security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 407                 /* Special handling. Genfs but also in-core setxattr handler */
 408                 !strcmp(sb->s_type->name, "sysfs") ||
 409                 !strcmp(sb->s_type->name, "pstore") ||
 410                 !strcmp(sb->s_type->name, "debugfs") ||
 411                 !strcmp(sb->s_type->name, "rootfs");
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = d_backing_inode(root);
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450
 451         sbsec->flags |= SE_SBINITIALIZED;
 452         if (selinux_is_sblabel_mnt(sb))
 453                 sbsec->flags |= SBLABEL_MNT;
 454
 455         /* Initialize the root inode. */
 456         rc = inode_doinit_with_dentry(root_inode, root);
 457
 458         /* Initialize any other inodes associated with the superblock, e.g.
 459            inodes created prior to initial policy load or inodes created
 460            during get_sb by a pseudo filesystem that directly
 461            populates itself. */
 462         spin_lock(&sbsec->isec_lock);
 463 next_inode:
 464         if (!list_empty(&sbsec->isec_head)) {
 465                 struct inode_security_struct *isec =
 466                                 list_entry(sbsec->isec_head.next,
 467                                            struct inode_security_struct, list);
 468                 struct inode *inode = isec->inode;
 469                 list_del_init(&isec->list);
 470                 spin_unlock(&sbsec->isec_lock);
 471                 inode = igrab(inode);
 472                 if (inode) {
 473                         if (!IS_PRIVATE(inode))
 474                                 inode_doinit(inode);
 475                         iput(inode);
 476                 }
 477                 spin_lock(&sbsec->isec_lock);
 478                 goto next_inode;
 479         }
 480         spin_unlock(&sbsec->isec_lock);
 481 out:
 482         return rc;
 483 }
 484
 485 /*
 486  * This function should allow an FS to ask what it's mount security
 487  * options were so it can use those later for submounts, displaying
 488  * mount options, or whatever.
 489  */
 490 static int selinux_get_mnt_opts(const struct super_block *sb,
 491                                 struct security_mnt_opts *opts)
 492 {
 493         int rc = 0, i;
 494         struct superblock_security_struct *sbsec = sb->s_security;
 495         char *context = NULL;
 496         u32 len;
 497         char tmp;
 498
 499         security_init_mnt_opts(opts);
 500
 501         if (!(sbsec->flags & SE_SBINITIALIZED))
 502                 return -EINVAL;
 503
 504         if (!ss_initialized)
 505                 return -EINVAL;
 506
 507         /* make sure we always check enough bits to cover the mask */
 508         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 509
 510         tmp = sbsec->flags & SE_MNTMASK;
 511         /* count the number of mount options for this sb */
 512         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 513                 if (tmp & 0x01)
 514                         opts->num_mnt_opts++;
 515                 tmp >>= 1;
 516         }
 517         /* Check if the Label support flag is set */
 518         if (sbsec->flags & SBLABEL_MNT)
 519                 opts->num_mnt_opts++;
 520
 521         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 522         if (!opts->mnt_opts) {
 523                 rc = -ENOMEM;
 524                 goto out_free;
 525         }
 526
 527         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 528         if (!opts->mnt_opts_flags) {
 529                 rc = -ENOMEM;
 530                 goto out_free;
 531         }
 532
 533         i = 0;
 534         if (sbsec->flags & FSCONTEXT_MNT) {
 535                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 536                 if (rc)
 537                         goto out_free;
 538                 opts->mnt_opts[i] = context;
 539                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 540         }
 541         if (sbsec->flags & CONTEXT_MNT) {
 542                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 543                 if (rc)
 544                         goto out_free;
 545                 opts->mnt_opts[i] = context;
 546                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 547         }
 548         if (sbsec->flags & DEFCONTEXT_MNT) {
 549                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 550                 if (rc)
 551                         goto out_free;
 552                 opts->mnt_opts[i] = context;
 553                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 554         }
 555         if (sbsec->flags & ROOTCONTEXT_MNT) {
 556                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 557                 struct inode_security_struct *isec = root->i_security;
 558
 559                 rc = security_sid_to_context(isec->sid, &context, &len);
 560                 if (rc)
 561                         goto out_free;
 562                 opts->mnt_opts[i] = context;
 563                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 564         }
 565         if (sbsec->flags & SBLABEL_MNT) {
 566                 opts->mnt_opts[i] = NULL;
 567                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 568         }
 569
 570         BUG_ON(i != opts->num_mnt_opts);
 571
 572         return 0;
 573
 574 out_free:
 575         security_free_mnt_opts(opts);
 576         return rc;
 577 }
 578
 579 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 580                       u32 old_sid, u32 new_sid)
 581 {
 582         char mnt_flags = sbsec->flags & SE_MNTMASK;
 583
 584         /* check if the old mount command had the same options */
 585         if (sbsec->flags & SE_SBINITIALIZED)
 586                 if (!(sbsec->flags & flag) ||
 587                     (old_sid != new_sid))
 588                         return 1;
 589
 590         /* check if we were passed the same options twice,
 591          * aka someone passed context=a,context=b
 592          */
 593         if (!(sbsec->flags & SE_SBINITIALIZED))
 594                 if (mnt_flags & flag)
 595                         return 1;
 596         return 0;
 597 }
 598
 599 /*
 600  * Allow filesystems with binary mount data to explicitly set mount point
 601  * labeling information.
 602  */
 603 static int selinux_set_mnt_opts(struct super_block *sb,
 604                                 struct security_mnt_opts *opts,
 605                                 unsigned long kern_flags,
 606                                 unsigned long *set_kern_flags)
 607 {
 608         const struct cred *cred = current_cred();
 609         int rc = 0, i;
 610         struct superblock_security_struct *sbsec = sb->s_security;
 611         const char *name = sb->s_type->name;
 612         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 613         struct inode_security_struct *root_isec = inode->i_security;
 614         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 615         u32 defcontext_sid = 0;
 616         char **mount_options = opts->mnt_opts;
 617         int *flags = opts->mnt_opts_flags;
 618         int num_opts = opts->num_mnt_opts;
 619
 620         mutex_lock(&sbsec->lock);
 621
 622         if (!ss_initialized) {
 623                 if (!num_opts) {
 624                         /* Defer initialization until selinux_complete_init,
 625                            after the initial policy is loaded and the security
 626                            server is ready to handle calls. */
 627                         goto out;
 628                 }
 629                 rc = -EINVAL;
 630                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 631                         "before the security server is initialized\n");
 632                 goto out;
 633         }
 634         if (kern_flags && !set_kern_flags) {
 635                 /* Specifying internal flags without providing a place to
 636                  * place the results is not allowed */
 637                 rc = -EINVAL;
 638                 goto out;
 639         }
 640
 641         /*
 642          * Binary mount data FS will come through this function twice.  Once
 643          * from an explicit call and once from the generic calls from the vfs.
 644          * Since the generic VFS calls will not contain any security mount data
 645          * we need to skip the double mount verification.
 646          *
 647          * This does open a hole in which we will not notice if the first
 648          * mount using this sb set explict options and a second mount using
 649          * this sb does not set any security options.  (The first options
 650          * will be used for both mounts)
 651          */
 652         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 653             && (num_opts == 0))
 654                 goto out;
 655
 656         /*
 657          * parse the mount options, check if they are valid sids.
 658          * also check if someone is trying to mount the same sb more
 659          * than once with different security options.
 660          */
 661         for (i = 0; i < num_opts; i++) {
 662                 u32 sid;
 663
 664                 if (flags[i] == SBLABEL_MNT)
 665                         continue;
 666                 rc = security_context_to_sid(mount_options[i],
 667                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 668                 if (rc) {
 669                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 670                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 671                                mount_options[i], sb->s_id, name, rc);
 672                         goto out;
 673                 }
 674                 switch (flags[i]) {
 675                 case FSCONTEXT_MNT:
 676                         fscontext_sid = sid;
 677
 678                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 679                                         fscontext_sid))
 680                                 goto out_double_mount;
 681
 682                         sbsec->flags |= FSCONTEXT_MNT;
 683                         break;
 684                 case CONTEXT_MNT:
 685                         context_sid = sid;
 686
 687                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 688                                         context_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= CONTEXT_MNT;
 692                         break;
 693                 case ROOTCONTEXT_MNT:
 694                         rootcontext_sid = sid;
 695
 696                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 697                                         rootcontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= ROOTCONTEXT_MNT;
 701
 702                         break;
 703                 case DEFCONTEXT_MNT:
 704                         defcontext_sid = sid;
 705
 706                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 707                                         defcontext_sid))
 708                                 goto out_double_mount;
 709
 710                         sbsec->flags |= DEFCONTEXT_MNT;
 711
 712                         break;
 713                 default:
 714                         rc = -EINVAL;
 715                         goto out;
 716                 }
 717         }
 718
 719         if (sbsec->flags & SE_SBINITIALIZED) {
 720                 /* previously mounted with options, but not on this attempt? */
 721                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 722                         goto out_double_mount;
 723                 rc = 0;
 724                 goto out;
 725         }
 726
 727         if (strcmp(sb->s_type->name, "proc") == 0)
 728                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 729
 730         if (!strcmp(sb->s_type->name, "debugfs") ||
 731             !strcmp(sb->s_type->name, "sysfs") ||
 732             !strcmp(sb->s_type->name, "pstore"))
 733                 sbsec->flags |= SE_SBGENFS;
 734
 735         if (!sbsec->behavior) {
 736                 /*
 737                  * Determine the labeling behavior to use for this
 738                  * filesystem type.
 739                  */
 740                 rc = security_fs_use(sb);
 741                 if (rc) {
 742                         printk(KERN_WARNING
 743                                 "%s: security_fs_use(%s) returned %d\n",
 744                                         __func__, sb->s_type->name, rc);
 745                         goto out;
 746                 }
 747         }
 748         /* sets the context of the superblock for the fs being mounted. */
 749         if (fscontext_sid) {
 750                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 751                 if (rc)
 752                         goto out;
 753
 754                 sbsec->sid = fscontext_sid;
 755         }
 756
 757         /*
 758          * Switch to using mount point labeling behavior.
 759          * sets the label used on all file below the mountpoint, and will set
 760          * the superblock context if not already set.
 761          */
 762         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 763                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 764                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 765         }
 766
 767         if (context_sid) {
 768                 if (!fscontext_sid) {
 769                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 770                                                           cred);
 771                         if (rc)
 772                                 goto out;
 773                         sbsec->sid = context_sid;
 774                 } else {
 775                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 776                                                              cred);
 777                         if (rc)
 778                                 goto out;
 779                 }
 780                 if (!rootcontext_sid)
 781                         rootcontext_sid = context_sid;
 782
 783                 sbsec->mntpoint_sid = context_sid;
 784                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 785         }
 786
 787         if (rootcontext_sid) {
 788                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 789                                                      cred);
 790                 if (rc)
 791                         goto out;
 792
 793                 root_isec->sid = rootcontext_sid;
 794                 root_isec->initialized = 1;
 795         }
 796
 797         if (defcontext_sid) {
 798                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 799                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 800                         rc = -EINVAL;
 801                         printk(KERN_WARNING "SELinux: defcontext option is "
 802                                "invalid for this filesystem type\n");
 803                         goto out;
 804                 }
 805
 806                 if (defcontext_sid != sbsec->def_sid) {
 807                         rc = may_context_mount_inode_relabel(defcontext_sid,
 808                                                              sbsec, cred);
 809                         if (rc)
 810                                 goto out;
 811                 }
 812
 813                 sbsec->def_sid = defcontext_sid;
 814         }
 815
 816         rc = sb_finish_set_opts(sb);
 817 out:
 818         mutex_unlock(&sbsec->lock);
 819         return rc;
 820 out_double_mount:
 821         rc = -EINVAL;
 822         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 823                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 824         goto out;
 825 }
 826
 827 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 828                                     const struct super_block *newsb)
 829 {
 830         struct superblock_security_struct *old = oldsb->s_security;
 831         struct superblock_security_struct *new = newsb->s_security;
 832         char oldflags = old->flags & SE_MNTMASK;
 833         char newflags = new->flags & SE_MNTMASK;
 834
 835         if (oldflags != newflags)
 836                 goto mismatch;
 837         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 838                 goto mismatch;
 839         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 840                 goto mismatch;
 841         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 842                 goto mismatch;
 843         if (oldflags & ROOTCONTEXT_MNT) {
 844                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 845                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 846                 if (oldroot->sid != newroot->sid)
 847                         goto mismatch;
 848         }
 849         return 0;
 850 mismatch:
 851         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 852                             "different security settings for (dev %s, "
 853                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 854         return -EBUSY;
 855 }
 856
 857 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 858                                         struct super_block *newsb)
 859 {
 860         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 861         struct superblock_security_struct *newsbsec = newsb->s_security;
 862
 863         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 864         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 865         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 866
 867         /*
 868          * if the parent was able to be mounted it clearly had no special lsm
 869          * mount options.  thus we can safely deal with this superblock later
 870          */
 871         if (!ss_initialized)
 872                 return 0;
 873
 874         /* how can we clone if the old one wasn't set up?? */
 875         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 876
 877         /* if fs is reusing a sb, make sure that the contexts match */
 878         if (newsbsec->flags & SE_SBINITIALIZED)
 879                 return selinux_cmp_sb_context(oldsb, newsb);
 880
 881         mutex_lock(&newsbsec->lock);
 882
 883         newsbsec->flags = oldsbsec->flags;
 884
 885         newsbsec->sid = oldsbsec->sid;
 886         newsbsec->def_sid = oldsbsec->def_sid;
 887         newsbsec->behavior = oldsbsec->behavior;
 888
 889         if (set_context) {
 890                 u32 sid = oldsbsec->mntpoint_sid;
 891
 892                 if (!set_fscontext)
 893                         newsbsec->sid = sid;
 894                 if (!set_rootcontext) {
 895                         struct inode *newinode = d_backing_inode(newsb->s_root);
 896                         struct inode_security_struct *newisec = newinode->i_security;
 897                         newisec->sid = sid;
 898                 }
 899                 newsbsec->mntpoint_sid = sid;
 900         }
 901         if (set_rootcontext) {
 902                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 903                 const struct inode_security_struct *oldisec = oldinode->i_security;
 904                 struct inode *newinode = d_backing_inode(newsb->s_root);
 905                 struct inode_security_struct *newisec = newinode->i_security;
 906
 907                 newisec->sid = oldisec->sid;
 908         }
 909
 910         sb_finish_set_opts(newsb);
 911         mutex_unlock(&newsbsec->lock);
 912         return 0;
 913 }
 914
 915 static int selinux_parse_opts_str(char *options,
 916                                   struct security_mnt_opts *opts)
 917 {
 918         char *p;
 919         char *context = NULL, *defcontext = NULL;
 920         char *fscontext = NULL, *rootcontext = NULL;
 921         int rc, num_mnt_opts = 0;
 922
 923         opts->num_mnt_opts = 0;
 924
 925         /* Standard string-based options. */
 926         while ((p = strsep(&options, "|")) != NULL) {
 927                 int token;
 928                 substring_t args[MAX_OPT_ARGS];
 929
 930                 if (!*p)
 931                         continue;
 932
 933                 token = match_token(p, tokens, args);
 934
 935                 switch (token) {
 936                 case Opt_context:
 937                         if (context || defcontext) {
 938                                 rc = -EINVAL;
 939                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 940                                 goto out_err;
 941                         }
 942                         context = match_strdup(&args[0]);
 943                         if (!context) {
 944                                 rc = -ENOMEM;
 945                                 goto out_err;
 946                         }
 947                         break;
 948
 949                 case Opt_fscontext:
 950                         if (fscontext) {
 951                                 rc = -EINVAL;
 952                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 953                                 goto out_err;
 954                         }
 955                         fscontext = match_strdup(&args[0]);
 956                         if (!fscontext) {
 957                                 rc = -ENOMEM;
 958                                 goto out_err;
 959                         }
 960                         break;
 961
 962                 case Opt_rootcontext:
 963                         if (rootcontext) {
 964                                 rc = -EINVAL;
 965                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 966                                 goto out_err;
 967                         }
 968                         rootcontext = match_strdup(&args[0]);
 969                         if (!rootcontext) {
 970                                 rc = -ENOMEM;
 971                                 goto out_err;
 972                         }
 973                         break;
 974
 975                 case Opt_defcontext:
 976                         if (context || defcontext) {
 977                                 rc = -EINVAL;
 978                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 979                                 goto out_err;
 980                         }
 981                         defcontext = match_strdup(&args[0]);
 982                         if (!defcontext) {
 983                                 rc = -ENOMEM;
 984                                 goto out_err;
 985                         }
 986                         break;
 987                 case Opt_labelsupport:
 988                         break;
 989                 default:
 990                         rc = -EINVAL;
 991                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 992                         goto out_err;
 993
 994                 }
 995         }
 996
 997         rc = -ENOMEM;
 998         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 999         if (!opts->mnt_opts)
1000                 goto out_err;
1001
1002         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1003         if (!opts->mnt_opts_flags) {
1004                 kfree(opts->mnt_opts);
1005                 goto out_err;
1006         }
1007
1008         if (fscontext) {
1009                 opts->mnt_opts[num_mnt_opts] = fscontext;
1010                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1011         }
1012         if (context) {
1013                 opts->mnt_opts[num_mnt_opts] = context;
1014                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1015         }
1016         if (rootcontext) {
1017                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1018                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1019         }
1020         if (defcontext) {
1021                 opts->mnt_opts[num_mnt_opts] = defcontext;
1022                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1023         }
1024
1025         opts->num_mnt_opts = num_mnt_opts;
1026         return 0;
1027
1028 out_err:
1029         kfree(context);
1030         kfree(defcontext);
1031         kfree(fscontext);
1032         kfree(rootcontext);
1033         return rc;
1034 }
1035 /*
1036  * string mount options parsing and call set the sbsec
1037  */
1038 static int superblock_doinit(struct super_block *sb, void *data)
1039 {
1040         int rc = 0;
1041         char *options = data;
1042         struct security_mnt_opts opts;
1043
1044         security_init_mnt_opts(&opts);
1045
1046         if (!data)
1047                 goto out;
1048
1049         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1050
1051         rc = selinux_parse_opts_str(options, &opts);
1052         if (rc)
1053                 goto out_err;
1054
1055 out:
1056         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1057
1058 out_err:
1059         security_free_mnt_opts(&opts);
1060         return rc;
1061 }
1062
1063 static void selinux_write_opts(struct seq_file *m,
1064                                struct security_mnt_opts *opts)
1065 {
1066         int i;
1067         char *prefix;
1068
1069         for (i = 0; i < opts->num_mnt_opts; i++) {
1070                 char *has_comma;
1071
1072                 if (opts->mnt_opts[i])
1073                         has_comma = strchr(opts->mnt_opts[i], ',');
1074                 else
1075                         has_comma = NULL;
1076
1077                 switch (opts->mnt_opts_flags[i]) {
1078                 case CONTEXT_MNT:
1079                         prefix = CONTEXT_STR;
1080                         break;
1081                 case FSCONTEXT_MNT:
1082                         prefix = FSCONTEXT_STR;
1083                         break;
1084                 case ROOTCONTEXT_MNT:
1085                         prefix = ROOTCONTEXT_STR;
1086                         break;
1087                 case DEFCONTEXT_MNT:
1088                         prefix = DEFCONTEXT_STR;
1089                         break;
1090                 case SBLABEL_MNT:
1091                         seq_putc(m, ',');
1092                         seq_puts(m, LABELSUPP_STR);
1093                         continue;
1094                 default:
1095                         BUG();
1096                         return;
1097                 };
1098                 /* we need a comma before each option */
1099                 seq_putc(m, ',');
1100                 seq_puts(m, prefix);
1101                 if (has_comma)
1102                         seq_putc(m, '\"');
1103                 seq_puts(m, opts->mnt_opts[i]);
1104                 if (has_comma)
1105                         seq_putc(m, '\"');
1106         }
1107 }
1108
1109 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1110 {
1111         struct security_mnt_opts opts;
1112         int rc;
1113
1114         rc = selinux_get_mnt_opts(sb, &opts);
1115         if (rc) {
1116                 /* before policy load we may get EINVAL, don't show anything */
1117                 if (rc == -EINVAL)
1118                         rc = 0;
1119                 return rc;
1120         }
1121
1122         selinux_write_opts(m, &opts);
1123
1124         security_free_mnt_opts(&opts);
1125
1126         return rc;
1127 }
1128
1129 static inline u16 inode_mode_to_security_class(umode_t mode)
1130 {
1131         switch (mode & S_IFMT) {
1132         case S_IFSOCK:
1133                 return SECCLASS_SOCK_FILE;
1134         case S_IFLNK:
1135                 return SECCLASS_LNK_FILE;
1136         case S_IFREG:
1137                 return SECCLASS_FILE;
1138         case S_IFBLK:
1139                 return SECCLASS_BLK_FILE;
1140         case S_IFDIR:
1141                 return SECCLASS_DIR;
1142         case S_IFCHR:
1143                 return SECCLASS_CHR_FILE;
1144         case S_IFIFO:
1145                 return SECCLASS_FIFO_FILE;
1146
1147         }
1148
1149         return SECCLASS_FILE;
1150 }
1151
1152 static inline int default_protocol_stream(int protocol)
1153 {
1154         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1155 }
1156
1157 static inline int default_protocol_dgram(int protocol)
1158 {
1159         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1160 }
1161
1162 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1163 {
1164         switch (family) {
1165         case PF_UNIX:
1166                 switch (type) {
1167                 case SOCK_STREAM:
1168                 case SOCK_SEQPACKET:
1169                         return SECCLASS_UNIX_STREAM_SOCKET;
1170                 case SOCK_DGRAM:
1171                         return SECCLASS_UNIX_DGRAM_SOCKET;
1172                 }
1173                 break;
1174         case PF_INET:
1175         case PF_INET6:
1176                 switch (type) {
1177                 case SOCK_STREAM:
1178                         if (default_protocol_stream(protocol))
1179                                 return SECCLASS_TCP_SOCKET;
1180                         else
1181                                 return SECCLASS_RAWIP_SOCKET;
1182                 case SOCK_DGRAM:
1183                         if (default_protocol_dgram(protocol))
1184                                 return SECCLASS_UDP_SOCKET;
1185                         else
1186                                 return SECCLASS_RAWIP_SOCKET;
1187                 case SOCK_DCCP:
1188                         return SECCLASS_DCCP_SOCKET;
1189                 default:
1190                         return SECCLASS_RAWIP_SOCKET;
1191                 }
1192                 break;
1193         case PF_NETLINK:
1194                 switch (protocol) {
1195                 case NETLINK_ROUTE:
1196                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1197                 case NETLINK_SOCK_DIAG:
1198                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1199                 case NETLINK_NFLOG:
1200                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1201                 case NETLINK_XFRM:
1202                         return SECCLASS_NETLINK_XFRM_SOCKET;
1203                 case NETLINK_SELINUX:
1204                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1205                 case NETLINK_ISCSI:
1206                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1207                 case NETLINK_AUDIT:
1208                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1209                 case NETLINK_FIB_LOOKUP:
1210                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1211                 case NETLINK_CONNECTOR:
1212                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1213                 case NETLINK_NETFILTER:
1214                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1215                 case NETLINK_DNRTMSG:
1216                         return SECCLASS_NETLINK_DNRT_SOCKET;
1217                 case NETLINK_KOBJECT_UEVENT:
1218                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1219                 case NETLINK_GENERIC:
1220                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1221                 case NETLINK_SCSITRANSPORT:
1222                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1223                 case NETLINK_RDMA:
1224                         return SECCLASS_NETLINK_RDMA_SOCKET;
1225                 case NETLINK_CRYPTO:
1226                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1227                 default:
1228                         return SECCLASS_NETLINK_SOCKET;
1229                 }
1230         case PF_PACKET:
1231                 return SECCLASS_PACKET_SOCKET;
1232         case PF_KEY:
1233                 return SECCLASS_KEY_SOCKET;
1234         case PF_APPLETALK:
1235                 return SECCLASS_APPLETALK_SOCKET;
1236         }
1237
1238         return SECCLASS_SOCKET;
1239 }
1240
1241 static int selinux_genfs_get_sid(struct dentry *dentry,
1242                                  u16 tclass,
1243                                  u16 flags,
1244                                  u32 *sid)
1245 {
1246         int rc;
1247         struct super_block *sb = dentry->d_inode->i_sb;
1248         char *buffer, *path;
1249
1250         buffer = (char *)__get_free_page(GFP_KERNEL);
1251         if (!buffer)
1252                 return -ENOMEM;
1253
1254         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1255         if (IS_ERR(path))
1256                 rc = PTR_ERR(path);
1257         else {
1258                 if (flags & SE_SBPROC) {
1259                         /* each process gets a /proc/PID/ entry. Strip off the
1260                          * PID part to get a valid selinux labeling.
