security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
  16  *                     Paul Moore, <paul.moore@hp.com>
  17  *
  18  *      This program is free software; you can redistribute it and/or modify
  19  *      it under the terms of the GNU General Public License version 2,
  20  *      as published by the Free Software Foundation.
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/kernel.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/errno.h>
  28 #include <linux/sched.h>
  29 #include <linux/security.h>
  30 #include <linux/xattr.h>
  31 #include <linux/capability.h>
  32 #include <linux/unistd.h>
  33 #include <linux/mm.h>
  34 #include <linux/mman.h>
  35 #include <linux/slab.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/swap.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/dccp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72 #include <linux/selinux.h>
  73 #include <linux/mutex.h>
  74
  75 #include "avc.h"
  76 #include "objsec.h"
  77 #include "netif.h"
  78 #include "xfrm.h"
  79 #include "netlabel.h"
  80
  81 #define XATTR_SELINUX_SUFFIX "selinux"
  82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  83
  84 extern unsigned int policydb_loaded_version;
  85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  86 extern int selinux_compat_net;
  87
  88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  89 int selinux_enforcing = 0;
  90
  91 static int __init enforcing_setup(char *str)
  92 {
  93         selinux_enforcing = simple_strtol(str,NULL,0);
  94         return 1;
  95 }
  96 __setup("enforcing=", enforcing_setup);
  97 #endif
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 101
 102 static int __init selinux_enabled_setup(char *str)
 103 {
 104         selinux_enabled = simple_strtol(str, NULL, 0);
 105         return 1;
 106 }
 107 __setup("selinux=", selinux_enabled_setup);
 108 #else
 109 int selinux_enabled = 1;
 110 #endif
 111
 112 /* Original (dummy) security module. */
 113 static struct security_operations *original_ops = NULL;
 114
 115 /* Minimal support for a secondary security module,
 116    just to allow the use of the dummy or capability modules.
 117    The owlsm module can alternatively be used as a secondary
 118    module as long as CONFIG_OWLSM_FD is not enabled. */
 119 static struct security_operations *secondary_ops = NULL;
 120
 121 /* Lists of inode and superblock security structures initialized
 122    before the policy was loaded. */
 123 static LIST_HEAD(superblock_security_head);
 124 static DEFINE_SPINLOCK(sb_security_lock);
 125
 126 static struct kmem_cache *sel_inode_cache;
 127
 128 /* Return security context for a given sid or just the context
 129    length if the buffer is null or length is 0 */
 130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 131 {
 132         char *context;
 133         unsigned len;
 134         int rc;
 135
 136         rc = security_sid_to_context(sid, &context, &len);
 137         if (rc)
 138                 return rc;
 139
 140         if (!buffer || !size)
 141                 goto getsecurity_exit;
 142
 143         if (size < len) {
 144                 len = -ERANGE;
 145                 goto getsecurity_exit;
 146         }
 147         memcpy(buffer, context, len);
 148
 149 getsecurity_exit:
 150         kfree(context);
 151         return len;
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_context = 1,
 320         Opt_fscontext = 2,
 321         Opt_defcontext = 4,
 322         Opt_rootcontext = 8,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329         {Opt_rootcontext, "rootcontext=%s"},
 330 };
 331
 332 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 333
 334 static int may_context_mount_sb_relabel(u32 sid,
 335                         struct superblock_security_struct *sbsec,
 336                         struct task_security_struct *tsec)
 337 {
 338         int rc;
 339
 340         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 341                           FILESYSTEM__RELABELFROM, NULL);
 342         if (rc)
 343                 return rc;
 344
 345         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELTO, NULL);
 347         return rc;
 348 }
 349
 350 static int may_context_mount_inode_relabel(u32 sid,
 351                         struct superblock_security_struct *sbsec,
 352                         struct task_security_struct *tsec)
 353 {
 354         int rc;
 355         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 356                           FILESYSTEM__RELABELFROM, NULL);
 357         if (rc)
 358                 return rc;
 359
 360         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 361                           FILESYSTEM__ASSOCIATE, NULL);
 362         return rc;
 363 }
 364
 365 static int try_context_mount(struct super_block *sb, void *data)
 366 {
 367         char *context = NULL, *defcontext = NULL;
 368         char *fscontext = NULL, *rootcontext = NULL;
 369         const char *name;
 370         u32 sid;
 371         int alloc = 0, rc = 0, seen = 0;
 372         struct task_security_struct *tsec = current->security;
 373         struct superblock_security_struct *sbsec = sb->s_security;
 374
 375         if (!data)
 376                 goto out;
 377
 378         name = sb->s_type->name;
 379
 380         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 381
 382                 /* NFS we understand. */
 383                 if (!strcmp(name, "nfs")) {
 384                         struct nfs_mount_data *d = data;
 385
 386                         if (d->version <  NFS_MOUNT_VERSION)
 387                                 goto out;
 388
 389                         if (d->context[0]) {
 390                                 context = d->context;
 391                                 seen |= Opt_context;
 392                         }
 393                 } else
 394                         goto out;
 395
 396         } else {
 397                 /* Standard string-based options. */
 398                 char *p, *options = data;
 399
 400                 while ((p = strsep(&options, "|")) != NULL) {
 401                         int token;
 402                         substring_t args[MAX_OPT_ARGS];
 403
 404                         if (!*p)
 405                                 continue;
 406
 407                         token = match_token(p, tokens, args);
 408
 409                         switch (token) {
 410                         case Opt_context:
 411                                 if (seen & (Opt_context|Opt_defcontext)) {
 412                                         rc = -EINVAL;
 413                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 414                                         goto out_free;
 415                                 }
 416                                 context = match_strdup(&args[0]);
 417                                 if (!context) {
 418                                         rc = -ENOMEM;
 419                                         goto out_free;
 420                                 }
 421                                 if (!alloc)
 422                                         alloc = 1;
 423                                 seen |= Opt_context;
 424                                 break;
 425
 426                         case Opt_fscontext:
 427                                 if (seen & Opt_fscontext) {
 428                                         rc = -EINVAL;
 429                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 430                                         goto out_free;
 431                                 }
 432                                 fscontext = match_strdup(&args[0]);
 433                                 if (!fscontext) {
 434                                         rc = -ENOMEM;
 435                                         goto out_free;
 436                                 }
 437                                 if (!alloc)
 438                                         alloc = 1;
 439                                 seen |= Opt_fscontext;
 440                                 break;
 441
 442                         case Opt_rootcontext:
 443                                 if (seen & Opt_rootcontext) {
 444                                         rc = -EINVAL;
 445                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 446                                         goto out_free;
 447                                 }
 448                                 rootcontext = match_strdup(&args[0]);
 449                                 if (!rootcontext) {
 450                                         rc = -ENOMEM;
 451                                         goto out_free;
 452                                 }
 453                                 if (!alloc)
 454                                         alloc = 1;
 455                                 seen |= Opt_rootcontext;
 456                                 break;
 457
 458                         case Opt_defcontext:
 459                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 460                                         rc = -EINVAL;
 461                                         printk(KERN_WARNING "SELinux:  "
 462                                                "defcontext option is invalid "
 463                                                "for this filesystem type\n");
 464                                         goto out_free;
 465                                 }
 466                                 if (seen & (Opt_context|Opt_defcontext)) {
 467                                         rc = -EINVAL;
 468                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 469                                         goto out_free;
 470                                 }
 471                                 defcontext = match_strdup(&args[0]);
 472                                 if (!defcontext) {
 473                                         rc = -ENOMEM;
 474                                         goto out_free;
 475                                 }
 476                                 if (!alloc)
 477                                         alloc = 1;
 478                                 seen |= Opt_defcontext;
 479                                 break;
 480
 481                         default:
 482                                 rc = -EINVAL;
 483                                 printk(KERN_WARNING "SELinux:  unknown mount "
 484                                        "option\n");
 485                                 goto out_free;
 486
 487                         }
 488                 }
 489         }
 490
 491         if (!seen)
 492                 goto out;
 493
 494         /* sets the context of the superblock for the fs being mounted. */
 495         if (fscontext) {
 496                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 497                 if (rc) {
 498                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 499                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 500                                fscontext, sb->s_id, name, rc);
 501                         goto out_free;
 502                 }
 503
 504                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 505                 if (rc)
 506                         goto out_free;
 507
 508                 sbsec->sid = sid;
 509         }
 510
 511         /*
 512          * Switch to using mount point labeling behavior.
 513          * sets the label used on all file below the mountpoint, and will set
 514          * the superblock context if not already set.
 515          */
 516         if (context) {
 517                 rc = security_context_to_sid(context, strlen(context), &sid);
 518                 if (rc) {
 519                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 520                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 521                                context, sb->s_id, name, rc);
 522                         goto out_free;
 523                 }
 524
 525                 if (!fscontext) {
 526                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 527                         if (rc)
 528                                 goto out_free;
 529                         sbsec->sid = sid;
 530                 } else {
 531                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 532                         if (rc)
 533                                 goto out_free;
 534                 }
 535                 sbsec->mntpoint_sid = sid;
 536
 537                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 538         }
 539
 540         if (rootcontext) {
 541                 struct inode *inode = sb->s_root->d_inode;
 542                 struct inode_security_struct *isec = inode->i_security;
 543                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 544                 if (rc) {
 545                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 546                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 547                                rootcontext, sb->s_id, name, rc);
 548                         goto out_free;
 549                 }
 550
 551                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 552                 if (rc)
 553                         goto out_free;
 554
 555                 isec->sid = sid;
 556                 isec->initialized = 1;
 557         }
 558
 559         if (defcontext) {
 560                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 561                 if (rc) {
 562                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 563                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 564                                defcontext, sb->s_id, name, rc);
 565                         goto out_free;
 566                 }
 567
 568                 if (sid == sbsec->def_sid)
 569                         goto out_free;
 570
 571                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 572                 if (rc)
 573                         goto out_free;
 574
 575                 sbsec->def_sid = sid;
 576         }
 577
 578 out_free:
 579         if (alloc) {
 580                 kfree(context);
 581                 kfree(defcontext);
 582                 kfree(fscontext);
 583                 kfree(rootcontext);
 584         }
 585 out:
 586         return rc;
 587 }
 588
 589 static int superblock_doinit(struct super_block *sb, void *data)
 590 {
 591         struct superblock_security_struct *sbsec = sb->s_security;
 592         struct dentry *root = sb->s_root;
 593         struct inode *inode = root->d_inode;
 594         int rc = 0;
 595
 596         mutex_lock(&sbsec->lock);
 597         if (sbsec->initialized)
 598                 goto out;
 599
 600         if (!ss_initialized) {
 601                 /* Defer initialization until selinux_complete_init,
 602                    after the initial policy is loaded and the security
 603                    server is ready to handle calls. */
 604                 spin_lock(&sb_security_lock);
 605                 if (list_empty(&sbsec->list))
 606                         list_add(&sbsec->list, &superblock_security_head);
 607                 spin_unlock(&sb_security_lock);
 608                 goto out;
 609         }
 610
 611         /* Determine the labeling behavior to use for this filesystem type. */
 612         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 613         if (rc) {
 614                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 615                        __FUNCTION__, sb->s_type->name, rc);
 616                 goto out;
 617         }
 618
 619         rc = try_context_mount(sb, data);
 620         if (rc)
 621                 goto out;
 622
 623         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 624                 /* Make sure that the xattr handler exists and that no
 625                    error other than -ENODATA is returned by getxattr on
 626                    the root directory.  -ENODATA is ok, as this may be
 627                    the first boot of the SELinux kernel before we have
 628                    assigned xattr values to the filesystem. */
 629                 if (!inode->i_op->getxattr) {
 630                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 631                                "xattr support\n", sb->s_id, sb->s_type->name);
 632                         rc = -EOPNOTSUPP;
 633                         goto out;
 634                 }
 635                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 636                 if (rc < 0 && rc != -ENODATA) {
 637                         if (rc == -EOPNOTSUPP)
 638                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 639                                        "%s) has no security xattr handler\n",
 640                                        sb->s_id, sb->s_type->name);
 641                         else
 642                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 643                                        "%s) getxattr errno %d\n", sb->s_id,
 644                                        sb->s_type->name, -rc);
 645                         goto out;
 646                 }
 647         }
 648
 649         if (strcmp(sb->s_type->name, "proc") == 0)
 650                 sbsec->proc = 1;
 651
 652         sbsec->initialized = 1;
 653
 654         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 655                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 656                        sb->s_id, sb->s_type->name);
 657         }
 658         else {
 659                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 660                        sb->s_id, sb->s_type->name,
 661                        labeling_behaviors[sbsec->behavior-1]);
 662         }
 663
 664         /* Initialize the root inode. */
 665         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 666
 667         /* Initialize any other inodes associated with the superblock, e.g.
