security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         /*
 259          * As not all inode security structures are in a list, we check for
 260          * empty list outside of the lock to make sure that we won't waste
 261          * time taking a lock doing nothing.
 262          *
 263          * The list_del_init() function can be safely called more than once.
 264          * It should not be possible for this function to be called with
 265          * concurrent list_add(), but for better safety against future changes
 266          * in the code, we use list_empty_careful() here.
 267          */
 268         if (!list_empty_careful(&isec->list)) {
 269                 spin_lock(&sbsec->isec_lock);
 270                 list_del_init(&isec->list);
 271                 spin_unlock(&sbsec->isec_lock);
 272         }
 273
 274         /*
 275          * The inode may still be referenced in a path walk and
 276          * a call to selinux_inode_permission() can be made
 277          * after inode_free_security() is called. Ideally, the VFS
 278          * wouldn't do this, but fixing that is a much harder
 279          * job. For now, simply free the i_security via RCU, and
 280          * leave the current inode->i_security pointer intact.
 281          * The inode will be freed after the RCU grace period too.
 282          */
 283         call_rcu(&isec->rcu, inode_free_rcu);
 284 }
 285
 286 static int file_alloc_security(struct file *file)
 287 {
 288         struct file_security_struct *fsec;
 289         u32 sid = current_sid();
 290
 291         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 292         if (!fsec)
 293                 return -ENOMEM;
 294
 295         fsec->sid = sid;
 296         fsec->fown_sid = sid;
 297         file->f_security = fsec;
 298
 299         return 0;
 300 }
 301
 302 static void file_free_security(struct file *file)
 303 {
 304         struct file_security_struct *fsec = file->f_security;
 305         file->f_security = NULL;
 306         kmem_cache_free(file_security_cache, fsec);
 307 }
 308
 309 static int superblock_alloc_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec;
 312
 313         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 314         if (!sbsec)
 315                 return -ENOMEM;
 316
 317         mutex_init(&sbsec->lock);
 318         INIT_LIST_HEAD(&sbsec->isec_head);
 319         spin_lock_init(&sbsec->isec_lock);
 320         sbsec->sb = sb;
 321         sbsec->sid = SECINITSID_UNLABELED;
 322         sbsec->def_sid = SECINITSID_FILE;
 323         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 324         sb->s_security = sbsec;
 325
 326         return 0;
 327 }
 328
 329 static void superblock_free_security(struct super_block *sb)
 330 {
 331         struct superblock_security_struct *sbsec = sb->s_security;
 332         sb->s_security = NULL;
 333         kfree(sbsec);
 334 }
 335
 336 /* The file system's label must be initialized prior to use. */
 337
 338 static const char *labeling_behaviors[7] = {
 339         "uses xattr",
 340         "uses transition SIDs",
 341         "uses task SIDs",
 342         "uses genfs_contexts",
 343         "not configured for labeling",
 344         "uses mountpoint labeling",
 345         "uses native labeling",
 346 };
 347
 348 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 349
 350 static inline int inode_doinit(struct inode *inode)
 351 {
 352         return inode_doinit_with_dentry(inode, NULL);
 353 }
 354
 355 enum {
 356         Opt_error = -1,
 357         Opt_context = 1,
 358         Opt_fscontext = 2,
 359         Opt_defcontext = 3,
 360         Opt_rootcontext = 4,
 361         Opt_labelsupport = 5,
 362         Opt_nextmntopt = 6,
 363 };
 364
 365 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 366
 367 static const match_table_t tokens = {
 368         {Opt_context, CONTEXT_STR "%s"},
 369         {Opt_fscontext, FSCONTEXT_STR "%s"},
 370         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 371         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 372         {Opt_labelsupport, LABELSUPP_STR},
 373         {Opt_error, NULL},
 374 };
 375
 376 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 377
 378 static int may_context_mount_sb_relabel(u32 sid,
 379                         struct superblock_security_struct *sbsec,
 380                         const struct cred *cred)
 381 {
 382         const struct task_security_struct *tsec = cred->security;
 383         int rc;
 384
 385         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 386                           FILESYSTEM__RELABELFROM, NULL);
 387         if (rc)
 388                 return rc;
 389
 390         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELTO, NULL);
 392         return rc;
 393 }
 394
 395 static int may_context_mount_inode_relabel(u32 sid,
 396                         struct superblock_security_struct *sbsec,
 397                         const struct cred *cred)
 398 {
 399         const struct task_security_struct *tsec = cred->security;
 400         int rc;
 401         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 402                           FILESYSTEM__RELABELFROM, NULL);
 403         if (rc)
 404                 return rc;
 405
 406         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 407                           FILESYSTEM__ASSOCIATE, NULL);
 408         return rc;
 409 }
 410
 411 static int selinux_is_sblabel_mnt(struct super_block *sb)
 412 {
 413         struct superblock_security_struct *sbsec = sb->s_security;
 414
 415         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 416                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 417                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 418                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 419                 /* Special handling. Genfs but also in-core setxattr handler */
 420                 !strcmp(sb->s_type->name, "sysfs") ||
 421                 !strcmp(sb->s_type->name, "pstore") ||
 422                 !strcmp(sb->s_type->name, "debugfs") ||
 423                 !strcmp(sb->s_type->name, "rootfs");
 424 }
 425
 426 static int sb_finish_set_opts(struct super_block *sb)
 427 {
 428         struct superblock_security_struct *sbsec = sb->s_security;
 429         struct dentry *root = sb->s_root;
 430         struct inode *root_inode = d_backing_inode(root);
 431         int rc = 0;
 432
 433         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 434                 /* Make sure that the xattr handler exists and that no
 435                    error other than -ENODATA is returned by getxattr on
 436                    the root directory.  -ENODATA is ok, as this may be
 437                    the first boot of the SELinux kernel before we have
 438                    assigned xattr values to the filesystem. */
 439                 if (!root_inode->i_op->getxattr) {
 440                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 441                                "xattr support\n", sb->s_id, sb->s_type->name);
 442                         rc = -EOPNOTSUPP;
 443                         goto out;
 444                 }
 445                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 446                 if (rc < 0 && rc != -ENODATA) {
 447                         if (rc == -EOPNOTSUPP)
 448                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 449                                        "%s) has no security xattr handler\n",
 450                                        sb->s_id, sb->s_type->name);
 451                         else
 452                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 453                                        "%s) getxattr errno %d\n", sb->s_id,
 454                                        sb->s_type->name, -rc);
 455                         goto out;
 456                 }
 457         }
 458
 459         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 460                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 461                        sb->s_id, sb->s_type->name);
 462
 463         sbsec->flags |= SE_SBINITIALIZED;
 464         if (selinux_is_sblabel_mnt(sb))
 465                 sbsec->flags |= SBLABEL_MNT;
 466
 467         /*
 468          * Special handling for rootfs. Is genfs but supports
 469          * setting SELinux context on in-core inodes.
 470          */
 471         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 472                 sbsec->flags |= SBLABEL_MNT;
 473
 474         /* Initialize the root inode. */
 475         rc = inode_doinit_with_dentry(root_inode, root);
 476
 477         /* Initialize any other inodes associated with the superblock, e.g.
 478            inodes created prior to initial policy load or inodes created
 479            during get_sb by a pseudo filesystem that directly
 480            populates itself. */
 481         spin_lock(&sbsec->isec_lock);
 482 next_inode:
 483         if (!list_empty(&sbsec->isec_head)) {
 484                 struct inode_security_struct *isec =
 485                                 list_entry(sbsec->isec_head.next,
 486                                            struct inode_security_struct, list);
 487                 struct inode *inode = isec->inode;
 488                 list_del_init(&isec->list);
 489                 spin_unlock(&sbsec->isec_lock);
 490                 inode = igrab(inode);
 491                 if (inode) {
 492                         if (!IS_PRIVATE(inode))
 493                                 inode_doinit(inode);
 494                         iput(inode);
 495                 }
 496                 spin_lock(&sbsec->isec_lock);
 497                 goto next_inode;
 498         }
 499         spin_unlock(&sbsec->isec_lock);
 500 out:
 501         return rc;
 502 }
 503
 504 /*
 505  * This function should allow an FS to ask what it's mount security
 506  * options were so it can use those later for submounts, displaying
 507  * mount options, or whatever.
 508  */
 509 static int selinux_get_mnt_opts(const struct super_block *sb,
 510                                 struct security_mnt_opts *opts)
 511 {
 512         int rc = 0, i;
 513         struct superblock_security_struct *sbsec = sb->s_security;
 514         char *context = NULL;
 515         u32 len;
 516         char tmp;
 517
 518         security_init_mnt_opts(opts);
 519
 520         if (!(sbsec->flags & SE_SBINITIALIZED))
 521                 return -EINVAL;
 522
 523         if (!ss_initialized)
 524                 return -EINVAL;
 525
 526         /* make sure we always check enough bits to cover the mask */
 527         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 528
 529         tmp = sbsec->flags & SE_MNTMASK;
 530         /* count the number of mount options for this sb */
 531         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 532                 if (tmp & 0x01)
 533                         opts->num_mnt_opts++;
 534                 tmp >>= 1;
 535         }
 536         /* Check if the Label support flag is set */
 537         if (sbsec->flags & SBLABEL_MNT)
 538                 opts->num_mnt_opts++;
 539
 540         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 541         if (!opts->mnt_opts) {
 542                 rc = -ENOMEM;
 543                 goto out_free;
 544         }
 545
 546         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 547         if (!opts->mnt_opts_flags) {
 548                 rc = -ENOMEM;
 549                 goto out_free;
 550         }
 551
 552         i = 0;
 553         if (sbsec->flags & FSCONTEXT_MNT) {
 554                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 555                 if (rc)
 556                         goto out_free;
 557                 opts->mnt_opts[i] = context;
 558                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 559         }
 560         if (sbsec->flags & CONTEXT_MNT) {
 561                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 562                 if (rc)
 563                         goto out_free;
 564                 opts->mnt_opts[i] = context;
 565                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 566         }
 567         if (sbsec->flags & DEFCONTEXT_MNT) {
 568                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 569                 if (rc)
 570                         goto out_free;
 571                 opts->mnt_opts[i] = context;
 572                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 573         }
 574         if (sbsec->flags & ROOTCONTEXT_MNT) {
 575                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 576                 struct inode_security_struct *isec = root->i_security;
 577
 578                 rc = security_sid_to_context(isec->sid, &context, &len);
 579                 if (rc)
 580                         goto out_free;
 581                 opts->mnt_opts[i] = context;
 582                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 583         }
 584         if (sbsec->flags & SBLABEL_MNT) {
 585                 opts->mnt_opts[i] = NULL;
 586                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 587         }
 588
 589         BUG_ON(i != opts->num_mnt_opts);
 590
 591         return 0;
 592
 593 out_free:
 594         security_free_mnt_opts(opts);
 595         return rc;
 596 }
 597
 598 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 599                       u32 old_sid, u32 new_sid)
 600 {
 601         char mnt_flags = sbsec->flags & SE_MNTMASK;
 602
 603         /* check if the old mount command had the same options */
 604         if (sbsec->flags & SE_SBINITIALIZED)
 605                 if (!(sbsec->flags & flag) ||
 606                     (old_sid != new_sid))
 607                         return 1;
 608
 609         /* check if we were passed the same options twice,
 610          * aka someone passed context=a,context=b
 611          */
 612         if (!(sbsec->flags & SE_SBINITIALIZED))
 613                 if (mnt_flags & flag)
 614                         return 1;
 615         return 0;
 616 }
 617
 618 /*
 619  * Allow filesystems with binary mount data to explicitly set mount point
 620  * labeling information.
 621  */
 622 static int selinux_set_mnt_opts(struct super_block *sb,
 623                                 struct security_mnt_opts *opts,
 624                                 unsigned long kern_flags,
 625                                 unsigned long *set_kern_flags)
 626 {
 627         const struct cred *cred = current_cred();
 628         int rc = 0, i;
 629         struct superblock_security_struct *sbsec = sb->s_security;
 630         const char *name = sb->s_type->name;
 631         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 632         struct inode_security_struct *root_isec = inode->i_security;
 633         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 634         u32 defcontext_sid = 0;
 635         char **mount_options = opts->mnt_opts;
 636         int *flags = opts->mnt_opts_flags;
 637         int num_opts = opts->num_mnt_opts;
 638
 639         mutex_lock(&sbsec->lock);
 640
 641         if (!ss_initialized) {
 642                 if (!num_opts) {
 643                         /* Defer initialization until selinux_complete_init,
 644                            after the initial policy is loaded and the security
 645                            server is ready to handle calls. */
 646                         goto out;
 647                 }
 648                 rc = -EINVAL;
 649                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 650                         "before the security server is initialized\n");
 651                 goto out;
 652         }
 653         if (kern_flags && !set_kern_flags) {
 654                 /* Specifying internal flags without providing a place to
 655                  * place the results is not allowed */
 656                 rc = -EINVAL;
 657                 goto out;
 658         }
 659
 660         /*
 661          * Binary mount data FS will come through this function twice.  Once
 662          * from an explicit call and once from the generic calls from the vfs.
 663          * Since the generic VFS calls will not contain any security mount data
 664          * we need to skip the double mount verification.
 665          *
 666          * This does open a hole in which we will not notice if the first
 667          * mount using this sb set explict options and a second mount using
 668          * this sb does not set any security options.  (The first options
 669          * will be used for both mounts)
 670          */
 671         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 672             && (num_opts == 0))
 673                 goto out;
 674
 675         /*
 676          * parse the mount options, check if they are valid sids.
 677          * also check if someone is trying to mount the same sb more
 678          * than once with different security options.
 679          */
 680         for (i = 0; i < num_opts; i++) {
 681                 u32 sid;
 682
 683                 if (flags[i] == SBLABEL_MNT)
 684                         continue;
 685                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 686                 if (rc) {
 687                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 688                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 689                                mount_options[i], sb->s_id, name, rc);
 690                         goto out;
 691                 }
 692                 switch (flags[i]) {
 693                 case FSCONTEXT_MNT:
 694                         fscontext_sid = sid;
 695
 696                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 697                                         fscontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= FSCONTEXT_MNT;
 701                         break;
 702                 case CONTEXT_MNT:
 703                         context_sid = sid;
 704
 705                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 706                                         context_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= CONTEXT_MNT;
 710                         break;
 711                 case ROOTCONTEXT_MNT:
 712                         rootcontext_sid = sid;
 713
 714                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 715                                         rootcontext_sid))
 716                                 goto out_double_mount;
 717
 718                         sbsec->flags |= ROOTCONTEXT_MNT;
 719
 720                         break;
 721                 case DEFCONTEXT_MNT:
 722                         defcontext_sid = sid;
 723
 724                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 725                                         defcontext_sid))
 726                                 goto out_double_mount;
 727
 728                         sbsec->flags |= DEFCONTEXT_MNT;
 729
 730                         break;
 731                 default:
 732                         rc = -EINVAL;
 733                         goto out;
 734                 }
 735         }
 736
 737         if (sbsec->flags & SE_SBINITIALIZED) {
 738                 /* previously mounted with options, but not on this attempt? */
 739                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 740                         goto out_double_mount;
 741                 rc = 0;
 742                 goto out;
 743         }
 744
 745         if (strcmp(sb->s_type->name, "proc") == 0)
 746                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 747
 748         if (!strcmp(sb->s_type->name, "debugfs") ||
 749             !strcmp(sb->s_type->name, "sysfs") ||
 750             !strcmp(sb->s_type->name, "pstore"))
 751                 sbsec->flags |= SE_SBGENFS;
 752
 753         if (!sbsec->behavior) {
 754                 /*
 755                  * Determine the labeling behavior to use for this
 756                  * filesystem type.
 757                  */
 758                 rc = security_fs_use(sb);
 759                 if (rc) {
 760                         printk(KERN_WARNING
 761                                 "%s: security_fs_use(%s) returned %d\n",
 762                                         __func__, sb->s_type->name, rc);
 763                         goto out;
 764                 }
 765         }
 766         /* sets the context of the superblock for the fs being mounted. */
 767         if (fscontext_sid) {
 768                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 769                 if (rc)
 770                         goto out;
 771
 772                 sbsec->sid = fscontext_sid;
 773         }
 774
 775         /*
 776          * Switch to using mount point labeling behavior.
 777          * sets the label used on all file below the mountpoint, and will set
 778          * the superblock context if not already set.