1261                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1262                         while (path[1] >= '0' && path[1] <= '9') {
1263                                 path[1] = '/';
1264                                 path++;
1265                         }
1266                 }
1267                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1268         }
1269         free_page((unsigned long)buffer);
1270         return rc;
1271 }
1272
1273 /* The inode's security attributes must be initialized before first use. */
1274 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1275 {
1276         struct superblock_security_struct *sbsec = NULL;
1277         struct inode_security_struct *isec = inode->i_security;
1278         u32 sid;
1279         struct dentry *dentry;
1280 #define INITCONTEXTLEN 255
1281         char *context = NULL;
1282         unsigned len = 0;
1283         int rc = 0;
1284
1285         if (isec->initialized)
1286                 goto out;
1287
1288         mutex_lock(&isec->lock);
1289         if (isec->initialized)
1290                 goto out_unlock;
1291
1292         sbsec = inode->i_sb->s_security;
1293         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1294                 /* Defer initialization until selinux_complete_init,
1295                    after the initial policy is loaded and the security
1296                    server is ready to handle calls. */
1297                 spin_lock(&sbsec->isec_lock);
1298                 if (list_empty(&isec->list))
1299                         list_add(&isec->list, &sbsec->isec_head);
1300                 spin_unlock(&sbsec->isec_lock);
1301                 goto out_unlock;
1302         }
1303
1304         switch (sbsec->behavior) {
1305         case SECURITY_FS_USE_NATIVE:
1306                 break;
1307         case SECURITY_FS_USE_XATTR:
1308                 if (!inode->i_op->getxattr) {
1309                         isec->sid = sbsec->def_sid;
1310                         break;
1311                 }
1312
1313                 /* Need a dentry, since the xattr API requires one.
1314                    Life would be simpler if we could just pass the inode. */
1315                 if (opt_dentry) {
1316                         /* Called from d_instantiate or d_splice_alias. */
1317                         dentry = dget(opt_dentry);
1318                 } else {
1319                         /* Called from selinux_complete_init, try to find a dentry. */
1320                         dentry = d_find_alias(inode);
1321                 }
1322                 if (!dentry) {
1323                         /*
1324                          * this is can be hit on boot when a file is accessed
1325                          * before the policy is loaded.  When we load policy we
1326                          * may find inodes that have no dentry on the
1327                          * sbsec->isec_head list.  No reason to complain as these
1328                          * will get fixed up the next time we go through
1329                          * inode_doinit with a dentry, before these inodes could
1330                          * be used again by userspace.
1331                          */
1332                         goto out_unlock;
1333                 }
1334
1335                 len = INITCONTEXTLEN;
1336                 context = kmalloc(len+1, GFP_NOFS);
1337                 if (!context) {
1338                         rc = -ENOMEM;
1339                         dput(dentry);
1340                         goto out_unlock;
1341                 }
1342                 context[len] = '\0';
1343                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1344                                            context, len);
1345                 if (rc == -ERANGE) {
1346                         kfree(context);
1347
1348                         /* Need a larger buffer.  Query for the right size. */
1349                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1350                                                    NULL, 0);
1351                         if (rc < 0) {
1352                                 dput(dentry);
1353                                 goto out_unlock;
1354                         }
1355                         len = rc;
1356                         context = kmalloc(len+1, GFP_NOFS);
1357                         if (!context) {
1358                                 rc = -ENOMEM;
1359                                 dput(dentry);
1360                                 goto out_unlock;
1361                         }
1362                         context[len] = '\0';
1363                         rc = inode->i_op->getxattr(dentry,
1364                                                    XATTR_NAME_SELINUX,
1365                                                    context, len);
1366                 }
1367                 dput(dentry);
1368                 if (rc < 0) {
1369                         if (rc != -ENODATA) {
1370                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1371                                        "%d for dev=%s ino=%ld\n", __func__,
1372                                        -rc, inode->i_sb->s_id, inode->i_ino);
1373                                 kfree(context);
1374                                 goto out_unlock;
1375                         }
1376                         /* Map ENODATA to the default file SID */
1377                         sid = sbsec->def_sid;
1378                         rc = 0;
1379                 } else {
1380                         rc = security_context_to_sid_default(context, rc, &sid,
1381                                                              sbsec->def_sid,
1382                                                              GFP_NOFS);
1383                         if (rc) {
1384                                 char *dev = inode->i_sb->s_id;
1385                                 unsigned long ino = inode->i_ino;
1386
1387                                 if (rc == -EINVAL) {
1388                                         if (printk_ratelimit())
1389                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1390                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1391                                                         "filesystem in question.\n", ino, dev, context);
1392                                 } else {
1393                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1394                                                "returned %d for dev=%s ino=%ld\n",
1395                                                __func__, context, -rc, dev, ino);
1396                                 }
1397                                 kfree(context);
1398                                 /* Leave with the unlabeled SID */
1399                                 rc = 0;
1400                                 break;
1401                         }
1402                 }
1403                 kfree(context);
1404                 isec->sid = sid;
1405                 break;
1406         case SECURITY_FS_USE_TASK:
1407                 isec->sid = isec->task_sid;
1408                 break;
1409         case SECURITY_FS_USE_TRANS:
1410                 /* Default to the fs SID. */
1411                 isec->sid = sbsec->sid;
1412
1413                 /* Try to obtain a transition SID. */
1414                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1415                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1416                                              isec->sclass, NULL, &sid);
1417                 if (rc)
1418                         goto out_unlock;
1419                 isec->sid = sid;
1420                 break;
1421         case SECURITY_FS_USE_MNTPOINT:
1422                 isec->sid = sbsec->mntpoint_sid;
1423                 break;
1424         default:
1425                 /* Default to the fs superblock SID. */
1426                 isec->sid = sbsec->sid;
1427
1428                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1429                         /* We must have a dentry to determine the label on
1430                          * procfs inodes */
1431                         if (opt_dentry)
1432                                 /* Called from d_instantiate or
1433                                  * d_splice_alias. */
1434                                 dentry = dget(opt_dentry);
1435                         else
1436                                 /* Called from selinux_complete_init, try to
1437                                  * find a dentry. */
1438                                 dentry = d_find_alias(inode);
1439                         /*
1440                          * This can be hit on boot when a file is accessed
1441                          * before the policy is loaded.  When we load policy we
1442                          * may find inodes that have no dentry on the
1443                          * sbsec->isec_head list.  No reason to complain as
1444                          * these will get fixed up the next time we go through
1445                          * inode_doinit() with a dentry, before these inodes
1446                          * could be used again by userspace.
1447                          */
1448                         if (!dentry)
1449                                 goto out_unlock;
1450                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1451                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1452                                                    sbsec->flags, &sid);
1453                         dput(dentry);
1454                         if (rc)
1455                                 goto out_unlock;
1456                         isec->sid = sid;
1457                 }
1458                 break;
1459         }
1460
1461         isec->initialized = 1;
1462
1463 out_unlock:
1464         mutex_unlock(&isec->lock);
1465 out:
1466         if (isec->sclass == SECCLASS_FILE)
1467                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1468         return rc;
1469 }
1470
1471 /* Convert a Linux signal to an access vector. */
1472 static inline u32 signal_to_av(int sig)
1473 {
1474         u32 perm = 0;
1475
1476         switch (sig) {
1477         case SIGCHLD:
1478                 /* Commonly granted from child to parent. */
1479                 perm = PROCESS__SIGCHLD;
1480                 break;
1481         case SIGKILL:
1482                 /* Cannot be caught or ignored */
1483                 perm = PROCESS__SIGKILL;
1484                 break;
1485         case SIGSTOP:
1486                 /* Cannot be caught or ignored */
1487                 perm = PROCESS__SIGSTOP;
1488                 break;
1489         default:
1490                 /* All other signals. */
1491                 perm = PROCESS__SIGNAL;
1492                 break;
1493         }
1494
1495         return perm;
1496 }
1497
1498 /*
1499  * Check permission between a pair of credentials
1500  * fork check, ptrace check, etc.
1501  */
1502 static int cred_has_perm(const struct cred *actor,
1503                          const struct cred *target,
1504                          u32 perms)
1505 {
1506         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1507
1508         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1509 }
1510
1511 /*
1512  * Check permission between a pair of tasks, e.g. signal checks,
1513  * fork check, ptrace check, etc.
1514  * tsk1 is the actor and tsk2 is the target
1515  * - this uses the default subjective creds of tsk1
1516  */
1517 static int task_has_perm(const struct task_struct *tsk1,
1518                          const struct task_struct *tsk2,
1519                          u32 perms)
1520 {
1521         const struct task_security_struct *__tsec1, *__tsec2;
1522         u32 sid1, sid2;
1523
1524         rcu_read_lock();
1525         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1526         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1527         rcu_read_unlock();
1528         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1529 }
1530
1531 /*
1532  * Check permission between current and another task, e.g. signal checks,
1533  * fork check, ptrace check, etc.
1534  * current is the actor and tsk2 is the target
1535  * - this uses current's subjective creds
1536  */
1537 static int current_has_perm(const struct task_struct *tsk,
1538                             u32 perms)
1539 {
1540         u32 sid, tsid;
1541
1542         sid = current_sid();
1543         tsid = task_sid(tsk);
1544         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1545 }
1546
1547 #if CAP_LAST_CAP > 63
1548 #error Fix SELinux to handle capabilities > 63.
1549 #endif
1550
1551 /* Check whether a task is allowed to use a capability. */
1552 static int cred_has_capability(const struct cred *cred,
1553                                int cap, int audit)
1554 {
1555         struct common_audit_data ad;
1556         struct av_decision avd;
1557         u16 sclass;
1558         u32 sid = cred_sid(cred);
1559         u32 av = CAP_TO_MASK(cap);
1560         int rc;
1561
1562         ad.type = LSM_AUDIT_DATA_CAP;
1563         ad.u.cap = cap;
1564
1565         switch (CAP_TO_INDEX(cap)) {
1566         case 0:
1567                 sclass = SECCLASS_CAPABILITY;
1568                 break;
1569         case 1:
1570                 sclass = SECCLASS_CAPABILITY2;
1571                 break;
1572         default:
1573                 printk(KERN_ERR
1574                        "SELinux:  out of range capability %d\n", cap);
1575                 BUG();
1576                 return -EINVAL;
1577         }
1578
1579         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1580         if (audit == SECURITY_CAP_AUDIT) {
1581                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1582                 if (rc2)
1583                         return rc2;
1584         }
1585         return rc;
1586 }
1587
1588 /* Check whether a task is allowed to use a system operation. */
1589 static int task_has_system(struct task_struct *tsk,
1590                            u32 perms)
1591 {
1592         u32 sid = task_sid(tsk);
1593
1594         return avc_has_perm(sid, SECINITSID_KERNEL,
1595                             SECCLASS_SYSTEM, perms, NULL);
1596 }
1597
1598 /* Check whether a task has a particular permission to an inode.
1599    The 'adp' parameter is optional and allows other audit
1600    data to be passed (e.g. the dentry). */
1601 static int inode_has_perm(const struct cred *cred,
1602                           struct inode *inode,
1603                           u32 perms,
1604                           struct common_audit_data *adp)
1605 {
1606         struct inode_security_struct *isec;
1607         u32 sid;
1608
1609         validate_creds(cred);
1610
1611         if (unlikely(IS_PRIVATE(inode)))
1612                 return 0;
1613
1614         sid = cred_sid(cred);
1615         isec = inode->i_security;
1616
1617         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1618 }
1619
1620 /* Same as inode_has_perm, but pass explicit audit data containing
1621    the dentry to help the auditing code to more easily generate the
1622    pathname if needed. */
1623 static inline int dentry_has_perm(const struct cred *cred,
1624                                   struct dentry *dentry,
1625                                   u32 av)
1626 {
1627         struct inode *inode = d_backing_inode(dentry);
1628         struct common_audit_data ad;
1629
1630         ad.type = LSM_AUDIT_DATA_DENTRY;
1631         ad.u.dentry = dentry;
1632         return inode_has_perm(cred, inode, av, &ad);
1633 }
1634
1635 /* Same as inode_has_perm, but pass explicit audit data containing
1636    the path to help the auditing code to more easily generate the
1637    pathname if needed. */
1638 static inline int path_has_perm(const struct cred *cred,
1639                                 const struct path *path,
1640                                 u32 av)
1641 {
1642         struct inode *inode = d_backing_inode(path->dentry);
1643         struct common_audit_data ad;
1644
1645         ad.type = LSM_AUDIT_DATA_PATH;
1646         ad.u.path = *path;
1647         return inode_has_perm(cred, inode, av, &ad);
1648 }
1649
1650 /* Same as path_has_perm, but uses the inode from the file struct. */
1651 static inline int file_path_has_perm(const struct cred *cred,
1652                                      struct file *file,
1653                                      u32 av)
1654 {
1655         struct common_audit_data ad;
1656
1657         ad.type = LSM_AUDIT_DATA_PATH;
1658         ad.u.path = file->f_path;
1659         return inode_has_perm(cred, file_inode(file), av, &ad);
1660 }
1661
1662 /* Check whether a task can use an open file descriptor to
1663    access an inode in a given way.  Check access to the
1664    descriptor itself, and then use dentry_has_perm to
1665    check a particular permission to the file.