 668            inodes created prior to initial policy load or inodes created
 669            during get_sb by a pseudo filesystem that directly
 670            populates itself. */
 671         spin_lock(&sbsec->isec_lock);
 672 next_inode:
 673         if (!list_empty(&sbsec->isec_head)) {
 674                 struct inode_security_struct *isec =
 675                                 list_entry(sbsec->isec_head.next,
 676                                            struct inode_security_struct, list);
 677                 struct inode *inode = isec->inode;
 678                 spin_unlock(&sbsec->isec_lock);
 679                 inode = igrab(inode);
 680                 if (inode) {
 681                         if (!IS_PRIVATE (inode))
 682                                 inode_doinit(inode);
 683                         iput(inode);
 684                 }
 685                 spin_lock(&sbsec->isec_lock);
 686                 list_del_init(&isec->list);
 687                 goto next_inode;
 688         }
 689         spin_unlock(&sbsec->isec_lock);
 690 out:
 691         mutex_unlock(&sbsec->lock);
 692         return rc;
 693 }
 694
 695 static inline u16 inode_mode_to_security_class(umode_t mode)
 696 {
 697         switch (mode & S_IFMT) {
 698         case S_IFSOCK:
 699                 return SECCLASS_SOCK_FILE;
 700         case S_IFLNK:
 701                 return SECCLASS_LNK_FILE;
 702         case S_IFREG:
 703                 return SECCLASS_FILE;
 704         case S_IFBLK:
 705                 return SECCLASS_BLK_FILE;
 706         case S_IFDIR:
 707                 return SECCLASS_DIR;
 708         case S_IFCHR:
 709                 return SECCLASS_CHR_FILE;
 710         case S_IFIFO:
 711                 return SECCLASS_FIFO_FILE;
 712
 713         }
 714
 715         return SECCLASS_FILE;
 716 }
 717
 718 static inline int default_protocol_stream(int protocol)
 719 {
 720         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 721 }
 722
 723 static inline int default_protocol_dgram(int protocol)
 724 {
 725         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 726 }
 727
 728 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 729 {
 730         switch (family) {
 731         case PF_UNIX:
 732                 switch (type) {
 733                 case SOCK_STREAM:
 734                 case SOCK_SEQPACKET:
 735                         return SECCLASS_UNIX_STREAM_SOCKET;
 736                 case SOCK_DGRAM:
 737                         return SECCLASS_UNIX_DGRAM_SOCKET;
 738                 }
 739                 break;
 740         case PF_INET:
 741         case PF_INET6:
 742                 switch (type) {
 743                 case SOCK_STREAM:
 744                         if (default_protocol_stream(protocol))
 745                                 return SECCLASS_TCP_SOCKET;
 746                         else
 747                                 return SECCLASS_RAWIP_SOCKET;
 748                 case SOCK_DGRAM:
 749                         if (default_protocol_dgram(protocol))
 750                                 return SECCLASS_UDP_SOCKET;
 751                         else
 752                                 return SECCLASS_RAWIP_SOCKET;
 753                 case SOCK_DCCP:
 754                         return SECCLASS_DCCP_SOCKET;
 755                 default:
 756                         return SECCLASS_RAWIP_SOCKET;
 757                 }
 758                 break;
 759         case PF_NETLINK:
 760                 switch (protocol) {
 761                 case NETLINK_ROUTE:
 762                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 763                 case NETLINK_FIREWALL:
 764                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 765                 case NETLINK_INET_DIAG:
 766                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 767                 case NETLINK_NFLOG:
 768                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 769                 case NETLINK_XFRM:
 770                         return SECCLASS_NETLINK_XFRM_SOCKET;
 771                 case NETLINK_SELINUX:
 772                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 773                 case NETLINK_AUDIT:
 774                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 775                 case NETLINK_IP6_FW:
 776                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 777                 case NETLINK_DNRTMSG:
 778                         return SECCLASS_NETLINK_DNRT_SOCKET;
 779                 case NETLINK_KOBJECT_UEVENT:
 780                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 781                 default:
 782                         return SECCLASS_NETLINK_SOCKET;
 783                 }
 784         case PF_PACKET:
 785                 return SECCLASS_PACKET_SOCKET;
 786         case PF_KEY:
 787                 return SECCLASS_KEY_SOCKET;
 788         case PF_APPLETALK:
 789                 return SECCLASS_APPLETALK_SOCKET;
 790         }
 791
 792         return SECCLASS_SOCKET;
 793 }
 794
 795 #ifdef CONFIG_PROC_FS
 796 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 797                                 u16 tclass,
 798                                 u32 *sid)
 799 {
 800         int buflen, rc;
 801         char *buffer, *path, *end;
 802
 803         buffer = (char*)__get_free_page(GFP_KERNEL);
 804         if (!buffer)
 805                 return -ENOMEM;
 806
 807         buflen = PAGE_SIZE;
 808         end = buffer+buflen;
 809         *--end = '\0';
 810         buflen--;
 811         path = end-1;
 812         *path = '/';
 813         while (de && de != de->parent) {
 814                 buflen -= de->namelen + 1;
 815                 if (buflen < 0)
 816                         break;
 817                 end -= de->namelen;
 818                 memcpy(end, de->name, de->namelen);
 819                 *--end = '/';
 820                 path = end;
 821                 de = de->parent;
 822         }
 823         rc = security_genfs_sid("proc", path, tclass, sid);
 824         free_page((unsigned long)buffer);
 825         return rc;
 826 }
 827 #else
 828 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 829                                 u16 tclass,
 830                                 u32 *sid)
 831 {
 832         return -EINVAL;
 833 }
 834 #endif
 835
 836 /* The inode's security attributes must be initialized before first use. */
 837 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 838 {
 839         struct superblock_security_struct *sbsec = NULL;
 840         struct inode_security_struct *isec = inode->i_security;
 841         u32 sid;
 842         struct dentry *dentry;
 843 #define INITCONTEXTLEN 255
 844         char *context = NULL;
 845         unsigned len = 0;
 846         int rc = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         mutex_lock(&isec->lock);
 852         if (isec->initialized)
 853                 goto out_unlock;
 854
 855         sbsec = inode->i_sb->s_security;
 856         if (!sbsec->initialized) {
 857                 /* Defer initialization until selinux_complete_init,
 858                    after the initial policy is loaded and the security
 859                    server is ready to handle calls. */
 860                 spin_lock(&sbsec->isec_lock);
 861                 if (list_empty(&isec->list))
 862                         list_add(&isec->list, &sbsec->isec_head);
 863                 spin_unlock(&sbsec->isec_lock);
 864                 goto out_unlock;
 865         }
 866
 867         switch (sbsec->behavior) {
 868         case SECURITY_FS_USE_XATTR:
 869                 if (!inode->i_op->getxattr) {
 870                         isec->sid = sbsec->def_sid;
 871                         break;
 872                 }
 873
 874                 /* Need a dentry, since the xattr API requires one.
 875                    Life would be simpler if we could just pass the inode. */
 876                 if (opt_dentry) {
 877                         /* Called from d_instantiate or d_splice_alias. */
 878                         dentry = dget(opt_dentry);
 879                 } else {
 880                         /* Called from selinux_complete_init, try to find a dentry. */
 881                         dentry = d_find_alias(inode);
 882                 }
 883                 if (!dentry) {
 884                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 885                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 886                                inode->i_ino);
 887                         goto out_unlock;
 888                 }
 889
 890                 len = INITCONTEXTLEN;
 891                 context = kmalloc(len, GFP_KERNEL);
 892                 if (!context) {
 893                         rc = -ENOMEM;
 894                         dput(dentry);
 895                         goto out_unlock;
 896                 }
 897                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 898                                            context, len);
 899                 if (rc == -ERANGE) {
 900                         /* Need a larger buffer.  Query for the right size. */
 901                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 902                                                    NULL, 0);
 903                         if (rc < 0) {
 904                                 dput(dentry);
 905                                 goto out_unlock;
 906                         }
 907                         kfree(context);
 908                         len = rc;
 909                         context = kmalloc(len, GFP_KERNEL);
 910                         if (!context) {
 911                                 rc = -ENOMEM;
 912                                 dput(dentry);
 913                                 goto out_unlock;
 914                         }
 915                         rc = inode->i_op->getxattr(dentry,
 916                                                    XATTR_NAME_SELINUX,
 917                                                    context, len);
 918                 }
 919                 dput(dentry);
 920                 if (rc < 0) {
 921                         if (rc != -ENODATA) {
 922                                 printk(KERN_WARNING "%s:  getxattr returned "
 923                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 924                                        -rc, inode->i_sb->s_id, inode->i_ino);
 925                                 kfree(context);
 926                                 goto out_unlock;
 927                         }
 928                         /* Map ENODATA to the default file SID */
 929                         sid = sbsec->def_sid;
 930                         rc = 0;
 931                 } else {
 932                         rc = security_context_to_sid_default(context, rc, &sid,
 933                                                              sbsec->def_sid);
 934                         if (rc) {
 935                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 936                                        "returned %d for dev=%s ino=%ld\n",
 937                                        __FUNCTION__, context, -rc,
 938                                        inode->i_sb->s_id, inode->i_ino);
 939                                 kfree(context);
 940                                 /* Leave with the unlabeled SID */
 941                                 rc = 0;
 942                                 break;
 943                         }
 944                 }
 945                 kfree(context);
 946                 isec->sid = sid;
 947                 break;
 948         case SECURITY_FS_USE_TASK:
 949                 isec->sid = isec->task_sid;
 950                 break;
 951         case SECURITY_FS_USE_TRANS:
 952                 /* Default to the fs SID. */
 953                 isec->sid = sbsec->sid;
 954
 955                 /* Try to obtain a transition SID. */
 956                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 957                 rc = security_transition_sid(isec->task_sid,
 958                                              sbsec->sid,
 959                                              isec->sclass,
 960                                              &sid);
 961                 if (rc)
 962                         goto out_unlock;
 963                 isec->sid = sid;
 964                 break;
 965         case SECURITY_FS_USE_MNTPOINT:
 966                 isec->sid = sbsec->mntpoint_sid;
 967                 break;
 968         default:
 969                 /* Default to the fs superblock SID. */
 970                 isec->sid = sbsec->sid;
 971
 972                 if (sbsec->proc) {
 973                         struct proc_inode *proci = PROC_I(inode);
 974                         if (proci->pde) {
 975                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 976                                 rc = selinux_proc_get_sid(proci->pde,
 977                                                           isec->sclass,
 978                                                           &sid);
 979                                 if (rc)
 980                                         goto out_unlock;
 981                                 isec->sid = sid;
 982                         }
 983                 }
 984                 break;
 985         }
 986
 987         isec->initialized = 1;
 988
 989 out_unlock:
 990         mutex_unlock(&isec->lock);
 991 out:
 992         if (isec->sclass == SECCLASS_FILE)
 993                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 994         return rc;
 995 }
 996
 997 /* Convert a Linux signal to an access vector. */
 998 static inline u32 signal_to_av(int sig)
 999 {
1000         u32 perm = 0;
1001
1002         switch (sig) {
1003         case SIGCHLD:
1004                 /* Commonly granted from child to parent. */
1005                 perm = PROCESS__SIGCHLD;
1006                 break;
1007         case SIGKILL:
1008                 /* Cannot be caught or ignored */
1009                 perm = PROCESS__SIGKILL;
1010                 break;
1011         case SIGSTOP:
1012                 /* Cannot be caught or ignored */
1013                 perm = PROCESS__SIGSTOP;
1014                 break;
1015         default:
1016                 /* All other signals. */
1017                 perm = PROCESS__SIGNAL;
1018                 break;
1019         }
1020
1021         return perm;
1022 }
1023
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025    fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct *tsk1,
1027                          struct task_struct *tsk2,
1028                          u32 perms)
1029 {
1030         struct task_security_struct *tsec1, *tsec2;
1031
1032         tsec1 = tsk1->security;
1033         tsec2 = tsk2->security;
1034         return avc_has_perm(tsec1->sid, tsec2->sid,
1035                             SECCLASS_PROCESS, perms, NULL);
1036 }
1037
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct *tsk,
1040                                int cap)
1041 {
1042         struct task_security_struct *tsec;
1043         struct avc_audit_data ad;
1044
1045         tsec = tsk->security;
1046
1047         AVC_AUDIT_DATA_INIT(&ad,CAP);
1048         ad.tsk = tsk;
1049         ad.u.cap = cap;
1050
1051         return avc_has_perm(tsec->sid, tsec->sid,
1052                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053 }
1054
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct *tsk,
1057                            u32 perms)
1058 {
1059         struct task_security_struct *tsec;
1060
1061         tsec = tsk->security;
1062
1063         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064                             SECCLASS_SYSTEM, perms, NULL);
1065 }
1066
1067 /* Check whether a task has a particular permission to an inode.