 779          */
 780         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 781                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 782                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 783         }
 784
 785         if (context_sid) {
 786                 if (!fscontext_sid) {
 787                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 788                                                           cred);
 789                         if (rc)
 790                                 goto out;
 791                         sbsec->sid = context_sid;
 792                 } else {
 793                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 794                                                              cred);
 795                         if (rc)
 796                                 goto out;
 797                 }
 798                 if (!rootcontext_sid)
 799                         rootcontext_sid = context_sid;
 800
 801                 sbsec->mntpoint_sid = context_sid;
 802                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 803         }
 804
 805         if (rootcontext_sid) {
 806                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 807                                                      cred);
 808                 if (rc)
 809                         goto out;
 810
 811                 root_isec->sid = rootcontext_sid;
 812                 root_isec->initialized = 1;
 813         }
 814
 815         if (defcontext_sid) {
 816                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 817                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 818                         rc = -EINVAL;
 819                         printk(KERN_WARNING "SELinux: defcontext option is "
 820                                "invalid for this filesystem type\n");
 821                         goto out;
 822                 }
 823
 824                 if (defcontext_sid != sbsec->def_sid) {
 825                         rc = may_context_mount_inode_relabel(defcontext_sid,
 826                                                              sbsec, cred);
 827                         if (rc)
 828                                 goto out;
 829                 }
 830
 831                 sbsec->def_sid = defcontext_sid;
 832         }
 833
 834         rc = sb_finish_set_opts(sb);
 835 out:
 836         mutex_unlock(&sbsec->lock);
 837         return rc;
 838 out_double_mount:
 839         rc = -EINVAL;
 840         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 841                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 842         goto out;
 843 }
 844
 845 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 846                                     const struct super_block *newsb)
 847 {
 848         struct superblock_security_struct *old = oldsb->s_security;
 849         struct superblock_security_struct *new = newsb->s_security;
 850         char oldflags = old->flags & SE_MNTMASK;
 851         char newflags = new->flags & SE_MNTMASK;
 852
 853         if (oldflags != newflags)
 854                 goto mismatch;
 855         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 856                 goto mismatch;
 857         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 858                 goto mismatch;
 859         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 860                 goto mismatch;
 861         if (oldflags & ROOTCONTEXT_MNT) {
 862                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 863                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 864                 if (oldroot->sid != newroot->sid)
 865                         goto mismatch;
 866         }
 867         return 0;
 868 mismatch:
 869         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 870                             "different security settings for (dev %s, "
 871                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 872         return -EBUSY;
 873 }
 874
 875 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 876                                         struct super_block *newsb)
 877 {
 878         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 879         struct superblock_security_struct *newsbsec = newsb->s_security;
 880
 881         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 882         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 883         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 884
 885         /*
 886          * if the parent was able to be mounted it clearly had no special lsm
 887          * mount options.  thus we can safely deal with this superblock later
 888          */
 889         if (!ss_initialized)
 890                 return 0;
 891
 892         /* how can we clone if the old one wasn't set up?? */
 893         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 894
 895         /* if fs is reusing a sb, make sure that the contexts match */
 896         if (newsbsec->flags & SE_SBINITIALIZED)
 897                 return selinux_cmp_sb_context(oldsb, newsb);
 898
 899         mutex_lock(&newsbsec->lock);
 900
 901         newsbsec->flags = oldsbsec->flags;
 902
 903         newsbsec->sid = oldsbsec->sid;
 904         newsbsec->def_sid = oldsbsec->def_sid;
 905         newsbsec->behavior = oldsbsec->behavior;
 906
 907         if (set_context) {
 908                 u32 sid = oldsbsec->mntpoint_sid;
 909
 910                 if (!set_fscontext)
 911                         newsbsec->sid = sid;
 912                 if (!set_rootcontext) {
 913                         struct inode *newinode = d_backing_inode(newsb->s_root);
 914                         struct inode_security_struct *newisec = newinode->i_security;
 915                         newisec->sid = sid;
 916                 }
 917                 newsbsec->mntpoint_sid = sid;
 918         }
 919         if (set_rootcontext) {
 920                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 921                 const struct inode_security_struct *oldisec = oldinode->i_security;
 922                 struct inode *newinode = d_backing_inode(newsb->s_root);
 923                 struct inode_security_struct *newisec = newinode->i_security;
 924
 925                 newisec->sid = oldisec->sid;
 926         }
 927
 928         sb_finish_set_opts(newsb);
 929         mutex_unlock(&newsbsec->lock);
 930         return 0;
 931 }
 932
 933 static int selinux_parse_opts_str(char *options,
 934                                   struct security_mnt_opts *opts)
 935 {
 936         char *p;
 937         char *context = NULL, *defcontext = NULL;
 938         char *fscontext = NULL, *rootcontext = NULL;
 939         int rc, num_mnt_opts = 0;
 940
 941         opts->num_mnt_opts = 0;
 942
 943         /* Standard string-based options. */
 944         while ((p = strsep(&options, "|")) != NULL) {
 945                 int token;
 946                 substring_t args[MAX_OPT_ARGS];
 947
 948                 if (!*p)
 949                         continue;
 950
 951                 token = match_token(p, tokens, args);
 952
 953                 switch (token) {
 954                 case Opt_context:
 955                         if (context || defcontext) {
 956                                 rc = -EINVAL;
 957                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 958                                 goto out_err;
 959                         }
 960                         context = match_strdup(&args[0]);
 961                         if (!context) {
 962                                 rc = -ENOMEM;
 963                                 goto out_err;
 964                         }
 965                         break;
 966
 967                 case Opt_fscontext:
 968                         if (fscontext) {
 969                                 rc = -EINVAL;
 970                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 971                                 goto out_err;
 972                         }
 973                         fscontext = match_strdup(&args[0]);
 974                         if (!fscontext) {
 975                                 rc = -ENOMEM;
 976                                 goto out_err;
 977                         }
 978                         break;
 979
 980                 case Opt_rootcontext:
 981                         if (rootcontext) {
 982                                 rc = -EINVAL;
 983                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 984                                 goto out_err;
 985                         }
 986                         rootcontext = match_strdup(&args[0]);
 987                         if (!rootcontext) {
 988                                 rc = -ENOMEM;
 989                                 goto out_err;
 990                         }
 991                         break;
 992
 993                 case Opt_defcontext:
 994                         if (context || defcontext) {
 995                                 rc = -EINVAL;
 996                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 997                                 goto out_err;
 998                         }
 999                         defcontext = match_strdup(&args[0]);
1000                         if (!defcontext) {
1001                                 rc = -ENOMEM;
1002                                 goto out_err;
1003                         }
1004                         break;
1005                 case Opt_labelsupport:
1006                         break;
1007                 default:
1008                         rc = -EINVAL;
1009                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1010                         goto out_err;
1011
1012                 }
1013         }
1014
1015         rc = -ENOMEM;
1016         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1017         if (!opts->mnt_opts)
1018                 goto out_err;
1019
1020         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1021         if (!opts->mnt_opts_flags) {
1022                 kfree(opts->mnt_opts);
1023                 goto out_err;
1024         }
1025
1026         if (fscontext) {
1027                 opts->mnt_opts[num_mnt_opts] = fscontext;
1028                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1029         }
1030         if (context) {
1031                 opts->mnt_opts[num_mnt_opts] = context;
1032                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1033         }
1034         if (rootcontext) {
1035                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1036                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1037         }
1038         if (defcontext) {
1039                 opts->mnt_opts[num_mnt_opts] = defcontext;
1040                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1041         }
1042
1043         opts->num_mnt_opts = num_mnt_opts;
1044         return 0;
1045
1046 out_err:
1047         kfree(context);
1048         kfree(defcontext);
1049         kfree(fscontext);
1050         kfree(rootcontext);
1051         return rc;
1052 }
1053 /*
1054  * string mount options parsing and call set the sbsec
1055  */
1056 static int superblock_doinit(struct super_block *sb, void *data)
1057 {
1058         int rc = 0;
1059         char *options = data;
1060         struct security_mnt_opts opts;
1061
1062         security_init_mnt_opts(&opts);
1063
1064         if (!data)
1065                 goto out;
1066
1067         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1068
1069         rc = selinux_parse_opts_str(options, &opts);
1070         if (rc)
1071                 goto out_err;
1072
1073 out:
1074         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1075
1076 out_err:
1077         security_free_mnt_opts(&opts);
1078         return rc;
1079 }
1080
1081 static void selinux_write_opts(struct seq_file *m,
1082                                struct security_mnt_opts *opts)
1083 {
1084         int i;
1085         char *prefix;
1086
1087         for (i = 0; i < opts->num_mnt_opts; i++) {
1088                 char *has_comma;
1089
1090                 if (opts->mnt_opts[i])
1091                         has_comma = strchr(opts->mnt_opts[i], ',');
1092                 else
1093                         has_comma = NULL;
1094
1095                 switch (opts->mnt_opts_flags[i]) {
1096                 case CONTEXT_MNT:
1097                         prefix = CONTEXT_STR;
1098                         break;
1099                 case FSCONTEXT_MNT:
1100                         prefix = FSCONTEXT_STR;
1101                         break;
1102                 case ROOTCONTEXT_MNT:
1103                         prefix = ROOTCONTEXT_STR;
1104                         break;
1105                 case DEFCONTEXT_MNT:
1106                         prefix = DEFCONTEXT_STR;
1107                         break;
1108                 case SBLABEL_MNT:
1109                         seq_putc(m, ',');
1110                         seq_puts(m, LABELSUPP_STR);
1111                         continue;
1112                 default:
1113                         BUG();
1114                         return;
1115                 };
1116                 /* we need a comma before each option */
1117                 seq_putc(m, ',');
1118                 seq_puts(m, prefix);
1119                 if (has_comma)
1120                         seq_putc(m, '\"');
1121                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1122                 if (has_comma)
1123                         seq_putc(m, '\"');
1124         }
1125 }
1126
1127 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1128 {
1129         struct security_mnt_opts opts;
1130         int rc;
1131
1132         rc = selinux_get_mnt_opts(sb, &opts);
1133         if (rc) {
1134                 /* before policy load we may get EINVAL, don't show anything */
1135                 if (rc == -EINVAL)
1136                         rc = 0;
1137                 return rc;
1138         }
1139
1140         selinux_write_opts(m, &opts);
1141
1142         security_free_mnt_opts(&opts);
1143
1144         return rc;
1145 }
1146
1147 static inline u16 inode_mode_to_security_class(umode_t mode)
1148 {
1149         switch (mode & S_IFMT) {
1150         case S_IFSOCK:
1151                 return SECCLASS_SOCK_FILE;
1152         case S_IFLNK:
1153                 return SECCLASS_LNK_FILE;
1154         case S_IFREG:
1155                 return SECCLASS_FILE;
1156         case S_IFBLK:
1157                 return SECCLASS_BLK_FILE;
1158         case S_IFDIR:
1159                 return SECCLASS_DIR;
1160         case S_IFCHR:
1161                 return SECCLASS_CHR_FILE;
1162         case S_IFIFO:
1163                 return SECCLASS_FIFO_FILE;
1164
1165         }
1166
1167         return SECCLASS_FILE;
1168 }
1169
1170 static inline int default_protocol_stream(int protocol)
1171 {
1172         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1173 }
1174
1175 static inline int default_protocol_dgram(int protocol)
1176 {
1177         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1178 }
1179
1180 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1181 {
1182         switch (family) {
1183         case PF_UNIX:
1184                 switch (type) {
1185                 case SOCK_STREAM:
1186                 case SOCK_SEQPACKET:
1187                         return SECCLASS_UNIX_STREAM_SOCKET;
1188                 case SOCK_DGRAM:
1189                         return SECCLASS_UNIX_DGRAM_SOCKET;
1190                 }
1191                 break;
1192         case PF_INET:
1193         case PF_INET6:
1194                 switch (type) {
1195                 case SOCK_STREAM:
1196                         if (default_protocol_stream(protocol))
1197                                 return SECCLASS_TCP_SOCKET;
1198                         else
1199                                 return SECCLASS_RAWIP_SOCKET;
1200                 case SOCK_DGRAM:
1201                         if (default_protocol_dgram(protocol))
1202                                 return SECCLASS_UDP_SOCKET;
1203                         else
1204                                 return SECCLASS_RAWIP_SOCKET;
1205                 case SOCK_DCCP:
1206                         return SECCLASS_DCCP_SOCKET;
1207                 default:
1208                         return SECCLASS_RAWIP_SOCKET;
1209                 }
1210                 break;
1211         case PF_NETLINK:
1212                 switch (protocol) {
1213                 case NETLINK_ROUTE:
1214                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1215                 case NETLINK_SOCK_DIAG:
1216                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217                 case NETLINK_NFLOG:
1218                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1219                 case NETLINK_XFRM:
1220                         return SECCLASS_NETLINK_XFRM_SOCKET;
1221                 case NETLINK_SELINUX:
1222                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1223                 case NETLINK_ISCSI:
1224                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1225                 case NETLINK_AUDIT:
1226                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1227                 case NETLINK_FIB_LOOKUP:
1228                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229                 case NETLINK_CONNECTOR:
1230                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231                 case NETLINK_NETFILTER:
1232                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1233                 case NETLINK_DNRTMSG:
1234                         return SECCLASS_NETLINK_DNRT_SOCKET;
1235                 case NETLINK_KOBJECT_UEVENT:
1236                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1237                 case NETLINK_GENERIC:
1238                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1239                 case NETLINK_SCSITRANSPORT:
1240                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241                 case NETLINK_RDMA:
1242                         return SECCLASS_NETLINK_RDMA_SOCKET;
1243                 case NETLINK_CRYPTO:
1244                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1245                 default:
1246                         return SECCLASS_NETLINK_SOCKET;
1247                 }
1248         case PF_PACKET:
1249                 return SECCLASS_PACKET_SOCKET;
1250         case PF_KEY:
1251                 return SECCLASS_KEY_SOCKET;
1252         case PF_APPLETALK:
1253                 return SECCLASS_APPLETALK_SOCKET;
1254         }
1255
1256         return SECCLASS_SOCKET;
1257 }
1258
1259 static int selinux_genfs_get_sid(struct dentry *dentry,
1260                                  u16 tclass,
1261                                  u16 flags,
1262                                  u32 *sid)
1263 {
1264         int rc;
1265         struct super_block *sb = dentry->d_inode->i_sb;
1266         char *buffer, *path;
1267
1268         buffer = (char *)__get_free_page(GFP_KERNEL);
1269         if (!buffer)
1270                 return -ENOMEM;
1271
1272         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1273         if (IS_ERR(path))
1274                 rc = PTR_ERR(path);
1275         else {
1276                 if (flags & SE_SBPROC) {
1277                         /* each process gets a /proc/PID/ entry. Strip off the
1278                          * PID part to get a valid selinux labeling.
1279                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1280                         while (path[1] >= '0' && path[1] <= '9') {
1281                                 path[1] = '/';
1282                                 path++;
1283                         }
1284                 }
1285                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1286         }
1287         free_page((unsigned long)buffer);
1288         return rc;
1289 }
1290
1291 /* The inode's security attributes must be initialized before first use. */
1292 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1293 {
1294         struct superblock_security_struct *sbsec = NULL;
1295         struct inode_security_struct *isec = inode->i_security;
1296         u32 sid;
1297         struct dentry *dentry;
1298 #define INITCONTEXTLEN 255
1299         char *context = NULL;
1300         unsigned len = 0;
1301         int rc = 0;
1302
1303         if (isec->initialized)
1304                 goto out;
1305
1306         mutex_lock(&isec->lock);
1307         if (isec->initialized)
1308                 goto out_unlock;
1309
1310         sbsec = inode->i_sb->s_security;
1311         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1312                 /* Defer initialization until selinux_complete_init,
1313                    after the initial policy is loaded and the security
1314                    server is ready to handle calls. */
1315                 spin_lock(&sbsec->isec_lock);
1316                 if (list_empty(&isec->list))
1317                         list_add(&isec->list, &sbsec->isec_head);
1318                 spin_unlock(&sbsec->isec_lock);
1319                 goto out_unlock;
1320         }
1321
1322         switch (sbsec->behavior) {
1323         case SECURITY_FS_USE_NATIVE:
1324                 break;
1325         case SECURITY_FS_USE_XATTR:
1326                 if (!inode->i_op->getxattr) {
1327                         isec->sid = sbsec->def_sid;
1328                         break;
1329                 }
1330
1331                 /* Need a dentry, since the xattr API requires one.
1332                    Life would be simpler if we could just pass the inode. */
1333                 if (opt_dentry) {
1334                         /* Called from d_instantiate or d_splice_alias. */
1335                         dentry = dget(opt_dentry);
1336                 } else {
1337                         /* Called from selinux_complete_init, try to find a dentry. */
1338                         dentry = d_find_alias(inode);
1339                 }
1340                 if (!dentry) {
1341                         /*
1342                          * this is can be hit on boot when a file is accessed
1343                          * before the policy is loaded.  When we load policy we
1344                          * may find inodes that have no dentry on the
1345                          * sbsec->isec_head list.  No reason to complain as these
1346                          * will get fixed up the next time we go through
1347                          * inode_doinit with a dentry, before these inodes could
1348                          * be used again by userspace.
1349                          */
1350                         goto out_unlock;
1351                 }
1352
1353                 len = INITCONTEXTLEN;
1354                 context = kmalloc(len+1, GFP_NOFS);
1355                 if (!context) {
1356                         rc = -ENOMEM;
1357                         dput(dentry);
1358                         goto out_unlock;
1359                 }
1360                 context[len] = '\0';
1361                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1362                                            context, len);
1363                 if (rc == -ERANGE) {
1364                         kfree(context);
1365
1366                         /* Need a larger buffer.  Query for the right size. */
1367                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1368                                                    NULL, 0);
1369                         if (rc < 0) {
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         len = rc;
1374                         context = kmalloc(len+1, GFP_NOFS);
1375                         if (!context) {
1376                                 rc = -ENOMEM;
1377                                 dput(dentry);
1378                                 goto out_unlock;
1379                         }
1380                         context[len] = '\0';
1381                         rc = inode->i_op->getxattr(dentry,
1382                                                    XATTR_NAME_SELINUX,
1383                                                    context, len);
1384                 }
1385                 dput(dentry);
1386                 if (rc < 0) {
1387                         if (rc != -ENODATA) {
1388                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1389                                        "%d for dev=%s ino=%ld\n", __func__,
1390                                        -rc, inode->i_sb->s_id, inode->i_ino);
1391                                 kfree(context);
1392                                 goto out_unlock;
1393                         }
1394                         /* Map ENODATA to the default file SID */
1395                         sid = sbsec->def_sid;
1396                         rc = 0;
1397                 } else {
1398                         rc = security_context_to_sid_default(context, rc, &sid,
1399                                                              sbsec->def_sid,
1400                                                              GFP_NOFS);
1401                         if (rc) {
1402                                 char *dev = inode->i_sb->s_id;
1403                                 unsigned long ino = inode->i_ino;
1404
1405                                 if (rc == -EINVAL) {
1406                                         if (printk_ratelimit())
1407                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1408                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1409                                                         "filesystem in question.\n", ino, dev, context);
1410                                 } else {
1411                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1412                                                "returned %d for dev=%s ino=%ld\n",
1413                                                __func__, context, -rc, dev, ino);
1414                                 }
1415                                 kfree(context);
1416                                 /* Leave with the unlabeled SID */
1417                                 rc = 0;
1418                                 break;
1419                         }
1420                 }
1421                 kfree(context);
1422                 isec->sid = sid;
1423                 break;
1424         case SECURITY_FS_USE_TASK:
1425                 isec->sid = isec->task_sid;
1426                 break;
1427         case SECURITY_FS_USE_TRANS:
1428                 /* Default to the fs SID. */
1429                 isec->sid = sbsec->sid;
1430
1431                 /* Try to obtain a transition SID. */
1432                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1433                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1434                                              isec->sclass, NULL, &sid);
1435                 if (rc)
1436                         goto out_unlock;
1437                 isec->sid = sid;
1438                 break;
1439         case SECURITY_FS_USE_MNTPOINT:
1440                 isec->sid = sbsec->mntpoint_sid;
1441                 break;
1442         default:
1443                 /* Default to the fs superblock SID. */
1444                 isec->sid = sbsec->sid;
1445
1446                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1447                         /* We must have a dentry to determine the label on
1448                          * procfs inodes */
1449                         if (opt_dentry)
1450                                 /* Called from d_instantiate or
1451                                  * d_splice_alias. */
1452                                 dentry = dget(opt_dentry);
1453                         else
1454                                 /* Called from selinux_complete_init, try to
1455                                  * find a dentry. */
1456                                 dentry = d_find_alias(inode);
1457                         /*
1458                          * This can be hit on boot when a file is accessed
1459                          * before the policy is loaded.  When we load policy we
1460                          * may find inodes that have no dentry on the
1461                          * sbsec->isec_head list.  No reason to complain as
1462                          * these will get fixed up the next time we go through
1463                          * inode_doinit() with a dentry, before these inodes
1464                          * could be used again by userspace.
1465                          */
1466                         if (!dentry)
1467                                 goto out_unlock;
1468                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1469                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1470                                                    sbsec->flags, &sid);
1471                         dput(dentry);
1472                         if (rc)
1473                                 goto out_unlock;
1474                         isec->sid = sid;
1475                 }
1476                 break;
1477         }
1478
1479         isec->initialized = 1;
1480
1481 out_unlock:
1482         mutex_unlock(&isec->lock);
1483 out:
1484         if (isec->sclass == SECCLASS_FILE)
1485                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1486         return rc;
1487 }
1488
1489 /* Convert a Linux signal to an access vector. */
1490 static inline u32 signal_to_av(int sig)
1491 {
1492         u32 perm = 0;
1493
1494         switch (sig) {
1495         case SIGCHLD:
1496                 /* Commonly granted from child to parent. */
1497                 perm = PROCESS__SIGCHLD;
1498                 break;
1499         case SIGKILL:
1500                 /* Cannot be caught or ignored */
1501                 perm = PROCESS__SIGKILL;
1502                 break;
1503         case SIGSTOP:
1504                 /* Cannot be caught or ignored */
1505                 perm = PROCESS__SIGSTOP;
1506                 break;
1507         default:
1508                 /* All other signals. */
1509                 perm = PROCESS__SIGNAL;
1510                 break;
1511         }
1512
1513         return perm;
1514 }
1515
1516 /*
1517  * Check permission between a pair of credentials
1518  * fork check, ptrace check, etc.
1519  */
1520 static int cred_has_perm(const struct cred *actor,
1521                          const struct cred *target,
1522                          u32 perms)
1523 {
1524         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1525
1526         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1527 }
1528
1529 /*
1530  * Check permission between a pair of tasks, e.g. signal checks,
1531  * fork check, ptrace check, etc.
1532  * tsk1 is the actor and tsk2 is the target
1533  * - this uses the default subjective creds of tsk1
1534  */
1535 static int task_has_perm(const struct task_struct *tsk1,
1536                          const struct task_struct *tsk2,
1537                          u32 perms)
1538 {
1539         const struct task_security_struct *__tsec1, *__tsec2;
1540         u32 sid1, sid2;
1541
1542         rcu_read_lock();
1543         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1544         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1545         rcu_read_unlock();
1546         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1547 }
1548
1549 /*
1550  * Check permission between current and another task, e.g. signal checks,
1551  * fork check, ptrace check, etc.
1552  * current is the actor and tsk2 is the target
1553  * - this uses current's subjective creds
1554  */
1555 static int current_has_perm(const struct task_struct *tsk,
1556                             u32 perms)
1557 {
1558         u32 sid, tsid;
1559
1560         sid = current_sid();
1561         tsid = task_sid(tsk);
1562         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1563 }
1564
1565 #if CAP_LAST_CAP > 63
1566 #error Fix SELinux to handle capabilities > 63.
1567 #endif
1568
1569 /* Check whether a task is allowed to use a capability. */
1570 static int cred_has_capability(const struct cred *cred,
1571                                int cap, int audit)
1572 {
1573         struct common_audit_data ad;
1574         struct av_decision avd;
1575         u16 sclass;
1576         u32 sid = cred_sid(cred);
1577         u32 av = CAP_TO_MASK(cap);
1578         int rc;
1579
1580         ad.type = LSM_AUDIT_DATA_CAP;
1581         ad.u.cap = cap;
1582
1583         switch (CAP_TO_INDEX(cap)) {
1584         case 0:
1585                 sclass = SECCLASS_CAPABILITY;
1586                 break;
1587         case 1:
1588                 sclass = SECCLASS_CAPABILITY2;
1589                 break;
1590         default:
1591                 printk(KERN_ERR
1592                        "SELinux:  out of range capability %d\n", cap);
1593                 BUG();
1594                 return -EINVAL;
1595         }
1596
1597         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1598         if (audit == SECURITY_CAP_AUDIT) {
1599                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1600                 if (rc2)
1601                         return rc2;
1602         }
1603         return rc;
1604 }
1605
1606 /* Check whether a task is allowed to use a system operation. */
1607 static int task_has_system(struct task_struct *tsk,
1608                            u32 perms)
1609 {
1610         u32 sid = task_sid(tsk);
1611
1612         return avc_has_perm(sid, SECINITSID_KERNEL,
1613                             SECCLASS_SYSTEM, perms, NULL);
1614 }
1615
1616 /* Check whether a task has a particular permission to an inode.
