if (!tsec)
3404                 return -ENOMEM;
3405
3406         new->security = tsec;
3407         return 0;
3408 }
3409
3410 /*
3411  * transfer the SELinux data to a blank set of creds
3412  */
3413 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3414 {
3415         const struct task_security_struct *old_tsec = old->security;
3416         struct task_security_struct *tsec = new->security;
3417
3418         *tsec = *old_tsec;
3419 }
3420
3421 /*
3422  * set the security data for a kernel service
3423  * - all the creation contexts are set to unlabelled
3424  */
3425 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3426 {
3427         struct task_security_struct *tsec = new->security;
3428         u32 sid = current_sid();
3429         int ret;
3430
3431         ret = avc_has_perm(sid, secid,
3432                            SECCLASS_KERNEL_SERVICE,
3433                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3434                            NULL);
3435         if (ret == 0) {
3436                 tsec->sid = secid;
3437                 tsec->create_sid = 0;
3438                 tsec->keycreate_sid = 0;
3439                 tsec->sockcreate_sid = 0;
3440         }
3441         return ret;
3442 }
3443
3444 /*
3445  * set the file creation context in a security record to the same as the
3446  * objective context of the specified inode
3447  */
3448 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3449 {
3450         struct inode_security_struct *isec = inode->i_security;
3451         struct task_security_struct *tsec = new->security;
3452         u32 sid = current_sid();
3453         int ret;
3454
3455         ret = avc_has_perm(sid, isec->sid,
3456                            SECCLASS_KERNEL_SERVICE,
3457                            KERNEL_SERVICE__CREATE_FILES_AS,
3458                            NULL);
3459
3460         if (ret == 0)
3461                 tsec->create_sid = isec->sid;
3462         return ret;
3463 }
3464
3465 static int selinux_kernel_module_request(char *kmod_name)
3466 {
3467         u32 sid;
3468         struct common_audit_data ad;
3469
3470         sid = task_sid(current);
3471
3472         ad.type = LSM_AUDIT_DATA_KMOD;
3473         ad.u.kmod_name = kmod_name;
3474
3475         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3476                             SYSTEM__MODULE_REQUEST, &ad);
3477 }
3478
3479 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3480 {
3481         return current_has_perm(p, PROCESS__SETPGID);
3482 }
3483
3484 static int selinux_task_getpgid(struct task_struct *p)
3485 {
3486         return current_has_perm(p, PROCESS__GETPGID);
3487 }
3488
3489 static int selinux_task_getsid(struct task_struct *p)
3490 {
3491         return current_has_perm(p, PROCESS__GETSESSION);
3492 }
3493
3494 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3495 {
3496         *secid = task_sid(p);
3497 }
3498
3499 static int selinux_task_setnice(struct task_struct *p, int nice)
3500 {
3501         int rc;
3502
3503         rc = cap_task_setnice(p, nice);
3504         if (rc)
3505                 return rc;
3506
3507         return current_has_perm(p, PROCESS__SETSCHED);
3508 }
3509
3510 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3511 {
3512         int rc;
3513
3514         rc = cap_task_setioprio(p, ioprio);
3515         if (rc)
3516                 return rc;
3517
3518         return current_has_perm(p, PROCESS__SETSCHED);
3519 }
3520
3521 static int selinux_task_getioprio(struct task_struct *p)
3522 {
3523         return current_has_perm(p, PROCESS__GETSCHED);
3524 }
3525
3526 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3527                 struct rlimit *new_rlim)
3528 {
3529         struct rlimit *old_rlim = p->signal->rlim + resource;
3530
3531         /* Control the ability to change the hard limit (whether
3532            lowering or raising it), so that the hard limit can
3533            later be used as a safe reset point for the soft limit
3534            upon context transitions.  See selinux_bprm_committing_creds. */
3535         if (old_rlim->rlim_max != new_rlim->rlim_max)
3536                 return current_has_perm(p, PROCESS__SETRLIMIT);
3537
3538         return 0;
3539 }
3540
3541 static int selinux_task_setscheduler(struct task_struct *p)
3542 {
3543         int rc;
3544
3545         rc = cap_task_setscheduler(p);
3546         if (rc)
3547                 return rc;
3548
3549         return current_has_perm(p, PROCESS__SETSCHED);
3550 }
3551
3552 static int selinux_task_getscheduler(struct task_struct *p)
3553 {
3554         return current_has_perm(p, PROCESS__GETSCHED);
3555 }
3556
3557 static int selinux_task_movememory(struct task_struct *p)
3558 {
3559         return current_has_perm(p, PROCESS__SETSCHED);
3560 }
3561
3562 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3563                                 int sig, u32 secid)
3564 {
3565         u32 perm;
3566         int rc;
3567
3568         if (!sig)
3569                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3570         else
3571                 perm = signal_to_av(sig);
3572         if (secid)
3573                 rc = avc_has_perm(secid, task_sid(p),
3574                                   SECCLASS_PROCESS, perm, NULL);
3575         else
3576                 rc = current_has_perm(p, perm);
3577         return rc;
3578 }
3579
3580 static int selinux_task_wait(struct task_struct *p)
3581 {
3582         return task_has_perm(p, current, PROCESS__SIGCHLD);
3583 }
3584
3585 static void selinux_task_to_inode(struct task_struct *p,
3586                                   struct inode *inode)
3587 {
3588         struct inode_security_struct *isec = inode->i_security;
3589         u32 sid = task_sid(p);
3590
3591         isec->sid = sid;
3592         isec->initialized = 1;
3593 }
3594
3595 /* Returns error only if unable to parse addresses */
3596 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3597                         struct common_audit_data *ad, u8 *proto)
3598 {
3599         int offset, ihlen, ret = -EINVAL;
3600         struct iphdr _iph, *ih;
3601
3602         offset = skb_network_offset(skb);
3603         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3604         if (ih == NULL)
3605                 goto out;
3606
3607         ihlen = ih->ihl * 4;
3608         if (ihlen < sizeof(_iph))
3609                 goto out;
3610
3611         ad->u.net->v4info.saddr = ih->saddr;
3612         ad->u.net->v4info.daddr = ih->daddr;
3613         ret = 0;
3614
3615         if (proto)
3616                 *proto = ih->protocol;
3617
3618         switch (ih->protocol) {
3619         case IPPROTO_TCP: {
3620                 struct tcphdr _tcph, *th;
3621
3622                 if (ntohs(ih->frag_off) & IP_OFFSET)
3623                         break;
3624
3625                 offset += ihlen;
3626                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3627                 if (th == NULL)
3628                         break;
3629
3630                 ad->u.net->sport = th->source;
3631                 ad->u.net->dport = th->dest;
3632                 break;
3633         }
3634
3635         case IPPROTO_UDP: {
3636                 struct udphdr _udph, *uh;
3637
3638                 if (ntohs(ih->frag_off) & IP_OFFSET)
3639                         break;
3640
3641                 offset += ihlen;
3642                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3643                 if (uh == NULL)
3644                         break;
3645
3646                 ad->u.net->sport = uh->source;
3647                 ad->u.net->dport = uh->dest;
3648                 break;
3649         }
3650
3651         case IPPROTO_DCCP: {
3652                 struct dccp_hdr _dccph, *dh;
3653
3654                 if (ntohs(ih->frag_off) & IP_OFFSET)
3655                         break;
3656
3657                 offset += ihlen;
3658                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3659                 if (dh == NULL)
3660                         break;
3661
3662                 ad->u.net->sport = dh->dccph_sport;
3663                 ad->u.net->dport = dh->dccph_dport;
3664                 break;
3665         }
3666
3667         default:
3668                 break;
3669         }
3670 out:
3671         return ret;
3672 }
3673
3674 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3675
3676 /* Returns error only if unable to parse addresses */
3677 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3678                         struct common_audit_data *ad, u8 *proto)
3679 {
3680         u8 nexthdr;
3681         int ret = -EINVAL, offset;
3682         struct ipv6hdr _ipv6h, *ip6;
3683         __be16 frag_off;
3684
3685         offset = skb_network_offset(skb);
3686         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3687         if (ip6 == NULL)
3688                 goto out;
3689
3690         ad->u.net->v6info.saddr = ip6->saddr;
3691         ad->u.net->v6info.daddr = ip6->daddr;
3692         ret = 0;
3693
3694         nexthdr = ip6->nexthdr;
3695         offset += sizeof(_ipv6h);
3696         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3697         if (offset < 0)
3698                 goto out;
3699
3700         if (proto)
3701                 *proto = nexthdr;
3702
3703         switch (nexthdr) {
3704         case IPPROTO_TCP: {
3705                 struct tcphdr _tcph, *th;
3706
3707                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3708                 if (th == NULL)
3709                         break;
3710
3711                 ad->u.net->sport = th->source;
3712                 ad->u.net->dport = th->dest;
3713                 break;
3714         }
3715
3716         case IPPROTO_UDP: {
3717                 struct udphdr _udph, *uh;
3718
3719                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3720                 if (uh == NULL)
3721                         break;
3722
3723                 ad->u.net->sport = uh->source;
3724                 ad->u.net->dport = uh->dest;
3725                 break;
3726         }
3727
3728         case IPPROTO_DCCP: {
3729                 struct dccp_hdr _dccph, *dh;
3730
3731                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3732                 if (dh == NULL)
3733                         break;
3734
3735                 ad->u.net->sport = dh->dccph_sport;
3736                 ad->u.net->dport = dh->dccph_dport;
3737                 break;
3738         }
3739
3740         /* includes fragments */
3741         default:
3742                 break;
3743         }
3744 out:
3745         return ret;
3746 }
3747
3748 #endif /* IPV6 */
3749
3750 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3751                              char **_addrp, int src, u8 *proto)
3752 {
3753         char *addrp;
3754         int ret;
3755
3756         switch (ad->u.net->family) {
3757         case PF_INET:
3758                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3759                 if (ret)
3760                         goto parse_error;
3761                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3762                                        &ad->u.net->v4info.daddr);
3763                 goto okay;
3764
3765 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3766         case PF_INET6:
3767                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3768                 if (ret)
3769                         goto parse_error;
3770                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3771                                        &ad->u.net->v6info.daddr);
3772                 goto okay;
3773 #endif  /* IPV6 */
3774         default:
3775                 addrp = NULL;
3776                 goto okay;
3777         }
3778
3779 parse_error:
3780         printk(KERN_WARNING
3781                "SELinux: failure in selinux_parse_skb(),"
3782                " unable to parse packet\n");
3783         return ret;
3784
3785 okay:
3786         if (_addrp)
3787                 *_addrp = addrp;
3788         return 0;
3789 }
3790
3791 /**
3792  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3793  * @skb: the packet
3794  * @family: protocol family
3795  * @sid: the packet's peer label SID
3796  *
3797  * Description:
3798  * Check the various different forms of network peer labeling and determine
3799  * the peer label/SID for the packet; most of the magic actually occurs in
3800  * the security server function security_net_peersid_cmp().  The function
3801  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3802  * or -EACCES if @sid is invalid due to inconsistencies with the different
3803  * peer labels.
