security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 #define NUM_SEL_MNT_OPTS 5
  98
  99 extern struct security_operations *security_ops;
 100
 101 /* SECMARK reference count */
 102 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 103
 104 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 105 int selinux_enforcing;
 106
 107 static int __init enforcing_setup(char *str)
 108 {
 109         unsigned long enforcing;
 110         if (!strict_strtoul(str, 0, &enforcing))
 111                 selinux_enforcing = enforcing ? 1 : 0;
 112         return 1;
 113 }
 114 __setup("enforcing=", enforcing_setup);
 115 #endif
 116
 117 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 118 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 119
 120 static int __init selinux_enabled_setup(char *str)
 121 {
 122         unsigned long enabled;
 123         if (!strict_strtoul(str, 0, &enabled))
 124                 selinux_enabled = enabled ? 1 : 0;
 125         return 1;
 126 }
 127 __setup("selinux=", selinux_enabled_setup);
 128 #else
 129 int selinux_enabled = 1;
 130 #endif
 131
 132 static struct kmem_cache *sel_inode_cache;
 133
 134 /**
 135  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 136  *
 137  * Description:
 138  * This function checks the SECMARK reference counter to see if any SECMARK
 139  * targets are currently configured, if the reference counter is greater than
 140  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 141  * enabled, false (0) if SECMARK is disabled.
 142  *
 143  */
 144 static int selinux_secmark_enabled(void)
 145 {
 146         return (atomic_read(&selinux_secmark_refcount) > 0);
 147 }
 148
 149 static int selinux_netcache_avc_callback(u32 event)
 150 {
 151         if (event == AVC_CALLBACK_RESET) {
 152                 sel_netif_flush();
 153                 sel_netnode_flush();
 154                 sel_netport_flush();
 155                 synchronize_net();
 156         }
 157         return 0;
 158 }
 159
 160 /*
 161  * initialise the security for the init task
 162  */
 163 static void cred_init_security(void)
 164 {
 165         struct cred *cred = (struct cred *) current->real_cred;
 166         struct task_security_struct *tsec;
 167
 168         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 169         if (!tsec)
 170                 panic("SELinux:  Failed to initialize initial task.\n");
 171
 172         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 173         cred->security = tsec;
 174 }
 175
 176 /*
 177  * get the security ID of a set of credentials
 178  */
 179 static inline u32 cred_sid(const struct cred *cred)
 180 {
 181         const struct task_security_struct *tsec;
 182
 183         tsec = cred->security;
 184         return tsec->sid;
 185 }
 186
 187 /*
 188  * get the objective security ID of a task
 189  */
 190 static inline u32 task_sid(const struct task_struct *task)
 191 {
 192         u32 sid;
 193
 194         rcu_read_lock();
 195         sid = cred_sid(__task_cred(task));
 196         rcu_read_unlock();
 197         return sid;
 198 }
 199
 200 /*
 201  * get the subjective security ID of the current task
 202  */
 203 static inline u32 current_sid(void)
 204 {
 205         const struct task_security_struct *tsec = current_security();
 206
 207         return tsec->sid;
 208 }
 209
 210 /* Allocate and free functions for each kind of security blob. */
 211
 212 static int inode_alloc_security(struct inode *inode)
 213 {
 214         struct inode_security_struct *isec;
 215         u32 sid = current_sid();
 216
 217         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 218         if (!isec)
 219                 return -ENOMEM;
 220
 221         mutex_init(&isec->lock);
 222         INIT_LIST_HEAD(&isec->list);
 223         isec->inode = inode;
 224         isec->sid = SECINITSID_UNLABELED;
 225         isec->sclass = SECCLASS_FILE;
 226         isec->task_sid = sid;
 227         inode->i_security = isec;
 228
 229         return 0;
 230 }
 231
 232 static void inode_free_rcu(struct rcu_head *head)
 233 {
 234         struct inode_security_struct *isec;
 235
 236         isec = container_of(head, struct inode_security_struct, rcu);
 237         kmem_cache_free(sel_inode_cache, isec);
 238 }
 239
 240 static void inode_free_security(struct inode *inode)
 241 {
 242         struct inode_security_struct *isec = inode->i_security;
 243         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 244
 245         spin_lock(&sbsec->isec_lock);
 246         if (!list_empty(&isec->list))
 247                 list_del_init(&isec->list);
 248         spin_unlock(&sbsec->isec_lock);
 249
 250         /*
 251          * The inode may still be referenced in a path walk and
 252          * a call to selinux_inode_permission() can be made
 253          * after inode_free_security() is called. Ideally, the VFS
 254          * wouldn't do this, but fixing that is a much harder
 255          * job. For now, simply free the i_security via RCU, and
 256          * leave the current inode->i_security pointer intact.
 257          * The inode will be freed after the RCU grace period too.
 258          */
 259         call_rcu(&isec->rcu, inode_free_rcu);
 260 }
 261
 262 static int file_alloc_security(struct file *file)
 263 {
 264         struct file_security_struct *fsec;
 265         u32 sid = current_sid();
 266
 267         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 268         if (!fsec)
 269                 return -ENOMEM;
 270
 271         fsec->sid = sid;
 272         fsec->fown_sid = sid;
 273         file->f_security = fsec;
 274
 275         return 0;
 276 }
 277
 278 static void file_free_security(struct file *file)
 279 {
 280         struct file_security_struct *fsec = file->f_security;
 281         file->f_security = NULL;
 282         kfree(fsec);
 283 }
 284
 285 static int superblock_alloc_security(struct super_block *sb)
 286 {
 287         struct superblock_security_struct *sbsec;
 288
 289         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 290         if (!sbsec)
 291                 return -ENOMEM;
 292
 293         mutex_init(&sbsec->lock);
 294         INIT_LIST_HEAD(&sbsec->isec_head);
 295         spin_lock_init(&sbsec->isec_lock);
 296         sbsec->sb = sb;
 297         sbsec->sid = SECINITSID_UNLABELED;
 298         sbsec->def_sid = SECINITSID_FILE;
 299         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 300         sb->s_security = sbsec;
 301
 302         return 0;
 303 }
 304
 305 static void superblock_free_security(struct super_block *sb)
 306 {
 307         struct superblock_security_struct *sbsec = sb->s_security;
 308         sb->s_security = NULL;
 309         kfree(sbsec);
 310 }
 311
 312 /* The file system's label must be initialized prior to use. */
 313
 314 static const char *labeling_behaviors[6] = {
 315         "uses xattr",
 316         "uses transition SIDs",
 317         "uses task SIDs",
 318         "uses genfs_contexts",
 319         "not configured for labeling",
 320         "uses mountpoint labeling",
 321 };
 322
 323 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 324
 325 static inline int inode_doinit(struct inode *inode)
 326 {
 327         return inode_doinit_with_dentry(inode, NULL);
 328 }
 329
 330 enum {
 331         Opt_error = -1,
 332         Opt_context = 1,
 333         Opt_fscontext = 2,
 334         Opt_defcontext = 3,
 335         Opt_rootcontext = 4,
 336         Opt_labelsupport = 5,
 337 };
 338
 339 static const match_table_t tokens = {
 340         {Opt_context, CONTEXT_STR "%s"},
 341         {Opt_fscontext, FSCONTEXT_STR "%s"},
 342         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 343         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 344         {Opt_labelsupport, LABELSUPP_STR},
 345         {Opt_error, NULL},
 346 };
 347
 348 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 349
 350 static int may_context_mount_sb_relabel(u32 sid,
 351                         struct superblock_security_struct *sbsec,
 352                         const struct cred *cred)
 353 {
 354         const struct task_security_struct *tsec = cred->security;
 355         int rc;
 356
 357         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 358                           FILESYSTEM__RELABELFROM, NULL);
 359         if (rc)
 360                 return rc;
 361
 362         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 363                           FILESYSTEM__RELABELTO, NULL);
 364         return rc;
 365 }
 366
 367 static int may_context_mount_inode_relabel(u32 sid,
 368                         struct superblock_security_struct *sbsec,
 369                         const struct cred *cred)
 370 {
 371         const struct task_security_struct *tsec = cred->security;
 372         int rc;
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__ASSOCIATE, NULL);
 380         return rc;
 381 }
 382
 383 static int sb_finish_set_opts(struct super_block *sb)
 384 {
 385         struct superblock_security_struct *sbsec = sb->s_security;
 386         struct dentry *root = sb->s_root;
 387         struct inode *root_inode = root->d_inode;
 388         int rc = 0;
 389
 390         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 391                 /* Make sure that the xattr handler exists and that no
 392                    error other than -ENODATA is returned by getxattr on
 393                    the root directory.  -ENODATA is ok, as this may be
 394                    the first boot of the SELinux kernel before we have
 395                    assigned xattr values to the filesystem. */
 396                 if (!root_inode->i_op->getxattr) {
 397                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 398                                "xattr support\n", sb->s_id, sb->s_type->name);
 399                         rc = -EOPNOTSUPP;
 400                         goto out;
 401                 }
 402                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 403                 if (rc < 0 && rc != -ENODATA) {
 404                         if (rc == -EOPNOTSUPP)
 405                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 406                                        "%s) has no security xattr handler\n",
 407                                        sb->s_id, sb->s_type->name);
 408                         else
 409                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 410                                        "%s) getxattr errno %d\n", sb->s_id,
 411                                        sb->s_type->name, -rc);
 412                         goto out;
 413                 }
 414         }
 415
 416         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 417
 418         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 419                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 420                        sb->s_id, sb->s_type->name);
 421         else
 422                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 423                        sb->s_id, sb->s_type->name,
 424                        labeling_behaviors[sbsec->behavior-1]);
 425
 426         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 427             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 428             sbsec->behavior == SECURITY_FS_USE_NONE ||
 429             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 430                 sbsec->flags &= ~SE_SBLABELSUPP;
 431
 432         /* Special handling. Is genfs but also has in-core setxattr handler*/
 433         if (!strcmp(sb->s_type->name, "sysfs") ||
 434             !strcmp(sb->s_type->name, "pstore") ||
 435             !strcmp(sb->s_type->name, "debugfs") ||
 436             !strcmp(sb->s_type->name, "rootfs"))
 437                 sbsec->flags |= SE_SBLABELSUPP;
 438
 439         /* Initialize the root inode. */
 440         rc = inode_doinit_with_dentry(root_inode, root);
 441
 442         /* Initialize any other inodes associated with the superblock, e.g.
 443            inodes created prior to initial policy load or inodes created
 444            during get_sb by a pseudo filesystem that directly
 445            populates itself. */
 446         spin_lock(&sbsec->isec_lock);
 447 next_inode:
 448         if (!list_empty(&sbsec->isec_head)) {
 449                 struct inode_security_struct *isec =
 450                                 list_entry(sbsec->isec_head.next,
 451                                            struct inode_security_struct, list);
 452                 struct inode *inode = isec->inode;
 453                 spin_unlock(&sbsec->isec_lock);
 454                 inode = igrab(inode);
 455                 if (inode) {
 456                         if (!IS_PRIVATE(inode))
 457                                 inode_doinit(inode);
 458                         iput(inode);
 459                 }
 460                 spin_lock(&sbsec->isec_lock);
 461                 list_del_init(&isec->list);
 462                 goto next_inode;
 463         }
 464         spin_unlock(&sbsec->isec_lock);
 465 out:
 466         return rc;
 467 }
 468
 469 /*
 470  * This function should allow an FS to ask what it's mount security
 471  * options were so it can use those later for submounts, displaying
 472  * mount options, or whatever.
 473  */
 474 static int selinux_get_mnt_opts(const struct super_block *sb,
 475                                 struct security_mnt_opts *opts)
 476 {
 477         int rc = 0, i;
 478         struct superblock_security_struct *sbsec = sb->s_security;
 479         char *context = NULL;
 480         u32 len;
 481         char tmp;
 482
 483         security_init_mnt_opts(opts);
 484
 485         if (!(sbsec->flags & SE_SBINITIALIZED))
 486                 return -EINVAL;
 487
 488         if (!ss_initialized)
 489                 return -EINVAL;
 490
 491         tmp = sbsec->flags & SE_MNTMASK;
 492         /* count the number of mount options for this sb */
 493         for (i = 0; i < 8; i++) {
 494                 if (tmp & 0x01)
 495                         opts->num_mnt_opts++;
 496                 tmp >>= 1;
 497         }
 498         /* Check if the Label support flag is set */
 499         if (sbsec->flags & SE_SBLABELSUPP)
 500                 opts->num_mnt_opts++;
 501
 502         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 503         if (!opts->mnt_opts) {
 504                 rc = -ENOMEM;
 505                 goto out_free;
 506         }
 507
 508         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 509         if (!opts->mnt_opts_flags) {
 510                 rc = -ENOMEM;
 511                 goto out_free;
 512         }
 513
 514         i = 0;
 515         if (sbsec->flags & FSCONTEXT_MNT) {
 516                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 517                 if (rc)
 518                         goto out_free;
 519                 opts->mnt_opts[i] = context;
 520                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 521         }
 522         if (sbsec->flags & CONTEXT_MNT) {
 523                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 524                 if (rc)
 525                         goto out_free;
 526                 opts->mnt_opts[i] = context;
 527                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 528         }
 529         if (sbsec->flags & DEFCONTEXT_MNT) {
 530                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 531                 if (rc)
 532                         goto out_free;
 533                 opts->mnt_opts[i] = context;
 534                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 535         }
 536         if (sbsec->flags & ROOTCONTEXT_MNT) {
 537                 struct inode *root = sbsec->sb->s_root->d_inode;
 538                 struct inode_security_struct *isec = root->i_security;
 539
 540                 rc = security_sid_to_context(isec->sid, &context, &len);
 541                 if (rc)
 542                         goto out_free;
 543                 opts->mnt_opts[i] = context;
 544                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 545         }
 546         if (sbsec->flags & SE_SBLABELSUPP) {
 547                 opts->mnt_opts[i] = NULL;
 548                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 549         }
 550
 551         BUG_ON(i != opts->num_mnt_opts);
 552
 553         return 0;
 554
 555 out_free:
 556         security_free_mnt_opts(opts);
 557         return rc;
 558 }
 559
 560 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 561                       u32 old_sid, u32 new_sid)
 562 {
 563         char mnt_flags = sbsec->flags & SE_MNTMASK;
 564
 565         /* check if the old mount command had the same options */
 566         if (sbsec->flags & SE_SBINITIALIZED)
 567                 if (!(sbsec->flags & flag) ||
 568                     (old_sid != new_sid))
 569                         return 1;
 570
 571         /* check if we were passed the same options twice,
 572          * aka someone passed context=a,context=b
 573          */
 574         if (!(sbsec->flags & SE_SBINITIALIZED))
 575                 if (mnt_flags & flag)
 576                         return 1;
 577         return 0;
 578 }
 579
 580 /*
 581  * Allow filesystems with binary mount data to explicitly set mount point
 582  * labeling information.
 583  */
 584 static int selinux_set_mnt_opts(struct super_block *sb,
 585                                 struct security_mnt_opts *opts)
 586 {
 587         const struct cred *cred = current_cred();
 588         int rc = 0, i;
 589         struct superblock_security_struct *sbsec = sb->s_security;
 590         const char *name = sb->s_type->name;
 591         struct inode *inode = sbsec->sb->s_root->d_inode;
 592         struct inode_security_struct *root_isec = inode->i_security;
 593         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 594         u32 defcontext_sid = 0;
 595         char **mount_options = opts->mnt_opts;
 596         int *flags = opts->mnt_opts_flags;
 597         int num_opts = opts->num_mnt_opts;
 598
 599         mutex_lock(&sbsec->lock);
 600
 601         if (!ss_initialized) {
 602                 if (!num_opts) {
 603                         /* Defer initialization until selinux_complete_init,
 604                            after the initial policy is loaded and the security
 605                            server is ready to handle calls. */
 606                         goto out;
 607                 }
 608                 rc = -EINVAL;
 609                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 610                         "before the security server is initialized\n");
 611                 goto out;
 612         }
 613
 614         /*
 615          * Binary mount data FS will come through this function twice.  Once
 616          * from an explicit call and once from the generic calls from the vfs.
 617          * Since the generic VFS calls will not contain any security mount data
 618          * we need to skip the double mount verification.
 619          *
 620          * This does open a hole in which we will not notice if the first
 621          * mount using this sb set explict options and a second mount using
 622          * this sb does not set any security options.  (The first options
 623          * will be used for both mounts)
 624          */
 625         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 626             && (num_opts == 0))
 627                 goto out;
 628
 629         /*
 630          * parse the mount options, check if they are valid sids.
 631          * also check if someone is trying to mount the same sb more
 632          * than once with different security options.
 633          */
 634         for (i = 0; i < num_opts; i++) {
 635                 u32 sid;
 636
 637                 if (flags[i] == SE_SBLABELSUPP)
 638                         continue;
 639                 rc = security_context_to_sid(mount_options[i],
 640                                              strlen(mount_options[i]), &sid);
 641                 if (rc) {
 642                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 643                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 644                                mount_options[i], sb->s_id, name, rc);
 645                         goto out;
 646                 }
 647                 switch (flags[i]) {
 648                 case FSCONTEXT_MNT:
 649                         fscontext_sid = sid;
 650
 651                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 652                                         fscontext_sid))
 653                                 goto out_double_mount;
 654
 655                         sbsec->flags |= FSCONTEXT_MNT;
 656                         break;
 657                 case CONTEXT_MNT:
 658                         context_sid = sid;
 659
 660                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 661                                         context_sid))
 662                                 goto out_double_mount;
 663
 664                         sbsec->flags |= CONTEXT_MNT;
 665                         break;
 666                 case ROOTCONTEXT_MNT:
 667                         rootcontext_sid = sid;
 668
 669                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 670                                         rootcontext_sid))
 671                                 goto out_double_mount;
 672
 673                         sbsec->flags |= ROOTCONTEXT_MNT;
 674
 675                         break;
 676                 case DEFCONTEXT_MNT:
 677                         defcontext_sid = sid;
 678
 679                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 680                                         defcontext_sid))
 681                                 goto out_double_mount;
 682
 683                         sbsec->flags |= DEFCONTEXT_MNT;
 684
 685                         break;
 686                 default:
 687                         rc = -EINVAL;
 688                         goto out;
 689                 }
 690         }
 691
 692         if (sbsec->flags & SE_SBINITIALIZED) {
 693                 /* previously mounted with options, but not on this attempt? */
 694                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 695                         goto out_double_mount;
 696                 rc = 0;
 697                 goto out;
 698         }
 699
 700         if (strcmp(sb->s_type->name, "proc") == 0)
 701                 sbsec->flags |= SE_SBPROC;
 702
 703         /* Determine the labeling behavior to use for this filesystem type. */
 704         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 705         if (rc) {
 706                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 707                        __func__, sb->s_type->name, rc);
 708                 goto out;
 709         }
 710
 711         /* sets the context of the superblock for the fs being mounted. */
 712         if (fscontext_sid) {
 713                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 714                 if (rc)
 715                         goto out;
 716
 717                 sbsec->sid = fscontext_sid;
 718         }
 719
 720         /*
 721          * Switch to using mount point labeling behavior.
 722          * sets the label used on all file below the mountpoint, and will set
 723          * the superblock context if not already set.