1617    The 'adp' parameter is optional and allows other audit
1618    data to be passed (e.g. the dentry). */
1619 static int inode_has_perm(const struct cred *cred,
1620                           struct inode *inode,
1621                           u32 perms,
1622                           struct common_audit_data *adp)
1623 {
1624         struct inode_security_struct *isec;
1625         u32 sid;
1626
1627         validate_creds(cred);
1628
1629         if (unlikely(IS_PRIVATE(inode)))
1630                 return 0;
1631
1632         sid = cred_sid(cred);
1633         isec = inode->i_security;
1634
1635         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1636 }
1637
1638 /* Same as inode_has_perm, but pass explicit audit data containing
1639    the dentry to help the auditing code to more easily generate the
1640    pathname if needed. */
1641 static inline int dentry_has_perm(const struct cred *cred,
1642                                   struct dentry *dentry,
1643                                   u32 av)
1644 {
1645         struct inode *inode = d_backing_inode(dentry);
1646         struct common_audit_data ad;
1647
1648         ad.type = LSM_AUDIT_DATA_DENTRY;
1649         ad.u.dentry = dentry;
1650         return inode_has_perm(cred, inode, av, &ad);
1651 }
1652
1653 /* Same as inode_has_perm, but pass explicit audit data containing
1654    the path to help the auditing code to more easily generate the
1655    pathname if needed. */
1656 static inline int path_has_perm(const struct cred *cred,
1657                                 const struct path *path,
1658                                 u32 av)
1659 {
1660         struct inode *inode = d_backing_inode(path->dentry);
1661         struct common_audit_data ad;
1662
1663         ad.type = LSM_AUDIT_DATA_PATH;
1664         ad.u.path = *path;
1665         return inode_has_perm(cred, inode, av, &ad);
1666 }
1667
1668 /* Same as path_has_perm, but uses the inode from the file struct. */
1669 static inline int file_path_has_perm(const struct cred *cred,
1670                                      struct file *file,
1671                                      u32 av)
1672 {
1673         struct common_audit_data ad;
1674
1675         ad.type = LSM_AUDIT_DATA_PATH;
1676         ad.u.path = file->f_path;
1677         return inode_has_perm(cred, file_inode(file), av, &ad);
1678 }
1679
1680 /* Check whether a task can use an open file descriptor to
1681    access an inode in a given way.  Check access to the
1682    descriptor itself, and then use dentry_has_perm to
1683    check a particular permission to the file.
1684    Access to the descriptor is implicitly granted if it
1685    has the same SID as the process.  If av is zero, then
1686    access to the file is not checked, e.g. for cases
1687    where only the descriptor is affected like seek. */
1688 static int file_has_perm(const struct cred *cred,
1689                          struct file *file,
1690                          u32 av)
1691 {
1692         struct file_security_struct *fsec = file->f_security;
1693         struct inode *inode = file_inode(file);
1694         struct common_audit_data ad;
1695         u32 sid = cred_sid(cred);
1696         int rc;
1697
1698         ad.type = LSM_AUDIT_DATA_PATH;
1699         ad.u.path = file->f_path;
1700
1701         if (sid != fsec->sid) {
1702                 rc = avc_has_perm(sid, fsec->sid,
1703                                   SECCLASS_FD,
1704                                   FD__USE,
1705                                   &ad);
1706                 if (rc)
1707                         goto out;
1708         }
1709
1710         /* av is zero if only checking access to the descriptor. */
1711         rc = 0;
1712         if (av)
1713                 rc = inode_has_perm(cred, inode, av, &ad);
1714
1715 out:
1716         return rc;
1717 }
1718
1719 /*
1720  * Determine the label for an inode that might be unioned.
1721  */
1722 static int selinux_determine_inode_label(const struct inode *dir,
1723                                          const struct qstr *name,
1724                                          u16 tclass,
1725                                          u32 *_new_isid)
1726 {
1727         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1728         const struct inode_security_struct *dsec = dir->i_security;
1729         const struct task_security_struct *tsec = current_security();
1730
1731         if ((sbsec->flags & SE_SBINITIALIZED) &&
1732             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1733                 *_new_isid = sbsec->mntpoint_sid;
1734         } else if ((sbsec->flags & SBLABEL_MNT) &&
1735                    tsec->create_sid) {
1736                 *_new_isid = tsec->create_sid;
1737         } else {
1738                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1739                                                name, _new_isid);
1740         }
1741
1742         return 0;
1743 }
1744
1745 /* Check whether a task can create a file. */
1746 static int may_create(struct inode *dir,
1747                       struct dentry *dentry,
1748                       u16 tclass)
1749 {
1750         const struct task_security_struct *tsec = current_security();
1751         struct inode_security_struct *dsec;
1752         struct superblock_security_struct *sbsec;
1753         u32 sid, newsid;
1754         struct common_audit_data ad;
1755         int rc;
1756
1757         dsec = dir->i_security;
1758         sbsec = dir->i_sb->s_security;
1759
1760         sid = tsec->sid;
1761
1762         ad.type = LSM_AUDIT_DATA_DENTRY;
1763         ad.u.dentry = dentry;
1764
1765         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1766                           DIR__ADD_NAME | DIR__SEARCH,
1767                           &ad);
1768         if (rc)
1769                 return rc;
1770
1771         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1772                                            &newsid);
1773         if (rc)
1774                 return rc;
1775
1776         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1777         if (rc)
1778                 return rc;
1779
1780         return avc_has_perm(newsid, sbsec->sid,
1781                             SECCLASS_FILESYSTEM,
1782                             FILESYSTEM__ASSOCIATE, &ad);
1783 }
1784
1785 /* Check whether a task can create a key. */
1786 static int may_create_key(u32 ksid,
1787                           struct task_struct *ctx)
1788 {
1789         u32 sid = task_sid(ctx);
1790
1791         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1792 }
1793
1794 #define MAY_LINK        0
1795 #define MAY_UNLINK      1
1796 #define MAY_RMDIR       2
1797
1798 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1799 static int may_link(struct inode *dir,
1800                     struct dentry *dentry,
1801                     int kind)
1802
1803 {
1804         struct inode_security_struct *dsec, *isec;
1805         struct common_audit_data ad;
1806         u32 sid = current_sid();
1807         u32 av;
1808         int rc;
1809
1810         dsec = dir->i_security;
1811         isec = d_backing_inode(dentry)->i_security;
1812
1813         ad.type = LSM_AUDIT_DATA_DENTRY;
1814         ad.u.dentry = dentry;
1815
1816         av = DIR__SEARCH;
1817         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1818         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1819         if (rc)
1820                 return rc;
1821
1822         switch (kind) {
1823         case MAY_LINK:
1824                 av = FILE__LINK;
1825                 break;
1826         case MAY_UNLINK:
1827                 av = FILE__UNLINK;
1828                 break;
1829         case MAY_RMDIR:
1830                 av = DIR__RMDIR;
1831                 break;
1832         default:
1833                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1834                         __func__, kind);
1835                 return 0;
1836         }
1837
1838         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1839         return rc;
1840 }
1841
1842 static inline int may_rename(struct inode *old_dir,
1843                              struct dentry *old_dentry,
1844                              struct inode *new_dir,
1845                              struct dentry *new_dentry)
1846 {
1847         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1848         struct common_audit_data ad;
1849         u32 sid = current_sid();
1850         u32 av;
1851         int old_is_dir, new_is_dir;
1852         int rc;
1853
1854         old_dsec = old_dir->i_security;
1855         old_isec = d_backing_inode(old_dentry)->i_security;
1856         old_is_dir = d_is_dir(old_dentry);
1857         new_dsec = new_dir->i_security;
1858
1859         ad.type = LSM_AUDIT_DATA_DENTRY;
1860
1861         ad.u.dentry = old_dentry;
1862         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1863                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1864         if (rc)
1865                 return rc;
1866         rc = avc_has_perm(sid, old_isec->sid,
1867                           old_isec->sclass, FILE__RENAME, &ad);
1868         if (rc)
1869                 return rc;
1870         if (old_is_dir && new_dir != old_dir) {
1871                 rc = avc_has_perm(sid, old_isec->sid,
1872                                   old_isec->sclass, DIR__REPARENT, &ad);
1873                 if (rc)
1874                         return rc;
1875         }
1876
1877         ad.u.dentry = new_dentry;
1878         av = DIR__ADD_NAME | DIR__SEARCH;
1879         if (d_is_positive(new_dentry))
1880                 av |= DIR__REMOVE_NAME;
1881         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1882         if (rc)
1883                 return rc;
1884         if (d_is_positive(new_dentry)) {
1885                 new_isec = d_backing_inode(new_dentry)->i_security;
1886                 new_is_dir = d_is_dir(new_dentry);
1887                 rc = avc_has_perm(sid, new_isec->sid,
1888                                   new_isec->sclass,
1889                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1890                 if (rc)
1891                         return rc;
1892         }
1893
1894         return 0;
1895 }
1896
1897 /* Check whether a task can perform a filesystem operation. */
1898 static int superblock_has_perm(const struct cred *cred,
1899                                struct super_block *sb,
1900                                u32 perms,
1901                                struct common_audit_data *ad)
1902 {
1903         struct superblock_security_struct *sbsec;
1904         u32 sid = cred_sid(cred);
1905
1906         sbsec = sb->s_security;
1907         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1908 }
1909
1910 /* Convert a Linux mode and permission mask to an access vector. */
1911 static inline u32 file_mask_to_av(int mode, int mask)
1912 {
1913         u32 av = 0;
1914
1915         if (!S_ISDIR(mode)) {
1916                 if (mask & MAY_EXEC)
1917                         av |= FILE__EXECUTE;
1918                 if (mask & MAY_READ)
1919                         av |= FILE__READ;
1920
1921                 if (mask & MAY_APPEND)
1922                         av |= FILE__APPEND;
1923                 else if (mask & MAY_WRITE)
1924                         av |= FILE__WRITE;
1925
1926         } else {
1927                 if (mask & MAY_EXEC)
1928                         av |= DIR__SEARCH;
1929                 if (mask & MAY_WRITE)
1930                         av |= DIR__WRITE;
1931                 if (mask & MAY_READ)
1932                         av |= DIR__READ;
1933         }
1934
1935         return av;
1936 }
1937
1938 /* Convert a Linux file to an access vector. */
1939 static inline u32 file_to_av(struct file *file)
1940 {
1941         u32 av = 0;
1942
1943         if (file->f_mode & FMODE_READ)
1944                 av |= FILE__READ;
1945         if (file->f_mode & FMODE_WRITE) {
1946                 if (file->f_flags & O_APPEND)
1947                         av |= FILE__APPEND;
1948                 else
1949                         av |= FILE__WRITE;
1950         }
1951         if (!av) {
1952                 /*
1953                  * Special file opened with flags 3 for ioctl-only use.
1954                  */
1955                 av = FILE__IOCTL;
1956         }
1957
1958         return av;
1959 }
1960
1961 /*
1962  * Convert a file to an access vector and include the correct open
1963  * open permission.
1964  */
1965 static inline u32 open_file_to_av(struct file *file)
1966 {
1967         u32 av = file_to_av(file);
1968
1969         if (selinux_policycap_openperm)
1970                 av |= FILE__OPEN;
1971
1972         return av;
1973 }
1974
1975 /* Hook functions begin here. */
1976
1977 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1978 {
1979         u32 mysid = current_sid();
1980         u32 mgrsid = task_sid(mgr);
1981
1982         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1983                             BINDER__SET_CONTEXT_MGR, NULL);
1984 }
1985
1986 static int selinux_binder_transaction(struct task_struct *from,
1987                                       struct task_struct *to)
1988 {
1989         u32 mysid = current_sid();
1990         u32 fromsid = task_sid(from);
1991         u32 tosid = task_sid(to);
1992         int rc;
1993
1994         if (mysid != fromsid) {
1995                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1996                                   BINDER__IMPERSONATE, NULL);
1997                 if (rc)
1998                         return rc;
1999         }
2000
2001         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2002                             NULL);
2003 }
2004
2005 static int selinux_binder_transfer_binder(struct task_struct *from,
2006                                           struct task_struct *to)
2007 {
2008         u32 fromsid = task_sid(from);
2009         u32 tosid = task_sid(to);
2010
2011         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2012                             NULL);
2013 }
2014
2015 static int selinux_binder_transfer_file(struct task_struct *from,
2016                                         struct task_struct *to,
2017                                         struct file *file)
2018 {
2019         u32 sid = task_sid(to);
2020         struct file_security_struct *fsec = file->f_security;
2021         struct inode *inode = d_backing_inode(file->f_path.dentry);
2022         struct inode_security_struct *isec = inode->i_security;
2023         struct common_audit_data ad;
2024         int rc;
2025
2026         ad.type = LSM_AUDIT_DATA_PATH;
2027         ad.u.path = file->f_path;
2028
2029         if (sid != fsec->sid) {
2030                 rc = avc_has_perm(sid, fsec->sid,
2031                                   SECCLASS_FD,
2032                                   FD__USE,
2033                                   &ad);
2034                 if (rc)
2035                         return rc;
2036         }
2037
2038         if (unlikely(IS_PRIVATE(inode)))
2039                 return 0;
2040
2041         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2042                             &ad);
2043 }
2044
2045 static int selinux_ptrace_access_check(struct task_struct *child,
2046                                      unsigned int mode)
2047 {
2048         if (mode & PTRACE_MODE_READ) {
2049                 u32 sid = current_sid();
2050                 u32 csid = task_sid(child);
2051                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2052         }
2053
2054         return current_has_perm(child, PROCESS__PTRACE);
2055 }
2056
2057 static int selinux_ptrace_traceme(struct task_struct *parent)
2058 {
2059         return task_has_perm(parent, current, PROCESS__PTRACE);
2060 }
2061
2062 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2063                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2064 {
2065         return current_has_perm(target, PROCESS__GETCAP);
2066 }
2067
2068 static int selinux_capset(struct cred *new, const struct cred *old,
2069                           const kernel_cap_t *effective,
2070                           const kernel_cap_t *inheritable,
2071                           const kernel_cap_t *permitted)
2072 {
2073         return cred_has_perm(old, new, PROCESS__SETCAP);
2074 }
2075
2076 /*
2077  * (This comment used to live with the selinux_task_setuid hook,
2078  * which was removed).
2079  *
2080  * Since setuid only affects the current process, and since the SELinux
2081  * controls are not based on the Linux identity attributes, SELinux does not
2082  * need to control this operation.  However, SELinux does control the use of
2083  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2084  */
2085
2086 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2087                            int cap, int audit)
2088 {
2089         return cred_has_capability(cred, cap, audit);
2090 }
2091
2092 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2093 {
2094         const struct cred *cred = current_cred();
2095         int rc = 0;
2096
2097         if (!sb)
2098                 return 0;
2099
2100         switch (cmds) {
2101         case Q_SYNC:
2102         case Q_QUOTAON:
2103         case Q_QUOTAOFF:
2104         case Q_SETINFO:
2105         case Q_SETQUOTA:
2106                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2107                 break;
2108         case Q_GETFMT:
2109         case Q_GETINFO:
2110         case Q_GETQUOTA:
2111                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2112                 break;
2113         default:
2114                 rc = 0;  /* let the kernel handle invalid cmds */
2115                 break;
2116         }
2117         return rc;
2118 }
2119
2120 static int selinux_quota_on(struct dentry *dentry)
2121 {
2122         const struct cred *cred = current_cred();
2123
2124         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2125 }
2126
2127 static int selinux_syslog(int type)
2128 {
2129         int rc;
2130
2131         switch (type) {
2132         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2133         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2134                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2135                 break;
2136         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2137         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2138         /* Set level of messages printed to console */
2139         case SYSLOG_ACTION_CONSOLE_LEVEL:
2140                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2141                 break;
2142         case SYSLOG_ACTION_CLOSE:       /* Close log */
2143         case SYSLOG_ACTION_OPEN:        /* Open log */
2144         case SYSLOG_ACTION_READ:        /* Read from log */
2145         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2146         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2147         default:
2148                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2149                 break;
2150         }
2151         return rc;
2152 }
2153
2154 /*
2155  * Check that a process has enough memory to allocate a new virtual
2156  * mapping. 0 means there is enough memory for the allocation to
2157  * succeed and -ENOMEM implies there is not.
2158  *
2159  * Do not audit the selinux permission check, as this is applied to all
2160  * processes that allocate mappings.
2161  */
2162 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2163 {
2164         int rc, cap_sys_admin = 0;
2165
2166         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2167                                         SECURITY_CAP_NOAUDIT);
2168         if (rc == 0)
2169                 cap_sys_admin = 1;
2170
2171         return cap_sys_admin;
2172 }
2173
2174 /* binprm security operations */
2175
2176 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2177                             const struct task_security_struct *old_tsec,
2178                             const struct task_security_struct *new_tsec)
2179 {
2180         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2181         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2182         int rc;
2183
2184         if (!nnp && !nosuid)
2185                 return 0; /* neither NNP nor nosuid */
2186
2187         if (new_tsec->sid == old_tsec->sid)
2188                 return 0; /* No change in credentials */
2189
2190         /*
2191          * The only transitions we permit under NNP or nosuid
2192          * are transitions to bounded SIDs, i.e. SIDs that are
2193          * guaranteed to only be allowed a subset of the permissions
2194          * of the current SID.
2195          */
2196         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2197         if (rc) {
2198                 /*
2199                  * On failure, preserve the errno values for NNP vs nosuid.
2200                  * NNP:  Operation not permitted for caller.
2201                  * nosuid:  Permission denied to file.
2202                  */
2203                 if (nnp)
2204                         return -EPERM;
2205                 else
2206                         return -EACCES;
2207         }
2208         return 0;
2209 }
2210
2211 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2212 {
2213         const struct task_security_struct *old_tsec;
2214         struct task_security_struct *new_tsec;
2215         struct inode_security_struct *isec;
2216         struct common_audit_data ad;
2217         struct inode *inode = file_inode(bprm->file);
2218         int rc;
2219
2220         /* SELinux context only depends on initial program or script and not
2221          * the script interpreter */
2222         if (bprm->cred_prepared)
2223                 return 0;
2224
2225         old_tsec = current_security();
2226         new_tsec = bprm->cred->security;
2227         isec = inode->i_security;
2228
2229         /* Default to the current task SID. */
2230         new_tsec->sid = old_tsec->sid;
2231         new_tsec->osid = old_tsec->sid;
2232
2233         /* Reset fs, key, and sock SIDs on execve. */
2234         new_tsec->create_sid = 0;
2235         new_tsec->keycreate_sid = 0;
2236         new_tsec->sockcreate_sid = 0;
2237
2238         if (old_tsec->exec_sid) {
2239                 new_tsec->sid = old_tsec->exec_sid;
2240                 /* Reset exec SID on execve. */
2241                 new_tsec->exec_sid = 0;
2242
2243                 /* Fail on NNP or nosuid if not an allowed transition. */
2244                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2245                 if (rc)
2246                         return rc;
2247         } else {
2248                 /* Check for a default transition on this program. */
2249                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2250                                              SECCLASS_PROCESS, NULL,
2251                                              &new_tsec->sid);
2252                 if (rc)
2253                         return rc;
2254
2255                 /*
2256                  * Fallback to old SID on NNP or nosuid if not an allowed
2257                  * transition.
2258                  */
2259                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2260                 if (rc)
2261                         new_tsec->sid = old_tsec->sid;
2262         }
2263
2264         ad.type = LSM_AUDIT_DATA_PATH;
2265         ad.u.path = bprm->file->f_path;
2266
2267         if (new_tsec->sid == old_tsec->sid) {
2268                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2269                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2270                 if (rc)
2271                         return rc;
2272         } else {
2273                 /* Check permissions for the transition. */
2274                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2275                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2276                 if (rc)
2277                         return rc;
2278
2279                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2280                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2281                 if (rc)
2282                         return rc;
2283
2284                 /* Check for shared state */
2285                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2286                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2287                                           SECCLASS_PROCESS, PROCESS__SHARE,
2288                                           NULL);
2289                         if (rc)
2290                                 return -EPERM;
2291                 }
2292
2293                 /* Make sure that anyone attempting to ptrace over a task that
2294                  * changes its SID has the appropriate permit */
2295                 if (bprm->unsafe &
2296                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2297                         struct task_struct *tracer;
2298                         struct task_security_struct *sec;
2299                         u32 ptsid = 0;
2300
2301                         rcu_read_lock();
2302                         tracer = ptrace_parent(current);
2303                         if (likely(tracer != NULL)) {
2304                                 sec = __task_cred(tracer)->security;
2305                                 ptsid = sec->sid;
2306                         }
2307                         rcu_read_unlock();
2308
2309                         if (ptsid != 0) {
2310                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2311                                                   SECCLASS_PROCESS,
2312                                                   PROCESS__PTRACE, NULL);
2313                                 if (rc)
2314                                         return -EPERM;
2315                         }
2316                 }
2317
2318                 /* Clear any possibly unsafe personality bits on exec: */
2319                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2320         }
2321
2322         return 0;
2323 }
2324
2325 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2326 {
2327         const struct task_security_struct *tsec = current_security();
2328         u32 sid, osid;
2329         int atsecure = 0;
2330
2331         sid = tsec->sid;
2332         osid = tsec->osid;
2333
2334         if (osid != sid) {
2335                 /* Enable secure mode for SIDs transitions unless
2336                    the noatsecure permission is granted between
2337                    the two SIDs, i.e. ahp returns 0. */
2338                 atsecure = avc_has_perm(osid, sid,
2339                                         SECCLASS_PROCESS,
2340                                         PROCESS__NOATSECURE, NULL);
2341         }
2342
2343         return !!atsecure;
2344 }
2345
2346 static int match_file(const void *p, struct file *file, unsigned fd)
2347 {
2348         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2349 }
2350
2351 /* Derived from fs/exec.c:flush_old_files. */
2352 static inline void flush_unauthorized_files(const struct cred *cred,
2353                                             struct files_struct *files)
2354 {
2355         struct file *file, *devnull = NULL;
2356         struct tty_struct *tty;
2357         int drop_tty = 0;
2358         unsigned n;
2359
2360         tty = get_current_tty();
2361         if (tty) {
2362                 spin_lock(&tty_files_lock);
2363                 if (!list_empty(&tty->tty_files)) {
2364                         struct tty_file_private *file_priv;
2365
2366                         /* Revalidate access to controlling tty.