3804  *
3805  */
3806 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3807 {
3808         int err;
3809         u32 xfrm_sid;
3810         u32 nlbl_sid;
3811         u32 nlbl_type;
3812
3813         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3814         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3815
3816         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3817         if (unlikely(err)) {
3818                 printk(KERN_WARNING
3819                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3820                        " unable to determine packet's peer label\n");
3821                 return -EACCES;
3822         }
3823
3824         return 0;
3825 }
3826
3827 /* socket security operations */
3828
3829 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3830                                  u16 secclass, u32 *socksid)
3831 {
3832         if (tsec->sockcreate_sid > SECSID_NULL) {
3833                 *socksid = tsec->sockcreate_sid;
3834                 return 0;
3835         }
3836
3837         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3838                                        socksid);
3839 }
3840
3841 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3842 {
3843         struct sk_security_struct *sksec = sk->sk_security;
3844         struct common_audit_data ad;
3845         struct lsm_network_audit net = {0,};
3846         u32 tsid = task_sid(task);
3847
3848         if (sksec->sid == SECINITSID_KERNEL)
3849                 return 0;
3850
3851         ad.type = LSM_AUDIT_DATA_NET;
3852         ad.u.net = &net;
3853         ad.u.net->sk = sk;
3854
3855         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3856 }
3857
3858 static int selinux_socket_create(int family, int type,
3859                                  int protocol, int kern)
3860 {
3861         const struct task_security_struct *tsec = current_security();
3862         u32 newsid;
3863         u16 secclass;
3864         int rc;
3865
3866         if (kern)
3867                 return 0;
3868
3869         secclass = socket_type_to_security_class(family, type, protocol);
3870         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3871         if (rc)
3872                 return rc;
3873
3874         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3875 }
3876
3877 static int selinux_socket_post_create(struct socket *sock, int family,
3878                                       int type, int protocol, int kern)
3879 {
3880         const struct task_security_struct *tsec = current_security();
3881         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3882         struct sk_security_struct *sksec;
3883         int err = 0;
3884
3885         isec->sclass = socket_type_to_security_class(family, type, protocol);
3886
3887         if (kern)
3888                 isec->sid = SECINITSID_KERNEL;
3889         else {
3890                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3891                 if (err)
3892                         return err;
3893         }
3894
3895         isec->initialized = 1;
3896
3897         if (sock->sk) {
3898                 sksec = sock->sk->sk_security;
3899                 sksec->sid = isec->sid;
3900                 sksec->sclass = isec->sclass;
3901                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3902         }
3903
3904         return err;
3905 }
3906
3907 /* Range of port numbers used to automatically bind.
3908    Need to determine whether we should perform a name_bind
3909    permission check between the socket and the port number. */
3910
3911 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3912 {
3913         struct sock *sk = sock->sk;
3914         u16 family;
3915         int err;
3916
3917         err = sock_has_perm(current, sk, SOCKET__BIND);
3918         if (err)
3919                 goto out;
3920
3921         /*
3922          * If PF_INET or PF_INET6, check name_bind permission for the port.
3923          * Multiple address binding for SCTP is not supported yet: we just
3924          * check the first address now.
3925          */
3926         family = sk->sk_family;
3927         if (family == PF_INET || family == PF_INET6) {
3928                 char *addrp;
3929                 struct sk_security_struct *sksec = sk->sk_security;
3930                 struct common_audit_data ad;
3931                 struct lsm_network_audit net = {0,};
3932                 struct sockaddr_in *addr4 = NULL;
3933                 struct sockaddr_in6 *addr6 = NULL;
3934                 unsigned short snum;
3935                 u32 sid, node_perm;
3936
3937                 if (family == PF_INET) {
3938                         addr4 = (struct sockaddr_in *)address;
3939                         snum = ntohs(addr4->sin_port);
3940                         addrp = (char *)&addr4->sin_addr.s_addr;
3941                 } else {
3942                         addr6 = (struct sockaddr_in6 *)address;
3943                         snum = ntohs(addr6->sin6_port);
3944                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3945                 }
3946
3947                 if (snum) {
3948                         int low, high;
3949
3950                         inet_get_local_port_range(&low, &high);
3951
3952                         if (snum < max(PROT_SOCK, low) || snum > high) {
3953                                 err = sel_netport_sid(sk->sk_protocol,
3954                                                       snum, &sid);
3955                                 if (err)
3956                                         goto out;
3957                                 ad.type = LSM_AUDIT_DATA_NET;
3958                                 ad.u.net = &net;
3959                                 ad.u.net->sport = htons(snum);
3960                                 ad.u.net->family = family;
3961                                 err = avc_has_perm(sksec->sid, sid,
3962                                                    sksec->sclass,
3963                                                    SOCKET__NAME_BIND, &ad);
3964                                 if (err)
3965                                         goto out;
3966                         }
3967                 }
3968
3969                 switch (sksec->sclass) {
3970                 case SECCLASS_TCP_SOCKET:
3971                         node_perm = TCP_SOCKET__NODE_BIND;
3972                         break;
3973
3974                 case SECCLASS_UDP_SOCKET:
3975                         node_perm = UDP_SOCKET__NODE_BIND;
3976                         break;
3977
3978                 case SECCLASS_DCCP_SOCKET:
3979                         node_perm = DCCP_SOCKET__NODE_BIND;
3980                         break;
3981
3982                 default:
3983                         node_perm = RAWIP_SOCKET__NODE_BIND;
3984                         break;
3985                 }
3986
3987                 err = sel_netnode_sid(addrp, family, &sid);
3988                 if (err)
3989                         goto out;
3990
3991                 ad.type = LSM_AUDIT_DATA_NET;
3992                 ad.u.net = &net;
3993                 ad.u.net->sport = htons(snum);
3994                 ad.u.net->family = family;
3995
3996                 if (family == PF_INET)
3997                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3998                 else
3999                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4000
4001                 err = avc_has_perm(sksec->sid, sid,
4002                                    sksec->sclass, node_perm, &ad);
4003                 if (err)
4004                         goto out;
4005         }
4006 out:
4007         return err;
4008 }
4009
4010 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4011 {
4012         struct sock *sk = sock->sk;
4013         struct sk_security_struct *sksec = sk->sk_security;
4014         int err;
4015
4016         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4017         if (err)
4018                 return err;
4019
4020         /*
4021          * If a TCP or DCCP socket, check name_connect permission for the port.