1666    Access to the descriptor is implicitly granted if it
1667    has the same SID as the process.  If av is zero, then
1668    access to the file is not checked, e.g. for cases
1669    where only the descriptor is affected like seek. */
1670 static int file_has_perm(const struct cred *cred,
1671                          struct file *file,
1672                          u32 av)
1673 {
1674         struct file_security_struct *fsec = file->f_security;
1675         struct inode *inode = file_inode(file);
1676         struct common_audit_data ad;
1677         u32 sid = cred_sid(cred);
1678         int rc;
1679
1680         ad.type = LSM_AUDIT_DATA_PATH;
1681         ad.u.path = file->f_path;
1682
1683         if (sid != fsec->sid) {
1684                 rc = avc_has_perm(sid, fsec->sid,
1685                                   SECCLASS_FD,
1686                                   FD__USE,
1687                                   &ad);
1688                 if (rc)
1689                         goto out;
1690         }
1691
1692         /* av is zero if only checking access to the descriptor. */
1693         rc = 0;
1694         if (av)
1695                 rc = inode_has_perm(cred, inode, av, &ad);
1696
1697 out:
1698         return rc;
1699 }
1700
1701 /* Check whether a task can create a file. */
1702 static int may_create(struct inode *dir,
1703                       struct dentry *dentry,
1704                       u16 tclass)
1705 {
1706         const struct task_security_struct *tsec = current_security();
1707         struct inode_security_struct *dsec;
1708         struct superblock_security_struct *sbsec;
1709         u32 sid, newsid;
1710         struct common_audit_data ad;
1711         int rc;
1712
1713         dsec = dir->i_security;
1714         sbsec = dir->i_sb->s_security;
1715
1716         sid = tsec->sid;
1717         newsid = tsec->create_sid;
1718
1719         ad.type = LSM_AUDIT_DATA_DENTRY;
1720         ad.u.dentry = dentry;
1721
1722         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1723                           DIR__ADD_NAME | DIR__SEARCH,
1724                           &ad);
1725         if (rc)
1726                 return rc;
1727
1728         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1729                 rc = security_transition_sid(sid, dsec->sid, tclass,
1730                                              &dentry->d_name, &newsid);
1731                 if (rc)
1732                         return rc;
1733         }
1734
1735         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1736         if (rc)
1737                 return rc;
1738
1739         return avc_has_perm(newsid, sbsec->sid,
1740                             SECCLASS_FILESYSTEM,
1741                             FILESYSTEM__ASSOCIATE, &ad);
1742 }
1743
1744 /* Check whether a task can create a key. */
1745 static int may_create_key(u32 ksid,
1746                           struct task_struct *ctx)
1747 {
1748         u32 sid = task_sid(ctx);
1749
1750         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1751 }
1752
1753 #define MAY_LINK        0
1754 #define MAY_UNLINK      1
1755 #define MAY_RMDIR       2
1756
1757 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1758 static int may_link(struct inode *dir,
1759                     struct dentry *dentry,
1760                     int kind)
1761
1762 {
1763         struct inode_security_struct *dsec, *isec;
1764         struct common_audit_data ad;
1765         u32 sid = current_sid();
1766         u32 av;
1767         int rc;
1768
1769         dsec = dir->i_security;
1770         isec = d_backing_inode(dentry)->i_security;
1771
1772         ad.type = LSM_AUDIT_DATA_DENTRY;
1773         ad.u.dentry = dentry;
1774
1775         av = DIR__SEARCH;
1776         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1777         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1778         if (rc)
1779                 return rc;
1780
1781         switch (kind) {
1782         case MAY_LINK:
1783                 av = FILE__LINK;
1784                 break;
1785         case MAY_UNLINK:
1786                 av = FILE__UNLINK;
1787                 break;
1788         case MAY_RMDIR:
1789                 av = DIR__RMDIR;
1790                 break;
1791         default:
1792                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1793                         __func__, kind);
1794                 return 0;
1795         }
1796
1797         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1798         return rc;
1799 }
1800
1801 static inline int may_rename(struct inode *old_dir,
1802                              struct dentry *old_dentry,
1803                              struct inode *new_dir,
1804                              struct dentry *new_dentry)
1805 {
1806         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1807         struct common_audit_data ad;
1808         u32 sid = current_sid();
1809         u32 av;
1810         int old_is_dir, new_is_dir;
1811         int rc;
1812
1813         old_dsec = old_dir->i_security;
1814         old_isec = d_backing_inode(old_dentry)->i_security;
1815         old_is_dir = d_is_dir(old_dentry);
1816         new_dsec = new_dir->i_security;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819
1820         ad.u.dentry = old_dentry;
1821         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1822                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1823         if (rc)
1824                 return rc;
1825         rc = avc_has_perm(sid, old_isec->sid,
1826                           old_isec->sclass, FILE__RENAME, &ad);
1827         if (rc)
1828                 return rc;
1829         if (old_is_dir && new_dir != old_dir) {
1830                 rc = avc_has_perm(sid, old_isec->sid,
1831                                   old_isec->sclass, DIR__REPARENT, &ad);
1832                 if (rc)
1833                         return rc;
1834         }
1835
1836         ad.u.dentry = new_dentry;
1837         av = DIR__ADD_NAME | DIR__SEARCH;
1838         if (d_is_positive(new_dentry))
1839                 av |= DIR__REMOVE_NAME;
1840         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1841         if (rc)
1842                 return rc;
1843         if (d_is_positive(new_dentry)) {
1844                 new_isec = d_backing_inode(new_dentry)->i_security;
1845                 new_is_dir = d_is_dir(new_dentry);
1846                 rc = avc_has_perm(sid, new_isec->sid,
1847                                   new_isec->sclass,
1848                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1849                 if (rc)
1850                         return rc;
1851         }
1852
1853         return 0;
1854 }
1855
1856 /* Check whether a task can perform a filesystem operation. */
1857 static int superblock_has_perm(const struct cred *cred,
1858                                struct super_block *sb,
1859                                u32 perms,
1860                                struct common_audit_data *ad)
1861 {
1862         struct superblock_security_struct *sbsec;
1863         u32 sid = cred_sid(cred);
1864
1865         sbsec = sb->s_security;
1866         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1867 }
1868
1869 /* Convert a Linux mode and permission mask to an access vector. */
1870 static inline u32 file_mask_to_av(int mode, int mask)
1871 {
1872         u32 av = 0;
1873
1874         if (!S_ISDIR(mode)) {
1875                 if (mask & MAY_EXEC)
1876                         av |= FILE__EXECUTE;
1877                 if (mask & MAY_READ)
1878                         av |= FILE__READ;
1879
1880                 if (mask & MAY_APPEND)
1881                         av |= FILE__APPEND;
1882                 else if (mask & MAY_WRITE)
1883                         av |= FILE__WRITE;
1884
1885         } else {
1886                 if (mask & MAY_EXEC)
1887                         av |= DIR__SEARCH;
1888                 if (mask & MAY_WRITE)
1889                         av |= DIR__WRITE;
1890                 if (mask & MAY_READ)
1891                         av |= DIR__READ;
1892         }
1893
1894         return av;
1895 }
1896
1897 /* Convert a Linux file to an access vector. */
1898 static inline u32 file_to_av(struct file *file)
1899 {
1900         u32 av = 0;
1901
1902         if (file->f_mode & FMODE_READ)
1903                 av |= FILE__READ;
1904         if (file->f_mode & FMODE_WRITE) {
1905                 if (file->f_flags & O_APPEND)
1906                         av |= FILE__APPEND;
1907                 else
1908                         av |= FILE__WRITE;
1909         }
1910         if (!av) {
1911                 /*
1912                  * Special file opened with flags 3 for ioctl-only use.
1913                  */
1914                 av = FILE__IOCTL;
1915         }
1916
1917         return av;
1918 }
1919
1920 /*
1921  * Convert a file to an access vector and include the correct open
1922  * open permission.
1923  */
1924 static inline u32 open_file_to_av(struct file *file)
1925 {
1926         u32 av = file_to_av(file);
1927
1928         if (selinux_policycap_openperm)
1929                 av |= FILE__OPEN;
1930
1931         return av;
1932 }
1933
1934 /* Hook functions begin here. */
1935
1936 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1937 {
1938         u32 mysid = current_sid();
1939         u32 mgrsid = task_sid(mgr);
1940
1941         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1942                             BINDER__SET_CONTEXT_MGR, NULL);
1943 }
1944
1945 static int selinux_binder_transaction(struct task_struct *from,
1946                                       struct task_struct *to)
1947 {
1948         u32 mysid = current_sid();
1949         u32 fromsid = task_sid(from);
1950         u32 tosid = task_sid(to);
1951         int rc;
1952
1953         if (mysid != fromsid) {
1954                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1955                                   BINDER__IMPERSONATE, NULL);
1956                 if (rc)
1957                         return rc;
1958         }
1959
1960         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1961                             NULL);
1962 }
1963
1964 static int selinux_binder_transfer_binder(struct task_struct *from,
1965                                           struct task_struct *to)
1966 {
1967         u32 fromsid = task_sid(from);
1968         u32 tosid = task_sid(to);
1969
1970         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1971                             NULL);
1972 }
1973
1974 static int selinux_binder_transfer_file(struct task_struct *from,
1975                                         struct task_struct *to,
1976                                         struct file *file)
1977 {
1978         u32 sid = task_sid(to);
1979         struct file_security_struct *fsec = file->f_security;
1980         struct inode *inode = d_backing_inode(file->f_path.dentry);
1981         struct inode_security_struct *isec = inode->i_security;
1982         struct common_audit_data ad;
1983         int rc;
1984
1985         ad.type = LSM_AUDIT_DATA_PATH;
1986         ad.u.path = file->f_path;
1987
1988         if (sid != fsec->sid) {
1989                 rc = avc_has_perm(sid, fsec->sid,
1990                                   SECCLASS_FD,
1991                                   FD__USE,
1992                                   &ad);
1993                 if (rc)
1994                         return rc;
1995         }
1996
1997         if (unlikely(IS_PRIVATE(inode)))
1998                 return 0;
1999
2000         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2001                             &ad);
2002 }
2003
2004 static int selinux_ptrace_access_check(struct task_struct *child,
2005                                      unsigned int mode)
2006 {
2007         if (mode & PTRACE_MODE_READ) {
2008                 u32 sid = current_sid();
2009                 u32 csid = task_sid(child);
2010                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2011         }
2012
2013         return current_has_perm(child, PROCESS__PTRACE);
2014 }
2015
2016 static int selinux_ptrace_traceme(struct task_struct *parent)
2017 {
2018         return task_has_perm(parent, current, PROCESS__PTRACE);
2019 }
2020
2021 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2022                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2023 {
2024         return current_has_perm(target, PROCESS__GETCAP);
2025 }
2026
2027 static int selinux_capset(struct cred *new, const struct cred *old,
2028                           const kernel_cap_t *effective,
2029                           const kernel_cap_t *inheritable,
2030                           const kernel_cap_t *permitted)
2031 {
2032         return cred_has_perm(old, new, PROCESS__SETCAP);
2033 }
2034
2035 /*
2036  * (This comment used to live with the selinux_task_setuid hook,
2037  * which was removed).
2038  *
2039  * Since setuid only affects the current process, and since the SELinux
2040  * controls are not based on the Linux identity attributes, SELinux does not
2041  * need to control this operation.  However, SELinux does control the use of
2042  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2043  */
2044
2045 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2046                            int cap, int audit)
2047 {
2048         return cred_has_capability(cred, cap, audit);
2049 }
2050
2051 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2052 {
2053         const struct cred *cred = current_cred();
2054         int rc = 0;
2055
2056         if (!sb)
2057                 return 0;
2058
2059         switch (cmds) {
2060         case Q_SYNC:
2061         case Q_QUOTAON:
2062         case Q_QUOTAOFF:
2063         case Q_SETINFO:
2064         case Q_SETQUOTA:
2065                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2066                 break;
2067         case Q_GETFMT:
2068         case Q_GETINFO:
2069         case Q_GETQUOTA:
2070                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2071                 break;
2072         default:
2073                 rc = 0;  /* let the kernel handle invalid cmds */
2074                 break;
2075         }
2076         return rc;
2077 }
2078
2079 static int selinux_quota_on(struct dentry *dentry)
2080 {
2081         const struct cred *cred = current_cred();
2082
2083         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2084 }
2085
2086 static int selinux_syslog(int type)
2087 {
2088         int rc;
2089
2090         switch (type) {
2091         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2092         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2093                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2094                 break;
2095         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2096         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2097         /* Set level of messages printed to console */
2098         case SYSLOG_ACTION_CONSOLE_LEVEL:
2099                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2100                 break;
2101         case SYSLOG_ACTION_CLOSE:       /* Close log */
2102         case SYSLOG_ACTION_OPEN:        /* Open log */
2103         case SYSLOG_ACTION_READ:        /* Read from log */
2104         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2105         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2106         default:
2107                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2108                 break;
2109         }
2110         return rc;
2111 }
2112
2113 /*
2114  * Check that a process has enough memory to allocate a new virtual
2115  * mapping. 0 means there is enough memory for the allocation to
2116  * succeed and -ENOMEM implies there is not.
2117  *
2118  * Do not audit the selinux permission check, as this is applied to all
2119  * processes that allocate mappings.
2120  */
2121 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2122 {
2123         int rc, cap_sys_admin = 0;
2124
2125         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2126                                         SECURITY_CAP_NOAUDIT);
2127         if (rc == 0)
2128                 cap_sys_admin = 1;
2129
2130         return cap_sys_admin;
2131 }
2132
2133 /* binprm security operations */
2134
2135 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2136                             const struct task_security_struct *old_tsec,
2137                             const struct task_security_struct *new_tsec)
2138 {
2139         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2140         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2141         int rc;
2142
2143         if (!nnp && !nosuid)
2144                 return 0; /* neither NNP nor nosuid */
2145
2146         if (new_tsec->sid == old_tsec->sid)
2147                 return 0; /* No change in credentials */
2148
2149         /*
2150          * The only transitions we permit under NNP or nosuid
2151          * are transitions to bounded SIDs, i.e. SIDs that are
2152          * guaranteed to only be allowed a subset of the permissions
2153          * of the current SID.
2154          */
2155         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2156         if (rc) {
2157                 /*
2158                  * On failure, preserve the errno values for NNP vs nosuid.
2159                  * NNP:  Operation not permitted for caller.
2160                  * nosuid:  Permission denied to file.
2161                  */
2162                 if (nnp)
2163                         return -EPERM;
2164                 else
2165                         return -EACCES;
2166         }
2167         return 0;
2168 }
2169
2170 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2171 {
2172         const struct task_security_struct *old_tsec;
2173         struct task_security_struct *new_tsec;
2174         struct inode_security_struct *isec;
2175         struct common_audit_data ad;
2176         struct inode *inode = file_inode(bprm->file);
2177         int rc;
2178
2179         /* SELinux context only depends on initial program or script and not
2180          * the script interpreter */
2181         if (bprm->cred_prepared)
2182                 return 0;
2183
2184         old_tsec = current_security();
2185         new_tsec = bprm->cred->security;
2186         isec = inode->i_security;
2187
2188         /* Default to the current task SID. */
2189         new_tsec->sid = old_tsec->sid;
2190         new_tsec->osid = old_tsec->sid;
2191
2192         /* Reset fs, key, and sock SIDs on execve. */
2193         new_tsec->create_sid = 0;
2194         new_tsec->keycreate_sid = 0;
2195         new_tsec->sockcreate_sid = 0;
2196
2197         if (old_tsec->exec_sid) {
2198                 new_tsec->sid = old_tsec->exec_sid;
2199                 /* Reset exec SID on execve. */
2200                 new_tsec->exec_sid = 0;
2201
2202                 /* Fail on NNP or nosuid if not an allowed transition. */
2203                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2204                 if (rc)
2205                         return rc;
2206         } else {
2207                 /* Check for a default transition on this program. */
2208                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2209                                              SECCLASS_PROCESS, NULL,
2210                                              &new_tsec->sid);
2211                 if (rc)
2212                         return rc;
2213
2214                 /*
2215                  * Fallback to old SID on NNP or nosuid if not an allowed
2216                  * transition.
2217                  */
2218                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2219                 if (rc)
2220                         new_tsec->sid = old_tsec->sid;
2221         }
2222
2223         ad.type = LSM_AUDIT_DATA_PATH;
2224         ad.u.path = bprm->file->f_path;
2225
2226         if (new_tsec->sid == old_tsec->sid) {
2227                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2228                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2229                 if (rc)
2230                         return rc;
2231         } else {
2232                 /* Check permissions for the transition. */
2233                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2234                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2235                 if (rc)
2236                         return rc;
2237
2238                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2239                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2240                 if (rc)
2241                         return rc;
2242
2243                 /* Check for shared state */
2244                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2245                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2246                                           SECCLASS_PROCESS, PROCESS__SHARE,
2247                                           NULL);
2248                         if (rc)
2249                                 return -EPERM;
2250                 }
2251
2252                 /* Make sure that anyone attempting to ptrace over a task that
2253                  * changes its SID has the appropriate permit */
2254                 if (bprm->unsafe &
2255                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2256                         struct task_struct *tracer;
2257                         struct task_security_struct *sec;
2258                         u32 ptsid = 0;
2259
2260                         rcu_read_lock();
2261                         tracer = ptrace_parent(current);
2262                         if (likely(tracer != NULL)) {
2263                                 sec = __task_cred(tracer)->security;
2264                                 ptsid = sec->sid;
2265                         }
2266                         rcu_read_unlock();
2267
2268                         if (ptsid != 0) {
2269                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2270                                                   SECCLASS_PROCESS,
2271                                                   PROCESS__PTRACE, NULL);
2272                                 if (rc)
2273                                         return -EPERM;
2274                         }
2275                 }
2276
2277                 /* Clear any possibly unsafe personality bits on exec: */
2278                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2279         }
2280
2281         return 0;
2282 }
2283
2284 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2285 {
2286         const struct task_security_struct *tsec = current_security();
2287         u32 sid, osid;
2288         int atsecure = 0;
2289
2290         sid = tsec->sid;
2291         osid = tsec->osid;
2292
2293         if (osid != sid) {
2294                 /* Enable secure mode for SIDs transitions unless
2295                    the noatsecure permission is granted between
2296                    the two SIDs, i.e. ahp returns 0. */
2297                 atsecure = avc_has_perm(osid, sid,
2298                                         SECCLASS_PROCESS,
2299                                         PROCESS__NOATSECURE, NULL);
2300         }
2301
2302         return !!atsecure;
2303 }
2304
2305 static int match_file(const void *p, struct file *file, unsigned fd)
2306 {
2307         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2308 }
2309
2310 /* Derived from fs/exec.c:flush_old_files. */
2311 static inline void flush_unauthorized_files(const struct cred *cred,
2312                                             struct files_struct *files)
2313 {
2314         struct file *file, *devnull = NULL;
2315         struct tty_struct *tty;
2316         int drop_tty = 0;
2317         unsigned n;
2318
2319         tty = get_current_tty();
2320         if (tty) {
2321                 spin_lock(&tty_files_lock);
2322                 if (!list_empty(&tty->tty_files)) {
2323                         struct tty_file_private *file_priv;
2324
2325                         /* Revalidate access to controlling tty.
2326                            Use file_path_has_perm on the tty path directly
2327                            rather than using file_has_perm, as this particular
2328                            open file may belong to another process and we are
2329                            only interested in the inode-based check here. */
2330                         file_priv = list_first_entry(&tty->tty_files,
2331                                                 struct tty_file_private, list);
2332                         file = file_priv->file;
2333                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2334                                 drop_tty = 1;
2335                 }
2336                 spin_unlock(&tty_files_lock);
2337                 tty_kref_put(tty);
2338         }
2339         /* Reset controlling tty. */
2340         if (drop_tty)
2341                 no_tty();
2342
2343         /* Revalidate access to inherited open files. */
2344         n = iterate_fd(files, 0, match_file, cred);
2345         if (!n) /* none found? */
2346                 return;
2347
2348         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2349         if (IS_ERR(devnull))
2350                 devnull = NULL;
2351         /* replace all the matching ones with this */
2352         do {
2353                 replace_fd(n - 1, devnull, 0);
2354         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2355         if (devnull)
2356                 fput(devnull);
2357 }
2358
2359 /*
2360  * Prepare a process for imminent new credential changes due to exec
2361  */
2362 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2363 {
2364         struct task_security_struct *new_tsec;
2365         struct rlimit *rlim, *initrlim;
2366         int rc, i;
2367
2368         new_tsec = bprm->cred->security;
2369         if (new_tsec->sid == new_tsec->osid)
2370                 return;
2371
2372         /* Close files for which the new task SID is not authorized. */
2373         flush_unauthorized_files(bprm->cred, current->files);
2374
2375         /* Always clear parent death signal on SID transitions. */
2376         current->pdeath_signal = 0;
2377
2378         /* Check whether the new SID can inherit resource limits from the old
2379          * SID.  If not, reset all soft limits to the lower of the current
2380          * task's hard limit and the init task's soft limit.
2381          *
2382          * Note that the setting of hard limits (even to lower them) can be
2383          * controlled by the setrlimit check.  The inclusion of the init task's
2384          * soft limit into the computation is to avoid resetting soft limits
2385          * higher than the default soft limit for cases where the default is
2386          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2387          */
2388         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2389                           PROCESS__RLIMITINH, NULL);
2390         if (rc) {
2391                 /* protect against do_prlimit() */
2392                 task_lock(current);
2393                 for (i = 0; i < RLIM_NLIMITS; i++) {
2394                         rlim = current->signal->rlim + i;
2395                         initrlim = init_task.signal->rlim + i;
2396                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2397                 }
2398                 task_unlock(current);
2399                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2400         }
2401 }
2402
2403 /*
2404  * Clean up the process immediately after the installation of new credentials
2405  * due to exec
2406  */
2407 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2408 {
2409         const struct task_security_struct *tsec = current_security();
2410         struct itimerval itimer;
2411         u32 osid, sid;
2412         int rc, i;
2413
2414         osid = tsec->osid;
2415         sid = tsec->sid;
2416
2417         if (sid == osid)
2418                 return;
2419
2420         /* Check whether the new SID can inherit signal state from the old SID.
2421          * If not, clear itimers to avoid subsequent signal generation and
2422          * flush and unblock signals.
2423          *
2424          * This must occur _after_ the task SID has been updated so that any
2425          * kill done after the flush will be checked against the new SID.