2367                            Use file_path_has_perm on the tty path directly
2368                            rather than using file_has_perm, as this particular
2369                            open file may belong to another process and we are
2370                            only interested in the inode-based check here. */
2371                         file_priv = list_first_entry(&tty->tty_files,
2372                                                 struct tty_file_private, list);
2373                         file = file_priv->file;
2374                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2375                                 drop_tty = 1;
2376                 }
2377                 spin_unlock(&tty_files_lock);
2378                 tty_kref_put(tty);
2379         }
2380         /* Reset controlling tty. */
2381         if (drop_tty)
2382                 no_tty();
2383
2384         /* Revalidate access to inherited open files. */
2385         n = iterate_fd(files, 0, match_file, cred);
2386         if (!n) /* none found? */
2387                 return;
2388
2389         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2390         if (IS_ERR(devnull))
2391                 devnull = NULL;
2392         /* replace all the matching ones with this */
2393         do {
2394                 replace_fd(n - 1, devnull, 0);
2395         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2396         if (devnull)
2397                 fput(devnull);
2398 }
2399
2400 /*
2401  * Prepare a process for imminent new credential changes due to exec
2402  */
2403 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2404 {
2405         struct task_security_struct *new_tsec;
2406         struct rlimit *rlim, *initrlim;
2407         int rc, i;
2408
2409         new_tsec = bprm->cred->security;
2410         if (new_tsec->sid == new_tsec->osid)
2411                 return;
2412
2413         /* Close files for which the new task SID is not authorized. */
2414         flush_unauthorized_files(bprm->cred, current->files);
2415
2416         /* Always clear parent death signal on SID transitions. */
2417         current->pdeath_signal = 0;
2418
2419         /* Check whether the new SID can inherit resource limits from the old
2420          * SID.  If not, reset all soft limits to the lower of the current
2421          * task's hard limit and the init task's soft limit.
2422          *
2423          * Note that the setting of hard limits (even to lower them) can be
2424          * controlled by the setrlimit check.  The inclusion of the init task's
2425          * soft limit into the computation is to avoid resetting soft limits
2426          * higher than the default soft limit for cases where the default is
2427          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2428          */
2429         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2430                           PROCESS__RLIMITINH, NULL);
2431         if (rc) {
2432                 /* protect against do_prlimit() */
2433                 task_lock(current);
2434                 for (i = 0; i < RLIM_NLIMITS; i++) {
2435                         rlim = current->signal->rlim + i;
2436                         initrlim = init_task.signal->rlim + i;
2437                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2438                 }
2439                 task_unlock(current);
2440                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2441         }
2442 }
2443
2444 /*
2445  * Clean up the process immediately after the installation of new credentials
2446  * due to exec
2447  */
2448 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2449 {
2450         const struct task_security_struct *tsec = current_security();
2451         struct itimerval itimer;
2452         u32 osid, sid;
2453         int rc, i;
2454
2455         osid = tsec->osid;
2456         sid = tsec->sid;
2457
2458         if (sid == osid)
2459                 return;
2460
2461         /* Check whether the new SID can inherit signal state from the old SID.
2462          * If not, clear itimers to avoid subsequent signal generation and
2463          * flush and unblock signals.
2464          *
2465          * This must occur _after_ the task SID has been updated so that any
2466          * kill done after the flush will be checked against the new SID.
2467          */
2468         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2469         if (rc) {
2470                 memset(&itimer, 0, sizeof itimer);
2471                 for (i = 0; i < 3; i++)
2472                         do_setitimer(i, &itimer, NULL);
2473                 spin_lock_irq(&current->sighand->siglock);
2474                 if (!fatal_signal_pending(current)) {
2475                         flush_sigqueue(&current->pending);
2476                         flush_sigqueue(&current->signal->shared_pending);
2477                         flush_signal_handlers(current, 1);
2478                         sigemptyset(&current->blocked);
2479                         recalc_sigpending();
2480                 }
2481                 spin_unlock_irq(&current->sighand->siglock);
2482         }
2483
2484         /* Wake up the parent if it is waiting so that it can recheck
2485          * wait permission to the new task SID. */
2486         read_lock(&tasklist_lock);
2487         __wake_up_parent(current, current->real_parent);
2488         read_unlock(&tasklist_lock);
2489 }
2490
2491 /* superblock security operations */
2492
2493 static int selinux_sb_alloc_security(struct super_block *sb)
2494 {
2495         return superblock_alloc_security(sb);
2496 }
2497
2498 static void selinux_sb_free_security(struct super_block *sb)
2499 {
2500         superblock_free_security(sb);
2501 }
2502
2503 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2504 {
2505         if (plen > olen)
2506                 return 0;
2507
2508         return !memcmp(prefix, option, plen);
2509 }
2510
2511 static inline int selinux_option(char *option, int len)
2512 {
2513         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2514                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2515                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2516                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2517                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2518 }
2519
2520 static inline void take_option(char **to, char *from, int *first, int len)
2521 {
2522         if (!*first) {
2523                 **to = ',';
2524                 *to += 1;
2525         } else
2526                 *first = 0;
2527         memcpy(*to, from, len);
2528         *to += len;
2529 }
2530
2531 static inline void take_selinux_option(char **to, char *from, int *first,
2532                                        int len)
2533 {
2534         int current_size = 0;
2535
2536         if (!*first) {
2537                 **to = '|';
2538                 *to += 1;
2539         } else
2540                 *first = 0;
2541
2542         while (current_size < len) {
2543                 if (*from != '"') {
2544                         **to = *from;
2545                         *to += 1;
2546                 }
2547                 from += 1;
2548                 current_size += 1;
2549         }
2550 }
2551
2552 static int selinux_sb_copy_data(char *orig, char *copy)
2553 {
2554         int fnosec, fsec, rc = 0;
2555         char *in_save, *in_curr, *in_end;
2556         char *sec_curr, *nosec_save, *nosec;
2557         int open_quote = 0;
2558
2559         in_curr = orig;
2560         sec_curr = copy;
2561
2562         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2563         if (!nosec) {
2564                 rc = -ENOMEM;
2565                 goto out;
2566         }
2567
2568         nosec_save = nosec;
2569         fnosec = fsec = 1;
2570         in_save = in_end = orig;
2571
2572         do {
2573                 if (*in_end == '"')
2574                         open_quote = !open_quote;
2575                 if ((*in_end == ',' && open_quote == 0) ||
2576                                 *in_end == '\0') {
2577                         int len = in_end - in_curr;
2578
2579                         if (selinux_option(in_curr, len))
2580                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2581                         else
2582                                 take_option(&nosec, in_curr, &fnosec, len);
2583
2584                         in_curr = in_end + 1;
2585                 }
2586         } while (*in_end++);
2587
2588         strcpy(in_save, nosec_save);
2589         free_page((unsigned long)nosec_save);
2590 out:
2591         return rc;
2592 }
2593
2594 static int selinux_sb_remount(struct super_block *sb, void *data)
2595 {
2596         int rc, i, *flags;
2597         struct security_mnt_opts opts;
2598         char *secdata, **mount_options;
2599         struct superblock_security_struct *sbsec = sb->s_security;
2600
2601         if (!(sbsec->flags & SE_SBINITIALIZED))
2602                 return 0;
2603
2604         if (!data)
2605                 return 0;
2606
2607         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2608                 return 0;
2609
2610         security_init_mnt_opts(&opts);
2611         secdata = alloc_secdata();
2612         if (!secdata)
2613                 return -ENOMEM;
2614         rc = selinux_sb_copy_data(data, secdata);
2615         if (rc)
2616                 goto out_free_secdata;
2617
2618         rc = selinux_parse_opts_str(secdata, &opts);
2619         if (rc)
2620                 goto out_free_secdata;
2621
2622         mount_options = opts.mnt_opts;
2623         flags = opts.mnt_opts_flags;
2624
2625         for (i = 0; i < opts.num_mnt_opts; i++) {
2626                 u32 sid;
2627
2628                 if (flags[i] == SBLABEL_MNT)
2629                         continue;
2630                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2631                 if (rc) {
2632                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2633                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2634                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2635                         goto out_free_opts;
2636                 }
2637                 rc = -EINVAL;
2638                 switch (flags[i]) {
2639                 case FSCONTEXT_MNT:
2640                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2641                                 goto out_bad_option;
2642                         break;
2643                 case CONTEXT_MNT:
2644                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2645                                 goto out_bad_option;
2646                         break;
2647                 case ROOTCONTEXT_MNT: {
2648                         struct inode_security_struct *root_isec;
2649                         root_isec = d_backing_inode(sb->s_root)->i_security;
2650
2651                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2652                                 goto out_bad_option;
2653                         break;
2654                 }
2655                 case DEFCONTEXT_MNT:
2656                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2657                                 goto out_bad_option;
2658                         break;
2659                 default:
2660                         goto out_free_opts;
2661                 }
2662         }
2663
2664         rc = 0;
2665 out_free_opts:
2666         security_free_mnt_opts(&opts);
2667 out_free_secdata:
2668         free_secdata(secdata);
2669         return rc;
2670 out_bad_option:
2671         printk(KERN_WARNING "SELinux: unable to change security options "
2672                "during remount (dev %s, type=%s)\n", sb->s_id,
2673                sb->s_type->name);
2674         goto out_free_opts;
2675 }
2676
2677 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2678 {
2679         const struct cred *cred = current_cred();
2680         struct common_audit_data ad;
2681         int rc;
2682
2683         rc = superblock_doinit(sb, data);
2684         if (rc)
2685                 return rc;
2686
2687         /* Allow all mounts performed by the kernel */
2688         if (flags & MS_KERNMOUNT)
2689                 return 0;
2690
2691         ad.type = LSM_AUDIT_DATA_DENTRY;
2692         ad.u.dentry = sb->s_root;
2693         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2694 }
2695
2696 static int selinux_sb_statfs(struct dentry *dentry)
2697 {
2698         const struct cred *cred = current_cred();
2699         struct common_audit_data ad;
2700
2701         ad.type = LSM_AUDIT_DATA_DENTRY;
2702         ad.u.dentry = dentry->d_sb->s_root;
2703         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2704 }
2705
2706 static int selinux_mount(const char *dev_name,
2707                          struct path *path,
2708                          const char *type,
2709                          unsigned long flags,
2710                          void *data)
2711 {
2712         const struct cred *cred = current_cred();
2713
2714         if (flags & MS_REMOUNT)
2715                 return superblock_has_perm(cred, path->dentry->d_sb,
2716                                            FILESYSTEM__REMOUNT, NULL);
2717         else
2718                 return path_has_perm(cred, path, FILE__MOUNTON);
2719 }
2720
2721 static int selinux_umount(struct vfsmount *mnt, int flags)
2722 {
2723         const struct cred *cred = current_cred();
2724
2725         return superblock_has_perm(cred, mnt->mnt_sb,
2726                                    FILESYSTEM__UNMOUNT, NULL);
2727 }
2728
2729 /* inode security operations */
2730
2731 static int selinux_inode_alloc_security(struct inode *inode)
2732 {
2733         return inode_alloc_security(inode);
2734 }
2735
2736 static void selinux_inode_free_security(struct inode *inode)
2737 {
2738         inode_free_security(inode);
2739 }
2740
2741 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2742                                         struct qstr *name, void **ctx,
2743                                         u32 *ctxlen)
2744 {
2745         u32 newsid;
2746         int rc;
2747
2748         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2749                                            inode_mode_to_security_class(mode),
2750                                            &newsid);
2751         if (rc)
2752                 return rc;
2753
2754         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2755 }
2756
2757 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758                                        const struct qstr *qstr,
2759                                        const char **name,
2760                                        void **value, size_t *len)
2761 {
2762         const struct task_security_struct *tsec = current_security();
2763         struct inode_security_struct *dsec;
2764         struct superblock_security_struct *sbsec;
2765         u32 sid, newsid, clen;
2766         int rc;
2767         char *context;
2768
2769         dsec = dir->i_security;
2770         sbsec = dir->i_sb->s_security;
2771
2772         sid = tsec->sid;
2773         newsid = tsec->create_sid;
2774
2775         rc = selinux_determine_inode_label(
2776                 dir, qstr,
2777                 inode_mode_to_security_class(inode->i_mode),
2778                 &newsid);
2779         if (rc)
2780                 return rc;
2781
2782         /* Possibly defer initialization to selinux_complete_init. */
2783         if (sbsec->flags & SE_SBINITIALIZED) {
2784                 struct inode_security_struct *isec = inode->i_security;
2785                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2786                 isec->sid = newsid;
2787                 isec->initialized = 1;
2788         }
2789
2790         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2791                 return -EOPNOTSUPP;
2792
2793         if (name)
2794                 *name = XATTR_SELINUX_SUFFIX;
2795
2796         if (value && len) {
2797                 rc = security_sid_to_context_force(newsid, &context, &clen);
2798                 if (rc)
2799                         return rc;
2800                 *value = context;
2801                 *len = clen;
2802         }
2803
2804         return 0;
2805 }
2806
2807 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2808 {
2809         return may_create(dir, dentry, SECCLASS_FILE);
2810 }
2811
2812 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2813 {
2814         return may_link(dir, old_dentry, MAY_LINK);
2815 }
2816
2817 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2818 {
2819         return may_link(dir, dentry, MAY_UNLINK);
2820 }
2821
2822 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2823 {
2824         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2825 }
2826
2827 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2828 {
2829         return may_create(dir, dentry, SECCLASS_DIR);
2830 }
2831
2832 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2833 {
2834         return may_link(dir, dentry, MAY_RMDIR);
2835 }
2836
2837 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2838 {
2839         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2840 }
2841
2842 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2843                                 struct inode *new_inode, struct dentry *new_dentry)
2844 {
2845         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2846 }
2847
2848 static int selinux_inode_readlink(struct dentry *dentry)
2849 {
2850         const struct cred *cred = current_cred();
2851
2852         return dentry_has_perm(cred, dentry, FILE__READ);
2853 }
2854
2855 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2856                                      bool rcu)
2857 {
2858         const struct cred *cred = current_cred();
2859         struct common_audit_data ad;
2860         struct inode_security_struct *isec;
2861         u32 sid;
2862
2863         validate_creds(cred);
2864
2865         ad.type = LSM_AUDIT_DATA_DENTRY;
2866         ad.u.dentry = dentry;
2867         sid = cred_sid(cred);
2868         isec = inode->i_security;
2869
2870         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2871                                   rcu ? MAY_NOT_BLOCK : 0);
2872 }
2873
2874 static noinline int audit_inode_permission(struct inode *inode,
2875                                            u32 perms, u32 audited, u32 denied,
2876                                            int result,
2877                                            unsigned flags)
2878 {
2879         struct common_audit_data ad;
2880         struct inode_security_struct *isec = inode->i_security;
2881         int rc;
2882
2883         ad.type = LSM_AUDIT_DATA_INODE;
2884         ad.u.inode = inode;
2885
2886         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2887                             audited, denied, result, &ad, flags);
2888         if (rc)
2889                 return rc;
2890         return 0;
2891 }
2892
2893 static int selinux_inode_permission(struct inode *inode, int mask)
2894 {
2895         const struct cred *cred = current_cred();
2896         u32 perms;
2897         bool from_access;
2898         unsigned flags = mask & MAY_NOT_BLOCK;
2899         struct inode_security_struct *isec;
2900         u32 sid;
2901         struct av_decision avd;
2902         int rc, rc2;
2903         u32 audited, denied;
2904
2905         from_access = mask & MAY_ACCESS;
2906         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2907
2908         /* No permission to check.  Existence test. */
2909         if (!mask)
2910                 return 0;
2911
2912         validate_creds(cred);
2913
2914         if (unlikely(IS_PRIVATE(inode)))
2915                 return 0;
2916
2917         perms = file_mask_to_av(inode->i_mode, mask);
2918
2919         sid = cred_sid(cred);
2920         isec = inode->i_security;
2921
2922         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2923         audited = avc_audit_required(perms, &avd, rc,
2924                                      from_access ? FILE__AUDIT_ACCESS : 0,
2925                                      &denied);
2926         if (likely(!audited))
2927                 return rc;
2928
2929         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2930         if (rc2)
2931                 return rc2;
2932         return rc;
2933 }
2934
2935 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2936 {
2937         const struct cred *cred = current_cred();
2938         unsigned int ia_valid = iattr->ia_valid;
2939         __u32 av = FILE__WRITE;
2940
2941         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2942         if (ia_valid & ATTR_FORCE) {
2943                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2944                               ATTR_FORCE);
2945                 if (!ia_valid)
2946                         return 0;
2947         }
2948
2949         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2950                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2951                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2952
2953         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2954                         && !(ia_valid & ATTR_FILE))
2955                 av |= FILE__OPEN;
2956
2957         return dentry_has_perm(cred, dentry, av);
2958 }
2959
2960 static int selinux_inode_getattr(const struct path *path)
2961 {
2962         return path_has_perm(current_cred(), path, FILE__GETATTR);
2963 }
2964
2965 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2966 {
2967         const struct cred *cred = current_cred();
2968
2969         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2970                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2971                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2972                         if (!capable(CAP_SETFCAP))
2973                                 return -EPERM;
2974                 } else if (!capable(CAP_SYS_ADMIN)) {
2975                         /* A different attribute in the security namespace.
2976                            Restrict to administrator. */
2977                         return -EPERM;
2978                 }
2979         }
2980
2981         /* Not an attribute we recognize, so just check the
2982            ordinary setattr permission. */
2983         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2984 }
2985
2986 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2987                                   const void *value, size_t size, int flags)
2988 {
2989         struct inode *inode = d_backing_inode(dentry);
2990         struct inode_security_struct *isec = inode->i_security;
2991         struct superblock_security_struct *sbsec;
2992         struct common_audit_data ad;
2993         u32 newsid, sid = current_sid();
2994         int rc = 0;
2995
2996         if (strcmp(name, XATTR_NAME_SELINUX))
2997                 return selinux_inode_setotherxattr(dentry, name);
2998
2999         sbsec = inode->i_sb->s_security;
3000         if (!(sbsec->flags & SBLABEL_MNT))
3001                 return -EOPNOTSUPP;
3002
3003         if (!inode_owner_or_capable(inode))
3004                 return -EPERM;
3005
3006         ad.type = LSM_AUDIT_DATA_DENTRY;
3007         ad.u.dentry = dentry;
3008
3009         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3010                           FILE__RELABELFROM, &ad);
3011         if (rc)
3012                 return rc;
3013
3014         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3015         if (rc == -EINVAL) {
3016                 if (!capable(CAP_MAC_ADMIN)) {
3017                         struct audit_buffer *ab;
3018                         size_t audit_size;
3019                         const char *str;
3020
3021                         /* We strip a nul only if it is at the end, otherwise the
3022                          * context contains a nul and we should audit that */
3023                         if (value) {
3024                                 str = value;
3025                                 if (str[size - 1] == '\0')
3026                                         audit_size = size - 1;
3027                                 else
3028                                         audit_size = size;
3029                         } else {
3030                                 str = "";
3031                                 audit_size = 0;
3032                         }
3033                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3034                         audit_log_format(ab, "op=setxattr invalid_context=");
3035                         audit_log_n_untrustedstring(ab, value, audit_size);
3036                         audit_log_end(ab);
3037
3038                         return rc;
3039                 }
3040                 rc = security_context_to_sid_force(value, size, &newsid);
3041         }
3042         if (rc)
3043                 return rc;
3044
3045         rc = avc_has_perm(sid, newsid, isec->sclass,
3046                           FILE__RELABELTO, &ad);
3047         if (rc)
3048                 return rc;
3049
3050         rc = security_validate_transition(isec->sid, newsid, sid,
3051                                           isec->sclass);
3052         if (rc)
3053                 return rc;
3054
3055         return avc_has_perm(newsid,
3056                             sbsec->sid,
3057                             SECCLASS_FILESYSTEM,
3058                             FILESYSTEM__ASSOCIATE,
3059                             &ad);
3060 }
3061
3062 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3063                                         const void *value, size_t size,
3064                                         int flags)
3065 {
3066         struct inode *inode = d_backing_inode(dentry);
3067         struct inode_security_struct *isec = inode->i_security;
3068         u32 newsid;
3069         int rc;
3070
3071         if (strcmp(name, XATTR_NAME_SELINUX)) {
3072                 /* Not an attribute we recognize, so nothing to do. */
3073                 return;
3074         }
3075
3076         rc = security_context_to_sid_force(value, size, &newsid);
3077         if (rc) {
3078                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3079                        "for (%s, %lu), rc=%d\n",
3080                        inode->i_sb->s_id, inode->i_ino, -rc);
3081                 return;
3082         }
3083
3084         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3085         isec->sid = newsid;
3086         isec->initialized = 1;
3087
3088         return;
3089 }
3090
3091 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3092 {
3093         const struct cred *cred = current_cred();
3094
3095         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3096 }
3097
3098 static int selinux_inode_listxattr(struct dentry *dentry)
3099 {
3100         const struct cred *cred = current_cred();
3101
3102         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3103 }
3104
3105 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3106 {
3107         if (strcmp(name, XATTR_NAME_SELINUX))
3108                 return selinux_inode_setotherxattr(dentry, name);
3109
3110         /* No one is allowed to remove a SELinux security label.
3111            You can change the label, but all data must be labeled. */
3112         return -EACCES;
3113 }
3114
3115 /*
3116  * Copy the inode security context value to the user.