4022          */
4023         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4024             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4025                 struct common_audit_data ad;
4026                 struct lsm_network_audit net = {0,};
4027                 struct sockaddr_in *addr4 = NULL;
4028                 struct sockaddr_in6 *addr6 = NULL;
4029                 unsigned short snum;
4030                 u32 sid, perm;
4031
4032                 if (sk->sk_family == PF_INET) {
4033                         addr4 = (struct sockaddr_in *)address;
4034                         if (addrlen < sizeof(struct sockaddr_in))
4035                                 return -EINVAL;
4036                         snum = ntohs(addr4->sin_port);
4037                 } else {
4038                         addr6 = (struct sockaddr_in6 *)address;
4039                         if (addrlen < SIN6_LEN_RFC2133)
4040                                 return -EINVAL;
4041                         snum = ntohs(addr6->sin6_port);
4042                 }
4043
4044                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4045                 if (err)
4046                         goto out;
4047
4048                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4049                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4050
4051                 ad.type = LSM_AUDIT_DATA_NET;
4052                 ad.u.net = &net;
4053                 ad.u.net->dport = htons(snum);
4054                 ad.u.net->family = sk->sk_family;
4055                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4056                 if (err)
4057                         goto out;
4058         }
4059
4060         err = selinux_netlbl_socket_connect(sk, address);
4061
4062 out:
4063         return err;
4064 }
4065
4066 static int selinux_socket_listen(struct socket *sock, int backlog)
4067 {
4068         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4069 }
4070
4071 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4072 {
4073         int err;
4074         struct inode_security_struct *isec;
4075         struct inode_security_struct *newisec;
4076
4077         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4078         if (err)
4079                 return err;
4080
4081         newisec = SOCK_INODE(newsock)->i_security;
4082
4083         isec = SOCK_INODE(sock)->i_security;
4084         newisec->sclass = isec->sclass;
4085         newisec->sid = isec->sid;
4086         newisec->initialized = 1;
4087
4088         return 0;
4089 }
4090
4091 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4092                                   int size)
4093 {
4094         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4095 }
4096
4097 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4098                                   int size, int flags)
4099 {
4100         return sock_has_perm(current, sock->sk, SOCKET__READ);
4101 }
4102
4103 static int selinux_socket_getsockname(struct socket *sock)
4104 {
4105         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4106 }
4107
4108 static int selinux_socket_getpeername(struct socket *sock)
4109 {
4110         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4111 }
4112
4113 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4114 {
4115         int err;
4116
4117         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4118         if (err)
4119                 return err;
4120
4121         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4122 }
4123
4124 static int selinux_socket_getsockopt(struct socket *sock, int level,
4125                                      int optname)
4126 {
4127         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4128 }
4129
4130 static int selinux_socket_shutdown(struct socket *sock, int how)
4131 {
4132         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4133 }
4134
4135 static int selinux_socket_unix_stream_connect(struct sock *sock,
4136                                               struct sock *other,
4137                                               struct sock *newsk)
4138 {
4139         struct sk_security_struct *sksec_sock = sock->sk_security;
4140         struct sk_security_struct *sksec_other = other->sk_security;
4141         struct sk_security_struct *sksec_new = newsk->sk_security;
4142         struct common_audit_data ad;
4143         struct lsm_network_audit net = {0,};
4144         int err;
4145
4146         ad.type = LSM_AUDIT_DATA_NET;
4147         ad.u.net = &net;
4148         ad.u.net->sk = other;
4149
4150         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4151                            sksec_other->sclass,
4152                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4153         if (err)
4154                 return err;
4155
4156         /* server child socket */
4157         sksec_new->peer_sid = sksec_sock->sid;
4158         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4159                                     &sksec_new->sid);
4160         if (err)
4161                 return err;
4162
4163         /* connecting socket */
4164         sksec_sock->peer_sid = sksec_new->sid;
4165
4166         return 0;
4167 }
4168
4169 static int selinux_socket_unix_may_send(struct socket *sock,
4170                                         struct socket *other)
4171 {
4172         struct sk_security_struct *ssec = sock->sk->sk_security;
4173         struct sk_security_struct *osec = other->sk->sk_security;
4174         struct common_audit_data ad;
4175         struct lsm_network_audit net = {0,};
4176
4177         ad.type = LSM_AUDIT_DATA_NET;
4178         ad.u.net = &net;
4179         ad.u.net->sk = other->sk;
4180
4181         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4182                             &ad);
4183 }
4184
4185 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4186                                     u32 peer_sid,
4187                                     struct common_audit_data *ad)
4188 {
4189         int err;
4190         u32 if_sid;
4191         u32 node_sid;
4192
4193         err = sel_netif_sid(ifindex, &if_sid);
4194         if (err)
4195                 return err;
4196         err = avc_has_perm(peer_sid, if_sid,
4197                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4198         if (err)
4199                 return err;
4200
4201         err = sel_netnode_sid(addrp, family, &node_sid);
4202         if (err)
4203                 return err;
4204         return avc_has_perm(peer_sid, node_sid,
4205                             SECCLASS_NODE, NODE__RECVFROM, ad);
4206 }
4207
4208 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4209                                        u16 family)
4210 {
4211         int err = 0;
4212         struct sk_security_struct *sksec = sk->sk_security;
4213         u32 sk_sid = sksec->sid;
4214         struct common_audit_data ad;
4215         struct lsm_network_audit net = {0,};
4216         char *addrp;
4217
4218         ad.type = LSM_AUDIT_DATA_NET;
4219         ad.u.net = &net;
4220         ad.u.net->netif = skb->skb_iif;
4221         ad.u.net->family = family;
4222         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4223         if (err)
4224                 return err;
4225
4226         if (selinux_secmark_enabled()) {
4227                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4228                                    PACKET__RECV, &ad);
4229                 if (err)
4230                         return err;
4231         }
4232
4233         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4234         if (err)
4235                 return err;
4236         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4237
4238         return err;
4239 }
4240
4241 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4242 {
4243         int err;
4244         struct sk_security_struct *sksec = sk->sk_security;
4245         u16 family = sk->sk_family;
4246         u32 sk_sid = sksec->sid;
4247         struct common_audit_data ad;
4248         struct lsm_network_audit net = {0,};
4249         char *addrp;
4250         u8 secmark_active;
4251         u8 peerlbl_active;
4252
4253         if (family != PF_INET && family != PF_INET6)
4254                 return 0;
4255
4256         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4257         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4258                 family = PF_INET;
4259
4260         /* If any sort of compatibility mode is enabled then handoff processing
4261          * to the selinux_sock_rcv_skb_compat() function to deal with the
4262          * special handling.  We do this in an attempt to keep this function
4263          * as fast and as clean as possible. */
4264         if (!selinux_policycap_netpeer)
4265                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4266
4267         secmark_active = selinux_secmark_enabled();
4268         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4269         if (!secmark_active && !peerlbl_active)
4270                 return 0;
4271
4272         ad.type = LSM_AUDIT_DATA_NET;
4273         ad.u.net = &net;
4274         ad.u.net->netif = skb->skb_iif;
4275         ad.u.net->family = family;
4276         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4277         if (err)
4278                 return err;
4279
4280         if (peerlbl_active) {
4281                 u32 peer_sid;
4282
4283                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4284                 if (err)
4285                         return err;
4286                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4287                                                peer_sid, &ad);
4288                 if (err) {
4289                         selinux_netlbl_err(skb, err, 0);
4290                         return err;
4291                 }
4292                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4293                                    PEER__RECV, &ad);
4294                 if (err)
4295                         selinux_netlbl_err(skb, err, 0);
4296         }
4297
4298         if (secmark_active) {
4299                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4300                                    PACKET__RECV, &ad);
4301                 if (err)
4302                         return err;
4303         }
4304
4305         return err;
4306 }
4307
4308 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4309                                             int __user *optlen, unsigned len)
4310 {
4311         int err = 0;
4312         char *scontext;
4313         u32 scontext_len;
4314         struct sk_security_struct *sksec = sock->sk->sk_security;
4315         u32 peer_sid = SECSID_NULL;
4316
4317         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4318             sksec->sclass == SECCLASS_TCP_SOCKET)
4319                 peer_sid = sksec->peer_sid;
4320         if (peer_sid == SECSID_NULL)
4321                 return -ENOPROTOOPT;
4322
4323         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4324         if (err)
4325                 return err;
4326
4327         if (scontext_len > len) {
4328                 err = -ERANGE;
4329                 goto out_len;
4330         }
4331
4332         if (copy_to_user(optval, scontext, scontext_len))
4333                 err = -EFAULT;
4334
4335 out_len:
4336         if (put_user(scontext_len, optlen))
4337                 err = -EFAULT;
4338         kfree(scontext);
4339         return err;
4340 }
4341
4342 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4343 {
4344         u32 peer_secid = SECSID_NULL;
4345         u16 family;
4346
4347         if (skb && skb->protocol == htons(ETH_P_IP))
4348                 family = PF_INET;
4349         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4350                 family = PF_INET6;
4351         else if (sock)
4352                 family = sock->sk->sk_family;
4353         else
4354                 goto out;
4355
4356         if (sock && family == PF_UNIX)
4357                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4358         else if (skb)
4359                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4360
4361 out:
4362         *secid = peer_secid;
4363         if (peer_secid == SECSID_NULL)
4364                 return -EINVAL;
4365         return 0;
4366 }
4367
4368 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4369 {
4370         struct sk_security_struct *sksec;
4371
4372         sksec = kzalloc(sizeof(*sksec), priority);
4373         if (!sksec)
4374                 return -ENOMEM;
4375
4376         sksec->peer_sid = SECINITSID_UNLABELED;
4377         sksec->sid = SECINITSID_UNLABELED;
4378         selinux_netlbl_sk_security_reset(sksec);
4379         sk->sk_security = sksec;
4380
4381         return 0;
4382 }
4383
4384 static void selinux_sk_free_security(struct sock *sk)
4385 {
4386         struct sk_security_struct *sksec = sk->sk_security;
4387
4388         sk->sk_security = NULL;
4389         selinux_netlbl_sk_security_free(sksec);
4390         kfree(sksec);
4391 }
4392
4393 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4394 {
4395         struct sk_security_struct *sksec = sk->sk_security;
4396         struct sk_security_struct *newsksec = newsk->sk_security;
4397
4398         newsksec->sid = sksec->sid;
4399         newsksec->peer_sid = sksec->peer_sid;
4400         newsksec->sclass = sksec->sclass;
4401
4402         selinux_netlbl_sk_security_reset(newsksec);
4403 }
4404
4405 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4406 {
4407         if (!sk)
4408                 *secid = SECINITSID_ANY_SOCKET;
4409         else {
4410                 struct sk_security_struct *sksec = sk->sk_security;
4411
4412                 *secid = sksec->sid;
4413         }
4414 }
4415
4416 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4417 {
4418         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4419         struct sk_security_struct *sksec = sk->sk_security;
4420
4421         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4422             sk->sk_family == PF_UNIX)
4423                 isec->sid = sksec->sid;
4424         sksec->sclass = isec->sclass;
4425 }
4426
4427 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4428                                      struct request_sock *req)
4429 {
4430         struct sk_security_struct *sksec = sk->sk_security;
4431         int err;
4432         u16 family = sk->sk_family;
4433         u32 newsid;
4434         u32 peersid;
4435
4436         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4437         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4438                 family = PF_INET;
4439
4440         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4441         if (err)
4442                 return err;
4443         if (peersid == SECSID_NULL) {
4444                 req->secid = sksec->sid;
4445                 req->peer_secid = SECSID_NULL;
4446         } else {
4447                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4448                 if (err)
4449                         return err;
4450                 req->secid = newsid;
4451                 req->peer_secid = peersid;
4452         }
4453
4454         return selinux_netlbl_inet_conn_request(req, family);
4455 }
4456
4457 static void selinux_inet_csk_clone(struct sock *newsk,
4458                                    const struct request_sock *req)
4459 {
4460         struct sk_security_struct *newsksec = newsk->sk_security;
4461
4462         newsksec->sid = req->secid;
4463         newsksec->peer_sid = req->peer_secid;
4464         /* NOTE: Ideally, we should also get the isec->sid for the
4465            new socket in sync, but we don't have the isec available yet.