 724          */
 725         if (context_sid) {
 726                 if (!fscontext_sid) {
 727                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 728                                                           cred);
 729                         if (rc)
 730                                 goto out;
 731                         sbsec->sid = context_sid;
 732                 } else {
 733                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 734                                                              cred);
 735                         if (rc)
 736                                 goto out;
 737                 }
 738                 if (!rootcontext_sid)
 739                         rootcontext_sid = context_sid;
 740
 741                 sbsec->mntpoint_sid = context_sid;
 742                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 743         }
 744
 745         if (rootcontext_sid) {
 746                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 747                                                      cred);
 748                 if (rc)
 749                         goto out;
 750
 751                 root_isec->sid = rootcontext_sid;
 752                 root_isec->initialized = 1;
 753         }
 754
 755         if (defcontext_sid) {
 756                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 757                         rc = -EINVAL;
 758                         printk(KERN_WARNING "SELinux: defcontext option is "
 759                                "invalid for this filesystem type\n");
 760                         goto out;
 761                 }
 762
 763                 if (defcontext_sid != sbsec->def_sid) {
 764                         rc = may_context_mount_inode_relabel(defcontext_sid,
 765                                                              sbsec, cred);
 766                         if (rc)
 767                                 goto out;
 768                 }
 769
 770                 sbsec->def_sid = defcontext_sid;
 771         }
 772
 773         rc = sb_finish_set_opts(sb);
 774 out:
 775         mutex_unlock(&sbsec->lock);
 776         return rc;
 777 out_double_mount:
 778         rc = -EINVAL;
 779         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 780                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 781         goto out;
 782 }
 783
 784 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 785                                     const struct super_block *newsb)
 786 {
 787         struct superblock_security_struct *old = oldsb->s_security;
 788         struct superblock_security_struct *new = newsb->s_security;
 789         char oldflags = old->flags & SE_MNTMASK;
 790         char newflags = new->flags & SE_MNTMASK;
 791
 792         if (oldflags != newflags)
 793                 goto mismatch;
 794         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 795                 goto mismatch;
 796         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 797                 goto mismatch;
 798         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 799                 goto mismatch;
 800         if (oldflags & ROOTCONTEXT_MNT) {
 801                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 802                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 803                 if (oldroot->sid != newroot->sid)
 804                         goto mismatch;
 805         }
 806         return 0;
 807 mismatch:
 808         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 809                             "different security settings for (dev %s, "
 810                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 811         return -EBUSY;
 812 }
 813
 814 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 815                                         struct super_block *newsb)
 816 {
 817         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 818         struct superblock_security_struct *newsbsec = newsb->s_security;
 819
 820         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 821         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 822         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 823
 824         /*
 825          * if the parent was able to be mounted it clearly had no special lsm
 826          * mount options.  thus we can safely deal with this superblock later
 827          */
 828         if (!ss_initialized)
 829                 return 0;
 830
 831         /* how can we clone if the old one wasn't set up?? */
 832         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 833
 834         /* if fs is reusing a sb, make sure that the contexts match */
 835         if (newsbsec->flags & SE_SBINITIALIZED)
 836                 return selinux_cmp_sb_context(oldsb, newsb);
 837
 838         mutex_lock(&newsbsec->lock);
 839
 840         newsbsec->flags = oldsbsec->flags;
 841
 842         newsbsec->sid = oldsbsec->sid;
 843         newsbsec->def_sid = oldsbsec->def_sid;
 844         newsbsec->behavior = oldsbsec->behavior;
 845
 846         if (set_context) {
 847                 u32 sid = oldsbsec->mntpoint_sid;
 848
 849                 if (!set_fscontext)
 850                         newsbsec->sid = sid;
 851                 if (!set_rootcontext) {
 852                         struct inode *newinode = newsb->s_root->d_inode;
 853                         struct inode_security_struct *newisec = newinode->i_security;
 854                         newisec->sid = sid;
 855                 }
 856                 newsbsec->mntpoint_sid = sid;
 857         }
 858         if (set_rootcontext) {
 859                 const struct inode *oldinode = oldsb->s_root->d_inode;
 860                 const struct inode_security_struct *oldisec = oldinode->i_security;
 861                 struct inode *newinode = newsb->s_root->d_inode;
 862                 struct inode_security_struct *newisec = newinode->i_security;
 863
 864                 newisec->sid = oldisec->sid;
 865         }
 866
 867         sb_finish_set_opts(newsb);
 868         mutex_unlock(&newsbsec->lock);
 869         return 0;
 870 }
 871
 872 static int selinux_parse_opts_str(char *options,
 873                                   struct security_mnt_opts *opts)
 874 {
 875         char *p;
 876         char *context = NULL, *defcontext = NULL;
 877         char *fscontext = NULL, *rootcontext = NULL;
 878         int rc, num_mnt_opts = 0;
 879
 880         opts->num_mnt_opts = 0;
 881
 882         /* Standard string-based options. */
 883         while ((p = strsep(&options, "|")) != NULL) {
 884                 int token;
 885                 substring_t args[MAX_OPT_ARGS];
 886
 887                 if (!*p)
 888                         continue;
 889
 890                 token = match_token(p, tokens, args);
 891
 892                 switch (token) {
 893                 case Opt_context:
 894                         if (context || defcontext) {
 895                                 rc = -EINVAL;
 896                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 897                                 goto out_err;
 898                         }
 899                         context = match_strdup(&args[0]);
 900                         if (!context) {
 901                                 rc = -ENOMEM;
 902                                 goto out_err;
 903                         }
 904                         break;
 905
 906                 case Opt_fscontext:
 907                         if (fscontext) {
 908                                 rc = -EINVAL;
 909                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 910                                 goto out_err;
 911                         }
 912                         fscontext = match_strdup(&args[0]);
 913                         if (!fscontext) {
 914                                 rc = -ENOMEM;
 915                                 goto out_err;
 916                         }
 917                         break;
 918
 919                 case Opt_rootcontext:
 920                         if (rootcontext) {
 921                                 rc = -EINVAL;
 922                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 923                                 goto out_err;
 924                         }
 925                         rootcontext = match_strdup(&args[0]);
 926                         if (!rootcontext) {
 927                                 rc = -ENOMEM;
 928                                 goto out_err;
 929                         }
 930                         break;
 931
 932                 case Opt_defcontext:
 933                         if (context || defcontext) {
 934                                 rc = -EINVAL;
 935                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 936                                 goto out_err;
 937                         }
 938                         defcontext = match_strdup(&args[0]);
 939                         if (!defcontext) {
 940                                 rc = -ENOMEM;
 941                                 goto out_err;
 942                         }
 943                         break;
 944                 case Opt_labelsupport:
 945                         break;
 946                 default:
 947                         rc = -EINVAL;
 948                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 949                         goto out_err;
 950
 951                 }
 952         }
 953
 954         rc = -ENOMEM;
 955         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 956         if (!opts->mnt_opts)
 957                 goto out_err;
 958
 959         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 960         if (!opts->mnt_opts_flags) {
 961                 kfree(opts->mnt_opts);
 962                 goto out_err;
 963         }
 964
 965         if (fscontext) {
 966                 opts->mnt_opts[num_mnt_opts] = fscontext;
 967                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 968         }
 969         if (context) {
 970                 opts->mnt_opts[num_mnt_opts] = context;
 971                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 972         }
 973         if (rootcontext) {
 974                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 975                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 976         }
 977         if (defcontext) {
 978                 opts->mnt_opts[num_mnt_opts] = defcontext;
 979                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 980         }
 981
 982         opts->num_mnt_opts = num_mnt_opts;
 983         return 0;
 984
 985 out_err:
 986         kfree(context);
 987         kfree(defcontext);
 988         kfree(fscontext);
 989         kfree(rootcontext);
 990         return rc;
 991 }
 992 /*
 993  * string mount options parsing and call set the sbsec
 994  */
 995 static int superblock_doinit(struct super_block *sb, void *data)
 996 {
 997         int rc = 0;
 998         char *options = data;
 999         struct security_mnt_opts opts;
1000
1001         security_init_mnt_opts(&opts);
1002
1003         if (!data)
1004                 goto out;
1005
1006         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1007
1008         rc = selinux_parse_opts_str(options, &opts);
1009         if (rc)
1010                 goto out_err;
1011
1012 out:
1013         rc = selinux_set_mnt_opts(sb, &opts);
1014
1015 out_err:
1016         security_free_mnt_opts(&opts);
1017         return rc;
1018 }
1019
1020 static void selinux_write_opts(struct seq_file *m,
1021                                struct security_mnt_opts *opts)
1022 {
1023         int i;
1024         char *prefix;
1025
1026         for (i = 0; i < opts->num_mnt_opts; i++) {
1027                 char *has_comma;
1028
1029                 if (opts->mnt_opts[i])
1030                         has_comma = strchr(opts->mnt_opts[i], ',');
1031                 else
1032                         has_comma = NULL;
1033
1034                 switch (opts->mnt_opts_flags[i]) {
1035                 case CONTEXT_MNT:
1036                         prefix = CONTEXT_STR;
1037                         break;
1038                 case FSCONTEXT_MNT:
1039                         prefix = FSCONTEXT_STR;
1040                         break;
1041                 case ROOTCONTEXT_MNT:
1042                         prefix = ROOTCONTEXT_STR;
1043                         break;
1044                 case DEFCONTEXT_MNT:
1045                         prefix = DEFCONTEXT_STR;
1046                         break;
1047                 case SE_SBLABELSUPP:
1048                         seq_putc(m, ',');
1049                         seq_puts(m, LABELSUPP_STR);
1050                         continue;
1051                 default:
1052                         BUG();
1053                         return;
1054                 };
1055                 /* we need a comma before each option */
1056                 seq_putc(m, ',');
1057                 seq_puts(m, prefix);
1058                 if (has_comma)
1059                         seq_putc(m, '\"');
1060                 seq_puts(m, opts->mnt_opts[i]);
1061                 if (has_comma)
1062                         seq_putc(m, '\"');
1063         }
1064 }
1065
1066 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1067 {
1068         struct security_mnt_opts opts;
1069         int rc;
1070
1071         rc = selinux_get_mnt_opts(sb, &opts);
1072         if (rc) {
1073                 /* before policy load we may get EINVAL, don't show anything */
1074                 if (rc == -EINVAL)
1075                         rc = 0;
1076                 return rc;
1077         }
1078
1079         selinux_write_opts(m, &opts);
1080
1081         security_free_mnt_opts(&opts);
1082
1083         return rc;
1084 }
1085
1086 static inline u16 inode_mode_to_security_class(umode_t mode)
1087 {
1088         switch (mode & S_IFMT) {
1089         case S_IFSOCK:
1090                 return SECCLASS_SOCK_FILE;
1091         case S_IFLNK:
1092                 return SECCLASS_LNK_FILE;
1093         case S_IFREG:
1094                 return SECCLASS_FILE;
1095         case S_IFBLK:
1096                 return SECCLASS_BLK_FILE;
1097         case S_IFDIR:
1098                 return SECCLASS_DIR;
1099         case S_IFCHR:
1100                 return SECCLASS_CHR_FILE;
1101         case S_IFIFO:
1102                 return SECCLASS_FIFO_FILE;
1103
1104         }
1105
1106         return SECCLASS_FILE;
1107 }
1108
1109 static inline int default_protocol_stream(int protocol)
1110 {
1111         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1112 }
1113
1114 static inline int default_protocol_dgram(int protocol)
1115 {
1116         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1117 }
1118
1119 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1120 {
1121         switch (family) {
1122         case PF_UNIX:
1123                 switch (type) {
1124                 case SOCK_STREAM:
1125                 case SOCK_SEQPACKET:
1126                         return SECCLASS_UNIX_STREAM_SOCKET;
1127                 case SOCK_DGRAM:
1128                         return SECCLASS_UNIX_DGRAM_SOCKET;
1129                 }
1130                 break;
1131         case PF_INET:
1132         case PF_INET6:
1133                 switch (type) {
1134                 case SOCK_STREAM:
1135                         if (default_protocol_stream(protocol))
1136                                 return SECCLASS_TCP_SOCKET;
1137                         else
1138                                 return SECCLASS_RAWIP_SOCKET;
1139                 case SOCK_DGRAM:
1140                         if (default_protocol_dgram(protocol))
1141                                 return SECCLASS_UDP_SOCKET;
1142                         else
1143                                 return SECCLASS_RAWIP_SOCKET;
1144                 case SOCK_DCCP:
1145                         return SECCLASS_DCCP_SOCKET;
1146                 default:
1147                         return SECCLASS_RAWIP_SOCKET;
1148                 }
1149                 break;
1150         case PF_NETLINK:
1151                 switch (protocol) {
1152                 case NETLINK_ROUTE:
1153                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1154                 case NETLINK_FIREWALL:
1155                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1156                 case NETLINK_SOCK_DIAG:
1157                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1158                 case NETLINK_NFLOG:
1159                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1160                 case NETLINK_XFRM:
1161                         return SECCLASS_NETLINK_XFRM_SOCKET;
1162                 case NETLINK_SELINUX:
1163                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1164                 case NETLINK_AUDIT:
1165                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1166                 case NETLINK_IP6_FW:
1167                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1168                 case NETLINK_DNRTMSG:
1169                         return SECCLASS_NETLINK_DNRT_SOCKET;
1170                 case NETLINK_KOBJECT_UEVENT:
1171                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1172                 default:
1173                         return SECCLASS_NETLINK_SOCKET;
1174                 }
1175         case PF_PACKET:
1176                 return SECCLASS_PACKET_SOCKET;
1177         case PF_KEY:
1178                 return SECCLASS_KEY_SOCKET;
1179         case PF_APPLETALK:
1180                 return SECCLASS_APPLETALK_SOCKET;
1181         }
1182
1183         return SECCLASS_SOCKET;
1184 }
1185
1186 #ifdef CONFIG_PROC_FS
1187 static int selinux_proc_get_sid(struct dentry *dentry,
1188                                 u16 tclass,
1189                                 u32 *sid)
1190 {
1191         int rc;
1192         char *buffer, *path;
1193
1194         buffer = (char *)__get_free_page(GFP_KERNEL);
1195         if (!buffer)
1196                 return -ENOMEM;
1197
1198         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1199         if (IS_ERR(path))
1200                 rc = PTR_ERR(path);
1201         else {
1202                 /* each process gets a /proc/PID/ entry. Strip off the
1203                  * PID part to get a valid selinux labeling.
1204                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1205                 while (path[1] >= '0' && path[1] <= '9') {
1206                         path[1] = '/';
1207                         path++;
1208                 }
1209                 rc = security_genfs_sid("proc", path, tclass, sid);
1210         }
1211         free_page((unsigned long)buffer);
1212         return rc;
1213 }
1214 #else
1215 static int selinux_proc_get_sid(struct dentry *dentry,
1216                                 u16 tclass,
1217                                 u32 *sid)
1218 {
1219         return -EINVAL;
1220 }
1221 #endif
1222
1223 /* The inode's security attributes must be initialized before first use. */
1224 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1225 {
1226         struct superblock_security_struct *sbsec = NULL;
1227         struct inode_security_struct *isec = inode->i_security;
1228         u32 sid;
1229         struct dentry *dentry;
1230 #define INITCONTEXTLEN 255
1231         char *context = NULL;
1232         unsigned len = 0;
1233         int rc = 0;
1234
1235         if (isec->initialized)
1236                 goto out;
1237
1238         mutex_lock(&isec->lock);
1239         if (isec->initialized)
1240                 goto out_unlock;
1241
1242         sbsec = inode->i_sb->s_security;
1243         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1244                 /* Defer initialization until selinux_complete_init,
1245                    after the initial policy is loaded and the security
1246                    server is ready to handle calls. */
1247                 spin_lock(&sbsec->isec_lock);
1248                 if (list_empty(&isec->list))
1249                         list_add(&isec->list, &sbsec->isec_head);
1250                 spin_unlock(&sbsec->isec_lock);
1251                 goto out_unlock;
1252         }
1253
1254         switch (sbsec->behavior) {
1255         case SECURITY_FS_USE_XATTR:
1256                 if (!inode->i_op->getxattr) {
1257                         isec->sid = sbsec->def_sid;
1258                         break;
1259                 }
1260
1261                 /* Need a dentry, since the xattr API requires one.
1262                    Life would be simpler if we could just pass the inode. */
1263                 if (opt_dentry) {
1264                         /* Called from d_instantiate or d_splice_alias. */
1265                         dentry = dget(opt_dentry);
1266                 } else {
1267                         /* Called from selinux_complete_init, try to find a dentry. */
1268                         dentry = d_find_alias(inode);
1269                 }
1270                 if (!dentry) {
1271                         /*
1272                          * this is can be hit on boot when a file is accessed
1273                          * before the policy is loaded.  When we load policy we
1274                          * may find inodes that have no dentry on the
1275                          * sbsec->isec_head list.  No reason to complain as these
1276                          * will get fixed up the next time we go through
1277                          * inode_doinit with a dentry, before these inodes could
1278                          * be used again by userspace.
1279                          */
1280                         goto out_unlock;
1281                 }
1282
1283                 len = INITCONTEXTLEN;
1284                 context = kmalloc(len+1, GFP_NOFS);
1285                 if (!context) {
1286                         rc = -ENOMEM;
1287                         dput(dentry);
1288                         goto out_unlock;
1289                 }
1290                 context[len] = '\0';
1291                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1292                                            context, len);
1293                 if (rc == -ERANGE) {
1294                         kfree(context);
1295
1296                         /* Need a larger buffer.  Query for the right size. */
1297                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1298                                                    NULL, 0);
1299                         if (rc < 0) {
1300                                 dput(dentry);
1301                                 goto out_unlock;
1302                         }
1303                         len = rc;
1304                         context = kmalloc(len+1, GFP_NOFS);
1305                         if (!context) {
1306                                 rc = -ENOMEM;
1307                                 dput(dentry);
1308                                 goto out_unlock;
1309                         }
1310                         context[len] = '\0';
1311                         rc = inode->i_op->getxattr(dentry,
1312                                                    XATTR_NAME_SELINUX,
1313                                                    context, len);
1314                 }
1315                 dput(dentry);
1316                 if (rc < 0) {
1317                         if (rc != -ENODATA) {
1318                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1319                                        "%d for dev=%s ino=%ld\n", __func__,
1320                                        -rc, inode->i_sb->s_id, inode->i_ino);
1321                                 kfree(context);
1322                                 goto out_unlock;
1323                         }
1324                         /* Map ENODATA to the default file SID */
1325                         sid = sbsec->def_sid;
1326                         rc = 0;
1327                 } else {
1328                         rc = security_context_to_sid_default(context, rc, &sid,
1329                                                              sbsec->def_sid,
1330                                                              GFP_NOFS);
1331                         if (rc) {
1332                                 char *dev = inode->i_sb->s_id;
1333                                 unsigned long ino = inode->i_ino;
1334
1335                                 if (rc == -EINVAL) {
1336                                         if (printk_ratelimit())
1337                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1338                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1339                                                         "filesystem in question.\n", ino, dev, context);
1340                                 } else {
1341                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1342                                                "returned %d for dev=%s ino=%ld\n",
1343                                                __func__, context, -rc, dev, ino);
1344                                 }
1345                                 kfree(context);
1346                                 /* Leave with the unlabeled SID */
1347                                 rc = 0;
1348                                 break;
1349                         }
1350                 }
1351                 kfree(context);
1352                 isec->sid = sid;
1353                 break;
1354         case SECURITY_FS_USE_TASK:
1355                 isec->sid = isec->task_sid;
1356                 break;
1357         case SECURITY_FS_USE_TRANS:
1358                 /* Default to the fs SID. */
1359                 isec->sid = sbsec->sid;
1360
1361                 /* Try to obtain a transition SID. */
1362                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1363                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1364                                              isec->sclass, NULL, &sid);
1365                 if (rc)
1366                         goto out_unlock;
1367                 isec->sid = sid;
1368                 break;
1369         case SECURITY_FS_USE_MNTPOINT:
1370                 isec->sid = sbsec->mntpoint_sid;
1371                 break;
1372         default:
1373                 /* Default to the fs superblock SID. */
1374                 isec->sid = sbsec->sid;
1375
1376                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1377                         if (opt_dentry) {
1378                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1379                                 rc = selinux_proc_get_sid(opt_dentry,
1380                                                           isec->sclass,
1381                                                           &sid);
1382                                 if (rc)
1383                                         goto out_unlock;
1384                                 isec->sid = sid;
1385                         }
1386                 }
1387                 break;
1388         }
1389
1390         isec->initialized = 1;
1391
1392 out_unlock:
1393         mutex_unlock(&isec->lock);
1394 out:
1395         if (isec->sclass == SECCLASS_FILE)
1396                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1397         return rc;
1398 }
1399
1400 /* Convert a Linux signal to an access vector. */
1401 static inline u32 signal_to_av(int sig)
1402 {
1403         u32 perm = 0;
1404
1405         switch (sig) {
1406         case SIGCHLD:
1407                 /* Commonly granted from child to parent. */
1408                 perm = PROCESS__SIGCHLD;
1409                 break;
1410         case SIGKILL:
1411                 /* Cannot be caught or ignored */
1412                 perm = PROCESS__SIGKILL;
1413                 break;
1414         case SIGSTOP:
1415                 /* Cannot be caught or ignored */
1416                 perm = PROCESS__SIGSTOP;
1417                 break;
1418         default:
1419                 /* All other signals. */
1420                 perm = PROCESS__SIGNAL;
1421                 break;
1422         }
1423
1424         return perm;
1425 }
1426
1427 /*
1428  * Check permission between a pair of credentials
1429  * fork check, ptrace check, etc.
1430  */
1431 static int cred_has_perm(const struct cred *actor,
1432                          const struct cred *target,
1433                          u32 perms)
1434 {
1435         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1436
1437         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1438 }
1439
1440 /*
1441  * Check permission between a pair of tasks, e.g. signal checks,
1442  * fork check, ptrace check, etc.
1443  * tsk1 is the actor and tsk2 is the target
1444  * - this uses the default subjective creds of tsk1
1445  */
1446 static int task_has_perm(const struct task_struct *tsk1,
1447                          const struct task_struct *tsk2,
1448                          u32 perms)
1449 {
1450         const struct task_security_struct *__tsec1, *__tsec2;
1451         u32 sid1, sid2;
1452
1453         rcu_read_lock();
1454         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1455         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1456         rcu_read_unlock();
1457         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1458 }
1459
1460 /*
1461  * Check permission between current and another task, e.g. signal checks,
1462  * fork check, ptrace check, etc.
1463  * current is the actor and tsk2 is the target
1464  * - this uses current's subjective creds
1465  */
1466 static int current_has_perm(const struct task_struct *tsk,
1467                             u32 perms)
1468 {
1469         u32 sid, tsid;
1470
1471         sid = current_sid();
1472         tsid = task_sid(tsk);
1473         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1474 }
1475
1476 #if CAP_LAST_CAP > 63
1477 #error Fix SELinux to handle capabilities > 63.
1478 #endif
1479
1480 /* Check whether a task is allowed to use a capability. */
1481 static int cred_has_capability(const struct cred *cred,
1482                                int cap, int audit)
1483 {
1484         struct common_audit_data ad;
1485         struct av_decision avd;
1486         u16 sclass;
1487         u32 sid = cred_sid(cred);
1488         u32 av = CAP_TO_MASK(cap);
1489         int rc;
1490
1491         ad.type = LSM_AUDIT_DATA_CAP;
1492         ad.u.cap = cap;
1493
1494         switch (CAP_TO_INDEX(cap)) {
1495         case 0:
1496                 sclass = SECCLASS_CAPABILITY;
1497                 break;
1498         case 1:
1499                 sclass = SECCLASS_CAPABILITY2;
1500                 break;
1501         default:
1502                 printk(KERN_ERR
1503                        "SELinux:  out of range capability %d\n", cap);
1504                 BUG();
1505                 return -EINVAL;
1506         }
1507
1508         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1509         if (audit == SECURITY_CAP_AUDIT) {
1510                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1511                 if (rc2)
1512                         return rc2;
1513         }
1514         return rc;
1515 }
1516
1517 /* Check whether a task is allowed to use a system operation. */
1518 static int task_has_system(struct task_struct *tsk,
1519                            u32 perms)
1520 {
1521         u32 sid = task_sid(tsk);
1522
1523         return avc_has_perm(sid, SECINITSID_KERNEL,
1524                             SECCLASS_SYSTEM, perms, NULL);
1525 }
1526
1527 /* Check whether a task has a particular permission to an inode.