2426          */
2427         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2428         if (rc) {
2429                 memset(&itimer, 0, sizeof itimer);
2430                 for (i = 0; i < 3; i++)
2431                         do_setitimer(i, &itimer, NULL);
2432                 spin_lock_irq(&current->sighand->siglock);
2433                 if (!fatal_signal_pending(current)) {
2434                         flush_sigqueue(&current->pending);
2435                         flush_sigqueue(&current->signal->shared_pending);
2436                         flush_signal_handlers(current, 1);
2437                         sigemptyset(&current->blocked);
2438                         recalc_sigpending();
2439                 }
2440                 spin_unlock_irq(&current->sighand->siglock);
2441         }
2442
2443         /* Wake up the parent if it is waiting so that it can recheck
2444          * wait permission to the new task SID. */
2445         read_lock(&tasklist_lock);
2446         __wake_up_parent(current, current->real_parent);
2447         read_unlock(&tasklist_lock);
2448 }
2449
2450 /* superblock security operations */
2451
2452 static int selinux_sb_alloc_security(struct super_block *sb)
2453 {
2454         return superblock_alloc_security(sb);
2455 }
2456
2457 static void selinux_sb_free_security(struct super_block *sb)
2458 {
2459         superblock_free_security(sb);
2460 }
2461
2462 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2463 {
2464         if (plen > olen)
2465                 return 0;
2466
2467         return !memcmp(prefix, option, plen);
2468 }
2469
2470 static inline int selinux_option(char *option, int len)
2471 {
2472         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2473                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2474                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2475                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2476                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2477 }
2478
2479 static inline void take_option(char **to, char *from, int *first, int len)
2480 {
2481         if (!*first) {
2482                 **to = ',';
2483                 *to += 1;
2484         } else
2485                 *first = 0;
2486         memcpy(*to, from, len);
2487         *to += len;
2488 }
2489
2490 static inline void take_selinux_option(char **to, char *from, int *first,
2491                                        int len)
2492 {
2493         int current_size = 0;
2494
2495         if (!*first) {
2496                 **to = '|';
2497                 *to += 1;
2498         } else
2499                 *first = 0;
2500
2501         while (current_size < len) {
2502                 if (*from != '"') {
2503                         **to = *from;
2504                         *to += 1;
2505                 }
2506                 from += 1;
2507                 current_size += 1;
2508         }
2509 }
2510
2511 static int selinux_sb_copy_data(char *orig, char *copy)
2512 {
2513         int fnosec, fsec, rc = 0;
2514         char *in_save, *in_curr, *in_end;
2515         char *sec_curr, *nosec_save, *nosec;
2516         int open_quote = 0;
2517
2518         in_curr = orig;
2519         sec_curr = copy;
2520
2521         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2522         if (!nosec) {
2523                 rc = -ENOMEM;
2524                 goto out;
2525         }
2526
2527         nosec_save = nosec;
2528         fnosec = fsec = 1;
2529         in_save = in_end = orig;
2530
2531         do {
2532                 if (*in_end == '"')
2533                         open_quote = !open_quote;
2534                 if ((*in_end == ',' && open_quote == 0) ||
2535                                 *in_end == '\0') {
2536                         int len = in_end - in_curr;
2537
2538                         if (selinux_option(in_curr, len))
2539                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2540                         else
2541                                 take_option(&nosec, in_curr, &fnosec, len);
2542
2543                         in_curr = in_end + 1;
2544                 }
2545         } while (*in_end++);
2546
2547         strcpy(in_save, nosec_save);
2548         free_page((unsigned long)nosec_save);
2549 out:
2550         return rc;
2551 }
2552
2553 static int selinux_sb_remount(struct super_block *sb, void *data)
2554 {
2555         int rc, i, *flags;
2556         struct security_mnt_opts opts;
2557         char *secdata, **mount_options;
2558         struct superblock_security_struct *sbsec = sb->s_security;
2559
2560         if (!(sbsec->flags & SE_SBINITIALIZED))
2561                 return 0;
2562
2563         if (!data)
2564                 return 0;
2565
2566         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2567                 return 0;
2568
2569         security_init_mnt_opts(&opts);
2570         secdata = alloc_secdata();
2571         if (!secdata)
2572                 return -ENOMEM;
2573         rc = selinux_sb_copy_data(data, secdata);
2574         if (rc)
2575                 goto out_free_secdata;
2576
2577         rc = selinux_parse_opts_str(secdata, &opts);
2578         if (rc)
2579                 goto out_free_secdata;
2580
2581         mount_options = opts.mnt_opts;
2582         flags = opts.mnt_opts_flags;
2583
2584         for (i = 0; i < opts.num_mnt_opts; i++) {
2585                 u32 sid;
2586                 size_t len;
2587
2588                 if (flags[i] == SBLABEL_MNT)
2589                         continue;
2590                 len = strlen(mount_options[i]);
2591                 rc = security_context_to_sid(mount_options[i], len, &sid,
2592                                              GFP_KERNEL);
2593                 if (rc) {
2594                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2595                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2596                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2597                         goto out_free_opts;
2598                 }
2599                 rc = -EINVAL;
2600                 switch (flags[i]) {
2601                 case FSCONTEXT_MNT:
2602                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2603                                 goto out_bad_option;
2604                         break;
2605                 case CONTEXT_MNT:
2606                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2607                                 goto out_bad_option;
2608                         break;
2609                 case ROOTCONTEXT_MNT: {
2610                         struct inode_security_struct *root_isec;
2611                         root_isec = d_backing_inode(sb->s_root)->i_security;
2612
2613                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2614                                 goto out_bad_option;
2615                         break;
2616                 }
2617                 case DEFCONTEXT_MNT:
2618                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2619                                 goto out_bad_option;
2620                         break;
2621                 default:
2622                         goto out_free_opts;
2623                 }
2624         }
2625
2626         rc = 0;
2627 out_free_opts:
2628         security_free_mnt_opts(&opts);
2629 out_free_secdata:
2630         free_secdata(secdata);
2631         return rc;
2632 out_bad_option:
2633         printk(KERN_WARNING "SELinux: unable to change security options "
2634                "during remount (dev %s, type=%s)\n", sb->s_id,
2635                sb->s_type->name);
2636         goto out_free_opts;
2637 }
2638
2639 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2640 {
2641         const struct cred *cred = current_cred();
2642         struct common_audit_data ad;
2643         int rc;
2644
2645         rc = superblock_doinit(sb, data);
2646         if (rc)
2647                 return rc;
2648
2649         /* Allow all mounts performed by the kernel */
2650         if (flags & MS_KERNMOUNT)
2651                 return 0;
2652
2653         ad.type = LSM_AUDIT_DATA_DENTRY;
2654         ad.u.dentry = sb->s_root;
2655         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2656 }
2657
2658 static int selinux_sb_statfs(struct dentry *dentry)
2659 {
2660         const struct cred *cred = current_cred();
2661         struct common_audit_data ad;
2662
2663         ad.type = LSM_AUDIT_DATA_DENTRY;
2664         ad.u.dentry = dentry->d_sb->s_root;
2665         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2666 }
2667
2668 static int selinux_mount(const char *dev_name,
2669                          struct path *path,
2670                          const char *type,
2671                          unsigned long flags,
2672                          void *data)
2673 {
2674         const struct cred *cred = current_cred();
2675
2676         if (flags & MS_REMOUNT)
2677                 return superblock_has_perm(cred, path->dentry->d_sb,
2678                                            FILESYSTEM__REMOUNT, NULL);
2679         else
2680                 return path_has_perm(cred, path, FILE__MOUNTON);
2681 }
2682
2683 static int selinux_umount(struct vfsmount *mnt, int flags)
2684 {
2685         const struct cred *cred = current_cred();
2686
2687         return superblock_has_perm(cred, mnt->mnt_sb,
2688                                    FILESYSTEM__UNMOUNT, NULL);
2689 }
2690
2691 /* inode security operations */
2692
2693 static int selinux_inode_alloc_security(struct inode *inode)
2694 {
2695         return inode_alloc_security(inode);
2696 }
2697
2698 static void selinux_inode_free_security(struct inode *inode)
2699 {
2700         inode_free_security(inode);
2701 }
2702
2703 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2704                                         struct qstr *name, void **ctx,
2705                                         u32 *ctxlen)
2706 {
2707         const struct cred *cred = current_cred();
2708         struct task_security_struct *tsec;
2709         struct inode_security_struct *dsec;
2710         struct superblock_security_struct *sbsec;
2711         struct inode *dir = d_backing_inode(dentry->d_parent);
2712         u32 newsid;
2713         int rc;
2714
2715         tsec = cred->security;
2716         dsec = dir->i_security;
2717         sbsec = dir->i_sb->s_security;
2718
2719         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2720                 newsid = tsec->create_sid;
2721         } else {
2722                 rc = security_transition_sid(tsec->sid, dsec->sid,
2723                                              inode_mode_to_security_class(mode),
2724                                              name,
2725                                              &newsid);
2726                 if (rc) {
2727                         printk(KERN_WARNING
2728                                 "%s: security_transition_sid failed, rc=%d\n",
2729                                __func__, -rc);
2730                         return rc;
2731                 }
2732         }
2733
2734         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2735 }
2736
2737 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2738                                        const struct qstr *qstr,
2739                                        const char **name,
2740                                        void **value, size_t *len)
2741 {
2742         const struct task_security_struct *tsec = current_security();
2743         struct inode_security_struct *dsec;
2744         struct superblock_security_struct *sbsec;
2745         u32 sid, newsid, clen;
2746         int rc;
2747         char *context;
2748
2749         dsec = dir->i_security;
2750         sbsec = dir->i_sb->s_security;
2751
2752         sid = tsec->sid;
2753         newsid = tsec->create_sid;
2754
2755         if ((sbsec->flags & SE_SBINITIALIZED) &&
2756             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2757                 newsid = sbsec->mntpoint_sid;
2758         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2759                 rc = security_transition_sid(sid, dsec->sid,
2760                                              inode_mode_to_security_class(inode->i_mode),
2761                                              qstr, &newsid);
2762                 if (rc) {
2763                         printk(KERN_WARNING "%s:  "
2764                                "security_transition_sid failed, rc=%d (dev=%s "
2765                                "ino=%ld)\n",
2766                                __func__,
2767                                -rc, inode->i_sb->s_id, inode->i_ino);
2768                         return rc;
2769                 }
2770         }
2771
2772         /* Possibly defer initialization to selinux_complete_init. */
2773         if (sbsec->flags & SE_SBINITIALIZED) {
2774                 struct inode_security_struct *isec = inode->i_security;
2775                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2776                 isec->sid = newsid;
2777                 isec->initialized = 1;
2778         }
2779
2780         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2781                 return -EOPNOTSUPP;
2782
2783         if (name)
2784                 *name = XATTR_SELINUX_SUFFIX;
2785
2786         if (value && len) {
2787                 rc = security_sid_to_context_force(newsid, &context, &clen);
2788                 if (rc)
2789                         return rc;
2790                 *value = context;
2791                 *len = clen;
2792         }
2793
2794         return 0;
2795 }
2796
2797 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2798 {
2799         return may_create(dir, dentry, SECCLASS_FILE);
2800 }
2801
2802 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2803 {
2804         return may_link(dir, old_dentry, MAY_LINK);
2805 }
2806
2807 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2808 {
2809         return may_link(dir, dentry, MAY_UNLINK);
2810 }
2811
2812 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2813 {
2814         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2815 }
2816
2817 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2818 {
2819         return may_create(dir, dentry, SECCLASS_DIR);
2820 }
2821
2822 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2823 {
2824         return may_link(dir, dentry, MAY_RMDIR);
2825 }
2826
2827 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2828 {
2829         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2830 }
2831
2832 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2833                                 struct inode *new_inode, struct dentry *new_dentry)
2834 {
2835         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2836 }
2837
2838 static int selinux_inode_readlink(struct dentry *dentry)
2839 {
2840         const struct cred *cred = current_cred();
2841
2842         return dentry_has_perm(cred, dentry, FILE__READ);
2843 }
2844
2845 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2846                                      bool rcu)
2847 {
2848         const struct cred *cred = current_cred();
2849         struct common_audit_data ad;
2850         struct inode_security_struct *isec;
2851         u32 sid;
2852
2853         validate_creds(cred);
2854
2855         ad.type = LSM_AUDIT_DATA_DENTRY;
2856         ad.u.dentry = dentry;
2857         sid = cred_sid(cred);
2858         isec = inode->i_security;
2859
2860         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2861                                   rcu ? MAY_NOT_BLOCK : 0);
2862 }
2863
2864 static noinline int audit_inode_permission(struct inode *inode,
2865                                            u32 perms, u32 audited, u32 denied,
2866                                            int result,
2867                                            unsigned flags)
2868 {
2869         struct common_audit_data ad;
2870         struct inode_security_struct *isec = inode->i_security;
2871         int rc;
2872
2873         ad.type = LSM_AUDIT_DATA_INODE;
2874         ad.u.inode = inode;
2875
2876         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2877                             audited, denied, result, &ad, flags);
2878         if (rc)
2879                 return rc;
2880         return 0;
2881 }
2882
2883 static int selinux_inode_permission(struct inode *inode, int mask)
2884 {
2885         const struct cred *cred = current_cred();
2886         u32 perms;
2887         bool from_access;
2888         unsigned flags = mask & MAY_NOT_BLOCK;
2889         struct inode_security_struct *isec;
2890         u32 sid;
2891         struct av_decision avd;
2892         int rc, rc2;
2893         u32 audited, denied;
2894
2895         from_access = mask & MAY_ACCESS;
2896         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2897
2898         /* No permission to check.  Existence test. */
2899         if (!mask)
2900                 return 0;
2901
2902         validate_creds(cred);
2903
2904         if (unlikely(IS_PRIVATE(inode)))
2905                 return 0;
2906
2907         perms = file_mask_to_av(inode->i_mode, mask);
2908
2909         sid = cred_sid(cred);
2910         isec = inode->i_security;
2911
2912         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2913         audited = avc_audit_required(perms, &avd, rc,
2914                                      from_access ? FILE__AUDIT_ACCESS : 0,
2915                                      &denied);
2916         if (likely(!audited))
2917                 return rc;
2918
2919         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2920         if (rc2)
2921                 return rc2;
2922         return rc;
2923 }
2924
2925 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2926 {
2927         const struct cred *cred = current_cred();
2928         unsigned int ia_valid = iattr->ia_valid;
2929         __u32 av = FILE__WRITE;
2930
2931         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2932         if (ia_valid & ATTR_FORCE) {
2933                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2934                               ATTR_FORCE);
2935                 if (!ia_valid)
2936                         return 0;
2937         }
2938
2939         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2940                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2941                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2942
2943         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2944                 av |= FILE__OPEN;
2945
2946         return dentry_has_perm(cred, dentry, av);
2947 }
2948
2949 static int selinux_inode_getattr(const struct path *path)
2950 {
2951         return path_has_perm(current_cred(), path, FILE__GETATTR);
2952 }
2953
2954 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2955 {
2956         const struct cred *cred = current_cred();
2957
2958         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2959                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2960                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2961                         if (!capable(CAP_SETFCAP))
2962                                 return -EPERM;
2963                 } else if (!capable(CAP_SYS_ADMIN)) {
2964                         /* A different attribute in the security namespace.
2965                            Restrict to administrator. */
2966                         return -EPERM;
2967                 }
2968         }
2969
2970         /* Not an attribute we recognize, so just check the
2971            ordinary setattr permission. */
2972         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2973 }
2974
2975 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2976                                   const void *value, size_t size, int flags)
2977 {
2978         struct inode *inode = d_backing_inode(dentry);
2979         struct inode_security_struct *isec = inode->i_security;
2980         struct superblock_security_struct *sbsec;
2981         struct common_audit_data ad;
2982         u32 newsid, sid = current_sid();
2983         int rc = 0;
2984
2985         if (strcmp(name, XATTR_NAME_SELINUX))
2986                 return selinux_inode_setotherxattr(dentry, name);
2987
2988         sbsec = inode->i_sb->s_security;
2989         if (!(sbsec->flags & SBLABEL_MNT))
2990                 return -EOPNOTSUPP;
2991
2992         if (!inode_owner_or_capable(inode))
2993                 return -EPERM;
2994
2995         ad.type = LSM_AUDIT_DATA_DENTRY;
2996         ad.u.dentry = dentry;
2997
2998         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2999                           FILE__RELABELFROM, &ad);
3000         if (rc)
3001                 return rc;
3002
3003         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3004         if (rc == -EINVAL) {
3005                 if (!capable(CAP_MAC_ADMIN)) {
3006                         struct audit_buffer *ab;
3007                         size_t audit_size;
3008                         const char *str;
3009
3010                         /* We strip a nul only if it is at the end, otherwise the
3011                          * context contains a nul and we should audit that */
3012                         if (value) {
3013                                 str = value;
3014                                 if (str[size - 1] == '\0')
3015                                         audit_size = size - 1;
3016                                 else
3017                                         audit_size = size;
3018                         } else {
3019                                 str = "";
3020                                 audit_size = 0;
3021                         }
3022                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3023                         audit_log_format(ab, "op=setxattr invalid_context=");
3024                         audit_log_n_untrustedstring(ab, value, audit_size);
3025                         audit_log_end(ab);
3026
3027                         return rc;
3028                 }
3029                 rc = security_context_to_sid_force(value, size, &newsid);
3030         }
3031         if (rc)
3032                 return rc;
3033
3034         rc = avc_has_perm(sid, newsid, isec->sclass,
3035                           FILE__RELABELTO, &ad);
3036         if (rc)
3037                 return rc;
3038
3039         rc = security_validate_transition(isec->sid, newsid, sid,
3040                                           isec->sclass);
3041         if (rc)
3042                 return rc;
3043
3044         return avc_has_perm(newsid,
3045                             sbsec->sid,
3046                             SECCLASS_FILESYSTEM,
3047                             FILESYSTEM__ASSOCIATE,
3048                             &ad);
3049 }
3050
3051 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3052                                         const void *value, size_t size,
3053                                         int flags)
3054 {
3055         struct inode *inode = d_backing_inode(dentry);
3056         struct inode_security_struct *isec = inode->i_security;
3057         u32 newsid;
3058         int rc;
3059
3060         if (strcmp(name, XATTR_NAME_SELINUX)) {
3061                 /* Not an attribute we recognize, so nothing to do. */
3062                 return;
3063         }
3064
3065         rc = security_context_to_sid_force(value, size, &newsid);
3066         if (rc) {
3067                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3068                        "for (%s, %lu), rc=%d\n",
3069                        inode->i_sb->s_id, inode->i_ino, -rc);
3070                 return;
3071         }
3072
3073         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3074         isec->sid = newsid;
3075         isec->initialized = 1;
3076
3077         return;
3078 }
3079
3080 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3081 {
3082         const struct cred *cred = current_cred();
3083
3084         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3085 }
3086
3087 static int selinux_inode_listxattr(struct dentry *dentry)
3088 {
3089         const struct cred *cred = current_cred();
3090
3091         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3092 }
3093
3094 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3095 {
3096         if (strcmp(name, XATTR_NAME_SELINUX))
3097                 return selinux_inode_setotherxattr(dentry, name);
3098
3099         /* No one is allowed to remove a SELinux security label.
3100            You can change the label, but all data must be labeled. */
3101         return -EACCES;
3102 }
3103
3104 /*
3105  * Copy the inode security context value to the user.
3106  *
3107  * Permission check is handled by selinux_inode_getxattr hook.
3108  */
3109 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3110 {
3111         u32 size;
3112         int error;
3113         char *context = NULL;
3114         struct inode_security_struct *isec = inode->i_security;
3115
3116         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3117                 return -EOPNOTSUPP;
3118
3119         /*
3120          * If the caller has CAP_MAC_ADMIN, then get the raw context
3121          * value even if it is not defined by current policy; otherwise,
3122          * use the in-core value under current policy.
3123          * Use the non-auditing forms of the permission checks since
3124          * getxattr may be called by unprivileged processes commonly
3125          * and lack of permission just means that we fall back to the
3126          * in-core context value, not a denial.