1068    The 'adp' parameter is optional and allows other audit
1069    data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct *tsk,
1071                           struct inode *inode,
1072                           u32 perms,
1073                           struct avc_audit_data *adp)
1074 {
1075         struct task_security_struct *tsec;
1076         struct inode_security_struct *isec;
1077         struct avc_audit_data ad;
1078
1079         if (unlikely (IS_PRIVATE (inode)))
1080                 return 0;
1081
1082         tsec = tsk->security;
1083         isec = inode->i_security;
1084
1085         if (!adp) {
1086                 adp = &ad;
1087                 AVC_AUDIT_DATA_INIT(&ad, FS);
1088                 ad.u.fs.inode = inode;
1089         }
1090
1091         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092 }
1093
1094 /* Same as inode_has_perm, but pass explicit audit data containing
1095    the dentry to help the auditing code to more easily generate the
1096    pathname if needed. */
1097 static inline int dentry_has_perm(struct task_struct *tsk,
1098                                   struct vfsmount *mnt,
1099                                   struct dentry *dentry,
1100                                   u32 av)
1101 {
1102         struct inode *inode = dentry->d_inode;
1103         struct avc_audit_data ad;
1104         AVC_AUDIT_DATA_INIT(&ad,FS);
1105         ad.u.fs.mnt = mnt;
1106         ad.u.fs.dentry = dentry;
1107         return inode_has_perm(tsk, inode, av, &ad);
1108 }
1109
1110 /* Check whether a task can use an open file descriptor to
1111    access an inode in a given way.  Check access to the
1112    descriptor itself, and then use dentry_has_perm to
1113    check a particular permission to the file.
1114    Access to the descriptor is implicitly granted if it
1115    has the same SID as the process.  If av is zero, then
1116    access to the file is not checked, e.g. for cases
1117    where only the descriptor is affected like seek. */
1118 static int file_has_perm(struct task_struct *tsk,
1119                                 struct file *file,
1120                                 u32 av)
1121 {
1122         struct task_security_struct *tsec = tsk->security;
1123         struct file_security_struct *fsec = file->f_security;
1124         struct vfsmount *mnt = file->f_path.mnt;
1125         struct dentry *dentry = file->f_path.dentry;
1126         struct inode *inode = dentry->d_inode;
1127         struct avc_audit_data ad;
1128         int rc;
1129
1130         AVC_AUDIT_DATA_INIT(&ad, FS);
1131         ad.u.fs.mnt = mnt;
1132         ad.u.fs.dentry = dentry;
1133
1134         if (tsec->sid != fsec->sid) {
1135                 rc = avc_has_perm(tsec->sid, fsec->sid,
1136                                   SECCLASS_FD,
1137                                   FD__USE,
1138                                   &ad);
1139                 if (rc)
1140                         return rc;
1141         }
1142
1143         /* av is zero if only checking access to the descriptor. */
1144         if (av)
1145                 return inode_has_perm(tsk, inode, av, &ad);
1146
1147         return 0;
1148 }
1149
1150 /* Check whether a task can create a file. */
1151 static int may_create(struct inode *dir,
1152                       struct dentry *dentry,
1153                       u16 tclass)
1154 {
1155         struct task_security_struct *tsec;
1156         struct inode_security_struct *dsec;
1157         struct superblock_security_struct *sbsec;
1158         u32 newsid;
1159         struct avc_audit_data ad;
1160         int rc;
1161
1162         tsec = current->security;
1163         dsec = dir->i_security;
1164         sbsec = dir->i_sb->s_security;
1165
1166         AVC_AUDIT_DATA_INIT(&ad, FS);
1167         ad.u.fs.dentry = dentry;
1168
1169         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170                           DIR__ADD_NAME | DIR__SEARCH,
1171                           &ad);
1172         if (rc)
1173                 return rc;
1174
1175         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176                 newsid = tsec->create_sid;
1177         } else {
1178                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179                                              &newsid);
1180                 if (rc)
1181                         return rc;
1182         }
1183
1184         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185         if (rc)
1186                 return rc;
1187
1188         return avc_has_perm(newsid, sbsec->sid,
1189                             SECCLASS_FILESYSTEM,
1190                             FILESYSTEM__ASSOCIATE, &ad);
1191 }
1192
1193 /* Check whether a task can create a key. */
1194 static int may_create_key(u32 ksid,
1195                           struct task_struct *ctx)
1196 {
1197         struct task_security_struct *tsec;
1198
1199         tsec = ctx->security;
1200
1201         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202 }
1203
1204 #define MAY_LINK   0
1205 #define MAY_UNLINK 1
1206 #define MAY_RMDIR  2
1207
1208 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1209 static int may_link(struct inode *dir,
1210                     struct dentry *dentry,
1211                     int kind)
1212
1213 {
1214         struct task_security_struct *tsec;
1215         struct inode_security_struct *dsec, *isec;
1216         struct avc_audit_data ad;
1217         u32 av;
1218         int rc;
1219
1220         tsec = current->security;
1221         dsec = dir->i_security;
1222         isec = dentry->d_inode->i_security;
1223
1224         AVC_AUDIT_DATA_INIT(&ad, FS);
1225         ad.u.fs.dentry = dentry;
1226
1227         av = DIR__SEARCH;
1228         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230         if (rc)
1231                 return rc;
1232
1233         switch (kind) {
1234         case MAY_LINK:
1235                 av = FILE__LINK;
1236                 break;
1237         case MAY_UNLINK:
1238                 av = FILE__UNLINK;
1239                 break;
1240         case MAY_RMDIR:
1241                 av = DIR__RMDIR;
1242                 break;
1243         default:
1244                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1245                 return 0;
1246         }
1247
1248         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249         return rc;
1250 }
1251
1252 static inline int may_rename(struct inode *old_dir,
1253                              struct dentry *old_dentry,
1254                              struct inode *new_dir,
1255                              struct dentry *new_dentry)
1256 {
1257         struct task_security_struct *tsec;
1258         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259         struct avc_audit_data ad;
1260         u32 av;
1261         int old_is_dir, new_is_dir;
1262         int rc;
1263
1264         tsec = current->security;
1265         old_dsec = old_dir->i_security;
1266         old_isec = old_dentry->d_inode->i_security;
1267         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268         new_dsec = new_dir->i_security;
1269
1270         AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272         ad.u.fs.dentry = old_dentry;
1273         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275         if (rc)
1276                 return rc;
1277         rc = avc_has_perm(tsec->sid, old_isec->sid,
1278                           old_isec->sclass, FILE__RENAME, &ad);
1279         if (rc)
1280                 return rc;
1281         if (old_is_dir && new_dir != old_dir) {
1282                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283                                   old_isec->sclass, DIR__REPARENT, &ad);
1284                 if (rc)
1285                         return rc;
1286         }
1287
1288         ad.u.fs.dentry = new_dentry;
1289         av = DIR__ADD_NAME | DIR__SEARCH;
1290         if (new_dentry->d_inode)
1291                 av |= DIR__REMOVE_NAME;
1292         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293         if (rc)
1294                 return rc;
1295         if (new_dentry->d_inode) {
1296                 new_isec = new_dentry->d_inode->i_security;
1297                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299                                   new_isec->sclass,
1300                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301                 if (rc)
1302                         return rc;
1303         }
1304
1305         return 0;
1306 }
1307
1308 /* Check whether a task can perform a filesystem operation. */
1309 static int superblock_has_perm(struct task_struct *tsk,
1310                                struct super_block *sb,
1311                                u32 perms,
1312                                struct avc_audit_data *ad)
1313 {
1314         struct task_security_struct *tsec;
1315         struct superblock_security_struct *sbsec;
1316
1317         tsec = tsk->security;
1318         sbsec = sb->s_security;
1319         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320                             perms, ad);
1321 }
1322
1323 /* Convert a Linux mode and permission mask to an access vector. */
1324 static inline u32 file_mask_to_av(int mode, int mask)
1325 {
1326         u32 av = 0;
1327
1328         if ((mode & S_IFMT) != S_IFDIR) {
1329                 if (mask & MAY_EXEC)
1330                         av |= FILE__EXECUTE;
1331                 if (mask & MAY_READ)
1332                         av |= FILE__READ;
1333
1334                 if (mask & MAY_APPEND)
1335                         av |= FILE__APPEND;
1336                 else if (mask & MAY_WRITE)
1337                         av |= FILE__WRITE;
1338
1339         } else {
1340                 if (mask & MAY_EXEC)
1341                         av |= DIR__SEARCH;
1342                 if (mask & MAY_WRITE)
1343                         av |= DIR__WRITE;
1344                 if (mask & MAY_READ)
1345                         av |= DIR__READ;
1346         }
1347
1348         return av;
1349 }
1350
1351 /* Convert a Linux file to an access vector. */
1352 static inline u32 file_to_av(struct file *file)
1353 {
1354         u32 av = 0;
1355
1356         if (file->f_mode & FMODE_READ)
1357                 av |= FILE__READ;
1358         if (file->f_mode & FMODE_WRITE) {
1359                 if (file->f_flags & O_APPEND)
1360                         av |= FILE__APPEND;
1361                 else
1362                         av |= FILE__WRITE;
1363         }
1364
1365         return av;
1366 }
1367
1368 /* Hook functions begin here. */
1369
1370 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371 {
1372         struct task_security_struct *psec = parent->security;
1373         struct task_security_struct *csec = child->security;
1374         int rc;
1375
1376         rc = secondary_ops->ptrace(parent,child);
1377         if (rc)
1378                 return rc;
1379
1380         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381         /* Save the SID of the tracing process for later use in apply_creds. */
1382         if (!(child->ptrace & PT_PTRACED) && !rc)
1383                 csec->ptrace_sid = psec->sid;
1384         return rc;
1385 }
1386
1387 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389 {
1390         int error;
1391
1392         error = task_has_perm(current, target, PROCESS__GETCAP);
1393         if (error)
1394                 return error;
1395
1396         return secondary_ops->capget(target, effective, inheritable, permitted);
1397 }
1398
1399 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402         int error;
1403
1404         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405         if (error)
1406                 return error;
1407