1528    The 'adp' parameter is optional and allows other audit
1529    data to be passed (e.g. the dentry). */
1530 static int inode_has_perm(const struct cred *cred,
1531                           struct inode *inode,
1532                           u32 perms,
1533                           struct common_audit_data *adp,
1534                           unsigned flags)
1535 {
1536         struct inode_security_struct *isec;
1537         u32 sid;
1538
1539         validate_creds(cred);
1540
1541         if (unlikely(IS_PRIVATE(inode)))
1542                 return 0;
1543
1544         sid = cred_sid(cred);
1545         isec = inode->i_security;
1546
1547         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1548 }
1549
1550 /* Same as inode_has_perm, but pass explicit audit data containing
1551    the dentry to help the auditing code to more easily generate the
1552    pathname if needed. */
1553 static inline int dentry_has_perm(const struct cred *cred,
1554                                   struct dentry *dentry,
1555                                   u32 av)
1556 {
1557         struct inode *inode = dentry->d_inode;
1558         struct common_audit_data ad;
1559
1560         ad.type = LSM_AUDIT_DATA_DENTRY;
1561         ad.u.dentry = dentry;
1562         return inode_has_perm(cred, inode, av, &ad, 0);
1563 }
1564
1565 /* Same as inode_has_perm, but pass explicit audit data containing
1566    the path to help the auditing code to more easily generate the
1567    pathname if needed. */
1568 static inline int path_has_perm(const struct cred *cred,
1569                                 struct path *path,
1570                                 u32 av)
1571 {
1572         struct inode *inode = path->dentry->d_inode;
1573         struct common_audit_data ad;
1574
1575         ad.type = LSM_AUDIT_DATA_PATH;
1576         ad.u.path = *path;
1577         return inode_has_perm(cred, inode, av, &ad, 0);
1578 }
1579
1580 /* Check whether a task can use an open file descriptor to
1581    access an inode in a given way.  Check access to the
1582    descriptor itself, and then use dentry_has_perm to
1583    check a particular permission to the file.
1584    Access to the descriptor is implicitly granted if it
1585    has the same SID as the process.  If av is zero, then
1586    access to the file is not checked, e.g. for cases
1587    where only the descriptor is affected like seek. */
1588 static int file_has_perm(const struct cred *cred,
1589                          struct file *file,
1590                          u32 av)
1591 {
1592         struct file_security_struct *fsec = file->f_security;
1593         struct inode *inode = file_inode(file);
1594         struct common_audit_data ad;
1595         u32 sid = cred_sid(cred);
1596         int rc;
1597
1598         ad.type = LSM_AUDIT_DATA_PATH;
1599         ad.u.path = file->f_path;
1600
1601         if (sid != fsec->sid) {
1602                 rc = avc_has_perm(sid, fsec->sid,
1603                                   SECCLASS_FD,
1604                                   FD__USE,
1605                                   &ad);
1606                 if (rc)
1607                         goto out;
1608         }
1609
1610         /* av is zero if only checking access to the descriptor. */
1611         rc = 0;
1612         if (av)
1613                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1614
1615 out:
1616         return rc;
1617 }
1618
1619 /* Check whether a task can create a file. */
1620 static int may_create(struct inode *dir,
1621                       struct dentry *dentry,
1622                       u16 tclass)
1623 {
1624         const struct task_security_struct *tsec = current_security();
1625         struct inode_security_struct *dsec;
1626         struct superblock_security_struct *sbsec;
1627         u32 sid, newsid;
1628         struct common_audit_data ad;
1629         int rc;
1630
1631         dsec = dir->i_security;
1632         sbsec = dir->i_sb->s_security;
1633
1634         sid = tsec->sid;
1635         newsid = tsec->create_sid;
1636
1637         ad.type = LSM_AUDIT_DATA_DENTRY;
1638         ad.u.dentry = dentry;
1639
1640         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1641                           DIR__ADD_NAME | DIR__SEARCH,
1642                           &ad);
1643         if (rc)
1644                 return rc;
1645
1646         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1647                 rc = security_transition_sid(sid, dsec->sid, tclass,
1648                                              &dentry->d_name, &newsid);
1649                 if (rc)
1650                         return rc;
1651         }
1652
1653         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1654         if (rc)
1655                 return rc;
1656
1657         return avc_has_perm(newsid, sbsec->sid,
1658                             SECCLASS_FILESYSTEM,
1659                             FILESYSTEM__ASSOCIATE, &ad);
1660 }
1661
1662 /* Check whether a task can create a key. */
1663 static int may_create_key(u32 ksid,
1664                           struct task_struct *ctx)
1665 {
1666         u32 sid = task_sid(ctx);
1667
1668         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1669 }
1670
1671 #define MAY_LINK        0
1672 #define MAY_UNLINK      1
1673 #define MAY_RMDIR       2
1674
1675 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1676 static int may_link(struct inode *dir,
1677                     struct dentry *dentry,
1678                     int kind)
1679
1680 {
1681         struct inode_security_struct *dsec, *isec;
1682         struct common_audit_data ad;
1683         u32 sid = current_sid();
1684         u32 av;
1685         int rc;
1686
1687         dsec = dir->i_security;
1688         isec = dentry->d_inode->i_security;
1689
1690         ad.type = LSM_AUDIT_DATA_DENTRY;
1691         ad.u.dentry = dentry;
1692
1693         av = DIR__SEARCH;
1694         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1695         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1696         if (rc)
1697                 return rc;
1698
1699         switch (kind) {
1700         case MAY_LINK:
1701                 av = FILE__LINK;
1702                 break;
1703         case MAY_UNLINK:
1704                 av = FILE__UNLINK;
1705                 break;
1706         case MAY_RMDIR:
1707                 av = DIR__RMDIR;
1708                 break;
1709         default:
1710                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1711                         __func__, kind);
1712                 return 0;
1713         }
1714
1715         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1716         return rc;
1717 }
1718
1719 static inline int may_rename(struct inode *old_dir,
1720                              struct dentry *old_dentry,
1721                              struct inode *new_dir,
1722                              struct dentry *new_dentry)
1723 {
1724         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1725         struct common_audit_data ad;
1726         u32 sid = current_sid();
1727         u32 av;
1728         int old_is_dir, new_is_dir;
1729         int rc;
1730
1731         old_dsec = old_dir->i_security;
1732         old_isec = old_dentry->d_inode->i_security;
1733         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1734         new_dsec = new_dir->i_security;
1735
1736         ad.type = LSM_AUDIT_DATA_DENTRY;
1737
1738         ad.u.dentry = old_dentry;
1739         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1740                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1741         if (rc)
1742                 return rc;
1743         rc = avc_has_perm(sid, old_isec->sid,
1744                           old_isec->sclass, FILE__RENAME, &ad);
1745         if (rc)
1746                 return rc;
1747         if (old_is_dir && new_dir != old_dir) {
1748                 rc = avc_has_perm(sid, old_isec->sid,
1749                                   old_isec->sclass, DIR__REPARENT, &ad);
1750                 if (rc)
1751                         return rc;
1752         }
1753
1754         ad.u.dentry = new_dentry;
1755         av = DIR__ADD_NAME | DIR__SEARCH;
1756         if (new_dentry->d_inode)
1757                 av |= DIR__REMOVE_NAME;
1758         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1759         if (rc)
1760                 return rc;
1761         if (new_dentry->d_inode) {
1762                 new_isec = new_dentry->d_inode->i_security;
1763                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1764                 rc = avc_has_perm(sid, new_isec->sid,
1765                                   new_isec->sclass,
1766                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1767                 if (rc)
1768                         return rc;
1769         }
1770
1771         return 0;
1772 }
1773
1774 /* Check whether a task can perform a filesystem operation. */
1775 static int superblock_has_perm(const struct cred *cred,
1776                                struct super_block *sb,
1777                                u32 perms,
1778                                struct common_audit_data *ad)
1779 {
1780         struct superblock_security_struct *sbsec;
1781         u32 sid = cred_sid(cred);
1782
1783         sbsec = sb->s_security;
1784         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1785 }
1786
1787 /* Convert a Linux mode and permission mask to an access vector. */
1788 static inline u32 file_mask_to_av(int mode, int mask)
1789 {
1790         u32 av = 0;
1791
1792         if (!S_ISDIR(mode)) {
1793                 if (mask & MAY_EXEC)
1794                         av |= FILE__EXECUTE;
1795                 if (mask & MAY_READ)
1796                         av |= FILE__READ;
1797
1798                 if (mask & MAY_APPEND)
1799                         av |= FILE__APPEND;
1800                 else if (mask & MAY_WRITE)
1801                         av |= FILE__WRITE;
1802
1803         } else {
1804                 if (mask & MAY_EXEC)
1805                         av |= DIR__SEARCH;
1806                 if (mask & MAY_WRITE)
1807                         av |= DIR__WRITE;
1808                 if (mask & MAY_READ)
1809                         av |= DIR__READ;
1810         }
1811
1812         return av;
1813 }
1814
1815 /* Convert a Linux file to an access vector. */
1816 static inline u32 file_to_av(struct file *file)
1817 {
1818         u32 av = 0;
1819
1820         if (file->f_mode & FMODE_READ)
1821                 av |= FILE__READ;
1822         if (file->f_mode & FMODE_WRITE) {
1823                 if (file->f_flags & O_APPEND)
1824                         av |= FILE__APPEND;
1825                 else
1826                         av |= FILE__WRITE;
1827         }
1828         if (!av) {
1829                 /*
1830                  * Special file opened with flags 3 for ioctl-only use.
1831                  */
1832                 av = FILE__IOCTL;
1833         }
1834
1835         return av;
1836 }
1837
1838 /*
1839  * Convert a file to an access vector and include the correct open
1840  * open permission.
1841  */
1842 static inline u32 open_file_to_av(struct file *file)
1843 {
1844         u32 av = file_to_av(file);
1845
1846         if (selinux_policycap_openperm)
1847                 av |= FILE__OPEN;
1848
1849         return av;
1850 }
1851
1852 /* Hook functions begin here. */
1853
1854 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1855 {
1856         u32 mysid = current_sid();
1857         u32 mgrsid = task_sid(mgr);
1858
1859         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER, BINDER__SET_CONTEXT_MGR, NULL);
1860 }
1861
1862 static int selinux_binder_transaction(struct task_struct *from, struct task_struct *to)
1863 {
1864         u32 mysid = current_sid();
1865         u32 fromsid = task_sid(from);
1866         u32 tosid = task_sid(to);
1867         int rc;
1868
1869         if (mysid != fromsid) {
1870                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER, BINDER__IMPERSONATE, NULL);
1871                 if (rc)
1872                         return rc;
1873         }
1874
1875         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL, NULL);
1876 }
1877
1878 static int selinux_binder_transfer_binder(struct task_struct *from, struct task_struct *to)
1879 {
1880         u32 fromsid = task_sid(from);
1881         u32 tosid = task_sid(to);
1882         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER, NULL);
1883 }
1884
1885 static int selinux_binder_transfer_file(struct task_struct *from, struct task_struct *to, struct file *file)
1886 {
1887         u32 sid = task_sid(to);
1888         struct file_security_struct *fsec = file->f_security;
1889         struct inode *inode = file->f_path.dentry->d_inode;
1890         struct inode_security_struct *isec = inode->i_security;
1891         struct common_audit_data ad;
1892         struct selinux_audit_data sad = {0,};
1893         int rc;
1894
1895         ad.type = LSM_AUDIT_DATA_PATH;
1896         ad.u.path = file->f_path;
1897         ad.selinux_audit_data = &sad;
1898
1899         if (sid != fsec->sid) {
1900                 rc = avc_has_perm(sid, fsec->sid,
1901                                   SECCLASS_FD,
1902                                   FD__USE,
1903                                   &ad);
1904                 if (rc)
1905                         return rc;
1906         }
1907
1908         if (unlikely(IS_PRIVATE(inode)))
1909                 return 0;
1910
1911         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1912                             &ad);
1913 }
1914
1915 static int selinux_ptrace_access_check(struct task_struct *child,
1916                                      unsigned int mode)
1917 {
1918         int rc;
1919
1920         rc = cap_ptrace_access_check(child, mode);
1921         if (rc)
1922                 return rc;
1923
1924         if (mode & PTRACE_MODE_READ) {
1925                 u32 sid = current_sid();
1926                 u32 csid = task_sid(child);
1927                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1928         }
1929
1930         return current_has_perm(child, PROCESS__PTRACE);
1931 }
1932
1933 static int selinux_ptrace_traceme(struct task_struct *parent)
1934 {
1935         int rc;
1936
1937         rc = cap_ptrace_traceme(parent);
1938         if (rc)
1939                 return rc;
1940
1941         return task_has_perm(parent, current, PROCESS__PTRACE);
1942 }
1943
1944 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1945                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1946 {
1947         int error;
1948
1949         error = current_has_perm(target, PROCESS__GETCAP);
1950         if (error)
1951                 return error;
1952
1953         return cap_capget(target, effective, inheritable, permitted);
1954 }
1955
1956 static int selinux_capset(struct cred *new, const struct cred *old,
1957                           const kernel_cap_t *effective,
1958                           const kernel_cap_t *inheritable,
1959                           const kernel_cap_t *permitted)
1960 {
1961         int error;
1962
1963         error = cap_capset(new, old,
1964                                       effective, inheritable, permitted);
1965         if (error)
1966                 return error;
1967
1968         return cred_has_perm(old, new, PROCESS__SETCAP);
1969 }
1970
1971 /*
1972  * (This comment used to live with the selinux_task_setuid hook,
1973  * which was removed).
1974  *
1975  * Since setuid only affects the current process, and since the SELinux
1976  * controls are not based on the Linux identity attributes, SELinux does not
1977  * need to control this operation.  However, SELinux does control the use of
1978  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1979  */
1980
1981 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1982                            int cap, int audit)
1983 {
1984         int rc;
1985
1986         rc = cap_capable(cred, ns, cap, audit);
1987         if (rc)
1988                 return rc;
1989
1990         return cred_has_capability(cred, cap, audit);
1991 }
1992
1993 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1994 {
1995         const struct cred *cred = current_cred();
1996         int rc = 0;
1997
1998         if (!sb)
1999                 return 0;
2000
2001         switch (cmds) {
2002         case Q_SYNC:
2003         case Q_QUOTAON:
2004         case Q_QUOTAOFF:
2005         case Q_SETINFO:
2006         case Q_SETQUOTA:
2007                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2008                 break;
2009         case Q_GETFMT:
2010         case Q_GETINFO:
2011         case Q_GETQUOTA:
2012                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2013                 break;
2014         default:
2015                 rc = 0;  /* let the kernel handle invalid cmds */
2016                 break;
2017         }
2018         return rc;
2019 }
2020
2021 static int selinux_quota_on(struct dentry *dentry)
2022 {
2023         const struct cred *cred = current_cred();
2024
2025         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2026 }
2027
2028 static int selinux_syslog(int type)
2029 {
2030         int rc;
2031
2032         switch (type) {
2033         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2034         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2035                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2036                 break;
2037         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2038         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2039         /* Set level of messages printed to console */
2040         case SYSLOG_ACTION_CONSOLE_LEVEL:
2041                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2042                 break;
2043         case SYSLOG_ACTION_CLOSE:       /* Close log */
2044         case SYSLOG_ACTION_OPEN:        /* Open log */
2045         case SYSLOG_ACTION_READ:        /* Read from log */
2046         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2047         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2048         default:
2049                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2050                 break;
2051         }
2052         return rc;
2053 }
2054
2055 /*
2056  * Check that a process has enough memory to allocate a new virtual
2057  * mapping. 0 means there is enough memory for the allocation to
2058  * succeed and -ENOMEM implies there is not.
2059  *
2060  * Do not audit the selinux permission check, as this is applied to all
2061  * processes that allocate mappings.
2062  */
2063 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2064 {
2065         int rc, cap_sys_admin = 0;
2066
2067         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2068                              SECURITY_CAP_NOAUDIT);
2069         if (rc == 0)
2070                 cap_sys_admin = 1;
2071
2072         return __vm_enough_memory(mm, pages, cap_sys_admin);
2073 }
2074
2075 /* binprm security operations */
2076
2077 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2078 {
2079         const struct task_security_struct *old_tsec;
2080         struct task_security_struct *new_tsec;
2081         struct inode_security_struct *isec;
2082         struct common_audit_data ad;
2083         struct inode *inode = file_inode(bprm->file);
2084         int rc;
2085
2086         rc = cap_bprm_set_creds(bprm);
2087         if (rc)
2088                 return rc;
2089
2090         /* SELinux context only depends on initial program or script and not
2091          * the script interpreter */
2092         if (bprm->cred_prepared)
2093                 return 0;
2094
2095         old_tsec = current_security();
2096         new_tsec = bprm->cred->security;
2097         isec = inode->i_security;
2098
2099         /* Default to the current task SID. */
2100         new_tsec->sid = old_tsec->sid;
2101         new_tsec->osid = old_tsec->sid;
2102
2103         /* Reset fs, key, and sock SIDs on execve. */
2104         new_tsec->create_sid = 0;
2105         new_tsec->keycreate_sid = 0;
2106         new_tsec->sockcreate_sid = 0;
2107
2108         if (old_tsec->exec_sid) {
2109                 new_tsec->sid = old_tsec->exec_sid;
2110                 /* Reset exec SID on execve. */
2111                 new_tsec->exec_sid = 0;
2112
2113                 /*
2114                  * Minimize confusion: if no_new_privs and a transition is
2115                  * explicitly requested, then fail the exec.
2116                  */
2117                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2118                         return -EPERM;
2119         } else {
2120                 /* Check for a default transition on this program. */
2121                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2122                                              SECCLASS_PROCESS, NULL,
2123                                              &new_tsec->sid);
2124                 if (rc)
2125                         return rc;
2126         }
2127
2128         ad.type = LSM_AUDIT_DATA_PATH;
2129         ad.u.path = bprm->file->f_path;
2130
2131         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2132             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2133                 new_tsec->sid = old_tsec->sid;
2134
2135         if (new_tsec->sid == old_tsec->sid) {
2136                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2137                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2138                 if (rc)
2139                         return rc;
2140         } else {
2141                 /* Check permissions for the transition. */
2142                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2143                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2144                 if (rc)
2145                         return rc;
2146
2147                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2148                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2149                 if (rc)
2150                         return rc;
2151
2152                 /* Check for shared state */
2153                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2154                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2155                                           SECCLASS_PROCESS, PROCESS__SHARE,
2156                                           NULL);
2157                         if (rc)
2158                                 return -EPERM;
2159                 }
2160
2161                 /* Make sure that anyone attempting to ptrace over a task that
2162                  * changes its SID has the appropriate permit */
2163                 if (bprm->unsafe &
2164                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2165                         struct task_struct *tracer;
2166                         struct task_security_struct *sec;
2167                         u32 ptsid = 0;
2168
2169                         rcu_read_lock();
2170                         tracer = ptrace_parent(current);
2171                         if (likely(tracer != NULL)) {
2172                                 sec = __task_cred(tracer)->security;
2173                                 ptsid = sec->sid;
2174                         }
2175                         rcu_read_unlock();
2176
2177                         if (ptsid != 0) {
2178                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2179                                                   SECCLASS_PROCESS,
2180                                                   PROCESS__PTRACE, NULL);
2181                                 if (rc)
2182                                         return -EPERM;
2183                         }
2184                 }
2185
2186                 /* Clear any possibly unsafe personality bits on exec: */
2187                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2188         }
2189
2190         return 0;
2191 }
2192
2193 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2194 {
2195         const struct task_security_struct *tsec = current_security();
2196         u32 sid, osid;
2197         int atsecure = 0;
2198
2199         sid = tsec->sid;
2200         osid = tsec->osid;
2201
2202         if (osid != sid) {
2203                 /* Enable secure mode for SIDs transitions unless
2204                    the noatsecure permission is granted between
2205                    the two SIDs, i.e. ahp returns 0. */
2206                 atsecure = avc_has_perm(osid, sid,
2207                                         SECCLASS_PROCESS,
2208                                         PROCESS__NOATSECURE, NULL);
2209         }
2210
2211         return (atsecure || cap_bprm_secureexec(bprm));
2212 }
2213
2214 static int match_file(const void *p, struct file *file, unsigned fd)
2215 {
2216         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2217 }
2218
2219 /* Derived from fs/exec.c:flush_old_files. */
2220 static inline void flush_unauthorized_files(const struct cred *cred,
2221                                             struct files_struct *files)
2222 {
2223         struct file *file, *devnull = NULL;
2224         struct tty_struct *tty;
2225         int drop_tty = 0;
2226         unsigned n;
2227
2228         tty = get_current_tty();
2229         if (tty) {
2230                 spin_lock(&tty_files_lock);
2231                 if (!list_empty(&tty->tty_files)) {
2232                         struct tty_file_private *file_priv;
2233
2234                         /* Revalidate access to controlling tty.