3117  *
3118  * Permission check is handled by selinux_inode_getxattr hook.
3119  */
3120 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3121 {
3122         u32 size;
3123         int error;
3124         char *context = NULL;
3125         struct inode_security_struct *isec = inode->i_security;
3126
3127         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3128                 return -EOPNOTSUPP;
3129
3130         /*
3131          * If the caller has CAP_MAC_ADMIN, then get the raw context
3132          * value even if it is not defined by current policy; otherwise,
3133          * use the in-core value under current policy.
3134          * Use the non-auditing forms of the permission checks since
3135          * getxattr may be called by unprivileged processes commonly
3136          * and lack of permission just means that we fall back to the
3137          * in-core context value, not a denial.
3138          */
3139         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3140                             SECURITY_CAP_NOAUDIT);
3141         if (!error)
3142                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3143                                             SECURITY_CAP_NOAUDIT);
3144         if (!error)
3145                 error = security_sid_to_context_force(isec->sid, &context,
3146                                                       &size);
3147         else
3148                 error = security_sid_to_context(isec->sid, &context, &size);
3149         if (error)
3150                 return error;
3151         error = size;
3152         if (alloc) {
3153                 *buffer = context;
3154                 goto out_nofree;
3155         }
3156         kfree(context);
3157 out_nofree:
3158         return error;
3159 }
3160
3161 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3162                                      const void *value, size_t size, int flags)
3163 {
3164         struct inode_security_struct *isec = inode->i_security;
3165         u32 newsid;
3166         int rc;
3167
3168         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3169                 return -EOPNOTSUPP;
3170
3171         if (!value || !size)
3172                 return -EACCES;
3173
3174         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3175         if (rc)
3176                 return rc;
3177
3178         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3179         isec->sid = newsid;
3180         isec->initialized = 1;
3181         return 0;
3182 }
3183
3184 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3185 {
3186         const int len = sizeof(XATTR_NAME_SELINUX);
3187         if (buffer && len <= buffer_size)
3188                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3189         return len;
3190 }
3191
3192 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3193 {
3194         struct inode_security_struct *isec = inode->i_security;
3195         *secid = isec->sid;
3196 }
3197
3198 /* file security operations */
3199
3200 static int selinux_revalidate_file_permission(struct file *file, int mask)
3201 {
3202         const struct cred *cred = current_cred();
3203         struct inode *inode = file_inode(file);
3204
3205         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3206         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3207                 mask |= MAY_APPEND;
3208
3209         return file_has_perm(cred, file,
3210                              file_mask_to_av(inode->i_mode, mask));
3211 }
3212
3213 static int selinux_file_permission(struct file *file, int mask)
3214 {
3215         struct inode *inode = file_inode(file);
3216         struct file_security_struct *fsec = file->f_security;
3217         struct inode_security_struct *isec = inode->i_security;
3218         u32 sid = current_sid();
3219
3220         if (!mask)
3221                 /* No permission to check.  Existence test. */
3222                 return 0;
3223
3224         if (sid == fsec->sid && fsec->isid == isec->sid &&
3225             fsec->pseqno == avc_policy_seqno())
3226                 /* No change since file_open check. */
3227                 return 0;
3228
3229         return selinux_revalidate_file_permission(file, mask);
3230 }
3231
3232 static int selinux_file_alloc_security(struct file *file)
3233 {
3234         return file_alloc_security(file);
3235 }
3236
3237 static void selinux_file_free_security(struct file *file)
3238 {
3239         file_free_security(file);
3240 }
3241
3242 /*
3243  * Check whether a task has the ioctl permission and cmd
3244  * operation to an inode.
3245  */
3246 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3247                 u32 requested, u16 cmd)
3248 {
3249         struct common_audit_data ad;
3250         struct file_security_struct *fsec = file->f_security;
3251         struct inode *inode = file_inode(file);
3252         struct inode_security_struct *isec = inode->i_security;
3253         struct lsm_ioctlop_audit ioctl;
3254         u32 ssid = cred_sid(cred);
3255         int rc;
3256         u8 driver = cmd >> 8;
3257         u8 xperm = cmd & 0xff;
3258
3259         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3260         ad.u.op = &ioctl;
3261         ad.u.op->cmd = cmd;
3262         ad.u.op->path = file->f_path;
3263
3264         if (ssid != fsec->sid) {
3265                 rc = avc_has_perm(ssid, fsec->sid,
3266                                 SECCLASS_FD,
3267                                 FD__USE,
3268                                 &ad);
3269                 if (rc)
3270                         goto out;
3271         }
3272
3273         if (unlikely(IS_PRIVATE(inode)))
3274                 return 0;
3275
3276         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3277                         requested, driver, xperm, &ad);
3278 out:
3279         return rc;
3280 }
3281
3282 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3283                               unsigned long arg)
3284 {
3285         const struct cred *cred = current_cred();
3286         int error = 0;
3287
3288         switch (cmd) {
3289         case FIONREAD:
3290         /* fall through */
3291         case FIBMAP:
3292         /* fall through */
3293         case FIGETBSZ:
3294         /* fall through */
3295         case FS_IOC_GETFLAGS:
3296         /* fall through */
3297         case FS_IOC_GETVERSION:
3298                 error = file_has_perm(cred, file, FILE__GETATTR);
3299                 break;
3300
3301         case FS_IOC_SETFLAGS:
3302         /* fall through */
3303         case FS_IOC_SETVERSION:
3304                 error = file_has_perm(cred, file, FILE__SETATTR);
3305                 break;
3306
3307         /* sys_ioctl() checks */
3308         case FIONBIO:
3309         /* fall through */
3310         case FIOASYNC:
3311                 error = file_has_perm(cred, file, 0);
3312                 break;
3313
3314         case KDSKBENT:
3315         case KDSKBSENT:
3316                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3317                                             SECURITY_CAP_AUDIT);
3318                 break;
3319
3320         /* default case assumes that the command will go
3321          * to the file's ioctl() function.
3322          */
3323         default:
3324                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3325         }
3326         return error;
3327 }
3328
3329 static int default_noexec;
3330
3331 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3332 {
3333         const struct cred *cred = current_cred();
3334         int rc = 0;
3335
3336         if (default_noexec &&
3337             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3338                                    (!shared && (prot & PROT_WRITE)))) {
3339                 /*
3340                  * We are making executable an anonymous mapping or a
3341                  * private file mapping that will also be writable.
3342                  * This has an additional check.
3343                  */
3344                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3345                 if (rc)
3346                         goto error;
3347         }
3348
3349         if (file) {
3350                 /* read access is always possible with a mapping */
3351                 u32 av = FILE__READ;
3352
3353                 /* write access only matters if the mapping is shared */
3354                 if (shared && (prot & PROT_WRITE))
3355                         av |= FILE__WRITE;
3356
3357                 if (prot & PROT_EXEC)
3358                         av |= FILE__EXECUTE;
3359
3360                 return file_has_perm(cred, file, av);
3361         }
3362
3363 error:
3364         return rc;
3365 }
3366
3367 static int selinux_mmap_addr(unsigned long addr)
3368 {
3369         int rc = 0;
3370
3371         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3372                 u32 sid = current_sid();
3373                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3374                                   MEMPROTECT__MMAP_ZERO, NULL);
3375         }
3376
3377         return rc;
3378 }
3379
3380 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3381                              unsigned long prot, unsigned long flags)
3382 {
3383         if (selinux_checkreqprot)
3384                 prot = reqprot;
3385
3386         return file_map_prot_check(file, prot,
3387                                    (flags & MAP_TYPE) == MAP_SHARED);
3388 }
3389
3390 static int selinux_file_mprotect(struct vm_area_struct *vma,
3391                                  unsigned long reqprot,
3392                                  unsigned long prot)
3393 {
3394         const struct cred *cred = current_cred();
3395
3396         if (selinux_checkreqprot)
3397                 prot = reqprot;
3398
3399         if (default_noexec &&
3400             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3401                 int rc = 0;
3402                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3403                     vma->vm_end <= vma->vm_mm->brk) {
3404                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3405                 } else if (!vma->vm_file &&
3406                            vma->vm_start <= vma->vm_mm->start_stack &&
3407                            vma->vm_end >= vma->vm_mm->start_stack) {
3408                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3409                 } else if (vma->vm_file && vma->anon_vma) {
3410                         /*
3411                          * We are making executable a file mapping that has
3412                          * had some COW done. Since pages might have been
3413                          * written, check ability to execute the possibly
3414                          * modified content.  This typically should only
3415                          * occur for text relocations.
3416                          */
3417                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3418                 }
3419                 if (rc)
3420                         return rc;
3421         }
3422
3423         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3424 }
3425
3426 static int selinux_file_lock(struct file *file, unsigned int cmd)
3427 {
3428         const struct cred *cred = current_cred();
3429
3430         return file_has_perm(cred, file, FILE__LOCK);
3431 }
3432
3433 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3434                               unsigned long arg)
3435 {
3436         const struct cred *cred = current_cred();
3437         int err = 0;
3438
3439         switch (cmd) {
3440         case F_SETFL:
3441                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3442                         err = file_has_perm(cred, file, FILE__WRITE);
3443                         break;
3444                 }
3445                 /* fall through */
3446         case F_SETOWN:
3447         case F_SETSIG:
3448         case F_GETFL:
3449         case F_GETOWN:
3450         case F_GETSIG:
3451         case F_GETOWNER_UIDS:
3452                 /* Just check FD__USE permission */
3453                 err = file_has_perm(cred, file, 0);
3454                 break;
3455         case F_GETLK:
3456         case F_SETLK:
3457         case F_SETLKW:
3458         case F_OFD_GETLK:
3459         case F_OFD_SETLK:
3460         case F_OFD_SETLKW:
3461 #if BITS_PER_LONG == 32
3462         case F_GETLK64:
3463         case F_SETLK64:
3464         case F_SETLKW64:
3465 #endif
3466                 err = file_has_perm(cred, file, FILE__LOCK);
3467                 break;
3468         }
3469
3470         return err;
3471 }
3472
3473 static void selinux_file_set_fowner(struct file *file)
3474 {
3475         struct file_security_struct *fsec;
3476
3477         fsec = file->f_security;
3478         fsec->fown_sid = current_sid();
3479 }
3480
3481 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3482                                        struct fown_struct *fown, int signum)
3483 {
3484         struct file *file;
3485         u32 sid = task_sid(tsk);
3486         u32 perm;
3487         struct file_security_struct *fsec;
3488
3489         /* struct fown_struct is never outside the context of a struct file */
3490         file = container_of(fown, struct file, f_owner);
3491
3492         fsec = file->f_security;
3493
3494         if (!signum)
3495                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3496         else
3497                 perm = signal_to_av(signum);
3498
3499         return avc_has_perm(fsec->fown_sid, sid,
3500                             SECCLASS_PROCESS, perm, NULL);
3501 }
3502
3503 static int selinux_file_receive(struct file *file)
3504 {
3505         const struct cred *cred = current_cred();
3506
3507         return file_has_perm(cred, file, file_to_av(file));
3508 }
3509
3510 static int selinux_file_open(struct file *file, const struct cred *cred)
3511 {
3512         struct file_security_struct *fsec;
3513         struct inode_security_struct *isec;
3514
3515         fsec = file->f_security;
3516         isec = file_inode(file)->i_security;
3517         /*
3518          * Save inode label and policy sequence number
3519          * at open-time so that selinux_file_permission
3520          * can determine whether revalidation is necessary.
3521          * Task label is already saved in the file security
3522          * struct as its SID.
3523          */
3524         fsec->isid = isec->sid;
3525         fsec->pseqno = avc_policy_seqno();
3526         /*
3527          * Since the inode label or policy seqno may have changed
3528          * between the selinux_inode_permission check and the saving
3529          * of state above, recheck that access is still permitted.
3530          * Otherwise, access might never be revalidated against the
3531          * new inode label or new policy.
3532          * This check is not redundant - do not remove.
3533          */
3534         return file_path_has_perm(cred, file, open_file_to_av(file));
3535 }
3536
3537 /* task security operations */
3538
3539 static int selinux_task_create(unsigned long clone_flags)
3540 {
3541         return current_has_perm(current, PROCESS__FORK);
3542 }
3543
3544 /*
3545  * allocate the SELinux part of blank credentials
3546  */
3547 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3548 {
3549         struct task_security_struct *tsec;
3550
3551         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3552         if (!tsec)
3553                 return -ENOMEM;
3554
3555         cred->security = tsec;
3556         return 0;
3557 }
3558
3559 /*
3560  * detach and free the LSM part of a set of credentials
3561  */
3562 static void selinux_cred_free(struct cred *cred)
3563 {
3564         struct task_security_struct *tsec = cred->security;
3565
3566         /*
3567          * cred->security == NULL if security_cred_alloc_blank() or
3568          * security_prepare_creds() returned an error.
3569          */
3570         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3571         cred->security = (void *) 0x7UL;
3572         kfree(tsec);
3573 }
3574
3575 /*
3576  * prepare a new set of credentials for modification
3577  */
3578 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3579                                 gfp_t gfp)
3580 {
3581         const struct task_security_struct *old_tsec;
3582         struct task_security_struct *tsec;
3583
3584         old_tsec = old->security;
3585
3586         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3587         if (!tsec)
3588                 return -ENOMEM;
3589
3590         new->security = tsec;
3591         return 0;
3592 }
3593
3594 /*
3595  * transfer the SELinux data to a blank set of creds
3596  */
3597 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3598 {
3599         const struct task_security_struct *old_tsec = old->security;
3600         struct task_security_struct *tsec = new->security;
3601
3602         *tsec = *old_tsec;
3603 }
3604
3605 /*
3606  * set the security data for a kernel service
3607  * - all the creation contexts are set to unlabelled
3608  */
3609 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3610 {
3611         struct task_security_struct *tsec = new->security;
3612         u32 sid = current_sid();
3613         int ret;
3614
3615         ret = avc_has_perm(sid, secid,
3616                            SECCLASS_KERNEL_SERVICE,
3617                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3618                            NULL);
3619         if (ret == 0) {
3620                 tsec->sid = secid;
3621                 tsec->create_sid = 0;
3622                 tsec->keycreate_sid = 0;
3623                 tsec->sockcreate_sid = 0;
3624         }
3625         return ret;
3626 }
3627
3628 /*
3629  * set the file creation context in a security record to the same as the
3630  * objective context of the specified inode
3631  */
3632 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3633 {
3634         struct inode_security_struct *isec = inode->i_security;
3635         struct task_security_struct *tsec = new->security;
3636         u32 sid = current_sid();
3637         int ret;
3638
3639         ret = avc_has_perm(sid, isec->sid,
3640                            SECCLASS_KERNEL_SERVICE,
3641                            KERNEL_SERVICE__CREATE_FILES_AS,
3642                            NULL);
3643
3644         if (ret == 0)
3645                 tsec->create_sid = isec->sid;
3646         return ret;
3647 }
3648
3649 static int selinux_kernel_module_request(char *kmod_name)
3650 {
3651         u32 sid;
3652         struct common_audit_data ad;
3653
3654         sid = task_sid(current);
3655
3656         ad.type = LSM_AUDIT_DATA_KMOD;
3657         ad.u.kmod_name = kmod_name;
3658
3659         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3660                             SYSTEM__MODULE_REQUEST, &ad);
3661 }
3662
3663 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3664 {
3665         return current_has_perm(p, PROCESS__SETPGID);
3666 }
3667
3668 static int selinux_task_getpgid(struct task_struct *p)
3669 {
3670         return current_has_perm(p, PROCESS__GETPGID);
3671 }
3672
3673 static int selinux_task_getsid(struct task_struct *p)
3674 {
3675         return current_has_perm(p, PROCESS__GETSESSION);
3676 }
3677
3678 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3679 {
3680         *secid = task_sid(p);
3681 }
3682
3683 static int selinux_task_setnice(struct task_struct *p, int nice)
3684 {
3685         return current_has_perm(p, PROCESS__SETSCHED);
3686 }
3687
3688 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3689 {
3690         return current_has_perm(p, PROCESS__SETSCHED);
3691 }
3692
3693 static int selinux_task_getioprio(struct task_struct *p)
3694 {
3695         return current_has_perm(p, PROCESS__GETSCHED);
3696 }
3697
3698 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3699                 struct rlimit *new_rlim)
3700 {
3701         struct rlimit *old_rlim = p->signal->rlim + resource;
3702
3703         /* Control the ability to change the hard limit (whether
3704            lowering or raising it), so that the hard limit can
3705            later be used as a safe reset point for the soft limit
3706            upon context transitions.  See selinux_bprm_committing_creds. */
3707         if (old_rlim->rlim_max != new_rlim->rlim_max)
3708                 return current_has_perm(p, PROCESS__SETRLIMIT);
3709
3710         return 0;
3711 }
3712
3713 static int selinux_task_setscheduler(struct task_struct *p)
3714 {
3715         return current_has_perm(p, PROCESS__SETSCHED);
3716 }
3717
3718 static int selinux_task_getscheduler(struct task_struct *p)
3719 {
3720         return current_has_perm(p, PROCESS__GETSCHED);
3721 }
3722
3723 static int selinux_task_movememory(struct task_struct *p)
3724 {
3725         return current_has_perm(p, PROCESS__SETSCHED);
3726 }
3727
3728 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3729                                 int sig, u32 secid)
3730 {
3731         u32 perm;
3732         int rc;
3733
3734         if (!sig)
3735                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3736         else
3737                 perm = signal_to_av(sig);
3738         if (secid)
3739                 rc = avc_has_perm(secid, task_sid(p),
3740                                   SECCLASS_PROCESS, perm, NULL);
3741         else
3742                 rc = current_has_perm(p, perm);
3743         return rc;
3744 }
3745
3746 static int selinux_task_wait(struct task_struct *p)
3747 {
3748         return task_has_perm(p, current, PROCESS__SIGCHLD);
3749 }
3750
3751 static void selinux_task_to_inode(struct task_struct *p,
3752                                   struct inode *inode)
3753 {
3754         struct inode_security_struct *isec = inode->i_security;
3755         u32 sid = task_sid(p);
3756
3757         isec->sid = sid;
3758         isec->initialized = 1;
3759 }
3760
3761 /* Returns error only if unable to parse addresses */
3762 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3763                         struct common_audit_data *ad, u8 *proto)
3764 {
3765         int offset, ihlen, ret = -EINVAL;
3766         struct iphdr _iph, *ih;
3767
3768         offset = skb_network_offset(skb);
3769         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3770         if (ih == NULL)
3771                 goto out;
3772
3773         ihlen = ih->ihl * 4;
3774         if (ihlen < sizeof(_iph))
3775                 goto out;
3776
3777         ad->u.net->v4info.saddr = ih->saddr;
3778         ad->u.net->v4info.daddr = ih->daddr;
3779         ret = 0;
3780
3781         if (proto)
3782                 *proto = ih->protocol;
3783
3784         switch (ih->protocol) {
3785         case IPPROTO_TCP: {
3786                 struct tcphdr _tcph, *th;
3787
3788                 if (ntohs(ih->frag_off) & IP_OFFSET)
3789                         break;
3790
3791                 offset += ihlen;
3792                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3793                 if (th == NULL)
3794                         break;
3795
3796                 ad->u.net->sport = th->source;
3797                 ad->u.net->dport = th->dest;
3798                 break;
3799         }
3800
3801         case IPPROTO_UDP: {
3802                 struct udphdr _udph, *uh;
3803
3804                 if (ntohs(ih->frag_off) & IP_OFFSET)
3805                         break;
3806
3807                 offset += ihlen;
3808                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3809                 if (uh == NULL)
3810                         break;
3811
3812                 ad->u.net->sport = uh->source;
3813                 ad->u.net->dport = uh->dest;
3814                 break;
3815         }
3816
3817         case IPPROTO_DCCP: {
3818                 struct dccp_hdr _dccph, *dh;
3819
3820                 if (ntohs(ih->frag_off) & IP_OFFSET)
3821                         break;
3822
3823                 offset += ihlen;
3824                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3825                 if (dh == NULL)
3826                         break;
3827
3828                 ad->u.net->sport = dh->dccph_sport;
3829                 ad->u.net->dport = dh->dccph_dport;
3830                 break;
3831         }
3832
3833         default:
3834                 break;
3835         }
3836 out:
3837         return ret;
3838 }
3839
3840 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3841
3842 /* Returns error only if unable to parse addresses */
3843 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3844                         struct common_audit_data *ad, u8 *proto)
3845 {
3846         u8 nexthdr;
3847         int ret = -EINVAL, offset;
3848         struct ipv6hdr _ipv6h, *ip6;
3849         __be16 frag_off;
3850
3851         offset = skb_network_offset(skb);
3852         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3853         if (ip6 == NULL)
3854                 goto out;
3855
3856         ad->u.net->v6info.saddr = ip6->saddr;
3857         ad->u.net->v6info.daddr = ip6->daddr;
3858         ret = 0;
3859
3860         nexthdr = ip6->nexthdr;
3861         offset += sizeof(_ipv6h);
3862         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3863         if (offset < 0)
3864                 goto out;
3865
3866         if (proto)
3867                 *proto = nexthdr;
3868
3869         switch (nexthdr) {
3870         case IPPROTO_TCP: {
3871                 struct tcphdr _tcph, *th;
3872
3873                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3874                 if (th == NULL)
3875                         break;
3876
3877                 ad->u.net->sport = th->source;
3878                 ad->u.net->dport = th->dest;
3879                 break;
3880         }
3881
3882         case IPPROTO_UDP: {
3883                 struct udphdr _udph, *uh;
3884
3885                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3886                 if (uh == NULL)
3887                         break;
3888
3889                 ad->u.net->sport = uh->source;
3890                 ad->u.net->dport = uh->dest;
3891                 break;
3892         }
3893
3894         case IPPROTO_DCCP: {
3895                 struct dccp_hdr _dccph, *dh;
3896
3897                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3898                 if (dh == NULL)
3899                         break;
3900
3901                 ad->u.net->sport = dh->dccph_sport;
3902                 ad->u.net->dport = dh->dccph_dport;
3903                 break;
3904         }
3905
3906         /* includes fragments */
3907         default:
3908                 break;
3909         }
3910 out:
3911         return ret;
3912 }
3913
3914 #endif /* IPV6 */
3915
3916 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3917                              char **_addrp, int src, u8 *proto)
3918 {
3919         char *addrp;
3920         int ret;
3921
3922         switch (ad->u.net->family) {
3923         case PF_INET:
3924                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3925                 if (ret)
3926                         goto parse_error;
3927                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3928                                        &ad->u.net->v4info.daddr);
3929                 goto okay;
3930
3931 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3932         case PF_INET6:
3933                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3934                 if (ret)
3935                         goto parse_error;
3936                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3937                                        &ad->u.net->v6info.daddr);
3938                 goto okay;
3939 #endif  /* IPV6 */
3940         default:
3941                 addrp = NULL;
3942                 goto okay;
3943         }
3944
3945 parse_error:
3946         printk(KERN_WARNING
3947                "SELinux: failure in selinux_parse_skb(),"
3948                " unable to parse packet\n");
3949         return ret;
3950
3951 okay:
3952         if (_addrp)
3953                 *_addrp = addrp;
3954         return 0;
3955 }
3956
3957 /**
3958  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3959  * @skb: the packet
3960  * @family: protocol family
3961  * @sid: the packet's peer label SID
3962  *
3963  * Description:
3964  * Check the various different forms of network peer labeling and determine
3965  * the peer label/SID for the packet; most of the magic actually occurs in
3966  * the security server function security_net_peersid_cmp().  The function
3967  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3968  * or -EACCES if @sid is invalid due to inconsistencies with the different
3969  * peer labels.
