security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         /*
 259          * As not all inode security structures are in a list, we check for
 260          * empty list outside of the lock to make sure that we won't waste
 261          * time taking a lock doing nothing.
 262          *
 263          * The list_del_init() function can be safely called more than once.
 264          * It should not be possible for this function to be called with
 265          * concurrent list_add(), but for better safety against future changes
 266          * in the code, we use list_empty_careful() here.
 267          */
 268         if (!list_empty_careful(&isec->list)) {
 269                 spin_lock(&sbsec->isec_lock);
 270                 list_del_init(&isec->list);
 271                 spin_unlock(&sbsec->isec_lock);
 272         }
 273
 274         /*
 275          * The inode may still be referenced in a path walk and
 276          * a call to selinux_inode_permission() can be made
 277          * after inode_free_security() is called. Ideally, the VFS
 278          * wouldn't do this, but fixing that is a much harder
 279          * job. For now, simply free the i_security via RCU, and
 280          * leave the current inode->i_security pointer intact.
 281          * The inode will be freed after the RCU grace period too.
 282          */
 283         call_rcu(&isec->rcu, inode_free_rcu);
 284 }
 285
 286 static int file_alloc_security(struct file *file)
 287 {
 288         struct file_security_struct *fsec;
 289         u32 sid = current_sid();
 290
 291         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 292         if (!fsec)
 293                 return -ENOMEM;
 294
 295         fsec->sid = sid;
 296         fsec->fown_sid = sid;
 297         file->f_security = fsec;
 298
 299         return 0;
 300 }
 301
 302 static void file_free_security(struct file *file)
 303 {
 304         struct file_security_struct *fsec = file->f_security;
 305         file->f_security = NULL;
 306         kmem_cache_free(file_security_cache, fsec);
 307 }
 308
 309 static int superblock_alloc_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec;
 312
 313         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 314         if (!sbsec)
 315                 return -ENOMEM;
 316
 317         mutex_init(&sbsec->lock);
 318         INIT_LIST_HEAD(&sbsec->isec_head);
 319         spin_lock_init(&sbsec->isec_lock);
 320         sbsec->sb = sb;
 321         sbsec->sid = SECINITSID_UNLABELED;
 322         sbsec->def_sid = SECINITSID_FILE;
 323         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 324         sb->s_security = sbsec;
 325
 326         return 0;
 327 }
 328
 329 static void superblock_free_security(struct super_block *sb)
 330 {
 331         struct superblock_security_struct *sbsec = sb->s_security;
 332         sb->s_security = NULL;
 333         kfree(sbsec);
 334 }
 335
 336 /* The file system's label must be initialized prior to use. */
 337
 338 static const char *labeling_behaviors[7] = {
 339         "uses xattr",
 340         "uses transition SIDs",
 341         "uses task SIDs",
 342         "uses genfs_contexts",
 343         "not configured for labeling",
 344         "uses mountpoint labeling",
 345         "uses native labeling",
 346 };
 347
 348 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 349
 350 static inline int inode_doinit(struct inode *inode)
 351 {
 352         return inode_doinit_with_dentry(inode, NULL);
 353 }
 354
 355 enum {
 356         Opt_error = -1,
 357         Opt_context = 1,
 358         Opt_fscontext = 2,
 359         Opt_defcontext = 3,
 360         Opt_rootcontext = 4,
 361         Opt_labelsupport = 5,
 362         Opt_nextmntopt = 6,
 363 };
 364
 365 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 366
 367 static const match_table_t tokens = {
 368         {Opt_context, CONTEXT_STR "%s"},
 369         {Opt_fscontext, FSCONTEXT_STR "%s"},
 370         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 371         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 372         {Opt_labelsupport, LABELSUPP_STR},
 373         {Opt_error, NULL},
 374 };
 375
 376 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 377
 378 static int may_context_mount_sb_relabel(u32 sid,
 379                         struct superblock_security_struct *sbsec,
 380                         const struct cred *cred)
 381 {
 382         const struct task_security_struct *tsec = cred->security;
 383         int rc;
 384
 385         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 386                           FILESYSTEM__RELABELFROM, NULL);
 387         if (rc)
 388                 return rc;
 389
 390         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELTO, NULL);
 392         return rc;
 393 }
 394
 395 static int may_context_mount_inode_relabel(u32 sid,
 396                         struct superblock_security_struct *sbsec,
 397                         const struct cred *cred)
 398 {
 399         const struct task_security_struct *tsec = cred->security;
 400         int rc;
 401         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 402                           FILESYSTEM__RELABELFROM, NULL);
 403         if (rc)
 404                 return rc;
 405
 406         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 407                           FILESYSTEM__ASSOCIATE, NULL);
 408         return rc;
 409 }
 410
 411 static int selinux_is_sblabel_mnt(struct super_block *sb)
 412 {
 413         struct superblock_security_struct *sbsec = sb->s_security;
 414
 415         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 416                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 417                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 418                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 419                 /* Special handling. Genfs but also in-core setxattr handler */
 420                 !strcmp(sb->s_type->name, "sysfs") ||
 421                 !strcmp(sb->s_type->name, "pstore") ||
 422                 !strcmp(sb->s_type->name, "debugfs") ||
 423                 !strcmp(sb->s_type->name, "tracefs") ||
 424                 !strcmp(sb->s_type->name, "rootfs");
 425 }
 426
 427 static int sb_finish_set_opts(struct super_block *sb)
 428 {
 429         struct superblock_security_struct *sbsec = sb->s_security;
 430         struct dentry *root = sb->s_root;
 431         struct inode *root_inode = d_backing_inode(root);
 432         int rc = 0;
 433
 434         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 435                 /* Make sure that the xattr handler exists and that no
 436                    error other than -ENODATA is returned by getxattr on
 437                    the root directory.  -ENODATA is ok, as this may be
 438                    the first boot of the SELinux kernel before we have
 439                    assigned xattr values to the filesystem. */
 440                 if (!root_inode->i_op->getxattr) {
 441                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 442                                "xattr support\n", sb->s_id, sb->s_type->name);
 443                         rc = -EOPNOTSUPP;
 444                         goto out;
 445                 }
 446                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 447                 if (rc < 0 && rc != -ENODATA) {
 448                         if (rc == -EOPNOTSUPP)
 449                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 450                                        "%s) has no security xattr handler\n",
 451                                        sb->s_id, sb->s_type->name);
 452                         else
 453                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 454                                        "%s) getxattr errno %d\n", sb->s_id,
 455                                        sb->s_type->name, -rc);
 456                         goto out;
 457                 }
 458         }
 459
 460         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 461                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 462                        sb->s_id, sb->s_type->name);
 463
 464         sbsec->flags |= SE_SBINITIALIZED;
 465         if (selinux_is_sblabel_mnt(sb))
 466                 sbsec->flags |= SBLABEL_MNT;
 467
 468         /* Initialize the root inode. */
 469         rc = inode_doinit_with_dentry(root_inode, root);
 470
 471         /* Initialize any other inodes associated with the superblock, e.g.
 472            inodes created prior to initial policy load or inodes created
 473            during get_sb by a pseudo filesystem that directly
 474            populates itself. */
 475         spin_lock(&sbsec->isec_lock);
 476 next_inode:
 477         if (!list_empty(&sbsec->isec_head)) {
 478                 struct inode_security_struct *isec =
 479                                 list_entry(sbsec->isec_head.next,
 480                                            struct inode_security_struct, list);
 481                 struct inode *inode = isec->inode;
 482                 list_del_init(&isec->list);
 483                 spin_unlock(&sbsec->isec_lock);
 484                 inode = igrab(inode);
 485                 if (inode) {
 486                         if (!IS_PRIVATE(inode))
 487                                 inode_doinit(inode);
 488                         iput(inode);
 489                 }
 490                 spin_lock(&sbsec->isec_lock);
 491                 goto next_inode;
 492         }
 493         spin_unlock(&sbsec->isec_lock);
 494 out:
 495         return rc;
 496 }
 497
 498 /*
 499  * This function should allow an FS to ask what it's mount security
 500  * options were so it can use those later for submounts, displaying
 501  * mount options, or whatever.
 502  */
 503 static int selinux_get_mnt_opts(const struct super_block *sb,
 504                                 struct security_mnt_opts *opts)
 505 {
 506         int rc = 0, i;
 507         struct superblock_security_struct *sbsec = sb->s_security;
 508         char *context = NULL;
 509         u32 len;
 510         char tmp;
 511
 512         security_init_mnt_opts(opts);
 513
 514         if (!(sbsec->flags & SE_SBINITIALIZED))
 515                 return -EINVAL;
 516
 517         if (!ss_initialized)
 518                 return -EINVAL;
 519
 520         /* make sure we always check enough bits to cover the mask */
 521         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 522
 523         tmp = sbsec->flags & SE_MNTMASK;
 524         /* count the number of mount options for this sb */
 525         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 526                 if (tmp & 0x01)
 527                         opts->num_mnt_opts++;
 528                 tmp >>= 1;
 529         }
 530         /* Check if the Label support flag is set */
 531         if (sbsec->flags & SBLABEL_MNT)
 532                 opts->num_mnt_opts++;
 533
 534         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 535         if (!opts->mnt_opts) {
 536                 rc = -ENOMEM;
 537                 goto out_free;
 538         }
 539
 540         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 541         if (!opts->mnt_opts_flags) {
 542                 rc = -ENOMEM;
 543                 goto out_free;
 544         }
 545
 546         i = 0;
 547         if (sbsec->flags & FSCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & CONTEXT_MNT) {
 555                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 556                 if (rc)
 557                         goto out_free;
 558                 opts->mnt_opts[i] = context;
 559                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 560         }
 561         if (sbsec->flags & DEFCONTEXT_MNT) {
 562                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 563                 if (rc)
 564                         goto out_free;
 565                 opts->mnt_opts[i] = context;
 566                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 567         }
 568         if (sbsec->flags & ROOTCONTEXT_MNT) {
 569                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 570                 struct inode_security_struct *isec = root->i_security;
 571
 572                 rc = security_sid_to_context(isec->sid, &context, &len);
 573                 if (rc)
 574                         goto out_free;
 575                 opts->mnt_opts[i] = context;
 576                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 577         }
 578         if (sbsec->flags & SBLABEL_MNT) {
 579                 opts->mnt_opts[i] = NULL;
 580                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 581         }
 582
 583         BUG_ON(i != opts->num_mnt_opts);
 584
 585         return 0;
 586
 587 out_free:
 588         security_free_mnt_opts(opts);
 589         return rc;
 590 }
 591
 592 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 593                       u32 old_sid, u32 new_sid)
 594 {
 595         char mnt_flags = sbsec->flags & SE_MNTMASK;
 596
 597         /* check if the old mount command had the same options */
 598         if (sbsec->flags & SE_SBINITIALIZED)
 599                 if (!(sbsec->flags & flag) ||
 600                     (old_sid != new_sid))
 601                         return 1;
 602
 603         /* check if we were passed the same options twice,
 604          * aka someone passed context=a,context=b
 605          */
 606         if (!(sbsec->flags & SE_SBINITIALIZED))
 607                 if (mnt_flags & flag)
 608                         return 1;
 609         return 0;
 610 }
 611
 612 /*
 613  * Allow filesystems with binary mount data to explicitly set mount point
 614  * labeling information.
 615  */
 616 static int selinux_set_mnt_opts(struct super_block *sb,
 617                                 struct security_mnt_opts *opts,
 618                                 unsigned long kern_flags,
 619                                 unsigned long *set_kern_flags)
 620 {
 621         const struct cred *cred = current_cred();
 622         int rc = 0, i;
 623         struct superblock_security_struct *sbsec = sb->s_security;
 624         const char *name = sb->s_type->name;
 625         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 626         struct inode_security_struct *root_isec = inode->i_security;
 627         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 628         u32 defcontext_sid = 0;
 629         char **mount_options = opts->mnt_opts;
 630         int *flags = opts->mnt_opts_flags;
 631         int num_opts = opts->num_mnt_opts;
 632
 633         mutex_lock(&sbsec->lock);
 634
 635         if (!ss_initialized) {
 636                 if (!num_opts) {
 637                         /* Defer initialization until selinux_complete_init,
 638                            after the initial policy is loaded and the security
 639                            server is ready to handle calls. */
 640                         goto out;
 641                 }
 642                 rc = -EINVAL;
 643                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 644                         "before the security server is initialized\n");
 645                 goto out;
 646         }
 647         if (kern_flags && !set_kern_flags) {
 648                 /* Specifying internal flags without providing a place to
 649                  * place the results is not allowed */
 650                 rc = -EINVAL;
 651                 goto out;
 652         }
 653
 654         /*
 655          * Binary mount data FS will come through this function twice.  Once
 656          * from an explicit call and once from the generic calls from the vfs.
 657          * Since the generic VFS calls will not contain any security mount data
 658          * we need to skip the double mount verification.
 659          *
 660          * This does open a hole in which we will not notice if the first
 661          * mount using this sb set explict options and a second mount using
 662          * this sb does not set any security options.  (The first options
 663          * will be used for both mounts)
 664          */
 665         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 666             && (num_opts == 0))
 667                 goto out;
 668
 669         /*
 670          * parse the mount options, check if they are valid sids.
 671          * also check if someone is trying to mount the same sb more
 672          * than once with different security options.
 673          */
 674         for (i = 0; i < num_opts; i++) {
 675                 u32 sid;
 676
 677                 if (flags[i] == SBLABEL_MNT)
 678                         continue;
 679                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 680                 if (rc) {
 681                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 682                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 683                                mount_options[i], sb->s_id, name, rc);
 684                         goto out;
 685                 }
 686                 switch (flags[i]) {
 687                 case FSCONTEXT_MNT:
 688                         fscontext_sid = sid;
 689
 690                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 691                                         fscontext_sid))
 692                                 goto out_double_mount;
 693
 694                         sbsec->flags |= FSCONTEXT_MNT;
 695                         break;
 696                 case CONTEXT_MNT:
 697                         context_sid = sid;
 698
 699                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 700                                         context_sid))
 701                                 goto out_double_mount;
 702
 703                         sbsec->flags |= CONTEXT_MNT;
 704                         break;
 705                 case ROOTCONTEXT_MNT:
 706                         rootcontext_sid = sid;
 707
 708                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 709                                         rootcontext_sid))
 710                                 goto out_double_mount;
 711
 712                         sbsec->flags |= ROOTCONTEXT_MNT;
 713
 714                         break;
 715                 case DEFCONTEXT_MNT:
 716                         defcontext_sid = sid;
 717
 718                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 719                                         defcontext_sid))
 720                                 goto out_double_mount;
 721
 722                         sbsec->flags |= DEFCONTEXT_MNT;
 723
 724                         break;
 725                 default:
 726                         rc = -EINVAL;
 727                         goto out;
 728                 }
 729         }
 730
 731         if (sbsec->flags & SE_SBINITIALIZED) {
 732                 /* previously mounted with options, but not on this attempt? */
 733                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 734                         goto out_double_mount;
 735                 rc = 0;
 736                 goto out;
 737         }
 738
 739         if (strcmp(sb->s_type->name, "proc") == 0)
 740                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 741
 742         if (!strcmp(sb->s_type->name, "debugfs") ||
 743             !strcmp(sb->s_type->name, "sysfs") ||
 744             !strcmp(sb->s_type->name, "pstore"))
 745                 sbsec->flags |= SE_SBGENFS;
 746
 747         if (!sbsec->behavior) {
 748                 /*
 749                  * Determine the labeling behavior to use for this
 750                  * filesystem type.
 751                  */
 752                 rc = security_fs_use(sb);
 753                 if (rc) {
 754                         printk(KERN_WARNING
 755                                 "%s: security_fs_use(%s) returned %d\n",
 756                                         __func__, sb->s_type->name, rc);
 757                         goto out;
 758                 }
 759         }
 760         /* sets the context of the superblock for the fs being mounted. */
 761         if (fscontext_sid) {
 762                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 763                 if (rc)
 764                         goto out;
 765
 766                 sbsec->sid = fscontext_sid;
 767         }
 768
 769         /*
 770          * Switch to using mount point labeling behavior.
 771          * sets the label used on all file below the mountpoint, and will set
 772          * the superblock context if not already set.