2235                            Use path_has_perm on the tty path directly rather
2236                            than using file_has_perm, as this particular open
2237                            file may belong to another process and we are only
2238                            interested in the inode-based check here. */
2239                         file_priv = list_first_entry(&tty->tty_files,
2240                                                 struct tty_file_private, list);
2241                         file = file_priv->file;
2242                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2243                                 drop_tty = 1;
2244                 }
2245                 spin_unlock(&tty_files_lock);
2246                 tty_kref_put(tty);
2247         }
2248         /* Reset controlling tty. */
2249         if (drop_tty)
2250                 no_tty();
2251
2252         /* Revalidate access to inherited open files. */
2253         n = iterate_fd(files, 0, match_file, cred);
2254         if (!n) /* none found? */
2255                 return;
2256
2257         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2258         if (IS_ERR(devnull))
2259                 devnull = NULL;
2260         /* replace all the matching ones with this */
2261         do {
2262                 replace_fd(n - 1, devnull, 0);
2263         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2264         if (devnull)
2265                 fput(devnull);
2266 }
2267
2268 /*
2269  * Prepare a process for imminent new credential changes due to exec
2270  */
2271 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2272 {
2273         struct task_security_struct *new_tsec;
2274         struct rlimit *rlim, *initrlim;
2275         int rc, i;
2276
2277         new_tsec = bprm->cred->security;
2278         if (new_tsec->sid == new_tsec->osid)
2279                 return;
2280
2281         /* Close files for which the new task SID is not authorized. */
2282         flush_unauthorized_files(bprm->cred, current->files);
2283
2284         /* Always clear parent death signal on SID transitions. */
2285         current->pdeath_signal = 0;
2286
2287         /* Check whether the new SID can inherit resource limits from the old
2288          * SID.  If not, reset all soft limits to the lower of the current
2289          * task's hard limit and the init task's soft limit.
2290          *
2291          * Note that the setting of hard limits (even to lower them) can be
2292          * controlled by the setrlimit check.  The inclusion of the init task's
2293          * soft limit into the computation is to avoid resetting soft limits
2294          * higher than the default soft limit for cases where the default is
2295          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2296          */
2297         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2298                           PROCESS__RLIMITINH, NULL);
2299         if (rc) {
2300                 /* protect against do_prlimit() */
2301                 task_lock(current);
2302                 for (i = 0; i < RLIM_NLIMITS; i++) {
2303                         rlim = current->signal->rlim + i;
2304                         initrlim = init_task.signal->rlim + i;
2305                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2306                 }
2307                 task_unlock(current);
2308                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2309         }
2310 }
2311
2312 /*
2313  * Clean up the process immediately after the installation of new credentials
2314  * due to exec
2315  */
2316 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2317 {
2318         const struct task_security_struct *tsec = current_security();
2319         struct itimerval itimer;
2320         u32 osid, sid;
2321         int rc, i;
2322
2323         osid = tsec->osid;
2324         sid = tsec->sid;
2325
2326         if (sid == osid)
2327                 return;
2328
2329         /* Check whether the new SID can inherit signal state from the old SID.
2330          * If not, clear itimers to avoid subsequent signal generation and
2331          * flush and unblock signals.
2332          *
2333          * This must occur _after_ the task SID has been updated so that any
2334          * kill done after the flush will be checked against the new SID.
2335          */
2336         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2337         if (rc) {
2338                 memset(&itimer, 0, sizeof itimer);
2339                 for (i = 0; i < 3; i++)
2340                         do_setitimer(i, &itimer, NULL);
2341                 spin_lock_irq(&current->sighand->siglock);
2342                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2343                         __flush_signals(current);
2344                         flush_signal_handlers(current, 1);
2345                         sigemptyset(&current->blocked);
2346                 }
2347                 spin_unlock_irq(&current->sighand->siglock);
2348         }
2349
2350         /* Wake up the parent if it is waiting so that it can recheck
2351          * wait permission to the new task SID. */
2352         read_lock(&tasklist_lock);
2353         __wake_up_parent(current, current->real_parent);
2354         read_unlock(&tasklist_lock);
2355 }
2356
2357 /* superblock security operations */
2358
2359 static int selinux_sb_alloc_security(struct super_block *sb)
2360 {
2361         return superblock_alloc_security(sb);
2362 }
2363
2364 static void selinux_sb_free_security(struct super_block *sb)
2365 {
2366         superblock_free_security(sb);
2367 }
2368
2369 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2370 {
2371         if (plen > olen)
2372                 return 0;
2373
2374         return !memcmp(prefix, option, plen);
2375 }
2376
2377 static inline int selinux_option(char *option, int len)
2378 {
2379         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2380                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2381                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2382                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2383                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2384 }
2385
2386 static inline void take_option(char **to, char *from, int *first, int len)
2387 {
2388         if (!*first) {
2389                 **to = ',';
2390                 *to += 1;
2391         } else
2392                 *first = 0;
2393         memcpy(*to, from, len);
2394         *to += len;
2395 }
2396
2397 static inline void take_selinux_option(char **to, char *from, int *first,
2398                                        int len)
2399 {
2400         int current_size = 0;
2401
2402         if (!*first) {
2403                 **to = '|';
2404                 *to += 1;
2405         } else
2406                 *first = 0;
2407
2408         while (current_size < len) {
2409                 if (*from != '"') {
2410                         **to = *from;
2411                         *to += 1;
2412                 }
2413                 from += 1;
2414                 current_size += 1;
2415         }
2416 }
2417
2418 static int selinux_sb_copy_data(char *orig, char *copy)
2419 {
2420         int fnosec, fsec, rc = 0;
2421         char *in_save, *in_curr, *in_end;
2422         char *sec_curr, *nosec_save, *nosec;
2423         int open_quote = 0;
2424
2425         in_curr = orig;
2426         sec_curr = copy;
2427
2428         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2429         if (!nosec) {
2430                 rc = -ENOMEM;
2431                 goto out;
2432         }
2433
2434         nosec_save = nosec;
2435         fnosec = fsec = 1;
2436         in_save = in_end = orig;
2437
2438         do {
2439                 if (*in_end == '"')
2440                         open_quote = !open_quote;
2441                 if ((*in_end == ',' && open_quote == 0) ||
2442                                 *in_end == '\0') {
2443                         int len = in_end - in_curr;
2444
2445                         if (selinux_option(in_curr, len))
2446                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2447                         else
2448                                 take_option(&nosec, in_curr, &fnosec, len);
2449
2450                         in_curr = in_end + 1;
2451                 }
2452         } while (*in_end++);
2453
2454         strcpy(in_save, nosec_save);
2455         free_page((unsigned long)nosec_save);
2456 out:
2457         return rc;
2458 }
2459
2460 static int selinux_sb_remount(struct super_block *sb, void *data)
2461 {
2462         int rc, i, *flags;
2463         struct security_mnt_opts opts;
2464         char *secdata, **mount_options;
2465         struct superblock_security_struct *sbsec = sb->s_security;
2466
2467         if (!(sbsec->flags & SE_SBINITIALIZED))
2468                 return 0;
2469
2470         if (!data)
2471                 return 0;
2472
2473         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2474                 return 0;
2475
2476         security_init_mnt_opts(&opts);
2477         secdata = alloc_secdata();
2478         if (!secdata)
2479                 return -ENOMEM;
2480         rc = selinux_sb_copy_data(data, secdata);
2481         if (rc)
2482                 goto out_free_secdata;
2483
2484         rc = selinux_parse_opts_str(secdata, &opts);
2485         if (rc)
2486                 goto out_free_secdata;
2487
2488         mount_options = opts.mnt_opts;
2489         flags = opts.mnt_opts_flags;
2490
2491         for (i = 0; i < opts.num_mnt_opts; i++) {
2492                 u32 sid;
2493                 size_t len;
2494
2495                 if (flags[i] == SE_SBLABELSUPP)
2496                         continue;
2497                 len = strlen(mount_options[i]);
2498                 rc = security_context_to_sid(mount_options[i], len, &sid);
2499                 if (rc) {
2500                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2501                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2502                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2503                         goto out_free_opts;
2504                 }
2505                 rc = -EINVAL;
2506                 switch (flags[i]) {
2507                 case FSCONTEXT_MNT:
2508                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2509                                 goto out_bad_option;
2510                         break;
2511                 case CONTEXT_MNT:
2512                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2513                                 goto out_bad_option;
2514                         break;
2515                 case ROOTCONTEXT_MNT: {
2516                         struct inode_security_struct *root_isec;
2517                         root_isec = sb->s_root->d_inode->i_security;
2518
2519                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2520                                 goto out_bad_option;
2521                         break;
2522                 }
2523                 case DEFCONTEXT_MNT:
2524                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2525                                 goto out_bad_option;
2526                         break;
2527                 default:
2528                         goto out_free_opts;
2529                 }
2530         }
2531
2532         rc = 0;
2533 out_free_opts:
2534         security_free_mnt_opts(&opts);
2535 out_free_secdata:
2536         free_secdata(secdata);
2537         return rc;
2538 out_bad_option:
2539         printk(KERN_WARNING "SELinux: unable to change security options "
2540                "during remount (dev %s, type=%s)\n", sb->s_id,
2541                sb->s_type->name);
2542         goto out_free_opts;
2543 }
2544
2545 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2546 {
2547         const struct cred *cred = current_cred();
2548         struct common_audit_data ad;
2549         int rc;
2550
2551         rc = superblock_doinit(sb, data);
2552         if (rc)
2553                 return rc;
2554
2555         /* Allow all mounts performed by the kernel */
2556         if (flags & MS_KERNMOUNT)
2557                 return 0;
2558
2559         ad.type = LSM_AUDIT_DATA_DENTRY;
2560         ad.u.dentry = sb->s_root;
2561         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2562 }
2563
2564 static int selinux_sb_statfs(struct dentry *dentry)
2565 {
2566         const struct cred *cred = current_cred();
2567         struct common_audit_data ad;
2568
2569         ad.type = LSM_AUDIT_DATA_DENTRY;
2570         ad.u.dentry = dentry->d_sb->s_root;
2571         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2572 }
2573
2574 static int selinux_mount(const char *dev_name,
2575                          struct path *path,
2576                          const char *type,
2577                          unsigned long flags,
2578                          void *data)
2579 {
2580         const struct cred *cred = current_cred();
2581
2582         if (flags & MS_REMOUNT)
2583                 return superblock_has_perm(cred, path->dentry->d_sb,
2584                                            FILESYSTEM__REMOUNT, NULL);
2585         else
2586                 return path_has_perm(cred, path, FILE__MOUNTON);
2587 }
2588
2589 static int selinux_umount(struct vfsmount *mnt, int flags)
2590 {
2591         const struct cred *cred = current_cred();
2592
2593         return superblock_has_perm(cred, mnt->mnt_sb,
2594                                    FILESYSTEM__UNMOUNT, NULL);
2595 }
2596
2597 /* inode security operations */
2598
2599 static int selinux_inode_alloc_security(struct inode *inode)
2600 {
2601         return inode_alloc_security(inode);
2602 }
2603
2604 static void selinux_inode_free_security(struct inode *inode)
2605 {
2606         inode_free_security(inode);
2607 }
2608
2609 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2610                                        const struct qstr *qstr, char **name,
2611                                        void **value, size_t *len)
2612 {
2613         const struct task_security_struct *tsec = current_security();
2614         struct inode_security_struct *dsec;
2615         struct superblock_security_struct *sbsec;
2616         u32 sid, newsid, clen;
2617         int rc;
2618         char *namep = NULL, *context;
2619
2620         dsec = dir->i_security;
2621         sbsec = dir->i_sb->s_security;
2622
2623         sid = tsec->sid;
2624         newsid = tsec->create_sid;
2625
2626         if ((sbsec->flags & SE_SBINITIALIZED) &&
2627             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2628                 newsid = sbsec->mntpoint_sid;
2629         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2630                 rc = security_transition_sid(sid, dsec->sid,
2631                                              inode_mode_to_security_class(inode->i_mode),
2632                                              qstr, &newsid);
2633                 if (rc) {
2634                         printk(KERN_WARNING "%s:  "
2635                                "security_transition_sid failed, rc=%d (dev=%s "
2636                                "ino=%ld)\n",
2637                                __func__,
2638                                -rc, inode->i_sb->s_id, inode->i_ino);
2639                         return rc;
2640                 }
2641         }
2642
2643         /* Possibly defer initialization to selinux_complete_init. */
2644         if (sbsec->flags & SE_SBINITIALIZED) {
2645                 struct inode_security_struct *isec = inode->i_security;
2646                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2647                 isec->sid = newsid;
2648                 isec->initialized = 1;
2649         }
2650
2651         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2652                 return -EOPNOTSUPP;
2653
2654         if (name) {
2655                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2656                 if (!namep)
2657                         return -ENOMEM;
2658                 *name = namep;
2659         }
2660
2661         if (value && len) {
2662                 rc = security_sid_to_context_force(newsid, &context, &clen);
2663                 if (rc) {
2664                         kfree(namep);
2665                         return rc;
2666                 }
2667                 *value = context;
2668                 *len = clen;
2669         }
2670
2671         return 0;
2672 }
2673
2674 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2675 {
2676         return may_create(dir, dentry, SECCLASS_FILE);
2677 }
2678
2679 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2680 {
2681         return may_link(dir, old_dentry, MAY_LINK);
2682 }
2683
2684 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2685 {
2686         return may_link(dir, dentry, MAY_UNLINK);
2687 }
2688
2689 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2690 {
2691         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2692 }
2693
2694 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2695 {
2696         return may_create(dir, dentry, SECCLASS_DIR);
2697 }
2698
2699 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2700 {
2701         return may_link(dir, dentry, MAY_RMDIR);
2702 }
2703
2704 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2705 {
2706         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2707 }
2708
2709 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2710                                 struct inode *new_inode, struct dentry *new_dentry)
2711 {
2712         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2713 }
2714
2715 static int selinux_inode_readlink(struct dentry *dentry)
2716 {
2717         const struct cred *cred = current_cred();
2718
2719         return dentry_has_perm(cred, dentry, FILE__READ);
2720 }
2721
2722 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2723 {
2724         const struct cred *cred = current_cred();
2725
2726         return dentry_has_perm(cred, dentry, FILE__READ);
2727 }
2728
2729 static noinline int audit_inode_permission(struct inode *inode,
2730                                            u32 perms, u32 audited, u32 denied,
2731                                            int result,
2732                                            unsigned flags)
2733 {
2734         struct common_audit_data ad;
2735         struct inode_security_struct *isec = inode->i_security;
2736         int rc;
2737
2738         ad.type = LSM_AUDIT_DATA_INODE;
2739         ad.u.inode = inode;
2740
2741         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2742                             audited, denied, result, &ad, flags);
2743         if (rc)
2744                 return rc;
2745         return 0;
2746 }
2747
2748 static int selinux_inode_permission(struct inode *inode, int mask)
2749 {
2750         const struct cred *cred = current_cred();
2751         u32 perms;
2752         bool from_access;
2753         unsigned flags = mask & MAY_NOT_BLOCK;
2754         struct inode_security_struct *isec;
2755         u32 sid;
2756         struct av_decision avd;
2757         int rc, rc2;
2758         u32 audited, denied;
2759
2760         from_access = mask & MAY_ACCESS;
2761         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2762
2763         /* No permission to check.  Existence test. */
2764         if (!mask)
2765                 return 0;
2766
2767         validate_creds(cred);
2768
2769         if (unlikely(IS_PRIVATE(inode)))
2770                 return 0;
2771
2772         perms = file_mask_to_av(inode->i_mode, mask);
2773
2774         sid = cred_sid(cred);
2775         isec = inode->i_security;
2776
2777         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2778         audited = avc_audit_required(perms, &avd, rc,
2779                                      from_access ? FILE__AUDIT_ACCESS : 0,
2780                                      &denied);
2781         if (likely(!audited))
2782                 return rc;
2783
2784         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2785         if (rc2)
2786                 return rc2;
2787         return rc;
2788 }
2789
2790 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2791 {
2792         const struct cred *cred = current_cred();
2793         unsigned int ia_valid = iattr->ia_valid;
2794         __u32 av = FILE__WRITE;
2795
2796         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2797         if (ia_valid & ATTR_FORCE) {
2798                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2799                               ATTR_FORCE);
2800                 if (!ia_valid)
2801                         return 0;
2802         }
2803
2804         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2805                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2806                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2807
2808         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2809                 av |= FILE__OPEN;
2810
2811         return dentry_has_perm(cred, dentry, av);
2812 }
2813
2814 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2815 {
2816         const struct cred *cred = current_cred();
2817         struct path path;
2818
2819         path.dentry = dentry;
2820         path.mnt = mnt;
2821
2822         return path_has_perm(cred, &path, FILE__GETATTR);
2823 }
2824
2825 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2826 {
2827         const struct cred *cred = current_cred();
2828
2829         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2830                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2831                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2832                         if (!capable(CAP_SETFCAP))
2833                                 return -EPERM;
2834                 } else if (!capable(CAP_SYS_ADMIN)) {
2835                         /* A different attribute in the security namespace.
2836                            Restrict to administrator. */
2837                         return -EPERM;
2838                 }
2839         }
2840
2841         /* Not an attribute we recognize, so just check the
2842            ordinary setattr permission. */
2843         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2844 }
2845
2846 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2847                                   const void *value, size_t size, int flags)
2848 {
2849         struct inode *inode = dentry->d_inode;
2850         struct inode_security_struct *isec = inode->i_security;
2851         struct superblock_security_struct *sbsec;
2852         struct common_audit_data ad;
2853         u32 newsid, sid = current_sid();
2854         int rc = 0;
2855
2856         if (strcmp(name, XATTR_NAME_SELINUX))
2857                 return selinux_inode_setotherxattr(dentry, name);
2858
2859         sbsec = inode->i_sb->s_security;
2860         if (!(sbsec->flags & SE_SBLABELSUPP))
2861                 return -EOPNOTSUPP;
2862
2863         if (!inode_owner_or_capable(inode))
2864                 return -EPERM;
2865
2866         ad.type = LSM_AUDIT_DATA_DENTRY;
2867         ad.u.dentry = dentry;
2868
2869         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2870                           FILE__RELABELFROM, &ad);
2871         if (rc)
2872                 return rc;
2873
2874         rc = security_context_to_sid(value, size, &newsid);
2875         if (rc == -EINVAL) {
2876                 if (!capable(CAP_MAC_ADMIN)) {
2877                         struct audit_buffer *ab;
2878                         size_t audit_size;
2879                         const char *str;
2880
2881                         /* We strip a nul only if it is at the end, otherwise the
2882                          * context contains a nul and we should audit that */
2883                         if (value) {
2884                                 str = value;
2885                                 if (str[size - 1] == '\0')
2886                                         audit_size = size - 1;
2887                                 else
2888                                         audit_size = size;
2889                         } else {
2890                                 str = "";
2891                                 audit_size = 0;
2892                         }
2893                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2894                         audit_log_format(ab, "op=setxattr invalid_context=");
2895                         audit_log_n_untrustedstring(ab, value, audit_size);
2896                         audit_log_end(ab);
2897
2898                         return rc;
2899                 }
2900                 rc = security_context_to_sid_force(value, size, &newsid);
2901         }
2902         if (rc)
2903                 return rc;
2904
2905         rc = avc_has_perm(sid, newsid, isec->sclass,
2906                           FILE__RELABELTO, &ad);
2907         if (rc)
2908                 return rc;
2909
2910         rc = security_validate_transition(isec->sid, newsid, sid,
2911                                           isec->sclass);
2912         if (rc)
2913                 return rc;
2914
2915         return avc_has_perm(newsid,
2916                             sbsec->sid,
2917                             SECCLASS_FILESYSTEM,
2918                             FILESYSTEM__ASSOCIATE,
2919                             &ad);
2920 }
2921
2922 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2923                                         const void *value, size_t size,
2924                                         int flags)
2925 {
2926         struct inode *inode = dentry->d_inode;
2927         struct inode_security_struct *isec = inode->i_security;
2928         u32 newsid;
2929         int rc;
2930
2931         if (strcmp(name, XATTR_NAME_SELINUX)) {
2932                 /* Not an attribute we recognize, so nothing to do. */
2933                 return;
2934         }
2935
2936         rc = security_context_to_sid_force(value, size, &newsid);
2937         if (rc) {
2938                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2939                        "for (%s, %lu), rc=%d\n",
2940                        inode->i_sb->s_id, inode->i_ino, -rc);
2941                 return;
2942         }
2943
2944         isec->sid = newsid;
2945         return;
2946 }
2947
2948 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2949 {
2950         const struct cred *cred = current_cred();
2951
2952         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2953 }
2954
2955 static int selinux_inode_listxattr(struct dentry *dentry)
2956 {
2957         const struct cred *cred = current_cred();
2958
2959         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2960 }
2961
2962 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2963 {
2964         if (strcmp(name, XATTR_NAME_SELINUX))
2965                 return selinux_inode_setotherxattr(dentry, name);
2966
2967         /* No one is allowed to remove a SELinux security label.
2968            You can change the label, but all data must be labeled. */
2969         return -EACCES;
2970 }
2971
2972 /*
2973  * Copy the inode security context value to the user.
2974  *
2975  * Permission check is handled by selinux_inode_getxattr hook.
2976  */
2977 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2978 {
2979         u32 size;
2980         int error;
2981         char *context = NULL;
2982         struct inode_security_struct *isec = inode->i_security;
2983
2984         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2985                 return -EOPNOTSUPP;
2986
2987         /*
2988          * If the caller has CAP_MAC_ADMIN, then get the raw context
2989          * value even if it is not defined by current policy; otherwise,
2990          * use the in-core value under current policy.
2991          * Use the non-auditing forms of the permission checks since
2992          * getxattr may be called by unprivileged processes commonly
2993          * and lack of permission just means that we fall back to the
2994          * in-core context value, not a denial.