3127          */
3128         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3129                             SECURITY_CAP_NOAUDIT);
3130         if (!error)
3131                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3132                                             SECURITY_CAP_NOAUDIT);
3133         if (!error)
3134                 error = security_sid_to_context_force(isec->sid, &context,
3135                                                       &size);
3136         else
3137                 error = security_sid_to_context(isec->sid, &context, &size);
3138         if (error)
3139                 return error;
3140         error = size;
3141         if (alloc) {
3142                 *buffer = context;
3143                 goto out_nofree;
3144         }
3145         kfree(context);
3146 out_nofree:
3147         return error;
3148 }
3149
3150 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3151                                      const void *value, size_t size, int flags)
3152 {
3153         struct inode_security_struct *isec = inode->i_security;
3154         u32 newsid;
3155         int rc;
3156
3157         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3158                 return -EOPNOTSUPP;
3159
3160         if (!value || !size)
3161                 return -EACCES;
3162
3163         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3164         if (rc)
3165                 return rc;
3166
3167         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3168         isec->sid = newsid;
3169         isec->initialized = 1;
3170         return 0;
3171 }
3172
3173 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3174 {
3175         const int len = sizeof(XATTR_NAME_SELINUX);
3176         if (buffer && len <= buffer_size)
3177                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3178         return len;
3179 }
3180
3181 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3182 {
3183         struct inode_security_struct *isec = inode->i_security;
3184         *secid = isec->sid;
3185 }
3186
3187 /* file security operations */
3188
3189 static int selinux_revalidate_file_permission(struct file *file, int mask)
3190 {
3191         const struct cred *cred = current_cred();
3192         struct inode *inode = file_inode(file);
3193
3194         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3195         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3196                 mask |= MAY_APPEND;
3197
3198         return file_has_perm(cred, file,
3199                              file_mask_to_av(inode->i_mode, mask));
3200 }
3201
3202 static int selinux_file_permission(struct file *file, int mask)
3203 {
3204         struct inode *inode = file_inode(file);
3205         struct file_security_struct *fsec = file->f_security;
3206         struct inode_security_struct *isec = inode->i_security;
3207         u32 sid = current_sid();
3208
3209         if (!mask)
3210                 /* No permission to check.  Existence test. */
3211                 return 0;
3212
3213         if (sid == fsec->sid && fsec->isid == isec->sid &&
3214             fsec->pseqno == avc_policy_seqno())
3215                 /* No change since file_open check. */
3216                 return 0;
3217
3218         return selinux_revalidate_file_permission(file, mask);
3219 }
3220
3221 static int selinux_file_alloc_security(struct file *file)
3222 {
3223         return file_alloc_security(file);
3224 }
3225
3226 static void selinux_file_free_security(struct file *file)
3227 {
3228         file_free_security(file);
3229 }
3230
3231 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3232                               unsigned long arg)
3233 {
3234         const struct cred *cred = current_cred();
3235         int error = 0;
3236
3237         switch (cmd) {
3238         case FIONREAD:
3239         /* fall through */
3240         case FIBMAP:
3241         /* fall through */
3242         case FIGETBSZ:
3243         /* fall through */
3244         case FS_IOC_GETFLAGS:
3245         /* fall through */
3246         case FS_IOC_GETVERSION:
3247                 error = file_has_perm(cred, file, FILE__GETATTR);
3248                 break;
3249
3250         case FS_IOC_SETFLAGS:
3251         /* fall through */
3252         case FS_IOC_SETVERSION:
3253                 error = file_has_perm(cred, file, FILE__SETATTR);
3254                 break;
3255
3256         /* sys_ioctl() checks */
3257         case FIONBIO:
3258         /* fall through */
3259         case FIOASYNC:
3260                 error = file_has_perm(cred, file, 0);
3261                 break;
3262
3263         case KDSKBENT:
3264         case KDSKBSENT:
3265                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3266                                             SECURITY_CAP_AUDIT);
3267                 break;
3268
3269         /* default case assumes that the command will go
3270          * to the file's ioctl() function.
3271          */
3272         default:
3273                 error = file_has_perm(cred, file, FILE__IOCTL);
3274         }
3275         return error;
3276 }
3277
3278 static int default_noexec;
3279
3280 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3281 {
3282         const struct cred *cred = current_cred();
3283         int rc = 0;
3284
3285         if (default_noexec &&
3286             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3287                 /*
3288                  * We are making executable an anonymous mapping or a
3289                  * private file mapping that will also be writable.
3290                  * This has an additional check.
3291                  */
3292                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3293                 if (rc)
3294                         goto error;
3295         }
3296
3297         if (file) {
3298                 /* read access is always possible with a mapping */
3299                 u32 av = FILE__READ;
3300
3301                 /* write access only matters if the mapping is shared */
3302                 if (shared && (prot & PROT_WRITE))
3303                         av |= FILE__WRITE;
3304
3305                 if (prot & PROT_EXEC)
3306                         av |= FILE__EXECUTE;
3307
3308                 return file_has_perm(cred, file, av);
3309         }
3310
3311 error:
3312         return rc;
3313 }
3314
3315 static int selinux_mmap_addr(unsigned long addr)
3316 {
3317         int rc = 0;
3318
3319         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3320                 u32 sid = current_sid();
3321                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3322                                   MEMPROTECT__MMAP_ZERO, NULL);
3323         }
3324
3325         return rc;
3326 }
3327
3328 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3329                              unsigned long prot, unsigned long flags)
3330 {
3331         if (selinux_checkreqprot)
3332                 prot = reqprot;
3333
3334         return file_map_prot_check(file, prot,
3335                                    (flags & MAP_TYPE) == MAP_SHARED);
3336 }
3337
3338 static int selinux_file_mprotect(struct vm_area_struct *vma,
3339                                  unsigned long reqprot,
3340                                  unsigned long prot)
3341 {
3342         const struct cred *cred = current_cred();
3343
3344         if (selinux_checkreqprot)
3345                 prot = reqprot;
3346
3347         if (default_noexec &&
3348             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3349                 int rc = 0;
3350                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3351                     vma->vm_end <= vma->vm_mm->brk) {
3352                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3353                 } else if (!vma->vm_file &&
3354                            vma->vm_start <= vma->vm_mm->start_stack &&
3355                            vma->vm_end >= vma->vm_mm->start_stack) {
3356                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3357                 } else if (vma->vm_file && vma->anon_vma) {
3358                         /*
3359                          * We are making executable a file mapping that has
3360                          * had some COW done. Since pages might have been
3361                          * written, check ability to execute the possibly
3362                          * modified content.  This typically should only
3363                          * occur for text relocations.
3364                          */
3365                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3366                 }
3367                 if (rc)
3368                         return rc;
3369         }
3370
3371         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3372 }
3373
3374 static int selinux_file_lock(struct file *file, unsigned int cmd)
3375 {
3376         const struct cred *cred = current_cred();
3377
3378         return file_has_perm(cred, file, FILE__LOCK);
3379 }
3380
3381 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3382                               unsigned long arg)
3383 {
3384         const struct cred *cred = current_cred();
3385         int err = 0;
3386
3387         switch (cmd) {
3388         case F_SETFL:
3389                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3390                         err = file_has_perm(cred, file, FILE__WRITE);
3391                         break;
3392                 }
3393                 /* fall through */
3394         case F_SETOWN:
3395         case F_SETSIG:
3396         case F_GETFL:
3397         case F_GETOWN:
3398         case F_GETSIG:
3399         case F_GETOWNER_UIDS:
3400                 /* Just check FD__USE permission */
3401                 err = file_has_perm(cred, file, 0);
3402                 break;
3403         case F_GETLK:
3404         case F_SETLK:
3405         case F_SETLKW:
3406         case F_OFD_GETLK:
3407         case F_OFD_SETLK:
3408         case F_OFD_SETLKW:
3409 #if BITS_PER_LONG == 32
3410         case F_GETLK64:
3411         case F_SETLK64:
3412         case F_SETLKW64:
3413 #endif
3414                 err = file_has_perm(cred, file, FILE__LOCK);
3415                 break;
3416         }
3417
3418         return err;
3419 }
3420
3421 static void selinux_file_set_fowner(struct file *file)
3422 {
3423         struct file_security_struct *fsec;
3424
3425         fsec = file->f_security;
3426         fsec->fown_sid = current_sid();
3427 }
3428
3429 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3430                                        struct fown_struct *fown, int signum)
3431 {
3432         struct file *file;
3433         u32 sid = task_sid(tsk);
3434         u32 perm;
3435         struct file_security_struct *fsec;
3436
3437         /* struct fown_struct is never outside the context of a struct file */
3438         file = container_of(fown, struct file, f_owner);
3439
3440         fsec = file->f_security;
3441
3442         if (!signum)
3443                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3444         else
3445                 perm = signal_to_av(signum);
3446
3447         return avc_has_perm(fsec->fown_sid, sid,
3448                             SECCLASS_PROCESS, perm, NULL);
3449 }
3450
3451 static int selinux_file_receive(struct file *file)
3452 {
3453         const struct cred *cred = current_cred();
3454
3455         return file_has_perm(cred, file, file_to_av(file));
3456 }
3457
3458 static int selinux_file_open(struct file *file, const struct cred *cred)
3459 {
3460         struct file_security_struct *fsec;
3461         struct inode_security_struct *isec;
3462
3463         fsec = file->f_security;
3464         isec = file_inode(file)->i_security;
3465         /*
3466          * Save inode label and policy sequence number
3467          * at open-time so that selinux_file_permission
3468          * can determine whether revalidation is necessary.
3469          * Task label is already saved in the file security
3470          * struct as its SID.
3471          */
3472         fsec->isid = isec->sid;
3473         fsec->pseqno = avc_policy_seqno();
3474         /*
3475          * Since the inode label or policy seqno may have changed
3476          * between the selinux_inode_permission check and the saving
3477          * of state above, recheck that access is still permitted.
3478          * Otherwise, access might never be revalidated against the
3479          * new inode label or new policy.
3480          * This check is not redundant - do not remove.
3481          */
3482         return file_path_has_perm(cred, file, open_file_to_av(file));
3483 }
3484
3485 /* task security operations */
3486
3487 static int selinux_task_create(unsigned long clone_flags)
3488 {
3489         return current_has_perm(current, PROCESS__FORK);
3490 }
3491
3492 /*
3493  * allocate the SELinux part of blank credentials
3494  */
3495 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3496 {
3497         struct task_security_struct *tsec;
3498
3499         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3500         if (!tsec)
3501                 return -ENOMEM;
3502
3503         cred->security = tsec;
3504         return 0;
3505 }
3506
3507 /*
3508  * detach and free the LSM part of a set of credentials
3509  */
3510 static void selinux_cred_free(struct cred *cred)
3511 {
3512         struct task_security_struct *tsec = cred->security;
3513
3514         /*
3515          * cred->security == NULL if security_cred_alloc_blank() or
3516          * security_prepare_creds() returned an error.
3517          */
3518         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3519         cred->security = (void *) 0x7UL;
3520         kfree(tsec);
3521 }
3522
3523 /*
3524  * prepare a new set of credentials for modification
3525  */
3526 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3527                                 gfp_t gfp)
3528 {
3529         const struct task_security_struct *old_tsec;
3530         struct task_security_struct *tsec;
3531
3532         old_tsec = old->security;
3533
3534         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3535         if (!tsec)
3536                 return -ENOMEM;
3537
3538         new->security = tsec;
3539         return 0;
3540 }
3541
3542 /*
3543  * transfer the SELinux data to a blank set of creds
3544  */
3545 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3546 {
3547         const struct task_security_struct *old_tsec = old->security;
3548         struct task_security_struct *tsec = new->security;
3549
3550         *tsec = *old_tsec;
3551 }
3552
3553 /*
3554  * set the security data for a kernel service
3555  * - all the creation contexts are set to unlabelled
3556  */
3557 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3558 {
3559         struct task_security_struct *tsec = new->security;
3560         u32 sid = current_sid();
3561         int ret;
3562
3563         ret = avc_has_perm(sid, secid,
3564                            SECCLASS_KERNEL_SERVICE,
3565                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3566                            NULL);
3567         if (ret == 0) {
3568                 tsec->sid = secid;
3569                 tsec->create_sid = 0;
3570                 tsec->keycreate_sid = 0;
3571                 tsec->sockcreate_sid = 0;
3572         }
3573         return ret;
3574 }
3575
3576 /*
3577  * set the file creation context in a security record to the same as the
3578  * objective context of the specified inode
3579  */
3580 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3581 {
3582         struct inode_security_struct *isec = inode->i_security;
3583         struct task_security_struct *tsec = new->security;
3584         u32 sid = current_sid();
3585         int ret;
3586
3587         ret = avc_has_perm(sid, isec->sid,
3588                            SECCLASS_KERNEL_SERVICE,
3589                            KERNEL_SERVICE__CREATE_FILES_AS,
3590                            NULL);
3591
3592         if (ret == 0)
3593                 tsec->create_sid = isec->sid;
3594         return ret;
3595 }
3596
3597 static int selinux_kernel_module_request(char *kmod_name)
3598 {
3599         u32 sid;
3600         struct common_audit_data ad;
3601
3602         sid = task_sid(current);
3603
3604         ad.type = LSM_AUDIT_DATA_KMOD;
3605         ad.u.kmod_name = kmod_name;
3606
3607         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3608                             SYSTEM__MODULE_REQUEST, &ad);
3609 }
3610
3611 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3612 {
3613         return current_has_perm(p, PROCESS__SETPGID);
3614 }
3615
3616 static int selinux_task_getpgid(struct task_struct *p)
3617 {
3618         return current_has_perm(p, PROCESS__GETPGID);
3619 }
3620
3621 static int selinux_task_getsid(struct task_struct *p)
3622 {
3623         return current_has_perm(p, PROCESS__GETSESSION);
3624 }
3625
3626 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3627 {
3628         *secid = task_sid(p);
3629 }
3630
3631 static int selinux_task_setnice(struct task_struct *p, int nice)
3632 {
3633         return current_has_perm(p, PROCESS__SETSCHED);
3634 }
3635
3636 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3637 {
3638         return current_has_perm(p, PROCESS__SETSCHED);
3639 }
3640
3641 static int selinux_task_getioprio(struct task_struct *p)
3642 {
3643         return current_has_perm(p, PROCESS__GETSCHED);
3644 }
3645
3646 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3647                 struct rlimit *new_rlim)
3648 {
3649         struct rlimit *old_rlim = p->signal->rlim + resource;
3650
3651         /* Control the ability to change the hard limit (whether
3652            lowering or raising it), so that the hard limit can
3653            later be used as a safe reset point for the soft limit
3654            upon context transitions.  See selinux_bprm_committing_creds. */
3655         if (old_rlim->rlim_max != new_rlim->rlim_max)
3656                 return current_has_perm(p, PROCESS__SETRLIMIT);
3657
3658         return 0;
3659 }
3660
3661 static int selinux_task_setscheduler(struct task_struct *p)
3662 {
3663         return current_has_perm(p, PROCESS__SETSCHED);
3664 }
3665
3666 static int selinux_task_getscheduler(struct task_struct *p)
3667 {
3668         return current_has_perm(p, PROCESS__GETSCHED);
3669 }
3670
3671 static int selinux_task_movememory(struct task_struct *p)
3672 {
3673         return current_has_perm(p, PROCESS__SETSCHED);
3674 }
3675
3676 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3677                                 int sig, u32 secid)
3678 {
3679         u32 perm;
3680         int rc;
3681
3682         if (!sig)
3683                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3684         else
3685                 perm = signal_to_av(sig);
3686         if (secid)
3687                 rc = avc_has_perm(secid, task_sid(p),
3688                                   SECCLASS_PROCESS, perm, NULL);
3689         else
3690                 rc = current_has_perm(p, perm);
3691         return rc;
3692 }
3693
3694 static int selinux_task_wait(struct task_struct *p)
3695 {
3696         return task_has_perm(p, current, PROCESS__SIGCHLD);
3697 }
3698
3699 static void selinux_task_to_inode(struct task_struct *p,
3700                                   struct inode *inode)
3701 {
3702         struct inode_security_struct *isec = inode->i_security;
3703         u32 sid = task_sid(p);
3704
3705         isec->sid = sid;
3706         isec->initialized = 1;
3707 }
3708
3709 /* Returns error only if unable to parse addresses */
3710 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3711                         struct common_audit_data *ad, u8 *proto)
3712 {
3713         int offset, ihlen, ret = -EINVAL;
3714         struct iphdr _iph, *ih;
3715
3716         offset = skb_network_offset(skb);
3717         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3718         if (ih == NULL)
3719                 goto out;
3720
3721         ihlen = ih->ihl * 4;
3722         if (ihlen < sizeof(_iph))
3723                 goto out;
3724
3725         ad->u.net->v4info.saddr = ih->saddr;
3726         ad->u.net->v4info.daddr = ih->daddr;
3727         ret = 0;
3728
3729         if (proto)
3730                 *proto = ih->protocol;
3731
3732         switch (ih->protocol) {
3733         case IPPROTO_TCP: {
3734                 struct tcphdr _tcph, *th;
3735
3736                 if (ntohs(ih->frag_off) & IP_OFFSET)
3737                         break;
3738
3739                 offset += ihlen;
3740                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3741                 if (th == NULL)
3742                         break;
3743
3744                 ad->u.net->sport = th->source;
3745                 ad->u.net->dport = th->dest;
3746                 break;
3747         }
3748
3749         case IPPROTO_UDP: {
3750                 struct udphdr _udph, *uh;
3751
3752                 if (ntohs(ih->frag_off) & IP_OFFSET)
3753                         break;
3754
3755                 offset += ihlen;
3756                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3757                 if (uh == NULL)
3758                         break;
3759
3760                 ad->u.net->sport = uh->source;
3761                 ad->u.net->dport = uh->dest;
3762                 break;
3763         }
3764
3765         case IPPROTO_DCCP: {
3766                 struct dccp_hdr _dccph, *dh;
3767
3768                 if (ntohs(ih->frag_off) & IP_OFFSET)
3769                         break;
3770
3771                 offset += ihlen;
3772                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3773                 if (dh == NULL)
3774                         break;
3775
3776                 ad->u.net->sport = dh->dccph_sport;
3777                 ad->u.net->dport = dh->dccph_dport;
3778                 break;
3779         }
3780
3781         default:
3782                 break;
3783         }
3784 out:
3785         return ret;
3786 }
3787
3788 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3789
3790 /* Returns error only if unable to parse addresses */
3791 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3792                         struct common_audit_data *ad, u8 *proto)
3793 {
3794         u8 nexthdr;
3795         int ret = -EINVAL, offset;
3796         struct ipv6hdr _ipv6h, *ip6;
3797         __be16 frag_off;
3798
3799         offset = skb_network_offset(skb);
3800         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3801         if (ip6 == NULL)
3802                 goto out;
3803
3804         ad->u.net->v6info.saddr = ip6->saddr;
3805         ad->u.net->v6info.daddr = ip6->daddr;
3806         ret = 0;
3807
3808         nexthdr = ip6->nexthdr;
3809         offset += sizeof(_ipv6h);
3810         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3811         if (offset < 0)
3812                 goto out;
3813
3814         if (proto)
3815                 *proto = nexthdr;
3816
3817         switch (nexthdr) {
3818         case IPPROTO_TCP: {
3819                 struct tcphdr _tcph, *th;
3820
3821                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3822                 if (th == NULL)
3823                         break;
3824
3825                 ad->u.net->sport = th->source;
3826                 ad->u.net->dport = th->dest;
3827                 break;
3828         }
3829
3830         case IPPROTO_UDP: {
3831                 struct udphdr _udph, *uh;
3832
3833                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3834                 if (uh == NULL)
3835                         break;
3836
3837                 ad->u.net->sport = uh->source;
3838                 ad->u.net->dport = uh->dest;
3839                 break;
3840         }
3841
3842         case IPPROTO_DCCP: {
3843                 struct dccp_hdr _dccph, *dh;
3844
3845                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3846                 if (dh == NULL)
3847                         break;
3848
3849                 ad->u.net->sport = dh->dccph_sport;
3850                 ad->u.net->dport = dh->dccph_dport;
3851                 break;
3852         }
3853
3854         /* includes fragments */
3855         default:
3856                 break;
3857         }
3858 out:
3859         return ret;
3860 }
3861
3862 #endif /* IPV6 */
3863
3864 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3865                              char **_addrp, int src, u8 *proto)
3866 {
3867         char *addrp;
3868         int ret;
3869
3870         switch (ad->u.net->family) {
3871         case PF_INET:
3872                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3873                 if (ret)
3874                         goto parse_error;
3875                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3876                                        &ad->u.net->v4info.daddr);
3877                 goto okay;
3878
3879 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3880         case PF_INET6:
3881                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3882                 if (ret)
3883                         goto parse_error;
3884                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3885                                        &ad->u.net->v6info.daddr);
3886                 goto okay;
3887 #endif  /* IPV6 */
3888         default:
3889                 addrp = NULL;
3890                 goto okay;
3891         }
3892
3893 parse_error:
3894         printk(KERN_WARNING
3895                "SELinux: failure in selinux_parse_skb(),"
3896                " unable to parse packet\n");
3897         return ret;
3898
3899 okay:
3900         if (_addrp)
3901                 *_addrp = addrp;
3902         return 0;
3903 }
3904
3905 /**
3906  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3907  * @skb: the packet
3908  * @family: protocol family
3909  * @sid: the packet's peer label SID
3910  *
3911  * Description:
3912  * Check the various different forms of network peer labeling and determine
3913  * the peer label/SID for the packet; most of the magic actually occurs in
3914  * the security server function security_net_peersid_cmp().  The function
3915  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3916  * or -EACCES if @sid is invalid due to inconsistencies with the different
3917  * peer labels.