 773          */
 774         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 775                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 776                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 777         }
 778
 779         if (context_sid) {
 780                 if (!fscontext_sid) {
 781                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 782                                                           cred);
 783                         if (rc)
 784                                 goto out;
 785                         sbsec->sid = context_sid;
 786                 } else {
 787                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 788                                                              cred);
 789                         if (rc)
 790                                 goto out;
 791                 }
 792                 if (!rootcontext_sid)
 793                         rootcontext_sid = context_sid;
 794
 795                 sbsec->mntpoint_sid = context_sid;
 796                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 797         }
 798
 799         if (rootcontext_sid) {
 800                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 801                                                      cred);
 802                 if (rc)
 803                         goto out;
 804
 805                 root_isec->sid = rootcontext_sid;
 806                 root_isec->initialized = 1;
 807         }
 808
 809         if (defcontext_sid) {
 810                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 811                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 812                         rc = -EINVAL;
 813                         printk(KERN_WARNING "SELinux: defcontext option is "
 814                                "invalid for this filesystem type\n");
 815                         goto out;
 816                 }
 817
 818                 if (defcontext_sid != sbsec->def_sid) {
 819                         rc = may_context_mount_inode_relabel(defcontext_sid,
 820                                                              sbsec, cred);
 821                         if (rc)
 822                                 goto out;
 823                 }
 824
 825                 sbsec->def_sid = defcontext_sid;
 826         }
 827
 828         rc = sb_finish_set_opts(sb);
 829 out:
 830         mutex_unlock(&sbsec->lock);
 831         return rc;
 832 out_double_mount:
 833         rc = -EINVAL;
 834         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 835                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 836         goto out;
 837 }
 838
 839 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 840                                     const struct super_block *newsb)
 841 {
 842         struct superblock_security_struct *old = oldsb->s_security;
 843         struct superblock_security_struct *new = newsb->s_security;
 844         char oldflags = old->flags & SE_MNTMASK;
 845         char newflags = new->flags & SE_MNTMASK;
 846
 847         if (oldflags != newflags)
 848                 goto mismatch;
 849         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 850                 goto mismatch;
 851         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 852                 goto mismatch;
 853         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 854                 goto mismatch;
 855         if (oldflags & ROOTCONTEXT_MNT) {
 856                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 857                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 858                 if (oldroot->sid != newroot->sid)
 859                         goto mismatch;
 860         }
 861         return 0;
 862 mismatch:
 863         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 864                             "different security settings for (dev %s, "
 865                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 866         return -EBUSY;
 867 }
 868
 869 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 870                                         struct super_block *newsb)
 871 {
 872         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 873         struct superblock_security_struct *newsbsec = newsb->s_security;
 874
 875         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 876         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 877         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 878
 879         /*
 880          * if the parent was able to be mounted it clearly had no special lsm
 881          * mount options.  thus we can safely deal with this superblock later
 882          */
 883         if (!ss_initialized)
 884                 return 0;
 885
 886         /* how can we clone if the old one wasn't set up?? */
 887         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 888
 889         /* if fs is reusing a sb, make sure that the contexts match */
 890         if (newsbsec->flags & SE_SBINITIALIZED)
 891                 return selinux_cmp_sb_context(oldsb, newsb);
 892
 893         mutex_lock(&newsbsec->lock);
 894
 895         newsbsec->flags = oldsbsec->flags;
 896
 897         newsbsec->sid = oldsbsec->sid;
 898         newsbsec->def_sid = oldsbsec->def_sid;
 899         newsbsec->behavior = oldsbsec->behavior;
 900
 901         if (set_context) {
 902                 u32 sid = oldsbsec->mntpoint_sid;
 903
 904                 if (!set_fscontext)
 905                         newsbsec->sid = sid;
 906                 if (!set_rootcontext) {
 907                         struct inode *newinode = d_backing_inode(newsb->s_root);
 908                         struct inode_security_struct *newisec = newinode->i_security;
 909                         newisec->sid = sid;
 910                 }
 911                 newsbsec->mntpoint_sid = sid;
 912         }
 913         if (set_rootcontext) {
 914                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 915                 const struct inode_security_struct *oldisec = oldinode->i_security;
 916                 struct inode *newinode = d_backing_inode(newsb->s_root);
 917                 struct inode_security_struct *newisec = newinode->i_security;
 918
 919                 newisec->sid = oldisec->sid;
 920         }
 921
 922         sb_finish_set_opts(newsb);
 923         mutex_unlock(&newsbsec->lock);
 924         return 0;
 925 }
 926
 927 static int selinux_parse_opts_str(char *options,
 928                                   struct security_mnt_opts *opts)
 929 {
 930         char *p;
 931         char *context = NULL, *defcontext = NULL;
 932         char *fscontext = NULL, *rootcontext = NULL;
 933         int rc, num_mnt_opts = 0;
 934
 935         opts->num_mnt_opts = 0;
 936
 937         /* Standard string-based options. */
 938         while ((p = strsep(&options, "|")) != NULL) {
 939                 int token;
 940                 substring_t args[MAX_OPT_ARGS];
 941
 942                 if (!*p)
 943                         continue;
 944
 945                 token = match_token(p, tokens, args);
 946
 947                 switch (token) {
 948                 case Opt_context:
 949                         if (context || defcontext) {
 950                                 rc = -EINVAL;
 951                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 952                                 goto out_err;
 953                         }
 954                         context = match_strdup(&args[0]);
 955                         if (!context) {
 956                                 rc = -ENOMEM;
 957                                 goto out_err;
 958                         }
 959                         break;
 960
 961                 case Opt_fscontext:
 962                         if (fscontext) {
 963                                 rc = -EINVAL;
 964                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 965                                 goto out_err;
 966                         }
 967                         fscontext = match_strdup(&args[0]);
 968                         if (!fscontext) {
 969                                 rc = -ENOMEM;
 970                                 goto out_err;
 971                         }
 972                         break;
 973
 974                 case Opt_rootcontext:
 975                         if (rootcontext) {
 976                                 rc = -EINVAL;
 977                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 978                                 goto out_err;
 979                         }
 980                         rootcontext = match_strdup(&args[0]);
 981                         if (!rootcontext) {
 982                                 rc = -ENOMEM;
 983                                 goto out_err;
 984                         }
 985                         break;
 986
 987                 case Opt_defcontext:
 988                         if (context || defcontext) {
 989                                 rc = -EINVAL;
 990                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 991                                 goto out_err;
 992                         }
 993                         defcontext = match_strdup(&args[0]);
 994                         if (!defcontext) {
 995                                 rc = -ENOMEM;
 996                                 goto out_err;
 997                         }
 998                         break;
 999                 case Opt_labelsupport:
1000                         break;
1001                 default:
1002                         rc = -EINVAL;
1003                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1004                         goto out_err;
1005
1006                 }
1007         }
1008
1009         rc = -ENOMEM;
1010         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1011         if (!opts->mnt_opts)
1012                 goto out_err;
1013
1014         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1015         if (!opts->mnt_opts_flags) {
1016                 kfree(opts->mnt_opts);
1017                 goto out_err;
1018         }
1019
1020         if (fscontext) {
1021                 opts->mnt_opts[num_mnt_opts] = fscontext;
1022                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1023         }
1024         if (context) {
1025                 opts->mnt_opts[num_mnt_opts] = context;
1026                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1027         }
1028         if (rootcontext) {
1029                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1030                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1031         }
1032         if (defcontext) {
1033                 opts->mnt_opts[num_mnt_opts] = defcontext;
1034                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1035         }
1036
1037         opts->num_mnt_opts = num_mnt_opts;
1038         return 0;
1039
1040 out_err:
1041         kfree(context);
1042         kfree(defcontext);
1043         kfree(fscontext);
1044         kfree(rootcontext);
1045         return rc;
1046 }
1047 /*
1048  * string mount options parsing and call set the sbsec
1049  */
1050 static int superblock_doinit(struct super_block *sb, void *data)
1051 {
1052         int rc = 0;
1053         char *options = data;
1054         struct security_mnt_opts opts;
1055
1056         security_init_mnt_opts(&opts);
1057
1058         if (!data)
1059                 goto out;
1060
1061         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1062
1063         rc = selinux_parse_opts_str(options, &opts);
1064         if (rc)
1065                 goto out_err;
1066
1067 out:
1068         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1069
1070 out_err:
1071         security_free_mnt_opts(&opts);
1072         return rc;
1073 }
1074
1075 static void selinux_write_opts(struct seq_file *m,
1076                                struct security_mnt_opts *opts)
1077 {
1078         int i;
1079         char *prefix;
1080
1081         for (i = 0; i < opts->num_mnt_opts; i++) {
1082                 char *has_comma;
1083
1084                 if (opts->mnt_opts[i])
1085                         has_comma = strchr(opts->mnt_opts[i], ',');
1086                 else
1087                         has_comma = NULL;
1088
1089                 switch (opts->mnt_opts_flags[i]) {
1090                 case CONTEXT_MNT:
1091                         prefix = CONTEXT_STR;
1092                         break;
1093                 case FSCONTEXT_MNT:
1094                         prefix = FSCONTEXT_STR;
1095                         break;
1096                 case ROOTCONTEXT_MNT:
1097                         prefix = ROOTCONTEXT_STR;
1098                         break;
1099                 case DEFCONTEXT_MNT:
1100                         prefix = DEFCONTEXT_STR;
1101                         break;
1102                 case SBLABEL_MNT:
1103                         seq_putc(m, ',');
1104                         seq_puts(m, LABELSUPP_STR);
1105                         continue;
1106                 default:
1107                         BUG();
1108                         return;
1109                 };
1110                 /* we need a comma before each option */
1111                 seq_putc(m, ',');
1112                 seq_puts(m, prefix);
1113                 if (has_comma)
1114                         seq_putc(m, '\"');
1115                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1116                 if (has_comma)
1117                         seq_putc(m, '\"');
1118         }
1119 }
1120
1121 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1122 {
1123         struct security_mnt_opts opts;
1124         int rc;
1125
1126         rc = selinux_get_mnt_opts(sb, &opts);
1127         if (rc) {
1128                 /* before policy load we may get EINVAL, don't show anything */
1129                 if (rc == -EINVAL)
1130                         rc = 0;
1131                 return rc;
1132         }
1133
1134         selinux_write_opts(m, &opts);
1135
1136         security_free_mnt_opts(&opts);
1137
1138         return rc;
1139 }
1140
1141 static inline u16 inode_mode_to_security_class(umode_t mode)
1142 {
1143         switch (mode & S_IFMT) {
1144         case S_IFSOCK:
1145                 return SECCLASS_SOCK_FILE;
1146         case S_IFLNK:
1147                 return SECCLASS_LNK_FILE;
1148         case S_IFREG:
1149                 return SECCLASS_FILE;
1150         case S_IFBLK:
1151                 return SECCLASS_BLK_FILE;
1152         case S_IFDIR:
1153                 return SECCLASS_DIR;
1154         case S_IFCHR:
1155                 return SECCLASS_CHR_FILE;
1156         case S_IFIFO:
1157                 return SECCLASS_FIFO_FILE;
1158
1159         }
1160
1161         return SECCLASS_FILE;
1162 }
1163
1164 static inline int default_protocol_stream(int protocol)
1165 {
1166         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1167 }
1168
1169 static inline int default_protocol_dgram(int protocol)
1170 {
1171         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1172 }
1173
1174 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1175 {
1176         switch (family) {
1177         case PF_UNIX:
1178                 switch (type) {
1179                 case SOCK_STREAM:
1180                 case SOCK_SEQPACKET:
1181                         return SECCLASS_UNIX_STREAM_SOCKET;
1182                 case SOCK_DGRAM:
1183                         return SECCLASS_UNIX_DGRAM_SOCKET;
1184                 }
1185                 break;
1186         case PF_INET:
1187         case PF_INET6:
1188                 switch (type) {
1189                 case SOCK_STREAM:
1190                         if (default_protocol_stream(protocol))
1191                                 return SECCLASS_TCP_SOCKET;
1192                         else
1193                                 return SECCLASS_RAWIP_SOCKET;
1194                 case SOCK_DGRAM:
1195                         if (default_protocol_dgram(protocol))
1196                                 return SECCLASS_UDP_SOCKET;
1197                         else
1198                                 return SECCLASS_RAWIP_SOCKET;
1199                 case SOCK_DCCP:
1200                         return SECCLASS_DCCP_SOCKET;
1201                 default:
1202                         return SECCLASS_RAWIP_SOCKET;
1203                 }
1204                 break;
1205         case PF_NETLINK:
1206                 switch (protocol) {
1207                 case NETLINK_ROUTE:
1208                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1209                 case NETLINK_SOCK_DIAG:
1210                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1211                 case NETLINK_NFLOG:
1212                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1213                 case NETLINK_XFRM:
1214                         return SECCLASS_NETLINK_XFRM_SOCKET;
1215                 case NETLINK_SELINUX:
1216                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1217                 case NETLINK_ISCSI:
1218                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1219                 case NETLINK_AUDIT:
1220                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1221                 case NETLINK_FIB_LOOKUP:
1222                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1223                 case NETLINK_CONNECTOR:
1224                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1225                 case NETLINK_NETFILTER:
1226                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1227                 case NETLINK_DNRTMSG:
1228                         return SECCLASS_NETLINK_DNRT_SOCKET;
1229                 case NETLINK_KOBJECT_UEVENT:
1230                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1231                 case NETLINK_GENERIC:
1232                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1233                 case NETLINK_SCSITRANSPORT:
1234                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1235                 case NETLINK_RDMA:
1236                         return SECCLASS_NETLINK_RDMA_SOCKET;
1237                 case NETLINK_CRYPTO:
1238                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1239                 default:
1240                         return SECCLASS_NETLINK_SOCKET;
1241                 }
1242         case PF_PACKET:
1243                 return SECCLASS_PACKET_SOCKET;
1244         case PF_KEY:
1245                 return SECCLASS_KEY_SOCKET;
1246         case PF_APPLETALK:
1247                 return SECCLASS_APPLETALK_SOCKET;
1248         }
1249
1250         return SECCLASS_SOCKET;
1251 }
1252
1253 static int selinux_genfs_get_sid(struct dentry *dentry,
1254                                  u16 tclass,
1255                                  u16 flags,
1256                                  u32 *sid)
1257 {
1258         int rc;
1259         struct super_block *sb = dentry->d_inode->i_sb;
1260         char *buffer, *path;
1261
1262         buffer = (char *)__get_free_page(GFP_KERNEL);
1263         if (!buffer)
1264                 return -ENOMEM;
1265
1266         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1267         if (IS_ERR(path))
1268                 rc = PTR_ERR(path);
1269         else {
1270                 if (flags & SE_SBPROC) {
1271                         /* each process gets a /proc/PID/ entry. Strip off the
1272                          * PID part to get a valid selinux labeling.
1273                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1274                         while (path[1] >= '0' && path[1] <= '9') {
1275                                 path[1] = '/';
1276                                 path++;
1277                         }
1278                 }
1279                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1280         }
1281         free_page((unsigned long)buffer);
1282         return rc;
1283 }
1284
1285 /* The inode's security attributes must be initialized before first use. */
1286 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1287 {
1288         struct superblock_security_struct *sbsec = NULL;
1289         struct inode_security_struct *isec = inode->i_security;
1290         u32 sid;
1291         struct dentry *dentry;
1292 #define INITCONTEXTLEN 255
1293         char *context = NULL;
1294         unsigned len = 0;
1295         int rc = 0;
1296
1297         if (isec->initialized)
1298                 goto out;
1299
1300         mutex_lock(&isec->lock);
1301         if (isec->initialized)
1302                 goto out_unlock;
1303
1304         sbsec = inode->i_sb->s_security;
1305         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1306                 /* Defer initialization until selinux_complete_init,
1307                    after the initial policy is loaded and the security
1308                    server is ready to handle calls. */
1309                 spin_lock(&sbsec->isec_lock);
1310                 if (list_empty(&isec->list))
1311                         list_add(&isec->list, &sbsec->isec_head);
1312                 spin_unlock(&sbsec->isec_lock);
1313                 goto out_unlock;
1314         }
1315
1316         switch (sbsec->behavior) {
1317         case SECURITY_FS_USE_NATIVE:
1318                 break;
1319         case SECURITY_FS_USE_XATTR:
1320                 if (!inode->i_op->getxattr) {
1321                         isec->sid = sbsec->def_sid;
1322                         break;
1323                 }
1324
1325                 /* Need a dentry, since the xattr API requires one.
1326                    Life would be simpler if we could just pass the inode. */
1327                 if (opt_dentry) {
1328                         /* Called from d_instantiate or d_splice_alias. */
1329                         dentry = dget(opt_dentry);
1330                 } else {
1331                         /* Called from selinux_complete_init, try to find a dentry. */
1332                         dentry = d_find_alias(inode);
1333                 }
1334                 if (!dentry) {
1335                         /*
1336                          * this is can be hit on boot when a file is accessed
1337                          * before the policy is loaded.  When we load policy we
1338                          * may find inodes that have no dentry on the
1339                          * sbsec->isec_head list.  No reason to complain as these
1340                          * will get fixed up the next time we go through
1341                          * inode_doinit with a dentry, before these inodes could
1342                          * be used again by userspace.
1343                          */
1344                         goto out_unlock;
1345                 }
1346
1347                 len = INITCONTEXTLEN;
1348                 context = kmalloc(len+1, GFP_NOFS);
1349                 if (!context) {
1350                         rc = -ENOMEM;
1351                         dput(dentry);
1352                         goto out_unlock;
1353                 }
1354                 context[len] = '\0';
1355                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1356                                            context, len);
1357                 if (rc == -ERANGE) {
1358                         kfree(context);
1359
1360                         /* Need a larger buffer.  Query for the right size. */
1361                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1362                                                    NULL, 0);
1363                         if (rc < 0) {
1364                                 dput(dentry);
1365                                 goto out_unlock;
1366                         }
1367                         len = rc;
1368                         context = kmalloc(len+1, GFP_NOFS);
1369                         if (!context) {
1370                                 rc = -ENOMEM;
1371                                 dput(dentry);
1372                                 goto out_unlock;
1373                         }
1374                         context[len] = '\0';
1375                         rc = inode->i_op->getxattr(dentry,
1376                                                    XATTR_NAME_SELINUX,
1377                                                    context, len);
1378                 }
1379                 dput(dentry);
1380                 if (rc < 0) {
1381                         if (rc != -ENODATA) {
1382                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1383                                        "%d for dev=%s ino=%ld\n", __func__,
1384                                        -rc, inode->i_sb->s_id, inode->i_ino);
1385                                 kfree(context);
1386                                 goto out_unlock;
1387                         }
1388                         /* Map ENODATA to the default file SID */
1389                         sid = sbsec->def_sid;
1390                         rc = 0;
1391                 } else {
1392                         rc = security_context_to_sid_default(context, rc, &sid,
1393                                                              sbsec->def_sid,
1394                                                              GFP_NOFS);
1395                         if (rc) {
1396                                 char *dev = inode->i_sb->s_id;
1397                                 unsigned long ino = inode->i_ino;
1398
1399                                 if (rc == -EINVAL) {
1400                                         if (printk_ratelimit())
1401                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1402                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1403                                                         "filesystem in question.\n", ino, dev, context);
1404                                 } else {
1405                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1406                                                "returned %d for dev=%s ino=%ld\n",
1407                                                __func__, context, -rc, dev, ino);
1408                                 }
1409                                 kfree(context);
1410                                 /* Leave with the unlabeled SID */
1411                                 rc = 0;
1412                                 break;
1413                         }
1414                 }
1415                 kfree(context);
1416                 isec->sid = sid;
1417                 break;
1418         case SECURITY_FS_USE_TASK:
1419                 isec->sid = isec->task_sid;
1420                 break;
1421         case SECURITY_FS_USE_TRANS:
1422                 /* Default to the fs SID. */
1423                 isec->sid = sbsec->sid;
1424
1425                 /* Try to obtain a transition SID. */
1426                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1427                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1428                                              isec->sclass, NULL, &sid);
1429                 if (rc)
1430                         goto out_unlock;
1431                 isec->sid = sid;
1432                 break;
1433         case SECURITY_FS_USE_MNTPOINT:
1434                 isec->sid = sbsec->mntpoint_sid;
1435                 break;
1436         default:
1437                 /* Default to the fs superblock SID. */
1438                 isec->sid = sbsec->sid;
1439
1440                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1441                         /* We must have a dentry to determine the label on
1442                          * procfs inodes */
1443                         if (opt_dentry)
1444                                 /* Called from d_instantiate or
1445                                  * d_splice_alias. */
1446                                 dentry = dget(opt_dentry);
1447                         else
1448                                 /* Called from selinux_complete_init, try to
1449                                  * find a dentry. */
1450                                 dentry = d_find_alias(inode);
1451                         /*
1452                          * This can be hit on boot when a file is accessed
1453                          * before the policy is loaded.  When we load policy we
1454                          * may find inodes that have no dentry on the
1455                          * sbsec->isec_head list.  No reason to complain as
1456                          * these will get fixed up the next time we go through
1457                          * inode_doinit() with a dentry, before these inodes
1458                          * could be used again by userspace.
1459                          */
1460                         if (!dentry)
1461                                 goto out_unlock;
1462                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1463                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1464                                                    sbsec->flags, &sid);
1465                         dput(dentry);
1466                         if (rc)
1467                                 goto out_unlock;
1468                         isec->sid = sid;
1469                 }
1470                 break;
1471         }
1472
1473         isec->initialized = 1;
1474
1475 out_unlock:
1476         mutex_unlock(&isec->lock);
1477 out:
1478         if (isec->sclass == SECCLASS_FILE)
1479                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1480         return rc;
1481 }
1482
1483 /* Convert a Linux signal to an access vector. */
1484 static inline u32 signal_to_av(int sig)
1485 {
1486         u32 perm = 0;
1487
1488         switch (sig) {
1489         case SIGCHLD:
1490                 /* Commonly granted from child to parent. */
1491                 perm = PROCESS__SIGCHLD;
1492                 break;
1493         case SIGKILL:
1494                 /* Cannot be caught or ignored */
1495                 perm = PROCESS__SIGKILL;
1496                 break;
1497         case SIGSTOP:
1498                 /* Cannot be caught or ignored */
1499                 perm = PROCESS__SIGSTOP;
1500                 break;
1501         default:
1502                 /* All other signals. */
1503                 perm = PROCESS__SIGNAL;
1504                 break;
1505         }
1506
1507         return perm;
1508 }
1509
1510 /*
1511  * Check permission between a pair of credentials
1512  * fork check, ptrace check, etc.
1513  */
1514 static int cred_has_perm(const struct cred *actor,
1515                          const struct cred *target,
1516                          u32 perms)
1517 {
1518         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1519
1520         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1521 }
1522
1523 /*
1524  * Check permission between a pair of tasks, e.g. signal checks,
1525  * fork check, ptrace check, etc.
1526  * tsk1 is the actor and tsk2 is the target
1527  * - this uses the default subjective creds of tsk1
1528  */
1529 static int task_has_perm(const struct task_struct *tsk1,
1530                          const struct task_struct *tsk2,
1531                          u32 perms)
1532 {
1533         const struct task_security_struct *__tsec1, *__tsec2;
1534         u32 sid1, sid2;
1535
1536         rcu_read_lock();
1537         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1538         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1539         rcu_read_unlock();
1540         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1541 }
1542
1543 /*
1544  * Check permission between current and another task, e.g. signal checks,
1545  * fork check, ptrace check, etc.
1546  * current is the actor and tsk2 is the target
1547  * - this uses current's subjective creds
1548  */
1549 static int current_has_perm(const struct task_struct *tsk,
1550                             u32 perms)
1551 {
1552         u32 sid, tsid;
1553
1554         sid = current_sid();
1555         tsid = task_sid(tsk);
1556         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1557 }
1558
1559 #if CAP_LAST_CAP > 63
1560 #error Fix SELinux to handle capabilities > 63.
1561 #endif
1562
1563 /* Check whether a task is allowed to use a capability. */
1564 static int cred_has_capability(const struct cred *cred,
1565                                int cap, int audit)
1566 {
1567         struct common_audit_data ad;
1568         struct av_decision avd;
1569         u16 sclass;
1570         u32 sid = cred_sid(cred);
1571         u32 av = CAP_TO_MASK(cap);
1572         int rc;
1573
1574         ad.type = LSM_AUDIT_DATA_CAP;
1575         ad.u.cap = cap;
1576
1577         switch (CAP_TO_INDEX(cap)) {
1578         case 0:
1579                 sclass = SECCLASS_CAPABILITY;
1580                 break;
1581         case 1:
1582                 sclass = SECCLASS_CAPABILITY2;
1583                 break;
1584         default:
1585                 printk(KERN_ERR
1586                        "SELinux:  out of range capability %d\n", cap);
1587                 BUG();
1588                 return -EINVAL;
1589         }
1590
1591         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1592         if (audit == SECURITY_CAP_AUDIT) {
1593                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1594                 if (rc2)
1595                         return rc2;
1596         }
1597         return rc;
1598 }
1599
1600 /* Check whether a task is allowed to use a system operation. */
1601 static int task_has_system(struct task_struct *tsk,
1602                            u32 perms)
1603 {
1604         u32 sid = task_sid(tsk);
1605
1606         return avc_has_perm(sid, SECINITSID_KERNEL,
1607                             SECCLASS_SYSTEM, perms, NULL);
1608 }
1609
1610 /* Check whether a task has a particular permission to an inode.
1611    The 'adp' parameter is optional and allows other audit
1612    data to be passed (e.g. the dentry). */
1613 static int inode_has_perm(const struct cred *cred,
1614                           struct inode *inode,
1615                           u32 perms,
1616                           struct common_audit_data *adp)
1617 {
1618         struct inode_security_struct *isec;
1619         u32 sid;
1620
1621         validate_creds(cred);
1622
1623         if (unlikely(IS_PRIVATE(inode)))
1624                 return 0;
1625
1626         sid = cred_sid(cred);
1627         isec = inode->i_security;
1628
1629         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1630 }
1631
1632 /* Same as inode_has_perm, but pass explicit audit data containing
1633    the dentry to help the auditing code to more easily generate the
1634    pathname if needed. */
1635 static inline int dentry_has_perm(const struct cred *cred,
1636                                   struct dentry *dentry,
1637                                   u32 av)
1638 {
1639         struct inode *inode = d_backing_inode(dentry);
1640         struct common_audit_data ad;
1641
1642         ad.type = LSM_AUDIT_DATA_DENTRY;
1643         ad.u.dentry = dentry;
1644         return inode_has_perm(cred, inode, av, &ad);
1645 }
1646
1647 /* Same as inode_has_perm, but pass explicit audit data containing
1648    the path to help the auditing code to more easily generate the
1649    pathname if needed. */
1650 static inline int path_has_perm(const struct cred *cred,
1651                                 const struct path *path,
1652                                 u32 av)
1653 {
1654         struct inode *inode = d_backing_inode(path->dentry);
1655         struct common_audit_data ad;
1656
1657         ad.type = LSM_AUDIT_DATA_PATH;
1658         ad.u.path = *path;
1659         return inode_has_perm(cred, inode, av, &ad);
1660 }
1661
1662 /* Same as path_has_perm, but uses the inode from the file struct. */
1663 static inline int file_path_has_perm(const struct cred *cred,
1664                                      struct file *file,
1665                                      u32 av)
1666 {
1667         struct common_audit_data ad;
1668
1669         ad.type = LSM_AUDIT_DATA_PATH;
1670         ad.u.path = file->f_path;
1671         return inode_has_perm(cred, file_inode(file), av, &ad);
1672 }
1673
1674 /* Check whether a task can use an open file descriptor to
1675    access an inode in a given way.  Check access to the
1676    descriptor itself, and then use dentry_has_perm to
1677    check a particular permission to the file.