1408         return task_has_perm(current, target, PROCESS__SETCAP);
1409 }
1410
1411 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414         secondary_ops->capset_set(target, effective, inheritable, permitted);
1415 }
1416
1417 static int selinux_capable(struct task_struct *tsk, int cap)
1418 {
1419         int rc;
1420
1421         rc = secondary_ops->capable(tsk, cap);
1422         if (rc)
1423                 return rc;
1424
1425         return task_has_capability(tsk,cap);
1426 }
1427
1428 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429 {
1430         int buflen, rc;
1431         char *buffer, *path, *end;
1432
1433         rc = -ENOMEM;
1434         buffer = (char*)__get_free_page(GFP_KERNEL);
1435         if (!buffer)
1436                 goto out;
1437
1438         buflen = PAGE_SIZE;
1439         end = buffer+buflen;
1440         *--end = '\0';
1441         buflen--;
1442         path = end-1;
1443         *path = '/';
1444         while (table) {
1445                 const char *name = table->procname;
1446                 size_t namelen = strlen(name);
1447                 buflen -= namelen + 1;
1448                 if (buflen < 0)
1449                         goto out_free;
1450                 end -= namelen;
1451                 memcpy(end, name, namelen);
1452                 *--end = '/';
1453                 path = end;
1454                 table = table->parent;
1455         }
1456         buflen -= 4;
1457         if (buflen < 0)
1458                 goto out_free;
1459         end -= 4;
1460         memcpy(end, "/sys", 4);
1461         path = end;
1462         rc = security_genfs_sid("proc", path, tclass, sid);
1463 out_free:
1464         free_page((unsigned long)buffer);
1465 out:
1466         return rc;
1467 }
1468
1469 static int selinux_sysctl(ctl_table *table, int op)
1470 {
1471         int error = 0;
1472         u32 av;
1473         struct task_security_struct *tsec;
1474         u32 tsid;
1475         int rc;
1476
1477         rc = secondary_ops->sysctl(table, op);
1478         if (rc)
1479                 return rc;
1480
1481         tsec = current->security;
1482
1483         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1485         if (rc) {
1486                 /* Default to the well-defined sysctl SID. */
1487                 tsid = SECINITSID_SYSCTL;
1488         }
1489
1490         /* The op values are "defined" in sysctl.c, thereby creating
1491          * a bad coupling between this module and sysctl.c */
1492         if(op == 001) {
1493                 error = avc_has_perm(tsec->sid, tsid,
1494                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1495         } else {
1496                 av = 0;
1497                 if (op & 004)
1498                         av |= FILE__READ;
1499                 if (op & 002)
1500                         av |= FILE__WRITE;
1501                 if (av)
1502                         error = avc_has_perm(tsec->sid, tsid,
1503                                              SECCLASS_FILE, av, NULL);
1504         }
1505
1506         return error;
1507 }
1508
1509 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510 {
1511         int rc = 0;
1512
1513         if (!sb)
1514                 return 0;
1515
1516         switch (cmds) {
1517                 case Q_SYNC:
1518                 case Q_QUOTAON:
1519                 case Q_QUOTAOFF:
1520                 case Q_SETINFO:
1521                 case Q_SETQUOTA:
1522                         rc = superblock_has_perm(current,
1523                                                  sb,
1524                                                  FILESYSTEM__QUOTAMOD, NULL);
1525                         break;
1526                 case Q_GETFMT:
1527                 case Q_GETINFO:
1528                 case Q_GETQUOTA:
1529                         rc = superblock_has_perm(current,
1530                                                  sb,
1531                                                  FILESYSTEM__QUOTAGET, NULL);
1532                         break;
1533                 default:
1534                         rc = 0;  /* let the kernel handle invalid cmds */
1535                         break;
1536         }
1537         return rc;
1538 }
1539
1540 static int selinux_quota_on(struct dentry *dentry)
1541 {
1542         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543 }
1544
1545 static int selinux_syslog(int type)
1546 {
1547         int rc;
1548
1549         rc = secondary_ops->syslog(type);
1550         if (rc)
1551                 return rc;
1552
1553         switch (type) {
1554                 case 3:         /* Read last kernel messages */
1555                 case 10:        /* Return size of the log buffer */
1556                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557                         break;
1558                 case 6:         /* Disable logging to console */
1559                 case 7:         /* Enable logging to console */
1560                 case 8:         /* Set level of messages printed to console */
1561                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562                         break;
1563                 case 0:         /* Close log */
1564                 case 1:         /* Open log */
1565                 case 2:         /* Read from log */
1566                 case 4:         /* Read/clear last kernel messages */
1567                 case 5:         /* Clear ring buffer */
1568                 default:
1569                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570                         break;
1571         }
1572         return rc;
1573 }
1574
1575 /*
1576  * Check that a process has enough memory to allocate a new virtual
1577  * mapping. 0 means there is enough memory for the allocation to
1578  * succeed and -ENOMEM implies there is not.
1579  *
1580  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581  * if the capability is granted, but __vm_enough_memory requires 1 if
1582  * the capability is granted.
1583  *
1584  * Do not audit the selinux permission check, as this is applied to all
1585  * processes that allocate mappings.
1586  */
1587 static int selinux_vm_enough_memory(long pages)
1588 {
1589         int rc, cap_sys_admin = 0;
1590         struct task_security_struct *tsec = current->security;
1591
1592         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593         if (rc == 0)
1594                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595                                         SECCLASS_CAPABILITY,
1596                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1597                                         NULL);
1598
1599         if (rc == 0)
1600                 cap_sys_admin = 1;
1601
1602         return __vm_enough_memory(pages, cap_sys_admin);
1603 }
1604
1605 /* binprm security operations */
1606
1607 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1608 {
1609         struct bprm_security_struct *bsec;
1610
1611         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1612         if (!bsec)
1613                 return -ENOMEM;
1614
1615         bsec->bprm = bprm;
1616         bsec->sid = SECINITSID_UNLABELED;
1617         bsec->set = 0;
1618
1619         bprm->security = bsec;
1620         return 0;
1621 }
1622
1623 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1624 {
1625         struct task_security_struct *tsec;
1626         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1627         struct inode_security_struct *isec;
1628         struct bprm_security_struct *bsec;
1629         u32 newsid;
1630         struct avc_audit_data ad;
1631         int rc;
1632
1633         rc = secondary_ops->bprm_set_security(bprm);
1634         if (rc)
1635                 return rc;
1636
1637         bsec = bprm->security;
1638
1639         if (bsec->set)
1640                 return 0;
1641
1642         tsec = current->security;
1643         isec = inode->i_security;
1644
1645         /* Default to the current task SID. */
1646         bsec->sid = tsec->sid;
1647
1648         /* Reset fs, key, and sock SIDs on execve. */
1649         tsec->create_sid = 0;
1650         tsec->keycreate_sid = 0;
1651         tsec->sockcreate_sid = 0;
1652
1653         if (tsec->exec_sid) {
1654                 newsid = tsec->exec_sid;
1655                 /* Reset exec SID on execve. */
1656                 tsec->exec_sid = 0;
1657         } else {
1658                 /* Check for a default transition on this program. */
1659                 rc = security_transition_sid(tsec->sid, isec->sid,
1660                                              SECCLASS_PROCESS, &newsid);
1661                 if (rc)
1662                         return rc;
1663         }
1664
1665         AVC_AUDIT_DATA_INIT(&ad, FS);
1666         ad.u.fs.mnt = bprm->file->f_path.mnt;
1667         ad.u.fs.dentry = bprm->file->f_path.dentry;
1668
1669         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1670                 newsid = tsec->sid;
1671
1672         if (tsec->sid == newsid) {
1673                 rc = avc_has_perm(tsec->sid, isec->sid,
1674                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1675                 if (rc)
1676                         return rc;
1677         } else {
1678                 /* Check permissions for the transition. */
1679                 rc = avc_has_perm(tsec->sid, newsid,
1680                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1681                 if (rc)
1682                         return rc;
1683
1684                 rc = avc_has_perm(newsid, isec->sid,
1685                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1686                 if (rc)
1687                         return rc;
1688
1689                 /* Clear any possibly unsafe personality bits on exec: */
1690                 current->personality &= ~PER_CLEAR_ON_SETID;
1691
1692                 /* Set the security field to the new SID. */
1693                 bsec->sid = newsid;
1694         }
1695
1696         bsec->set = 1;
1697         return 0;
1698 }
1699
1700 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1701 {
1702         return secondary_ops->bprm_check_security(bprm);
1703 }
1704
1705
1706 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1707 {
1708         struct task_security_struct *tsec = current->security;
1709         int atsecure = 0;
1710
1711         if (tsec->osid != tsec->sid) {
1712                 /* Enable secure mode for SIDs transitions unless
1713                    the noatsecure permission is granted between
1714                    the two SIDs, i.e. ahp returns 0. */
1715                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1716                                          SECCLASS_PROCESS,
1717                                          PROCESS__NOATSECURE, NULL);
1718         }
1719
1720         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1721 }
1722
1723 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1724 {
1725         kfree(bprm->security);
1726         bprm->security = NULL;
1727 }
1728
1729 extern struct vfsmount *selinuxfs_mount;
1730 extern struct dentry *selinux_null;
1731
1732 /* Derived from fs/exec.c:flush_old_files. */
1733 static inline void flush_unauthorized_files(struct files_struct * files)
1734 {
1735         struct avc_audit_data ad;
1736         struct file *file, *devnull = NULL;
1737         struct tty_struct *tty;
1738         struct fdtable *fdt;
1739         long j = -1;
1740         int drop_tty = 0;
1741
1742         mutex_lock(&tty_mutex);
1743         tty = get_current_tty();
1744         if (tty) {
1745                 file_list_lock();
1746                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1747                 if (file) {
1748                         /* Revalidate access to controlling tty.