2995          */
2996         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2997                                 SECURITY_CAP_NOAUDIT);
2998         if (!error)
2999                 error = security_sid_to_context_force(isec->sid, &context,
3000                                                       &size);
3001         else
3002                 error = security_sid_to_context(isec->sid, &context, &size);
3003         if (error)
3004                 return error;
3005         error = size;
3006         if (alloc) {
3007                 *buffer = context;
3008                 goto out_nofree;
3009         }
3010         kfree(context);
3011 out_nofree:
3012         return error;
3013 }
3014
3015 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3016                                      const void *value, size_t size, int flags)
3017 {
3018         struct inode_security_struct *isec = inode->i_security;
3019         u32 newsid;
3020         int rc;
3021
3022         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3023                 return -EOPNOTSUPP;
3024
3025         if (!value || !size)
3026                 return -EACCES;
3027
3028         rc = security_context_to_sid((void *)value, size, &newsid);
3029         if (rc)
3030                 return rc;
3031
3032         isec->sid = newsid;
3033         isec->initialized = 1;
3034         return 0;
3035 }
3036
3037 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3038 {
3039         const int len = sizeof(XATTR_NAME_SELINUX);
3040         if (buffer && len <= buffer_size)
3041                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3042         return len;
3043 }
3044
3045 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3046 {
3047         struct inode_security_struct *isec = inode->i_security;
3048         *secid = isec->sid;
3049 }
3050
3051 /* file security operations */
3052
3053 static int selinux_revalidate_file_permission(struct file *file, int mask)
3054 {
3055         const struct cred *cred = current_cred();
3056         struct inode *inode = file_inode(file);
3057
3058         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3059         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3060                 mask |= MAY_APPEND;
3061
3062         return file_has_perm(cred, file,
3063                              file_mask_to_av(inode->i_mode, mask));
3064 }
3065
3066 static int selinux_file_permission(struct file *file, int mask)
3067 {
3068         struct inode *inode = file_inode(file);
3069         struct file_security_struct *fsec = file->f_security;
3070         struct inode_security_struct *isec = inode->i_security;
3071         u32 sid = current_sid();
3072
3073         if (!mask)
3074                 /* No permission to check.  Existence test. */
3075                 return 0;
3076
3077         if (sid == fsec->sid && fsec->isid == isec->sid &&
3078             fsec->pseqno == avc_policy_seqno())
3079                 /* No change since file_open check. */
3080                 return 0;
3081
3082         return selinux_revalidate_file_permission(file, mask);
3083 }
3084
3085 static int selinux_file_alloc_security(struct file *file)
3086 {
3087         return file_alloc_security(file);
3088 }
3089
3090 static void selinux_file_free_security(struct file *file)
3091 {
3092         file_free_security(file);
3093 }
3094
3095 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3096                               unsigned long arg)
3097 {
3098         const struct cred *cred = current_cred();
3099         int error = 0;
3100
3101         switch (cmd) {
3102         case FIONREAD:
3103         /* fall through */
3104         case FIBMAP:
3105         /* fall through */
3106         case FIGETBSZ:
3107         /* fall through */
3108         case FS_IOC_GETFLAGS:
3109         /* fall through */
3110         case FS_IOC_GETVERSION:
3111                 error = file_has_perm(cred, file, FILE__GETATTR);
3112                 break;
3113
3114         case FS_IOC_SETFLAGS:
3115         /* fall through */
3116         case FS_IOC_SETVERSION:
3117                 error = file_has_perm(cred, file, FILE__SETATTR);
3118                 break;
3119
3120         /* sys_ioctl() checks */
3121         case FIONBIO:
3122         /* fall through */
3123         case FIOASYNC:
3124                 error = file_has_perm(cred, file, 0);
3125                 break;
3126
3127         case KDSKBENT:
3128         case KDSKBSENT:
3129                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3130                                             SECURITY_CAP_AUDIT);
3131                 break;
3132
3133         /* default case assumes that the command will go
3134          * to the file's ioctl() function.
3135          */
3136         default:
3137                 error = file_has_perm(cred, file, FILE__IOCTL);
3138         }
3139         return error;
3140 }
3141
3142 static int default_noexec;
3143
3144 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3145 {
3146         const struct cred *cred = current_cred();
3147         int rc = 0;
3148
3149         if (default_noexec &&
3150             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3151                 /*
3152                  * We are making executable an anonymous mapping or a
3153                  * private file mapping that will also be writable.
3154                  * This has an additional check.
3155                  */
3156                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3157                 if (rc)
3158                         goto error;
3159         }
3160
3161         if (file) {
3162                 /* read access is always possible with a mapping */
3163                 u32 av = FILE__READ;
3164
3165                 /* write access only matters if the mapping is shared */
3166                 if (shared && (prot & PROT_WRITE))
3167                         av |= FILE__WRITE;
3168
3169                 if (prot & PROT_EXEC)
3170                         av |= FILE__EXECUTE;
3171
3172                 return file_has_perm(cred, file, av);
3173         }
3174
3175 error:
3176         return rc;
3177 }
3178
3179 static int selinux_mmap_addr(unsigned long addr)
3180 {
3181         int rc = 0;
3182         u32 sid = current_sid();
3183
3184         /*
3185          * notice that we are intentionally putting the SELinux check before
3186          * the secondary cap_file_mmap check.  This is such a likely attempt
3187          * at bad behaviour/exploit that we always want to get the AVC, even
3188          * if DAC would have also denied the operation.
3189          */
3190         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3191                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3192                                   MEMPROTECT__MMAP_ZERO, NULL);
3193                 if (rc)
3194                         return rc;
3195         }
3196
3197         /* do DAC check on address space usage */
3198         return cap_mmap_addr(addr);
3199 }
3200
3201 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3202                              unsigned long prot, unsigned long flags)
3203 {
3204         if (selinux_checkreqprot)
3205                 prot = reqprot;
3206
3207         return file_map_prot_check(file, prot,
3208                                    (flags & MAP_TYPE) == MAP_SHARED);
3209 }
3210
3211 static int selinux_file_mprotect(struct vm_area_struct *vma,
3212                                  unsigned long reqprot,
3213                                  unsigned long prot)
3214 {
3215         const struct cred *cred = current_cred();
3216
3217         if (selinux_checkreqprot)
3218                 prot = reqprot;
3219
3220         if (default_noexec &&
3221             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3222                 int rc = 0;
3223                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3224                     vma->vm_end <= vma->vm_mm->brk) {
3225                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3226                 } else if (!vma->vm_file &&
3227                            vma->vm_start <= vma->vm_mm->start_stack &&
3228                            vma->vm_end >= vma->vm_mm->start_stack) {
3229                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3230                 } else if (vma->vm_file && vma->anon_vma) {
3231                         /*
3232                          * We are making executable a file mapping that has
3233                          * had some COW done. Since pages might have been
3234                          * written, check ability to execute the possibly
3235                          * modified content.  This typically should only
3236                          * occur for text relocations.
3237                          */
3238                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3239                 }
3240                 if (rc)
3241                         return rc;
3242         }
3243
3244         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3245 }
3246
3247 static int selinux_file_lock(struct file *file, unsigned int cmd)
3248 {
3249         const struct cred *cred = current_cred();
3250
3251         return file_has_perm(cred, file, FILE__LOCK);
3252 }
3253
3254 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3255                               unsigned long arg)
3256 {
3257         const struct cred *cred = current_cred();
3258         int err = 0;
3259
3260         switch (cmd) {
3261         case F_SETFL:
3262                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3263                         err = file_has_perm(cred, file, FILE__WRITE);
3264                         break;
3265                 }
3266                 /* fall through */
3267         case F_SETOWN:
3268         case F_SETSIG:
3269         case F_GETFL:
3270         case F_GETOWN:
3271         case F_GETSIG:
3272         case F_GETOWNER_UIDS:
3273                 /* Just check FD__USE permission */
3274                 err = file_has_perm(cred, file, 0);
3275                 break;
3276         case F_GETLK:
3277         case F_SETLK:
3278         case F_SETLKW:
3279 #if BITS_PER_LONG == 32
3280         case F_GETLK64:
3281         case F_SETLK64:
3282         case F_SETLKW64:
3283 #endif
3284                 err = file_has_perm(cred, file, FILE__LOCK);
3285                 break;
3286         }
3287
3288         return err;
3289 }
3290
3291 static int selinux_file_set_fowner(struct file *file)
3292 {
3293         struct file_security_struct *fsec;
3294
3295         fsec = file->f_security;
3296         fsec->fown_sid = current_sid();
3297
3298         return 0;
3299 }
3300
3301 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3302                                        struct fown_struct *fown, int signum)
3303 {
3304         struct file *file;
3305         u32 sid = task_sid(tsk);
3306         u32 perm;
3307         struct file_security_struct *fsec;
3308
3309         /* struct fown_struct is never outside the context of a struct file */
3310         file = container_of(fown, struct file, f_owner);
3311
3312         fsec = file->f_security;
3313
3314         if (!signum)
3315                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3316         else
3317                 perm = signal_to_av(signum);
3318
3319         return avc_has_perm(fsec->fown_sid, sid,
3320                             SECCLASS_PROCESS, perm, NULL);
3321 }
3322
3323 static int selinux_file_receive(struct file *file)
3324 {
3325         const struct cred *cred = current_cred();
3326
3327         return file_has_perm(cred, file, file_to_av(file));
3328 }
3329
3330 static int selinux_file_open(struct file *file, const struct cred *cred)
3331 {
3332         struct file_security_struct *fsec;
3333         struct inode_security_struct *isec;
3334
3335         fsec = file->f_security;
3336         isec = file_inode(file)->i_security;
3337         /*
3338          * Save inode label and policy sequence number
3339          * at open-time so that selinux_file_permission
3340          * can determine whether revalidation is necessary.
3341          * Task label is already saved in the file security
3342          * struct as its SID.
3343          */
3344         fsec->isid = isec->sid;
3345         fsec->pseqno = avc_policy_seqno();
3346         /*
3347          * Since the inode label or policy seqno may have changed
3348          * between the selinux_inode_permission check and the saving
3349          * of state above, recheck that access is still permitted.
3350          * Otherwise, access might never be revalidated against the
3351          * new inode label or new policy.
3352          * This check is not redundant - do not remove.
3353          */
3354         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3355 }
3356
3357 /* task security operations */
3358
3359 static int selinux_task_create(unsigned long clone_flags)
3360 {
3361         return current_has_perm(current, PROCESS__FORK);
3362 }
3363
3364 /*
3365  * allocate the SELinux part of blank credentials
3366  */
3367 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3368 {
3369         struct task_security_struct *tsec;
3370
3371         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3372         if (!tsec)
3373                 return -ENOMEM;
3374
3375         cred->security = tsec;
3376         return 0;
3377 }
3378
3379 /*
3380  * detach and free the LSM part of a set of credentials
3381  */
3382 static void selinux_cred_free(struct cred *cred)
3383 {
3384         struct task_security_struct *tsec = cred->security;
3385
3386         /*
3387          * cred->security == NULL if security_cred_alloc_blank() or
3388          * security_prepare_creds() returned an error.
3389          */
3390         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3391         cred->security = (void *) 0x7UL;
3392         kfree(tsec);
3393 }
3394
3395 /*
3396  * prepare a new set of credentials for modification
3397  */
3398 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3399                                 gfp_t gfp)
3400 {
3401         const struct task_security_struct *old_tsec;
3402         struct task_security_struct *tsec;
3403
3404         old_tsec = old->security;
3405
3406         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3407         if (!tsec)
3408                 return -ENOMEM;
3409
3410         new->security = tsec;
3411         return 0;
3412 }
3413
3414 /*
3415  * transfer the SELinux data to a blank set of creds
3416  */
3417 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3418 {
3419         const struct task_security_struct *old_tsec = old->security;
3420         struct task_security_struct *tsec = new->security;
3421
3422         *tsec = *old_tsec;
3423 }
3424
3425 /*
3426  * set the security data for a kernel service
3427  * - all the creation contexts are set to unlabelled
3428  */
3429 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3430 {
3431         struct task_security_struct *tsec = new->security;
3432         u32 sid = current_sid();
3433         int ret;
3434
3435         ret = avc_has_perm(sid, secid,
3436                            SECCLASS_KERNEL_SERVICE,
3437                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3438                            NULL);
3439         if (ret == 0) {
3440                 tsec->sid = secid;
3441                 tsec->create_sid = 0;
3442                 tsec->keycreate_sid = 0;
3443                 tsec->sockcreate_sid = 0;
3444         }
3445         return ret;
3446 }
3447
3448 /*
3449  * set the file creation context in a security record to the same as the
3450  * objective context of the specified inode
3451  */
3452 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3453 {
3454         struct inode_security_struct *isec = inode->i_security;
3455         struct task_security_struct *tsec = new->security;
3456         u32 sid = current_sid();
3457         int ret;
3458
3459         ret = avc_has_perm(sid, isec->sid,
3460                            SECCLASS_KERNEL_SERVICE,
3461                            KERNEL_SERVICE__CREATE_FILES_AS,
3462                            NULL);
3463
3464         if (ret == 0)
3465                 tsec->create_sid = isec->sid;
3466         return ret;
3467 }
3468
3469 static int selinux_kernel_module_request(char *kmod_name)
3470 {
3471         u32 sid;
3472         struct common_audit_data ad;
3473
3474         sid = task_sid(current);
3475
3476         ad.type = LSM_AUDIT_DATA_KMOD;
3477         ad.u.kmod_name = kmod_name;
3478
3479         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3480                             SYSTEM__MODULE_REQUEST, &ad);
3481 }
3482
3483 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3484 {
3485         return current_has_perm(p, PROCESS__SETPGID);
3486 }
3487
3488 static int selinux_task_getpgid(struct task_struct *p)
3489 {
3490         return current_has_perm(p, PROCESS__GETPGID);
3491 }
3492
3493 static int selinux_task_getsid(struct task_struct *p)
3494 {
3495         return current_has_perm(p, PROCESS__GETSESSION);
3496 }
3497
3498 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3499 {
3500         *secid = task_sid(p);
3501 }
3502
3503 static int selinux_task_setnice(struct task_struct *p, int nice)
3504 {
3505         int rc;
3506
3507         rc = cap_task_setnice(p, nice);
3508         if (rc)
3509                 return rc;
3510
3511         return current_has_perm(p, PROCESS__SETSCHED);
3512 }
3513
3514 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3515 {
3516         int rc;
3517
3518         rc = cap_task_setioprio(p, ioprio);
3519         if (rc)
3520                 return rc;
3521
3522         return current_has_perm(p, PROCESS__SETSCHED);
3523 }
3524
3525 static int selinux_task_getioprio(struct task_struct *p)
3526 {
3527         return current_has_perm(p, PROCESS__GETSCHED);
3528 }
3529
3530 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3531                 struct rlimit *new_rlim)
3532 {
3533         struct rlimit *old_rlim = p->signal->rlim + resource;
3534
3535         /* Control the ability to change the hard limit (whether
3536            lowering or raising it), so that the hard limit can
3537            later be used as a safe reset point for the soft limit
3538            upon context transitions.  See selinux_bprm_committing_creds. */
3539         if (old_rlim->rlim_max != new_rlim->rlim_max)
3540                 return current_has_perm(p, PROCESS__SETRLIMIT);
3541
3542         return 0;
3543 }
3544
3545 static int selinux_task_setscheduler(struct task_struct *p)
3546 {
3547         int rc;
3548
3549         rc = cap_task_setscheduler(p);
3550         if (rc)
3551                 return rc;
3552
3553         return current_has_perm(p, PROCESS__SETSCHED);
3554 }
3555
3556 static int selinux_task_getscheduler(struct task_struct *p)
3557 {
3558         return current_has_perm(p, PROCESS__GETSCHED);
3559 }
3560
3561 static int selinux_task_movememory(struct task_struct *p)
3562 {
3563         return current_has_perm(p, PROCESS__SETSCHED);
3564 }
3565
3566 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3567                                 int sig, u32 secid)
3568 {
3569         u32 perm;
3570         int rc;
3571
3572         if (!sig)
3573                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3574         else
3575                 perm = signal_to_av(sig);
3576         if (secid)
3577                 rc = avc_has_perm(secid, task_sid(p),
3578                                   SECCLASS_PROCESS, perm, NULL);
3579         else
3580                 rc = current_has_perm(p, perm);
3581         return rc;
3582 }
3583
3584 static int selinux_task_wait(struct task_struct *p)
3585 {
3586         return task_has_perm(p, current, PROCESS__SIGCHLD);
3587 }
3588
3589 static void selinux_task_to_inode(struct task_struct *p,
3590                                   struct inode *inode)
3591 {
3592         struct inode_security_struct *isec = inode->i_security;
3593         u32 sid = task_sid(p);
3594
3595         isec->sid = sid;
3596         isec->initialized = 1;
3597 }
3598
3599 /* Returns error only if unable to parse addresses */
3600 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3601                         struct common_audit_data *ad, u8 *proto)
3602 {
3603         int offset, ihlen, ret = -EINVAL;
3604         struct iphdr _iph, *ih;
3605
3606         offset = skb_network_offset(skb);
3607         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3608         if (ih == NULL)
3609                 goto out;
3610
3611         ihlen = ih->ihl * 4;
3612         if (ihlen < sizeof(_iph))
3613                 goto out;
3614
3615         ad->u.net->v4info.saddr = ih->saddr;
3616         ad->u.net->v4info.daddr = ih->daddr;
3617         ret = 0;
3618
3619         if (proto)
3620                 *proto = ih->protocol;
3621
3622         switch (ih->protocol) {
3623         case IPPROTO_TCP: {
3624                 struct tcphdr _tcph, *th;
3625
3626                 if (ntohs(ih->frag_off) & IP_OFFSET)
3627                         break;
3628
3629                 offset += ihlen;
3630                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3631                 if (th == NULL)
3632                         break;
3633
3634                 ad->u.net->sport = th->source;
3635                 ad->u.net->dport = th->dest;
3636                 break;
3637         }
3638
3639         case IPPROTO_UDP: {
3640                 struct udphdr _udph, *uh;
3641
3642                 if (ntohs(ih->frag_off) & IP_OFFSET)
3643                         break;
3644
3645                 offset += ihlen;
3646                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3647                 if (uh == NULL)
3648                         break;
3649
3650                 ad->u.net->sport = uh->source;
3651                 ad->u.net->dport = uh->dest;
3652                 break;
3653         }
3654
3655         case IPPROTO_DCCP: {
3656                 struct dccp_hdr _dccph, *dh;
3657
3658                 if (ntohs(ih->frag_off) & IP_OFFSET)
3659                         break;
3660
3661                 offset += ihlen;
3662                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3663                 if (dh == NULL)
3664                         break;
3665
3666                 ad->u.net->sport = dh->dccph_sport;
3667                 ad->u.net->dport = dh->dccph_dport;
3668                 break;
3669         }
3670
3671         default:
3672                 break;
3673         }
3674 out:
3675         return ret;
3676 }
3677
3678 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3679
3680 /* Returns error only if unable to parse addresses */
3681 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3682                         struct common_audit_data *ad, u8 *proto)
3683 {
3684         u8 nexthdr;
3685         int ret = -EINVAL, offset;
3686         struct ipv6hdr _ipv6h, *ip6;
3687         __be16 frag_off;
3688
3689         offset = skb_network_offset(skb);
3690         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3691         if (ip6 == NULL)
3692                 goto out;
3693
3694         ad->u.net->v6info.saddr = ip6->saddr;
3695         ad->u.net->v6info.daddr = ip6->daddr;
3696         ret = 0;
3697
3698         nexthdr = ip6->nexthdr;
3699         offset += sizeof(_ipv6h);
3700         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3701         if (offset < 0)
3702                 goto out;
3703
3704         if (proto)
3705                 *proto = nexthdr;
3706
3707         switch (nexthdr) {
3708         case IPPROTO_TCP: {
3709                 struct tcphdr _tcph, *th;
3710
3711                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3712                 if (th == NULL)
3713                         break;
3714
3715                 ad->u.net->sport = th->source;
3716                 ad->u.net->dport = th->dest;
3717                 break;
3718         }
3719
3720         case IPPROTO_UDP: {
3721                 struct udphdr _udph, *uh;
3722
3723                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3724                 if (uh == NULL)
3725                         break;
3726
3727                 ad->u.net->sport = uh->source;
3728                 ad->u.net->dport = uh->dest;
3729                 break;
3730         }
3731
3732         case IPPROTO_DCCP: {
3733                 struct dccp_hdr _dccph, *dh;
3734
3735                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3736                 if (dh == NULL)
3737                         break;
3738
3739                 ad->u.net->sport = dh->dccph_sport;
3740                 ad->u.net->dport = dh->dccph_dport;
3741                 break;
3742         }
3743
3744         /* includes fragments */
3745         default:
3746                 break;
3747         }
3748 out:
3749         return ret;
3750 }
3751
3752 #endif /* IPV6 */
3753
3754 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3755                              char **_addrp, int src, u8 *proto)
3756 {
3757         char *addrp;
3758         int ret;
3759
3760         switch (ad->u.net->family) {
3761         case PF_INET:
3762                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3763                 if (ret)
3764                         goto parse_error;
3765                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3766                                        &ad->u.net->v4info.daddr);
3767                 goto okay;
3768
3769 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3770         case PF_INET6:
3771                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3772                 if (ret)
3773                         goto parse_error;
3774                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3775                                        &ad->u.net->v6info.daddr);
3776                 goto okay;
3777 #endif  /* IPV6 */
3778         default:
3779                 addrp = NULL;
3780                 goto okay;
3781         }
3782
3783 parse_error:
3784         printk(KERN_WARNING
3785                "SELinux: failure in selinux_parse_skb(),"
3786                " unable to parse packet\n");
3787         return ret;
3788
3789 okay:
3790         if (_addrp)
3791                 *_addrp = addrp;
3792         return 0;
3793 }
3794
3795 /**
3796  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3797  * @skb: the packet
3798  * @family: protocol family
3799  * @sid: the packet's peer label SID
3800  *
3801  * Description:
3802  * Check the various different forms of network peer labeling and determine
3803  * the peer label/SID for the packet; most of the magic actually occurs in
3804  * the security server function security_net_peersid_cmp().  The function
3805  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3806  * or -EACCES if @sid is invalid due to inconsistencies with the different
3807  * peer labels.