1678    Access to the descriptor is implicitly granted if it
1679    has the same SID as the process.  If av is zero, then
1680    access to the file is not checked, e.g. for cases
1681    where only the descriptor is affected like seek. */
1682 static int file_has_perm(const struct cred *cred,
1683                          struct file *file,
1684                          u32 av)
1685 {
1686         struct file_security_struct *fsec = file->f_security;
1687         struct inode *inode = file_inode(file);
1688         struct common_audit_data ad;
1689         u32 sid = cred_sid(cred);
1690         int rc;
1691
1692         ad.type = LSM_AUDIT_DATA_PATH;
1693         ad.u.path = file->f_path;
1694
1695         if (sid != fsec->sid) {
1696                 rc = avc_has_perm(sid, fsec->sid,
1697                                   SECCLASS_FD,
1698                                   FD__USE,
1699                                   &ad);
1700                 if (rc)
1701                         goto out;
1702         }
1703
1704         /* av is zero if only checking access to the descriptor. */
1705         rc = 0;
1706         if (av)
1707                 rc = inode_has_perm(cred, inode, av, &ad);
1708
1709 out:
1710         return rc;
1711 }
1712
1713 /*
1714  * Determine the label for an inode that might be unioned.
1715  */
1716 static int selinux_determine_inode_label(const struct inode *dir,
1717                                          const struct qstr *name,
1718                                          u16 tclass,
1719                                          u32 *_new_isid)
1720 {
1721         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1722         const struct inode_security_struct *dsec = dir->i_security;
1723         const struct task_security_struct *tsec = current_security();
1724
1725         if ((sbsec->flags & SE_SBINITIALIZED) &&
1726             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1727                 *_new_isid = sbsec->mntpoint_sid;
1728         } else if ((sbsec->flags & SBLABEL_MNT) &&
1729                    tsec->create_sid) {
1730                 *_new_isid = tsec->create_sid;
1731         } else {
1732                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1733                                                name, _new_isid);
1734         }
1735
1736         return 0;
1737 }
1738
1739 /* Check whether a task can create a file. */
1740 static int may_create(struct inode *dir,
1741                       struct dentry *dentry,
1742                       u16 tclass)
1743 {
1744         const struct task_security_struct *tsec = current_security();
1745         struct inode_security_struct *dsec;
1746         struct superblock_security_struct *sbsec;
1747         u32 sid, newsid;
1748         struct common_audit_data ad;
1749         int rc;
1750
1751         dsec = dir->i_security;
1752         sbsec = dir->i_sb->s_security;
1753
1754         sid = tsec->sid;
1755
1756         ad.type = LSM_AUDIT_DATA_DENTRY;
1757         ad.u.dentry = dentry;
1758
1759         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1760                           DIR__ADD_NAME | DIR__SEARCH,
1761                           &ad);
1762         if (rc)
1763                 return rc;
1764
1765         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1766                                            &newsid);
1767         if (rc)
1768                 return rc;
1769
1770         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1771         if (rc)
1772                 return rc;
1773
1774         return avc_has_perm(newsid, sbsec->sid,
1775                             SECCLASS_FILESYSTEM,
1776                             FILESYSTEM__ASSOCIATE, &ad);
1777 }
1778
1779 /* Check whether a task can create a key. */
1780 static int may_create_key(u32 ksid,
1781                           struct task_struct *ctx)
1782 {
1783         u32 sid = task_sid(ctx);
1784
1785         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1786 }
1787
1788 #define MAY_LINK        0
1789 #define MAY_UNLINK      1
1790 #define MAY_RMDIR       2
1791
1792 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1793 static int may_link(struct inode *dir,
1794                     struct dentry *dentry,
1795                     int kind)
1796
1797 {
1798         struct inode_security_struct *dsec, *isec;
1799         struct common_audit_data ad;
1800         u32 sid = current_sid();
1801         u32 av;
1802         int rc;
1803
1804         dsec = dir->i_security;
1805         isec = d_backing_inode(dentry)->i_security;
1806
1807         ad.type = LSM_AUDIT_DATA_DENTRY;
1808         ad.u.dentry = dentry;
1809
1810         av = DIR__SEARCH;
1811         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1812         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1813         if (rc)
1814                 return rc;
1815
1816         switch (kind) {
1817         case MAY_LINK:
1818                 av = FILE__LINK;
1819                 break;
1820         case MAY_UNLINK:
1821                 av = FILE__UNLINK;
1822                 break;
1823         case MAY_RMDIR:
1824                 av = DIR__RMDIR;
1825                 break;
1826         default:
1827                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1828                         __func__, kind);
1829                 return 0;
1830         }
1831
1832         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1833         return rc;
1834 }
1835
1836 static inline int may_rename(struct inode *old_dir,
1837                              struct dentry *old_dentry,
1838                              struct inode *new_dir,
1839                              struct dentry *new_dentry)
1840 {
1841         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1842         struct common_audit_data ad;
1843         u32 sid = current_sid();
1844         u32 av;
1845         int old_is_dir, new_is_dir;
1846         int rc;
1847
1848         old_dsec = old_dir->i_security;
1849         old_isec = d_backing_inode(old_dentry)->i_security;
1850         old_is_dir = d_is_dir(old_dentry);
1851         new_dsec = new_dir->i_security;
1852
1853         ad.type = LSM_AUDIT_DATA_DENTRY;
1854
1855         ad.u.dentry = old_dentry;
1856         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1857                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1858         if (rc)
1859                 return rc;
1860         rc = avc_has_perm(sid, old_isec->sid,
1861                           old_isec->sclass, FILE__RENAME, &ad);
1862         if (rc)
1863                 return rc;
1864         if (old_is_dir && new_dir != old_dir) {
1865                 rc = avc_has_perm(sid, old_isec->sid,
1866                                   old_isec->sclass, DIR__REPARENT, &ad);
1867                 if (rc)
1868                         return rc;
1869         }
1870
1871         ad.u.dentry = new_dentry;
1872         av = DIR__ADD_NAME | DIR__SEARCH;
1873         if (d_is_positive(new_dentry))
1874                 av |= DIR__REMOVE_NAME;
1875         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1876         if (rc)
1877                 return rc;
1878         if (d_is_positive(new_dentry)) {
1879                 new_isec = d_backing_inode(new_dentry)->i_security;
1880                 new_is_dir = d_is_dir(new_dentry);
1881                 rc = avc_has_perm(sid, new_isec->sid,
1882                                   new_isec->sclass,
1883                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1884                 if (rc)
1885                         return rc;
1886         }
1887
1888         return 0;
1889 }
1890
1891 /* Check whether a task can perform a filesystem operation. */
1892 static int superblock_has_perm(const struct cred *cred,
1893                                struct super_block *sb,
1894                                u32 perms,
1895                                struct common_audit_data *ad)
1896 {
1897         struct superblock_security_struct *sbsec;
1898         u32 sid = cred_sid(cred);
1899
1900         sbsec = sb->s_security;
1901         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1902 }
1903
1904 /* Convert a Linux mode and permission mask to an access vector. */
1905 static inline u32 file_mask_to_av(int mode, int mask)
1906 {
1907         u32 av = 0;
1908
1909         if (!S_ISDIR(mode)) {
1910                 if (mask & MAY_EXEC)
1911                         av |= FILE__EXECUTE;
1912                 if (mask & MAY_READ)
1913                         av |= FILE__READ;
1914
1915                 if (mask & MAY_APPEND)
1916                         av |= FILE__APPEND;
1917                 else if (mask & MAY_WRITE)
1918                         av |= FILE__WRITE;
1919
1920         } else {
1921                 if (mask & MAY_EXEC)
1922                         av |= DIR__SEARCH;
1923                 if (mask & MAY_WRITE)
1924                         av |= DIR__WRITE;
1925                 if (mask & MAY_READ)
1926                         av |= DIR__READ;
1927         }
1928
1929         return av;
1930 }
1931
1932 /* Convert a Linux file to an access vector. */
1933 static inline u32 file_to_av(struct file *file)
1934 {
1935         u32 av = 0;
1936
1937         if (file->f_mode & FMODE_READ)
1938                 av |= FILE__READ;
1939         if (file->f_mode & FMODE_WRITE) {
1940                 if (file->f_flags & O_APPEND)
1941                         av |= FILE__APPEND;
1942                 else
1943                         av |= FILE__WRITE;
1944         }
1945         if (!av) {
1946                 /*
1947                  * Special file opened with flags 3 for ioctl-only use.
1948                  */
1949                 av = FILE__IOCTL;
1950         }
1951
1952         return av;
1953 }
1954
1955 /*
1956  * Convert a file to an access vector and include the correct open
1957  * open permission.
1958  */
1959 static inline u32 open_file_to_av(struct file *file)
1960 {
1961         u32 av = file_to_av(file);
1962
1963         if (selinux_policycap_openperm)
1964                 av |= FILE__OPEN;
1965
1966         return av;
1967 }
1968
1969 /* Hook functions begin here. */
1970
1971 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1972 {
1973         u32 mysid = current_sid();
1974         u32 mgrsid = task_sid(mgr);
1975
1976         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1977                             BINDER__SET_CONTEXT_MGR, NULL);
1978 }
1979
1980 static int selinux_binder_transaction(struct task_struct *from,
1981                                       struct task_struct *to)
1982 {
1983         u32 mysid = current_sid();
1984         u32 fromsid = task_sid(from);
1985         u32 tosid = task_sid(to);
1986         int rc;
1987
1988         if (mysid != fromsid) {
1989                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1990                                   BINDER__IMPERSONATE, NULL);
1991                 if (rc)
1992                         return rc;
1993         }
1994
1995         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1996                             NULL);
1997 }
1998
1999 static int selinux_binder_transfer_binder(struct task_struct *from,
2000                                           struct task_struct *to)
2001 {
2002         u32 fromsid = task_sid(from);
2003         u32 tosid = task_sid(to);
2004
2005         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2006                             NULL);
2007 }
2008
2009 static int selinux_binder_transfer_file(struct task_struct *from,
2010                                         struct task_struct *to,
2011                                         struct file *file)
2012 {
2013         u32 sid = task_sid(to);
2014         struct file_security_struct *fsec = file->f_security;
2015         struct inode *inode = d_backing_inode(file->f_path.dentry);
2016         struct inode_security_struct *isec = inode->i_security;
2017         struct common_audit_data ad;
2018         int rc;
2019
2020         ad.type = LSM_AUDIT_DATA_PATH;
2021         ad.u.path = file->f_path;
2022
2023         if (sid != fsec->sid) {
2024                 rc = avc_has_perm(sid, fsec->sid,
2025                                   SECCLASS_FD,
2026                                   FD__USE,
2027                                   &ad);
2028                 if (rc)
2029                         return rc;
2030         }
2031
2032         if (unlikely(IS_PRIVATE(inode)))
2033                 return 0;
2034
2035         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2036                             &ad);
2037 }
2038
2039 static int selinux_ptrace_access_check(struct task_struct *child,
2040                                      unsigned int mode)
2041 {
2042         if (mode & PTRACE_MODE_READ) {
2043                 u32 sid = current_sid();
2044                 u32 csid = task_sid(child);
2045                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2046         }
2047
2048         return current_has_perm(child, PROCESS__PTRACE);
2049 }
2050
2051 static int selinux_ptrace_traceme(struct task_struct *parent)
2052 {
2053         return task_has_perm(parent, current, PROCESS__PTRACE);
2054 }
2055
2056 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2057                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2058 {
2059         return current_has_perm(target, PROCESS__GETCAP);
2060 }
2061
2062 static int selinux_capset(struct cred *new, const struct cred *old,
2063                           const kernel_cap_t *effective,
2064                           const kernel_cap_t *inheritable,
2065                           const kernel_cap_t *permitted)
2066 {
2067         return cred_has_perm(old, new, PROCESS__SETCAP);
2068 }
2069
2070 /*
2071  * (This comment used to live with the selinux_task_setuid hook,
2072  * which was removed).
2073  *
2074  * Since setuid only affects the current process, and since the SELinux
2075  * controls are not based on the Linux identity attributes, SELinux does not
2076  * need to control this operation.  However, SELinux does control the use of
2077  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2078  */
2079
2080 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2081                            int cap, int audit)
2082 {
2083         return cred_has_capability(cred, cap, audit);
2084 }
2085
2086 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2087 {
2088         const struct cred *cred = current_cred();
2089         int rc = 0;
2090
2091         if (!sb)
2092                 return 0;
2093
2094         switch (cmds) {
2095         case Q_SYNC:
2096         case Q_QUOTAON:
2097         case Q_QUOTAOFF:
2098         case Q_SETINFO:
2099         case Q_SETQUOTA:
2100                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2101                 break;
2102         case Q_GETFMT:
2103         case Q_GETINFO:
2104         case Q_GETQUOTA:
2105                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2106                 break;
2107         default:
2108                 rc = 0;  /* let the kernel handle invalid cmds */
2109                 break;
2110         }
2111         return rc;
2112 }
2113
2114 static int selinux_quota_on(struct dentry *dentry)
2115 {
2116         const struct cred *cred = current_cred();
2117
2118         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2119 }
2120
2121 static int selinux_syslog(int type)
2122 {
2123         int rc;
2124
2125         switch (type) {
2126         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2127         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2128                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2129                 break;
2130         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2131         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2132         /* Set level of messages printed to console */
2133         case SYSLOG_ACTION_CONSOLE_LEVEL:
2134                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2135                 break;
2136         case SYSLOG_ACTION_CLOSE:       /* Close log */
2137         case SYSLOG_ACTION_OPEN:        /* Open log */
2138         case SYSLOG_ACTION_READ:        /* Read from log */
2139         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2140         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2141         default:
2142                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2143                 break;
2144         }
2145         return rc;
2146 }
2147
2148 /*
2149  * Check that a process has enough memory to allocate a new virtual
2150  * mapping. 0 means there is enough memory for the allocation to
2151  * succeed and -ENOMEM implies there is not.
2152  *
2153  * Do not audit the selinux permission check, as this is applied to all
2154  * processes that allocate mappings.
2155  */
2156 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2157 {
2158         int rc, cap_sys_admin = 0;
2159
2160         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2161                                         SECURITY_CAP_NOAUDIT);
2162         if (rc == 0)
2163                 cap_sys_admin = 1;
2164
2165         return cap_sys_admin;
2166 }
2167
2168 /* binprm security operations */
2169
2170 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2171                             const struct task_security_struct *old_tsec,
2172                             const struct task_security_struct *new_tsec)
2173 {
2174         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2175         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2176         int rc;
2177
2178         if (!nnp && !nosuid)
2179                 return 0; /* neither NNP nor nosuid */
2180
2181         if (new_tsec->sid == old_tsec->sid)
2182                 return 0; /* No change in credentials */
2183
2184         /*
2185          * The only transitions we permit under NNP or nosuid
2186          * are transitions to bounded SIDs, i.e. SIDs that are
2187          * guaranteed to only be allowed a subset of the permissions
2188          * of the current SID.
2189          */
2190         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2191         if (rc) {
2192                 /*
2193                  * On failure, preserve the errno values for NNP vs nosuid.
2194                  * NNP:  Operation not permitted for caller.
2195                  * nosuid:  Permission denied to file.
2196                  */
2197                 if (nnp)
2198                         return -EPERM;
2199                 else
2200                         return -EACCES;
2201         }
2202         return 0;
2203 }
2204
2205 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2206 {
2207         const struct task_security_struct *old_tsec;
2208         struct task_security_struct *new_tsec;
2209         struct inode_security_struct *isec;
2210         struct common_audit_data ad;
2211         struct inode *inode = file_inode(bprm->file);
2212         int rc;
2213
2214         /* SELinux context only depends on initial program or script and not
2215          * the script interpreter */
2216         if (bprm->cred_prepared)
2217                 return 0;
2218
2219         old_tsec = current_security();
2220         new_tsec = bprm->cred->security;
2221         isec = inode->i_security;
2222
2223         /* Default to the current task SID. */
2224         new_tsec->sid = old_tsec->sid;
2225         new_tsec->osid = old_tsec->sid;
2226
2227         /* Reset fs, key, and sock SIDs on execve. */
2228         new_tsec->create_sid = 0;
2229         new_tsec->keycreate_sid = 0;
2230         new_tsec->sockcreate_sid = 0;
2231
2232         if (old_tsec->exec_sid) {
2233                 new_tsec->sid = old_tsec->exec_sid;
2234                 /* Reset exec SID on execve. */
2235                 new_tsec->exec_sid = 0;
2236
2237                 /* Fail on NNP or nosuid if not an allowed transition. */
2238                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2239                 if (rc)
2240                         return rc;
2241         } else {
2242                 /* Check for a default transition on this program. */
2243                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2244                                              SECCLASS_PROCESS, NULL,
2245                                              &new_tsec->sid);
2246                 if (rc)
2247                         return rc;
2248
2249                 /*
2250                  * Fallback to old SID on NNP or nosuid if not an allowed
2251                  * transition.
2252                  */
2253                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2254                 if (rc)
2255                         new_tsec->sid = old_tsec->sid;
2256         }
2257
2258         ad.type = LSM_AUDIT_DATA_PATH;
2259         ad.u.path = bprm->file->f_path;
2260
2261         if (new_tsec->sid == old_tsec->sid) {
2262                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2263                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2264                 if (rc)
2265                         return rc;
2266         } else {
2267                 /* Check permissions for the transition. */
2268                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2269                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2270                 if (rc)
2271                         return rc;
2272
2273                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2274                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2275                 if (rc)
2276                         return rc;
2277
2278                 /* Check for shared state */
2279                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2280                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2281                                           SECCLASS_PROCESS, PROCESS__SHARE,
2282                                           NULL);
2283                         if (rc)
2284                                 return -EPERM;
2285                 }
2286
2287                 /* Make sure that anyone attempting to ptrace over a task that
2288                  * changes its SID has the appropriate permit */
2289                 if (bprm->unsafe &
2290                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2291                         struct task_struct *tracer;
2292                         struct task_security_struct *sec;
2293                         u32 ptsid = 0;
2294
2295                         rcu_read_lock();
2296                         tracer = ptrace_parent(current);
2297                         if (likely(tracer != NULL)) {
2298                                 sec = __task_cred(tracer)->security;
2299                                 ptsid = sec->sid;
2300                         }
2301                         rcu_read_unlock();
2302
2303                         if (ptsid != 0) {
2304                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2305                                                   SECCLASS_PROCESS,
2306                                                   PROCESS__PTRACE, NULL);
2307                                 if (rc)
2308                                         return -EPERM;
2309                         }
2310                 }
2311
2312                 /* Clear any possibly unsafe personality bits on exec: */
2313                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2314         }
2315
2316         return 0;
2317 }
2318
2319 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2320 {
2321         const struct task_security_struct *tsec = current_security();
2322         u32 sid, osid;
2323         int atsecure = 0;
2324
2325         sid = tsec->sid;
2326         osid = tsec->osid;
2327
2328         if (osid != sid) {
2329                 /* Enable secure mode for SIDs transitions unless
2330                    the noatsecure permission is granted between
2331                    the two SIDs, i.e. ahp returns 0. */
2332                 atsecure = avc_has_perm(osid, sid,
2333                                         SECCLASS_PROCESS,
2334                                         PROCESS__NOATSECURE, NULL);
2335         }
2336
2337         return !!atsecure;
2338 }
2339
2340 static int match_file(const void *p, struct file *file, unsigned fd)
2341 {
2342         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2343 }
2344
2345 /* Derived from fs/exec.c:flush_old_files. */
2346 static inline void flush_unauthorized_files(const struct cred *cred,
2347                                             struct files_struct *files)
2348 {
2349         struct file *file, *devnull = NULL;
2350         struct tty_struct *tty;
2351         int drop_tty = 0;
2352         unsigned n;
2353
2354         tty = get_current_tty();
2355         if (tty) {
2356                 spin_lock(&tty_files_lock);
2357                 if (!list_empty(&tty->tty_files)) {
2358                         struct tty_file_private *file_priv;
2359
2360                         /* Revalidate access to controlling tty.