1749                            Use inode_has_perm on the tty inode directly rather
1750                            than using file_has_perm, as this particular open
1751                            file may belong to another process and we are only
1752                            interested in the inode-based check here. */
1753                         struct inode *inode = file->f_path.dentry->d_inode;
1754                         if (inode_has_perm(current, inode,
1755                                            FILE__READ | FILE__WRITE, NULL)) {
1756                                 drop_tty = 1;
1757                         }
1758                 }
1759                 file_list_unlock();
1760         }
1761         mutex_unlock(&tty_mutex);
1762         /* Reset controlling tty. */
1763         if (drop_tty)
1764                 no_tty();
1765
1766         /* Revalidate access to inherited open files. */
1767
1768         AVC_AUDIT_DATA_INIT(&ad,FS);
1769
1770         spin_lock(&files->file_lock);
1771         for (;;) {
1772                 unsigned long set, i;
1773                 int fd;
1774
1775                 j++;
1776                 i = j * __NFDBITS;
1777                 fdt = files_fdtable(files);
1778                 if (i >= fdt->max_fds)
1779                         break;
1780                 set = fdt->open_fds->fds_bits[j];
1781                 if (!set)
1782                         continue;
1783                 spin_unlock(&files->file_lock);
1784                 for ( ; set ; i++,set >>= 1) {
1785                         if (set & 1) {
1786                                 file = fget(i);
1787                                 if (!file)
1788                                         continue;
1789                                 if (file_has_perm(current,
1790                                                   file,
1791                                                   file_to_av(file))) {
1792                                         sys_close(i);
1793                                         fd = get_unused_fd();
1794                                         if (fd != i) {
1795                                                 if (fd >= 0)
1796                                                         put_unused_fd(fd);
1797                                                 fput(file);
1798                                                 continue;
1799                                         }
1800                                         if (devnull) {
1801                                                 get_file(devnull);
1802                                         } else {
1803                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1804                                                 if (IS_ERR(devnull)) {
1805                                                         devnull = NULL;
1806                                                         put_unused_fd(fd);
1807                                                         fput(file);
1808                                                         continue;
1809                                                 }
1810                                         }
1811                                         fd_install(fd, devnull);
1812                                 }
1813                                 fput(file);
1814                         }
1815                 }
1816                 spin_lock(&files->file_lock);
1817
1818         }
1819         spin_unlock(&files->file_lock);
1820 }
1821
1822 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1823 {
1824         struct task_security_struct *tsec;
1825         struct bprm_security_struct *bsec;
1826         u32 sid;
1827         int rc;
1828
1829         secondary_ops->bprm_apply_creds(bprm, unsafe);
1830
1831         tsec = current->security;
1832
1833         bsec = bprm->security;
1834         sid = bsec->sid;
1835
1836         tsec->osid = tsec->sid;
1837         bsec->unsafe = 0;
1838         if (tsec->sid != sid) {
1839                 /* Check for shared state.  If not ok, leave SID
1840                    unchanged and kill. */
1841                 if (unsafe & LSM_UNSAFE_SHARE) {
1842                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1843                                         PROCESS__SHARE, NULL);
1844                         if (rc) {
1845                                 bsec->unsafe = 1;
1846                                 return;
1847                         }
1848                 }
1849
1850                 /* Check for ptracing, and update the task SID if ok.
1851                    Otherwise, leave SID unchanged and kill. */
1852                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1853                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1854                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1855                                           NULL);
1856                         if (rc) {
1857                                 bsec->unsafe = 1;
1858                                 return;
1859                         }
1860                 }
1861                 tsec->sid = sid;
1862         }
1863 }
1864
1865 /*
1866  * called after apply_creds without the task lock held
1867  */
1868 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1869 {
1870         struct task_security_struct *tsec;
1871         struct rlimit *rlim, *initrlim;
1872         struct itimerval itimer;
1873         struct bprm_security_struct *bsec;
1874         int rc, i;
1875
1876         tsec = current->security;
1877         bsec = bprm->security;
1878
1879         if (bsec->unsafe) {
1880                 force_sig_specific(SIGKILL, current);
1881                 return;
1882         }
1883         if (tsec->osid == tsec->sid)
1884                 return;
1885
1886         /* Close files for which the new task SID is not authorized. */
1887         flush_unauthorized_files(current->files);
1888
1889         /* Check whether the new SID can inherit signal state
1890            from the old SID.  If not, clear itimers to avoid
1891            subsequent signal generation and flush and unblock
1892            signals. This must occur _after_ the task SID has
1893           been updated so that any kill done after the flush
1894           will be checked against the new SID. */
1895         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1896                           PROCESS__SIGINH, NULL);
1897         if (rc) {
1898                 memset(&itimer, 0, sizeof itimer);
1899                 for (i = 0; i < 3; i++)
1900                         do_setitimer(i, &itimer, NULL);
1901                 flush_signals(current);
1902                 spin_lock_irq(&current->sighand->siglock);
1903                 flush_signal_handlers(current, 1);
1904                 sigemptyset(&current->blocked);
1905                 recalc_sigpending();
1906                 spin_unlock_irq(&current->sighand->siglock);
1907         }
1908
1909         /* Check whether the new SID can inherit resource limits
1910            from the old SID.  If not, reset all soft limits to
1911            the lower of the current task's hard limit and the init
1912            task's soft limit.  Note that the setting of hard limits
1913            (even to lower them) can be controlled by the setrlimit
1914            check. The inclusion of the init task's soft limit into
1915            the computation is to avoid resetting soft limits higher
1916            than the default soft limit for cases where the default
1917            is lower than the hard limit, e.g. RLIMIT_CORE or
1918            RLIMIT_STACK.*/
1919         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1920                           PROCESS__RLIMITINH, NULL);
1921         if (rc) {
1922                 for (i = 0; i < RLIM_NLIMITS; i++) {
1923                         rlim = current->signal->rlim + i;
1924                         initrlim = init_task.signal->rlim+i;
1925                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1926                 }
1927                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1928                         /*
1929                          * This will cause RLIMIT_CPU calculations
1930                          * to be refigured.
1931                          */
1932                         current->it_prof_expires = jiffies_to_cputime(1);
1933                 }
1934         }
1935
1936         /* Wake up the parent if it is waiting so that it can
1937            recheck wait permission to the new task SID. */
1938         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1939 }
1940
1941 /* superblock security operations */
1942
1943 static int selinux_sb_alloc_security(struct super_block *sb)
1944 {
1945         return superblock_alloc_security(sb);
1946 }
1947
1948 static void selinux_sb_free_security(struct super_block *sb)
1949 {
1950         superblock_free_security(sb);
1951 }
1952
1953 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1954 {
1955         if (plen > olen)
1956                 return 0;
1957
1958         return !memcmp(prefix, option, plen);
1959 }
1960
1961 static inline int selinux_option(char *option, int len)
1962 {
1963         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1964                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1965                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1966                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1967 }
1968
1969 static inline void take_option(char **to, char *from, int *first, int len)
1970 {
1971         if (!*first) {
1972                 **to = ',';
1973                 *to += 1;
1974         } else
1975                 *first = 0;
1976         memcpy(*to, from, len);
1977         *to += len;
1978 }
1979
1980 static inline void take_selinux_option(char **to, char *from, int *first,
1981                                        int len)
1982 {
1983         int current_size = 0;
1984
1985         if (!*first) {
1986                 **to = '|';
1987                 *to += 1;
1988         }
1989         else
1990                 *first = 0;
1991
1992         while (current_size < len) {
1993                 if (*from != '"') {
1994                         **to = *from;
1995                         *to += 1;
1996                 }
1997                 from += 1;
1998                 current_size += 1;
1999         }
2000 }
2001
2002 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2003 {
2004         int fnosec, fsec, rc = 0;
2005         char *in_save, *in_curr, *in_end;
2006         char *sec_curr, *nosec_save, *nosec;
2007         int open_quote = 0;
2008
2009         in_curr = orig;
2010         sec_curr = copy;
2011
2012         /* Binary mount data: just copy */
2013         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2014                 copy_page(sec_curr, in_curr);
2015                 goto out;
2016         }
2017
2018         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2019         if (!nosec) {
2020                 rc = -ENOMEM;
2021                 goto out;
2022         }
2023
2024         nosec_save = nosec;
2025         fnosec = fsec = 1;
2026         in_save = in_end = orig;
2027
2028         do {
2029                 if (*in_end == '"')
2030                         open_quote = !open_quote;
2031                 if ((*in_end == ',' && open_quote == 0) ||
2032                                 *in_end == '\0') {
2033                         int len = in_end - in_curr;
2034
2035                         if (selinux_option(in_curr, len))
2036                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2037                         else
2038                                 take_option(&nosec, in_curr, &fnosec, len);
2039
2040                         in_curr = in_end + 1;
2041                 }
2042         } while (*in_end++);
2043
2044         strcpy(in_save, nosec_save);
2045         free_page((unsigned long)nosec_save);
2046 out:
2047         return rc;
2048 }
2049
2050 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2051 {
2052         struct avc_audit_data ad;
2053         int rc;
2054
2055         rc = superblock_doinit(sb, data);
2056         if (rc)
2057                 return rc;
2058
2059         AVC_AUDIT_DATA_INIT(&ad,FS);
2060         ad.u.fs.dentry = sb->s_root;
2061         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2062 }
2063
2064 static int selinux_sb_statfs(struct dentry *dentry)
2065 {
2066         struct avc_audit_data ad;
2067
2068         AVC_AUDIT_DATA_INIT(&ad,FS);
2069         ad.u.fs.dentry = dentry->d_sb->s_root;
2070         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2071 }
2072
2073 static int selinux_mount(char * dev_name,
2074                          struct nameidata *nd,
2075                          char * type,
2076                          unsigned long flags,
2077                          void * data)
2078 {
2079         int rc;
2080
2081         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2082         if (rc)
2083                 return rc;
2084
2085         if (flags & MS_REMOUNT)
2086                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2087                                            FILESYSTEM__REMOUNT, NULL);
2088         else
2089                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2090                                        FILE__MOUNTON);
2091 }
2092
2093 static int selinux_umount(struct vfsmount *mnt, int flags)
2094 {
2095         int rc;
2096
2097         rc = secondary_ops->sb_umount(mnt, flags);
2098         if (rc)
2099                 return rc;
2100
2101         return superblock_has_perm(current,mnt->mnt_sb,
2102                                    FILESYSTEM__UNMOUNT,NULL);
2103 }
2104
2105 /* inode security operations */
2106
2107 static int selinux_inode_alloc_security(struct inode *inode)
2108 {
2109         return inode_alloc_security(inode);
2110 }
2111
2112 static void selinux_inode_free_security(struct inode *inode)
2113 {
2114         inode_free_security(inode);
2115 }
2116
2117 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2118                                        char **name, void **value,
2119                                        size_t *len)
2120 {
2121         struct task_security_struct *tsec;
2122         struct inode_security_struct *dsec;
2123         struct superblock_security_struct *sbsec;
2124         u32 newsid, clen;
2125         int rc;
2126         char *namep = NULL, *context;
2127