3808  *
3809  */
3810 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3811 {
3812         int err;
3813         u32 xfrm_sid;
3814         u32 nlbl_sid;
3815         u32 nlbl_type;
3816
3817         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3818         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3819
3820         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3821         if (unlikely(err)) {
3822                 printk(KERN_WARNING
3823                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3824                        " unable to determine packet's peer label\n");
3825                 return -EACCES;
3826         }
3827
3828         return 0;
3829 }
3830
3831 /* socket security operations */
3832
3833 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3834                                  u16 secclass, u32 *socksid)
3835 {
3836         if (tsec->sockcreate_sid > SECSID_NULL) {
3837                 *socksid = tsec->sockcreate_sid;
3838                 return 0;
3839         }
3840
3841         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3842                                        socksid);
3843 }
3844
3845 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3846 {
3847         struct sk_security_struct *sksec = sk->sk_security;
3848         struct common_audit_data ad;
3849         struct lsm_network_audit net = {0,};
3850         u32 tsid = task_sid(task);
3851
3852         if (sksec->sid == SECINITSID_KERNEL)
3853                 return 0;
3854
3855         ad.type = LSM_AUDIT_DATA_NET;
3856         ad.u.net = &net;
3857         ad.u.net->sk = sk;
3858
3859         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3860 }
3861
3862 static int selinux_socket_create(int family, int type,
3863                                  int protocol, int kern)
3864 {
3865         const struct task_security_struct *tsec = current_security();
3866         u32 newsid;
3867         u16 secclass;
3868         int rc;
3869
3870         if (kern)
3871                 return 0;
3872
3873         secclass = socket_type_to_security_class(family, type, protocol);
3874         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3875         if (rc)
3876                 return rc;
3877
3878         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3879 }
3880
3881 static int selinux_socket_post_create(struct socket *sock, int family,
3882                                       int type, int protocol, int kern)
3883 {
3884         const struct task_security_struct *tsec = current_security();
3885         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3886         struct sk_security_struct *sksec;
3887         int err = 0;
3888
3889         isec->sclass = socket_type_to_security_class(family, type, protocol);
3890
3891         if (kern)
3892                 isec->sid = SECINITSID_KERNEL;
3893         else {
3894                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3895                 if (err)
3896                         return err;
3897         }
3898
3899         isec->initialized = 1;
3900
3901         if (sock->sk) {
3902                 sksec = sock->sk->sk_security;
3903                 sksec->sid = isec->sid;
3904                 sksec->sclass = isec->sclass;
3905                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3906         }
3907
3908         return err;
3909 }
3910
3911 /* Range of port numbers used to automatically bind.
3912    Need to determine whether we should perform a name_bind
3913    permission check between the socket and the port number. */
3914
3915 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3916 {
3917         struct sock *sk = sock->sk;
3918         u16 family;
3919         int err;
3920
3921         err = sock_has_perm(current, sk, SOCKET__BIND);
3922         if (err)
3923                 goto out;
3924
3925         /*
3926          * If PF_INET or PF_INET6, check name_bind permission for the port.
3927          * Multiple address binding for SCTP is not supported yet: we just
3928          * check the first address now.
3929          */
3930         family = sk->sk_family;
3931         if (family == PF_INET || family == PF_INET6) {
3932                 char *addrp;
3933                 struct sk_security_struct *sksec = sk->sk_security;
3934                 struct common_audit_data ad;
3935                 struct lsm_network_audit net = {0,};
3936                 struct sockaddr_in *addr4 = NULL;
3937                 struct sockaddr_in6 *addr6 = NULL;
3938                 unsigned short snum;
3939                 u32 sid, node_perm;
3940
3941                 if (family == PF_INET) {
3942                         addr4 = (struct sockaddr_in *)address;
3943                         snum = ntohs(addr4->sin_port);
3944                         addrp = (char *)&addr4->sin_addr.s_addr;
3945                 } else {
3946                         addr6 = (struct sockaddr_in6 *)address;
3947                         snum = ntohs(addr6->sin6_port);
3948                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3949                 }
3950
3951                 if (snum) {
3952                         int low, high;
3953
3954                         inet_get_local_port_range(&low, &high);
3955
3956                         if (snum < max(PROT_SOCK, low) || snum > high) {
3957                                 err = sel_netport_sid(sk->sk_protocol,
3958                                                       snum, &sid);
3959                                 if (err)
3960                                         goto out;
3961                                 ad.type = LSM_AUDIT_DATA_NET;
3962                                 ad.u.net = &net;
3963                                 ad.u.net->sport = htons(snum);
3964                                 ad.u.net->family = family;
3965                                 err = avc_has_perm(sksec->sid, sid,
3966                                                    sksec->sclass,
3967                                                    SOCKET__NAME_BIND, &ad);
3968                                 if (err)
3969                                         goto out;
3970                         }
3971                 }
3972
3973                 switch (sksec->sclass) {
3974                 case SECCLASS_TCP_SOCKET:
3975                         node_perm = TCP_SOCKET__NODE_BIND;
3976                         break;
3977
3978                 case SECCLASS_UDP_SOCKET:
3979                         node_perm = UDP_SOCKET__NODE_BIND;
3980                         break;
3981
3982                 case SECCLASS_DCCP_SOCKET:
3983                         node_perm = DCCP_SOCKET__NODE_BIND;
3984                         break;
3985
3986                 default:
3987                         node_perm = RAWIP_SOCKET__NODE_BIND;
3988                         break;
3989                 }
3990
3991                 err = sel_netnode_sid(addrp, family, &sid);
3992                 if (err)
3993                         goto out;
3994
3995                 ad.type = LSM_AUDIT_DATA_NET;
3996                 ad.u.net = &net;
3997                 ad.u.net->sport = htons(snum);
3998                 ad.u.net->family = family;
3999
4000                 if (family == PF_INET)
4001                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4002                 else
4003                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4004
4005                 err = avc_has_perm(sksec->sid, sid,
4006                                    sksec->sclass, node_perm, &ad);
4007                 if (err)
4008                         goto out;
4009         }
4010 out:
4011         return err;
4012 }
4013
4014 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4015 {
4016         struct sock *sk = sock->sk;
4017         struct sk_security_struct *sksec = sk->sk_security;
4018         int err;
4019
4020         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4021         if (err)
4022                 return err;
4023
4024         /*
4025          * If a TCP or DCCP socket, check name_connect permission for the port.
4026          */
4027         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4028             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4029                 struct common_audit_data ad;
4030                 struct lsm_network_audit net = {0,};
4031                 struct sockaddr_in *addr4 = NULL;
4032                 struct sockaddr_in6 *addr6 = NULL;
4033                 unsigned short snum;
4034                 u32 sid, perm;
4035
4036                 if (sk->sk_family == PF_INET) {
4037                         addr4 = (struct sockaddr_in *)address;
4038                         if (addrlen < sizeof(struct sockaddr_in))
4039                                 return -EINVAL;
4040                         snum = ntohs(addr4->sin_port);
4041                 } else {
4042                         addr6 = (struct sockaddr_in6 *)address;
4043                         if (addrlen < SIN6_LEN_RFC2133)
4044                                 return -EINVAL;
4045                         snum = ntohs(addr6->sin6_port);
4046                 }
4047
4048                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4049                 if (err)
4050                         goto out;
4051
4052                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4053                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4054
4055                 ad.type = LSM_AUDIT_DATA_NET;
4056                 ad.u.net = &net;
4057                 ad.u.net->dport = htons(snum);
4058                 ad.u.net->family = sk->sk_family;
4059                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4060                 if (err)
4061                         goto out;
4062         }
4063
4064         err = selinux_netlbl_socket_connect(sk, address);
4065
4066 out:
4067         return err;
4068 }
4069
4070 static int selinux_socket_listen(struct socket *sock, int backlog)
4071 {
4072         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4073 }
4074
4075 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4076 {
4077         int err;
4078         struct inode_security_struct *isec;
4079         struct inode_security_struct *newisec;
4080
4081         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4082         if (err)
4083                 return err;
4084
4085         newisec = SOCK_INODE(newsock)->i_security;
4086
4087         isec = SOCK_INODE(sock)->i_security;
4088         newisec->sclass = isec->sclass;
4089         newisec->sid = isec->sid;
4090         newisec->initialized = 1;
4091
4092         return 0;
4093 }
4094
4095 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4096                                   int size)
4097 {
4098         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4099 }
4100
4101 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4102                                   int size, int flags)
4103 {
4104         return sock_has_perm(current, sock->sk, SOCKET__READ);
4105 }
4106
4107 static int selinux_socket_getsockname(struct socket *sock)
4108 {
4109         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4110 }
4111
4112 static int selinux_socket_getpeername(struct socket *sock)
4113 {
4114         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4115 }
4116
4117 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4118 {
4119         int err;
4120
4121         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4122         if (err)
4123                 return err;
4124
4125         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4126 }
4127
4128 static int selinux_socket_getsockopt(struct socket *sock, int level,
4129                                      int optname)
4130 {
4131         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4132 }
4133
4134 static int selinux_socket_shutdown(struct socket *sock, int how)
4135 {
4136         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4137 }
4138
4139 static int selinux_socket_unix_stream_connect(struct sock *sock,
4140                                               struct sock *other,
4141                                               struct sock *newsk)
4142 {
4143         struct sk_security_struct *sksec_sock = sock->sk_security;
4144         struct sk_security_struct *sksec_other = other->sk_security;
4145         struct sk_security_struct *sksec_new = newsk->sk_security;
4146         struct common_audit_data ad;
4147         struct lsm_network_audit net = {0,};
4148         int err;
4149
4150         ad.type = LSM_AUDIT_DATA_NET;
4151         ad.u.net = &net;
4152         ad.u.net->sk = other;
4153
4154         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4155                            sksec_other->sclass,
4156                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4157         if (err)
4158                 return err;
4159
4160         /* server child socket */
4161         sksec_new->peer_sid = sksec_sock->sid;
4162         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4163                                     &sksec_new->sid);
4164         if (err)
4165                 return err;
4166
4167         /* connecting socket */
4168         sksec_sock->peer_sid = sksec_new->sid;
4169
4170         return 0;
4171 }
4172
4173 static int selinux_socket_unix_may_send(struct socket *sock,
4174                                         struct socket *other)
4175 {
4176         struct sk_security_struct *ssec = sock->sk->sk_security;
4177         struct sk_security_struct *osec = other->sk->sk_security;
4178         struct common_audit_data ad;
4179         struct lsm_network_audit net = {0,};
4180
4181         ad.type = LSM_AUDIT_DATA_NET;
4182         ad.u.net = &net;
4183         ad.u.net->sk = other->sk;
4184
4185         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4186                             &ad);
4187 }
4188
4189 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4190                                     u32 peer_sid,
4191                                     struct common_audit_data *ad)
4192 {
4193         int err;
4194         u32 if_sid;
4195         u32 node_sid;
4196
4197         err = sel_netif_sid(ifindex, &if_sid);
4198         if (err)
4199                 return err;
4200         err = avc_has_perm(peer_sid, if_sid,
4201                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4202         if (err)
4203                 return err;
4204
4205         err = sel_netnode_sid(addrp, family, &node_sid);
4206         if (err)
4207                 return err;
4208         return avc_has_perm(peer_sid, node_sid,
4209                             SECCLASS_NODE, NODE__RECVFROM, ad);
4210 }
4211
4212 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4213                                        u16 family)
4214 {
4215         int err = 0;
4216         struct sk_security_struct *sksec = sk->sk_security;
4217         u32 sk_sid = sksec->sid;
4218         struct common_audit_data ad;
4219         struct lsm_network_audit net = {0,};
4220         char *addrp;
4221
4222         ad.type = LSM_AUDIT_DATA_NET;
4223         ad.u.net = &net;
4224         ad.u.net->netif = skb->skb_iif;
4225         ad.u.net->family = family;
4226         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4227         if (err)
4228                 return err;
4229
4230         if (selinux_secmark_enabled()) {
4231                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4232                                    PACKET__RECV, &ad);
4233                 if (err)
4234                         return err;
4235         }
4236
4237         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4238         if (err)
4239                 return err;
4240         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4241
4242         return err;
4243 }
4244
4245 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4246 {
4247         int err;
4248         struct sk_security_struct *sksec = sk->sk_security;
4249         u16 family = sk->sk_family;
4250         u32 sk_sid = sksec->sid;
4251         struct common_audit_data ad;
4252         struct lsm_network_audit net = {0,};
4253         char *addrp;
4254         u8 secmark_active;
4255         u8 peerlbl_active;
4256
4257         if (family != PF_INET && family != PF_INET6)
4258                 return 0;
4259
4260         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4261         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4262                 family = PF_INET;
4263
4264         /* If any sort of compatibility mode is enabled then handoff processing
4265          * to the selinux_sock_rcv_skb_compat() function to deal with the
4266          * special handling.  We do this in an attempt to keep this function
4267          * as fast and as clean as possible. */
4268         if (!selinux_policycap_netpeer)
4269                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4270
4271         secmark_active = selinux_secmark_enabled();
4272         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4273         if (!secmark_active && !peerlbl_active)
4274                 return 0;
4275
4276         ad.type = LSM_AUDIT_DATA_NET;
4277         ad.u.net = &net;
4278         ad.u.net->netif = skb->skb_iif;
4279         ad.u.net->family = family;
4280         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4281         if (err)
4282                 return err;
4283
4284         if (peerlbl_active) {
4285                 u32 peer_sid;
4286
4287                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4288                 if (err)
4289                         return err;
4290                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4291                                                peer_sid, &ad);
4292                 if (err) {
4293                         selinux_netlbl_err(skb, err, 0);
4294                         return err;
4295                 }
4296                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4297                                    PEER__RECV, &ad);
4298                 if (err)
4299                         selinux_netlbl_err(skb, err, 0);
4300         }
4301
4302         if (secmark_active) {
4303                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4304                                    PACKET__RECV, &ad);
4305                 if (err)
4306                         return err;
4307         }
4308
4309         return err;
4310 }
4311
4312 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4313                                             int __user *optlen, unsigned len)
4314 {
4315         int err = 0;
4316         char *scontext;
4317         u32 scontext_len;
4318         struct sk_security_struct *sksec = sock->sk->sk_security;
4319         u32 peer_sid = SECSID_NULL;
4320
4321         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4322             sksec->sclass == SECCLASS_TCP_SOCKET)
4323                 peer_sid = sksec->peer_sid;
4324         if (peer_sid == SECSID_NULL)
4325                 return -ENOPROTOOPT;
4326
4327         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4328         if (err)
4329                 return err;
4330
4331         if (scontext_len > len) {
4332                 err = -ERANGE;
4333                 goto out_len;
4334         }
4335
4336         if (copy_to_user(optval, scontext, scontext_len))
4337                 err = -EFAULT;
4338
4339 out_len:
4340         if (put_user(scontext_len, optlen))
4341                 err = -EFAULT;
4342         kfree(scontext);
4343         return err;
4344 }
4345
4346 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4347 {
4348         u32 peer_secid = SECSID_NULL;
4349         u16 family;
4350
4351         if (skb && skb->protocol == htons(ETH_P_IP))
4352                 family = PF_INET;
4353         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4354                 family = PF_INET6;
4355         else if (sock)
4356                 family = sock->sk->sk_family;
4357         else
4358                 goto out;
4359
4360         if (sock && family == PF_UNIX)
4361                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4362         else if (skb)
4363                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4364
4365 out:
4366         *secid = peer_secid;
4367         if (peer_secid == SECSID_NULL)
4368                 return -EINVAL;
4369         return 0;
4370 }
4371
4372 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4373 {
4374         struct sk_security_struct *sksec;
4375
4376         sksec = kzalloc(sizeof(*sksec), priority);
4377         if (!sksec)
4378                 return -ENOMEM;
4379
4380         sksec->peer_sid = SECINITSID_UNLABELED;
4381         sksec->sid = SECINITSID_UNLABELED;
4382         selinux_netlbl_sk_security_reset(sksec);
4383         sk->sk_security = sksec;
4384
4385         return 0;
4386 }
4387
4388 static void selinux_sk_free_security(struct sock *sk)
4389 {
4390         struct sk_security_struct *sksec = sk->sk_security;
4391
4392         sk->sk_security = NULL;
4393         selinux_netlbl_sk_security_free(sksec);
4394         kfree(sksec);
4395 }
4396
4397 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4398 {
4399         struct sk_security_struct *sksec = sk->sk_security;
4400         struct sk_security_struct *newsksec = newsk->sk_security;
4401
4402         newsksec->sid = sksec->sid;
4403         newsksec->peer_sid = sksec->peer_sid;
4404         newsksec->sclass = sksec->sclass;
4405
4406         selinux_netlbl_sk_security_reset(newsksec);
4407 }
4408
4409 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4410 {
4411         if (!sk)
4412                 *secid = SECINITSID_ANY_SOCKET;
4413         else {
4414                 struct sk_security_struct *sksec = sk->sk_security;
4415
4416                 *secid = sksec->sid;
4417         }
4418 }
4419
4420 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4421 {
4422         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4423         struct sk_security_struct *sksec = sk->sk_security;
4424
4425         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4426             sk->sk_family == PF_UNIX)
4427                 isec->sid = sksec->sid;
4428         sksec->sclass = isec->sclass;
4429 }
4430
4431 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4432                                      struct request_sock *req)
4433 {
4434         struct sk_security_struct *sksec = sk->sk_security;
4435         int err;
4436         u16 family = sk->sk_family;
4437         u32 newsid;
4438         u32 peersid;
4439
4440         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4441         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4442                 family = PF_INET;
4443
4444         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4445         if (err)
4446                 return err;
4447         if (peersid == SECSID_NULL) {
4448                 req->secid = sksec->sid;
4449                 req->peer_secid = SECSID_NULL;
4450         } else {
4451                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4452                 if (err)
4453                         return err;
4454                 req->secid = newsid;
4455                 req->peer_secid = peersid;
4456         }
4457
4458         return selinux_netlbl_inet_conn_request(req, family);
4459 }
4460
4461 static void selinux_inet_csk_clone(struct sock *newsk,
4462                                    const struct request_sock *req)
4463 {
4464         struct sk_security_struct *newsksec = newsk->sk_security;
4465
4466         newsksec->sid = req->secid;
4467         newsksec->peer_sid = req->peer_secid;
4468         /* NOTE: Ideally, we should also get the isec->sid for the
4469            new socket in sync, but we don't have the isec available yet.