2361                            Use file_path_has_perm on the tty path directly
2362                            rather than using file_has_perm, as this particular
2363                            open file may belong to another process and we are
2364                            only interested in the inode-based check here. */
2365                         file_priv = list_first_entry(&tty->tty_files,
2366                                                 struct tty_file_private, list);
2367                         file = file_priv->file;
2368                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2369                                 drop_tty = 1;
2370                 }
2371                 spin_unlock(&tty_files_lock);
2372                 tty_kref_put(tty);
2373         }
2374         /* Reset controlling tty. */
2375         if (drop_tty)
2376                 no_tty();
2377
2378         /* Revalidate access to inherited open files. */
2379         n = iterate_fd(files, 0, match_file, cred);
2380         if (!n) /* none found? */
2381                 return;
2382
2383         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2384         if (IS_ERR(devnull))
2385                 devnull = NULL;
2386         /* replace all the matching ones with this */
2387         do {
2388                 replace_fd(n - 1, devnull, 0);
2389         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2390         if (devnull)
2391                 fput(devnull);
2392 }
2393
2394 /*
2395  * Prepare a process for imminent new credential changes due to exec
2396  */
2397 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2398 {
2399         struct task_security_struct *new_tsec;
2400         struct rlimit *rlim, *initrlim;
2401         int rc, i;
2402
2403         new_tsec = bprm->cred->security;
2404         if (new_tsec->sid == new_tsec->osid)
2405                 return;
2406
2407         /* Close files for which the new task SID is not authorized. */
2408         flush_unauthorized_files(bprm->cred, current->files);
2409
2410         /* Always clear parent death signal on SID transitions. */
2411         current->pdeath_signal = 0;
2412
2413         /* Check whether the new SID can inherit resource limits from the old
2414          * SID.  If not, reset all soft limits to the lower of the current
2415          * task's hard limit and the init task's soft limit.
2416          *
2417          * Note that the setting of hard limits (even to lower them) can be
2418          * controlled by the setrlimit check.  The inclusion of the init task's
2419          * soft limit into the computation is to avoid resetting soft limits
2420          * higher than the default soft limit for cases where the default is
2421          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2422          */
2423         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2424                           PROCESS__RLIMITINH, NULL);
2425         if (rc) {
2426                 /* protect against do_prlimit() */
2427                 task_lock(current);
2428                 for (i = 0; i < RLIM_NLIMITS; i++) {
2429                         rlim = current->signal->rlim + i;
2430                         initrlim = init_task.signal->rlim + i;
2431                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2432                 }
2433                 task_unlock(current);
2434                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2435         }
2436 }
2437
2438 /*
2439  * Clean up the process immediately after the installation of new credentials
2440  * due to exec
2441  */
2442 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2443 {
2444         const struct task_security_struct *tsec = current_security();
2445         struct itimerval itimer;
2446         u32 osid, sid;
2447         int rc, i;
2448
2449         osid = tsec->osid;
2450         sid = tsec->sid;
2451
2452         if (sid == osid)
2453                 return;
2454
2455         /* Check whether the new SID can inherit signal state from the old SID.
2456          * If not, clear itimers to avoid subsequent signal generation and
2457          * flush and unblock signals.
2458          *
2459          * This must occur _after_ the task SID has been updated so that any
2460          * kill done after the flush will be checked against the new SID.
2461          */
2462         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2463         if (rc) {
2464                 memset(&itimer, 0, sizeof itimer);
2465                 for (i = 0; i < 3; i++)
2466                         do_setitimer(i, &itimer, NULL);
2467                 spin_lock_irq(&current->sighand->siglock);
2468                 if (!fatal_signal_pending(current)) {
2469                         flush_sigqueue(&current->pending);
2470                         flush_sigqueue(&current->signal->shared_pending);
2471                         flush_signal_handlers(current, 1);
2472                         sigemptyset(&current->blocked);
2473                         recalc_sigpending();
2474                 }
2475                 spin_unlock_irq(&current->sighand->siglock);
2476         }
2477
2478         /* Wake up the parent if it is waiting so that it can recheck
2479          * wait permission to the new task SID. */
2480         read_lock(&tasklist_lock);
2481         __wake_up_parent(current, current->real_parent);
2482         read_unlock(&tasklist_lock);
2483 }
2484
2485 /* superblock security operations */
2486
2487 static int selinux_sb_alloc_security(struct super_block *sb)
2488 {
2489         return superblock_alloc_security(sb);
2490 }
2491
2492 static void selinux_sb_free_security(struct super_block *sb)
2493 {
2494         superblock_free_security(sb);
2495 }
2496
2497 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2498 {
2499         if (plen > olen)
2500                 return 0;
2501
2502         return !memcmp(prefix, option, plen);
2503 }
2504
2505 static inline int selinux_option(char *option, int len)
2506 {
2507         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2508                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2510                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2511                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2512 }
2513
2514 static inline void take_option(char **to, char *from, int *first, int len)
2515 {
2516         if (!*first) {
2517                 **to = ',';
2518                 *to += 1;
2519         } else
2520                 *first = 0;
2521         memcpy(*to, from, len);
2522         *to += len;
2523 }
2524
2525 static inline void take_selinux_option(char **to, char *from, int *first,
2526                                        int len)
2527 {
2528         int current_size = 0;
2529
2530         if (!*first) {
2531                 **to = '|';
2532                 *to += 1;
2533         } else
2534                 *first = 0;
2535
2536         while (current_size < len) {
2537                 if (*from != '"') {
2538                         **to = *from;
2539                         *to += 1;
2540                 }
2541                 from += 1;
2542                 current_size += 1;
2543         }
2544 }
2545
2546 static int selinux_sb_copy_data(char *orig, char *copy)
2547 {
2548         int fnosec, fsec, rc = 0;
2549         char *in_save, *in_curr, *in_end;
2550         char *sec_curr, *nosec_save, *nosec;
2551         int open_quote = 0;
2552
2553         in_curr = orig;
2554         sec_curr = copy;
2555
2556         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2557         if (!nosec) {
2558                 rc = -ENOMEM;
2559                 goto out;
2560         }
2561
2562         nosec_save = nosec;
2563         fnosec = fsec = 1;
2564         in_save = in_end = orig;
2565
2566         do {
2567                 if (*in_end == '"')
2568                         open_quote = !open_quote;
2569                 if ((*in_end == ',' && open_quote == 0) ||
2570                                 *in_end == '\0') {
2571                         int len = in_end - in_curr;
2572
2573                         if (selinux_option(in_curr, len))
2574                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2575                         else
2576                                 take_option(&nosec, in_curr, &fnosec, len);
2577
2578                         in_curr = in_end + 1;
2579                 }
2580         } while (*in_end++);
2581
2582         strcpy(in_save, nosec_save);
2583         free_page((unsigned long)nosec_save);
2584 out:
2585         return rc;
2586 }
2587
2588 static int selinux_sb_remount(struct super_block *sb, void *data)
2589 {
2590         int rc, i, *flags;
2591         struct security_mnt_opts opts;
2592         char *secdata, **mount_options;
2593         struct superblock_security_struct *sbsec = sb->s_security;
2594
2595         if (!(sbsec->flags & SE_SBINITIALIZED))
2596                 return 0;
2597
2598         if (!data)
2599                 return 0;
2600
2601         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2602                 return 0;
2603
2604         security_init_mnt_opts(&opts);
2605         secdata = alloc_secdata();
2606         if (!secdata)
2607                 return -ENOMEM;
2608         rc = selinux_sb_copy_data(data, secdata);
2609         if (rc)
2610                 goto out_free_secdata;
2611
2612         rc = selinux_parse_opts_str(secdata, &opts);
2613         if (rc)
2614                 goto out_free_secdata;
2615
2616         mount_options = opts.mnt_opts;
2617         flags = opts.mnt_opts_flags;
2618
2619         for (i = 0; i < opts.num_mnt_opts; i++) {
2620                 u32 sid;
2621
2622                 if (flags[i] == SBLABEL_MNT)
2623                         continue;
2624                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2625                 if (rc) {
2626                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2627                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2628                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2629                         goto out_free_opts;
2630                 }
2631                 rc = -EINVAL;
2632                 switch (flags[i]) {
2633                 case FSCONTEXT_MNT:
2634                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2635                                 goto out_bad_option;
2636                         break;
2637                 case CONTEXT_MNT:
2638                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2639                                 goto out_bad_option;
2640                         break;
2641                 case ROOTCONTEXT_MNT: {
2642                         struct inode_security_struct *root_isec;
2643                         root_isec = d_backing_inode(sb->s_root)->i_security;
2644
2645                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2646                                 goto out_bad_option;
2647                         break;
2648                 }
2649                 case DEFCONTEXT_MNT:
2650                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2651                                 goto out_bad_option;
2652                         break;
2653                 default:
2654                         goto out_free_opts;
2655                 }
2656         }
2657
2658         rc = 0;
2659 out_free_opts:
2660         security_free_mnt_opts(&opts);
2661 out_free_secdata:
2662         free_secdata(secdata);
2663         return rc;
2664 out_bad_option:
2665         printk(KERN_WARNING "SELinux: unable to change security options "
2666                "during remount (dev %s, type=%s)\n", sb->s_id,
2667                sb->s_type->name);
2668         goto out_free_opts;
2669 }
2670
2671 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2672 {
2673         const struct cred *cred = current_cred();
2674         struct common_audit_data ad;
2675         int rc;
2676
2677         rc = superblock_doinit(sb, data);
2678         if (rc)
2679                 return rc;
2680
2681         /* Allow all mounts performed by the kernel */
2682         if (flags & MS_KERNMOUNT)
2683                 return 0;
2684
2685         ad.type = LSM_AUDIT_DATA_DENTRY;
2686         ad.u.dentry = sb->s_root;
2687         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2688 }
2689
2690 static int selinux_sb_statfs(struct dentry *dentry)
2691 {
2692         const struct cred *cred = current_cred();
2693         struct common_audit_data ad;
2694
2695         ad.type = LSM_AUDIT_DATA_DENTRY;
2696         ad.u.dentry = dentry->d_sb->s_root;
2697         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2698 }
2699
2700 static int selinux_mount(const char *dev_name,
2701                          struct path *path,
2702                          const char *type,
2703                          unsigned long flags,
2704                          void *data)
2705 {
2706         const struct cred *cred = current_cred();
2707
2708         if (flags & MS_REMOUNT)
2709                 return superblock_has_perm(cred, path->dentry->d_sb,
2710                                            FILESYSTEM__REMOUNT, NULL);
2711         else
2712                 return path_has_perm(cred, path, FILE__MOUNTON);
2713 }
2714
2715 static int selinux_umount(struct vfsmount *mnt, int flags)
2716 {
2717         const struct cred *cred = current_cred();
2718
2719         return superblock_has_perm(cred, mnt->mnt_sb,
2720                                    FILESYSTEM__UNMOUNT, NULL);
2721 }
2722
2723 /* inode security operations */
2724
2725 static int selinux_inode_alloc_security(struct inode *inode)
2726 {
2727         return inode_alloc_security(inode);
2728 }
2729
2730 static void selinux_inode_free_security(struct inode *inode)
2731 {
2732         inode_free_security(inode);
2733 }
2734
2735 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2736                                         struct qstr *name, void **ctx,
2737                                         u32 *ctxlen)
2738 {
2739         u32 newsid;
2740         int rc;
2741
2742         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2743                                            inode_mode_to_security_class(mode),
2744                                            &newsid);
2745         if (rc)
2746                 return rc;
2747
2748         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2749 }
2750
2751 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2752                                        const struct qstr *qstr,
2753                                        const char **name,
2754                                        void **value, size_t *len)
2755 {
2756         const struct task_security_struct *tsec = current_security();
2757         struct inode_security_struct *dsec;
2758         struct superblock_security_struct *sbsec;
2759         u32 sid, newsid, clen;
2760         int rc;
2761         char *context;
2762
2763         dsec = dir->i_security;
2764         sbsec = dir->i_sb->s_security;
2765
2766         sid = tsec->sid;
2767         newsid = tsec->create_sid;
2768
2769         rc = selinux_determine_inode_label(
2770                 dir, qstr,
2771                 inode_mode_to_security_class(inode->i_mode),
2772                 &newsid);
2773         if (rc)
2774                 return rc;
2775
2776         /* Possibly defer initialization to selinux_complete_init. */
2777         if (sbsec->flags & SE_SBINITIALIZED) {
2778                 struct inode_security_struct *isec = inode->i_security;
2779                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2780                 isec->sid = newsid;
2781                 isec->initialized = 1;
2782         }
2783
2784         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2785                 return -EOPNOTSUPP;
2786
2787         if (name)
2788                 *name = XATTR_SELINUX_SUFFIX;
2789
2790         if (value && len) {
2791                 rc = security_sid_to_context_force(newsid, &context, &clen);
2792                 if (rc)
2793                         return rc;
2794                 *value = context;
2795                 *len = clen;
2796         }
2797
2798         return 0;
2799 }
2800
2801 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2802 {
2803         return may_create(dir, dentry, SECCLASS_FILE);
2804 }
2805
2806 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2807 {
2808         return may_link(dir, old_dentry, MAY_LINK);
2809 }
2810
2811 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2812 {
2813         return may_link(dir, dentry, MAY_UNLINK);
2814 }
2815
2816 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2817 {
2818         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2819 }
2820
2821 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2822 {
2823         return may_create(dir, dentry, SECCLASS_DIR);
2824 }
2825
2826 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2827 {
2828         return may_link(dir, dentry, MAY_RMDIR);
2829 }
2830
2831 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2832 {
2833         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2834 }
2835
2836 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2837                                 struct inode *new_inode, struct dentry *new_dentry)
2838 {
2839         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2840 }
2841
2842 static int selinux_inode_readlink(struct dentry *dentry)
2843 {
2844         const struct cred *cred = current_cred();
2845
2846         return dentry_has_perm(cred, dentry, FILE__READ);
2847 }
2848
2849 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2850                                      bool rcu)
2851 {
2852         const struct cred *cred = current_cred();
2853         struct common_audit_data ad;
2854         struct inode_security_struct *isec;
2855         u32 sid;
2856
2857         validate_creds(cred);
2858
2859         ad.type = LSM_AUDIT_DATA_DENTRY;
2860         ad.u.dentry = dentry;
2861         sid = cred_sid(cred);
2862         isec = inode->i_security;
2863
2864         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2865                                   rcu ? MAY_NOT_BLOCK : 0);
2866 }
2867
2868 static noinline int audit_inode_permission(struct inode *inode,
2869                                            u32 perms, u32 audited, u32 denied,
2870                                            int result,
2871                                            unsigned flags)
2872 {
2873         struct common_audit_data ad;
2874         struct inode_security_struct *isec = inode->i_security;
2875         int rc;
2876
2877         ad.type = LSM_AUDIT_DATA_INODE;
2878         ad.u.inode = inode;
2879
2880         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2881                             audited, denied, result, &ad, flags);
2882         if (rc)
2883                 return rc;
2884         return 0;
2885 }
2886
2887 static int selinux_inode_permission(struct inode *inode, int mask)
2888 {
2889         const struct cred *cred = current_cred();
2890         u32 perms;
2891         bool from_access;
2892         unsigned flags = mask & MAY_NOT_BLOCK;
2893         struct inode_security_struct *isec;
2894         u32 sid;
2895         struct av_decision avd;
2896         int rc, rc2;
2897         u32 audited, denied;
2898
2899         from_access = mask & MAY_ACCESS;
2900         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2901
2902         /* No permission to check.  Existence test. */
2903         if (!mask)
2904                 return 0;
2905
2906         validate_creds(cred);
2907
2908         if (unlikely(IS_PRIVATE(inode)))
2909                 return 0;
2910
2911         perms = file_mask_to_av(inode->i_mode, mask);
2912
2913         sid = cred_sid(cred);
2914         isec = inode->i_security;
2915
2916         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2917         audited = avc_audit_required(perms, &avd, rc,
2918                                      from_access ? FILE__AUDIT_ACCESS : 0,
2919                                      &denied);
2920         if (likely(!audited))
2921                 return rc;
2922
2923         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2924         if (rc2)
2925                 return rc2;
2926         return rc;
2927 }
2928
2929 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2930 {
2931         const struct cred *cred = current_cred();
2932         unsigned int ia_valid = iattr->ia_valid;
2933         __u32 av = FILE__WRITE;
2934
2935         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2936         if (ia_valid & ATTR_FORCE) {
2937                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2938                               ATTR_FORCE);
2939                 if (!ia_valid)
2940                         return 0;
2941         }
2942
2943         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2944                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2945                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2946
2947         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2948                         && !(ia_valid & ATTR_FILE))
2949                 av |= FILE__OPEN;
2950
2951         return dentry_has_perm(cred, dentry, av);
2952 }
2953
2954 static int selinux_inode_getattr(const struct path *path)
2955 {
2956         return path_has_perm(current_cred(), path, FILE__GETATTR);
2957 }
2958
2959 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2960 {
2961         const struct cred *cred = current_cred();
2962
2963         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2964                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2965                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2966                         if (!capable(CAP_SETFCAP))
2967                                 return -EPERM;
2968                 } else if (!capable(CAP_SYS_ADMIN)) {
2969                         /* A different attribute in the security namespace.
2970                            Restrict to administrator. */
2971                         return -EPERM;
2972                 }
2973         }
2974
2975         /* Not an attribute we recognize, so just check the
2976            ordinary setattr permission. */
2977         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2978 }
2979
2980 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2981                                   const void *value, size_t size, int flags)
2982 {
2983         struct inode *inode = d_backing_inode(dentry);
2984         struct inode_security_struct *isec = inode->i_security;
2985         struct superblock_security_struct *sbsec;
2986         struct common_audit_data ad;
2987         u32 newsid, sid = current_sid();
2988         int rc = 0;
2989
2990         if (strcmp(name, XATTR_NAME_SELINUX))
2991                 return selinux_inode_setotherxattr(dentry, name);
2992
2993         sbsec = inode->i_sb->s_security;
2994         if (!(sbsec->flags & SBLABEL_MNT))
2995                 return -EOPNOTSUPP;
2996
2997         if (!inode_owner_or_capable(inode))
2998                 return -EPERM;
2999
3000         ad.type = LSM_AUDIT_DATA_DENTRY;
3001         ad.u.dentry = dentry;
3002
3003         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3004                           FILE__RELABELFROM, &ad);
3005         if (rc)
3006                 return rc;
3007
3008         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3009         if (rc == -EINVAL) {
3010                 if (!capable(CAP_MAC_ADMIN)) {
3011                         struct audit_buffer *ab;
3012                         size_t audit_size;
3013                         const char *str;
3014
3015                         /* We strip a nul only if it is at the end, otherwise the
3016                          * context contains a nul and we should audit that */
3017                         if (value) {
3018                                 str = value;
3019                                 if (str[size - 1] == '\0')
3020                                         audit_size = size - 1;
3021                                 else
3022                                         audit_size = size;
3023                         } else {
3024                                 str = "";
3025                                 audit_size = 0;
3026                         }
3027                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3028                         audit_log_format(ab, "op=setxattr invalid_context=");
3029                         audit_log_n_untrustedstring(ab, value, audit_size);
3030                         audit_log_end(ab);
3031
3032                         return rc;
3033                 }
3034                 rc = security_context_to_sid_force(value, size, &newsid);
3035         }
3036         if (rc)
3037                 return rc;
3038
3039         rc = avc_has_perm(sid, newsid, isec->sclass,
3040                           FILE__RELABELTO, &ad);
3041         if (rc)
3042                 return rc;
3043
3044         rc = security_validate_transition(isec->sid, newsid, sid,
3045                                           isec->sclass);
3046         if (rc)
3047                 return rc;
3048
3049         return avc_has_perm(newsid,
3050                             sbsec->sid,
3051                             SECCLASS_FILESYSTEM,
3052                             FILESYSTEM__ASSOCIATE,
3053                             &ad);
3054 }
3055
3056 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3057                                         const void *value, size_t size,
3058                                         int flags)
3059 {
3060         struct inode *inode = d_backing_inode(dentry);
3061         struct inode_security_struct *isec = inode->i_security;
3062         u32 newsid;
3063         int rc;
3064
3065         if (strcmp(name, XATTR_NAME_SELINUX)) {
3066                 /* Not an attribute we recognize, so nothing to do. */
3067                 return;
3068         }
3069
3070         rc = security_context_to_sid_force(value, size, &newsid);
3071         if (rc) {
3072                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3073                        "for (%s, %lu), rc=%d\n",
3074                        inode->i_sb->s_id, inode->i_ino, -rc);
3075                 return;
3076         }
3077
3078         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3079         isec->sid = newsid;
3080         isec->initialized = 1;
3081
3082         return;
3083 }
3084
3085 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3086 {
3087         const struct cred *cred = current_cred();
3088
3089         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3090 }
3091
3092 static int selinux_inode_listxattr(struct dentry *dentry)
3093 {
3094         const struct cred *cred = current_cred();
3095
3096         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3097 }
3098
3099 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3100 {
3101         if (strcmp(name, XATTR_NAME_SELINUX))
3102                 return selinux_inode_setotherxattr(dentry, name);
3103
3104         /* No one is allowed to remove a SELinux security label.
3105            You can change the label, but all data must be labeled. */
3106         return -EACCES;
3107 }
3108
3109 /*
3110  * Copy the inode security context value to the user.
3111  *
3112  * Permission check is handled by selinux_inode_getxattr hook.
3113  */
3114 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3115 {
3116         u32 size;
3117         int error;
3118         char *context = NULL;
3119         struct inode_security_struct *isec = inode->i_security;
3120
3121         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3122                 return -EOPNOTSUPP;
3123
3124         /*
3125          * If the caller has CAP_MAC_ADMIN, then get the raw context
3126          * value even if it is not defined by current policy; otherwise,
3127          * use the in-core value under current policy.