3970  *
3971  */
3972 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3973 {
3974         int err;
3975         u32 xfrm_sid;
3976         u32 nlbl_sid;
3977         u32 nlbl_type;
3978
3979         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3980         if (unlikely(err))
3981                 return -EACCES;
3982         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3983         if (unlikely(err))
3984                 return -EACCES;
3985
3986         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3987         if (unlikely(err)) {
3988                 printk(KERN_WARNING
3989                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3990                        " unable to determine packet's peer label\n");
3991                 return -EACCES;
3992         }
3993
3994         return 0;
3995 }
3996
3997 /**
3998  * selinux_conn_sid - Determine the child socket label for a connection
3999  * @sk_sid: the parent socket's SID
4000  * @skb_sid: the packet's SID
4001  * @conn_sid: the resulting connection SID
4002  *
4003  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4004  * combined with the MLS information from @skb_sid in order to create
4005  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4006  * of @sk_sid.  Returns zero on success, negative values on failure.
4007  *
4008  */
4009 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4010 {
4011         int err = 0;
4012
4013         if (skb_sid != SECSID_NULL)
4014                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4015         else
4016                 *conn_sid = sk_sid;
4017
4018         return err;
4019 }
4020
4021 /* socket security operations */
4022
4023 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4024                                  u16 secclass, u32 *socksid)
4025 {
4026         if (tsec->sockcreate_sid > SECSID_NULL) {
4027                 *socksid = tsec->sockcreate_sid;
4028                 return 0;
4029         }
4030
4031         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4032                                        socksid);
4033 }
4034
4035 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4036 {
4037         struct sk_security_struct *sksec = sk->sk_security;
4038         struct common_audit_data ad;
4039         struct lsm_network_audit net = {0,};
4040         u32 tsid = task_sid(task);
4041
4042         if (sksec->sid == SECINITSID_KERNEL)
4043                 return 0;
4044
4045         ad.type = LSM_AUDIT_DATA_NET;
4046         ad.u.net = &net;
4047         ad.u.net->sk = sk;
4048
4049         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4050 }
4051
4052 static int selinux_socket_create(int family, int type,
4053                                  int protocol, int kern)
4054 {
4055         const struct task_security_struct *tsec = current_security();
4056         u32 newsid;
4057         u16 secclass;
4058         int rc;
4059
4060         if (kern)
4061                 return 0;
4062
4063         secclass = socket_type_to_security_class(family, type, protocol);
4064         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4065         if (rc)
4066                 return rc;
4067
4068         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4069 }
4070
4071 static int selinux_socket_post_create(struct socket *sock, int family,
4072                                       int type, int protocol, int kern)
4073 {
4074         const struct task_security_struct *tsec = current_security();
4075         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4076         struct sk_security_struct *sksec;
4077         int err = 0;
4078
4079         isec->sclass = socket_type_to_security_class(family, type, protocol);
4080
4081         if (kern)
4082                 isec->sid = SECINITSID_KERNEL;
4083         else {
4084                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4085                 if (err)
4086                         return err;
4087         }
4088
4089         isec->initialized = 1;
4090
4091         if (sock->sk) {
4092                 sksec = sock->sk->sk_security;
4093                 sksec->sid = isec->sid;
4094                 sksec->sclass = isec->sclass;
4095                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4096         }
4097
4098         return err;
4099 }
4100
4101 /* Range of port numbers used to automatically bind.
4102    Need to determine whether we should perform a name_bind
4103    permission check between the socket and the port number. */
4104
4105 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4106 {
4107         struct sock *sk = sock->sk;
4108         u16 family;
4109         int err;
4110
4111         err = sock_has_perm(current, sk, SOCKET__BIND);
4112         if (err)
4113                 goto out;
4114
4115         /*
4116          * If PF_INET or PF_INET6, check name_bind permission for the port.
4117          * Multiple address binding for SCTP is not supported yet: we just
4118          * check the first address now.
4119          */
4120         family = sk->sk_family;
4121         if (family == PF_INET || family == PF_INET6) {
4122                 char *addrp;
4123                 struct sk_security_struct *sksec = sk->sk_security;
4124                 struct common_audit_data ad;
4125                 struct lsm_network_audit net = {0,};
4126                 struct sockaddr_in *addr4 = NULL;
4127                 struct sockaddr_in6 *addr6 = NULL;
4128                 unsigned short snum;
4129                 u32 sid, node_perm;
4130
4131                 if (family == PF_INET) {
4132                         addr4 = (struct sockaddr_in *)address;
4133                         snum = ntohs(addr4->sin_port);
4134                         addrp = (char *)&addr4->sin_addr.s_addr;
4135                 } else {
4136                         addr6 = (struct sockaddr_in6 *)address;
4137                         snum = ntohs(addr6->sin6_port);
4138                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4139                 }
4140
4141                 if (snum) {
4142                         int low, high;
4143
4144                         inet_get_local_port_range(sock_net(sk), &low, &high);
4145
4146                         if (snum < max(PROT_SOCK, low) || snum > high) {
4147                                 err = sel_netport_sid(sk->sk_protocol,
4148                                                       snum, &sid);
4149                                 if (err)
4150                                         goto out;
4151                                 ad.type = LSM_AUDIT_DATA_NET;
4152                                 ad.u.net = &net;
4153                                 ad.u.net->sport = htons(snum);
4154                                 ad.u.net->family = family;
4155                                 err = avc_has_perm(sksec->sid, sid,
4156                                                    sksec->sclass,
4157                                                    SOCKET__NAME_BIND, &ad);
4158                                 if (err)
4159                                         goto out;
4160                         }
4161                 }
4162
4163                 switch (sksec->sclass) {
4164                 case SECCLASS_TCP_SOCKET:
4165                         node_perm = TCP_SOCKET__NODE_BIND;
4166                         break;
4167
4168                 case SECCLASS_UDP_SOCKET:
4169                         node_perm = UDP_SOCKET__NODE_BIND;
4170                         break;
4171
4172                 case SECCLASS_DCCP_SOCKET:
4173                         node_perm = DCCP_SOCKET__NODE_BIND;
4174                         break;
4175
4176                 default:
4177                         node_perm = RAWIP_SOCKET__NODE_BIND;
4178                         break;
4179                 }
4180
4181                 err = sel_netnode_sid(addrp, family, &sid);
4182                 if (err)
4183                         goto out;
4184
4185                 ad.type = LSM_AUDIT_DATA_NET;
4186                 ad.u.net = &net;
4187                 ad.u.net->sport = htons(snum);
4188                 ad.u.net->family = family;
4189
4190                 if (family == PF_INET)
4191                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4192                 else
4193                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4194
4195                 err = avc_has_perm(sksec->sid, sid,
4196                                    sksec->sclass, node_perm, &ad);
4197                 if (err)
4198                         goto out;
4199         }
4200 out:
4201         return err;
4202 }
4203
4204 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4205 {
4206         struct sock *sk = sock->sk;
4207         struct sk_security_struct *sksec = sk->sk_security;
4208         int err;
4209
4210         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4211         if (err)
4212                 return err;
4213
4214         /*
4215          * If a TCP or DCCP socket, check name_connect permission for the port.
4216          */
4217         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4218             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4219                 struct common_audit_data ad;
4220                 struct lsm_network_audit net = {0,};
4221                 struct sockaddr_in *addr4 = NULL;
4222                 struct sockaddr_in6 *addr6 = NULL;
4223                 unsigned short snum;
4224                 u32 sid, perm;
4225
4226                 if (sk->sk_family == PF_INET) {
4227                         addr4 = (struct sockaddr_in *)address;
4228                         if (addrlen < sizeof(struct sockaddr_in))
4229                                 return -EINVAL;
4230                         snum = ntohs(addr4->sin_port);
4231                 } else {
4232                         addr6 = (struct sockaddr_in6 *)address;
4233                         if (addrlen < SIN6_LEN_RFC2133)
4234                                 return -EINVAL;
4235                         snum = ntohs(addr6->sin6_port);
4236                 }
4237
4238                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4239                 if (err)
4240                         goto out;
4241
4242                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4243                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4244
4245                 ad.type = LSM_AUDIT_DATA_NET;
4246                 ad.u.net = &net;
4247                 ad.u.net->dport = htons(snum);
4248                 ad.u.net->family = sk->sk_family;
4249                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4250                 if (err)
4251                         goto out;
4252         }
4253
4254         err = selinux_netlbl_socket_connect(sk, address);
4255
4256 out:
4257         return err;
4258 }
4259
4260 static int selinux_socket_listen(struct socket *sock, int backlog)
4261 {
4262         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4263 }
4264
4265 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4266 {
4267         int err;
4268         struct inode_security_struct *isec;
4269         struct inode_security_struct *newisec;
4270
4271         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4272         if (err)
4273                 return err;
4274
4275         newisec = SOCK_INODE(newsock)->i_security;
4276
4277         isec = SOCK_INODE(sock)->i_security;
4278         newisec->sclass = isec->sclass;
4279         newisec->sid = isec->sid;
4280         newisec->initialized = 1;
4281
4282         return 0;
4283 }
4284
4285 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4286                                   int size)
4287 {
4288         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4289 }
4290
4291 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4292                                   int size, int flags)
4293 {
4294         return sock_has_perm(current, sock->sk, SOCKET__READ);
4295 }
4296
4297 static int selinux_socket_getsockname(struct socket *sock)
4298 {
4299         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4300 }
4301
4302 static int selinux_socket_getpeername(struct socket *sock)
4303 {
4304         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4305 }
4306
4307 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4308 {
4309         int err;
4310
4311         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4312         if (err)
4313                 return err;
4314
4315         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4316 }
4317
4318 static int selinux_socket_getsockopt(struct socket *sock, int level,
4319                                      int optname)
4320 {
4321         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4322 }
4323
4324 static int selinux_socket_shutdown(struct socket *sock, int how)
4325 {
4326         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4327 }
4328
4329 static int selinux_socket_unix_stream_connect(struct sock *sock,
4330                                               struct sock *other,
4331                                               struct sock *newsk)
4332 {
4333         struct sk_security_struct *sksec_sock = sock->sk_security;
4334         struct sk_security_struct *sksec_other = other->sk_security;
4335         struct sk_security_struct *sksec_new = newsk->sk_security;
4336         struct common_audit_data ad;
4337         struct lsm_network_audit net = {0,};
4338         int err;
4339
4340         ad.type = LSM_AUDIT_DATA_NET;
4341         ad.u.net = &net;
4342         ad.u.net->sk = other;
4343
4344         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4345                            sksec_other->sclass,
4346                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4347         if (err)
4348                 return err;
4349
4350         /* server child socket */
4351         sksec_new->peer_sid = sksec_sock->sid;
4352         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4353                                     &sksec_new->sid);
4354         if (err)
4355                 return err;
4356
4357         /* connecting socket */
4358         sksec_sock->peer_sid = sksec_new->sid;
4359
4360         return 0;
4361 }
4362
4363 static int selinux_socket_unix_may_send(struct socket *sock,
4364                                         struct socket *other)
4365 {
4366         struct sk_security_struct *ssec = sock->sk->sk_security;
4367         struct sk_security_struct *osec = other->sk->sk_security;
4368         struct common_audit_data ad;
4369         struct lsm_network_audit net = {0,};
4370
4371         ad.type = LSM_AUDIT_DATA_NET;
4372         ad.u.net = &net;
4373         ad.u.net->sk = other->sk;
4374
4375         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4376                             &ad);
4377 }
4378
4379 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4380                                     char *addrp, u16 family, u32 peer_sid,
4381                                     struct common_audit_data *ad)
4382 {
4383         int err;
4384         u32 if_sid;
4385         u32 node_sid;
4386
4387         err = sel_netif_sid(ns, ifindex, &if_sid);
4388         if (err)
4389                 return err;
4390         err = avc_has_perm(peer_sid, if_sid,
4391                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4392         if (err)
4393                 return err;
4394
4395         err = sel_netnode_sid(addrp, family, &node_sid);
4396         if (err)
4397                 return err;
4398         return avc_has_perm(peer_sid, node_sid,
4399                             SECCLASS_NODE, NODE__RECVFROM, ad);
4400 }
4401
4402 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4403                                        u16 family)
4404 {
4405         int err = 0;
4406         struct sk_security_struct *sksec = sk->sk_security;
4407         u32 sk_sid = sksec->sid;
4408         struct common_audit_data ad;
4409         struct lsm_network_audit net = {0,};
4410         char *addrp;
4411
4412         ad.type = LSM_AUDIT_DATA_NET;
4413         ad.u.net = &net;
4414         ad.u.net->netif = skb->skb_iif;
4415         ad.u.net->family = family;
4416         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4417         if (err)
4418                 return err;
4419
4420         if (selinux_secmark_enabled()) {
4421                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4422                                    PACKET__RECV, &ad);
4423                 if (err)
4424                         return err;
4425         }
4426
4427         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4428         if (err)
4429                 return err;
4430         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4431
4432         return err;
4433 }
4434
4435 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4436 {
4437         int err;
4438         struct sk_security_struct *sksec = sk->sk_security;
4439         u16 family = sk->sk_family;
4440         u32 sk_sid = sksec->sid;
4441         struct common_audit_data ad;
4442         struct lsm_network_audit net = {0,};
4443         char *addrp;
4444         u8 secmark_active;
4445         u8 peerlbl_active;
4446
4447         if (family != PF_INET && family != PF_INET6)
4448                 return 0;
4449
4450         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4451         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4452                 family = PF_INET;
4453
4454         /* If any sort of compatibility mode is enabled then handoff processing
4455          * to the selinux_sock_rcv_skb_compat() function to deal with the
4456          * special handling.  We do this in an attempt to keep this function
4457          * as fast and as clean as possible. */
4458         if (!selinux_policycap_netpeer)
4459                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4460
4461         secmark_active = selinux_secmark_enabled();
4462         peerlbl_active = selinux_peerlbl_enabled();
4463         if (!secmark_active && !peerlbl_active)
4464                 return 0;
4465
4466         ad.type = LSM_AUDIT_DATA_NET;
4467         ad.u.net = &net;
4468         ad.u.net->netif = skb->skb_iif;
4469         ad.u.net->family = family;
4470         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4471         if (err)
4472                 return err;
4473
4474         if (peerlbl_active) {
4475                 u32 peer_sid;
4476
4477                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4478                 if (err)
4479                         return err;
4480                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4481                                                addrp, family, peer_sid, &ad);
4482                 if (err) {
4483                         selinux_netlbl_err(skb, err, 0);
4484                         return err;
4485                 }
4486                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4487                                    PEER__RECV, &ad);
4488                 if (err) {
4489                         selinux_netlbl_err(skb, err, 0);
4490                         return err;
4491                 }
4492         }
4493
4494         if (secmark_active) {
4495                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4496                                    PACKET__RECV, &ad);
4497                 if (err)
4498                         return err;
4499         }
4500
4501         return err;
4502 }
4503
4504 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4505                                             int __user *optlen, unsigned len)
4506 {
4507         int err = 0;
4508         char *scontext;
4509         u32 scontext_len;
4510         struct sk_security_struct *sksec = sock->sk->sk_security;
4511         u32 peer_sid = SECSID_NULL;
4512
4513         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4514             sksec->sclass == SECCLASS_TCP_SOCKET)
4515                 peer_sid = sksec->peer_sid;
4516         if (peer_sid == SECSID_NULL)
4517                 return -ENOPROTOOPT;
4518
4519         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4520         if (err)
4521                 return err;
4522
4523         if (scontext_len > len) {
4524                 err = -ERANGE;
4525                 goto out_len;
4526         }
4527
4528         if (copy_to_user(optval, scontext, scontext_len))
4529                 err = -EFAULT;
4530
4531 out_len:
4532         if (put_user(scontext_len, optlen))
4533                 err = -EFAULT;
4534         kfree(scontext);
4535         return err;
4536 }
4537
4538 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4539 {
4540         u32 peer_secid = SECSID_NULL;
4541         u16 family;
4542
4543         if (skb && skb->protocol == htons(ETH_P_IP))
4544                 family = PF_INET;
4545         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4546                 family = PF_INET6;
4547         else if (sock)
4548                 family = sock->sk->sk_family;
4549         else
4550                 goto out;
4551
4552         if (sock && family == PF_UNIX)
4553                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4554         else if (skb)
4555                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4556
4557 out:
4558         *secid = peer_secid;
4559         if (peer_secid == SECSID_NULL)
4560                 return -EINVAL;
4561         return 0;
4562 }
4563
4564 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4565 {
4566         struct sk_security_struct *sksec;
4567
4568         sksec = kzalloc(sizeof(*sksec), priority);
4569         if (!sksec)
4570                 return -ENOMEM;
4571
4572         sksec->peer_sid = SECINITSID_UNLABELED;
4573         sksec->sid = SECINITSID_UNLABELED;
4574         sksec->sclass = SECCLASS_SOCKET;
4575         selinux_netlbl_sk_security_reset(sksec);
4576         sk->sk_security = sksec;
4577
4578         return 0;
4579 }
4580
4581 static void selinux_sk_free_security(struct sock *sk)
4582 {
4583         struct sk_security_struct *sksec = sk->sk_security;
4584
4585         sk->sk_security = NULL;
4586         selinux_netlbl_sk_security_free(sksec);
4587         kfree(sksec);
4588 }
4589
4590 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4591 {
4592         struct sk_security_struct *sksec = sk->sk_security;
4593         struct sk_security_struct *newsksec = newsk->sk_security;
4594
4595         newsksec->sid = sksec->sid;
4596         newsksec->peer_sid = sksec->peer_sid;
4597         newsksec->sclass = sksec->sclass;
4598
4599         selinux_netlbl_sk_security_reset(newsksec);
4600 }
4601
4602 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4603 {
4604         if (!sk)
4605                 *secid = SECINITSID_ANY_SOCKET;
4606         else {
4607                 struct sk_security_struct *sksec = sk->sk_security;
4608
4609                 *secid = sksec->sid;
4610         }
4611 }
4612
4613 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4614 {
4615         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4616         struct sk_security_struct *sksec = sk->sk_security;
4617
4618         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4619             sk->sk_family == PF_UNIX)
4620                 isec->sid = sksec->sid;
4621         sksec->sclass = isec->sclass;
4622 }
4623
4624 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4625                                      struct request_sock *req)
4626 {
4627         struct sk_security_struct *sksec = sk->sk_security;
4628         int err;
4629         u16 family = req->rsk_ops->family;
4630         u32 connsid;
4631         u32 peersid;
4632
4633         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4634         if (err)
4635                 return err;
4636         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4637         if (err)
4638                 return err;
4639         req->secid = connsid;
4640         req->peer_secid = peersid;
4641
4642         return selinux_netlbl_inet_conn_request(req, family);
4643 }
4644
4645 static void selinux_inet_csk_clone(struct sock *newsk,
4646                                    const struct request_sock *req)
4647 {
4648         struct sk_security_struct *newsksec = newsk->sk_security;
4649
4650         newsksec->sid = req->secid;
4651         newsksec->peer_sid = req->peer_secid;
4652         /* NOTE: Ideally, we should also get the isec->sid for the
4653            new socket in sync, but we don't have the isec available yet.