4466            So we will wait until sock_graft to do it, by which
4467            time it will have been created and available. */
4468
4469         /* We don't need to take any sort of lock here as we are the only
4470          * thread with access to newsksec */
4471         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4472 }
4473
4474 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4475 {
4476         u16 family = sk->sk_family;
4477         struct sk_security_struct *sksec = sk->sk_security;
4478
4479         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4480         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4481                 family = PF_INET;
4482
4483         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4484 }
4485
4486 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4487 {
4488         skb_set_owner_w(skb, sk);
4489 }
4490
4491 static int selinux_secmark_relabel_packet(u32 sid)
4492 {
4493         const struct task_security_struct *__tsec;
4494         u32 tsid;
4495
4496         __tsec = current_security();
4497         tsid = __tsec->sid;
4498
4499         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4500 }
4501
4502 static void selinux_secmark_refcount_inc(void)
4503 {
4504         atomic_inc(&selinux_secmark_refcount);
4505 }
4506
4507 static void selinux_secmark_refcount_dec(void)
4508 {
4509         atomic_dec(&selinux_secmark_refcount);
4510 }
4511
4512 static void selinux_req_classify_flow(const struct request_sock *req,
4513                                       struct flowi *fl)
4514 {
4515         fl->flowi_secid = req->secid;
4516 }
4517
4518 static int selinux_tun_dev_alloc_security(void **security)
4519 {
4520         struct tun_security_struct *tunsec;
4521
4522         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4523         if (!tunsec)
4524                 return -ENOMEM;
4525         tunsec->sid = current_sid();
4526
4527         *security = tunsec;
4528         return 0;
4529 }
4530
4531 static void selinux_tun_dev_free_security(void *security)
4532 {
4533         kfree(security);
4534 }
4535
4536 static int selinux_tun_dev_create(void)
4537 {
4538         u32 sid = current_sid();
4539
4540         /* we aren't taking into account the "sockcreate" SID since the socket
4541          * that is being created here is not a socket in the traditional sense,
4542          * instead it is a private sock, accessible only to the kernel, and
4543          * representing a wide range of network traffic spanning multiple
4544          * connections unlike traditional sockets - check the TUN driver to
4545          * get a better understanding of why this socket is special */
4546
4547         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4548                             NULL);
4549 }
4550
4551 static int selinux_tun_dev_attach_queue(void *security)
4552 {
4553         struct tun_security_struct *tunsec = security;
4554
4555         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4556                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4557 }
4558
4559 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4560 {
4561         struct tun_security_struct *tunsec = security;
4562         struct sk_security_struct *sksec = sk->sk_security;
4563
4564         /* we don't currently perform any NetLabel based labeling here and it
4565          * isn't clear that we would want to do so anyway; while we could apply
4566          * labeling without the support of the TUN user the resulting labeled
4567          * traffic from the other end of the connection would almost certainly
4568          * cause confusion to the TUN user that had no idea network labeling
4569          * protocols were being used */
4570
4571         sksec->sid = tunsec->sid;
4572         sksec->sclass = SECCLASS_TUN_SOCKET;
4573
4574         return 0;
4575 }
4576
4577 static int selinux_tun_dev_open(void *security)
4578 {
4579         struct tun_security_struct *tunsec = security;
4580         u32 sid = current_sid();
4581         int err;
4582
4583         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4584                            TUN_SOCKET__RELABELFROM, NULL);
4585         if (err)
4586                 return err;
4587         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4588                            TUN_SOCKET__RELABELTO, NULL);
4589         if (err)
4590                 return err;
4591         tunsec->sid = sid;
4592
4593         return 0;
4594 }
4595
4596 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4597 {
4598         int err = 0;
4599         u32 perm;
4600         struct nlmsghdr *nlh;
4601         struct sk_security_struct *sksec = sk->sk_security;
4602
4603         if (skb->len < NLMSG_HDRLEN) {
4604                 err = -EINVAL;
4605                 goto out;
4606         }
4607         nlh = nlmsg_hdr(skb);
4608
4609         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4610         if (err) {
4611                 if (err == -EINVAL) {
4612                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4613                                   "SELinux:  unrecognized netlink message"
4614                                   " type=%hu for sclass=%hu\n",
4615                                   nlh->nlmsg_type, sksec->sclass);
4616                         if (!selinux_enforcing || security_get_allow_unknown())
4617                                 err = 0;
4618                 }
4619
4620                 /* Ignore */
4621                 if (err == -ENOENT)
4622                         err = 0;
4623                 goto out;
4624         }
4625
4626         err = sock_has_perm(current, sk, perm);
4627 out:
4628         return err;
4629 }
4630
4631 #ifdef CONFIG_NETFILTER
4632
4633 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4634                                        u16 family)
4635 {
4636         int err;
4637         char *addrp;
4638         u32 peer_sid;
4639         struct common_audit_data ad;
4640         struct lsm_network_audit net = {0,};
4641         u8 secmark_active;
4642         u8 netlbl_active;
4643         u8 peerlbl_active;
4644
4645         if (!selinux_policycap_netpeer)
4646                 return NF_ACCEPT;
4647
4648         secmark_active = selinux_secmark_enabled();
4649         netlbl_active = netlbl_enabled();
4650         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4651         if (!secmark_active && !peerlbl_active)
4652                 return NF_ACCEPT;
4653
4654         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4655                 return NF_DROP;
4656
4657         ad.type = LSM_AUDIT_DATA_NET;
4658         ad.u.net = &net;
4659         ad.u.net->netif = ifindex;
4660         ad.u.net->family = family;
4661         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4662                 return NF_DROP;
4663
4664         if (peerlbl_active) {
4665                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4666                                                peer_sid, &ad);
4667                 if (err) {
4668                         selinux_netlbl_err(skb, err, 1);
4669                         return NF_DROP;
4670                 }
4671         }
4672
4673         if (secmark_active)
4674                 if (avc_has_perm(peer_sid, skb->secmark,
4675                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4676                         return NF_DROP;
4677
4678         if (netlbl_active)
4679                 /* we do this in the FORWARD path and not the POST_ROUTING
4680                  * path because we want to make sure we apply the necessary
4681                  * labeling before IPsec is applied so we can leverage AH
4682                  * protection */
4683                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4684                         return NF_DROP;
4685
4686         return NF_ACCEPT;
4687 }
4688
4689 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4690                                          struct sk_buff *skb,
4691                                          const struct net_device *in,
4692                                          const struct net_device *out,
4693                                          int (*okfn)(struct sk_buff *))
4694 {
4695         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4696 }
4697
4698 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4699 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4700                                          struct sk_buff *skb,
4701                                          const struct net_device *in,
4702                                          const struct net_device *out,
4703                                          int (*okfn)(struct sk_buff *))
4704 {
4705         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4706 }
4707 #endif  /* IPV6 */
4708
4709 static unsigned int selinux_ip_output(struct sk_buff *skb,
4710                                       u16 family)
4711 {
4712         u32 sid;
4713
4714         if (!netlbl_enabled())
4715                 return NF_ACCEPT;
4716
4717         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4718          * because we want to make sure we apply the necessary labeling
4719          * before IPsec is applied so we can leverage AH protection */
4720         if (skb->sk) {
4721                 struct sk_security_struct *sksec = skb->sk->sk_security;
4722                 sid = sksec->sid;
4723         } else
4724                 sid = SECINITSID_KERNEL;
4725         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4726                 return NF_DROP;
4727
4728         return NF_ACCEPT;
4729 }
4730
4731 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4732                                         struct sk_buff *skb,
4733                                         const struct net_device *in,
4734                                         const struct net_device *out,
4735                                         int (*okfn)(struct sk_buff *))
4736 {
4737         return selinux_ip_output(skb, PF_INET);
4738 }
4739
4740 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4741                                                 int ifindex,
4742                                                 u16 family)
4743 {
4744         struct sock *sk = skb->sk;
4745         struct sk_security_struct *sksec;
4746         struct common_audit_data ad;
4747         struct lsm_network_audit net = {0,};
4748         char *addrp;
4749         u8 proto;
4750
4751         if (sk == NULL)
4752                 return NF_ACCEPT;
4753         sksec = sk->sk_security;
4754
4755         ad.type = LSM_AUDIT_DATA_NET;
4756         ad.u.net = &net;
4757         ad.u.net->netif = ifindex;
4758         ad.u.net->family = family;
4759         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4760                 return NF_DROP;
4761
4762         if (selinux_secmark_enabled())
4763                 if (avc_has_perm(sksec->sid, skb->secmark,
4764                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4765                         return NF_DROP_ERR(-ECONNREFUSED);
4766
4767         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4768                 return NF_DROP_ERR(-ECONNREFUSED);
4769
4770         return NF_ACCEPT;
4771 }
4772
4773 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4774                                          u16 family)
4775 {
4776         u32 secmark_perm;
4777         u32 peer_sid;
4778         struct sock *sk;
4779         struct common_audit_data ad;
4780         struct lsm_network_audit net = {0,};
4781         char *addrp;
4782         u8 secmark_active;
4783         u8 peerlbl_active;
4784
4785         /* If any sort of compatibility mode is enabled then handoff processing
4786          * to the selinux_ip_postroute_compat() function to deal with the
4787          * special handling.  We do this in an attempt to keep this function
4788          * as fast and as clean as possible. */
4789         if (!selinux_policycap_netpeer)
4790                 return selinux_ip_postroute_compat(skb, ifindex, family);
4791 #ifdef CONFIG_XFRM
4792         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4793          * packet transformation so allow the packet to pass without any checks
4794          * since we'll have another chance to perform access control checks
4795          * when the packet is on it's final way out.