3128          * Use the non-auditing forms of the permission checks since
3129          * getxattr may be called by unprivileged processes commonly
3130          * and lack of permission just means that we fall back to the
3131          * in-core context value, not a denial.
3132          */
3133         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3134                             SECURITY_CAP_NOAUDIT);
3135         if (!error)
3136                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3137                                             SECURITY_CAP_NOAUDIT);
3138         if (!error)
3139                 error = security_sid_to_context_force(isec->sid, &context,
3140                                                       &size);
3141         else
3142                 error = security_sid_to_context(isec->sid, &context, &size);
3143         if (error)
3144                 return error;
3145         error = size;
3146         if (alloc) {
3147                 *buffer = context;
3148                 goto out_nofree;
3149         }
3150         kfree(context);
3151 out_nofree:
3152         return error;
3153 }
3154
3155 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3156                                      const void *value, size_t size, int flags)
3157 {
3158         struct inode_security_struct *isec = inode->i_security;
3159         u32 newsid;
3160         int rc;
3161
3162         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3163                 return -EOPNOTSUPP;
3164
3165         if (!value || !size)
3166                 return -EACCES;
3167
3168         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3169         if (rc)
3170                 return rc;
3171
3172         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3173         isec->sid = newsid;
3174         isec->initialized = 1;
3175         return 0;
3176 }
3177
3178 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3179 {
3180         const int len = sizeof(XATTR_NAME_SELINUX);
3181         if (buffer && len <= buffer_size)
3182                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3183         return len;
3184 }
3185
3186 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3187 {
3188         struct inode_security_struct *isec = inode->i_security;
3189         *secid = isec->sid;
3190 }
3191
3192 /* file security operations */
3193
3194 static int selinux_revalidate_file_permission(struct file *file, int mask)
3195 {
3196         const struct cred *cred = current_cred();
3197         struct inode *inode = file_inode(file);
3198
3199         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3200         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3201                 mask |= MAY_APPEND;
3202
3203         return file_has_perm(cred, file,
3204                              file_mask_to_av(inode->i_mode, mask));
3205 }
3206
3207 static int selinux_file_permission(struct file *file, int mask)
3208 {
3209         struct inode *inode = file_inode(file);
3210         struct file_security_struct *fsec = file->f_security;
3211         struct inode_security_struct *isec = inode->i_security;
3212         u32 sid = current_sid();
3213
3214         if (!mask)
3215                 /* No permission to check.  Existence test. */
3216                 return 0;
3217
3218         if (sid == fsec->sid && fsec->isid == isec->sid &&
3219             fsec->pseqno == avc_policy_seqno())
3220                 /* No change since file_open check. */
3221                 return 0;
3222
3223         return selinux_revalidate_file_permission(file, mask);
3224 }
3225
3226 static int selinux_file_alloc_security(struct file *file)
3227 {
3228         return file_alloc_security(file);
3229 }
3230
3231 static void selinux_file_free_security(struct file *file)
3232 {
3233         file_free_security(file);
3234 }
3235
3236 /*
3237  * Check whether a task has the ioctl permission and cmd
3238  * operation to an inode.
3239  */
3240 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3241                 u32 requested, u16 cmd)
3242 {
3243         struct common_audit_data ad;
3244         struct file_security_struct *fsec = file->f_security;
3245         struct inode *inode = file_inode(file);
3246         struct inode_security_struct *isec = inode->i_security;
3247         struct lsm_ioctlop_audit ioctl;
3248         u32 ssid = cred_sid(cred);
3249         int rc;
3250         u8 driver = cmd >> 8;
3251         u8 xperm = cmd & 0xff;
3252
3253         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3254         ad.u.op = &ioctl;
3255         ad.u.op->cmd = cmd;
3256         ad.u.op->path = file->f_path;
3257
3258         if (ssid != fsec->sid) {
3259                 rc = avc_has_perm(ssid, fsec->sid,
3260                                 SECCLASS_FD,
3261                                 FD__USE,
3262                                 &ad);
3263                 if (rc)
3264                         goto out;
3265         }
3266
3267         if (unlikely(IS_PRIVATE(inode)))
3268                 return 0;
3269
3270         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3271                         requested, driver, xperm, &ad);
3272 out:
3273         return rc;
3274 }
3275
3276 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3277                               unsigned long arg)
3278 {
3279         const struct cred *cred = current_cred();
3280         int error = 0;
3281
3282         switch (cmd) {
3283         case FIONREAD:
3284         /* fall through */
3285         case FIBMAP:
3286         /* fall through */
3287         case FIGETBSZ:
3288         /* fall through */
3289         case FS_IOC_GETFLAGS:
3290         /* fall through */
3291         case FS_IOC_GETVERSION:
3292                 error = file_has_perm(cred, file, FILE__GETATTR);
3293                 break;
3294
3295         case FS_IOC_SETFLAGS:
3296         /* fall through */
3297         case FS_IOC_SETVERSION:
3298                 error = file_has_perm(cred, file, FILE__SETATTR);
3299                 break;
3300
3301         /* sys_ioctl() checks */
3302         case FIONBIO:
3303         /* fall through */
3304         case FIOASYNC:
3305                 error = file_has_perm(cred, file, 0);
3306                 break;
3307
3308         case KDSKBENT:
3309         case KDSKBSENT:
3310                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3311                                             SECURITY_CAP_AUDIT);
3312                 break;
3313
3314         /* default case assumes that the command will go
3315          * to the file's ioctl() function.
3316          */
3317         default:
3318                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3319         }
3320         return error;
3321 }
3322
3323 static int default_noexec;
3324
3325 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3326 {
3327         const struct cred *cred = current_cred();
3328         int rc = 0;
3329
3330         if (default_noexec &&
3331             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3332                                    (!shared && (prot & PROT_WRITE)))) {
3333                 /*
3334                  * We are making executable an anonymous mapping or a
3335                  * private file mapping that will also be writable.
3336                  * This has an additional check.
3337                  */
3338                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3339                 if (rc)
3340                         goto error;
3341         }
3342
3343         if (file) {
3344                 /* read access is always possible with a mapping */
3345                 u32 av = FILE__READ;
3346
3347                 /* write access only matters if the mapping is shared */
3348                 if (shared && (prot & PROT_WRITE))
3349                         av |= FILE__WRITE;
3350
3351                 if (prot & PROT_EXEC)
3352                         av |= FILE__EXECUTE;
3353
3354                 return file_has_perm(cred, file, av);
3355         }
3356
3357 error:
3358         return rc;
3359 }
3360
3361 static int selinux_mmap_addr(unsigned long addr)
3362 {
3363         int rc = 0;
3364
3365         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3366                 u32 sid = current_sid();
3367                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3368                                   MEMPROTECT__MMAP_ZERO, NULL);
3369         }
3370
3371         return rc;
3372 }
3373
3374 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3375                              unsigned long prot, unsigned long flags)
3376 {
3377         if (selinux_checkreqprot)
3378                 prot = reqprot;
3379
3380         return file_map_prot_check(file, prot,
3381                                    (flags & MAP_TYPE) == MAP_SHARED);
3382 }
3383
3384 static int selinux_file_mprotect(struct vm_area_struct *vma,
3385                                  unsigned long reqprot,
3386                                  unsigned long prot)
3387 {
3388         const struct cred *cred = current_cred();
3389
3390         if (selinux_checkreqprot)
3391                 prot = reqprot;
3392
3393         if (default_noexec &&
3394             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3395                 int rc = 0;
3396                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3397                     vma->vm_end <= vma->vm_mm->brk) {
3398                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3399                 } else if (!vma->vm_file &&
3400                            vma->vm_start <= vma->vm_mm->start_stack &&
3401                            vma->vm_end >= vma->vm_mm->start_stack) {
3402                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3403                 } else if (vma->vm_file && vma->anon_vma) {
3404                         /*
3405                          * We are making executable a file mapping that has
3406                          * had some COW done. Since pages might have been
3407                          * written, check ability to execute the possibly
3408                          * modified content.  This typically should only
3409                          * occur for text relocations.
3410                          */
3411                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3412                 }
3413                 if (rc)
3414                         return rc;
3415         }
3416
3417         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3418 }
3419
3420 static int selinux_file_lock(struct file *file, unsigned int cmd)
3421 {
3422         const struct cred *cred = current_cred();
3423
3424         return file_has_perm(cred, file, FILE__LOCK);
3425 }
3426
3427 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3428                               unsigned long arg)
3429 {
3430         const struct cred *cred = current_cred();
3431         int err = 0;
3432
3433         switch (cmd) {
3434         case F_SETFL:
3435                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3436                         err = file_has_perm(cred, file, FILE__WRITE);
3437                         break;
3438                 }
3439                 /* fall through */
3440         case F_SETOWN:
3441         case F_SETSIG:
3442         case F_GETFL:
3443         case F_GETOWN:
3444         case F_GETSIG:
3445         case F_GETOWNER_UIDS:
3446                 /* Just check FD__USE permission */
3447                 err = file_has_perm(cred, file, 0);
3448                 break;
3449         case F_GETLK:
3450         case F_SETLK:
3451         case F_SETLKW:
3452         case F_OFD_GETLK:
3453         case F_OFD_SETLK:
3454         case F_OFD_SETLKW:
3455 #if BITS_PER_LONG == 32
3456         case F_GETLK64:
3457         case F_SETLK64:
3458         case F_SETLKW64:
3459 #endif
3460                 err = file_has_perm(cred, file, FILE__LOCK);
3461                 break;
3462         }
3463
3464         return err;
3465 }
3466
3467 static void selinux_file_set_fowner(struct file *file)
3468 {
3469         struct file_security_struct *fsec;
3470
3471         fsec = file->f_security;
3472         fsec->fown_sid = current_sid();
3473 }
3474
3475 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3476                                        struct fown_struct *fown, int signum)
3477 {
3478         struct file *file;
3479         u32 sid = task_sid(tsk);
3480         u32 perm;
3481         struct file_security_struct *fsec;
3482
3483         /* struct fown_struct is never outside the context of a struct file */
3484         file = container_of(fown, struct file, f_owner);
3485
3486         fsec = file->f_security;
3487
3488         if (!signum)
3489                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3490         else
3491                 perm = signal_to_av(signum);
3492
3493         return avc_has_perm(fsec->fown_sid, sid,
3494                             SECCLASS_PROCESS, perm, NULL);
3495 }
3496
3497 static int selinux_file_receive(struct file *file)
3498 {
3499         const struct cred *cred = current_cred();
3500
3501         return file_has_perm(cred, file, file_to_av(file));
3502 }
3503
3504 static int selinux_file_open(struct file *file, const struct cred *cred)
3505 {
3506         struct file_security_struct *fsec;
3507         struct inode_security_struct *isec;
3508
3509         fsec = file->f_security;
3510         isec = file_inode(file)->i_security;
3511         /*
3512          * Save inode label and policy sequence number
3513          * at open-time so that selinux_file_permission
3514          * can determine whether revalidation is necessary.
3515          * Task label is already saved in the file security
3516          * struct as its SID.
3517          */
3518         fsec->isid = isec->sid;
3519         fsec->pseqno = avc_policy_seqno();
3520         /*
3521          * Since the inode label or policy seqno may have changed
3522          * between the selinux_inode_permission check and the saving
3523          * of state above, recheck that access is still permitted.
3524          * Otherwise, access might never be revalidated against the
3525          * new inode label or new policy.
3526          * This check is not redundant - do not remove.
3527          */
3528         return file_path_has_perm(cred, file, open_file_to_av(file));
3529 }
3530
3531 /* task security operations */
3532
3533 static int selinux_task_create(unsigned long clone_flags)
3534 {
3535         return current_has_perm(current, PROCESS__FORK);
3536 }
3537
3538 /*
3539  * allocate the SELinux part of blank credentials
3540  */
3541 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3542 {
3543         struct task_security_struct *tsec;
3544
3545         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3546         if (!tsec)
3547                 return -ENOMEM;
3548
3549         cred->security = tsec;
3550         return 0;
3551 }
3552
3553 /*
3554  * detach and free the LSM part of a set of credentials
3555  */
3556 static void selinux_cred_free(struct cred *cred)
3557 {
3558         struct task_security_struct *tsec = cred->security;
3559
3560         /*
3561          * cred->security == NULL if security_cred_alloc_blank() or
3562          * security_prepare_creds() returned an error.
3563          */
3564         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3565         cred->security = (void *) 0x7UL;
3566         kfree(tsec);
3567 }
3568
3569 /*
3570  * prepare a new set of credentials for modification
3571  */
3572 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3573                                 gfp_t gfp)
3574 {
3575         const struct task_security_struct *old_tsec;
3576         struct task_security_struct *tsec;
3577
3578         old_tsec = old->security;
3579
3580         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3581         if (!tsec)
3582                 return -ENOMEM;
3583
3584         new->security = tsec;
3585         return 0;
3586 }
3587
3588 /*
3589  * transfer the SELinux data to a blank set of creds
3590  */
3591 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3592 {
3593         const struct task_security_struct *old_tsec = old->security;
3594         struct task_security_struct *tsec = new->security;
3595
3596         *tsec = *old_tsec;
3597 }
3598
3599 /*
3600  * set the security data for a kernel service
3601  * - all the creation contexts are set to unlabelled
3602  */
3603 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3604 {
3605         struct task_security_struct *tsec = new->security;
3606         u32 sid = current_sid();
3607         int ret;
3608
3609         ret = avc_has_perm(sid, secid,
3610                            SECCLASS_KERNEL_SERVICE,
3611                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3612                            NULL);
3613         if (ret == 0) {
3614                 tsec->sid = secid;
3615                 tsec->create_sid = 0;
3616                 tsec->keycreate_sid = 0;
3617                 tsec->sockcreate_sid = 0;
3618         }
3619         return ret;
3620 }
3621
3622 /*
3623  * set the file creation context in a security record to the same as the
3624  * objective context of the specified inode
3625  */
3626 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3627 {
3628         struct inode_security_struct *isec = inode->i_security;
3629         struct task_security_struct *tsec = new->security;
3630         u32 sid = current_sid();
3631         int ret;
3632
3633         ret = avc_has_perm(sid, isec->sid,
3634                            SECCLASS_KERNEL_SERVICE,
3635                            KERNEL_SERVICE__CREATE_FILES_AS,
3636                            NULL);
3637
3638         if (ret == 0)
3639                 tsec->create_sid = isec->sid;
3640         return ret;
3641 }
3642
3643 static int selinux_kernel_module_request(char *kmod_name)
3644 {
3645         u32 sid;
3646         struct common_audit_data ad;
3647
3648         sid = task_sid(current);
3649
3650         ad.type = LSM_AUDIT_DATA_KMOD;
3651         ad.u.kmod_name = kmod_name;
3652
3653         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3654                             SYSTEM__MODULE_REQUEST, &ad);
3655 }
3656
3657 static int selinux_kernel_module_from_file(struct file *file)
3658 {
3659         struct common_audit_data ad;
3660         struct inode_security_struct *isec;
3661         struct file_security_struct *fsec;
3662         struct inode *inode;
3663         u32 sid = current_sid();
3664         int rc;
3665
3666         /* init_module */
3667         if (file == NULL)
3668                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3669                                         SYSTEM__MODULE_LOAD, NULL);
3670
3671         /* finit_module */
3672         ad.type = LSM_AUDIT_DATA_PATH;
3673         ad.u.path = file->f_path;
3674
3675         inode = file_inode(file);
3676         isec = inode->i_security;
3677         fsec = file->f_security;
3678
3679         if (sid != fsec->sid) {
3680                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3681                 if (rc)
3682                         return rc;
3683         }
3684
3685         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3686                                 SYSTEM__MODULE_LOAD, &ad);
3687 }
3688
3689 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3690 {
3691         return current_has_perm(p, PROCESS__SETPGID);
3692 }
3693
3694 static int selinux_task_getpgid(struct task_struct *p)
3695 {
3696         return current_has_perm(p, PROCESS__GETPGID);
3697 }
3698
3699 static int selinux_task_getsid(struct task_struct *p)
3700 {
3701         return current_has_perm(p, PROCESS__GETSESSION);
3702 }
3703
3704 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3705 {
3706         *secid = task_sid(p);
3707 }
3708
3709 static int selinux_task_setnice(struct task_struct *p, int nice)
3710 {
3711         return current_has_perm(p, PROCESS__SETSCHED);
3712 }
3713
3714 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3715 {
3716         return current_has_perm(p, PROCESS__SETSCHED);
3717 }
3718
3719 static int selinux_task_getioprio(struct task_struct *p)
3720 {
3721         return current_has_perm(p, PROCESS__GETSCHED);
3722 }
3723
3724 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3725                 struct rlimit *new_rlim)
3726 {
3727         struct rlimit *old_rlim = p->signal->rlim + resource;
3728
3729         /* Control the ability to change the hard limit (whether
3730            lowering or raising it), so that the hard limit can
3731            later be used as a safe reset point for the soft limit
3732            upon context transitions.  See selinux_bprm_committing_creds. */
3733         if (old_rlim->rlim_max != new_rlim->rlim_max)
3734                 return current_has_perm(p, PROCESS__SETRLIMIT);
3735
3736         return 0;
3737 }
3738
3739 static int selinux_task_setscheduler(struct task_struct *p)
3740 {
3741         return current_has_perm(p, PROCESS__SETSCHED);
3742 }
3743
3744 static int selinux_task_getscheduler(struct task_struct *p)
3745 {
3746         return current_has_perm(p, PROCESS__GETSCHED);
3747 }
3748
3749 static int selinux_task_movememory(struct task_struct *p)
3750 {
3751         return current_has_perm(p, PROCESS__SETSCHED);
3752 }
3753
3754 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3755                                 int sig, u32 secid)
3756 {
3757         u32 perm;
3758         int rc;
3759
3760         if (!sig)
3761                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3762         else
3763                 perm = signal_to_av(sig);
3764         if (secid)
3765                 rc = avc_has_perm(secid, task_sid(p),
3766                                   SECCLASS_PROCESS, perm, NULL);
3767         else
3768                 rc = current_has_perm(p, perm);
3769         return rc;
3770 }
3771
3772 static int selinux_task_wait(struct task_struct *p)
3773 {
3774         return task_has_perm(p, current, PROCESS__SIGCHLD);
3775 }
3776
3777 static void selinux_task_to_inode(struct task_struct *p,
3778                                   struct inode *inode)
3779 {
3780         struct inode_security_struct *isec = inode->i_security;
3781         u32 sid = task_sid(p);
3782
3783         isec->sid = sid;
3784         isec->initialized = 1;
3785 }
3786
3787 /* Returns error only if unable to parse addresses */
3788 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3789                         struct common_audit_data *ad, u8 *proto)
3790 {
3791         int offset, ihlen, ret = -EINVAL;
3792         struct iphdr _iph, *ih;
3793
3794         offset = skb_network_offset(skb);
3795         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3796         if (ih == NULL)
3797                 goto out;
3798
3799         ihlen = ih->ihl * 4;
3800         if (ihlen < sizeof(_iph))
3801                 goto out;
3802
3803         ad->u.net->v4info.saddr = ih->saddr;
3804         ad->u.net->v4info.daddr = ih->daddr;
3805         ret = 0;
3806
3807         if (proto)
3808                 *proto = ih->protocol;
3809
3810         switch (ih->protocol) {
3811         case IPPROTO_TCP: {
3812                 struct tcphdr _tcph, *th;
3813
3814                 if (ntohs(ih->frag_off) & IP_OFFSET)
3815                         break;
3816
3817                 offset += ihlen;
3818                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3819                 if (th == NULL)
3820                         break;
3821
3822                 ad->u.net->sport = th->source;
3823                 ad->u.net->dport = th->dest;
3824                 break;
3825         }
3826
3827         case IPPROTO_UDP: {
3828                 struct udphdr _udph, *uh;
3829
3830                 if (ntohs(ih->frag_off) & IP_OFFSET)
3831                         break;
3832
3833                 offset += ihlen;
3834                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3835                 if (uh == NULL)
3836                         break;
3837
3838                 ad->u.net->sport = uh->source;
3839                 ad->u.net->dport = uh->dest;
3840                 break;
3841         }
3842
3843         case IPPROTO_DCCP: {
3844                 struct dccp_hdr _dccph, *dh;
3845
3846                 if (ntohs(ih->frag_off) & IP_OFFSET)
3847                         break;
3848
3849                 offset += ihlen;
3850                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3851                 if (dh == NULL)
3852                         break;
3853
3854                 ad->u.net->sport = dh->dccph_sport;
3855                 ad->u.net->dport = dh->dccph_dport;
3856                 break;
3857         }
3858
3859         default:
3860                 break;
3861         }
3862 out:
3863         return ret;
3864 }
3865
3866 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3867
3868 /* Returns error only if unable to parse addresses */
3869 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3870                         struct common_audit_data *ad, u8 *proto)
3871 {
3872         u8 nexthdr;
3873         int ret = -EINVAL, offset;
3874         struct ipv6hdr _ipv6h, *ip6;
3875         __be16 frag_off;
3876
3877         offset = skb_network_offset(skb);
3878         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3879         if (ip6 == NULL)
3880                 goto out;
3881
3882         ad->u.net->v6info.saddr = ip6->saddr;
3883         ad->u.net->v6info.daddr = ip6->daddr;
3884         ret = 0;
3885
3886         nexthdr = ip6->nexthdr;
3887         offset += sizeof(_ipv6h);
3888         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3889         if (offset < 0)
3890                 goto out;
3891
3892         if (proto)
3893                 *proto = nexthdr;
3894
3895         switch (nexthdr) {
3896         case IPPROTO_TCP: {
3897                 struct tcphdr _tcph, *th;
3898
3899                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3900                 if (th == NULL)
3901                         break;
3902
3903                 ad->u.net->sport = th->source;
3904                 ad->u.net->dport = th->dest;
3905                 break;
3906         }
3907
3908         case IPPROTO_UDP: {
3909                 struct udphdr _udph, *uh;
3910
3911                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3912                 if (uh == NULL)
3913                         break;
3914
3915                 ad->u.net->sport = uh->source;
3916                 ad->u.net->dport = uh->dest;
3917                 break;
3918         }
3919
3920         case IPPROTO_DCCP: {
3921                 struct dccp_hdr _dccph, *dh;
3922
3923                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3924                 if (dh == NULL)
3925                         break;
3926
3927                 ad->u.net->sport = dh->dccph_sport;
3928                 ad->u.net->dport = dh->dccph_dport;
3929                 break;
3930         }
3931
3932         /* includes fragments */
3933         default:
3934                 break;
3935         }
3936 out:
3937         return ret;
3938 }
3939
3940 #endif /* IPV6 */
3941
3942 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3943                              char **_addrp, int src, u8 *proto)
3944 {
3945         char *addrp;
3946         int ret;
3947
3948         switch (ad->u.net->family) {
3949         case PF_INET:
3950                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3951                 if (ret)
3952                         goto parse_error;
3953                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3954                                        &ad->u.net->v4info.daddr);
3955                 goto okay;
3956
3957 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3958         case PF_INET6:
3959                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3960                 if (ret)
3961                         goto parse_error;
3962                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3963                                        &ad->u.net->v6info.daddr);
3964                 goto okay;
3965 #endif  /* IPV6 */
3966         default:
3967                 addrp = NULL;
3968                 goto okay;
3969         }
3970
3971 parse_error:
3972         printk(KERN_WARNING
3973                "SELinux: failure in selinux_parse_skb(),"
3974                " unable to parse packet\n");
3975         return ret;
3976
3977 okay:
3978         if (_addrp)
3979                 *_addrp = addrp;
3980         return 0;
3981 }
3982
3983 /**
3984  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3985  * @skb: the packet
3986  * @family: protocol family
3987  * @sid: the packet's peer label SID
3988  *
3989  * Description:
3990  * Check the various different forms of network peer labeling and determine
3991  * the peer label/SID for the packet; most of the magic actually occurs in
3992  * the security server function security_net_peersid_cmp().  The function
3993  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3994  * or -EACCES if @sid is invalid due to inconsistencies with the different
3995  * peer labels.