4654            So we will wait until sock_graft to do it, by which
4655            time it will have been created and available. */
4656
4657         /* We don't need to take any sort of lock here as we are the only
4658          * thread with access to newsksec */
4659         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4660 }
4661
4662 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4663 {
4664         u16 family = sk->sk_family;
4665         struct sk_security_struct *sksec = sk->sk_security;
4666
4667         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4668         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4669                 family = PF_INET;
4670
4671         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4672 }
4673
4674 static int selinux_secmark_relabel_packet(u32 sid)
4675 {
4676         const struct task_security_struct *__tsec;
4677         u32 tsid;
4678
4679         __tsec = current_security();
4680         tsid = __tsec->sid;
4681
4682         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4683 }
4684
4685 static void selinux_secmark_refcount_inc(void)
4686 {
4687         atomic_inc(&selinux_secmark_refcount);
4688 }
4689
4690 static void selinux_secmark_refcount_dec(void)
4691 {
4692         atomic_dec(&selinux_secmark_refcount);
4693 }
4694
4695 static void selinux_req_classify_flow(const struct request_sock *req,
4696                                       struct flowi *fl)
4697 {
4698         fl->flowi_secid = req->secid;
4699 }
4700
4701 static int selinux_tun_dev_alloc_security(void **security)
4702 {
4703         struct tun_security_struct *tunsec;
4704
4705         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4706         if (!tunsec)
4707                 return -ENOMEM;
4708         tunsec->sid = current_sid();
4709
4710         *security = tunsec;
4711         return 0;
4712 }
4713
4714 static void selinux_tun_dev_free_security(void *security)
4715 {
4716         kfree(security);
4717 }
4718
4719 static int selinux_tun_dev_create(void)
4720 {
4721         u32 sid = current_sid();
4722
4723         /* we aren't taking into account the "sockcreate" SID since the socket
4724          * that is being created here is not a socket in the traditional sense,
4725          * instead it is a private sock, accessible only to the kernel, and
4726          * representing a wide range of network traffic spanning multiple
4727          * connections unlike traditional sockets - check the TUN driver to
4728          * get a better understanding of why this socket is special */
4729
4730         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4731                             NULL);
4732 }
4733
4734 static int selinux_tun_dev_attach_queue(void *security)
4735 {
4736         struct tun_security_struct *tunsec = security;
4737
4738         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4739                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4740 }
4741
4742 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4743 {
4744         struct tun_security_struct *tunsec = security;
4745         struct sk_security_struct *sksec = sk->sk_security;
4746
4747         /* we don't currently perform any NetLabel based labeling here and it
4748          * isn't clear that we would want to do so anyway; while we could apply
4749          * labeling without the support of the TUN user the resulting labeled
4750          * traffic from the other end of the connection would almost certainly
4751          * cause confusion to the TUN user that had no idea network labeling
4752          * protocols were being used */
4753
4754         sksec->sid = tunsec->sid;
4755         sksec->sclass = SECCLASS_TUN_SOCKET;
4756
4757         return 0;
4758 }
4759
4760 static int selinux_tun_dev_open(void *security)
4761 {
4762         struct tun_security_struct *tunsec = security;
4763         u32 sid = current_sid();
4764         int err;
4765
4766         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4767                            TUN_SOCKET__RELABELFROM, NULL);
4768         if (err)
4769                 return err;
4770         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4771                            TUN_SOCKET__RELABELTO, NULL);
4772         if (err)
4773                 return err;
4774         tunsec->sid = sid;
4775
4776         return 0;
4777 }
4778
4779 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4780 {
4781         int err = 0;
4782         u32 perm;
4783         struct nlmsghdr *nlh;
4784         struct sk_security_struct *sksec = sk->sk_security;
4785
4786         if (skb->len < NLMSG_HDRLEN) {
4787                 err = -EINVAL;
4788                 goto out;
4789         }
4790         nlh = nlmsg_hdr(skb);
4791
4792         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4793         if (err) {
4794                 if (err == -EINVAL) {
4795                         printk(KERN_WARNING
4796                                "SELinux: unrecognized netlink message:"
4797                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4798                                sk->sk_protocol, nlh->nlmsg_type,
4799                                secclass_map[sksec->sclass - 1].name);
4800                         if (!selinux_enforcing || security_get_allow_unknown())
4801                                 err = 0;
4802                 }
4803
4804                 /* Ignore */
4805                 if (err == -ENOENT)
4806                         err = 0;
4807                 goto out;
4808         }
4809
4810         err = sock_has_perm(current, sk, perm);
4811 out:
4812         return err;
4813 }
4814
4815 #ifdef CONFIG_NETFILTER
4816
4817 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4818                                        const struct net_device *indev,
4819                                        u16 family)
4820 {
4821         int err;
4822         char *addrp;
4823         u32 peer_sid;
4824         struct common_audit_data ad;
4825         struct lsm_network_audit net = {0,};
4826         u8 secmark_active;
4827         u8 netlbl_active;
4828         u8 peerlbl_active;
4829
4830         if (!selinux_policycap_netpeer)
4831                 return NF_ACCEPT;
4832
4833         secmark_active = selinux_secmark_enabled();
4834         netlbl_active = netlbl_enabled();
4835         peerlbl_active = selinux_peerlbl_enabled();
4836         if (!secmark_active && !peerlbl_active)
4837                 return NF_ACCEPT;
4838
4839         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4840                 return NF_DROP;
4841
4842         ad.type = LSM_AUDIT_DATA_NET;
4843         ad.u.net = &net;
4844         ad.u.net->netif = indev->ifindex;
4845         ad.u.net->family = family;
4846         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4847                 return NF_DROP;
4848
4849         if (peerlbl_active) {
4850                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4851                                                addrp, family, peer_sid, &ad);
4852                 if (err) {
4853                         selinux_netlbl_err(skb, err, 1);
4854                         return NF_DROP;
4855                 }
4856         }
4857
4858         if (secmark_active)
4859                 if (avc_has_perm(peer_sid, skb->secmark,
4860                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4861                         return NF_DROP;
4862
4863         if (netlbl_active)
4864                 /* we do this in the FORWARD path and not the POST_ROUTING
4865                  * path because we want to make sure we apply the necessary
4866                  * labeling before IPsec is applied so we can leverage AH
4867                  * protection */
4868                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4869                         return NF_DROP;
4870
4871         return NF_ACCEPT;
4872 }
4873
4874 static unsigned int selinux_ipv4_forward(void *priv,
4875                                          struct sk_buff *skb,
4876                                          const struct nf_hook_state *state)
4877 {
4878         return selinux_ip_forward(skb, state->in, PF_INET);
4879 }
4880
4881 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4882 static unsigned int selinux_ipv6_forward(void *priv,
4883                                          struct sk_buff *skb,
4884                                          const struct nf_hook_state *state)
4885 {
4886         return selinux_ip_forward(skb, state->in, PF_INET6);
4887 }
4888 #endif  /* IPV6 */
4889
4890 static unsigned int selinux_ip_output(struct sk_buff *skb,
4891                                       u16 family)
4892 {
4893         struct sock *sk;
4894         u32 sid;
4895
4896         if (!netlbl_enabled())
4897                 return NF_ACCEPT;
4898
4899         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4900          * because we want to make sure we apply the necessary labeling
4901          * before IPsec is applied so we can leverage AH protection */
4902         sk = skb->sk;
4903         if (sk) {
4904                 struct sk_security_struct *sksec;
4905
4906                 if (sk_listener(sk))
4907                         /* if the socket is the listening state then this
4908                          * packet is a SYN-ACK packet which means it needs to
4909                          * be labeled based on the connection/request_sock and
4910                          * not the parent socket.  unfortunately, we can't
4911                          * lookup the request_sock yet as it isn't queued on
4912                          * the parent socket until after the SYN-ACK is sent.
4913                          * the "solution" is to simply pass the packet as-is
4914                          * as any IP option based labeling should be copied
4915                          * from the initial connection request (in the IP
4916                          * layer).  it is far from ideal, but until we get a
4917                          * security label in the packet itself this is the
4918                          * best we can do. */
4919                         return NF_ACCEPT;
4920
4921                 /* standard practice, label using the parent socket */
4922                 sksec = sk->sk_security;
4923                 sid = sksec->sid;
4924         } else
4925                 sid = SECINITSID_KERNEL;
4926         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4927                 return NF_DROP;
4928
4929         return NF_ACCEPT;
4930 }
4931
4932 static unsigned int selinux_ipv4_output(void *priv,
4933                                         struct sk_buff *skb,
4934                                         const struct nf_hook_state *state)
4935 {
4936         return selinux_ip_output(skb, PF_INET);
4937 }
4938
4939 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4940                                                 int ifindex,
4941                                                 u16 family)
4942 {
4943         struct sock *sk = skb_to_full_sk(skb);
4944         struct sk_security_struct *sksec;
4945         struct common_audit_data ad;
4946         struct lsm_network_audit net = {0,};
4947         char *addrp;
4948         u8 proto;
4949
4950         if (sk == NULL)
4951                 return NF_ACCEPT;
4952         sksec = sk->sk_security;
4953
4954         ad.type = LSM_AUDIT_DATA_NET;
4955         ad.u.net = &net;
4956         ad.u.net->netif = ifindex;
4957         ad.u.net->family = family;
4958         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4959                 return NF_DROP;
4960
4961         if (selinux_secmark_enabled())
4962                 if (avc_has_perm(sksec->sid, skb->secmark,
4963                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4964                         return NF_DROP_ERR(-ECONNREFUSED);
4965
4966         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4967                 return NF_DROP_ERR(-ECONNREFUSED);
4968
4969         return NF_ACCEPT;
4970 }
4971
4972 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4973                                          const struct net_device *outdev,
4974                                          u16 family)
4975 {
4976         u32 secmark_perm;
4977         u32 peer_sid;
4978         int ifindex = outdev->ifindex;
4979         struct sock *sk;
4980         struct common_audit_data ad;
4981         struct lsm_network_audit net = {0,};
4982         char *addrp;
4983         u8 secmark_active;
4984         u8 peerlbl_active;
4985
4986         /* If any sort of compatibility mode is enabled then handoff processing
4987          * to the selinux_ip_postroute_compat() function to deal with the
4988          * special handling.  We do this in an attempt to keep this function
4989          * as fast and as clean as possible. */
4990         if (!selinux_policycap_netpeer)
4991                 return selinux_ip_postroute_compat(skb, ifindex, family);
4992
4993         secmark_active = selinux_secmark_enabled();
4994         peerlbl_active = selinux_peerlbl_enabled();
4995         if (!secmark_active && !peerlbl_active)
4996                 return NF_ACCEPT;
4997
4998         sk = skb_to_full_sk(skb);
4999
5000 #ifdef CONFIG_XFRM
5001         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5002          * packet transformation so allow the packet to pass without any checks
5003          * since we'll have another chance to perform access control checks
5004          * when the packet is on it's final way out.
5005          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5006          *       is NULL, in this case go ahead and apply access control.
5007          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5008          *       TCP listening state we cannot wait until the XFRM processing
5009          *       is done as we will miss out on the SA label if we do;
5010          *       unfortunately, this means more work, but it is only once per
5011          *       connection. */
5012         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5013             !(sk && sk_listener(sk)))
5014                 return NF_ACCEPT;
5015 #endif
5016
5017         if (sk == NULL) {
5018                 /* Without an associated socket the packet is either coming
5019                  * from the kernel or it is being forwarded; check the packet
5020                  * to determine which and if the packet is being forwarded
5021                  * query the packet directly to determine the security label. */
5022                 if (skb->skb_iif) {
5023                         secmark_perm = PACKET__FORWARD_OUT;
5024                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5025                                 return NF_DROP;
5026                 } else {
5027                         secmark_perm = PACKET__SEND;
5028                         peer_sid = SECINITSID_KERNEL;
5029                 }
5030         } else if (sk_listener(sk)) {
5031                 /* Locally generated packet but the associated socket is in the
5032                  * listening state which means this is a SYN-ACK packet.  In
5033                  * this particular case the correct security label is assigned
5034                  * to the connection/request_sock but unfortunately we can't
5035                  * query the request_sock as it isn't queued on the parent
5036                  * socket until after the SYN-ACK packet is sent; the only
5037                  * viable choice is to regenerate the label like we do in
5038                  * selinux_inet_conn_request().  See also selinux_ip_output()
5039                  * for similar problems. */
5040                 u32 skb_sid;
5041                 struct sk_security_struct *sksec;
5042
5043                 sksec = sk->sk_security;
5044                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5045                         return NF_DROP;
5046                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5047                  * and the packet has been through at least one XFRM
5048                  * transformation then we must be dealing with the "final"
5049                  * form of labeled IPsec packet; since we've already applied
5050                  * all of our access controls on this packet we can safely
5051                  * pass the packet. */
5052                 if (skb_sid == SECSID_NULL) {
5053                         switch (family) {
5054                         case PF_INET:
5055                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5056                                         return NF_ACCEPT;
5057                                 break;
5058                         case PF_INET6:
5059                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5060                                         return NF_ACCEPT;
5061                                 break;
5062                         default:
5063                                 return NF_DROP_ERR(-ECONNREFUSED);
5064                         }
5065                 }
5066                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5067                         return NF_DROP;
5068                 secmark_perm = PACKET__SEND;
5069         } else {
5070                 /* Locally generated packet, fetch the security label from the
5071                  * associated socket. */
5072                 struct sk_security_struct *sksec = sk->sk_security;
5073                 peer_sid = sksec->sid;
5074                 secmark_perm = PACKET__SEND;
5075         }
5076
5077         ad.type = LSM_AUDIT_DATA_NET;
5078         ad.u.net = &net;
5079         ad.u.net->netif = ifindex;
5080         ad.u.net->family = family;
5081         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5082                 return NF_DROP;
5083
5084         if (secmark_active)
5085                 if (avc_has_perm(peer_sid, skb->secmark,
5086                                  SECCLASS_PACKET, secmark_perm, &ad))
5087                         return NF_DROP_ERR(-ECONNREFUSED);
5088
5089         if (peerlbl_active) {
5090                 u32 if_sid;
5091                 u32 node_sid;
5092
5093                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5094                         return NF_DROP;
5095                 if (avc_has_perm(peer_sid, if_sid,
5096                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5097                         return NF_DROP_ERR(-ECONNREFUSED);
5098
5099                 if (sel_netnode_sid(addrp, family, &node_sid))
5100                         return NF_DROP;
5101                 if (avc_has_perm(peer_sid, node_sid,
5102                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5103                         return NF_DROP_ERR(-ECONNREFUSED);
5104         }
5105
5106         return NF_ACCEPT;
5107 }
5108
5109 static unsigned int selinux_ipv4_postroute(void *priv,
5110                                            struct sk_buff *skb,
5111                                            const struct nf_hook_state *state)
5112 {
5113         return selinux_ip_postroute(skb, state->out, PF_INET);
5114 }
5115
5116 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5117 static unsigned int selinux_ipv6_postroute(void *priv,
5118                                            struct sk_buff *skb,
5119                                            const struct nf_hook_state *state)
5120 {
5121         return selinux_ip_postroute(skb, state->out, PF_INET6);
5122 }
5123 #endif  /* IPV6 */
5124
5125 #endif  /* CONFIG_NETFILTER */
5126
5127 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5128 {
5129         return selinux_nlmsg_perm(sk, skb);
5130 }
5131
5132 static int ipc_alloc_security(struct task_struct *task,
5133                               struct kern_ipc_perm *perm,
5134                               u16 sclass)
5135 {
5136         struct ipc_security_struct *isec;
5137         u32 sid;
5138
5139         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5140         if (!isec)
5141                 return -ENOMEM;
5142
5143         sid = task_sid(task);
5144         isec->sclass = sclass;
5145         isec->sid = sid;
5146         perm->security = isec;
5147
5148         return 0;
5149 }
5150
5151 static void ipc_free_security(struct kern_ipc_perm *perm)
5152 {
5153         struct ipc_security_struct *isec = perm->security;
5154         perm->security = NULL;
5155         kfree(isec);
5156 }
5157
5158 static int msg_msg_alloc_security(struct msg_msg *msg)
5159 {
5160         struct msg_security_struct *msec;
5161
5162         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5163         if (!msec)
5164                 return -ENOMEM;
5165
5166         msec->sid = SECINITSID_UNLABELED;
5167         msg->security = msec;
5168
5169         return 0;
5170 }
5171
5172 static void msg_msg_free_security(struct msg_msg *msg)
5173 {
5174         struct msg_security_struct *msec = msg->security;
5175
5176         msg->security = NULL;
5177         kfree(msec);
5178 }
5179
5180 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5181                         u32 perms)
5182 {
5183         struct ipc_security_struct *isec;
5184         struct common_audit_data ad;
5185         u32 sid = current_sid();
5186
5187         isec = ipc_perms->security;
5188
5189         ad.type = LSM_AUDIT_DATA_IPC;
5190         ad.u.ipc_id = ipc_perms->key;
5191
5192         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5193 }
5194
5195 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5196 {
5197         return msg_msg_alloc_security(msg);
5198 }
5199
5200 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5201 {
5202         msg_msg_free_security(msg);
5203 }
5204
5205 /* message queue security operations */
5206 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5207 {
5208         struct ipc_security_struct *isec;
5209         struct common_audit_data ad;
5210         u32 sid = current_sid();
5211         int rc;
5212
5213         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5214         if (rc)
5215                 return rc;
5216
5217         isec = msq->q_perm.security;
5218
5219         ad.type = LSM_AUDIT_DATA_IPC;
5220         ad.u.ipc_id = msq->q_perm.key;
5221
5222         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5223                           MSGQ__CREATE, &ad);
5224         if (rc) {
5225                 ipc_free_security(&msq->q_perm);
5226                 return rc;
5227         }
5228         return 0;
5229 }
5230
5231 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5232 {
5233         ipc_free_security(&msq->q_perm);
5234 }
5235
5236 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5237 {
5238         struct ipc_security_struct *isec;
5239         struct common_audit_data ad;
5240         u32 sid = current_sid();
5241
5242         isec = msq->q_perm.security;
5243
5244         ad.type = LSM_AUDIT_DATA_IPC;
5245         ad.u.ipc_id = msq->q_perm.key;
5246
5247         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5248                             MSGQ__ASSOCIATE, &ad);
5249 }
5250
5251 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5252 {
5253         int err;
5254         int perms;
5255
5256         switch (cmd) {
5257         case IPC_INFO:
5258         case MSG_INFO:
5259                 /* No specific object, just general system-wide information. */
5260                 return task_has_system(current, SYSTEM__IPC_INFO);
5261         case IPC_STAT:
5262         case MSG_STAT:
5263                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5264                 break;
5265         case IPC_SET:
5266                 perms = MSGQ__SETATTR;
5267                 break;
5268         case IPC_RMID:
5269                 perms = MSGQ__DESTROY;
5270                 break;
5271         default:
5272                 return 0;
5273         }
5274
5275         err = ipc_has_perm(&msq->q_perm, perms);
5276         return err;
5277 }
5278
5279 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5280 {
5281         struct ipc_security_struct *isec;
5282         struct msg_security_struct *msec;
5283         struct common_audit_data ad;
5284         u32 sid = current_sid();
5285         int rc;
5286
5287         isec = msq->q_perm.security;
5288         msec = msg->security;
5289
5290         /*
5291          * First time through, need to assign label to the message
5292          */
5293         if (msec->sid == SECINITSID_UNLABELED) {
5294                 /*
5295                  * Compute new sid based on current process and
5296                  * message queue this message will be stored in
5297                  */
5298                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5299                                              NULL, &msec->sid);
5300                 if (rc)
5301                         return rc;
5302         }
5303
5304         ad.type = LSM_AUDIT_DATA_IPC;
5305         ad.u.ipc_id = msq->q_perm.key;
5306
5307         /* Can this process write to the queue? */
5308         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5309                           MSGQ__WRITE, &ad);
5310         if (!rc)
5311                 /* Can this process send the message */
5312                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5313                                   MSG__SEND, &ad);
5314         if (!rc)
5315                 /* Can the message be put in the queue? */
5316                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5317                                   MSGQ__ENQUEUE, &ad);
5318
5319         return rc;
5320 }
5321
5322 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5323                                     struct task_struct *target,
5324                                     long type, int mode)
5325 {
5326         struct ipc_security_struct *isec;
5327         struct msg_security_struct *msec;
5328         struct common_audit_data ad;
5329         u32 sid = task_sid(target);
5330         int rc;
5331
5332         isec = msq->q_perm.security;
5333         msec = msg->security;
5334
5335         ad.type = LSM_AUDIT_DATA_IPC;
5336         ad.u.ipc_id = msq->q_perm.key;
5337
5338         rc = avc_has_perm(sid, isec->sid,
5339                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5340         if (!rc)
5341                 rc = avc_has_perm(sid, msec->sid,
5342                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5343         return rc;
5344 }
5345
5346 /* Shared Memory security operations */
5347 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5348 {
5349         struct ipc_security_struct *isec;
5350         struct common_audit_data ad;
5351         u32 sid = current_sid();
5352         int rc;
5353
5354         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5355         if (rc)
5356                 return rc;
5357
5358         isec = shp->shm_perm.security;
5359
5360         ad.type = LSM_AUDIT_DATA_IPC;
5361         ad.u.ipc_id = shp->shm_perm.key;
5362
5363         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5364                           SHM__CREATE, &ad);
5365         if (rc) {
5366                 ipc_free_security(&shp->shm_perm);
5367                 return rc;
5368         }
5369         return 0;
5370 }
5371
5372 static void selinux_shm_free_security(struct shmid_kernel *shp)
5373 {
5374         ipc_free_security(&shp->shm_perm);
5375 }
5376
5377 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5378 {
5379         struct ipc_security_struct *isec;
5380         struct common_audit_data ad;
5381         u32 sid = current_sid();
5382
5383         isec = shp->shm_perm.security;
5384
5385         ad.type = LSM_AUDIT_DATA_IPC;
5386         ad.u.ipc_id = shp->shm_perm.key;
5387
5388         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5389                             SHM__ASSOCIATE, &ad);
5390 }
5391
5392 /* Note, at this point, shp is locked down */
5393 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5394 {
5395         int perms;
5396         int err;
5397
5398         switch (cmd) {
5399         case IPC_INFO:
5400         case SHM_INFO:
5401                 /* No specific object, just general system-wide information. */
5402                 return task_has_system(current, SYSTEM__IPC_INFO);
5403         case IPC_STAT:
5404         case SHM_STAT:
5405                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5406                 break;
5407         case IPC_SET:
5408                 perms = SHM__SETATTR;
5409                 break;
5410         case SHM_LOCK:
5411         case SHM_UNLOCK:
5412                 perms = SHM__LOCK;
5413                 break;
5414         case IPC_RMID:
5415                 perms = SHM__DESTROY;
5416                 break;
5417         default:
5418                 return 0;
5419         }
5420
5421         err = ipc_has_perm(&shp->shm_perm, perms);
5422         return err;
5423 }
5424
5425 static int selinux_shm_shmat(struct shmid_kernel *shp,
5426                              char __user *shmaddr, int shmflg)
5427 {
5428         u32 perms;
5429
5430         if (shmflg & SHM_RDONLY)
5431                 perms = SHM__READ;
5432         else
5433                 perms = SHM__READ | SHM__WRITE;
5434
5435         return ipc_has_perm(&shp->shm_perm, perms);
5436 }
5437
5438 /* Semaphore security operations */
5439 static int selinux_sem_alloc_security(struct sem_array *sma)
5440 {
5441         struct ipc_security_struct *isec;
5442         struct common_audit_data ad;
5443         u32 sid = current_sid();
5444         int rc;
5445
5446         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5447         if (rc)
5448                 return rc;
5449
5450         isec = sma->sem_perm.security;
5451
5452         ad.type = LSM_AUDIT_DATA_IPC;
5453         ad.u.ipc_id = sma->sem_perm.key;
5454
5455         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5456                           SEM__CREATE, &ad);
5457         if (rc) {
5458                 ipc_free_security(&sma->sem_perm);
5459                 return rc;
5460         }
5461         return 0;
5462 }
5463
5464 static void selinux_sem_free_security(struct sem_array *sma)
5465 {
5466         ipc_free_security(&sma->sem_perm);
5467 }
5468
5469 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5470 {
5471         struct ipc_security_struct *isec;
5472         struct common_audit_data ad;
5473         u32 sid = current_sid();
5474
5475         isec = sma->sem_perm.security;
5476
5477         ad.type = LSM_AUDIT_DATA_IPC;
5478         ad.u.ipc_id = sma->sem_perm.key;
5479
5480         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5481                             SEM__ASSOCIATE, &ad);
5482 }
5483