4796          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4797          *       is NULL, in this case go ahead and apply access control. */
4798         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4799                 return NF_ACCEPT;
4800 #endif
4801         secmark_active = selinux_secmark_enabled();
4802         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4803         if (!secmark_active && !peerlbl_active)
4804                 return NF_ACCEPT;
4805
4806         /* if the packet is being forwarded then get the peer label from the
4807          * packet itself; otherwise check to see if it is from a local
4808          * application or the kernel, if from an application get the peer label
4809          * from the sending socket, otherwise use the kernel's sid */
4810         sk = skb->sk;
4811         if (sk == NULL) {
4812                 if (skb->skb_iif) {
4813                         secmark_perm = PACKET__FORWARD_OUT;
4814                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4815                                 return NF_DROP;
4816                 } else {
4817                         secmark_perm = PACKET__SEND;
4818                         peer_sid = SECINITSID_KERNEL;
4819                 }
4820         } else {
4821                 struct sk_security_struct *sksec = sk->sk_security;
4822                 peer_sid = sksec->sid;
4823                 secmark_perm = PACKET__SEND;
4824         }
4825
4826         ad.type = LSM_AUDIT_DATA_NET;
4827         ad.u.net = &net;
4828         ad.u.net->netif = ifindex;
4829         ad.u.net->family = family;
4830         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4831                 return NF_DROP;
4832
4833         if (secmark_active)
4834                 if (avc_has_perm(peer_sid, skb->secmark,
4835                                  SECCLASS_PACKET, secmark_perm, &ad))
4836                         return NF_DROP_ERR(-ECONNREFUSED);
4837
4838         if (peerlbl_active) {
4839                 u32 if_sid;
4840                 u32 node_sid;
4841
4842                 if (sel_netif_sid(ifindex, &if_sid))
4843                         return NF_DROP;
4844                 if (avc_has_perm(peer_sid, if_sid,
4845                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4846                         return NF_DROP_ERR(-ECONNREFUSED);
4847
4848                 if (sel_netnode_sid(addrp, family, &node_sid))
4849                         return NF_DROP;
4850                 if (avc_has_perm(peer_sid, node_sid,
4851                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4852                         return NF_DROP_ERR(-ECONNREFUSED);
4853         }
4854
4855         return NF_ACCEPT;
4856 }
4857
4858 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4859                                            struct sk_buff *skb,
4860                                            const struct net_device *in,
4861                                            const struct net_device *out,
4862                                            int (*okfn)(struct sk_buff *))
4863 {
4864         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4865 }
4866
4867 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4868 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4869                                            struct sk_buff *skb,
4870                                            const struct net_device *in,
4871                                            const struct net_device *out,
4872                                            int (*okfn)(struct sk_buff *))
4873 {
4874         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4875 }
4876 #endif  /* IPV6 */
4877
4878 #endif  /* CONFIG_NETFILTER */
4879
4880 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4881 {
4882         int err;
4883
4884         err = cap_netlink_send(sk, skb);
4885         if (err)
4886                 return err;
4887
4888         return selinux_nlmsg_perm(sk, skb);
4889 }
4890
4891 static int ipc_alloc_security(struct task_struct *task,
4892                               struct kern_ipc_perm *perm,
4893                               u16 sclass)
4894 {
4895         struct ipc_security_struct *isec;
4896         u32 sid;
4897
4898         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4899         if (!isec)
4900                 return -ENOMEM;
4901
4902         sid = task_sid(task);
4903         isec->sclass = sclass;
4904         isec->sid = sid;
4905         perm->security = isec;
4906
4907         return 0;
4908 }
4909
4910 static void ipc_free_security(struct kern_ipc_perm *perm)
4911 {
4912         struct ipc_security_struct *isec = perm->security;
4913         perm->security = NULL;
4914         kfree(isec);
4915 }
4916
4917 static int msg_msg_alloc_security(struct msg_msg *msg)
4918 {
4919         struct msg_security_struct *msec;
4920
4921         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4922         if (!msec)
4923                 return -ENOMEM;
4924
4925         msec->sid = SECINITSID_UNLABELED;
4926         msg->security = msec;
4927
4928         return 0;
4929 }
4930
4931 static void msg_msg_free_security(struct msg_msg *msg)
4932 {
4933         struct msg_security_struct *msec = msg->security;
4934
4935         msg->security = NULL;
4936         kfree(msec);
4937 }
4938
4939 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4940                         u32 perms)
4941 {
4942         struct ipc_security_struct *isec;
4943         struct common_audit_data ad;
4944         u32 sid = current_sid();
4945
4946         isec = ipc_perms->security;
4947
4948         ad.type = LSM_AUDIT_DATA_IPC;
4949         ad.u.ipc_id = ipc_perms->key;
4950
4951         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4952 }
4953
4954 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4955 {
4956         return msg_msg_alloc_security(msg);
4957 }
4958
4959 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4960 {
4961         msg_msg_free_security(msg);
4962 }
4963
4964 /* message queue security operations */
4965 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4966 {
4967         struct ipc_security_struct *isec;
4968         struct common_audit_data ad;
4969         u32 sid = current_sid();
4970         int rc;
4971
4972         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4973         if (rc)
4974                 return rc;
4975
4976         isec = msq->q_perm.security;
4977
4978         ad.type = LSM_AUDIT_DATA_IPC;
4979         ad.u.ipc_id = msq->q_perm.key;
4980
4981         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4982                           MSGQ__CREATE, &ad);
4983         if (rc) {
4984                 ipc_free_security(&msq->q_perm);
4985                 return rc;
4986         }
4987         return 0;
4988 }
4989
4990 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4991 {
4992         ipc_free_security(&msq->q_perm);
4993 }
4994
4995 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4996 {
4997         struct ipc_security_struct *isec;
4998         struct common_audit_data ad;
4999         u32 sid = current_sid();
5000
5001         isec = msq->q_perm.security;
5002
5003         ad.type = LSM_AUDIT_DATA_IPC;
5004         ad.u.ipc_id = msq->q_perm.key;
5005
5006         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5007                             MSGQ__ASSOCIATE, &ad);
5008 }
5009
5010 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5011 {
5012         int err;
5013         int perms;
5014
5015         switch (cmd) {
5016         case IPC_INFO:
5017         case MSG_INFO:
5018                 /* No specific object, just general system-wide information. */
5019                 return task_has_system(current, SYSTEM__IPC_INFO);
5020         case IPC_STAT:
5021         case MSG_STAT:
5022                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5023                 break;
5024         case IPC_SET:
5025                 perms = MSGQ__SETATTR;
5026                 break;
5027         case IPC_RMID:
5028                 perms = MSGQ__DESTROY;
5029                 break;
5030         default:
5031                 return 0;
5032         }
5033
5034         err = ipc_has_perm(&msq->q_perm, perms);
5035         return err;
5036 }
5037
5038 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5039 {
5040         struct ipc_security_struct *isec;
5041         struct msg_security_struct *msec;
5042         struct common_audit_data ad;
5043         u32 sid = current_sid();
5044         int rc;
5045
5046         isec = msq->q_perm.security;
5047         msec = msg->security;
5048
5049         /*
5050          * First time through, need to assign label to the message
5051          */
5052         if (msec->sid == SECINITSID_UNLABELED) {
5053                 /*
5054                  * Compute new sid based on current process and
5055                  * message queue this message will be stored in
5056                  */
5057                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5058                                              NULL, &msec->sid);
5059                 if (rc)
5060                         return rc;
5061         }
5062
5063         ad.type = LSM_AUDIT_DATA_IPC;
5064         ad.u.ipc_id = msq->q_perm.key;
5065
5066         /* Can this process write to the queue? */
5067         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5068                           MSGQ__WRITE, &ad);
5069         if (!rc)
5070                 /* Can this process send the message */
5071                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5072                                   MSG__SEND, &ad);
5073         if (!rc)
5074                 /* Can the message be put in the queue? */
5075                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5076                                   MSGQ__ENQUEUE, &ad);
5077
5078         return rc;
5079 }
5080
5081 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5082                                     struct task_struct *target,
5083                                     long type, int mode)
5084 {
5085         struct ipc_security_struct *isec;
5086         struct msg_security_struct *msec;
5087         struct common_audit_data ad;
5088         u32 sid = task_sid(target);
5089         int rc;
5090
5091         isec = msq->q_perm.security;
5092         msec = msg->security;
5093
5094         ad.type = LSM_AUDIT_DATA_IPC;
5095         ad.u.ipc_id = msq->q_perm.key;
5096
5097         rc = avc_has_perm(sid, isec->sid,
5098                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5099         if (!rc)
5100                 rc = avc_has_perm(sid, msec->sid,
5101                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5102         return rc;
5103 }
5104
5105 /* Shared Memory security operations */
5106 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5107 {
5108         struct ipc_security_struct *isec;
5109         struct common_audit_data ad;
5110         u32 sid = current_sid();
5111         int rc;
5112
5113         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5114         if (rc)
5115                 return rc;
5116
5117         isec = shp->shm_perm.security;
5118
5119         ad.type = LSM_AUDIT_DATA_IPC;
5120         ad.u.ipc_id = shp->shm_perm.key;
5121
5122         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5123                           SHM__CREATE, &ad);
5124         if (rc) {
5125                 ipc_free_security(&shp->shm_perm);
5126                 return rc;
5127         }
5128         return 0;
5129 }
5130
5131 static void selinux_shm_free_security(struct shmid_kernel *shp)
5132 {
5133         ipc_free_security(&shp->shm_perm);
5134 }
5135
5136 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5137 {
5138         struct ipc_security_struct *isec;
5139         struct common_audit_data ad;
5140         u32 sid = current_sid();
5141
5142         isec = shp->shm_perm.security;
5143
5144         ad.type = LSM_AUDIT_DATA_IPC;
5145         ad.u.ipc_id = shp->shm_perm.key;