3996  *
3997  */
3998 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3999 {
4000         int err;
4001         u32 xfrm_sid;
4002         u32 nlbl_sid;
4003         u32 nlbl_type;
4004
4005         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4006         if (unlikely(err))
4007                 return -EACCES;
4008         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4009         if (unlikely(err))
4010                 return -EACCES;
4011
4012         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4013         if (unlikely(err)) {
4014                 printk(KERN_WARNING
4015                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4016                        " unable to determine packet's peer label\n");
4017                 return -EACCES;
4018         }
4019
4020         return 0;
4021 }
4022
4023 /**
4024  * selinux_conn_sid - Determine the child socket label for a connection
4025  * @sk_sid: the parent socket's SID
4026  * @skb_sid: the packet's SID
4027  * @conn_sid: the resulting connection SID
4028  *
4029  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4030  * combined with the MLS information from @skb_sid in order to create
4031  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4032  * of @sk_sid.  Returns zero on success, negative values on failure.
4033  *
4034  */
4035 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4036 {
4037         int err = 0;
4038
4039         if (skb_sid != SECSID_NULL)
4040                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4041         else
4042                 *conn_sid = sk_sid;
4043
4044         return err;
4045 }
4046
4047 /* socket security operations */
4048
4049 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4050                                  u16 secclass, u32 *socksid)
4051 {
4052         if (tsec->sockcreate_sid > SECSID_NULL) {
4053                 *socksid = tsec->sockcreate_sid;
4054                 return 0;
4055         }
4056
4057         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4058                                        socksid);
4059 }
4060
4061 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4062 {
4063         struct sk_security_struct *sksec = sk->sk_security;
4064         struct common_audit_data ad;
4065         struct lsm_network_audit net = {0,};
4066         u32 tsid = task_sid(task);
4067
4068         if (sksec->sid == SECINITSID_KERNEL)
4069                 return 0;
4070
4071         ad.type = LSM_AUDIT_DATA_NET;
4072         ad.u.net = &net;
4073         ad.u.net->sk = sk;
4074
4075         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4076 }
4077
4078 static int selinux_socket_create(int family, int type,
4079                                  int protocol, int kern)
4080 {
4081         const struct task_security_struct *tsec = current_security();
4082         u32 newsid;
4083         u16 secclass;
4084         int rc;
4085
4086         if (kern)
4087                 return 0;
4088
4089         secclass = socket_type_to_security_class(family, type, protocol);
4090         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4091         if (rc)
4092                 return rc;
4093
4094         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4095 }
4096
4097 static int selinux_socket_post_create(struct socket *sock, int family,
4098                                       int type, int protocol, int kern)
4099 {
4100         const struct task_security_struct *tsec = current_security();
4101         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4102         struct sk_security_struct *sksec;
4103         int err = 0;
4104
4105         isec->sclass = socket_type_to_security_class(family, type, protocol);
4106
4107         if (kern)
4108                 isec->sid = SECINITSID_KERNEL;
4109         else {
4110                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4111                 if (err)
4112                         return err;
4113         }
4114
4115         isec->initialized = 1;
4116
4117         if (sock->sk) {
4118                 sksec = sock->sk->sk_security;
4119                 sksec->sid = isec->sid;
4120                 sksec->sclass = isec->sclass;
4121                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4122         }
4123
4124         return err;
4125 }
4126
4127 /* Range of port numbers used to automatically bind.
4128    Need to determine whether we should perform a name_bind
4129    permission check between the socket and the port number. */
4130
4131 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4132 {
4133         struct sock *sk = sock->sk;
4134         u16 family;
4135         int err;
4136
4137         err = sock_has_perm(current, sk, SOCKET__BIND);
4138         if (err)
4139                 goto out;
4140
4141         /*
4142          * If PF_INET or PF_INET6, check name_bind permission for the port.
4143          * Multiple address binding for SCTP is not supported yet: we just
4144          * check the first address now.
4145          */
4146         family = sk->sk_family;
4147         if (family == PF_INET || family == PF_INET6) {
4148                 char *addrp;
4149                 struct sk_security_struct *sksec = sk->sk_security;
4150                 struct common_audit_data ad;
4151                 struct lsm_network_audit net = {0,};
4152                 struct sockaddr_in *addr4 = NULL;
4153                 struct sockaddr_in6 *addr6 = NULL;
4154                 unsigned short snum;
4155                 u32 sid, node_perm;
4156
4157                 if (family == PF_INET) {
4158                         addr4 = (struct sockaddr_in *)address;
4159                         snum = ntohs(addr4->sin_port);
4160                         addrp = (char *)&addr4->sin_addr.s_addr;
4161                 } else {
4162                         addr6 = (struct sockaddr_in6 *)address;
4163                         snum = ntohs(addr6->sin6_port);
4164                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4165                 }
4166
4167                 if (snum) {
4168                         int low, high;
4169
4170                         inet_get_local_port_range(sock_net(sk), &low, &high);
4171
4172                         if (snum < max(PROT_SOCK, low) || snum > high) {
4173                                 err = sel_netport_sid(sk->sk_protocol,
4174                                                       snum, &sid);
4175                                 if (err)
4176                                         goto out;
4177                                 ad.type = LSM_AUDIT_DATA_NET;
4178                                 ad.u.net = &net;
4179                                 ad.u.net->sport = htons(snum);
4180                                 ad.u.net->family = family;
4181                                 err = avc_has_perm(sksec->sid, sid,
4182                                                    sksec->sclass,
4183                                                    SOCKET__NAME_BIND, &ad);
4184                                 if (err)
4185                                         goto out;
4186                         }
4187                 }
4188
4189                 switch (sksec->sclass) {
4190                 case SECCLASS_TCP_SOCKET:
4191                         node_perm = TCP_SOCKET__NODE_BIND;
4192                         break;
4193
4194                 case SECCLASS_UDP_SOCKET:
4195                         node_perm = UDP_SOCKET__NODE_BIND;
4196                         break;
4197
4198                 case SECCLASS_DCCP_SOCKET:
4199                         node_perm = DCCP_SOCKET__NODE_BIND;
4200                         break;
4201
4202                 default:
4203                         node_perm = RAWIP_SOCKET__NODE_BIND;
4204                         break;
4205                 }
4206
4207                 err = sel_netnode_sid(addrp, family, &sid);
4208                 if (err)
4209                         goto out;
4210
4211                 ad.type = LSM_AUDIT_DATA_NET;
4212                 ad.u.net = &net;
4213                 ad.u.net->sport = htons(snum);
4214                 ad.u.net->family = family;
4215
4216                 if (family == PF_INET)
4217                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4218                 else
4219                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4220
4221                 err = avc_has_perm(sksec->sid, sid,
4222                                    sksec->sclass, node_perm, &ad);
4223                 if (err)
4224                         goto out;
4225         }
4226 out:
4227         return err;
4228 }
4229
4230 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4231 {
4232         struct sock *sk = sock->sk;
4233         struct sk_security_struct *sksec = sk->sk_security;
4234         int err;
4235
4236         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4237         if (err)
4238                 return err;
4239
4240         /*
4241          * If a TCP or DCCP socket, check name_connect permission for the port.
4242          */
4243         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4244             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4245                 struct common_audit_data ad;
4246                 struct lsm_network_audit net = {0,};
4247                 struct sockaddr_in *addr4 = NULL;
4248                 struct sockaddr_in6 *addr6 = NULL;
4249                 unsigned short snum;
4250                 u32 sid, perm;
4251
4252                 if (sk->sk_family == PF_INET) {
4253                         addr4 = (struct sockaddr_in *)address;
4254                         if (addrlen < sizeof(struct sockaddr_in))
4255                                 return -EINVAL;
4256                         snum = ntohs(addr4->sin_port);
4257                 } else {
4258                         addr6 = (struct sockaddr_in6 *)address;
4259                         if (addrlen < SIN6_LEN_RFC2133)
4260                                 return -EINVAL;
4261                         snum = ntohs(addr6->sin6_port);
4262                 }
4263
4264                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4265                 if (err)
4266                         goto out;
4267
4268                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4269                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4270
4271                 ad.type = LSM_AUDIT_DATA_NET;
4272                 ad.u.net = &net;
4273                 ad.u.net->dport = htons(snum);
4274                 ad.u.net->family = sk->sk_family;
4275                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4276                 if (err)
4277                         goto out;
4278         }
4279
4280         err = selinux_netlbl_socket_connect(sk, address);
4281
4282 out:
4283         return err;
4284 }
4285
4286 static int selinux_socket_listen(struct socket *sock, int backlog)
4287 {
4288         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4289 }
4290
4291 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4292 {
4293         int err;
4294         struct inode_security_struct *isec;
4295         struct inode_security_struct *newisec;
4296
4297         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4298         if (err)
4299                 return err;
4300
4301         newisec = SOCK_INODE(newsock)->i_security;
4302
4303         isec = SOCK_INODE(sock)->i_security;
4304         newisec->sclass = isec->sclass;
4305         newisec->sid = isec->sid;
4306         newisec->initialized = 1;
4307
4308         return 0;
4309 }
4310
4311 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4312                                   int size)
4313 {
4314         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4315 }
4316
4317 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4318                                   int size, int flags)
4319 {
4320         return sock_has_perm(current, sock->sk, SOCKET__READ);
4321 }
4322
4323 static int selinux_socket_getsockname(struct socket *sock)
4324 {
4325         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4326 }
4327
4328 static int selinux_socket_getpeername(struct socket *sock)
4329 {
4330         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4331 }
4332
4333 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4334 {
4335         int err;
4336
4337         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4338         if (err)
4339                 return err;
4340
4341         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4342 }
4343
4344 static int selinux_socket_getsockopt(struct socket *sock, int level,
4345                                      int optname)
4346 {
4347         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4348 }
4349
4350 static int selinux_socket_shutdown(struct socket *sock, int how)
4351 {
4352         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4353 }
4354
4355 static int selinux_socket_unix_stream_connect(struct sock *sock,
4356                                               struct sock *other,
4357                                               struct sock *newsk)
4358 {
4359         struct sk_security_struct *sksec_sock = sock->sk_security;
4360         struct sk_security_struct *sksec_other = other->sk_security;
4361         struct sk_security_struct *sksec_new = newsk->sk_security;
4362         struct common_audit_data ad;
4363         struct lsm_network_audit net = {0,};
4364         int err;
4365
4366         ad.type = LSM_AUDIT_DATA_NET;
4367         ad.u.net = &net;
4368         ad.u.net->sk = other;
4369
4370         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4371                            sksec_other->sclass,
4372                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4373         if (err)
4374                 return err;
4375
4376         /* server child socket */
4377         sksec_new->peer_sid = sksec_sock->sid;
4378         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4379                                     &sksec_new->sid);
4380         if (err)
4381                 return err;
4382
4383         /* connecting socket */
4384         sksec_sock->peer_sid = sksec_new->sid;
4385
4386         return 0;
4387 }
4388
4389 static int selinux_socket_unix_may_send(struct socket *sock,
4390                                         struct socket *other)
4391 {
4392         struct sk_security_struct *ssec = sock->sk->sk_security;
4393         struct sk_security_struct *osec = other->sk->sk_security;
4394         struct common_audit_data ad;
4395         struct lsm_network_audit net = {0,};
4396
4397         ad.type = LSM_AUDIT_DATA_NET;
4398         ad.u.net = &net;
4399         ad.u.net->sk = other->sk;
4400
4401         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4402                             &ad);
4403 }
4404
4405 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4406                                     char *addrp, u16 family, u32 peer_sid,
4407                                     struct common_audit_data *ad)
4408 {
4409         int err;
4410         u32 if_sid;
4411         u32 node_sid;
4412
4413         err = sel_netif_sid(ns, ifindex, &if_sid);
4414         if (err)
4415                 return err;
4416         err = avc_has_perm(peer_sid, if_sid,
4417                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4418         if (err)
4419                 return err;
4420
4421         err = sel_netnode_sid(addrp, family, &node_sid);
4422         if (err)
4423                 return err;
4424         return avc_has_perm(peer_sid, node_sid,
4425                             SECCLASS_NODE, NODE__RECVFROM, ad);
4426 }
4427
4428 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4429                                        u16 family)
4430 {
4431         int err = 0;
4432         struct sk_security_struct *sksec = sk->sk_security;
4433         u32 sk_sid = sksec->sid;
4434         struct common_audit_data ad;
4435         struct lsm_network_audit net = {0,};
4436         char *addrp;
4437
4438         ad.type = LSM_AUDIT_DATA_NET;
4439         ad.u.net = &net;
4440         ad.u.net->netif = skb->skb_iif;
4441         ad.u.net->family = family;
4442         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4443         if (err)
4444                 return err;
4445
4446         if (selinux_secmark_enabled()) {
4447                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4448                                    PACKET__RECV, &ad);
4449                 if (err)
4450                         return err;
4451         }
4452
4453         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4454         if (err)
4455                 return err;
4456         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4457
4458         return err;
4459 }
4460
4461 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4462 {
4463         int err;
4464         struct sk_security_struct *sksec = sk->sk_security;
4465         u16 family = sk->sk_family;
4466         u32 sk_sid = sksec->sid;
4467         struct common_audit_data ad;
4468         struct lsm_network_audit net = {0,};
4469         char *addrp;
4470         u8 secmark_active;
4471         u8 peerlbl_active;
4472
4473         if (family != PF_INET && family != PF_INET6)
4474                 return 0;
4475
4476         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4477         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4478                 family = PF_INET;
4479
4480         /* If any sort of compatibility mode is enabled then handoff processing
4481          * to the selinux_sock_rcv_skb_compat() function to deal with the
4482          * special handling.  We do this in an attempt to keep this function
4483          * as fast and as clean as possible. */
4484         if (!selinux_policycap_netpeer)
4485                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4486
4487         secmark_active = selinux_secmark_enabled();
4488         peerlbl_active = selinux_peerlbl_enabled();
4489         if (!secmark_active && !peerlbl_active)
4490                 return 0;
4491
4492         ad.type = LSM_AUDIT_DATA_NET;
4493         ad.u.net = &net;
4494         ad.u.net->netif = skb->skb_iif;
4495         ad.u.net->family = family;
4496         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4497         if (err)
4498                 return err;
4499
4500         if (peerlbl_active) {
4501                 u32 peer_sid;
4502
4503                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4504                 if (err)
4505                         return err;
4506                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4507                                                addrp, family, peer_sid, &ad);
4508                 if (err) {
4509                         selinux_netlbl_err(skb, err, 0);
4510                         return err;
4511                 }
4512                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4513                                    PEER__RECV, &ad);
4514                 if (err) {
4515                         selinux_netlbl_err(skb, err, 0);
4516                         return err;
4517                 }
4518         }
4519
4520         if (secmark_active) {
4521                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4522                                    PACKET__RECV, &ad);
4523                 if (err)
4524                         return err;
4525         }
4526
4527         return err;
4528 }
4529
4530 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4531                                             int __user *optlen, unsigned len)
4532 {
4533         int err = 0;
4534         char *scontext;
4535         u32 scontext_len;
4536         struct sk_security_struct *sksec = sock->sk->sk_security;
4537         u32 peer_sid = SECSID_NULL;
4538
4539         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4540             sksec->sclass == SECCLASS_TCP_SOCKET)
4541                 peer_sid = sksec->peer_sid;
4542         if (peer_sid == SECSID_NULL)
4543                 return -ENOPROTOOPT;
4544
4545         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4546         if (err)
4547                 return err;
4548
4549         if (scontext_len > len) {
4550                 err = -ERANGE;
4551                 goto out_len;
4552         }
4553
4554         if (copy_to_user(optval, scontext, scontext_len))
4555                 err = -EFAULT;
4556
4557 out_len:
4558         if (put_user(scontext_len, optlen))
4559                 err = -EFAULT;
4560         kfree(scontext);
4561         return err;
4562 }
4563
4564 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4565 {
4566         u32 peer_secid = SECSID_NULL;
4567         u16 family;
4568
4569         if (skb && skb->protocol == htons(ETH_P_IP))
4570                 family = PF_INET;
4571         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4572                 family = PF_INET6;
4573         else if (sock)
4574                 family = sock->sk->sk_family;
4575         else
4576                 goto out;
4577
4578         if (sock && family == PF_UNIX)
4579                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4580         else if (skb)
4581                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4582
4583 out:
4584         *secid = peer_secid;
4585         if (peer_secid == SECSID_NULL)
4586                 return -EINVAL;
4587         return 0;
4588 }
4589
4590 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4591 {
4592         struct sk_security_struct *sksec;
4593
4594         sksec = kzalloc(sizeof(*sksec), priority);
4595         if (!sksec)
4596                 return -ENOMEM;
4597
4598         sksec->peer_sid = SECINITSID_UNLABELED;
4599         sksec->sid = SECINITSID_UNLABELED;
4600         sksec->sclass = SECCLASS_SOCKET;
4601         selinux_netlbl_sk_security_reset(sksec);
4602         sk->sk_security = sksec;
4603
4604         return 0;
4605 }
4606
4607 static void selinux_sk_free_security(struct sock *sk)
4608 {
4609         struct sk_security_struct *sksec = sk->sk_security;
4610
4611         sk->sk_security = NULL;
4612         selinux_netlbl_sk_security_free(sksec);
4613         kfree(sksec);
4614 }
4615
4616 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4617 {
4618         struct sk_security_struct *sksec = sk->sk_security;
4619         struct sk_security_struct *newsksec = newsk->sk_security;
4620
4621         newsksec->sid = sksec->sid;
4622         newsksec->peer_sid = sksec->peer_sid;
4623         newsksec->sclass = sksec->sclass;
4624
4625         selinux_netlbl_sk_security_reset(newsksec);
4626 }
4627
4628 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4629 {
4630         if (!sk)
4631                 *secid = SECINITSID_ANY_SOCKET;
4632         else {
4633                 struct sk_security_struct *sksec = sk->sk_security;
4634
4635                 *secid = sksec->sid;
4636         }
4637 }
4638
4639 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4640 {
4641         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4642         struct sk_security_struct *sksec = sk->sk_security;
4643
4644         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4645             sk->sk_family == PF_UNIX)
4646                 isec->sid = sksec->sid;
4647         sksec->sclass = isec->sclass;
4648 }
4649
4650 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4651                                      struct request_sock *req)
4652 {
4653         struct sk_security_struct *sksec = sk->sk_security;
4654         int err;
4655         u16 family = req->rsk_ops->family;
4656         u32 connsid;
4657         u32 peersid;
4658
4659         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4660         if (err)
4661                 return err;
4662         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4663         if (err)
4664                 return err;
4665         req->secid = connsid;
4666         req->peer_secid = peersid;
4667
4668         return selinux_netlbl_inet_conn_request(req, family);
4669 }
4670
4671 static void selinux_inet_csk_clone(struct sock *newsk,
4672                                    const struct request_sock *req)
4673 {
4674         struct sk_security_struct *newsksec = newsk->sk_security;
4675
4676         newsksec->sid = req->secid;
4677         newsksec->peer_sid = req->peer_secid;
4678         /* NOTE: Ideally, we should also get the isec->sid for the
4679            new socket in sync, but we don't have the isec available yet.