4470            So we will wait until sock_graft to do it, by which
4471            time it will have been created and available. */
4472
4473         /* We don't need to take any sort of lock here as we are the only
4474          * thread with access to newsksec */
4475         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4476 }
4477
4478 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4479 {
4480         u16 family = sk->sk_family;
4481         struct sk_security_struct *sksec = sk->sk_security;
4482
4483         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4484         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4485                 family = PF_INET;
4486
4487         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4488 }
4489
4490 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4491 {
4492         skb_set_owner_w(skb, sk);
4493 }
4494
4495 static int selinux_secmark_relabel_packet(u32 sid)
4496 {
4497         const struct task_security_struct *__tsec;
4498         u32 tsid;
4499
4500         __tsec = current_security();
4501         tsid = __tsec->sid;
4502
4503         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4504 }
4505
4506 static void selinux_secmark_refcount_inc(void)
4507 {
4508         atomic_inc(&selinux_secmark_refcount);
4509 }
4510
4511 static void selinux_secmark_refcount_dec(void)
4512 {
4513         atomic_dec(&selinux_secmark_refcount);
4514 }
4515
4516 static void selinux_req_classify_flow(const struct request_sock *req,
4517                                       struct flowi *fl)
4518 {
4519         fl->flowi_secid = req->secid;
4520 }
4521
4522 static int selinux_tun_dev_alloc_security(void **security)
4523 {
4524         struct tun_security_struct *tunsec;
4525
4526         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4527         if (!tunsec)
4528                 return -ENOMEM;
4529         tunsec->sid = current_sid();
4530
4531         *security = tunsec;
4532         return 0;
4533 }
4534
4535 static void selinux_tun_dev_free_security(void *security)
4536 {
4537         kfree(security);
4538 }
4539
4540 static int selinux_tun_dev_create(void)
4541 {
4542         u32 sid = current_sid();
4543
4544         /* we aren't taking into account the "sockcreate" SID since the socket
4545          * that is being created here is not a socket in the traditional sense,
4546          * instead it is a private sock, accessible only to the kernel, and
4547          * representing a wide range of network traffic spanning multiple
4548          * connections unlike traditional sockets - check the TUN driver to
4549          * get a better understanding of why this socket is special */
4550
4551         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4552                             NULL);
4553 }
4554
4555 static int selinux_tun_dev_attach_queue(void *security)
4556 {
4557         struct tun_security_struct *tunsec = security;
4558
4559         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4560                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4561 }
4562
4563 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4564 {
4565         struct tun_security_struct *tunsec = security;
4566         struct sk_security_struct *sksec = sk->sk_security;
4567
4568         /* we don't currently perform any NetLabel based labeling here and it
4569          * isn't clear that we would want to do so anyway; while we could apply
4570          * labeling without the support of the TUN user the resulting labeled
4571          * traffic from the other end of the connection would almost certainly
4572          * cause confusion to the TUN user that had no idea network labeling
4573          * protocols were being used */
4574
4575         sksec->sid = tunsec->sid;
4576         sksec->sclass = SECCLASS_TUN_SOCKET;
4577
4578         return 0;
4579 }
4580
4581 static int selinux_tun_dev_open(void *security)
4582 {
4583         struct tun_security_struct *tunsec = security;
4584         u32 sid = current_sid();
4585         int err;
4586
4587         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4588                            TUN_SOCKET__RELABELFROM, NULL);
4589         if (err)
4590                 return err;
4591         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4592                            TUN_SOCKET__RELABELTO, NULL);
4593         if (err)
4594                 return err;
4595         tunsec->sid = sid;
4596
4597         return 0;
4598 }
4599
4600 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4601 {
4602         int err = 0;
4603         u32 perm;
4604         struct nlmsghdr *nlh;
4605         struct sk_security_struct *sksec = sk->sk_security;
4606
4607         if (skb->len < NLMSG_HDRLEN) {
4608                 err = -EINVAL;
4609                 goto out;
4610         }
4611         nlh = nlmsg_hdr(skb);
4612
4613         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4614         if (err) {
4615                 if (err == -EINVAL) {
4616                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4617                                   "SELinux:  unrecognized netlink message"
4618                                   " type=%hu for sclass=%hu\n",
4619                                   nlh->nlmsg_type, sksec->sclass);
4620                         if (!selinux_enforcing || security_get_allow_unknown())
4621                                 err = 0;
4622                 }
4623
4624                 /* Ignore */
4625                 if (err == -ENOENT)
4626                         err = 0;
4627                 goto out;
4628         }
4629
4630         err = sock_has_perm(current, sk, perm);
4631 out:
4632         return err;
4633 }
4634
4635 #ifdef CONFIG_NETFILTER
4636
4637 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4638                                        u16 family)
4639 {
4640         int err;
4641         char *addrp;
4642         u32 peer_sid;
4643         struct common_audit_data ad;
4644         struct lsm_network_audit net = {0,};
4645         u8 secmark_active;
4646         u8 netlbl_active;
4647         u8 peerlbl_active;
4648
4649         if (!selinux_policycap_netpeer)
4650                 return NF_ACCEPT;
4651
4652         secmark_active = selinux_secmark_enabled();
4653         netlbl_active = netlbl_enabled();
4654         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4655         if (!secmark_active && !peerlbl_active)
4656                 return NF_ACCEPT;
4657
4658         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4659                 return NF_DROP;
4660
4661         ad.type = LSM_AUDIT_DATA_NET;
4662         ad.u.net = &net;
4663         ad.u.net->netif = ifindex;
4664         ad.u.net->family = family;
4665         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4666                 return NF_DROP;
4667
4668         if (peerlbl_active) {
4669                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4670                                                peer_sid, &ad);
4671                 if (err) {
4672                         selinux_netlbl_err(skb, err, 1);
4673                         return NF_DROP;
4674                 }
4675         }
4676
4677         if (secmark_active)
4678                 if (avc_has_perm(peer_sid, skb->secmark,
4679                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4680                         return NF_DROP;
4681
4682         if (netlbl_active)
4683                 /* we do this in the FORWARD path and not the POST_ROUTING
4684                  * path because we want to make sure we apply the necessary
4685                  * labeling before IPsec is applied so we can leverage AH
4686                  * protection */
4687                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4688                         return NF_DROP;
4689
4690         return NF_ACCEPT;
4691 }
4692
4693 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4694                                          struct sk_buff *skb,
4695                                          const struct net_device *in,
4696                                          const struct net_device *out,
4697                                          int (*okfn)(struct sk_buff *))
4698 {
4699         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4700 }
4701
4702 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4703 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4704                                          struct sk_buff *skb,
4705                                          const struct net_device *in,
4706                                          const struct net_device *out,
4707                                          int (*okfn)(struct sk_buff *))
4708 {
4709         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4710 }
4711 #endif  /* IPV6 */
4712
4713 static unsigned int selinux_ip_output(struct sk_buff *skb,
4714                                       u16 family)
4715 {
4716         u32 sid;
4717
4718         if (!netlbl_enabled())
4719                 return NF_ACCEPT;
4720
4721         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4722          * because we want to make sure we apply the necessary labeling
4723          * before IPsec is applied so we can leverage AH protection */
4724         if (skb->sk) {
4725                 struct sk_security_struct *sksec = skb->sk->sk_security;
4726                 sid = sksec->sid;
4727         } else
4728                 sid = SECINITSID_KERNEL;
4729         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4730                 return NF_DROP;
4731
4732         return NF_ACCEPT;
4733 }
4734
4735 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4736                                         struct sk_buff *skb,
4737                                         const struct net_device *in,
4738                                         const struct net_device *out,
4739                                         int (*okfn)(struct sk_buff *))
4740 {
4741         return selinux_ip_output(skb, PF_INET);
4742 }
4743
4744 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4745                                                 int ifindex,
4746                                                 u16 family)
4747 {
4748         struct sock *sk = skb->sk;
4749         struct sk_security_struct *sksec;
4750         struct common_audit_data ad;
4751         struct lsm_network_audit net = {0,};
4752         char *addrp;
4753         u8 proto;
4754
4755         if (sk == NULL)
4756                 return NF_ACCEPT;
4757         sksec = sk->sk_security;
4758
4759         ad.type = LSM_AUDIT_DATA_NET;
4760         ad.u.net = &net;
4761         ad.u.net->netif = ifindex;
4762         ad.u.net->family = family;
4763         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4764                 return NF_DROP;
4765
4766         if (selinux_secmark_enabled())
4767                 if (avc_has_perm(sksec->sid, skb->secmark,
4768                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4769                         return NF_DROP_ERR(-ECONNREFUSED);
4770
4771         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4772                 return NF_DROP_ERR(-ECONNREFUSED);
4773
4774         return NF_ACCEPT;
4775 }
4776
4777 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4778                                          u16 family)
4779 {
4780         u32 secmark_perm;
4781         u32 peer_sid;
4782         struct sock *sk;
4783         struct common_audit_data ad;
4784         struct lsm_network_audit net = {0,};
4785         char *addrp;
4786         u8 secmark_active;
4787         u8 peerlbl_active;
4788
4789         /* If any sort of compatibility mode is enabled then handoff processing
4790          * to the selinux_ip_postroute_compat() function to deal with the
4791          * special handling.  We do this in an attempt to keep this function
4792          * as fast and as clean as possible. */
4793         if (!selinux_policycap_netpeer)
4794                 return selinux_ip_postroute_compat(skb, ifindex, family);
4795 #ifdef CONFIG_XFRM
4796         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4797          * packet transformation so allow the packet to pass without any checks
4798          * since we'll have another chance to perform access control checks
4799          * when the packet is on it's final way out.
4800          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4801          *       is NULL, in this case go ahead and apply access control. */
4802         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4803                 return NF_ACCEPT;
4804 #endif
4805         secmark_active = selinux_secmark_enabled();
4806         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4807         if (!secmark_active && !peerlbl_active)
4808                 return NF_ACCEPT;
4809
4810         /* if the packet is being forwarded then get the peer label from the
4811          * packet itself; otherwise check to see if it is from a local
4812          * application or the kernel, if from an application get the peer label
4813          * from the sending socket, otherwise use the kernel's sid */
4814         sk = skb->sk;
4815         if (sk == NULL) {
4816                 if (skb->skb_iif) {
4817                         secmark_perm = PACKET__FORWARD_OUT;
4818                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4819                                 return NF_DROP;
4820                 } else {
4821                         secmark_perm = PACKET__SEND;
4822                         peer_sid = SECINITSID_KERNEL;
4823                 }
4824         } else {
4825                 struct sk_security_struct *sksec = sk->sk_security;
4826                 peer_sid = sksec->sid;
4827                 secmark_perm = PACKET__SEND;
4828         }
4829
4830         ad.type = LSM_AUDIT_DATA_NET;
4831         ad.u.net = &net;
4832         ad.u.net->netif = ifindex;
4833         ad.u.net->family = family;
4834         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4835                 return NF_DROP;
4836
4837         if (secmark_active)
4838                 if (avc_has_perm(peer_sid, skb->secmark,
4839                                  SECCLASS_PACKET, secmark_perm, &ad))
4840                         return NF_DROP_ERR(-ECONNREFUSED);
4841
4842         if (peerlbl_active) {
4843                 u32 if_sid;
4844                 u32 node_sid;
4845
4846                 if (sel_netif_sid(ifindex, &if_sid))
4847                         return NF_DROP;
4848                 if (avc_has_perm(peer_sid, if_sid,
4849                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4850                         return NF_DROP_ERR(-ECONNREFUSED);
4851
4852                 if (sel_netnode_sid(addrp, family, &node_sid))
4853                         return NF_DROP;
4854                 if (avc_has_perm(peer_sid, node_sid,
4855                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4856                         return NF_DROP_ERR(-ECONNREFUSED);
4857         }
4858
4859         return NF_ACCEPT;
4860 }
4861
4862 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4863                                            struct sk_buff *skb,
4864                                            const struct net_device *in,
4865                                            const struct net_device *out,
4866                                            int (*okfn)(struct sk_buff *))
4867 {
4868         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4869 }
4870
4871 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4872 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4873                                            struct sk_buff *skb,
4874                                            const struct net_device *in,
4875                                            const struct net_device *out,
4876                                            int (*okfn)(struct sk_buff *))
4877 {
4878         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4879 }
4880 #endif  /* IPV6 */
4881
4882 #endif  /* CONFIG_NETFILTER */
4883
4884 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4885 {
4886         int err;
4887
4888         err = cap_netlink_send(sk, skb);
4889         if (err)
4890                 return err;
4891
4892         return selinux_nlmsg_perm(sk, skb);
4893 }
4894
4895 static int ipc_alloc_security(struct task_struct *task,
4896                               struct kern_ipc_perm *perm,
4897                               u16 sclass)
4898 {
4899         struct ipc_security_struct *isec;
4900         u32 sid;
4901
4902         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4903         if (!isec)
4904                 return -ENOMEM;
4905
4906         sid = task_sid(task);
4907         isec->sclass = sclass;
4908         isec->sid = sid;
4909         perm->security = isec;
4910
4911         return 0;
4912 }
4913
4914 static void ipc_free_security(struct kern_ipc_perm *perm)
4915 {
4916         struct ipc_security_struct *isec = perm->security;
4917         perm->security = NULL;
4918         kfree(isec);
4919 }
4920
4921 static int msg_msg_alloc_security(struct msg_msg *msg)
4922 {
4923         struct msg_security_struct *msec;
4924
4925         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4926         if (!msec)
4927                 return -ENOMEM;
4928
4929         msec->sid = SECINITSID_UNLABELED;
4930         msg->security = msec;
4931
4932         return 0;
4933 }
4934
4935 static void msg_msg_free_security(struct msg_msg *msg)
4936 {
4937         struct msg_security_struct *msec = msg->security;
4938
4939         msg->security = NULL;
4940         kfree(msec);
4941 }
4942
4943 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4944                         u32 perms)
4945 {
4946         struct ipc_security_struct *isec;
4947         struct common_audit_data ad;
4948         u32 sid = current_sid();
4949
4950         isec = ipc_perms->security;
4951
4952         ad.type = LSM_AUDIT_DATA_IPC;
4953         ad.u.ipc_id = ipc_perms->key;
4954
4955         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4956 }
4957
4958 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4959 {
4960         return msg_msg_alloc_security(msg);
4961 }
4962
4963 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4964 {
4965         msg_msg_free_security(msg);
4966 }
4967
4968 /* message queue security operations */
4969 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4970 {
4971         struct ipc_security_struct *isec;
4972         struct common_audit_data ad;
4973         u32 sid = current_sid();
4974         int rc;
4975
4976         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4977         if (rc)
4978                 return rc;
4979
4980         isec = msq->q_perm.security;
4981
4982         ad.type = LSM_AUDIT_DATA_IPC;
4983         ad.u.ipc_id = msq->q_perm.key;
4984
4985         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4986                           MSGQ__CREATE, &ad);
4987         if (rc) {
4988                 ipc_free_security(&msq->q_perm);
4989                 return rc;
4990         }
4991         return 0;
4992 }
4993
4994 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4995 {
4996         ipc_free_security(&msq->q_perm);
4997 }
4998
4999 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5000 {
5001         struct ipc_security_struct *isec;
5002         struct common_audit_data ad;
5003         u32 sid = current_sid();
5004
5005         isec = msq->q_perm.security;
5006
5007         ad.type = LSM_AUDIT_DATA_IPC;
5008         ad.u.ipc_id = msq->q_perm.key;
5009
5010         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5011                             MSGQ__ASSOCIATE, &ad);
5012 }
5013
5014 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5015 {
5016         int err;
5017         int perms;
5018
5019         switch (cmd) {
5020         case IPC_INFO:
5021         case MSG_INFO:
5022                 /* No specific object, just general system-wide information. */
5023                 return task_has_system(current, SYSTEM__IPC_INFO);
5024         case IPC_STAT:
5025         case MSG_STAT:
5026                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5027                 break;
5028         case IPC_SET:
5029                 perms = MSGQ__SETATTR;
5030                 break;
5031         case IPC_RMID:
5032                 perms = MSGQ__DESTROY;
5033                 break;
5034         default:
5035                 return 0;
5036         }
5037
5038         err = ipc_has_perm(&msq->q_perm, perms);
5039         return err;
5040 }
5041
5042 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5043 {
5044         struct ipc_security_struct *isec;
5045         struct msg_security_struct *msec;
5046         struct common_audit_data ad;
5047         u32 sid = current_sid();
5048         int rc;
5049
5050         isec = msq->q_perm.security;
5051         msec = msg->security;
5052
5053         /*
5054          * First time through, need to assign label to the message
5055          */
5056         if (msec->sid == SECINITSID_UNLABELED) {
5057                 /*
5058                  * Compute new sid based on current process and
5059                  * message queue this message will be stored in
5060                  */
5061                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5062                                              NULL, &msec->sid);
5063                 if (rc)
5064                         return rc;
5065         }
5066
5067         ad.type = LSM_AUDIT_DATA_IPC;
5068         ad.u.ipc_id = msq->q_perm.key;
5069
5070         /* Can this process write to the queue? */
5071         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5072                           MSGQ__WRITE, &ad);
5073         if (!rc)
5074                 /* Can this process send the message */
5075                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5076                                   MSG__SEND, &ad);
5077         if (!rc)
5078                 /* Can the message be put in the queue? */
5079                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5080                                   MSGQ__ENQUEUE, &ad);
5081
5082         return rc;
5083 }
5084
5085 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5086                                     struct task_struct *target,
5087                                     long type, int mode)
5088 {
5089         struct ipc_security_struct *isec;
5090         struct msg_security_struct *msec;
5091         struct common_audit_data ad;
5092         u32 sid = task_sid(target);
5093         int rc;
5094
5095         isec = msq->q_perm.security;
5096         msec = msg->security;
5097
5098         ad.type = LSM_AUDIT_DATA_IPC;
5099         ad.u.ipc_id = msq->q_perm.key;
5100
5101         rc = avc_has_perm(sid, isec->sid,
5102                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5103         if (!rc)
5104                 rc = avc_has_perm(sid, msec->sid,
5105                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5106         return rc;
5107 }
5108
5109 /* Shared Memory security operations */
5110 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5111 {
5112         struct ipc_security_struct *isec;
5113         struct common_audit_data ad;
5114         u32 sid = current_sid();
5115         int rc;
5116
5117         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5118         if (rc)
5119                 return rc;
5120
5121         isec = shp->shm_perm.security;
5122
5123         ad.type = LSM_AUDIT_DATA_IPC;
5124         ad.u.ipc_id = shp->shm_perm.key;
5125
5126         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5127                           SHM__CREATE, &ad);
5128         if (rc) {
5129                 ipc_free_security(&shp->shm_perm);
5130                 return rc;
5131         }
5132         return 0;
5133 }
5134
5135 static void selinux_shm_free_security(struct shmid_kernel *shp)
5136 {
5137         ipc_free_security(&shp->shm_perm);
5138 }
5139
5140 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5141 {
5142         struct ipc_security_struct *isec;
5143         struct common_audit_data ad;
5144         u32 sid = current_sid();
5145
5146         isec = shp->shm_perm.security;
5147
5148         ad.type = LSM_AUDIT_DATA_IPC;
5149         ad.u.ipc_id = shp->shm_perm.key;
5150
5151         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5152                             SHM__ASSOCIATE, &ad);
5153 }
5154
5155 /* Note, at this point, shp is locked down */
5156 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5157 {
5158         int perms;
5159         int err;
5160
5161         switch (cmd) {
5162         case IPC_INFO:
5163         case SHM_INFO:
5164                 /* No specific object, just general system-wide information. */
5165                 return task_has_system(current, SYSTEM__IPC_INFO);
5166         case IPC_STAT:
5167         case SHM_STAT:
5168                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5169                 break;
5170         case IPC_SET:
5171                 perms = SHM__SETATTR;
5172                 break;
5173         case SHM_LOCK:
5174         case SHM_UNLOCK:
5175                 perms = SHM__LOCK;
5176                 break;
5177         case IPC_RMID:
5178                 perms = SHM__DESTROY;
5179                 break;
5180         default:
5181                 return 0;
5182         }
5183
5184         err = ipc_has_perm(&shp->shm_perm, perms);
5185         return err;
5186 }
5187
5188 static int selinux_shm_shmat(struct shmid_kernel *shp,
5189                              char __user *shmaddr, int shmflg)
5190 {
5191         u32 perms;
5192
5193         if (shmflg & SHM_RDONLY)
5194                 perms = SHM__READ;
5195         else
5196                 perms = SHM__READ | SHM__WRITE;
5197
5198         return ipc_has_perm(&shp->shm_perm, perms);
5199 }
5200
5201 /* Semaphore security operations */
5202 static int selinux_sem_alloc_security(struct sem_array *sma)
5203 {
5204         struct ipc_security_struct *isec;
5205         struct common_audit_data ad;
5206         u32 sid = current_sid();
5207         int rc;
5208
5209         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5210         if (rc)
5211                 return rc;
5212
5213         isec = sma->sem_perm.security;
5214
5215         ad.type = LSM_AUDIT_DATA_IPC;
5216         ad.u.ipc_id = sma->sem_perm.key;
5217
5218         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5219                           SEM__CREATE, &ad);
5220         if (rc) {
5221                 ipc_free_security(&sma->sem_perm);
5222                 return rc;
5223         }
5224         return 0;
5225 }
5226
5227 static void selinux_sem_free_security(struct sem_array *sma)
5228 {
5229         ipc_free_security(&sma->sem_perm);
5230 }
5231
5232 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5233 {
5234         struct ipc_security_struct *isec;
5235         struct common_audit_data ad;
5236         u32 sid = current_sid();
5237
5238         isec = sma->sem_perm.security;
5239
5240         ad.type = LSM_AUDIT_DATA_IPC;
5241         ad.u.ipc_id = sma->sem_perm.key;
5242
5243         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5244                             SEM__ASSOCIATE, &ad);
5245 }
5246
5247 /* Note, at this point, sma is locked down */
5248 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5249 {
5250         int err;
5251         u32 perms;
5252
5253         switch (cmd) {
5254         case IPC_INFO:
5255         case SEM_INFO:
5256                 /* No specific object, just general system-wide information. */
5257                 return task_has_system(current, SYSTEM__IPC_INFO);
5258         case GETPID:
5259         case GETNCNT:
5260         case GETZCNT:
5261                 perms = SEM__GETATTR;
5262                 break;
5263         case GETVAL:
5264         case GETALL:
5265                 perms = SEM__READ;
5266                 break;
5267         case SETVAL:
5268         case SETALL:
5269                 perms = SEM__WRITE;
5270                 break;
5271         case IPC_RMID:
5272                 perms = SEM__DESTROY;
5273                 break;
5274         case IPC_SET:
5275                 perms = SEM__SETATTR;
5276                 break;
5277         case IPC_STAT:
5278         case SEM_STAT:
5279                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5280                 break;
5281         default:
5282                 return 0;
5283         }
5284
5285         err = ipc_has_perm(&sma->sem_perm, perms);
5286         return err;
5287 }
5288
5289 static int selinux_sem_semop(struct sem_array *sma,
5290                              struct sembuf *sops, unsigned nsops, int alter)
5291 {
5292         u32 perms;
5293
5294         if (alter)
5295                 perms = SEM__READ | SEM__WRITE;
5296         else
5297                 perms = SEM__READ;
5298
5299         return ipc_has_perm(&sma->sem_perm, perms);
5300 }
5301
5302 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5303 {
5304         u32 av = 0;
5305
5306         av = 0;
5307         if (flag & S_IRUGO)
5308                 av |= IPC__UNIX_READ;
5309         if (flag & S_IWUGO)
5310                 av |= IPC__UNIX_WRITE;
5311
5312         if (av == 0)
5313                 return 0;
5314
5315         return ipc_has_perm(ipcp, av);
5316 }
5317
5318 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5319 {
5320         struct ipc_security_struct *isec = ipcp->security;
5321         *secid = isec->sid;
5322 }
5323
5324 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5325 {
5326         if (inode)
5327                 inode_doinit_with_dentry(inode, dentry);
5328 }
5329
5330 static int selinux_getprocattr(struct task_struct *p,
5331                                char *name, char **value)
5332 {
5333         const struct task_security_struct *__tsec;
5334         u32 sid;
5335         int error;
5336         unsigned len;
5337
5338         if (current != p) {
5339                 error = current_has_perm(p, PROCESS__GETATTR);
5340                 if (error)
5341                         return error;
5342         }
5343
5344         rcu_read_lock();
5345         __tsec = __task_cred(p)->security;
5346
5347         if (!strcmp(name, "current"))
5348                 sid = __tsec->sid;
5349         else if (!strcmp(name, "prev"))
5350                 sid = __tsec->osid;
5351         else if (!strcmp(name, "exec"))
5352                 sid = __tsec->exec_sid;
5353         else if (!strcmp(name, "fscreate"))
5354                 sid = __tsec->create_sid;
5355         else if (!strcmp(name, "keycreate"))
5356                 sid = __tsec->keycreate_sid;
5357         else if (!strcmp(name, "sockcreate"))
5358                 sid = __tsec->sockcreate_sid;
5359         else
5360                 goto invalid;
5361         rcu_read_unlock();
5362
5363         if (!sid)
5364                 return 0;
5365
5366         error = security_sid_to_context(sid, value, &len);
5367         if (error)
5368                 return error;
5369         return len;
5370
5371 invalid:
5372         rcu_read_unlock();
5373         return -EINVAL;
5374 }
5375
5376 static int selinux_setprocattr(struct task_struct *p,
5377                                char *name, void *value, size_t size)
5378 {
5379         struct task_security_struct *tsec;
5380         struct task_struct *tracer;
5381         struct cred *new;
5382         u32 sid = 0, ptsid;
5383         int error;
5384         char *str = value;
5385
5386         if (current != p) {
5387                 /* SELinux only allows a process to change its own
5388                    security attributes. */
5389                 return -EACCES;
5390         }
5391
5392         /*
5393          * Basic control over ability to set these attributes at all.