3918  *
3919  */
3920 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3921 {
3922         int err;
3923         u32 xfrm_sid;
3924         u32 nlbl_sid;
3925         u32 nlbl_type;
3926
3927         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3928         if (unlikely(err))
3929                 return -EACCES;
3930         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3931         if (unlikely(err))
3932                 return -EACCES;
3933
3934         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3935         if (unlikely(err)) {
3936                 printk(KERN_WARNING
3937                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3938                        " unable to determine packet's peer label\n");
3939                 return -EACCES;
3940         }
3941
3942         return 0;
3943 }
3944
3945 /**
3946  * selinux_conn_sid - Determine the child socket label for a connection
3947  * @sk_sid: the parent socket's SID
3948  * @skb_sid: the packet's SID
3949  * @conn_sid: the resulting connection SID
3950  *
3951  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3952  * combined with the MLS information from @skb_sid in order to create
3953  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3954  * of @sk_sid.  Returns zero on success, negative values on failure.
3955  *
3956  */
3957 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3958 {
3959         int err = 0;
3960
3961         if (skb_sid != SECSID_NULL)
3962                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3963         else
3964                 *conn_sid = sk_sid;
3965
3966         return err;
3967 }
3968
3969 /* socket security operations */
3970
3971 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3972                                  u16 secclass, u32 *socksid)
3973 {
3974         if (tsec->sockcreate_sid > SECSID_NULL) {
3975                 *socksid = tsec->sockcreate_sid;
3976                 return 0;
3977         }
3978
3979         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3980                                        socksid);
3981 }
3982
3983 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3984 {
3985         struct sk_security_struct *sksec = sk->sk_security;
3986         struct common_audit_data ad;
3987         struct lsm_network_audit net = {0,};
3988         u32 tsid = task_sid(task);
3989
3990         if (sksec->sid == SECINITSID_KERNEL)
3991                 return 0;
3992
3993         ad.type = LSM_AUDIT_DATA_NET;
3994         ad.u.net = &net;
3995         ad.u.net->sk = sk;
3996
3997         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3998 }
3999
4000 static int selinux_socket_create(int family, int type,
4001                                  int protocol, int kern)
4002 {
4003         const struct task_security_struct *tsec = current_security();
4004         u32 newsid;
4005         u16 secclass;
4006         int rc;
4007
4008         if (kern)
4009                 return 0;
4010
4011         secclass = socket_type_to_security_class(family, type, protocol);
4012         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4013         if (rc)
4014                 return rc;
4015
4016         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4017 }
4018
4019 static int selinux_socket_post_create(struct socket *sock, int family,
4020                                       int type, int protocol, int kern)
4021 {
4022         const struct task_security_struct *tsec = current_security();
4023         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4024         struct sk_security_struct *sksec;
4025         int err = 0;
4026
4027         isec->sclass = socket_type_to_security_class(family, type, protocol);
4028
4029         if (kern)
4030                 isec->sid = SECINITSID_KERNEL;
4031         else {
4032                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4033                 if (err)
4034                         return err;
4035         }
4036
4037         isec->initialized = 1;
4038
4039         if (sock->sk) {
4040                 sksec = sock->sk->sk_security;
4041                 sksec->sid = isec->sid;
4042                 sksec->sclass = isec->sclass;
4043                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4044         }
4045
4046         return err;
4047 }
4048
4049 /* Range of port numbers used to automatically bind.
4050    Need to determine whether we should perform a name_bind
4051    permission check between the socket and the port number. */
4052
4053 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4054 {
4055         struct sock *sk = sock->sk;
4056         u16 family;
4057         int err;
4058
4059         err = sock_has_perm(current, sk, SOCKET__BIND);
4060         if (err)
4061                 goto out;
4062
4063         /*
4064          * If PF_INET or PF_INET6, check name_bind permission for the port.
4065          * Multiple address binding for SCTP is not supported yet: we just
4066          * check the first address now.
4067          */
4068         family = sk->sk_family;
4069         if (family == PF_INET || family == PF_INET6) {
4070                 char *addrp;
4071                 struct sk_security_struct *sksec = sk->sk_security;
4072                 struct common_audit_data ad;
4073                 struct lsm_network_audit net = {0,};
4074                 struct sockaddr_in *addr4 = NULL;
4075                 struct sockaddr_in6 *addr6 = NULL;
4076                 unsigned short snum;
4077                 u32 sid, node_perm;
4078
4079                 if (family == PF_INET) {
4080                         addr4 = (struct sockaddr_in *)address;
4081                         snum = ntohs(addr4->sin_port);
4082                         addrp = (char *)&addr4->sin_addr.s_addr;
4083                 } else {
4084                         addr6 = (struct sockaddr_in6 *)address;
4085                         snum = ntohs(addr6->sin6_port);
4086                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4087                 }
4088
4089                 if (snum) {
4090                         int low, high;
4091
4092                         inet_get_local_port_range(sock_net(sk), &low, &high);
4093
4094                         if (snum < max(PROT_SOCK, low) || snum > high) {
4095                                 err = sel_netport_sid(sk->sk_protocol,
4096                                                       snum, &sid);
4097                                 if (err)
4098                                         goto out;
4099                                 ad.type = LSM_AUDIT_DATA_NET;
4100                                 ad.u.net = &net;
4101                                 ad.u.net->sport = htons(snum);
4102                                 ad.u.net->family = family;
4103                                 err = avc_has_perm(sksec->sid, sid,
4104                                                    sksec->sclass,
4105                                                    SOCKET__NAME_BIND, &ad);
4106                                 if (err)
4107                                         goto out;
4108                         }
4109                 }
4110
4111                 switch (sksec->sclass) {
4112                 case SECCLASS_TCP_SOCKET:
4113                         node_perm = TCP_SOCKET__NODE_BIND;
4114                         break;
4115
4116                 case SECCLASS_UDP_SOCKET:
4117                         node_perm = UDP_SOCKET__NODE_BIND;
4118                         break;
4119
4120                 case SECCLASS_DCCP_SOCKET:
4121                         node_perm = DCCP_SOCKET__NODE_BIND;
4122                         break;
4123
4124                 default:
4125                         node_perm = RAWIP_SOCKET__NODE_BIND;
4126                         break;
4127                 }
4128
4129                 err = sel_netnode_sid(addrp, family, &sid);
4130                 if (err)
4131                         goto out;
4132
4133                 ad.type = LSM_AUDIT_DATA_NET;
4134                 ad.u.net = &net;
4135                 ad.u.net->sport = htons(snum);
4136                 ad.u.net->family = family;
4137
4138                 if (family == PF_INET)
4139                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4140                 else
4141                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4142
4143                 err = avc_has_perm(sksec->sid, sid,
4144                                    sksec->sclass, node_perm, &ad);
4145                 if (err)
4146                         goto out;
4147         }
4148 out:
4149         return err;
4150 }
4151
4152 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4153 {
4154         struct sock *sk = sock->sk;
4155         struct sk_security_struct *sksec = sk->sk_security;
4156         int err;
4157
4158         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4159         if (err)
4160                 return err;
4161
4162         /*
4163          * If a TCP or DCCP socket, check name_connect permission for the port.
4164          */
4165         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4166             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4167                 struct common_audit_data ad;
4168                 struct lsm_network_audit net = {0,};
4169                 struct sockaddr_in *addr4 = NULL;
4170                 struct sockaddr_in6 *addr6 = NULL;
4171                 unsigned short snum;
4172                 u32 sid, perm;
4173
4174                 if (sk->sk_family == PF_INET) {
4175                         addr4 = (struct sockaddr_in *)address;
4176                         if (addrlen < sizeof(struct sockaddr_in))
4177                                 return -EINVAL;
4178                         snum = ntohs(addr4->sin_port);
4179                 } else {
4180                         addr6 = (struct sockaddr_in6 *)address;
4181                         if (addrlen < SIN6_LEN_RFC2133)
4182                                 return -EINVAL;
4183                         snum = ntohs(addr6->sin6_port);
4184                 }
4185
4186                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4187                 if (err)
4188                         goto out;
4189
4190                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4191                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4192
4193                 ad.type = LSM_AUDIT_DATA_NET;
4194                 ad.u.net = &net;
4195                 ad.u.net->dport = htons(snum);
4196                 ad.u.net->family = sk->sk_family;
4197                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4198                 if (err)
4199                         goto out;
4200         }
4201
4202         err = selinux_netlbl_socket_connect(sk, address);
4203
4204 out:
4205         return err;
4206 }
4207
4208 static int selinux_socket_listen(struct socket *sock, int backlog)
4209 {
4210         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4211 }
4212
4213 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4214 {
4215         int err;
4216         struct inode_security_struct *isec;
4217         struct inode_security_struct *newisec;
4218
4219         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4220         if (err)
4221                 return err;
4222
4223         newisec = SOCK_INODE(newsock)->i_security;
4224
4225         isec = SOCK_INODE(sock)->i_security;
4226         newisec->sclass = isec->sclass;
4227         newisec->sid = isec->sid;
4228         newisec->initialized = 1;
4229
4230         return 0;
4231 }
4232
4233 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4234                                   int size)
4235 {
4236         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4237 }
4238
4239 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4240                                   int size, int flags)
4241 {
4242         return sock_has_perm(current, sock->sk, SOCKET__READ);
4243 }
4244
4245 static int selinux_socket_getsockname(struct socket *sock)
4246 {
4247         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4248 }
4249
4250 static int selinux_socket_getpeername(struct socket *sock)
4251 {
4252         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4253 }
4254
4255 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4256 {
4257         int err;
4258
4259         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4260         if (err)
4261                 return err;
4262
4263         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4264 }
4265
4266 static int selinux_socket_getsockopt(struct socket *sock, int level,
4267                                      int optname)
4268 {
4269         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4270 }
4271
4272 static int selinux_socket_shutdown(struct socket *sock, int how)
4273 {
4274         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4275 }
4276
4277 static int selinux_socket_unix_stream_connect(struct sock *sock,
4278                                               struct sock *other,
4279                                               struct sock *newsk)
4280 {
4281         struct sk_security_struct *sksec_sock = sock->sk_security;
4282         struct sk_security_struct *sksec_other = other->sk_security;
4283         struct sk_security_struct *sksec_new = newsk->sk_security;
4284         struct common_audit_data ad;
4285         struct lsm_network_audit net = {0,};
4286         int err;
4287
4288         ad.type = LSM_AUDIT_DATA_NET;
4289         ad.u.net = &net;
4290         ad.u.net->sk = other;
4291
4292         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4293                            sksec_other->sclass,
4294                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4295         if (err)
4296                 return err;
4297
4298         /* server child socket */
4299         sksec_new->peer_sid = sksec_sock->sid;
4300         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4301                                     &sksec_new->sid);
4302         if (err)
4303                 return err;
4304
4305         /* connecting socket */
4306         sksec_sock->peer_sid = sksec_new->sid;
4307
4308         return 0;
4309 }
4310
4311 static int selinux_socket_unix_may_send(struct socket *sock,
4312                                         struct socket *other)
4313 {
4314         struct sk_security_struct *ssec = sock->sk->sk_security;
4315         struct sk_security_struct *osec = other->sk->sk_security;
4316         struct common_audit_data ad;
4317         struct lsm_network_audit net = {0,};
4318
4319         ad.type = LSM_AUDIT_DATA_NET;
4320         ad.u.net = &net;
4321         ad.u.net->sk = other->sk;
4322
4323         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4324                             &ad);
4325 }
4326
4327 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4328                                     char *addrp, u16 family, u32 peer_sid,
4329                                     struct common_audit_data *ad)
4330 {
4331         int err;
4332         u32 if_sid;
4333         u32 node_sid;
4334
4335         err = sel_netif_sid(ns, ifindex, &if_sid);
4336         if (err)
4337                 return err;
4338         err = avc_has_perm(peer_sid, if_sid,
4339                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4340         if (err)
4341                 return err;
4342
4343         err = sel_netnode_sid(addrp, family, &node_sid);
4344         if (err)
4345                 return err;
4346         return avc_has_perm(peer_sid, node_sid,
4347                             SECCLASS_NODE, NODE__RECVFROM, ad);
4348 }
4349
4350 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4351                                        u16 family)
4352 {
4353         int err = 0;
4354         struct sk_security_struct *sksec = sk->sk_security;
4355         u32 sk_sid = sksec->sid;
4356         struct common_audit_data ad;
4357         struct lsm_network_audit net = {0,};
4358         char *addrp;
4359
4360         ad.type = LSM_AUDIT_DATA_NET;
4361         ad.u.net = &net;
4362         ad.u.net->netif = skb->skb_iif;
4363         ad.u.net->family = family;
4364         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4365         if (err)
4366                 return err;
4367
4368         if (selinux_secmark_enabled()) {
4369                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4370                                    PACKET__RECV, &ad);
4371                 if (err)
4372                         return err;
4373         }
4374
4375         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4376         if (err)
4377                 return err;
4378         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4379
4380         return err;
4381 }
4382
4383 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4384 {
4385         int err;
4386         struct sk_security_struct *sksec = sk->sk_security;
4387         u16 family = sk->sk_family;
4388         u32 sk_sid = sksec->sid;
4389         struct common_audit_data ad;
4390         struct lsm_network_audit net = {0,};
4391         char *addrp;
4392         u8 secmark_active;
4393         u8 peerlbl_active;
4394
4395         if (family != PF_INET && family != PF_INET6)
4396                 return 0;
4397
4398         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4399         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4400                 family = PF_INET;
4401
4402         /* If any sort of compatibility mode is enabled then handoff processing
4403          * to the selinux_sock_rcv_skb_compat() function to deal with the
4404          * special handling.  We do this in an attempt to keep this function
4405          * as fast and as clean as possible. */
4406         if (!selinux_policycap_netpeer)
4407                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4408
4409         secmark_active = selinux_secmark_enabled();
4410         peerlbl_active = selinux_peerlbl_enabled();
4411         if (!secmark_active && !peerlbl_active)
4412                 return 0;
4413
4414         ad.type = LSM_AUDIT_DATA_NET;
4415         ad.u.net = &net;
4416         ad.u.net->netif = skb->skb_iif;
4417         ad.u.net->family = family;
4418         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4419         if (err)
4420                 return err;
4421
4422         if (peerlbl_active) {
4423                 u32 peer_sid;
4424
4425                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4426                 if (err)
4427                         return err;
4428                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4429                                                addrp, family, peer_sid, &ad);
4430                 if (err) {
4431                         selinux_netlbl_err(skb, err, 0);
4432                         return err;
4433                 }
4434                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4435                                    PEER__RECV, &ad);
4436                 if (err) {
4437                         selinux_netlbl_err(skb, err, 0);
4438                         return err;
4439                 }
4440         }
4441
4442         if (secmark_active) {
4443                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4444                                    PACKET__RECV, &ad);
4445                 if (err)
4446                         return err;
4447         }
4448
4449         return err;
4450 }
4451
4452 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4453                                             int __user *optlen, unsigned len)
4454 {
4455         int err = 0;
4456         char *scontext;
4457         u32 scontext_len;
4458         struct sk_security_struct *sksec = sock->sk->sk_security;
4459         u32 peer_sid = SECSID_NULL;
4460
4461         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4462             sksec->sclass == SECCLASS_TCP_SOCKET)
4463                 peer_sid = sksec->peer_sid;
4464         if (peer_sid == SECSID_NULL)
4465                 return -ENOPROTOOPT;
4466
4467         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4468         if (err)
4469                 return err;
4470
4471         if (scontext_len > len) {
4472                 err = -ERANGE;
4473                 goto out_len;
4474         }
4475
4476         if (copy_to_user(optval, scontext, scontext_len))
4477                 err = -EFAULT;
4478
4479 out_len:
4480         if (put_user(scontext_len, optlen))
4481                 err = -EFAULT;
4482         kfree(scontext);
4483         return err;
4484 }
4485
4486 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4487 {
4488         u32 peer_secid = SECSID_NULL;
4489         u16 family;
4490
4491         if (skb && skb->protocol == htons(ETH_P_IP))
4492                 family = PF_INET;
4493         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4494                 family = PF_INET6;
4495         else if (sock)
4496                 family = sock->sk->sk_family;
4497         else
4498                 goto out;
4499
4500         if (sock && family == PF_UNIX)
4501                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4502         else if (skb)
4503                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4504
4505 out:
4506         *secid = peer_secid;
4507         if (peer_secid == SECSID_NULL)
4508                 return -EINVAL;
4509         return 0;
4510 }
4511
4512 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4513 {
4514         struct sk_security_struct *sksec;
4515
4516         sksec = kzalloc(sizeof(*sksec), priority);
4517         if (!sksec)
4518                 return -ENOMEM;
4519
4520         sksec->peer_sid = SECINITSID_UNLABELED;
4521         sksec->sid = SECINITSID_UNLABELED;
4522         selinux_netlbl_sk_security_reset(sksec);
4523         sk->sk_security = sksec;
4524
4525         return 0;
4526 }
4527
4528 static void selinux_sk_free_security(struct sock *sk)
4529 {
4530         struct sk_security_struct *sksec = sk->sk_security;
4531
4532         sk->sk_security = NULL;
4533         selinux_netlbl_sk_security_free(sksec);
4534         kfree(sksec);
4535 }
4536
4537 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4538 {
4539         struct sk_security_struct *sksec = sk->sk_security;
4540         struct sk_security_struct *newsksec = newsk->sk_security;
4541
4542         newsksec->sid = sksec->sid;
4543         newsksec->peer_sid = sksec->peer_sid;
4544         newsksec->sclass = sksec->sclass;
4545
4546         selinux_netlbl_sk_security_reset(newsksec);
4547 }
4548
4549 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4550 {
4551         if (!sk)
4552                 *secid = SECINITSID_ANY_SOCKET;
4553         else {
4554                 struct sk_security_struct *sksec = sk->sk_security;
4555
4556                 *secid = sksec->sid;
4557         }
4558 }
4559
4560 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4561 {
4562         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4563         struct sk_security_struct *sksec = sk->sk_security;
4564
4565         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4566             sk->sk_family == PF_UNIX)
4567                 isec->sid = sksec->sid;
4568         sksec->sclass = isec->sclass;
4569 }
4570
4571 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4572                                      struct request_sock *req)
4573 {
4574         struct sk_security_struct *sksec = sk->sk_security;
4575         int err;
4576         u16 family = req->rsk_ops->family;
4577         u32 connsid;
4578         u32 peersid;
4579
4580         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4581         if (err)
4582                 return err;
4583         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4584         if (err)
4585                 return err;
4586         req->secid = connsid;
4587         req->peer_secid = peersid;
4588
4589         return selinux_netlbl_inet_conn_request(req, family);
4590 }
4591
4592 static void selinux_inet_csk_clone(struct sock *newsk,
4593                                    const struct request_sock *req)
4594 {
4595         struct sk_security_struct *newsksec = newsk->sk_security;
4596
4597         newsksec->sid = req->secid;
4598         newsksec->peer_sid = req->peer_secid;
4599         /* NOTE: Ideally, we should also get the isec->sid for the
4600            new socket in sync, but we don't have the isec available yet.