4680            So we will wait until sock_graft to do it, by which
4681            time it will have been created and available. */
4682
4683         /* We don't need to take any sort of lock here as we are the only
4684          * thread with access to newsksec */
4685         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4686 }
4687
4688 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4689 {
4690         u16 family = sk->sk_family;
4691         struct sk_security_struct *sksec = sk->sk_security;
4692
4693         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4694         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4695                 family = PF_INET;
4696
4697         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4698 }
4699
4700 static int selinux_secmark_relabel_packet(u32 sid)
4701 {
4702         const struct task_security_struct *__tsec;
4703         u32 tsid;
4704
4705         __tsec = current_security();
4706         tsid = __tsec->sid;
4707
4708         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4709 }
4710
4711 static void selinux_secmark_refcount_inc(void)
4712 {
4713         atomic_inc(&selinux_secmark_refcount);
4714 }
4715
4716 static void selinux_secmark_refcount_dec(void)
4717 {
4718         atomic_dec(&selinux_secmark_refcount);
4719 }
4720
4721 static void selinux_req_classify_flow(const struct request_sock *req,
4722                                       struct flowi *fl)
4723 {
4724         fl->flowi_secid = req->secid;
4725 }
4726
4727 static int selinux_tun_dev_alloc_security(void **security)
4728 {
4729         struct tun_security_struct *tunsec;
4730
4731         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4732         if (!tunsec)
4733                 return -ENOMEM;
4734         tunsec->sid = current_sid();
4735
4736         *security = tunsec;
4737         return 0;
4738 }
4739
4740 static void selinux_tun_dev_free_security(void *security)
4741 {
4742         kfree(security);
4743 }
4744
4745 static int selinux_tun_dev_create(void)
4746 {
4747         u32 sid = current_sid();
4748
4749         /* we aren't taking into account the "sockcreate" SID since the socket
4750          * that is being created here is not a socket in the traditional sense,
4751          * instead it is a private sock, accessible only to the kernel, and
4752          * representing a wide range of network traffic spanning multiple
4753          * connections unlike traditional sockets - check the TUN driver to
4754          * get a better understanding of why this socket is special */
4755
4756         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4757                             NULL);
4758 }
4759
4760 static int selinux_tun_dev_attach_queue(void *security)
4761 {
4762         struct tun_security_struct *tunsec = security;
4763
4764         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4765                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4766 }
4767
4768 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4769 {
4770         struct tun_security_struct *tunsec = security;
4771         struct sk_security_struct *sksec = sk->sk_security;
4772
4773         /* we don't currently perform any NetLabel based labeling here and it
4774          * isn't clear that we would want to do so anyway; while we could apply
4775          * labeling without the support of the TUN user the resulting labeled
4776          * traffic from the other end of the connection would almost certainly
4777          * cause confusion to the TUN user that had no idea network labeling
4778          * protocols were being used */
4779
4780         sksec->sid = tunsec->sid;
4781         sksec->sclass = SECCLASS_TUN_SOCKET;
4782
4783         return 0;
4784 }
4785
4786 static int selinux_tun_dev_open(void *security)
4787 {
4788         struct tun_security_struct *tunsec = security;
4789         u32 sid = current_sid();
4790         int err;
4791
4792         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4793                            TUN_SOCKET__RELABELFROM, NULL);
4794         if (err)
4795                 return err;
4796         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4797                            TUN_SOCKET__RELABELTO, NULL);
4798         if (err)
4799                 return err;
4800         tunsec->sid = sid;
4801
4802         return 0;
4803 }
4804
4805 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4806 {
4807         int err = 0;
4808         u32 perm;
4809         struct nlmsghdr *nlh;
4810         struct sk_security_struct *sksec = sk->sk_security;
4811
4812         if (skb->len < NLMSG_HDRLEN) {
4813                 err = -EINVAL;
4814                 goto out;
4815         }
4816         nlh = nlmsg_hdr(skb);
4817
4818         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4819         if (err) {
4820                 if (err == -EINVAL) {
4821                         printk(KERN_WARNING
4822                                "SELinux: unrecognized netlink message:"
4823                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4824                                sk->sk_protocol, nlh->nlmsg_type,
4825                                secclass_map[sksec->sclass - 1].name);
4826                         if (!selinux_enforcing || security_get_allow_unknown())
4827                                 err = 0;
4828                 }
4829
4830                 /* Ignore */
4831                 if (err == -ENOENT)
4832                         err = 0;
4833                 goto out;
4834         }
4835
4836         err = sock_has_perm(current, sk, perm);
4837 out:
4838         return err;
4839 }
4840
4841 #ifdef CONFIG_NETFILTER
4842
4843 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4844                                        const struct net_device *indev,
4845                                        u16 family)
4846 {
4847         int err;
4848         char *addrp;
4849         u32 peer_sid;
4850         struct common_audit_data ad;
4851         struct lsm_network_audit net = {0,};
4852         u8 secmark_active;
4853         u8 netlbl_active;
4854         u8 peerlbl_active;
4855
4856         if (!selinux_policycap_netpeer)
4857                 return NF_ACCEPT;
4858
4859         secmark_active = selinux_secmark_enabled();
4860         netlbl_active = netlbl_enabled();
4861         peerlbl_active = selinux_peerlbl_enabled();
4862         if (!secmark_active && !peerlbl_active)
4863                 return NF_ACCEPT;
4864
4865         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4866                 return NF_DROP;
4867
4868         ad.type = LSM_AUDIT_DATA_NET;
4869         ad.u.net = &net;
4870         ad.u.net->netif = indev->ifindex;
4871         ad.u.net->family = family;
4872         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4873                 return NF_DROP;
4874
4875         if (peerlbl_active) {
4876                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4877                                                addrp, family, peer_sid, &ad);
4878                 if (err) {
4879                         selinux_netlbl_err(skb, err, 1);
4880                         return NF_DROP;
4881                 }
4882         }
4883
4884         if (secmark_active)
4885                 if (avc_has_perm(peer_sid, skb->secmark,
4886                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4887                         return NF_DROP;
4888
4889         if (netlbl_active)
4890                 /* we do this in the FORWARD path and not the POST_ROUTING
4891                  * path because we want to make sure we apply the necessary
4892                  * labeling before IPsec is applied so we can leverage AH
4893                  * protection */
4894                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4895                         return NF_DROP;
4896
4897         return NF_ACCEPT;
4898 }
4899
4900 static unsigned int selinux_ipv4_forward(void *priv,
4901                                          struct sk_buff *skb,
4902                                          const struct nf_hook_state *state)
4903 {
4904         return selinux_ip_forward(skb, state->in, PF_INET);
4905 }
4906
4907 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4908 static unsigned int selinux_ipv6_forward(void *priv,
4909                                          struct sk_buff *skb,
4910                                          const struct nf_hook_state *state)
4911 {
4912         return selinux_ip_forward(skb, state->in, PF_INET6);
4913 }
4914 #endif  /* IPV6 */
4915
4916 static unsigned int selinux_ip_output(struct sk_buff *skb,
4917                                       u16 family)
4918 {
4919         struct sock *sk;
4920         u32 sid;
4921
4922         if (!netlbl_enabled())
4923                 return NF_ACCEPT;
4924
4925         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4926          * because we want to make sure we apply the necessary labeling
4927          * before IPsec is applied so we can leverage AH protection */
4928         sk = skb->sk;
4929         if (sk) {
4930                 struct sk_security_struct *sksec;
4931
4932                 if (sk_listener(sk))
4933                         /* if the socket is the listening state then this
4934                          * packet is a SYN-ACK packet which means it needs to
4935                          * be labeled based on the connection/request_sock and
4936                          * not the parent socket.  unfortunately, we can't
4937                          * lookup the request_sock yet as it isn't queued on
4938                          * the parent socket until after the SYN-ACK is sent.
4939                          * the "solution" is to simply pass the packet as-is
4940                          * as any IP option based labeling should be copied
4941                          * from the initial connection request (in the IP
4942                          * layer).  it is far from ideal, but until we get a
4943                          * security label in the packet itself this is the
4944                          * best we can do. */
4945                         return NF_ACCEPT;
4946
4947                 /* standard practice, label using the parent socket */
4948                 sksec = sk->sk_security;
4949                 sid = sksec->sid;
4950         } else
4951                 sid = SECINITSID_KERNEL;
4952         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4953                 return NF_DROP;
4954
4955         return NF_ACCEPT;
4956 }
4957
4958 static unsigned int selinux_ipv4_output(void *priv,
4959                                         struct sk_buff *skb,
4960                                         const struct nf_hook_state *state)
4961 {
4962         return selinux_ip_output(skb, PF_INET);
4963 }
4964
4965 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4966                                                 int ifindex,
4967                                                 u16 family)
4968 {
4969         struct sock *sk = skb_to_full_sk(skb);
4970         struct sk_security_struct *sksec;
4971         struct common_audit_data ad;
4972         struct lsm_network_audit net = {0,};
4973         char *addrp;
4974         u8 proto;
4975
4976         if (sk == NULL)
4977                 return NF_ACCEPT;
4978         sksec = sk->sk_security;
4979
4980         ad.type = LSM_AUDIT_DATA_NET;
4981         ad.u.net = &net;
4982         ad.u.net->netif = ifindex;
4983         ad.u.net->family = family;
4984         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4985                 return NF_DROP;
4986
4987         if (selinux_secmark_enabled())
4988                 if (avc_has_perm(sksec->sid, skb->secmark,
4989                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4990                         return NF_DROP_ERR(-ECONNREFUSED);
4991
4992         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4993                 return NF_DROP_ERR(-ECONNREFUSED);
4994
4995         return NF_ACCEPT;
4996 }
4997
4998 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4999                                          const struct net_device *outdev,
5000                                          u16 family)
5001 {
5002         u32 secmark_perm;
5003         u32 peer_sid;
5004         int ifindex = outdev->ifindex;
5005         struct sock *sk;
5006         struct common_audit_data ad;
5007         struct lsm_network_audit net = {0,};
5008         char *addrp;
5009         u8 secmark_active;
5010         u8 peerlbl_active;
5011
5012         /* If any sort of compatibility mode is enabled then handoff processing
5013          * to the selinux_ip_postroute_compat() function to deal with the
5014          * special handling.  We do this in an attempt to keep this function
5015          * as fast and as clean as possible. */
5016         if (!selinux_policycap_netpeer)
5017                 return selinux_ip_postroute_compat(skb, ifindex, family);
5018
5019         secmark_active = selinux_secmark_enabled();
5020         peerlbl_active = selinux_peerlbl_enabled();
5021         if (!secmark_active && !peerlbl_active)
5022                 return NF_ACCEPT;
5023
5024         sk = skb_to_full_sk(skb);
5025
5026 #ifdef CONFIG_XFRM
5027         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5028          * packet transformation so allow the packet to pass without any checks
5029          * since we'll have another chance to perform access control checks
5030          * when the packet is on it's final way out.
5031          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5032          *       is NULL, in this case go ahead and apply access control.
5033          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5034          *       TCP listening state we cannot wait until the XFRM processing
5035          *       is done as we will miss out on the SA label if we do;
5036          *       unfortunately, this means more work, but it is only once per
5037          *       connection. */
5038         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5039             !(sk && sk_listener(sk)))
5040                 return NF_ACCEPT;
5041 #endif
5042
5043         if (sk == NULL) {
5044                 /* Without an associated socket the packet is either coming
5045                  * from the kernel or it is being forwarded; check the packet
5046                  * to determine which and if the packet is being forwarded
5047                  * query the packet directly to determine the security label. */
5048                 if (skb->skb_iif) {
5049                         secmark_perm = PACKET__FORWARD_OUT;
5050                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5051                                 return NF_DROP;
5052                 } else {
5053                         secmark_perm = PACKET__SEND;
5054                         peer_sid = SECINITSID_KERNEL;
5055                 }
5056         } else if (sk_listener(sk)) {
5057                 /* Locally generated packet but the associated socket is in the
5058                  * listening state which means this is a SYN-ACK packet.  In
5059                  * this particular case the correct security label is assigned
5060                  * to the connection/request_sock but unfortunately we can't
5061                  * query the request_sock as it isn't queued on the parent
5062                  * socket until after the SYN-ACK packet is sent; the only
5063                  * viable choice is to regenerate the label like we do in
5064                  * selinux_inet_conn_request().  See also selinux_ip_output()
5065                  * for similar problems. */
5066                 u32 skb_sid;
5067                 struct sk_security_struct *sksec;
5068
5069                 sksec = sk->sk_security;
5070                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5071                         return NF_DROP;
5072                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5073                  * and the packet has been through at least one XFRM
5074                  * transformation then we must be dealing with the "final"
5075                  * form of labeled IPsec packet; since we've already applied
5076                  * all of our access controls on this packet we can safely
5077                  * pass the packet. */
5078                 if (skb_sid == SECSID_NULL) {
5079                         switch (family) {
5080                         case PF_INET:
5081                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5082                                         return NF_ACCEPT;
5083                                 break;
5084                         case PF_INET6:
5085                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5086                                         return NF_ACCEPT;
5087                                 break;
5088                         default:
5089                                 return NF_DROP_ERR(-ECONNREFUSED);
5090                         }
5091                 }
5092                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5093                         return NF_DROP;
5094                 secmark_perm = PACKET__SEND;
5095         } else {
5096                 /* Locally generated packet, fetch the security label from the
5097                  * associated socket. */
5098                 struct sk_security_struct *sksec = sk->sk_security;
5099                 peer_sid = sksec->sid;
5100                 secmark_perm = PACKET__SEND;
5101         }
5102
5103         ad.type = LSM_AUDIT_DATA_NET;
5104         ad.u.net = &net;
5105         ad.u.net->netif = ifindex;
5106         ad.u.net->family = family;
5107         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5108                 return NF_DROP;
5109
5110         if (secmark_active)
5111                 if (avc_has_perm(peer_sid, skb->secmark,
5112                                  SECCLASS_PACKET, secmark_perm, &ad))
5113                         return NF_DROP_ERR(-ECONNREFUSED);
5114
5115         if (peerlbl_active) {
5116                 u32 if_sid;
5117                 u32 node_sid;
5118
5119                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5120                         return NF_DROP;
5121                 if (avc_has_perm(peer_sid, if_sid,
5122                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5123                         return NF_DROP_ERR(-ECONNREFUSED);
5124
5125                 if (sel_netnode_sid(addrp, family, &node_sid))
5126                         return NF_DROP;
5127                 if (avc_has_perm(peer_sid, node_sid,
5128                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5129                         return NF_DROP_ERR(-ECONNREFUSED);
5130         }
5131
5132         return NF_ACCEPT;
5133 }
5134
5135 static unsigned int selinux_ipv4_postroute(void *priv,
5136                                            struct sk_buff *skb,
5137                                            const struct nf_hook_state *state)
5138 {
5139         return selinux_ip_postroute(skb, state->out, PF_INET);
5140 }
5141
5142 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5143 static unsigned int selinux_ipv6_postroute(void *priv,
5144                                            struct sk_buff *skb,
5145                                            const struct nf_hook_state *state)
5146 {
5147         return selinux_ip_postroute(skb, state->out, PF_INET6);
5148 }
5149 #endif  /* IPV6 */
5150
5151 #endif  /* CONFIG_NETFILTER */
5152
5153 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5154 {
5155         return selinux_nlmsg_perm(sk, skb);
5156 }
5157
5158 static int ipc_alloc_security(struct task_struct *task,
5159                               struct kern_ipc_perm *perm,
5160                               u16 sclass)
5161 {
5162         struct ipc_security_struct *isec;
5163         u32 sid;
5164
5165         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5166         if (!isec)
5167                 return -ENOMEM;
5168
5169         sid = task_sid(task);
5170         isec->sclass = sclass;
5171         isec->sid = sid;
5172         perm->security = isec;
5173
5174         return 0;
5175 }
5176
5177 static void ipc_free_security(struct kern_ipc_perm *perm)
5178 {
5179         struct ipc_security_struct *isec = perm->security;
5180         perm->security = NULL;
5181         kfree(isec);
5182 }
5183
5184 static int msg_msg_alloc_security(struct msg_msg *msg)
5185 {
5186         struct msg_security_struct *msec;
5187
5188         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5189         if (!msec)
5190                 return -ENOMEM;
5191
5192         msec->sid = SECINITSID_UNLABELED;
5193         msg->security = msec;
5194
5195         return 0;
5196 }
5197
5198 static void msg_msg_free_security(struct msg_msg *msg)
5199 {
5200         struct msg_security_struct *msec = msg->security;
5201
5202         msg->security = NULL;
5203         kfree(msec);
5204 }
5205
5206 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5207                         u32 perms)
5208 {
5209         struct ipc_security_struct *isec;
5210         struct common_audit_data ad;
5211         u32 sid = current_sid();
5212
5213         isec = ipc_perms->security;
5214
5215         ad.type = LSM_AUDIT_DATA_IPC;
5216         ad.u.ipc_id = ipc_perms->key;
5217
5218         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5219 }
5220
5221 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5222 {
5223         return msg_msg_alloc_security(msg);
5224 }
5225
5226 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5227 {
5228         msg_msg_free_security(msg);
5229 }
5230
5231 /* message queue security operations */
5232 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5233 {
5234         struct ipc_security_struct *isec;
5235         struct common_audit_data ad;
5236         u32 sid = current_sid();
5237         int rc;
5238
5239         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5240         if (rc)
5241                 return rc;
5242
5243         isec = msq->q_perm.security;
5244
5245         ad.type = LSM_AUDIT_DATA_IPC;
5246         ad.u.ipc_id = msq->q_perm.key;
5247
5248         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5249                           MSGQ__CREATE, &ad);
5250         if (rc) {
5251                 ipc_free_security(&msq->q_perm);
5252                 return rc;
5253         }
5254         return 0;
5255 }
5256
5257 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5258 {
5259         ipc_free_security(&msq->q_perm);
5260 }
5261
5262 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5263 {
5264         struct ipc_security_struct *isec;
5265         struct common_audit_data ad;
5266         u32 sid = current_sid();
5267
5268         isec = msq->q_perm.security;
5269
5270         ad.type = LSM_AUDIT_DATA_IPC;
5271         ad.u.ipc_id = msq->q_perm.key;
5272
5273         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5274                             MSGQ__ASSOCIATE, &ad);
5275 }
5276
5277 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5278 {
5279         int err;
5280         int perms;
5281
5282         switch (cmd) {
5283         case IPC_INFO:
5284         case MSG_INFO:
5285                 /* No specific object, just general system-wide information. */
5286                 return task_has_system(current, SYSTEM__IPC_INFO);
5287         case IPC_STAT:
5288         case MSG_STAT:
5289                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5290                 break;
5291         case IPC_SET:
5292                 perms = MSGQ__SETATTR;
5293                 break;
5294         case IPC_RMID:
5295                 perms = MSGQ__DESTROY;
5296                 break;
5297         default:
5298                 return 0;
5299         }
5300
5301         err = ipc_has_perm(&msq->q_perm, perms);
5302         return err;
5303 }
5304
5305 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5306 {
5307         struct ipc_security_struct *isec;
5308         struct msg_security_struct *msec;
5309         struct common_audit_data ad;
5310         u32 sid = current_sid();
5311         int rc;
5312
5313         isec = msq->q_perm.security;
5314         msec = msg->security;
5315
5316         /*
5317          * First time through, need to assign label to the message
5318          */
5319         if (msec->sid == SECINITSID_UNLABELED) {
5320                 /*
5321                  * Compute new sid based on current process and
5322                  * message queue this message will be stored in
5323                  */
5324                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5325                                              NULL, &msec->sid);
5326                 if (rc)
5327                         return rc;
5328         }
5329
5330         ad.type = LSM_AUDIT_DATA_IPC;
5331         ad.u.ipc_id = msq->q_perm.key;
5332
5333         /* Can this process write to the queue? */
5334         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5335                           MSGQ__WRITE, &ad);
5336         if (!rc)
5337                 /* Can this process send the message */
5338                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5339                                   MSG__SEND, &ad);
5340         if (!rc)
5341                 /* Can the message be put in the queue? */
5342                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5343                                   MSGQ__ENQUEUE, &ad);
5344
5345         return rc;
5346 }
5347
5348 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5349                                     struct task_struct *target,
5350                                     long type, int mode)
5351 {
5352         struct ipc_security_struct *isec;
5353         struct msg_security_struct *msec;
5354         struct common_audit_data ad;
5355         u32 sid = task_sid(target);
5356         int rc;
5357
5358         isec = msq->q_perm.security;
5359         msec = msg->security;
5360
5361         ad.type = LSM_AUDIT_DATA_IPC;
5362         ad.u.ipc_id = msq->q_perm.key;
5363
5364         rc = avc_has_perm(sid, isec->sid,
5365                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5366         if (!rc)
5367                 rc = avc_has_perm(sid, msec->sid,
5368                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5369         return rc;
5370 }
5371
5372 /* Shared Memory security operations */
5373 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5374 {
5375         struct ipc_security_struct *isec;
5376         struct common_audit_data ad;
5377         u32 sid = current_sid();
5378         int rc;
5379
5380         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5381         if (rc)
5382                 return rc;
5383
5384         isec = shp->shm_perm.security;
5385
5386         ad.type = LSM_AUDIT_DATA_IPC;
5387         ad.u.ipc_id = shp->shm_perm.key;
5388
5389         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5390                           SHM__CREATE, &ad);
5391         if (rc) {
5392                 ipc_free_security(&shp->shm_perm);
5393                 return rc;
5394         }
5395         return 0;
5396 }
5397
5398 static void selinux_shm_free_security(struct shmid_kernel *shp)
5399 {
5400         ipc_free_security(&shp->shm_perm);
5401 }
5402
5403 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5404 {
5405         struct ipc_security_struct *isec;
5406         struct common_audit_data ad;
5407         u32 sid = current_sid();
5408
5409         isec = shp->shm_perm.security;
5410
5411         ad.type = LSM_AUDIT_DATA_IPC;
5412         ad.u.ipc_id = shp->shm_perm.key;
5413
5414         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5415                             SHM__ASSOCIATE, &ad);
5416 }
5417
5418 /* Note, at this point, shp is locked down */
5419 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5420 {
5421         int perms;
5422         int err;
5423
5424         switch (cmd) {
5425         case IPC_INFO:
5426         case SHM_INFO:
5427                 /* No specific object, just general system-wide information. */
5428                 return task_has_system(current, SYSTEM__IPC_INFO);
5429         case IPC_STAT:
5430         case SHM_STAT:
5431                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5432                 break;
5433         case IPC_SET:
5434                 perms = SHM__SETATTR;
5435                 break;
5436         case SHM_LOCK:
5437         case SHM_UNLOCK:
5438                 perms = SHM__LOCK;
5439                 break;
5440         case IPC_RMID:
5441                 perms = SHM__DESTROY;
5442                 break;
5443         default:
5444                 return 0;
5445         }
5446
5447         err = ipc_has_perm(&shp->shm_perm, perms);
5448         return err;
5449 }
5450
5451 static int selinux_shm_shmat(struct shmid_kernel *shp,
5452                              char __user *shmaddr, int shmflg)
5453 {
5454         u32 perms;
5455
5456         if (shmflg & SHM_RDONLY)
5457                 perms = SHM__READ;
5458         else
5459                 perms = SHM__READ | SHM__WRITE;
5460
5461         return ipc_has_perm(&shp->shm_perm, perms);
5462 }
5463
5464 /* Semaphore security operations */
5465 static int selinux_sem_alloc_security(struct sem_array *sma)
5466 {
5467         struct ipc_security_struct *isec;
5468         struct common_audit_data ad;
5469         u32 sid = current_sid();
5470         int rc;
5471
5472         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5473         if (rc)
5474                 return rc;
5475
5476         isec = sma->sem_perm.security;
5477
5478         ad.type = LSM_AUDIT_DATA_IPC;
5479         ad.u.ipc_id = sma->sem_perm.key;
5480
5481         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5482                           SEM__CREATE, &ad);
5483         if (rc) {
5484                 ipc_free_security(&sma->sem_perm);
5485                 return rc;
5486         }
5487         return 0;
5488 }
5489
5490 static void selinux_sem_free_security(struct sem_array *sma)
5491 {
5492         ipc_free_security(&sma->sem_perm);
5493 }
5494
5495 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5496 {
5497         struct ipc_security_struct *isec;
5498         struct common_audit_data ad;
5499         u32 sid = current_sid();
5500
5501         isec = sma->sem_perm.security;
5502
5503         ad.type = LSM_AUDIT_DATA_IPC;
5504         ad.u.ipc_id = sma->sem_perm.key;
5505
5506         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5507                             SEM__ASSOCIATE, &ad);
5508 }
5509
5510 /* Note, at this point, sma is locked down */