2128         tsec = current->security;
2129         dsec = dir->i_security;
2130         sbsec = dir->i_sb->s_security;
2131
2132         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2133                 newsid = tsec->create_sid;
2134         } else {
2135                 rc = security_transition_sid(tsec->sid, dsec->sid,
2136                                              inode_mode_to_security_class(inode->i_mode),
2137                                              &newsid);
2138                 if (rc) {
2139                         printk(KERN_WARNING "%s:  "
2140                                "security_transition_sid failed, rc=%d (dev=%s "
2141                                "ino=%ld)\n",
2142                                __FUNCTION__,
2143                                -rc, inode->i_sb->s_id, inode->i_ino);
2144                         return rc;
2145                 }
2146         }
2147
2148         /* Possibly defer initialization to selinux_complete_init. */
2149         if (sbsec->initialized) {
2150                 struct inode_security_struct *isec = inode->i_security;
2151                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2152                 isec->sid = newsid;
2153                 isec->initialized = 1;
2154         }
2155
2156         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2157                 return -EOPNOTSUPP;
2158
2159         if (name) {
2160                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2161                 if (!namep)
2162                         return -ENOMEM;
2163                 *name = namep;
2164         }
2165
2166         if (value && len) {
2167                 rc = security_sid_to_context(newsid, &context, &clen);
2168                 if (rc) {
2169                         kfree(namep);
2170                         return rc;
2171                 }
2172                 *value = context;
2173                 *len = clen;
2174         }
2175
2176         return 0;
2177 }
2178
2179 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2180 {
2181         return may_create(dir, dentry, SECCLASS_FILE);
2182 }
2183
2184 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2185 {
2186         int rc;
2187
2188         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2189         if (rc)
2190                 return rc;
2191         return may_link(dir, old_dentry, MAY_LINK);
2192 }
2193
2194 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2195 {
2196         int rc;
2197
2198         rc = secondary_ops->inode_unlink(dir, dentry);
2199         if (rc)
2200                 return rc;
2201         return may_link(dir, dentry, MAY_UNLINK);
2202 }
2203
2204 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2205 {
2206         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2207 }
2208
2209 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2210 {
2211         return may_create(dir, dentry, SECCLASS_DIR);
2212 }
2213
2214 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2215 {
2216         return may_link(dir, dentry, MAY_RMDIR);
2217 }
2218
2219 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2220 {
2221         int rc;
2222
2223         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2224         if (rc)
2225                 return rc;
2226
2227         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2228 }
2229
2230 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2231                                 struct inode *new_inode, struct dentry *new_dentry)
2232 {
2233         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2234 }
2235
2236 static int selinux_inode_readlink(struct dentry *dentry)
2237 {
2238         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2239 }
2240
2241 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2242 {
2243         int rc;
2244
2245         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2246         if (rc)
2247                 return rc;
2248         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2249 }
2250
2251 static int selinux_inode_permission(struct inode *inode, int mask,
2252                                     struct nameidata *nd)
2253 {
2254         int rc;
2255
2256         rc = secondary_ops->inode_permission(inode, mask, nd);
2257         if (rc)
2258                 return rc;
2259
2260         if (!mask) {
2261                 /* No permission to check.  Existence test. */
2262                 return 0;
2263         }
2264
2265         return inode_has_perm(current, inode,
2266                                file_mask_to_av(inode->i_mode, mask), NULL);
2267 }
2268
2269 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2270 {
2271         int rc;
2272
2273         rc = secondary_ops->inode_setattr(dentry, iattr);
2274         if (rc)
2275                 return rc;
2276
2277         if (iattr->ia_valid & ATTR_FORCE)
2278                 return 0;
2279
2280         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2281                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2282                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2283
2284         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2285 }
2286
2287 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2288 {
2289         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2290 }
2291
2292 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2293 {
2294         struct task_security_struct *tsec = current->security;
2295         struct inode *inode = dentry->d_inode;
2296         struct inode_security_struct *isec = inode->i_security;
2297         struct superblock_security_struct *sbsec;
2298         struct avc_audit_data ad;
2299         u32 newsid;
2300         int rc = 0;
2301
2302         if (strcmp(name, XATTR_NAME_SELINUX)) {
2303                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2304                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2305                     !capable(CAP_SYS_ADMIN)) {
2306                         /* A different attribute in the security namespace.
2307                            Restrict to administrator. */
2308                         return -EPERM;
2309                 }
2310
2311                 /* Not an attribute we recognize, so just check the
2312                    ordinary setattr permission. */
2313                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2314         }
2315
2316         sbsec = inode->i_sb->s_security;
2317         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2318                 return -EOPNOTSUPP;
2319
2320         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2321                 return -EPERM;
2322
2323         AVC_AUDIT_DATA_INIT(&ad,FS);
2324         ad.u.fs.dentry = dentry;
2325
2326         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2327                           FILE__RELABELFROM, &ad);
2328         if (rc)
2329                 return rc;
2330
2331         rc = security_context_to_sid(value, size, &newsid);
2332         if (rc)
2333                 return rc;
2334
2335         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2336                           FILE__RELABELTO, &ad);
2337         if (rc)
2338                 return rc;
2339
2340         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2341                                           isec->sclass);
2342         if (rc)
2343                 return rc;
2344
2345         return avc_has_perm(newsid,
2346                             sbsec->sid,
2347                             SECCLASS_FILESYSTEM,
2348                             FILESYSTEM__ASSOCIATE,
2349                             &ad);
2350 }
2351
2352 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2353                                         void *value, size_t size, int flags)
2354 {
2355         struct inode *inode = dentry->d_inode;
2356         struct inode_security_struct *isec = inode->i_security;
2357         u32 newsid;
2358         int rc;
2359
2360         if (strcmp(name, XATTR_NAME_SELINUX)) {
2361                 /* Not an attribute we recognize, so nothing to do. */
2362                 return;
2363         }
2364
2365         rc = security_context_to_sid(value, size, &newsid);
2366         if (rc) {
2367                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2368                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2369                 return;
2370         }
2371
2372         isec->sid = newsid;
2373         return;
2374 }
2375
2376 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2377 {
2378         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2379 }
2380
2381 static int selinux_inode_listxattr (struct dentry *dentry)
2382 {
2383         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2384 }
2385
2386 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2387 {
2388         if (strcmp(name, XATTR_NAME_SELINUX)) {
2389                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2390                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2391                     !capable(CAP_SYS_ADMIN)) {
2392                         /* A different attribute in the security namespace.
2393                            Restrict to administrator. */
2394                         return -EPERM;
2395                 }
2396
2397                 /* Not an attribute we recognize, so just check the
2398                    ordinary setattr permission. Might want a separate
2399                    permission for removexattr. */
2400                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2401         }
2402
2403         /* No one is allowed to remove a SELinux security label.
2404            You can change the label, but all data must be labeled. */
2405         return -EACCES;
2406 }
2407
2408 static const char *selinux_inode_xattr_getsuffix(void)
2409 {
2410       return XATTR_SELINUX_SUFFIX;
2411 }
2412
2413 /*
2414  * Copy the in-core inode security context value to the user.  If the
2415  * getxattr() prior to this succeeded, check to see if we need to
2416  * canonicalize the value to be finally returned to the user.
2417  *
2418  * Permission check is handled by selinux_inode_getxattr hook.
2419  */
2420 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2421 {
2422         struct inode_security_struct *isec = inode->i_security;
2423
2424         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2425                 return -EOPNOTSUPP;
2426
2427         return selinux_getsecurity(isec->sid, buffer, size);
2428 }
2429
2430 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2431                                      const void *value, size_t size, int flags)
2432 {
2433         struct inode_security_struct *isec = inode->i_security;
2434         u32 newsid;
2435         int rc;
2436
2437         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2438                 return -EOPNOTSUPP;
2439
2440         if (!value || !size)
2441                 return -EACCES;
2442
2443         rc = security_context_to_sid((void*)value, size, &newsid);
2444         if (rc)
2445                 return rc;
2446
2447         isec->sid = newsid;
2448         return 0;
2449 }
2450
2451 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2452 {
2453         const int len = sizeof(XATTR_NAME_SELINUX);
2454         if (buffer && len <= buffer_size)
2455                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2456         return len;
2457 }
2458
2459 /* file security operations */
2460
2461 static int selinux_file_permission(struct file *file, int mask)
2462 {
2463         int rc;
2464         struct inode *inode = file->f_path.dentry->d_inode;
2465
2466         if (!mask) {
2467                 /* No permission to check.  Existence test. */
2468                 return 0;
2469         }
2470
2471         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2472         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2473                 mask |= MAY_APPEND;
2474
2475         rc = file_has_perm(current, file,
2476                            file_mask_to_av(inode->i_mode, mask));
2477         if (rc)
2478                 return rc;
2479
2480         return selinux_netlbl_inode_permission(inode, mask);
2481 }
2482
2483 static int selinux_file_alloc_security(struct file *file)
2484 {
2485         return file_alloc_security(file);
2486 }
2487
2488 static void selinux_file_free_security(struct file *file)
2489 {
2490         file_free_security(file);
2491 }
2492
2493 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2494                               unsigned long arg)
2495 {
2496         int error = 0;
2497
2498         switch (cmd) {
2499                 case FIONREAD:
2500                 /* fall through */
2501                 case FIBMAP:
2502                 /* fall through */
2503                 case FIGETBSZ:
2504                 /* fall through */
2505                 case EXT2_IOC_GETFLAGS:
2506                 /* fall through */
2507                 case EXT2_IOC_GETVERSION:
2508                         error = file_has_perm(current, file, FILE__GETATTR);
2509                         break;
2510
2511                 case EXT2_IOC_SETFLAGS:
2512                 /* fall through */
2513                 case EXT2_IOC_SETVERSION:
2514                         error = file_has_perm(current, file, FILE__SETATTR);
2515                         break;
2516
2517                 /* sys_ioctl() checks */
2518                 case FIONBIO:
2519                 /* fall through */
2520                 case FIOASYNC:
2521                         error = file_has_perm(current, file, 0);
2522                         break;
2523
2524                 case KDSKBENT:
2525                 case KDSKBSENT:
2526                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2527                         break;
2528
2529                 /* default case assumes that the command will go
2530                  * to the file's ioctl() function.
2531                  */
2532                 default:
2533                         error = file_has_perm(current, file, FILE__IOCTL);
2534
2535         }
2536         return error;
2537 }
2538
2539 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2540 {
2541 #ifndef CONFIG_PPC32
2542         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2543                 /*
2544                  * We are making executable an anonymous mapping or a
2545                  * private file mapping that will also be writable.
2546                  * This has an additional check.