5484 /* Note, at this point, sma is locked down */
5485 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5486 {
5487         int err;
5488         u32 perms;
5489
5490         switch (cmd) {
5491         case IPC_INFO:
5492         case SEM_INFO:
5493                 /* No specific object, just general system-wide information. */
5494                 return task_has_system(current, SYSTEM__IPC_INFO);
5495         case GETPID:
5496         case GETNCNT:
5497         case GETZCNT:
5498                 perms = SEM__GETATTR;
5499                 break;
5500         case GETVAL:
5501         case GETALL:
5502                 perms = SEM__READ;
5503                 break;
5504         case SETVAL:
5505         case SETALL:
5506                 perms = SEM__WRITE;
5507                 break;
5508         case IPC_RMID:
5509                 perms = SEM__DESTROY;
5510                 break;
5511         case IPC_SET:
5512                 perms = SEM__SETATTR;
5513                 break;
5514         case IPC_STAT:
5515         case SEM_STAT:
5516                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5517                 break;
5518         default:
5519                 return 0;
5520         }
5521
5522         err = ipc_has_perm(&sma->sem_perm, perms);
5523         return err;
5524 }
5525
5526 static int selinux_sem_semop(struct sem_array *sma,
5527                              struct sembuf *sops, unsigned nsops, int alter)
5528 {
5529         u32 perms;
5530
5531         if (alter)
5532                 perms = SEM__READ | SEM__WRITE;
5533         else
5534                 perms = SEM__READ;
5535
5536         return ipc_has_perm(&sma->sem_perm, perms);
5537 }
5538
5539 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5540 {
5541         u32 av = 0;
5542
5543         av = 0;
5544         if (flag & S_IRUGO)
5545                 av |= IPC__UNIX_READ;
5546         if (flag & S_IWUGO)
5547                 av |= IPC__UNIX_WRITE;
5548
5549         if (av == 0)
5550                 return 0;
5551
5552         return ipc_has_perm(ipcp, av);
5553 }
5554
5555 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5556 {
5557         struct ipc_security_struct *isec = ipcp->security;
5558         *secid = isec->sid;
5559 }
5560
5561 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5562 {
5563         if (inode)
5564                 inode_doinit_with_dentry(inode, dentry);
5565 }
5566
5567 static int selinux_getprocattr(struct task_struct *p,
5568                                char *name, char **value)
5569 {
5570         const struct task_security_struct *__tsec;
5571         u32 sid;
5572         int error;
5573         unsigned len;
5574
5575         if (current != p) {
5576                 error = current_has_perm(p, PROCESS__GETATTR);
5577                 if (error)
5578                         return error;
5579         }
5580
5581         rcu_read_lock();
5582         __tsec = __task_cred(p)->security;
5583
5584         if (!strcmp(name, "current"))
5585                 sid = __tsec->sid;
5586         else if (!strcmp(name, "prev"))
5587                 sid = __tsec->osid;
5588         else if (!strcmp(name, "exec"))
5589                 sid = __tsec->exec_sid;
5590         else if (!strcmp(name, "fscreate"))
5591                 sid = __tsec->create_sid;
5592         else if (!strcmp(name, "keycreate"))
5593                 sid = __tsec->keycreate_sid;
5594         else if (!strcmp(name, "sockcreate"))
5595                 sid = __tsec->sockcreate_sid;
5596         else
5597                 goto invalid;
5598         rcu_read_unlock();
5599
5600         if (!sid)
5601                 return 0;
5602
5603         error = security_sid_to_context(sid, value, &len);
5604         if (error)
5605                 return error;
5606         return len;
5607
5608 invalid:
5609         rcu_read_unlock();
5610         return -EINVAL;
5611 }
5612
5613 static int selinux_setprocattr(struct task_struct *p,
5614                                char *name, void *value, size_t size)
5615 {
5616         struct task_security_struct *tsec;
5617         struct task_struct *tracer;
5618         struct cred *new;
5619         u32 sid = 0, ptsid;
5620         int error;
5621         char *str = value;
5622
5623         if (current != p) {
5624                 /* SELinux only allows a process to change its own
5625                    security attributes. */
5626                 return -EACCES;
5627         }
5628
5629         /*
5630          * Basic control over ability to set these attributes at all.
5631          * current == p, but we'll pass them separately in case the
5632          * above restriction is ever removed.
5633          */
5634         if (!strcmp(name, "exec"))
5635                 error = current_has_perm(p, PROCESS__SETEXEC);
5636         else if (!strcmp(name, "fscreate"))
5637                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5638         else if (!strcmp(name, "keycreate"))
5639                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5640         else if (!strcmp(name, "sockcreate"))
5641                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5642         else if (!strcmp(name, "current"))
5643                 error = current_has_perm(p, PROCESS__SETCURRENT);
5644         else
5645                 error = -EINVAL;
5646         if (error)
5647                 return error;
5648
5649         /* Obtain a SID for the context, if one was specified. */
5650         if (size && str[1] && str[1] != '\n') {
5651                 if (str[size-1] == '\n') {
5652                         str[size-1] = 0;
5653                         size--;
5654                 }
5655                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5656                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5657                         if (!capable(CAP_MAC_ADMIN)) {
5658                                 struct audit_buffer *ab;
5659                                 size_t audit_size;
5660
5661                                 /* We strip a nul only if it is at the end, otherwise the
5662                                  * context contains a nul and we should audit that */
5663                                 if (str[size - 1] == '\0')
5664                                         audit_size = size - 1;
5665                                 else
5666                                         audit_size = size;
5667                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5668                                 audit_log_format(ab, "op=fscreate invalid_context=");
5669                                 audit_log_n_untrustedstring(ab, value, audit_size);
5670                                 audit_log_end(ab);
5671
5672                                 return error;
5673                         }
5674                         error = security_context_to_sid_force(value, size,
5675                                                               &sid);
5676                 }
5677                 if (error)
5678                         return error;
5679         }
5680
5681         new = prepare_creds();
5682         if (!new)
5683                 return -ENOMEM;
5684
5685         /* Permission checking based on the specified context is
5686            performed during the actual operation (execve,
5687            open/mkdir/...), when we know the full context of the
5688            operation.  See selinux_bprm_set_creds for the execve
5689            checks and may_create for the file creation checks. The
5690            operation will then fail if the context is not permitted. */
5691         tsec = new->security;
5692         if (!strcmp(name, "exec")) {
5693                 tsec->exec_sid = sid;
5694         } else if (!strcmp(name, "fscreate")) {
5695                 tsec->create_sid = sid;
5696         } else if (!strcmp(name, "keycreate")) {
5697                 error = may_create_key(sid, p);
5698                 if (error)
5699                         goto abort_change;
5700                 tsec->keycreate_sid = sid;
5701         } else if (!strcmp(name, "sockcreate")) {
5702                 tsec->sockcreate_sid = sid;
5703         } else if (!strcmp(name, "current")) {
5704                 error = -EINVAL;
5705                 if (sid == 0)
5706                         goto abort_change;
5707
5708                 /* Only allow single threaded processes to change context */
5709                 error = -EPERM;
5710                 if (!current_is_single_threaded()) {
5711                         error = security_bounded_transition(tsec->sid, sid);
5712                         if (error)
5713                                 goto abort_change;
5714                 }
5715
5716                 /* Check permissions for the transition. */
5717                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5718                                      PROCESS__DYNTRANSITION, NULL);
5719                 if (error)
5720                         goto abort_change;
5721
5722                 /* Check for ptracing, and update the task SID if ok.
5723                    Otherwise, leave SID unchanged and fail. */
5724                 ptsid = 0;
5725                 rcu_read_lock();
5726                 tracer = ptrace_parent(p);
5727                 if (tracer)
5728                         ptsid = task_sid(tracer);
5729                 rcu_read_unlock();
5730
5731                 if (tracer) {
5732                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5733                                              PROCESS__PTRACE, NULL);
5734                         if (error)
5735                                 goto abort_change;
5736                 }
5737
5738                 tsec->sid = sid;
5739         } else {
5740                 error = -EINVAL;
5741                 goto abort_change;
5742         }
5743
5744         commit_creds(new);
5745         return size;
5746
5747 abort_change:
5748         abort_creds(new);
5749         return error;
5750 }
5751
5752 static int selinux_ismaclabel(const char *name)
5753 {
5754         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5755 }
5756
5757 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5758 {
5759         return security_sid_to_context(secid, secdata, seclen);
5760 }
5761
5762 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5763 {
5764         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5765 }
5766
5767 static void selinux_release_secctx(char *secdata, u32 seclen)
5768 {
5769         kfree(secdata);
5770 }
5771
5772 /*
5773  *      called with inode->i_mutex locked
5774  */
5775 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5776 {
5777         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5778 }
5779
5780 /*
5781  *      called with inode->i_mutex locked
5782  */
5783 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5784 {
5785         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5786 }
5787
5788 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5789 {
5790         int len = 0;
5791         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5792                                                 ctx, true);
5793         if (len < 0)
5794                 return len;
5795         *ctxlen = len;
5796         return 0;
5797 }
5798 #ifdef CONFIG_KEYS
5799
5800 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5801                              unsigned long flags)
5802 {
5803         const struct task_security_struct *tsec;
5804         struct key_security_struct *ksec;
5805
5806         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5807         if (!ksec)
5808                 return -ENOMEM;
5809
5810         tsec = cred->security;
5811         if (tsec->keycreate_sid)
5812                 ksec->sid = tsec->keycreate_sid;
5813         else
5814                 ksec->sid = tsec->sid;
5815
5816         k->security = ksec;
5817         return 0;
5818 }
5819
5820 static void selinux_key_free(struct key *k)
5821 {
5822         struct key_security_struct *ksec = k->security;
5823
5824         k->security = NULL;
5825         kfree(ksec);
5826 }
5827
5828 static int selinux_key_permission(key_ref_t key_ref,
5829                                   const struct cred *cred,
5830                                   unsigned perm)
5831 {
5832         struct key *key;
5833         struct key_security_struct *ksec;
5834         u32 sid;
5835
5836         /* if no specific permissions are requested, we skip the
5837            permission check. No serious, additional covert channels
5838            appear to be created. */
5839         if (perm == 0)
5840                 return 0;
5841
5842         sid = cred_sid(cred);
5843
5844         key = key_ref_to_ptr(key_ref);
5845         ksec = key->security;
5846
5847         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5848 }
5849
5850 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5851 {
5852         struct key_security_struct *ksec = key->security;
5853         char *context = NULL;
5854         unsigned len;
5855         int rc;
5856
5857         rc = security_sid_to_context(ksec->sid, &context, &len);
5858         if (!rc)
5859                 rc = len;
5860         *_buffer = context;
5861         return rc;
5862 }
5863
5864 #endif
5865
5866 static struct security_hook_list selinux_hooks[] = {
5867         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5868         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5869         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5870         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5871
5872         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5873         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5874         LSM_HOOK_INIT(capget, selinux_capget),
5875         LSM_HOOK_INIT(capset, selinux_capset),
5876         LSM_HOOK_INIT(capable, selinux_capable),
5877         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5878         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5879         LSM_HOOK_INIT(syslog, selinux_syslog),
5880         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5881
5882         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5883
5884         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5885         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5886         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5887         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5888
5889         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5890         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5891         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5892         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5893         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5894         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5895         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5896         LSM_HOOK_INIT(sb_mount, selinux_mount),
5897         LSM_HOOK_INIT(sb_umount, selinux_umount),
5898         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5899         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5900         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5901
5902         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5903
5904         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5905         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5906         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5907         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5908         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5909         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5910         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5911         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5912         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5913         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5914         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5915         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5916         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5917         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5918         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5919         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5920         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5921         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5922         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5923         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5924         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5925         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5926         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5927         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5928         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5929
5930         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5931         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5932         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5933         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5934         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5935         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5936         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5937         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5938         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5939         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5940         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5941         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5942
5943         LSM_HOOK_INIT(file_open, selinux_file_open),
5944
5945         LSM_HOOK_INIT(task_create, selinux_task_create),
5946         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5947         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5948         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5949         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5950         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5951         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5952         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5953         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5954         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5955         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5956         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5957         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5958         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5959         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5960         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5961         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5962         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5963         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5964         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5965         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5966         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5967
5968         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5969         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5970
5971         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5972         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5973
5974         LSM_HOOK_INIT(msg_queue_alloc_security,
5975                         selinux_msg_queue_alloc_security),
5976         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5977         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5978         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5979         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5980         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5981
5982         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5983         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5984         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5985         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5986         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5987
5988         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5989         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5990         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5991         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5992         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5993
5994         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5995
5996         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5997         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5998
5999         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6000         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6001         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6002         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6003         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6004         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6005         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6006
6007         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6008         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6009
6010         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6011         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6012         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6013         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6014         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6015         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6016         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6017         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6018         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6019         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6020         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6021         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6022         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6023         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6024         LSM_HOOK_INIT(socket_getpeersec_stream,
6025                         selinux_socket_getpeersec_stream),
6026         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6027         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6028         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6029         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6030         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6031         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6032         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6033         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6034         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6035         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6036         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6037         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6038         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6039         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6040         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6041         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6042         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6043         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6044         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6045
6046 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6047         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6048         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6049         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6050         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6051         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6052         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6053                         selinux_xfrm_state_alloc_acquire),
6054         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6055         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6056         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6057         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6058                         selinux_xfrm_state_pol_flow_match),
6059         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6060 #endif
6061
6062 #ifdef CONFIG_KEYS
6063         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6064         LSM_HOOK_INIT(key_free, selinux_key_free),
6065         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6066         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6067 #endif
6068
6069 #ifdef CONFIG_AUDIT
6070         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6071         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6072         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6073         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6074 #endif
6075 };
6076
6077 static __init int selinux_init(void)
6078 {
6079         if (!security_module_enable("selinux")) {
6080                 selinux_enabled = 0;
6081                 return 0;
6082         }
6083
6084         if (!selinux_enabled) {
6085                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6086                 return 0;
6087         }
6088
6089         printk(KERN_INFO "SELinux:  Initializing.\n");
6090
6091         /* Set the security state for the initial task. */
6092         cred_init_security();
6093
6094         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6095
6096         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6097                                             sizeof(struct inode_security_struct),
6098                                             0, SLAB_PANIC, NULL);
6099         file_security_cache = kmem_cache_create("selinux_file_security",
6100                                             sizeof(struct file_security_struct),
6101                                             0, SLAB_PANIC, NULL);
6102         avc_init();
6103
6104         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6105
6106         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6107                 panic("SELinux: Unable to register AVC netcache callback\n");
6108
6109         if (selinux_enforcing)
6110                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6111         else
6112                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6113
6114         return 0;
6115 }
6116
6117 static void delayed_superblock_init(struct super_block *sb, void *unused)
6118 {
6119         superblock_doinit(sb, NULL);
6120 }
6121
6122 void selinux_complete_init(void)
6123 {
6124         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6125
6126         /* Set up any superblocks initialized prior to the policy load. */
6127         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6128         iterate_supers(delayed_superblock_init, NULL);
6129 }
6130
6131 /* SELinux requires early initialization in order to label
6132    all processes and objects when they are created. */
6133 security_initcall(selinux_init);
6134
6135 #if defined(CONFIG_NETFILTER)
6136
6137 static struct nf_hook_ops selinux_nf_ops[] = {
6138         {
6139                 .hook =         selinux_ipv4_postroute,
6140                 .pf =           NFPROTO_IPV4,
6141                 .hooknum =      NF_INET_POST_ROUTING,
6142                 .priority =     NF_IP_PRI_SELINUX_LAST,
6143         },
6144         {
6145                 .hook =         selinux_ipv4_forward,
6146                 .pf =           NFPROTO_IPV4,
6147                 .hooknum =      NF_INET_FORWARD,
6148                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6149         },
6150         {
6151                 .hook =         selinux_ipv4_output,
6152                 .pf =           NFPROTO_IPV4,
6153                 .hooknum =      NF_INET_LOCAL_OUT,
6154                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6155         },
6156 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6157         {
6158                 .hook =         selinux_ipv6_postroute,
6159                 .pf =           NFPROTO_IPV6,
6160                 .hooknum =      NF_INET_POST_ROUTING,
6161                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6162         },
6163         {
6164                 .hook =         selinux_ipv6_forward,
6165                 .pf =           NFPROTO_IPV6,
6166                 .hooknum =      NF_INET_FORWARD,
6167                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6168         },
6169 #endif  /* IPV6 */
6170 };
6171
6172 static int __init selinux_nf_ip_init(void)
6173 {
6174         int err;
6175
6176         if (!selinux_enabled)
6177                 return 0;
6178
6179         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6180
6181         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6182         if (err)
6183                 panic("SELinux: nf_register_hooks: error %d\n", err);
6184
6185         return 0;
6186 }
6187
6188 __initcall(selinux_nf_ip_init);
6189
6190 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6191 static void selinux_nf_ip_exit(void)
6192 {
6193         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6194
6195         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6196 }
6197 #endif
6198
6199 #else /* CONFIG_NETFILTER */
6200
6201 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6202 #define selinux_nf_ip_exit()
6203 #endif
6204
6205 #endif /* CONFIG_NETFILTER */
6206
6207 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6208 static int selinux_disabled;
6209
6210 int selinux_disable(void)
6211 {
6212         if (ss_initialized) {
6213                 /* Not permitted after initial policy load. */
6214                 return -EINVAL;
6215         }
6216
6217         if (selinux_disabled) {
6218                 /* Only do this once. */
6219                 return -EINVAL;
6220         }
6221
6222         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6223
6224         selinux_disabled = 1;
6225         selinux_enabled = 0;
6226
6227         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6228
6229         /* Try to destroy the avc node cache */
6230         avc_disable();
6231
6232         /* Unregister netfilter hooks. */
6233         selinux_nf_ip_exit();
6234
6235         /* Unregister selinuxfs. */
6236         exit_sel_fs();
6237
6238         return 0;
6239 }
6240 #endif