4601            So we will wait until sock_graft to do it, by which
4602            time it will have been created and available. */
4603
4604         /* We don't need to take any sort of lock here as we are the only
4605          * thread with access to newsksec */
4606         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4607 }
4608
4609 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4610 {
4611         u16 family = sk->sk_family;
4612         struct sk_security_struct *sksec = sk->sk_security;
4613
4614         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4615         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4616                 family = PF_INET;
4617
4618         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4619 }
4620
4621 static int selinux_secmark_relabel_packet(u32 sid)
4622 {
4623         const struct task_security_struct *__tsec;
4624         u32 tsid;
4625
4626         __tsec = current_security();
4627         tsid = __tsec->sid;
4628
4629         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4630 }
4631
4632 static void selinux_secmark_refcount_inc(void)
4633 {
4634         atomic_inc(&selinux_secmark_refcount);
4635 }
4636
4637 static void selinux_secmark_refcount_dec(void)
4638 {
4639         atomic_dec(&selinux_secmark_refcount);
4640 }
4641
4642 static void selinux_req_classify_flow(const struct request_sock *req,
4643                                       struct flowi *fl)
4644 {
4645         fl->flowi_secid = req->secid;
4646 }
4647
4648 static int selinux_tun_dev_alloc_security(void **security)
4649 {
4650         struct tun_security_struct *tunsec;
4651
4652         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4653         if (!tunsec)
4654                 return -ENOMEM;
4655         tunsec->sid = current_sid();
4656
4657         *security = tunsec;
4658         return 0;
4659 }
4660
4661 static void selinux_tun_dev_free_security(void *security)
4662 {
4663         kfree(security);
4664 }
4665
4666 static int selinux_tun_dev_create(void)
4667 {
4668         u32 sid = current_sid();
4669
4670         /* we aren't taking into account the "sockcreate" SID since the socket
4671          * that is being created here is not a socket in the traditional sense,
4672          * instead it is a private sock, accessible only to the kernel, and
4673          * representing a wide range of network traffic spanning multiple
4674          * connections unlike traditional sockets - check the TUN driver to
4675          * get a better understanding of why this socket is special */
4676
4677         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4678                             NULL);
4679 }
4680
4681 static int selinux_tun_dev_attach_queue(void *security)
4682 {
4683         struct tun_security_struct *tunsec = security;
4684
4685         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4686                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4687 }
4688
4689 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4690 {
4691         struct tun_security_struct *tunsec = security;
4692         struct sk_security_struct *sksec = sk->sk_security;
4693
4694         /* we don't currently perform any NetLabel based labeling here and it
4695          * isn't clear that we would want to do so anyway; while we could apply
4696          * labeling without the support of the TUN user the resulting labeled
4697          * traffic from the other end of the connection would almost certainly
4698          * cause confusion to the TUN user that had no idea network labeling
4699          * protocols were being used */
4700
4701         sksec->sid = tunsec->sid;
4702         sksec->sclass = SECCLASS_TUN_SOCKET;
4703
4704         return 0;
4705 }
4706
4707 static int selinux_tun_dev_open(void *security)
4708 {
4709         struct tun_security_struct *tunsec = security;
4710         u32 sid = current_sid();
4711         int err;
4712
4713         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4714                            TUN_SOCKET__RELABELFROM, NULL);
4715         if (err)
4716                 return err;
4717         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4718                            TUN_SOCKET__RELABELTO, NULL);
4719         if (err)
4720                 return err;
4721         tunsec->sid = sid;
4722
4723         return 0;
4724 }
4725
4726 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4727 {
4728         int err = 0;
4729         u32 perm;
4730         struct nlmsghdr *nlh;
4731         struct sk_security_struct *sksec = sk->sk_security;
4732
4733         if (skb->len < NLMSG_HDRLEN) {
4734                 err = -EINVAL;
4735                 goto out;
4736         }
4737         nlh = nlmsg_hdr(skb);
4738
4739         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4740         if (err) {
4741                 if (err == -EINVAL) {
4742                         printk(KERN_WARNING
4743                                "SELinux: unrecognized netlink message:"
4744                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4745                                sk->sk_protocol, nlh->nlmsg_type,
4746                                secclass_map[sksec->sclass - 1].name);
4747                         if (!selinux_enforcing || security_get_allow_unknown())
4748                                 err = 0;
4749                 }
4750
4751                 /* Ignore */
4752                 if (err == -ENOENT)
4753                         err = 0;
4754                 goto out;
4755         }
4756
4757         err = sock_has_perm(current, sk, perm);
4758 out:
4759         return err;
4760 }
4761
4762 #ifdef CONFIG_NETFILTER
4763
4764 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4765                                        const struct net_device *indev,
4766                                        u16 family)
4767 {
4768         int err;
4769         char *addrp;
4770         u32 peer_sid;
4771         struct common_audit_data ad;
4772         struct lsm_network_audit net = {0,};
4773         u8 secmark_active;
4774         u8 netlbl_active;
4775         u8 peerlbl_active;
4776
4777         if (!selinux_policycap_netpeer)
4778                 return NF_ACCEPT;
4779
4780         secmark_active = selinux_secmark_enabled();
4781         netlbl_active = netlbl_enabled();
4782         peerlbl_active = selinux_peerlbl_enabled();
4783         if (!secmark_active && !peerlbl_active)
4784                 return NF_ACCEPT;
4785
4786         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4787                 return NF_DROP;
4788
4789         ad.type = LSM_AUDIT_DATA_NET;
4790         ad.u.net = &net;
4791         ad.u.net->netif = indev->ifindex;
4792         ad.u.net->family = family;
4793         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4794                 return NF_DROP;
4795
4796         if (peerlbl_active) {
4797                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4798                                                addrp, family, peer_sid, &ad);
4799                 if (err) {
4800                         selinux_netlbl_err(skb, err, 1);
4801                         return NF_DROP;
4802                 }
4803         }
4804
4805         if (secmark_active)
4806                 if (avc_has_perm(peer_sid, skb->secmark,
4807                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4808                         return NF_DROP;
4809
4810         if (netlbl_active)
4811                 /* we do this in the FORWARD path and not the POST_ROUTING
4812                  * path because we want to make sure we apply the necessary
4813                  * labeling before IPsec is applied so we can leverage AH
4814                  * protection */
4815                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4816                         return NF_DROP;
4817
4818         return NF_ACCEPT;
4819 }
4820
4821 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4822                                          struct sk_buff *skb,
4823                                          const struct nf_hook_state *state)
4824 {
4825         return selinux_ip_forward(skb, state->in, PF_INET);
4826 }
4827
4828 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4829 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4830                                          struct sk_buff *skb,
4831                                          const struct nf_hook_state *state)
4832 {
4833         return selinux_ip_forward(skb, state->in, PF_INET6);
4834 }
4835 #endif  /* IPV6 */
4836
4837 static unsigned int selinux_ip_output(struct sk_buff *skb,
4838                                       u16 family)
4839 {
4840         struct sock *sk;
4841         u32 sid;
4842
4843         if (!netlbl_enabled())
4844                 return NF_ACCEPT;
4845
4846         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4847          * because we want to make sure we apply the necessary labeling
4848          * before IPsec is applied so we can leverage AH protection */
4849         sk = skb->sk;
4850         if (sk) {
4851                 struct sk_security_struct *sksec;
4852
4853                 if (sk->sk_state == TCP_LISTEN)
4854                         /* if the socket is the listening state then this
4855                          * packet is a SYN-ACK packet which means it needs to
4856                          * be labeled based on the connection/request_sock and
4857                          * not the parent socket.  unfortunately, we can't
4858                          * lookup the request_sock yet as it isn't queued on
4859                          * the parent socket until after the SYN-ACK is sent.
4860                          * the "solution" is to simply pass the packet as-is
4861                          * as any IP option based labeling should be copied
4862                          * from the initial connection request (in the IP
4863                          * layer).  it is far from ideal, but until we get a
4864                          * security label in the packet itself this is the
4865                          * best we can do. */
4866                         return NF_ACCEPT;
4867
4868                 /* standard practice, label using the parent socket */
4869                 sksec = sk->sk_security;
4870                 sid = sksec->sid;
4871         } else
4872                 sid = SECINITSID_KERNEL;
4873         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4874                 return NF_DROP;
4875
4876         return NF_ACCEPT;
4877 }
4878
4879 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4880                                         struct sk_buff *skb,
4881                                         const struct nf_hook_state *state)
4882 {
4883         return selinux_ip_output(skb, PF_INET);
4884 }
4885
4886 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4887                                                 int ifindex,
4888                                                 u16 family)
4889 {
4890         struct sock *sk = skb->sk;
4891         struct sk_security_struct *sksec;
4892         struct common_audit_data ad;
4893         struct lsm_network_audit net = {0,};
4894         char *addrp;
4895         u8 proto;
4896
4897         if (sk == NULL)
4898                 return NF_ACCEPT;
4899         sksec = sk->sk_security;
4900
4901         ad.type = LSM_AUDIT_DATA_NET;
4902         ad.u.net = &net;
4903         ad.u.net->netif = ifindex;
4904         ad.u.net->family = family;
4905         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4906                 return NF_DROP;
4907
4908         if (selinux_secmark_enabled())
4909                 if (avc_has_perm(sksec->sid, skb->secmark,
4910                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4911                         return NF_DROP_ERR(-ECONNREFUSED);
4912
4913         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4914                 return NF_DROP_ERR(-ECONNREFUSED);
4915
4916         return NF_ACCEPT;
4917 }
4918
4919 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4920                                          const struct net_device *outdev,
4921                                          u16 family)
4922 {
4923         u32 secmark_perm;
4924         u32 peer_sid;
4925         int ifindex = outdev->ifindex;
4926         struct sock *sk;
4927         struct common_audit_data ad;
4928         struct lsm_network_audit net = {0,};
4929         char *addrp;
4930         u8 secmark_active;
4931         u8 peerlbl_active;
4932
4933         /* If any sort of compatibility mode is enabled then handoff processing
4934          * to the selinux_ip_postroute_compat() function to deal with the
4935          * special handling.  We do this in an attempt to keep this function
4936          * as fast and as clean as possible. */
4937         if (!selinux_policycap_netpeer)
4938                 return selinux_ip_postroute_compat(skb, ifindex, family);
4939
4940         secmark_active = selinux_secmark_enabled();
4941         peerlbl_active = selinux_peerlbl_enabled();
4942         if (!secmark_active && !peerlbl_active)
4943                 return NF_ACCEPT;
4944
4945         sk = skb->sk;
4946
4947 #ifdef CONFIG_XFRM
4948         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4949          * packet transformation so allow the packet to pass without any checks
4950          * since we'll have another chance to perform access control checks
4951          * when the packet is on it's final way out.
4952          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4953          *       is NULL, in this case go ahead and apply access control.
4954          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4955          *       TCP listening state we cannot wait until the XFRM processing
4956          *       is done as we will miss out on the SA label if we do;
4957          *       unfortunately, this means more work, but it is only once per
4958          *       connection. */
4959         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4960             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4961                 return NF_ACCEPT;
4962 #endif
4963
4964         if (sk == NULL) {
4965                 /* Without an associated socket the packet is either coming
4966                  * from the kernel or it is being forwarded; check the packet
4967                  * to determine which and if the packet is being forwarded
4968                  * query the packet directly to determine the security label. */
4969                 if (skb->skb_iif) {
4970                         secmark_perm = PACKET__FORWARD_OUT;
4971                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4972                                 return NF_DROP;
4973                 } else {
4974                         secmark_perm = PACKET__SEND;
4975                         peer_sid = SECINITSID_KERNEL;
4976                 }
4977         } else if (sk->sk_state == TCP_LISTEN) {
4978                 /* Locally generated packet but the associated socket is in the
4979                  * listening state which means this is a SYN-ACK packet.  In
4980                  * this particular case the correct security label is assigned
4981                  * to the connection/request_sock but unfortunately we can't
4982                  * query the request_sock as it isn't queued on the parent
4983                  * socket until after the SYN-ACK packet is sent; the only
4984                  * viable choice is to regenerate the label like we do in
4985                  * selinux_inet_conn_request().  See also selinux_ip_output()
4986                  * for similar problems. */
4987                 u32 skb_sid;
4988                 struct sk_security_struct *sksec = sk->sk_security;
4989                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4990                         return NF_DROP;
4991                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4992                  * and the packet has been through at least one XFRM
4993                  * transformation then we must be dealing with the "final"
4994                  * form of labeled IPsec packet; since we've already applied
4995                  * all of our access controls on this packet we can safely
4996                  * pass the packet. */
4997                 if (skb_sid == SECSID_NULL) {
4998                         switch (family) {
4999                         case PF_INET:
5000                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5001                                         return NF_ACCEPT;
5002                                 break;
5003                         case PF_INET6:
5004                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5005                                         return NF_ACCEPT;
5006                                 break;
5007                         default:
5008                                 return NF_DROP_ERR(-ECONNREFUSED);
5009                         }
5010                 }
5011                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5012                         return NF_DROP;
5013                 secmark_perm = PACKET__SEND;
5014         } else {
5015                 /* Locally generated packet, fetch the security label from the
5016                  * associated socket. */
5017                 struct sk_security_struct *sksec = sk->sk_security;
5018                 peer_sid = sksec->sid;
5019                 secmark_perm = PACKET__SEND;
5020         }
5021
5022         ad.type = LSM_AUDIT_DATA_NET;
5023         ad.u.net = &net;
5024         ad.u.net->netif = ifindex;
5025         ad.u.net->family = family;
5026         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5027                 return NF_DROP;
5028
5029         if (secmark_active)
5030                 if (avc_has_perm(peer_sid, skb->secmark,
5031                                  SECCLASS_PACKET, secmark_perm, &ad))
5032                         return NF_DROP_ERR(-ECONNREFUSED);
5033
5034         if (peerlbl_active) {
5035                 u32 if_sid;
5036                 u32 node_sid;
5037
5038                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5039                         return NF_DROP;
5040                 if (avc_has_perm(peer_sid, if_sid,
5041                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5042                         return NF_DROP_ERR(-ECONNREFUSED);
5043
5044                 if (sel_netnode_sid(addrp, family, &node_sid))
5045                         return NF_DROP;
5046                 if (avc_has_perm(peer_sid, node_sid,
5047                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5048                         return NF_DROP_ERR(-ECONNREFUSED);
5049         }
5050
5051         return NF_ACCEPT;
5052 }
5053
5054 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5055                                            struct sk_buff *skb,
5056                                            const struct nf_hook_state *state)
5057 {
5058         return selinux_ip_postroute(skb, state->out, PF_INET);
5059 }
5060
5061 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5062 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5063                                            struct sk_buff *skb,
5064                                            const struct nf_hook_state *state)
5065 {
5066         return selinux_ip_postroute(skb, state->out, PF_INET6);
5067 }
5068 #endif  /* IPV6 */
5069
5070 #endif  /* CONFIG_NETFILTER */
5071
5072 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5073 {
5074         return selinux_nlmsg_perm(sk, skb);
5075 }
5076
5077 static int ipc_alloc_security(struct task_struct *task,
5078                               struct kern_ipc_perm *perm,
5079                               u16 sclass)
5080 {
5081         struct ipc_security_struct *isec;
5082         u32 sid;
5083
5084         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5085         if (!isec)
5086                 return -ENOMEM;
5087
5088         sid = task_sid(task);
5089         isec->sclass = sclass;
5090         isec->sid = sid;
5091         perm->security = isec;
5092
5093         return 0;
5094 }
5095
5096 static void ipc_free_security(struct kern_ipc_perm *perm)
5097 {
5098         struct ipc_security_struct *isec = perm->security;
5099         perm->security = NULL;
5100         kfree(isec);
5101 }
5102
5103 static int msg_msg_alloc_security(struct msg_msg *msg)
5104 {
5105         struct msg_security_struct *msec;
5106
5107         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5108         if (!msec)
5109                 return -ENOMEM;
5110
5111         msec->sid = SECINITSID_UNLABELED;
5112         msg->security = msec;
5113
5114         return 0;
5115 }
5116
5117 static void msg_msg_free_security(struct msg_msg *msg)
5118 {
5119         struct msg_security_struct *msec = msg->security;
5120
5121         msg->security = NULL;
5122         kfree(msec);
5123 }
5124
5125 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5126                         u32 perms)
5127 {
5128         struct ipc_security_struct *isec;
5129         struct common_audit_data ad;
5130         u32 sid = current_sid();
5131
5132         isec = ipc_perms->security;
5133
5134         ad.type = LSM_AUDIT_DATA_IPC;
5135         ad.u.ipc_id = ipc_perms->key;
5136
5137         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5138 }
5139
5140 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5141 {
5142         return msg_msg_alloc_security(msg);
5143 }
5144
5145 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5146 {
5147         msg_msg_free_security(msg);
5148 }
5149
5150 /* message queue security operations */
5151 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5152 {
5153         struct ipc_security_struct *isec;
5154         struct common_audit_data ad;
5155         u32 sid = current_sid();
5156         int rc;
5157
5158         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5159         if (rc)
5160                 return rc;
5161
5162         isec = msq->q_perm.security;
5163
5164         ad.type = LSM_AUDIT_DATA_IPC;
5165         ad.u.ipc_id = msq->q_perm.key;
5166
5167         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5168                           MSGQ__CREATE, &ad);
5169         if (rc) {
5170                 ipc_free_security(&msq->q_perm);
5171                 return rc;
5172         }
5173         return 0;
5174 }
5175
5176 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5177 {
5178         ipc_free_security(&msq->q_perm);
5179 }
5180
5181 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5182 {
5183         struct ipc_security_struct *isec;
5184         struct common_audit_data ad;
5185         u32 sid = current_sid();
5186
5187         isec = msq->q_perm.security;
5188
5189         ad.type = LSM_AUDIT_DATA_IPC;
5190         ad.u.ipc_id = msq->q_perm.key;
5191
5192         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5193                             MSGQ__ASSOCIATE, &ad);
5194 }
5195
5196 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5197 {
5198         int err;
5199         int perms;
5200
5201         switch (cmd) {
5202         case IPC_INFO:
5203         case MSG_INFO:
5204                 /* No specific object, just general system-wide information. */
5205                 return task_has_system(current, SYSTEM__IPC_INFO);
5206         case IPC_STAT:
5207         case MSG_STAT:
5208                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5209                 break;
5210         case IPC_SET:
5211                 perms = MSGQ__SETATTR;
5212                 break;
5213         case IPC_RMID:
5214                 perms = MSGQ__DESTROY;
5215                 break;
5216         default:
5217                 return 0;
5218         }
5219
5220         err = ipc_has_perm(&msq->q_perm, perms);
5221         return err;
5222 }
5223
5224 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5225 {
5226         struct ipc_security_struct *isec;
5227         struct msg_security_struct *msec;
5228         struct common_audit_data ad;
5229         u32 sid = current_sid();
5230         int rc;
5231
5232         isec = msq->q_perm.security;
5233         msec = msg->security;
5234
5235         /*
5236          * First time through, need to assign label to the message
5237          */
5238         if (msec->sid == SECINITSID_UNLABELED) {
5239                 /*
5240                  * Compute new sid based on current process and
5241                  * message queue this message will be stored in
5242                  */
5243                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5244                                              NULL, &msec->sid);
5245                 if (rc)
5246                         return rc;
5247         }
5248
5249         ad.type = LSM_AUDIT_DATA_IPC;
5250         ad.u.ipc_id = msq->q_perm.key;
5251
5252         /* Can this process write to the queue? */
5253         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5254                           MSGQ__WRITE, &ad);
5255         if (!rc)
5256                 /* Can this process send the message */
5257                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5258                                   MSG__SEND, &ad);
5259         if (!rc)
5260                 /* Can the message be put in the queue? */
5261                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5262                                   MSGQ__ENQUEUE, &ad);
5263
5264         return rc;
5265 }
5266
5267 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5268                                     struct task_struct *target,
5269                                     long type, int mode)
5270 {
5271         struct ipc_security_struct *isec;
5272         struct msg_security_struct *msec;
5273         struct common_audit_data ad;
5274         u32 sid = task_sid(target);
5275         int rc;
5276
5277         isec = msq->q_perm.security;
5278         msec = msg->security;
5279
5280         ad.type = LSM_AUDIT_DATA_IPC;
5281         ad.u.ipc_id = msq->q_perm.key;
5282
5283         rc = avc_has_perm(sid, isec->sid,
5284                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5285         if (!rc)
5286                 rc = avc_has_perm(sid, msec->sid,
5287                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5288         return rc;
5289 }
5290
5291 /* Shared Memory security operations */
5292 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5293 {
5294         struct ipc_security_struct *isec;
5295         struct common_audit_data ad;
5296         u32 sid = current_sid();
5297         int rc;
5298
5299         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5300         if (rc)
5301                 return rc;
5302
5303         isec = shp->shm_perm.security;
5304
5305         ad.type = LSM_AUDIT_DATA_IPC;
5306         ad.u.ipc_id = shp->shm_perm.key;
5307
5308         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5309                           SHM__CREATE, &ad);
5310         if (rc) {
5311                 ipc_free_security(&shp->shm_perm);
5312                 return rc;
5313         }
5314         return 0;
5315 }
5316
5317 static void selinux_shm_free_security(struct shmid_kernel *shp)
5318 {
5319         ipc_free_security(&shp->shm_perm);
5320 }
5321
5322 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5323 {
5324         struct ipc_security_struct *isec;
5325         struct common_audit_data ad;
5326         u32 sid = current_sid();
5327
5328         isec = shp->shm_perm.security;
5329
5330         ad.type = LSM_AUDIT_DATA_IPC;
5331         ad.u.ipc_id = shp->shm_perm.key;
5332
5333         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5334                             SHM__ASSOCIATE, &ad);
5335 }
5336
5337 /* Note, at this point, shp is locked down */
5338 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5339 {
5340         int perms;
5341         int err;
5342
5343         switch (cmd) {
5344         case IPC_INFO:
5345         case SHM_INFO:
5346                 /* No specific object, just general system-wide information. */
5347                 return task_has_system(current, SYSTEM__IPC_INFO);
5348         case IPC_STAT:
5349         case SHM_STAT:
5350                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5351                 break;
5352         case IPC_SET:
5353                 perms = SHM__SETATTR;
5354                 break;
5355         case SHM_LOCK:
5356         case SHM_UNLOCK:
5357                 perms = SHM__LOCK;
5358                 break;
5359         case IPC_RMID:
5360                 perms = SHM__DESTROY;
5361                 break;
5362         default:
5363                 return 0;
5364         }
5365
5366         err = ipc_has_perm(&shp->shm_perm, perms);
5367         return err;
5368 }
5369
5370 static int selinux_shm_shmat(struct shmid_kernel *shp,
5371                              char __user *shmaddr, int shmflg)
5372 {
5373         u32 perms;
5374
5375         if (shmflg & SHM_RDONLY)
5376                 perms = SHM__READ;
5377         else
5378                 perms = SHM__READ | SHM__WRITE;
5379
5380         return ipc_has_perm(&shp->shm_perm, perms);
5381 }
5382
5383 /* Semaphore security operations */
5384 static int selinux_sem_alloc_security(struct sem_array *sma)
5385 {
5386         struct ipc_security_struct *isec;
5387         struct common_audit_data ad;
5388         u32 sid = current_sid();
5389         int rc;
5390
5391         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5392         if (rc)
5393                 return rc;
5394
5395         isec = sma->sem_perm.security;
5396
5397         ad.type = LSM_AUDIT_DATA_IPC;
5398         ad.u.ipc_id = sma->sem_perm.key;
5399
5400         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5401                           SEM__CREATE, &ad);
5402         if (rc) {
5403                 ipc_free_security(&sma->sem_perm);
5404                 return rc;
5405         }
5406         return 0;
5407 }
5408
5409 static void selinux_sem_free_security(struct sem_array *sma)
5410 {
5411         ipc_free_security(&sma->sem_perm);
5412 }
5413
5414 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5415 {
5416         struct ipc_security_struct *isec;
5417         struct common_audit_data ad;
5418         u32 sid = current_sid();
5419
5420         isec = sma->sem_perm.security;
5421
5422         ad.type = LSM_AUDIT_DATA_IPC;
5423         ad.u.ipc_id = sma->sem_perm.key;
5424
5425         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5426                             SEM__ASSOCIATE, &ad);
5427 }
5428
5429 /* Note, at this point, sma is locked down */