5394          * current == p, but we'll pass them separately in case the
5395          * above restriction is ever removed.
5396          */
5397         if (!strcmp(name, "exec"))
5398                 error = current_has_perm(p, PROCESS__SETEXEC);
5399         else if (!strcmp(name, "fscreate"))
5400                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5401         else if (!strcmp(name, "keycreate"))
5402                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5403         else if (!strcmp(name, "sockcreate"))
5404                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5405         else if (!strcmp(name, "current"))
5406                 error = current_has_perm(p, PROCESS__SETCURRENT);
5407         else
5408                 error = -EINVAL;
5409         if (error)
5410                 return error;
5411
5412         /* Obtain a SID for the context, if one was specified. */
5413         if (size && str[1] && str[1] != '\n') {
5414                 if (str[size-1] == '\n') {
5415                         str[size-1] = 0;
5416                         size--;
5417                 }
5418                 error = security_context_to_sid(value, size, &sid);
5419                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5420                         if (!capable(CAP_MAC_ADMIN)) {
5421                                 struct audit_buffer *ab;
5422                                 size_t audit_size;
5423
5424                                 /* We strip a nul only if it is at the end, otherwise the
5425                                  * context contains a nul and we should audit that */
5426                                 if (str[size - 1] == '\0')
5427                                         audit_size = size - 1;
5428                                 else
5429                                         audit_size = size;
5430                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5431                                 audit_log_format(ab, "op=fscreate invalid_context=");
5432                                 audit_log_n_untrustedstring(ab, value, audit_size);
5433                                 audit_log_end(ab);
5434
5435                                 return error;
5436                         }
5437                         error = security_context_to_sid_force(value, size,
5438                                                               &sid);
5439                 }
5440                 if (error)
5441                         return error;
5442         }
5443
5444         new = prepare_creds();
5445         if (!new)
5446                 return -ENOMEM;
5447
5448         /* Permission checking based on the specified context is
5449            performed during the actual operation (execve,
5450            open/mkdir/...), when we know the full context of the
5451            operation.  See selinux_bprm_set_creds for the execve
5452            checks and may_create for the file creation checks. The
5453            operation will then fail if the context is not permitted. */
5454         tsec = new->security;
5455         if (!strcmp(name, "exec")) {
5456                 tsec->exec_sid = sid;
5457         } else if (!strcmp(name, "fscreate")) {
5458                 tsec->create_sid = sid;
5459         } else if (!strcmp(name, "keycreate")) {
5460                 error = may_create_key(sid, p);
5461                 if (error)
5462                         goto abort_change;
5463                 tsec->keycreate_sid = sid;
5464         } else if (!strcmp(name, "sockcreate")) {
5465                 tsec->sockcreate_sid = sid;
5466         } else if (!strcmp(name, "current")) {
5467                 error = -EINVAL;
5468                 if (sid == 0)
5469                         goto abort_change;
5470
5471                 /* Only allow single threaded processes to change context */
5472                 error = -EPERM;
5473                 if (!current_is_single_threaded()) {
5474                         error = security_bounded_transition(tsec->sid, sid);
5475                         if (error)
5476                                 goto abort_change;
5477                 }
5478
5479                 /* Check permissions for the transition. */
5480                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5481                                      PROCESS__DYNTRANSITION, NULL);
5482                 if (error)
5483                         goto abort_change;
5484
5485                 /* Check for ptracing, and update the task SID if ok.
5486                    Otherwise, leave SID unchanged and fail. */
5487                 ptsid = 0;
5488                 task_lock(p);
5489                 tracer = ptrace_parent(p);
5490                 if (tracer)
5491                         ptsid = task_sid(tracer);
5492                 task_unlock(p);
5493
5494                 if (tracer) {
5495                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5496                                              PROCESS__PTRACE, NULL);
5497                         if (error)
5498                                 goto abort_change;
5499                 }
5500
5501                 tsec->sid = sid;
5502         } else {
5503                 error = -EINVAL;
5504                 goto abort_change;
5505         }
5506
5507         commit_creds(new);
5508         return size;
5509
5510 abort_change:
5511         abort_creds(new);
5512         return error;
5513 }
5514
5515 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5516 {
5517         return security_sid_to_context(secid, secdata, seclen);
5518 }
5519
5520 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5521 {
5522         return security_context_to_sid(secdata, seclen, secid);
5523 }
5524
5525 static void selinux_release_secctx(char *secdata, u32 seclen)
5526 {
5527         kfree(secdata);
5528 }
5529
5530 /*
5531  *      called with inode->i_mutex locked
5532  */
5533 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5534 {
5535         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5536 }
5537
5538 /*
5539  *      called with inode->i_mutex locked
5540  */
5541 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5542 {
5543         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5544 }
5545
5546 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5547 {
5548         int len = 0;
5549         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5550                                                 ctx, true);
5551         if (len < 0)
5552                 return len;
5553         *ctxlen = len;
5554         return 0;
5555 }
5556 #ifdef CONFIG_KEYS
5557
5558 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5559                              unsigned long flags)
5560 {
5561         const struct task_security_struct *tsec;
5562         struct key_security_struct *ksec;
5563
5564         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5565         if (!ksec)
5566                 return -ENOMEM;
5567
5568         tsec = cred->security;
5569         if (tsec->keycreate_sid)
5570                 ksec->sid = tsec->keycreate_sid;
5571         else
5572                 ksec->sid = tsec->sid;
5573
5574         k->security = ksec;
5575         return 0;
5576 }
5577
5578 static void selinux_key_free(struct key *k)
5579 {
5580         struct key_security_struct *ksec = k->security;
5581
5582         k->security = NULL;
5583         kfree(ksec);
5584 }
5585
5586 static int selinux_key_permission(key_ref_t key_ref,
5587                                   const struct cred *cred,
5588                                   key_perm_t perm)
5589 {
5590         struct key *key;
5591         struct key_security_struct *ksec;
5592         u32 sid;
5593
5594         /* if no specific permissions are requested, we skip the
5595            permission check. No serious, additional covert channels
5596            appear to be created. */
5597         if (perm == 0)
5598                 return 0;
5599
5600         sid = cred_sid(cred);
5601
5602         key = key_ref_to_ptr(key_ref);
5603         ksec = key->security;
5604
5605         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5606 }
5607
5608 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5609 {
5610         struct key_security_struct *ksec = key->security;
5611         char *context = NULL;
5612         unsigned len;
5613         int rc;
5614
5615         rc = security_sid_to_context(ksec->sid, &context, &len);
5616         if (!rc)
5617                 rc = len;
5618         *_buffer = context;
5619         return rc;
5620 }
5621
5622 #endif
5623
5624 static struct security_operations selinux_ops = {
5625         .name =                         "selinux",
5626
5627         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5628         .binder_transaction =           selinux_binder_transaction,
5629         .binder_transfer_binder =       selinux_binder_transfer_binder,
5630         .binder_transfer_file =         selinux_binder_transfer_file,
5631
5632         .ptrace_access_check =          selinux_ptrace_access_check,
5633         .ptrace_traceme =               selinux_ptrace_traceme,
5634         .capget =                       selinux_capget,
5635         .capset =                       selinux_capset,
5636         .capable =                      selinux_capable,
5637         .quotactl =                     selinux_quotactl,
5638         .quota_on =                     selinux_quota_on,
5639         .syslog =                       selinux_syslog,
5640         .vm_enough_memory =             selinux_vm_enough_memory,
5641
5642         .netlink_send =                 selinux_netlink_send,
5643
5644         .bprm_set_creds =               selinux_bprm_set_creds,
5645         .bprm_committing_creds =        selinux_bprm_committing_creds,
5646         .bprm_committed_creds =         selinux_bprm_committed_creds,
5647         .bprm_secureexec =              selinux_bprm_secureexec,
5648
5649         .sb_alloc_security =            selinux_sb_alloc_security,
5650         .sb_free_security =             selinux_sb_free_security,
5651         .sb_copy_data =                 selinux_sb_copy_data,
5652         .sb_remount =                   selinux_sb_remount,
5653         .sb_kern_mount =                selinux_sb_kern_mount,
5654         .sb_show_options =              selinux_sb_show_options,
5655         .sb_statfs =                    selinux_sb_statfs,
5656         .sb_mount =                     selinux_mount,
5657         .sb_umount =                    selinux_umount,
5658         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5659         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5660         .sb_parse_opts_str =            selinux_parse_opts_str,
5661
5662
5663         .inode_alloc_security =         selinux_inode_alloc_security,
5664         .inode_free_security =          selinux_inode_free_security,
5665         .inode_init_security =          selinux_inode_init_security,
5666         .inode_create =                 selinux_inode_create,
5667         .inode_link =                   selinux_inode_link,
5668         .inode_unlink =                 selinux_inode_unlink,
5669         .inode_symlink =                selinux_inode_symlink,
5670         .inode_mkdir =                  selinux_inode_mkdir,
5671         .inode_rmdir =                  selinux_inode_rmdir,
5672         .inode_mknod =                  selinux_inode_mknod,
5673         .inode_rename =                 selinux_inode_rename,
5674         .inode_readlink =               selinux_inode_readlink,
5675         .inode_follow_link =            selinux_inode_follow_link,
5676         .inode_permission =             selinux_inode_permission,
5677         .inode_setattr =                selinux_inode_setattr,
5678         .inode_getattr =                selinux_inode_getattr,
5679         .inode_setxattr =               selinux_inode_setxattr,
5680         .inode_post_setxattr =          selinux_inode_post_setxattr,
5681         .inode_getxattr =               selinux_inode_getxattr,
5682         .inode_listxattr =              selinux_inode_listxattr,
5683         .inode_removexattr =            selinux_inode_removexattr,
5684         .inode_getsecurity =            selinux_inode_getsecurity,
5685         .inode_setsecurity =            selinux_inode_setsecurity,
5686         .inode_listsecurity =           selinux_inode_listsecurity,
5687         .inode_getsecid =               selinux_inode_getsecid,
5688
5689         .file_permission =              selinux_file_permission,
5690         .file_alloc_security =          selinux_file_alloc_security,
5691         .file_free_security =           selinux_file_free_security,
5692         .file_ioctl =                   selinux_file_ioctl,
5693         .mmap_file =                    selinux_mmap_file,
5694         .mmap_addr =                    selinux_mmap_addr,
5695         .file_mprotect =                selinux_file_mprotect,
5696         .file_lock =                    selinux_file_lock,
5697         .file_fcntl =                   selinux_file_fcntl,
5698         .file_set_fowner =              selinux_file_set_fowner,
5699         .file_send_sigiotask =          selinux_file_send_sigiotask,
5700         .file_receive =                 selinux_file_receive,
5701
5702         .file_open =                    selinux_file_open,
5703
5704         .task_create =                  selinux_task_create,
5705         .cred_alloc_blank =             selinux_cred_alloc_blank,
5706         .cred_free =                    selinux_cred_free,
5707         .cred_prepare =                 selinux_cred_prepare,
5708         .cred_transfer =                selinux_cred_transfer,
5709         .kernel_act_as =                selinux_kernel_act_as,
5710         .kernel_create_files_as =       selinux_kernel_create_files_as,
5711         .kernel_module_request =        selinux_kernel_module_request,
5712         .task_setpgid =                 selinux_task_setpgid,
5713         .task_getpgid =                 selinux_task_getpgid,
5714         .task_getsid =                  selinux_task_getsid,
5715         .task_getsecid =                selinux_task_getsecid,
5716         .task_setnice =                 selinux_task_setnice,
5717         .task_setioprio =               selinux_task_setioprio,
5718         .task_getioprio =               selinux_task_getioprio,
5719         .task_setrlimit =               selinux_task_setrlimit,
5720         .task_setscheduler =            selinux_task_setscheduler,
5721         .task_getscheduler =            selinux_task_getscheduler,
5722         .task_movememory =              selinux_task_movememory,
5723         .task_kill =                    selinux_task_kill,
5724         .task_wait =                    selinux_task_wait,
5725         .task_to_inode =                selinux_task_to_inode,
5726
5727         .ipc_permission =               selinux_ipc_permission,
5728         .ipc_getsecid =                 selinux_ipc_getsecid,
5729
5730         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5731         .msg_msg_free_security =        selinux_msg_msg_free_security,
5732
5733         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5734         .msg_queue_free_security =      selinux_msg_queue_free_security,
5735         .msg_queue_associate =          selinux_msg_queue_associate,
5736         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5737         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5738         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5739
5740         .shm_alloc_security =           selinux_shm_alloc_security,
5741         .shm_free_security =            selinux_shm_free_security,
5742         .shm_associate =                selinux_shm_associate,
5743         .shm_shmctl =                   selinux_shm_shmctl,
5744         .shm_shmat =                    selinux_shm_shmat,
5745
5746         .sem_alloc_security =           selinux_sem_alloc_security,
5747         .sem_free_security =            selinux_sem_free_security,
5748         .sem_associate =                selinux_sem_associate,
5749         .sem_semctl =                   selinux_sem_semctl,
5750         .sem_semop =                    selinux_sem_semop,
5751
5752         .d_instantiate =                selinux_d_instantiate,
5753
5754         .getprocattr =                  selinux_getprocattr,
5755         .setprocattr =                  selinux_setprocattr,
5756
5757         .secid_to_secctx =              selinux_secid_to_secctx,
5758         .secctx_to_secid =              selinux_secctx_to_secid,
5759         .release_secctx =               selinux_release_secctx,
5760         .inode_notifysecctx =           selinux_inode_notifysecctx,
5761         .inode_setsecctx =              selinux_inode_setsecctx,
5762         .inode_getsecctx =              selinux_inode_getsecctx,
5763
5764         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5765         .unix_may_send =                selinux_socket_unix_may_send,
5766
5767         .socket_create =                selinux_socket_create,
5768         .socket_post_create =           selinux_socket_post_create,
5769         .socket_bind =                  selinux_socket_bind,
5770         .socket_connect =               selinux_socket_connect,
5771         .socket_listen =                selinux_socket_listen,
5772         .socket_accept =                selinux_socket_accept,
5773         .socket_sendmsg =               selinux_socket_sendmsg,
5774         .socket_recvmsg =               selinux_socket_recvmsg,
5775         .socket_getsockname =           selinux_socket_getsockname,
5776         .socket_getpeername =           selinux_socket_getpeername,
5777         .socket_getsockopt =            selinux_socket_getsockopt,
5778         .socket_setsockopt =            selinux_socket_setsockopt,
5779         .socket_shutdown =              selinux_socket_shutdown,
5780         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5781         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5782         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5783         .sk_alloc_security =            selinux_sk_alloc_security,
5784         .sk_free_security =             selinux_sk_free_security,
5785         .sk_clone_security =            selinux_sk_clone_security,
5786         .sk_getsecid =                  selinux_sk_getsecid,
5787         .sock_graft =                   selinux_sock_graft,
5788         .inet_conn_request =            selinux_inet_conn_request,
5789         .inet_csk_clone =               selinux_inet_csk_clone,
5790         .inet_conn_established =        selinux_inet_conn_established,
5791         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5792         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5793         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5794         .req_classify_flow =            selinux_req_classify_flow,
5795         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5796         .tun_dev_free_security =        selinux_tun_dev_free_security,
5797         .tun_dev_create =               selinux_tun_dev_create,
5798         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5799         .tun_dev_attach =               selinux_tun_dev_attach,
5800         .tun_dev_open =                 selinux_tun_dev_open,
5801         .skb_owned_by =                 selinux_skb_owned_by,
5802
5803 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5804         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5805         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5806         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5807         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5808         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5809         .xfrm_state_free_security =     selinux_xfrm_state_free,
5810         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5811         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5812         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5813         .xfrm_decode_session =          selinux_xfrm_decode_session,
5814 #endif
5815
5816 #ifdef CONFIG_KEYS
5817         .key_alloc =                    selinux_key_alloc,
5818         .key_free =                     selinux_key_free,
5819         .key_permission =               selinux_key_permission,
5820         .key_getsecurity =              selinux_key_getsecurity,
5821 #endif
5822
5823 #ifdef CONFIG_AUDIT
5824         .audit_rule_init =              selinux_audit_rule_init,
5825         .audit_rule_known =             selinux_audit_rule_known,
5826         .audit_rule_match =             selinux_audit_rule_match,
5827         .audit_rule_free =              selinux_audit_rule_free,
5828 #endif
5829 };
5830
5831 static __init int selinux_init(void)
5832 {
5833         if (!security_module_enable(&selinux_ops)) {
5834                 selinux_enabled = 0;
5835                 return 0;
5836         }
5837
5838         if (!selinux_enabled) {
5839                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5840                 return 0;
5841         }
5842
5843         printk(KERN_INFO "SELinux:  Initializing.\n");
5844
5845         /* Set the security state for the initial task. */
5846         cred_init_security();
5847
5848         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5849
5850         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5851                                             sizeof(struct inode_security_struct),
5852                                             0, SLAB_PANIC, NULL);
5853         avc_init();
5854
5855         if (register_security(&selinux_ops))
5856                 panic("SELinux: Unable to register with kernel.\n");
5857
5858         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
5859                 panic("SELinux: Unable to register AVC netcache callback\n");
5860
5861         if (selinux_enforcing)
5862                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5863         else
5864                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5865
5866         return 0;
5867 }
5868
5869 static void delayed_superblock_init(struct super_block *sb, void *unused)
5870 {
5871         superblock_doinit(sb, NULL);
5872 }
5873
5874 void selinux_complete_init(void)
5875 {
5876         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5877
5878         /* Set up any superblocks initialized prior to the policy load. */
5879         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5880         iterate_supers(delayed_superblock_init, NULL);
5881 }
5882
5883 /* SELinux requires early initialization in order to label
5884    all processes and objects when they are created. */
5885 security_initcall(selinux_init);
5886
5887 #if defined(CONFIG_NETFILTER)
5888
5889 static struct nf_hook_ops selinux_ipv4_ops[] = {
5890         {
5891                 .hook =         selinux_ipv4_postroute,
5892                 .owner =        THIS_MODULE,
5893                 .pf =           NFPROTO_IPV4,
5894                 .hooknum =      NF_INET_POST_ROUTING,
5895                 .priority =     NF_IP_PRI_SELINUX_LAST,
5896         },
5897         {
5898                 .hook =         selinux_ipv4_forward,
5899                 .owner =        THIS_MODULE,
5900                 .pf =           NFPROTO_IPV4,
5901                 .hooknum =      NF_INET_FORWARD,
5902                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5903         },
5904         {
5905                 .hook =         selinux_ipv4_output,
5906                 .owner =        THIS_MODULE,
5907                 .pf =           NFPROTO_IPV4,
5908                 .hooknum =      NF_INET_LOCAL_OUT,
5909                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5910         }
5911 };
5912
5913 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5914
5915 static struct nf_hook_ops selinux_ipv6_ops[] = {
5916         {
5917                 .hook =         selinux_ipv6_postroute,
5918                 .owner =        THIS_MODULE,
5919                 .pf =           NFPROTO_IPV6,
5920                 .hooknum =      NF_INET_POST_ROUTING,
5921                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5922         },
5923         {
5924                 .hook =         selinux_ipv6_forward,
5925                 .owner =        THIS_MODULE,
5926                 .pf =           NFPROTO_IPV6,
5927                 .hooknum =      NF_INET_FORWARD,
5928                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5929         }
5930 };
5931
5932 #endif  /* IPV6 */
5933
5934 static int __init selinux_nf_ip_init(void)
5935 {
5936         int err = 0;
5937
5938         if (!selinux_enabled)
5939                 goto out;
5940
5941         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5942
5943         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5944         if (err)
5945                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5946
5947 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5948         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5949         if (err)
5950                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5951 #endif  /* IPV6 */
5952
5953 out:
5954         return err;
5955 }
5956
5957 __initcall(selinux_nf_ip_init);
5958
5959 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5960 static void selinux_nf_ip_exit(void)
5961 {
5962         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5963
5964         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5965 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5966         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5967 #endif  /* IPV6 */
5968 }
5969 #endif
5970
5971 #else /* CONFIG_NETFILTER */
5972
5973 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5974 #define selinux_nf_ip_exit()
5975 #endif
5976
5977 #endif /* CONFIG_NETFILTER */
5978
5979 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5980 static int selinux_disabled;
5981
5982 int selinux_disable(void)
5983 {
5984         if (ss_initialized) {
5985                 /* Not permitted after initial policy load. */
5986                 return -EINVAL;
5987         }
5988
5989         if (selinux_disabled) {
5990                 /* Only do this once. */
5991                 return -EINVAL;
5992         }
5993
5994         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5995
5996         selinux_disabled = 1;
5997         selinux_enabled = 0;
5998
5999         reset_security_ops();
6000
6001         /* Try to destroy the avc node cache */
6002         avc_disable();
6003
6004         /* Unregister netfilter hooks. */
6005         selinux_nf_ip_exit();
6006
6007         /* Unregister selinuxfs. */
6008         exit_sel_fs();
6009
6010         return 0;
6011 }
6012 #endif