2547                  */
2548                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2549                 if (rc)
2550                         return rc;
2551         }
2552 #endif
2553
2554         if (file) {
2555                 /* read access is always possible with a mapping */
2556                 u32 av = FILE__READ;
2557
2558                 /* write access only matters if the mapping is shared */
2559                 if (shared && (prot & PROT_WRITE))
2560                         av |= FILE__WRITE;
2561
2562                 if (prot & PROT_EXEC)
2563                         av |= FILE__EXECUTE;
2564
2565                 return file_has_perm(current, file, av);
2566         }
2567         return 0;
2568 }
2569
2570 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2571                              unsigned long prot, unsigned long flags)
2572 {
2573         int rc;
2574
2575         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2576         if (rc)
2577                 return rc;
2578
2579         if (selinux_checkreqprot)
2580                 prot = reqprot;
2581
2582         return file_map_prot_check(file, prot,
2583                                    (flags & MAP_TYPE) == MAP_SHARED);
2584 }
2585
2586 static int selinux_file_mprotect(struct vm_area_struct *vma,
2587                                  unsigned long reqprot,
2588                                  unsigned long prot)
2589 {
2590         int rc;
2591
2592         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2593         if (rc)
2594                 return rc;
2595
2596         if (selinux_checkreqprot)
2597                 prot = reqprot;
2598
2599 #ifndef CONFIG_PPC32
2600         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2601                 rc = 0;
2602                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2603                     vma->vm_end <= vma->vm_mm->brk) {
2604                         rc = task_has_perm(current, current,
2605                                            PROCESS__EXECHEAP);
2606                 } else if (!vma->vm_file &&
2607                            vma->vm_start <= vma->vm_mm->start_stack &&
2608                            vma->vm_end >= vma->vm_mm->start_stack) {
2609                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2610                 } else if (vma->vm_file && vma->anon_vma) {
2611                         /*
2612                          * We are making executable a file mapping that has
2613                          * had some COW done. Since pages might have been
2614                          * written, check ability to execute the possibly
2615                          * modified content.  This typically should only
2616                          * occur for text relocations.
2617                          */
2618                         rc = file_has_perm(current, vma->vm_file,
2619                                            FILE__EXECMOD);
2620                 }
2621                 if (rc)
2622                         return rc;
2623         }
2624 #endif
2625
2626         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2627 }
2628
2629 static int selinux_file_lock(struct file *file, unsigned int cmd)
2630 {
2631         return file_has_perm(current, file, FILE__LOCK);
2632 }
2633
2634 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2635                               unsigned long arg)
2636 {
2637         int err = 0;
2638
2639         switch (cmd) {
2640                 case F_SETFL:
2641                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2642                                 err = -EINVAL;
2643                                 break;
2644                         }
2645
2646                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2647                                 err = file_has_perm(current, file,FILE__WRITE);
2648                                 break;
2649                         }
2650                         /* fall through */
2651                 case F_SETOWN:
2652                 case F_SETSIG:
2653                 case F_GETFL:
2654                 case F_GETOWN:
2655                 case F_GETSIG:
2656                         /* Just check FD__USE permission */
2657                         err = file_has_perm(current, file, 0);
2658                         break;
2659                 case F_GETLK:
2660                 case F_SETLK:
2661                 case F_SETLKW:
2662 #if BITS_PER_LONG == 32
2663                 case F_GETLK64:
2664                 case F_SETLK64:
2665                 case F_SETLKW64:
2666 #endif
2667                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2668                                 err = -EINVAL;
2669                                 break;
2670                         }
2671                         err = file_has_perm(current, file, FILE__LOCK);
2672                         break;
2673         }
2674
2675         return err;
2676 }
2677
2678 static int selinux_file_set_fowner(struct file *file)
2679 {
2680         struct task_security_struct *tsec;
2681         struct file_security_struct *fsec;
2682
2683         tsec = current->security;
2684         fsec = file->f_security;
2685         fsec->fown_sid = tsec->sid;
2686
2687         return 0;
2688 }
2689
2690 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2691                                        struct fown_struct *fown, int signum)
2692 {
2693         struct file *file;
2694         u32 perm;
2695         struct task_security_struct *tsec;
2696         struct file_security_struct *fsec;
2697
2698         /* struct fown_struct is never outside the context of a struct file */
2699         file = container_of(fown, struct file, f_owner);
2700
2701         tsec = tsk->security;
2702         fsec = file->f_security;
2703
2704         if (!signum)
2705                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2706         else
2707                 perm = signal_to_av(signum);
2708
2709         return avc_has_perm(fsec->fown_sid, tsec->sid,
2710                             SECCLASS_PROCESS, perm, NULL);
2711 }
2712
2713 static int selinux_file_receive(struct file *file)
2714 {
2715         return file_has_perm(current, file, file_to_av(file));
2716 }
2717
2718 /* task security operations */
2719
2720 static int selinux_task_create(unsigned long clone_flags)
2721 {
2722         int rc;
2723
2724         rc = secondary_ops->task_create(clone_flags);
2725         if (rc)
2726                 return rc;
2727
2728         return task_has_perm(current, current, PROCESS__FORK);
2729 }
2730
2731 static int selinux_task_alloc_security(struct task_struct *tsk)
2732 {
2733         struct task_security_struct *tsec1, *tsec2;
2734         int rc;
2735
2736         tsec1 = current->security;
2737
2738         rc = task_alloc_security(tsk);
2739         if (rc)
2740                 return rc;
2741         tsec2 = tsk->security;
2742
2743         tsec2->osid = tsec1->osid;
2744         tsec2->sid = tsec1->sid;
2745
2746         /* Retain the exec, fs, key, and sock SIDs across fork */
2747         tsec2->exec_sid = tsec1->exec_sid;
2748         tsec2->create_sid = tsec1->create_sid;
2749         tsec2->keycreate_sid = tsec1->keycreate_sid;
2750         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2751
2752         /* Retain ptracer SID across fork, if any.
2753            This will be reset by the ptrace hook upon any
2754            subsequent ptrace_attach operations. */
2755         tsec2->ptrace_sid = tsec1->ptrace_sid;
2756
2757         return 0;
2758 }
2759
2760 static void selinux_task_free_security(struct task_struct *tsk)
2761 {
2762         task_free_security(tsk);
2763 }
2764
2765 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2766 {
2767         /* Since setuid only affects the current process, and
2768            since the SELinux controls are not based on the Linux
2769            identity attributes, SELinux does not need to control
2770            this operation.  However, SELinux does control the use
2771            of the CAP_SETUID and CAP_SETGID capabilities using the
2772            capable hook. */
2773         return 0;
2774 }
2775
2776 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2777 {
2778         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2779 }
2780
2781 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2782 {
2783         /* See the comment for setuid above. */
2784         return 0;
2785 }
2786
2787 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2788 {
2789         return task_has_perm(current, p, PROCESS__SETPGID);
2790 }
2791
2792 static int selinux_task_getpgid(struct task_struct *p)
2793 {
2794         return task_has_perm(current, p, PROCESS__GETPGID);
2795 }
2796
2797 static int selinux_task_getsid(struct task_struct *p)
2798 {
2799         return task_has_perm(current, p, PROCESS__GETSESSION);
2800 }
2801
2802 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2803 {
2804         selinux_get_task_sid(p, secid);
2805 }
2806
2807 static int selinux_task_setgroups(struct group_info *group_info)
2808 {
2809         /* See the comment for setuid above. */
2810         return 0;
2811 }
2812
2813 static int selinux_task_setnice(struct task_struct *p, int nice)
2814 {
2815         int rc;
2816
2817         rc = secondary_ops->task_setnice(p, nice);
2818         if (rc)
2819                 return rc;
2820
2821         return task_has_perm(current,p, PROCESS__SETSCHED);
2822 }
2823
2824 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2825 {
2826         return task_has_perm(current, p, PROCESS__SETSCHED);
2827 }
2828
2829 static int selinux_task_getioprio(struct task_struct *p)
2830 {
2831         return task_has_perm(current, p, PROCESS__GETSCHED);
2832 }
2833
2834 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2835 {
2836         struct rlimit *old_rlim = current->signal->rlim + resource;
2837         int rc;
2838
2839         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2840         if (rc)
2841                 return rc;
2842
2843         /* Control the ability to change the hard limit (whether
2844            lowering or raising it), so that the hard limit can
2845            later be used as a safe reset point for the soft limit
2846            upon context transitions. See selinux_bprm_apply_creds. */
2847         if (old_rlim->rlim_max != new_rlim->rlim_max)
2848                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2849
2850         return 0;
2851 }
2852
2853 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2854 {
2855         return task_has_perm(current, p, PROCESS__SETSCHED);
2856 }
2857
2858 static int selinux_task_getscheduler(struct task_struct *p)
2859 {
2860         return task_has_perm(current, p, PROCESS__GETSCHED);
2861 }
2862
2863 static int selinux_task_movememory(struct task_struct *p)
2864 {
2865         return task_has_perm(current, p, PROCESS__SETSCHED);
2866 }
2867
2868 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2869                                 int sig, u32 secid)
2870 {
2871         u32 perm;
2872         int rc;
2873         struct task_security_struct *tsec;
2874
2875         rc = secondary_ops->task_kill(p, info, sig, secid);
2876         if (rc)
2877                 return rc;
2878
2879         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2880                 return 0;
2881
2882         if (!sig)
2883                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2884         else
2885                 perm = signal_to_av(sig);
2886         tsec = p->security;
2887         if (secid)
2888                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2889         else
2890                 rc = task_has_perm(current, p, perm);
2891         return rc;
2892 }
2893
2894 static int selinux_task_prctl(int option,
2895                               unsigned long arg2,
2896                               unsigned long arg3,
2897                               unsigned long arg4,
2898                               unsigned long arg5)
2899 {
2900         /* The current prctl operations do not appear to require
2901            any SELinux controls since they merely observe or modify
2902            the state of the current process. */
2903         return 0;
2904 }
2905
2906 static int selinux_task_wait(struct task_struct *p)
2907 {
2908         u32 perm;
2909
2910         perm = signal_to_av(p->exit_signal);
2911
2912         return task_has_perm(p, current, perm);
2913 }
2914
2915 static void selinux_task_reparent_to_init(struct task_struct *p)
2916 {
2917         struct task_security_struct *tsec;
2918
2919         secondary_ops->task_reparent_to_init(p);
2920
2921         tsec = p->security;
2922         tsec->osid = tsec->sid;
2923         tsec->sid = SECINITSID_KERNEL;
2924         return;
2925 }
2926
2927 static void selinux_task_to_inode(struct task_struct *p,
2928                                   struct inode *inode)
2929 {
2930         struct task_security_struct *tsec = p->security;
2931         struct inode_security_struct *isec = inode->i_security;
2932
2933         isec->sid = tsec->sid;
2934         isec->initialized = 1;
2935         return;
2936 }
2937
2938 /* Returns error only if unable to parse addresses */
2939 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2940                         struct avc_audit_data *ad, u8 *proto)
2941 {
2942         int offset, ihlen, ret = -EINVAL;
2943         struct iphdr _iph, *ih;
2944
2945         offset = skb_network_offset(skb);
2946         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2947         if (ih == NULL)
2948                 goto out;
2949
2950         ihlen = ih->ihl * 4;
2951         if (ihlen < sizeof(_iph))
2952                 goto out;
2953
2954         ad->u.net.v4info.saddr = ih->saddr;
2955         ad->u.net.v4info.daddr = ih->daddr;
2956         ret = 0;
2957
2958         if (proto)
2959                 *proto = ih->protocol;
2960
2961         switch (ih->protocol) {
2962         case IPPROTO_TCP: {
2963                 struct tcphdr _tcph, *th;
2964
2965                 if (ntohs(ih->frag_off) & IP_OFFSET)
2966                         break;
2967