5146
5147         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5148                             SHM__ASSOCIATE, &ad);
5149 }
5150
5151 /* Note, at this point, shp is locked down */
5152 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5153 {
5154         int perms;
5155         int err;
5156
5157         switch (cmd) {
5158         case IPC_INFO:
5159         case SHM_INFO:
5160                 /* No specific object, just general system-wide information. */
5161                 return task_has_system(current, SYSTEM__IPC_INFO);
5162         case IPC_STAT:
5163         case SHM_STAT:
5164                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5165                 break;
5166         case IPC_SET:
5167                 perms = SHM__SETATTR;
5168                 break;
5169         case SHM_LOCK:
5170         case SHM_UNLOCK:
5171                 perms = SHM__LOCK;
5172                 break;
5173         case IPC_RMID:
5174                 perms = SHM__DESTROY;
5175                 break;
5176         default:
5177                 return 0;
5178         }
5179
5180         err = ipc_has_perm(&shp->shm_perm, perms);
5181         return err;
5182 }
5183
5184 static int selinux_shm_shmat(struct shmid_kernel *shp,
5185                              char __user *shmaddr, int shmflg)
5186 {
5187         u32 perms;
5188
5189         if (shmflg & SHM_RDONLY)
5190                 perms = SHM__READ;
5191         else
5192                 perms = SHM__READ | SHM__WRITE;
5193
5194         return ipc_has_perm(&shp->shm_perm, perms);
5195 }
5196
5197 /* Semaphore security operations */
5198 static int selinux_sem_alloc_security(struct sem_array *sma)
5199 {
5200         struct ipc_security_struct *isec;
5201         struct common_audit_data ad;
5202         u32 sid = current_sid();
5203         int rc;
5204
5205         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5206         if (rc)
5207                 return rc;
5208
5209         isec = sma->sem_perm.security;
5210
5211         ad.type = LSM_AUDIT_DATA_IPC;
5212         ad.u.ipc_id = sma->sem_perm.key;
5213
5214         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5215                           SEM__CREATE, &ad);
5216         if (rc) {
5217                 ipc_free_security(&sma->sem_perm);
5218                 return rc;
5219         }
5220         return 0;
5221 }
5222
5223 static void selinux_sem_free_security(struct sem_array *sma)
5224 {
5225         ipc_free_security(&sma->sem_perm);
5226 }
5227
5228 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5229 {
5230         struct ipc_security_struct *isec;
5231         struct common_audit_data ad;
5232         u32 sid = current_sid();
5233
5234         isec = sma->sem_perm.security;
5235
5236         ad.type = LSM_AUDIT_DATA_IPC;
5237         ad.u.ipc_id = sma->sem_perm.key;
5238
5239         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5240                             SEM__ASSOCIATE, &ad);
5241 }
5242
5243 /* Note, at this point, sma is locked down */
5244 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5245 {
5246         int err;
5247         u32 perms;
5248
5249         switch (cmd) {
5250         case IPC_INFO:
5251         case SEM_INFO:
5252                 /* No specific object, just general system-wide information. */
5253                 return task_has_system(current, SYSTEM__IPC_INFO);
5254         case GETPID:
5255         case GETNCNT:
5256         case GETZCNT:
5257                 perms = SEM__GETATTR;
5258                 break;
5259         case GETVAL:
5260         case GETALL:
5261                 perms = SEM__READ;
5262                 break;
5263         case SETVAL:
5264         case SETALL:
5265                 perms = SEM__WRITE;
5266                 break;
5267         case IPC_RMID:
5268                 perms = SEM__DESTROY;
5269                 break;
5270         case IPC_SET:
5271                 perms = SEM__SETATTR;
5272                 break;
5273         case IPC_STAT:
5274         case SEM_STAT:
5275                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5276                 break;
5277         default:
5278                 return 0;
5279         }
5280
5281         err = ipc_has_perm(&sma->sem_perm, perms);
5282         return err;
5283 }
5284
5285 static int selinux_sem_semop(struct sem_array *sma,
5286                              struct sembuf *sops, unsigned nsops, int alter)
5287 {
5288         u32 perms;
5289
5290         if (alter)
5291                 perms = SEM__READ | SEM__WRITE;
5292         else
5293                 perms = SEM__READ;
5294
5295         return ipc_has_perm(&sma->sem_perm, perms);
5296 }
5297
5298 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5299 {
5300         u32 av = 0;
5301
5302         av = 0;
5303         if (flag & S_IRUGO)
5304                 av |= IPC__UNIX_READ;
5305         if (flag & S_IWUGO)
5306                 av |= IPC__UNIX_WRITE;
5307
5308         if (av == 0)
5309                 return 0;
5310
5311         return ipc_has_perm(ipcp, av);
5312 }
5313
5314 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5315 {
5316         struct ipc_security_struct *isec = ipcp->security;
5317         *secid = isec->sid;
5318 }
5319
5320 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5321 {
5322         if (inode)
5323                 inode_doinit_with_dentry(inode, dentry);
5324 }
5325
5326 static int selinux_getprocattr(struct task_struct *p,
5327                                char *name, char **value)
5328 {
5329         const struct task_security_struct *__tsec;
5330         u32 sid;
5331         int error;
5332         unsigned len;
5333
5334         if (current != p) {
5335                 error = current_has_perm(p, PROCESS__GETATTR);
5336                 if (error)
5337                         return error;
5338         }
5339
5340         rcu_read_lock();
5341         __tsec = __task_cred(p)->security;
5342
5343         if (!strcmp(name, "current"))
5344                 sid = __tsec->sid;
5345         else if (!strcmp(name, "prev"))
5346                 sid = __tsec->osid;
5347         else if (!strcmp(name, "exec"))
5348                 sid = __tsec->exec_sid;
5349         else if (!strcmp(name, "fscreate"))
5350                 sid = __tsec->create_sid;
5351         else if (!strcmp(name, "keycreate"))
5352                 sid = __tsec->keycreate_sid;
5353         else if (!strcmp(name, "sockcreate"))
5354                 sid = __tsec->sockcreate_sid;
5355         else
5356                 goto invalid;
5357         rcu_read_unlock();
5358
5359         if (!sid)
5360                 return 0;
5361
5362         error = security_sid_to_context(sid, value, &len);
5363         if (error)
5364                 return error;
5365         return len;
5366
5367 invalid:
5368         rcu_read_unlock();
5369         return -EINVAL;
5370 }
5371
5372 static int selinux_setprocattr(struct task_struct *p,
5373                                char *name, void *value, size_t size)
5374 {
5375         struct task_security_struct *tsec;
5376         struct task_struct *tracer;
5377         struct cred *new;
5378         u32 sid = 0, ptsid;
5379         int error;
5380         char *str = value;
5381
5382         if (current != p) {
5383                 /* SELinux only allows a process to change its own
5384                    security attributes. */
5385                 return -EACCES;
5386         }
5387
5388         /*
5389          * Basic control over ability to set these attributes at all.
5390          * current == p, but we'll pass them separately in case the
5391          * above restriction is ever removed.
5392          */
5393         if (!strcmp(name, "exec"))
5394                 error = current_has_perm(p, PROCESS__SETEXEC);
5395         else if (!strcmp(name, "fscreate"))
5396                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5397         else if (!strcmp(name, "keycreate"))
5398                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5399         else if (!strcmp(name, "sockcreate"))
5400                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5401         else if (!strcmp(name, "current"))
5402                 error = current_has_perm(p, PROCESS__SETCURRENT);
5403         else
5404                 error = -EINVAL;
5405         if (error)
5406                 return error;
5407
5408         /* Obtain a SID for the context, if one was specified. */
5409         if (size && str[1] && str[1] != '\n') {
5410                 if (str[size-1] == '\n') {
5411                         str[size-1] = 0;
5412                         size--;
5413                 }
5414                 error = security_context_to_sid(value, size, &sid);
5415                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5416                         if (!capable(CAP_MAC_ADMIN)) {
5417                                 struct audit_buffer *ab;
5418                                 size_t audit_size;
5419
5420                                 /* We strip a nul only if it is at the end, otherwise the
5421                                  * context contains a nul and we should audit that */
5422                                 if (str[size - 1] == '\0')
5423                                         audit_size = size - 1;
5424                                 else
5425                                         audit_size = size;
5426                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5427                                 audit_log_format(ab, "op=fscreate invalid_context=");
5428                                 audit_log_n_untrustedstring(ab, value, audit_size);
5429                                 audit_log_end(ab);
5430
5431                                 return error;
5432                         }
5433                         error = security_context_to_sid_force(value, size,
5434                                                               &sid);
5435                 }
5436                 if (error)
5437                         return error;
5438         }
5439
5440         new = prepare_creds();
5441         if (!new)
5442                 return -ENOMEM;
5443
5444         /* Permission checking based on the specified context is
5445            performed during the actual operation (execve,
5446            open/mkdir/...), when we know the full context of the
5447            operation.  See selinux_bprm_set_creds for the execve
5448            checks and may_create for the file creation checks. The
5449            operation will then fail if the context is not permitted. */
5450         tsec = new->security;
5451         if (!strcmp(name, "exec")) {
5452                 tsec->exec_sid = sid;
5453         } else if (!strcmp(name, "fscreate")) {
5454                 tsec->create_sid = sid;
5455         } else if (!strcmp(name, "keycreate")) {
5456                 error = may_create_key(sid, p);
5457                 if (error)
5458                         goto abort_change;
5459                 tsec->keycreate_sid = sid;
5460         } else if (!strcmp(name, "sockcreate")) {
5461                 tsec->sockcreate_sid = sid;
5462         } else if (!strcmp(name, "current")) {
5463                 error = -EINVAL;
5464                 if (sid == 0)
5465                         goto abort_change;
5466
5467                 /* Only allow single threaded processes to change context */
5468                 error = -EPERM;
5469                 if (!current_is_single_threaded()) {
5470                         error = security_bounded_transition(tsec->sid, sid);
5471                         if (error)
5472                                 goto abort_change;
5473                 }
5474
5475                 /* Check permissions for the transition. */
5476                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5477                                      PROCESS__DYNTRANSITION, NULL);
5478                 if (error)
5479                         goto abort_change;
5480
5481                 /* Check for ptracing, and update the task SID if ok.