5430 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5431 {
5432         int err;
5433         u32 perms;
5434
5435         switch (cmd) {
5436         case IPC_INFO:
5437         case SEM_INFO:
5438                 /* No specific object, just general system-wide information. */
5439                 return task_has_system(current, SYSTEM__IPC_INFO);
5440         case GETPID:
5441         case GETNCNT:
5442         case GETZCNT:
5443                 perms = SEM__GETATTR;
5444                 break;
5445         case GETVAL:
5446         case GETALL:
5447                 perms = SEM__READ;
5448                 break;
5449         case SETVAL:
5450         case SETALL:
5451                 perms = SEM__WRITE;
5452                 break;
5453         case IPC_RMID:
5454                 perms = SEM__DESTROY;
5455                 break;
5456         case IPC_SET:
5457                 perms = SEM__SETATTR;
5458                 break;
5459         case IPC_STAT:
5460         case SEM_STAT:
5461                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5462                 break;
5463         default:
5464                 return 0;
5465         }
5466
5467         err = ipc_has_perm(&sma->sem_perm, perms);
5468         return err;
5469 }
5470
5471 static int selinux_sem_semop(struct sem_array *sma,
5472                              struct sembuf *sops, unsigned nsops, int alter)
5473 {
5474         u32 perms;
5475
5476         if (alter)
5477                 perms = SEM__READ | SEM__WRITE;
5478         else
5479                 perms = SEM__READ;
5480
5481         return ipc_has_perm(&sma->sem_perm, perms);
5482 }
5483
5484 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5485 {
5486         u32 av = 0;
5487
5488         av = 0;
5489         if (flag & S_IRUGO)
5490                 av |= IPC__UNIX_READ;
5491         if (flag & S_IWUGO)
5492                 av |= IPC__UNIX_WRITE;
5493
5494         if (av == 0)
5495                 return 0;
5496
5497         return ipc_has_perm(ipcp, av);
5498 }
5499
5500 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5501 {
5502         struct ipc_security_struct *isec = ipcp->security;
5503         *secid = isec->sid;
5504 }
5505
5506 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5507 {
5508         if (inode)
5509                 inode_doinit_with_dentry(inode, dentry);
5510 }
5511
5512 static int selinux_getprocattr(struct task_struct *p,
5513                                char *name, char **value)
5514 {
5515         const struct task_security_struct *__tsec;
5516         u32 sid;
5517         int error;
5518         unsigned len;
5519
5520         if (current != p) {
5521                 error = current_has_perm(p, PROCESS__GETATTR);
5522                 if (error)
5523                         return error;
5524         }
5525
5526         rcu_read_lock();
5527         __tsec = __task_cred(p)->security;
5528
5529         if (!strcmp(name, "current"))
5530                 sid = __tsec->sid;
5531         else if (!strcmp(name, "prev"))
5532                 sid = __tsec->osid;
5533         else if (!strcmp(name, "exec"))
5534                 sid = __tsec->exec_sid;
5535         else if (!strcmp(name, "fscreate"))
5536                 sid = __tsec->create_sid;
5537         else if (!strcmp(name, "keycreate"))
5538                 sid = __tsec->keycreate_sid;
5539         else if (!strcmp(name, "sockcreate"))
5540                 sid = __tsec->sockcreate_sid;
5541         else
5542                 goto invalid;
5543         rcu_read_unlock();
5544
5545         if (!sid)
5546                 return 0;
5547
5548         error = security_sid_to_context(sid, value, &len);
5549         if (error)
5550                 return error;
5551         return len;
5552
5553 invalid:
5554         rcu_read_unlock();
5555         return -EINVAL;
5556 }
5557
5558 static int selinux_setprocattr(struct task_struct *p,
5559                                char *name, void *value, size_t size)
5560 {
5561         struct task_security_struct *tsec;
5562         struct task_struct *tracer;
5563         struct cred *new;
5564         u32 sid = 0, ptsid;
5565         int error;
5566         char *str = value;
5567
5568         if (current != p) {
5569                 /* SELinux only allows a process to change its own
5570                    security attributes. */
5571                 return -EACCES;
5572         }
5573
5574         /*
5575          * Basic control over ability to set these attributes at all.
5576          * current == p, but we'll pass them separately in case the
5577          * above restriction is ever removed.
5578          */
5579         if (!strcmp(name, "exec"))
5580                 error = current_has_perm(p, PROCESS__SETEXEC);
5581         else if (!strcmp(name, "fscreate"))
5582                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5583         else if (!strcmp(name, "keycreate"))
5584                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5585         else if (!strcmp(name, "sockcreate"))
5586                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5587         else if (!strcmp(name, "current"))
5588                 error = current_has_perm(p, PROCESS__SETCURRENT);
5589         else
5590                 error = -EINVAL;
5591         if (error)
5592                 return error;
5593
5594         /* Obtain a SID for the context, if one was specified. */
5595         if (size && str[1] && str[1] != '\n') {
5596                 if (str[size-1] == '\n') {
5597                         str[size-1] = 0;
5598                         size--;
5599                 }
5600                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5601                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5602                         if (!capable(CAP_MAC_ADMIN)) {
5603                                 struct audit_buffer *ab;
5604                                 size_t audit_size;
5605
5606                                 /* We strip a nul only if it is at the end, otherwise the
5607                                  * context contains a nul and we should audit that */
5608                                 if (str[size - 1] == '\0')
5609                                         audit_size = size - 1;
5610                                 else
5611                                         audit_size = size;
5612                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5613                                 audit_log_format(ab, "op=fscreate invalid_context=");
5614                                 audit_log_n_untrustedstring(ab, value, audit_size);
5615                                 audit_log_end(ab);
5616
5617                                 return error;
5618                         }
5619                         error = security_context_to_sid_force(value, size,
5620                                                               &sid);
5621                 }
5622                 if (error)
5623                         return error;
5624         }
5625
5626         new = prepare_creds();
5627         if (!new)
5628                 return -ENOMEM;
5629
5630         /* Permission checking based on the specified context is
5631            performed during the actual operation (execve,
5632            open/mkdir/...), when we know the full context of the
5633            operation.  See selinux_bprm_set_creds for the execve
5634            checks and may_create for the file creation checks. The
5635            operation will then fail if the context is not permitted. */
5636         tsec = new->security;
5637         if (!strcmp(name, "exec")) {
5638                 tsec->exec_sid = sid;
5639         } else if (!strcmp(name, "fscreate")) {
5640                 tsec->create_sid = sid;
5641         } else if (!strcmp(name, "keycreate")) {
5642                 error = may_create_key(sid, p);
5643                 if (error)
5644                         goto abort_change;
5645                 tsec->keycreate_sid = sid;
5646         } else if (!strcmp(name, "sockcreate")) {
5647                 tsec->sockcreate_sid = sid;
5648         } else if (!strcmp(name, "current")) {
5649                 error = -EINVAL;
5650                 if (sid == 0)
5651                         goto abort_change;
5652
5653                 /* Only allow single threaded processes to change context */
5654                 error = -EPERM;
5655                 if (!current_is_single_threaded()) {
5656                         error = security_bounded_transition(tsec->sid, sid);
5657                         if (error)
5658                                 goto abort_change;
5659                 }
5660
5661                 /* Check permissions for the transition. */
5662                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5663                                      PROCESS__DYNTRANSITION, NULL);
5664                 if (error)
5665                         goto abort_change;
5666
5667                 /* Check for ptracing, and update the task SID if ok.
5668                    Otherwise, leave SID unchanged and fail. */
5669                 ptsid = 0;
5670                 rcu_read_lock();
5671                 tracer = ptrace_parent(p);
5672                 if (tracer)
5673                         ptsid = task_sid(tracer);
5674                 rcu_read_unlock();
5675
5676                 if (tracer) {
5677                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5678                                              PROCESS__PTRACE, NULL);
5679                         if (error)
5680                                 goto abort_change;
5681                 }
5682
5683                 tsec->sid = sid;
5684         } else {
5685                 error = -EINVAL;
5686                 goto abort_change;
5687         }
5688
5689         commit_creds(new);
5690         return size;
5691
5692 abort_change:
5693         abort_creds(new);
5694         return error;
5695 }
5696
5697 static int selinux_ismaclabel(const char *name)
5698 {
5699         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5700 }
5701
5702 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5703 {
5704         return security_sid_to_context(secid, secdata, seclen);
5705 }
5706
5707 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5708 {
5709         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5710 }
5711
5712 static void selinux_release_secctx(char *secdata, u32 seclen)
5713 {
5714         kfree(secdata);
5715 }
5716
5717 /*
5718  *      called with inode->i_mutex locked
5719  */
5720 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5721 {
5722         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5723 }
5724
5725 /*
5726  *      called with inode->i_mutex locked
5727  */
5728 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5729 {
5730         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5731 }
5732
5733 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5734 {
5735         int len = 0;
5736         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5737                                                 ctx, true);
5738         if (len < 0)
5739                 return len;
5740         *ctxlen = len;
5741         return 0;
5742 }
5743 #ifdef CONFIG_KEYS
5744
5745 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5746                              unsigned long flags)
5747 {
5748         const struct task_security_struct *tsec;
5749         struct key_security_struct *ksec;
5750
5751         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5752         if (!ksec)
5753                 return -ENOMEM;
5754
5755         tsec = cred->security;
5756         if (tsec->keycreate_sid)
5757                 ksec->sid = tsec->keycreate_sid;
5758         else
5759                 ksec->sid = tsec->sid;
5760
5761         k->security = ksec;
5762         return 0;
5763 }
5764
5765 static void selinux_key_free(struct key *k)
5766 {
5767         struct key_security_struct *ksec = k->security;
5768
5769         k->security = NULL;
5770         kfree(ksec);
5771 }
5772
5773 static int selinux_key_permission(key_ref_t key_ref,
5774                                   const struct cred *cred,
5775                                   unsigned perm)
5776 {
5777         struct key *key;
5778         struct key_security_struct *ksec;
5779         u32 sid;
5780
5781         /* if no specific permissions are requested, we skip the
5782            permission check. No serious, additional covert channels
5783            appear to be created. */
5784         if (perm == 0)
5785                 return 0;
5786
5787         sid = cred_sid(cred);
5788
5789         key = key_ref_to_ptr(key_ref);
5790         ksec = key->security;
5791
5792         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5793 }
5794
5795 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5796 {
5797         struct key_security_struct *ksec = key->security;
5798         char *context = NULL;
5799         unsigned len;
5800         int rc;
5801
5802         rc = security_sid_to_context(ksec->sid, &context, &len);
5803         if (!rc)
5804                 rc = len;
5805         *_buffer = context;
5806         return rc;
5807 }
5808
5809 #endif
5810
5811 static struct security_hook_list selinux_hooks[] = {
5812         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5813         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5814         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5815         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5816
5817         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5818         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5819         LSM_HOOK_INIT(capget, selinux_capget),
5820         LSM_HOOK_INIT(capset, selinux_capset),
5821         LSM_HOOK_INIT(capable, selinux_capable),
5822         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5823         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5824         LSM_HOOK_INIT(syslog, selinux_syslog),
5825         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5826
5827         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5828
5829         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5830         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5831         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5832         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5833
5834         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5835         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5836         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5837         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5838         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5839         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5840         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5841         LSM_HOOK_INIT(sb_mount, selinux_mount),
5842         LSM_HOOK_INIT(sb_umount, selinux_umount),
5843         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5844         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5845         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5846
5847         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5848
5849         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5850         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5851         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5852         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5853         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5854         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5855         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5856         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5857         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5858         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5859         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5860         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5861         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5862         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5863         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5864         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5865         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5866         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5867         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5868         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5869         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5870         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5871         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5872         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5873         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5874
5875         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5876         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5877         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5878         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5879         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5880         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5881         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5882         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5883         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5884         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5885         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5886         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5887
5888         LSM_HOOK_INIT(file_open, selinux_file_open),
5889
5890         LSM_HOOK_INIT(task_create, selinux_task_create),
5891         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5892         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5893         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5894         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5895         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5896         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5897         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5898         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5899         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5900         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5901         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5902         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5903         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5904         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5905         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5906         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5907         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5908         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5909         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5910         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5911         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5912
5913         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5914         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5915
5916         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5917         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5918
5919         LSM_HOOK_INIT(msg_queue_alloc_security,
5920                         selinux_msg_queue_alloc_security),
5921         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5922         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5923         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5924         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5925         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5926
5927         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5928         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5929         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5930         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5931         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5932
5933         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5934         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5935         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5936         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5937         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5938
5939         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5940
5941         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5942         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5943
5944         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5945         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5946         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5947         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5948         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5949         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5950         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5951
5952         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5953         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5954
5955         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5956         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5957         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5958         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
5959         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
5960         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
5961         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
5962         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
5963         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
5964         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
5965         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
5966         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
5967         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
5968         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
5969         LSM_HOOK_INIT(socket_getpeersec_stream,
5970                         selinux_socket_getpeersec_stream),
5971         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
5972         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
5973         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
5974         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
5975         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
5976         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
5977         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
5978         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
5979         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
5980         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
5981         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
5982         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
5983         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
5984         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
5985         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
5986         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
5987         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
5988         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
5989         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
5990
5991 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5992         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
5993         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
5994         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
5995         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
5996         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
5997         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
5998                         selinux_xfrm_state_alloc_acquire),
5999         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6000         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6001         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6002         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6003                         selinux_xfrm_state_pol_flow_match),
6004         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6005 #endif
6006
6007 #ifdef CONFIG_KEYS
6008         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6009         LSM_HOOK_INIT(key_free, selinux_key_free),
6010         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6011         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6012 #endif
6013
6014 #ifdef CONFIG_AUDIT
6015         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6016         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6017         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6018         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6019 #endif
6020 };
6021
6022 static __init int selinux_init(void)
6023 {
6024         if (!security_module_enable("selinux")) {
6025                 selinux_enabled = 0;
6026                 return 0;
6027         }
6028
6029         if (!selinux_enabled) {
6030                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6031                 return 0;
6032         }
6033
6034         printk(KERN_INFO "SELinux:  Initializing.\n");
6035
6036         /* Set the security state for the initial task. */
6037         cred_init_security();
6038
6039         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6040
6041         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6042                                             sizeof(struct inode_security_struct),
6043                                             0, SLAB_PANIC, NULL);
6044         avc_init();
6045
6046         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6047
6048         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6049                 panic("SELinux: Unable to register AVC netcache callback\n");
6050
6051         if (selinux_enforcing)
6052                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6053         else
6054                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6055
6056         return 0;
6057 }
6058
6059 static void delayed_superblock_init(struct super_block *sb, void *unused)
6060 {
6061         superblock_doinit(sb, NULL);
6062 }
6063
6064 void selinux_complete_init(void)
6065 {
6066         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6067
6068         /* Set up any superblocks initialized prior to the policy load. */
6069         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6070         iterate_supers(delayed_superblock_init, NULL);
6071 }
6072
6073 /* SELinux requires early initialization in order to label
6074    all processes and objects when they are created. */
6075 security_initcall(selinux_init);
6076
6077 #if defined(CONFIG_NETFILTER)
6078
6079 static struct nf_hook_ops selinux_nf_ops[] = {
6080         {
6081                 .hook =         selinux_ipv4_postroute,
6082                 .owner =        THIS_MODULE,
6083                 .pf =           NFPROTO_IPV4,
6084                 .hooknum =      NF_INET_POST_ROUTING,
6085                 .priority =     NF_IP_PRI_SELINUX_LAST,
6086         },
6087         {
6088                 .hook =         selinux_ipv4_forward,
6089                 .owner =        THIS_MODULE,
6090                 .pf =           NFPROTO_IPV4,
6091                 .hooknum =      NF_INET_FORWARD,
6092                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6093         },
6094         {
6095                 .hook =         selinux_ipv4_output,
6096                 .owner =        THIS_MODULE,
6097                 .pf =           NFPROTO_IPV4,
6098                 .hooknum =      NF_INET_LOCAL_OUT,
6099                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6100         },
6101 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6102         {
6103                 .hook =         selinux_ipv6_postroute,
6104                 .owner =        THIS_MODULE,
6105                 .pf =           NFPROTO_IPV6,
6106                 .hooknum =      NF_INET_POST_ROUTING,
6107                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6108         },
6109         {
6110                 .hook =         selinux_ipv6_forward,
6111                 .owner =        THIS_MODULE,
6112                 .pf =           NFPROTO_IPV6,
6113                 .hooknum =      NF_INET_FORWARD,
6114                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6115         },
6116 #endif  /* IPV6 */
6117 };
6118
6119 static int __init selinux_nf_ip_init(void)
6120 {
6121         int err;
6122
6123         if (!selinux_enabled)
6124                 return 0;
6125
6126         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6127
6128         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6129         if (err)
6130                 panic("SELinux: nf_register_hooks: error %d\n", err);
6131
6132         return 0;
6133 }
6134
6135 __initcall(selinux_nf_ip_init);
6136
6137 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6138 static void selinux_nf_ip_exit(void)
6139 {
6140         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6141
6142         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6143 }
6144 #endif
6145
6146 #else /* CONFIG_NETFILTER */
6147
6148 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6149 #define selinux_nf_ip_exit()
6150 #endif
6151
6152 #endif /* CONFIG_NETFILTER */
6153
6154 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6155 static int selinux_disabled;
6156
6157 int selinux_disable(void)
6158 {
6159         if (ss_initialized) {
6160                 /* Not permitted after initial policy load. */
6161                 return -EINVAL;
6162         }
6163
6164         if (selinux_disabled) {
6165                 /* Only do this once. */
6166                 return -EINVAL;
6167         }
6168
6169         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6170
6171         selinux_disabled = 1;
6172         selinux_enabled = 0;
6173
6174         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6175
6176         /* Try to destroy the avc node cache */
6177         avc_disable();
6178
6179         /* Unregister netfilter hooks. */
6180         selinux_nf_ip_exit();
6181
6182         /* Unregister selinuxfs. */
6183         exit_sel_fs();
6184
6185         return 0;
6186 }
6187 #endif