5511 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5512 {
5513         int err;
5514         u32 perms;
5515
5516         switch (cmd) {
5517         case IPC_INFO:
5518         case SEM_INFO:
5519                 /* No specific object, just general system-wide information. */
5520                 return task_has_system(current, SYSTEM__IPC_INFO);
5521         case GETPID:
5522         case GETNCNT:
5523         case GETZCNT:
5524                 perms = SEM__GETATTR;
5525                 break;
5526         case GETVAL:
5527         case GETALL:
5528                 perms = SEM__READ;
5529                 break;
5530         case SETVAL:
5531         case SETALL:
5532                 perms = SEM__WRITE;
5533                 break;
5534         case IPC_RMID:
5535                 perms = SEM__DESTROY;
5536                 break;
5537         case IPC_SET:
5538                 perms = SEM__SETATTR;
5539                 break;
5540         case IPC_STAT:
5541         case SEM_STAT:
5542                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5543                 break;
5544         default:
5545                 return 0;
5546         }
5547
5548         err = ipc_has_perm(&sma->sem_perm, perms);
5549         return err;
5550 }
5551
5552 static int selinux_sem_semop(struct sem_array *sma,
5553                              struct sembuf *sops, unsigned nsops, int alter)
5554 {
5555         u32 perms;
5556
5557         if (alter)
5558                 perms = SEM__READ | SEM__WRITE;
5559         else
5560                 perms = SEM__READ;
5561
5562         return ipc_has_perm(&sma->sem_perm, perms);
5563 }
5564
5565 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5566 {
5567         u32 av = 0;
5568
5569         av = 0;
5570         if (flag & S_IRUGO)
5571                 av |= IPC__UNIX_READ;
5572         if (flag & S_IWUGO)
5573                 av |= IPC__UNIX_WRITE;
5574
5575         if (av == 0)
5576                 return 0;
5577
5578         return ipc_has_perm(ipcp, av);
5579 }
5580
5581 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5582 {
5583         struct ipc_security_struct *isec = ipcp->security;
5584         *secid = isec->sid;
5585 }
5586
5587 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5588 {
5589         if (inode)
5590                 inode_doinit_with_dentry(inode, dentry);
5591 }
5592
5593 static int selinux_getprocattr(struct task_struct *p,
5594                                char *name, char **value)
5595 {
5596         const struct task_security_struct *__tsec;
5597         u32 sid;
5598         int error;
5599         unsigned len;
5600
5601         if (current != p) {
5602                 error = current_has_perm(p, PROCESS__GETATTR);
5603                 if (error)
5604                         return error;
5605         }
5606
5607         rcu_read_lock();
5608         __tsec = __task_cred(p)->security;
5609
5610         if (!strcmp(name, "current"))
5611                 sid = __tsec->sid;
5612         else if (!strcmp(name, "prev"))
5613                 sid = __tsec->osid;
5614         else if (!strcmp(name, "exec"))
5615                 sid = __tsec->exec_sid;
5616         else if (!strcmp(name, "fscreate"))
5617                 sid = __tsec->create_sid;
5618         else if (!strcmp(name, "keycreate"))
5619                 sid = __tsec->keycreate_sid;
5620         else if (!strcmp(name, "sockcreate"))
5621                 sid = __tsec->sockcreate_sid;
5622         else
5623                 goto invalid;
5624         rcu_read_unlock();
5625
5626         if (!sid)
5627                 return 0;
5628
5629         error = security_sid_to_context(sid, value, &len);
5630         if (error)
5631                 return error;
5632         return len;
5633
5634 invalid:
5635         rcu_read_unlock();
5636         return -EINVAL;
5637 }
5638
5639 static int selinux_setprocattr(struct task_struct *p,
5640                                char *name, void *value, size_t size)
5641 {
5642         struct task_security_struct *tsec;
5643         struct task_struct *tracer;
5644         struct cred *new;
5645         u32 sid = 0, ptsid;
5646         int error;
5647         char *str = value;
5648
5649         if (current != p) {
5650                 /* SELinux only allows a process to change its own
5651                    security attributes. */
5652                 return -EACCES;
5653         }
5654
5655         /*
5656          * Basic control over ability to set these attributes at all.
5657          * current == p, but we'll pass them separately in case the
5658          * above restriction is ever removed.
5659          */
5660         if (!strcmp(name, "exec"))
5661                 error = current_has_perm(p, PROCESS__SETEXEC);
5662         else if (!strcmp(name, "fscreate"))
5663                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5664         else if (!strcmp(name, "keycreate"))
5665                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5666         else if (!strcmp(name, "sockcreate"))
5667                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5668         else if (!strcmp(name, "current"))
5669                 error = current_has_perm(p, PROCESS__SETCURRENT);
5670         else
5671                 error = -EINVAL;
5672         if (error)
5673                 return error;
5674
5675         /* Obtain a SID for the context, if one was specified. */
5676         if (size && str[0] && str[0] != '\n') {
5677                 if (str[size-1] == '\n') {
5678                         str[size-1] = 0;
5679                         size--;
5680                 }
5681                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5682                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5683                         if (!capable(CAP_MAC_ADMIN)) {
5684                                 struct audit_buffer *ab;
5685                                 size_t audit_size;
5686
5687                                 /* We strip a nul only if it is at the end, otherwise the
5688                                  * context contains a nul and we should audit that */
5689                                 if (str[size - 1] == '\0')
5690                                         audit_size = size - 1;
5691                                 else
5692                                         audit_size = size;
5693                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5694                                 audit_log_format(ab, "op=fscreate invalid_context=");
5695                                 audit_log_n_untrustedstring(ab, value, audit_size);
5696                                 audit_log_end(ab);
5697
5698                                 return error;
5699                         }
5700                         error = security_context_to_sid_force(value, size,
5701                                                               &sid);
5702                 }
5703                 if (error)
5704                         return error;
5705         }
5706
5707         new = prepare_creds();
5708         if (!new)
5709                 return -ENOMEM;
5710
5711         /* Permission checking based on the specified context is
5712            performed during the actual operation (execve,
5713            open/mkdir/...), when we know the full context of the
5714            operation.  See selinux_bprm_set_creds for the execve
5715            checks and may_create for the file creation checks. The
5716            operation will then fail if the context is not permitted. */
5717         tsec = new->security;
5718         if (!strcmp(name, "exec")) {
5719                 tsec->exec_sid = sid;
5720         } else if (!strcmp(name, "fscreate")) {
5721                 tsec->create_sid = sid;
5722         } else if (!strcmp(name, "keycreate")) {
5723                 error = may_create_key(sid, p);
5724                 if (error)
5725                         goto abort_change;
5726                 tsec->keycreate_sid = sid;
5727         } else if (!strcmp(name, "sockcreate")) {
5728                 tsec->sockcreate_sid = sid;
5729         } else if (!strcmp(name, "current")) {
5730                 error = -EINVAL;
5731                 if (sid == 0)
5732                         goto abort_change;
5733
5734                 /* Only allow single threaded processes to change context */
5735                 error = -EPERM;
5736                 if (!current_is_single_threaded()) {
5737                         error = security_bounded_transition(tsec->sid, sid);
5738                         if (error)
5739                                 goto abort_change;
5740                 }
5741
5742                 /* Check permissions for the transition. */
5743                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5744                                      PROCESS__DYNTRANSITION, NULL);
5745                 if (error)
5746                         goto abort_change;
5747
5748                 /* Check for ptracing, and update the task SID if ok.
5749                    Otherwise, leave SID unchanged and fail. */
5750                 ptsid = 0;
5751                 rcu_read_lock();
5752                 tracer = ptrace_parent(p);
5753                 if (tracer)
5754                         ptsid = task_sid(tracer);
5755                 rcu_read_unlock();
5756
5757                 if (tracer) {
5758                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5759                                              PROCESS__PTRACE, NULL);
5760                         if (error)
5761                                 goto abort_change;
5762                 }
5763
5764                 tsec->sid = sid;
5765         } else {
5766                 error = -EINVAL;
5767                 goto abort_change;
5768         }
5769
5770         commit_creds(new);
5771         return size;
5772
5773 abort_change:
5774         abort_creds(new);
5775         return error;
5776 }
5777
5778 static int selinux_ismaclabel(const char *name)
5779 {
5780         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5781 }
5782
5783 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5784 {
5785         return security_sid_to_context(secid, secdata, seclen);
5786 }
5787
5788 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5789 {
5790         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5791 }
5792
5793 static void selinux_release_secctx(char *secdata, u32 seclen)
5794 {
5795         kfree(secdata);
5796 }
5797
5798 /*
5799  *      called with inode->i_mutex locked
5800  */
5801 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5802 {
5803         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5804 }
5805
5806 /*
5807  *      called with inode->i_mutex locked
5808  */
5809 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5810 {
5811         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5812 }
5813
5814 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5815 {
5816         int len = 0;
5817         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5818                                                 ctx, true);
5819         if (len < 0)
5820                 return len;
5821         *ctxlen = len;
5822         return 0;
5823 }
5824 #ifdef CONFIG_KEYS
5825
5826 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5827                              unsigned long flags)
5828 {
5829         const struct task_security_struct *tsec;
5830         struct key_security_struct *ksec;
5831
5832         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5833         if (!ksec)
5834                 return -ENOMEM;
5835
5836         tsec = cred->security;
5837         if (tsec->keycreate_sid)
5838                 ksec->sid = tsec->keycreate_sid;
5839         else
5840                 ksec->sid = tsec->sid;
5841
5842         k->security = ksec;
5843         return 0;
5844 }
5845
5846 static void selinux_key_free(struct key *k)
5847 {
5848         struct key_security_struct *ksec = k->security;
5849
5850         k->security = NULL;
5851         kfree(ksec);
5852 }
5853
5854 static int selinux_key_permission(key_ref_t key_ref,
5855                                   const struct cred *cred,
5856                                   unsigned perm)
5857 {
5858         struct key *key;
5859         struct key_security_struct *ksec;
5860         u32 sid;
5861
5862         /* if no specific permissions are requested, we skip the
5863            permission check. No serious, additional covert channels
5864            appear to be created. */
5865         if (perm == 0)
5866                 return 0;
5867
5868         sid = cred_sid(cred);
5869
5870         key = key_ref_to_ptr(key_ref);
5871         ksec = key->security;
5872
5873         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5874 }
5875
5876 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5877 {
5878         struct key_security_struct *ksec = key->security;
5879         char *context = NULL;
5880         unsigned len;
5881         int rc;
5882
5883         rc = security_sid_to_context(ksec->sid, &context, &len);
5884         if (!rc)
5885                 rc = len;
5886         *_buffer = context;
5887         return rc;
5888 }
5889
5890 #endif
5891
5892 static struct security_hook_list selinux_hooks[] = {
5893         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5894         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5895         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5896         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5897
5898         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5899         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5900         LSM_HOOK_INIT(capget, selinux_capget),
5901         LSM_HOOK_INIT(capset, selinux_capset),
5902         LSM_HOOK_INIT(capable, selinux_capable),
5903         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5904         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5905         LSM_HOOK_INIT(syslog, selinux_syslog),
5906         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5907
5908         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5909
5910         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5911         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5912         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5913         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5914
5915         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5916         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5917         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5918         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5919         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5920         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5921         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5922         LSM_HOOK_INIT(sb_mount, selinux_mount),
5923         LSM_HOOK_INIT(sb_umount, selinux_umount),
5924         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5925         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5926         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5927
5928         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5929
5930         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5931         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5932         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5933         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5934         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5935         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5936         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5937         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5938         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5939         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5940         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5941         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5942         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5943         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5944         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5945         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5946         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5947         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5948         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5949         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5950         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5951         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5952         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5953         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5954         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5955
5956         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5957         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5958         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5959         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5960         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5961         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5962         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5963         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5964         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5965         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5966         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5967         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5968
5969         LSM_HOOK_INIT(file_open, selinux_file_open),
5970
5971         LSM_HOOK_INIT(task_create, selinux_task_create),
5972         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5973         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5974         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5975         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5976         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5977         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5978         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5979         LSM_HOOK_INIT(kernel_module_from_file, selinux_kernel_module_from_file),
5980         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5981         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5982         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5983         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5984         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5985         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5986         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5987         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5988         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5989         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5990         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5991         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5992         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5993         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5994
5995         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5996         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5997
5998         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5999         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6000
6001         LSM_HOOK_INIT(msg_queue_alloc_security,
6002                         selinux_msg_queue_alloc_security),
6003         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6004         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6005         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6006         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6007         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6008
6009         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6010         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6011         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6012         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6013         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6014
6015         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6016         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6017         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6018         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6019         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6020
6021         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6022
6023         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6024         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6025
6026         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6027         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6028         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6029         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6030         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6031         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6032         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6033
6034         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6035         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6036
6037         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6038         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6039         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6040         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6041         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6042         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6043         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6044         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6045         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6046         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6047         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6048         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6049         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6050         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6051         LSM_HOOK_INIT(socket_getpeersec_stream,
6052                         selinux_socket_getpeersec_stream),
6053         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6054         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6055         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6056         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6057         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6058         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6059         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6060         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6061         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6062         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6063         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6064         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6065         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6066         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6067         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6068         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6069         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6070         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6071         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6072
6073 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6074         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6075         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6076         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6077         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6078         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6079         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6080                         selinux_xfrm_state_alloc_acquire),
6081         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6082         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6083         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6084         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6085                         selinux_xfrm_state_pol_flow_match),
6086         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6087 #endif
6088
6089 #ifdef CONFIG_KEYS
6090         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6091         LSM_HOOK_INIT(key_free, selinux_key_free),
6092         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6093         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6094 #endif
6095
6096 #ifdef CONFIG_AUDIT
6097         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6098         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6099         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6100         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6101 #endif
6102 };
6103
6104 static __init int selinux_init(void)
6105 {
6106         if (!security_module_enable("selinux")) {
6107                 selinux_enabled = 0;
6108                 return 0;
6109         }
6110
6111         if (!selinux_enabled) {
6112                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6113                 return 0;
6114         }
6115
6116         printk(KERN_INFO "SELinux:  Initializing.\n");
6117
6118         /* Set the security state for the initial task. */
6119         cred_init_security();
6120
6121         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6122
6123         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6124                                             sizeof(struct inode_security_struct),
6125                                             0, SLAB_PANIC, NULL);
6126         file_security_cache = kmem_cache_create("selinux_file_security",
6127                                             sizeof(struct file_security_struct),
6128                                             0, SLAB_PANIC, NULL);
6129         avc_init();
6130
6131         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6132
6133         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6134                 panic("SELinux: Unable to register AVC netcache callback\n");
6135
6136         if (selinux_enforcing)
6137                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6138         else
6139                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6140
6141         return 0;
6142 }
6143
6144 static void delayed_superblock_init(struct super_block *sb, void *unused)
6145 {
6146         superblock_doinit(sb, NULL);
6147 }
6148
6149 void selinux_complete_init(void)
6150 {
6151         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6152
6153         /* Set up any superblocks initialized prior to the policy load. */
6154         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6155         iterate_supers(delayed_superblock_init, NULL);
6156 }
6157
6158 /* SELinux requires early initialization in order to label
6159    all processes and objects when they are created. */
6160 security_initcall(selinux_init);
6161
6162 #if defined(CONFIG_NETFILTER)
6163
6164 static struct nf_hook_ops selinux_nf_ops[] = {
6165         {
6166                 .hook =         selinux_ipv4_postroute,
6167                 .pf =           NFPROTO_IPV4,
6168                 .hooknum =      NF_INET_POST_ROUTING,
6169                 .priority =     NF_IP_PRI_SELINUX_LAST,
6170         },
6171         {
6172                 .hook =         selinux_ipv4_forward,
6173                 .pf =           NFPROTO_IPV4,
6174                 .hooknum =      NF_INET_FORWARD,
6175                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6176         },
6177         {
6178                 .hook =         selinux_ipv4_output,
6179                 .pf =           NFPROTO_IPV4,
6180                 .hooknum =      NF_INET_LOCAL_OUT,
6181                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6182         },
6183 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6184         {
6185                 .hook =         selinux_ipv6_postroute,
6186                 .pf =           NFPROTO_IPV6,
6187                 .hooknum =      NF_INET_POST_ROUTING,
6188                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6189         },
6190         {
6191                 .hook =         selinux_ipv6_forward,
6192                 .pf =           NFPROTO_IPV6,
6193                 .hooknum =      NF_INET_FORWARD,
6194                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6195         },
6196 #endif  /* IPV6 */
6197 };
6198
6199 static int __init selinux_nf_ip_init(void)
6200 {
6201         int err;
6202
6203         if (!selinux_enabled)
6204                 return 0;
6205
6206         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6207
6208         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6209         if (err)
6210                 panic("SELinux: nf_register_hooks: error %d\n", err);
6211
6212         return 0;
6213 }
6214
6215 __initcall(selinux_nf_ip_init);
6216
6217 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6218 static void selinux_nf_ip_exit(void)
6219 {
6220         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6221
6222         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6223 }
6224 #endif
6225
6226 #else /* CONFIG_NETFILTER */
6227
6228 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6229 #define selinux_nf_ip_exit()
6230 #endif
6231
6232 #endif /* CONFIG_NETFILTER */
6233
6234 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6235 static int selinux_disabled;
6236
6237 int selinux_disable(void)
6238 {
6239         if (ss_initialized) {
6240                 /* Not permitted after initial policy load. */
6241                 return -EINVAL;
6242         }
6243
6244         if (selinux_disabled) {
6245                 /* Only do this once. */
6246                 return -EINVAL;
6247         }
6248
6249         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6250
6251         selinux_disabled = 1;
6252         selinux_enabled = 0;
6253
6254         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6255
6256         /* Try to destroy the avc node cache */
6257         avc_disable();
6258
6259         /* Unregister netfilter hooks. */
6260         selinux_nf_ip_exit();
6261
6262         /* Unregister selinuxfs. */
6263         exit_sel_fs();
6264
6265         return 0;
6266 }
6267 #endif