5482                    Otherwise, leave SID unchanged and fail. */
5483                 ptsid = 0;
5484                 task_lock(p);
5485                 tracer = ptrace_parent(p);
5486                 if (tracer)
5487                         ptsid = task_sid(tracer);
5488                 task_unlock(p);
5489
5490                 if (tracer) {
5491                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5492                                              PROCESS__PTRACE, NULL);
5493                         if (error)
5494                                 goto abort_change;
5495                 }
5496
5497                 tsec->sid = sid;
5498         } else {
5499                 error = -EINVAL;
5500                 goto abort_change;
5501         }
5502
5503         commit_creds(new);
5504         return size;
5505
5506 abort_change:
5507         abort_creds(new);
5508         return error;
5509 }
5510
5511 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5512 {
5513         return security_sid_to_context(secid, secdata, seclen);
5514 }
5515
5516 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5517 {
5518         return security_context_to_sid(secdata, seclen, secid);
5519 }
5520
5521 static void selinux_release_secctx(char *secdata, u32 seclen)
5522 {
5523         kfree(secdata);
5524 }
5525
5526 /*
5527  *      called with inode->i_mutex locked
5528  */
5529 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5530 {
5531         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5532 }
5533
5534 /*
5535  *      called with inode->i_mutex locked
5536  */
5537 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5538 {
5539         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5540 }
5541
5542 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5543 {
5544         int len = 0;
5545         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5546                                                 ctx, true);
5547         if (len < 0)
5548                 return len;
5549         *ctxlen = len;
5550         return 0;
5551 }
5552 #ifdef CONFIG_KEYS
5553
5554 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5555                              unsigned long flags)
5556 {
5557         const struct task_security_struct *tsec;
5558         struct key_security_struct *ksec;
5559
5560         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5561         if (!ksec)
5562                 return -ENOMEM;
5563
5564         tsec = cred->security;
5565         if (tsec->keycreate_sid)
5566                 ksec->sid = tsec->keycreate_sid;
5567         else
5568                 ksec->sid = tsec->sid;
5569
5570         k->security = ksec;
5571         return 0;
5572 }
5573
5574 static void selinux_key_free(struct key *k)
5575 {
5576         struct key_security_struct *ksec = k->security;
5577
5578         k->security = NULL;
5579         kfree(ksec);
5580 }
5581
5582 static int selinux_key_permission(key_ref_t key_ref,
5583                                   const struct cred *cred,
5584                                   key_perm_t perm)
5585 {
5586         struct key *key;
5587         struct key_security_struct *ksec;
5588         u32 sid;
5589
5590         /* if no specific permissions are requested, we skip the
5591            permission check. No serious, additional covert channels
5592            appear to be created. */
5593         if (perm == 0)
5594                 return 0;
5595
5596         sid = cred_sid(cred);
5597
5598         key = key_ref_to_ptr(key_ref);
5599         ksec = key->security;
5600
5601         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5602 }
5603
5604 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5605 {
5606         struct key_security_struct *ksec = key->security;
5607         char *context = NULL;
5608         unsigned len;
5609         int rc;
5610
5611         rc = security_sid_to_context(ksec->sid, &context, &len);
5612         if (!rc)
5613                 rc = len;
5614         *_buffer = context;
5615         return rc;
5616 }
5617
5618 #endif
5619
5620 static struct security_operations selinux_ops = {
5621         .name =                         "selinux",
5622
5623         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5624         .binder_transaction =           selinux_binder_transaction,
5625         .binder_transfer_binder =       selinux_binder_transfer_binder,
5626         .binder_transfer_file =         selinux_binder_transfer_file,
5627
5628         .ptrace_access_check =          selinux_ptrace_access_check,
5629         .ptrace_traceme =               selinux_ptrace_traceme,
5630         .capget =                       selinux_capget,
5631         .capset =                       selinux_capset,
5632         .capable =                      selinux_capable,
5633         .quotactl =                     selinux_quotactl,
5634         .quota_on =                     selinux_quota_on,
5635         .syslog =                       selinux_syslog,
5636         .vm_enough_memory =             selinux_vm_enough_memory,
5637
5638         .netlink_send =                 selinux_netlink_send,
5639
5640         .bprm_set_creds =               selinux_bprm_set_creds,
5641         .bprm_committing_creds =        selinux_bprm_committing_creds,
5642         .bprm_committed_creds =         selinux_bprm_committed_creds,
5643         .bprm_secureexec =              selinux_bprm_secureexec,
5644
5645         .sb_alloc_security =            selinux_sb_alloc_security,
5646         .sb_free_security =             selinux_sb_free_security,
5647         .sb_copy_data =                 selinux_sb_copy_data,
5648         .sb_remount =                   selinux_sb_remount,
5649         .sb_kern_mount =                selinux_sb_kern_mount,
5650         .sb_show_options =              selinux_sb_show_options,
5651         .sb_statfs =                    selinux_sb_statfs,
5652         .sb_mount =                     selinux_mount,
5653         .sb_umount =                    selinux_umount,
5654         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5655         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5656         .sb_parse_opts_str =            selinux_parse_opts_str,
5657
5658
5659         .inode_alloc_security =         selinux_inode_alloc_security,
5660         .inode_free_security =          selinux_inode_free_security,
5661         .inode_init_security =          selinux_inode_init_security,
5662         .inode_create =                 selinux_inode_create,
5663         .inode_link =                   selinux_inode_link,
5664         .inode_unlink =                 selinux_inode_unlink,
5665         .inode_symlink =                selinux_inode_symlink,
5666         .inode_mkdir =                  selinux_inode_mkdir,
5667         .inode_rmdir =                  selinux_inode_rmdir,
5668         .inode_mknod =                  selinux_inode_mknod,
5669         .inode_rename =                 selinux_inode_rename,
5670         .inode_readlink =               selinux_inode_readlink,
5671         .inode_follow_link =            selinux_inode_follow_link,
5672         .inode_permission =             selinux_inode_permission,
5673         .inode_setattr =                selinux_inode_setattr,
5674         .inode_getattr =                selinux_inode_getattr,
5675         .inode_setxattr =               selinux_inode_setxattr,
5676         .inode_post_setxattr =          selinux_inode_post_setxattr,
5677         .inode_getxattr =               selinux_inode_getxattr,
5678         .inode_listxattr =              selinux_inode_listxattr,
5679         .inode_removexattr =            selinux_inode_removexattr,
5680         .inode_getsecurity =            selinux_inode_getsecurity,
5681         .inode_setsecurity =            selinux_inode_setsecurity,
5682         .inode_listsecurity =           selinux_inode_listsecurity,
5683         .inode_getsecid =               selinux_inode_getsecid,
5684
5685         .file_permission =              selinux_file_permission,
5686         .file_alloc_security =          selinux_file_alloc_security,
5687         .file_free_security =           selinux_file_free_security,
5688         .file_ioctl =                   selinux_file_ioctl,
5689         .mmap_file =                    selinux_mmap_file,
5690         .mmap_addr =                    selinux_mmap_addr,
5691         .file_mprotect =                selinux_file_mprotect,
5692         .file_lock =                    selinux_file_lock,
5693         .file_fcntl =                   selinux_file_fcntl,
5694         .file_set_fowner =              selinux_file_set_fowner,
5695         .file_send_sigiotask =          selinux_file_send_sigiotask,
5696         .file_receive =                 selinux_file_receive,
5697
5698         .file_open =                    selinux_file_open,
5699
5700         .task_create =                  selinux_task_create,
5701         .cred_alloc_blank =             selinux_cred_alloc_blank,
5702         .cred_free =                    selinux_cred_free,
5703         .cred_prepare =                 selinux_cred_prepare,
5704         .cred_transfer =                selinux_cred_transfer,
5705         .kernel_act_as =                selinux_kernel_act_as,
5706         .kernel_create_files_as =       selinux_kernel_create_files_as,
5707         .kernel_module_request =        selinux_kernel_module_request,
5708         .task_setpgid =                 selinux_task_setpgid,
5709         .task_getpgid =                 selinux_task_getpgid,
5710         .task_getsid =                  selinux_task_getsid,
5711         .task_getsecid =                selinux_task_getsecid,
5712         .task_setnice =                 selinux_task_setnice,
5713         .task_setioprio =               selinux_task_setioprio,
5714         .task_getioprio =               selinux_task_getioprio,
5715         .task_setrlimit =               selinux_task_setrlimit,
5716         .task_setscheduler =            selinux_task_setscheduler,
5717         .task_getscheduler =            selinux_task_getscheduler,
5718         .task_movememory =              selinux_task_movememory,
5719         .task_kill =                    selinux_task_kill,
5720         .task_wait =                    selinux_task_wait,
5721         .task_to_inode =                selinux_task_to_inode,
5722
5723         .ipc_permission =               selinux_ipc_permission,
5724         .ipc_getsecid =                 selinux_ipc_getsecid,
5725
5726         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5727         .msg_msg_free_security =        selinux_msg_msg_free_security,
5728
5729         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5730         .msg_queue_free_security =      selinux_msg_queue_free_security,
5731         .msg_queue_associate =          selinux_msg_queue_associate,
5732         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5733         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5734         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5735
5736         .shm_alloc_security =           selinux_shm_alloc_security,
5737         .shm_free_security =            selinux_shm_free_security,
5738         .shm_associate =                selinux_shm_associate,
5739         .shm_shmctl =                   selinux_shm_shmctl,
5740         .shm_shmat =                    selinux_shm_shmat,
5741
5742         .sem_alloc_security =           selinux_sem_alloc_security,
5743         .sem_free_security =            selinux_sem_free_security,
5744         .sem_associate =                selinux_sem_associate,
5745         .sem_semctl =                   selinux_sem_semctl,
5746         .sem_semop =                    selinux_sem_semop,
5747
5748         .d_instantiate =                selinux_d_instantiate,
5749
5750         .getprocattr =                  selinux_getprocattr,
5751         .setprocattr =                  selinux_setprocattr,
5752
5753         .secid_to_secctx =              selinux_secid_to_secctx,
5754         .secctx_to_secid =              selinux_secctx_to_secid,
5755         .release_secctx =               selinux_release_secctx,
5756         .inode_notifysecctx =           selinux_inode_notifysecctx,
5757         .inode_setsecctx =              selinux_inode_setsecctx,
5758         .inode_getsecctx =              selinux_inode_getsecctx,
5759
5760         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5761         .unix_may_send =                selinux_socket_unix_may_send,
5762
5763         .socket_create =                selinux_socket_create,
5764         .socket_post_create =           selinux_socket_post_create,
5765         .socket_bind =                  selinux_socket_bind,
5766         .socket_connect =               selinux_socket_connect,
5767         .socket_listen =                selinux_socket_listen,
5768         .socket_accept =                selinux_socket_accept,
5769         .socket_sendmsg =               selinux_socket_sendmsg,
5770         .socket_recvmsg =               selinux_socket_recvmsg,
5771         .socket_getsockname =           selinux_socket_getsockname,
5772         .socket_getpeername =           selinux_socket_getpeername,
5773         .socket_getsockopt =            selinux_socket_getsockopt,
5774         .socket_setsockopt =            selinux_socket_setsockopt,
5775         .socket_shutdown =              selinux_socket_shutdown,
5776         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5777         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5778         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5779         .sk_alloc_security =            selinux_sk_alloc_security,
5780         .sk_free_security =             selinux_sk_free_security,
5781         .sk_clone_security =            selinux_sk_clone_security,
5782         .sk_getsecid =                  selinux_sk_getsecid,
5783         .sock_graft =                   selinux_sock_graft,
5784         .inet_conn_request =            selinux_inet_conn_request,
5785         .inet_csk_clone =               selinux_inet_csk_clone,
5786         .inet_conn_established =        selinux_inet_conn_established,
5787         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5788         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5789         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5790         .req_classify_flow =            selinux_req_classify_flow,
5791         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5792         .tun_dev_free_security =        selinux_tun_dev_free_security,
5793         .tun_dev_create =               selinux_tun_dev_create,
5794         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5795         .tun_dev_attach =               selinux_tun_dev_attach,
5796         .tun_dev_open =                 selinux_tun_dev_open,
5797         .skb_owned_by =                 selinux_skb_owned_by,
5798
5799 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5800         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5801         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5802         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5803         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5804         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5805         .xfrm_state_free_security =     selinux_xfrm_state_free,
5806         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5807         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5808         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5809         .xfrm_decode_session =          selinux_xfrm_decode_session,
5810 #endif
5811
5812 #ifdef CONFIG_KEYS
5813         .key_alloc =                    selinux_key_alloc,
5814         .key_free =                     selinux_key_free,
5815         .key_permission =               selinux_key_permission,
5816         .key_getsecurity =              selinux_key_getsecurity,
5817 #endif
5818
5819 #ifdef CONFIG_AUDIT
5820         .audit_rule_init =              selinux_audit_rule_init,
5821         .audit_rule_known =             selinux_audit_rule_known,
5822         .audit_rule_match =             selinux_audit_rule_match,
5823         .audit_rule_free =              selinux_audit_rule_free,
5824 #endif
5825 };
5826
5827 static __init int selinux_init(void)
5828 {
5829         if (!security_module_enable(&selinux_ops)) {
5830                 selinux_enabled = 0;
5831                 return 0;
5832         }
5833
5834         if (!selinux_enabled) {
5835                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5836                 return 0;
5837         }
5838
5839         printk(KERN_INFO "SELinux:  Initializing.\n");
5840
5841         /* Set the security state for the initial task. */
5842         cred_init_security();
5843
5844         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5845
5846         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5847                                             sizeof(struct inode_security_struct),
5848                                             0, SLAB_PANIC, NULL);
5849         avc_init();
5850
5851         if (register_security(&selinux_ops))
5852                 panic("SELinux: Unable to register with kernel.\n");
5853
5854         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
5855                 panic("SELinux: Unable to register AVC netcache callback\n");
5856
5857         if (selinux_enforcing)
5858                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5859         else
5860                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5861
5862         return 0;
5863 }
5864
5865 static void delayed_superblock_init(struct super_block *sb, void *unused)
5866 {
5867         superblock_doinit(sb, NULL);
5868 }
5869
5870 void selinux_complete_init(void)
5871 {
5872         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5873
5874         /* Set up any superblocks initialized prior to the policy load. */
5875         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5876         iterate_supers(delayed_superblock_init, NULL);
5877 }
5878
5879 /* SELinux requires early initialization in order to label
5880    all processes and objects when they are created. */
5881 security_initcall(selinux_init);
5882
5883 #if defined(CONFIG_NETFILTER)
5884
5885 static struct nf_hook_ops selinux_ipv4_ops[] = {
5886         {
5887                 .hook =         selinux_ipv4_postroute,
5888                 .owner =        THIS_MODULE,
5889                 .pf =           NFPROTO_IPV4,
5890                 .hooknum =      NF_INET_POST_ROUTING,
5891                 .priority =     NF_IP_PRI_SELINUX_LAST,
5892         },
5893         {
5894                 .hook =         selinux_ipv4_forward,
5895                 .owner =        THIS_MODULE,
5896                 .pf =           NFPROTO_IPV4,
5897                 .hooknum =      NF_INET_FORWARD,
5898                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5899         },
5900         {
5901                 .hook =         selinux_ipv4_output,
5902                 .owner =        THIS_MODULE,
5903                 .pf =           NFPROTO_IPV4,
5904                 .hooknum =      NF_INET_LOCAL_OUT,
5905                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5906         }
5907 };
5908
5909 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5910
5911 static struct nf_hook_ops selinux_ipv6_ops[] = {
5912         {
5913                 .hook =         selinux_ipv6_postroute,
5914                 .owner =        THIS_MODULE,
5915                 .pf =           NFPROTO_IPV6,
5916                 .hooknum =      NF_INET_POST_ROUTING,
5917                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5918         },
5919         {
5920                 .hook =         selinux_ipv6_forward,
5921                 .owner =        THIS_MODULE,
5922                 .pf =           NFPROTO_IPV6,
5923                 .hooknum =      NF_INET_FORWARD,
5924                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5925         }
5926 };
5927
5928 #endif  /* IPV6 */
5929
5930 static int __init selinux_nf_ip_init(void)
5931 {
5932         int err = 0;
5933
5934         if (!selinux_enabled)
5935                 goto out;
5936
5937         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5938
5939         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5940         if (err)
5941                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5942
5943 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5944         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5945         if (err)
5946                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5947 #endif  /* IPV6 */
5948
5949 out:
5950         return err;
5951 }
5952
5953 __initcall(selinux_nf_ip_init);
5954
5955 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5956 static void selinux_nf_ip_exit(void)
5957 {
5958         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5959
5960         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5961 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5962         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5963 #endif  /* IPV6 */
5964 }
5965 #endif
5966
5967 #else /* CONFIG_NETFILTER */
5968
5969 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5970 #define selinux_nf_ip_exit()
5971 #endif
5972
5973 #endif /* CONFIG_NETFILTER */
5974
5975 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5976 static int selinux_disabled;
5977
5978 int selinux_disable(void)
5979 {
5980         if (ss_initialized) {
5981                 /* Not permitted after initial policy load. */
5982                 return -EINVAL;
5983         }
5984
5985         if (selinux_disabled) {
5986                 /* Only do this once. */
5987                 return -EINVAL;
5988         }
5989
5990         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5991
5992         selinux_disabled = 1;
5993         selinux_enabled = 0;
5994
5995         reset_security_ops();
5996
5997         /* Try to destroy the avc node cache */
5998         avc_disable();
5999
6000         /* Unregister netfilter hooks. */
6001         selinux_nf_ip_exit();
6002
6003         /* Unregister selinuxfs. */
6004         exit_sel_fs();
6005
6006         return 0;
6007 }
6008 #endif