2968                 offset += ihlen;
2969                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2970                 if (th == NULL)
2971                         break;
2972
2973                 ad->u.net.sport = th->source;
2974                 ad->u.net.dport = th->dest;
2975                 break;
2976         }
2977
2978         case IPPROTO_UDP: {
2979                 struct udphdr _udph, *uh;
2980
2981                 if (ntohs(ih->frag_off) & IP_OFFSET)
2982                         break;
2983
2984                 offset += ihlen;
2985                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2986                 if (uh == NULL)
2987                         break;
2988
2989                 ad->u.net.sport = uh->source;
2990                 ad->u.net.dport = uh->dest;
2991                 break;
2992         }
2993
2994         case IPPROTO_DCCP: {
2995                 struct dccp_hdr _dccph, *dh;
2996
2997                 if (ntohs(ih->frag_off) & IP_OFFSET)
2998                         break;
2999
3000                 offset += ihlen;
3001                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3002                 if (dh == NULL)
3003                         break;
3004
3005                 ad->u.net.sport = dh->dccph_sport;
3006                 ad->u.net.dport = dh->dccph_dport;
3007                 break;
3008         }
3009
3010         default:
3011                 break;
3012         }
3013 out:
3014         return ret;
3015 }
3016
3017 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3018
3019 /* Returns error only if unable to parse addresses */
3020 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3021                         struct avc_audit_data *ad, u8 *proto)
3022 {
3023         u8 nexthdr;
3024         int ret = -EINVAL, offset;
3025         struct ipv6hdr _ipv6h, *ip6;
3026
3027         offset = skb_network_offset(skb);
3028         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3029         if (ip6 == NULL)
3030                 goto out;
3031
3032         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3033         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3034         ret = 0;
3035
3036         nexthdr = ip6->nexthdr;
3037         offset += sizeof(_ipv6h);
3038         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3039         if (offset < 0)
3040                 goto out;
3041
3042         if (proto)
3043                 *proto = nexthdr;
3044
3045         switch (nexthdr) {
3046         case IPPROTO_TCP: {
3047                 struct tcphdr _tcph, *th;
3048
3049                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3050                 if (th == NULL)
3051                         break;
3052
3053                 ad->u.net.sport = th->source;
3054                 ad->u.net.dport = th->dest;
3055                 break;
3056         }
3057
3058         case IPPROTO_UDP: {
3059                 struct udphdr _udph, *uh;
3060
3061                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3062                 if (uh == NULL)
3063                         break;
3064
3065                 ad->u.net.sport = uh->source;
3066                 ad->u.net.dport = uh->dest;
3067                 break;
3068         }
3069
3070         case IPPROTO_DCCP: {
3071                 struct dccp_hdr _dccph, *dh;
3072
3073                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3074                 if (dh == NULL)
3075                         break;
3076
3077                 ad->u.net.sport = dh->dccph_sport;
3078                 ad->u.net.dport = dh->dccph_dport;
3079                 break;
3080         }
3081
3082         /* includes fragments */
3083         default:
3084                 break;
3085         }
3086 out:
3087         return ret;
3088 }
3089
3090 #endif /* IPV6 */
3091
3092 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3093                              char **addrp, int *len, int src, u8 *proto)
3094 {
3095         int ret = 0;
3096
3097         switch (ad->u.net.family) {
3098         case PF_INET:
3099                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3100                 if (ret || !addrp)
3101                         break;
3102                 *len = 4;
3103                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3104                                         &ad->u.net.v4info.daddr);
3105                 break;
3106
3107 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3108         case PF_INET6:
3109                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3110                 if (ret || !addrp)
3111                         break;
3112                 *len = 16;
3113                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3114                                         &ad->u.net.v6info.daddr);
3115                 break;
3116 #endif  /* IPV6 */
3117         default:
3118                 break;
3119         }
3120
3121         return ret;
3122 }
3123
3124 /**
3125  * selinux_skb_extlbl_sid - Determine the external label of a packet
3126  * @skb: the packet
3127  * @base_sid: the SELinux SID to use as a context for MLS only external labels
3128  * @sid: the packet's SID
3129  *
3130  * Description:
3131  * Check the various different forms of external packet labeling and determine
3132  * the external SID for the packet.
3133  *
3134  */
3135 static void selinux_skb_extlbl_sid(struct sk_buff *skb,
3136                                    u32 base_sid,
3137                                    u32 *sid)
3138 {
3139         u32 xfrm_sid;
3140         u32 nlbl_sid;
3141
3142         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3143         if (selinux_netlbl_skbuff_getsid(skb,
3144                                          (xfrm_sid == SECSID_NULL ?
3145                                           base_sid : xfrm_sid),
3146                                          &nlbl_sid) != 0)
3147                 nlbl_sid = SECSID_NULL;
3148
3149         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3150 }
3151
3152 /* socket security operations */
3153 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3154                            u32 perms)
3155 {
3156         struct inode_security_struct *isec;
3157         struct task_security_struct *tsec;
3158         struct avc_audit_data ad;
3159         int err = 0;
3160
3161         tsec = task->security;
3162         isec = SOCK_INODE(sock)->i_security;
3163
3164         if (isec->sid == SECINITSID_KERNEL)
3165                 goto out;
3166
3167         AVC_AUDIT_DATA_INIT(&ad,NET);
3168         ad.u.net.sk = sock->sk;
3169         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3170
3171 out:
3172         return err;
3173 }
3174
3175 static int selinux_socket_create(int family, int type,
3176                                  int protocol, int kern)
3177 {
3178         int err = 0;
3179         struct task_security_struct *tsec;
3180         u32 newsid;
3181
3182         if (kern)
3183                 goto out;
3184
3185         tsec = current->security;
3186         newsid = tsec->sockcreate_sid ? : tsec->sid;
3187         err = avc_has_perm(tsec->sid, newsid,
3188                            socket_type_to_security_class(family, type,
3189                            protocol), SOCKET__CREATE, NULL);
3190
3191 out:
3192         return err;
3193 }
3194
3195 static int selinux_socket_post_create(struct socket *sock, int family,
3196                                       int type, int protocol, int kern)
3197 {
3198         int err = 0;
3199         struct inode_security_struct *isec;
3200         struct task_security_struct *tsec;
3201         struct sk_security_struct *sksec;
3202         u32 newsid;
3203
3204         isec = SOCK_INODE(sock)->i_security;
3205
3206         tsec = current->security;
3207         newsid = tsec->sockcreate_sid ? : tsec->sid;
3208         isec->sclass = socket_type_to_security_class(family, type, protocol);
3209         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3210         isec->initialized = 1;
3211
3212         if (sock->sk) {
3213                 sksec = sock->sk->sk_security;
3214                 sksec->sid = isec->sid;
3215                 err = selinux_netlbl_socket_post_create(sock);
3216         }
3217
3218         return err;
3219 }
3220
3221 /* Range of port numbers used to automatically bind.
3222    Need to determine whether we should perform a name_bind
3223    permission check between the socket and the port number. */
3224 #define ip_local_port_range_0 sysctl_local_port_range[0]
3225 #define ip_local_port_range_1 sysctl_local_port_range[1]
3226
3227 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3228 {
3229         u16 family;
3230         int err;
3231
3232         err = socket_has_perm(current, sock, SOCKET__BIND);
3233         if (err)
3234                 goto out;
3235
3236         /*
3237          * If PF_INET or PF_INET6, check name_bind permission for the port.
3238          * Multiple address binding for SCTP is not supported yet: we just
3239          * check the first address now.
3240          */
3241         family = sock->sk->sk_family;
3242         if (family == PF_INET || family == PF_INET6) {
3243                 char *addrp;
3244                 struct inode_security_struct *isec;
3245                 struct task_security_struct *tsec;
3246                 struct avc_audit_data ad;
3247                 struct sockaddr_in *addr4 = NULL;
3248                 struct sockaddr_in6 *addr6 = NULL;
3249                 unsigned short snum;
3250                 struct sock *sk = sock->sk;
3251                 u32 sid, node_perm, addrlen;
3252
3253                 tsec = current->security;
3254                 isec = SOCK_INODE(sock)->i_security;
3255
3256                 if (family == PF_INET) {
3257                         addr4 = (struct sockaddr_in *)address;
3258                         snum = ntohs(addr4->sin_port);
3259                         addrlen = sizeof(addr4->sin_addr.s_addr);
3260                         addrp = (char *)&addr4->sin_addr.s_addr;
3261                 } else {
3262                         addr6 = (struct sockaddr_in6 *)address;
3263                         snum = ntohs(addr6->sin6_port);
3264                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3265                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3266                 }
3267
3268                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3269                            snum > ip_local_port_range_1)) {
3270                         err = security_port_sid(sk->sk_family, sk->sk_type,
3271                                                 sk->sk_protocol, snum, &sid);
3272                         if (err)
3273                                 goto out;
3274                         AVC_AUDIT_DATA_INIT(&ad,NET);
3275                         ad.u.net.sport = htons(snum);
3276                         ad.u.net.family = family;
3277                         err = avc_has_perm(isec->sid, sid,
3278                                            isec->sclass,
3279                                            SOCKET__NAME_BIND, &ad);
3280                         if (err)
3281                                 goto out;
3282                 }
3283
3284                 switch(isec->sclass) {
3285                 case SECCLASS_TCP_SOCKET:
3286                         node_perm = TCP_SOCKET__NODE_BIND;
3287                         break;
3288
3289                 case SECCLASS_UDP_SOCKET:
3290                         node_perm = UDP_SOCKET__NODE_BIND;
3291                         break;
3292
3293                 case SECCLASS_DCCP_SOCKET:
3294                         node_perm = DCCP_SOCKET__NODE_BIND;
3295                         break;
3296
3297                 default:
3298                         node_perm = RAWIP_SOCKET__NODE_BIND;
3299                         break;
3300                 }
3301
3302                 err = security_node_sid(family, addrp, addrlen, &sid);
3303                 if (err)
3304                         goto out;
3305
3306                 AVC_AUDIT_DATA_INIT(&ad,NET);
3307                 ad.u.net.sport = htons(snum);
3308                 ad.u.net.family = family;
3309
3310                 if (family == PF_INET)
3311                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3312                 else
3313                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3314
3315                 err = avc_has_perm(isec->sid, sid,
3316                                    isec->sclass, node_perm, &ad);
3317                 if (err)
3318                         goto out;
3319         }
3320 out:
3321         return err;
3322 }
3323
3324 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3325 {
3326         struct inode_security_struct *isec;
3327         int err;
3328
3329         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3330         if (err)
3331                 return err;
3332
3333         /*
3334          * If a TCP or DCCP socket, check name_connect permission for the port.
3335          */
3336         isec = SOCK_INODE(sock)->i_security;
3337         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3338             isec->sclass == SECCLASS_DCCP_SOCKET) {
3339                 struct sock *sk = sock->sk;
3340                 struct avc_audit_data ad;
3341                 struct sockaddr_in *addr4 = NULL;
3342                 struct sockaddr_in6 *addr6 = NULL;
3343                 unsigned short snum;
3344                 u32 sid, perm;
3345
3346                 if (sk->sk_family == PF_INET) {
3347                         addr4 = (struct sockaddr_in *)address;
3348                         if (addrlen < sizeof(struct sockaddr_in))
3349                                 return -EINVAL;
3350                         snum = ntohs(addr4->sin_port);
3351                 } else {
3352                         addr6 = (struct sockaddr_in6 *)address;
3353                         if (addrlen < SIN6_LEN_RFC2133)
3354                                 return -EINVAL;
3355                         snum = ntohs(addr6->sin6_port);
3356                 }
3357
3358                 err = security_port_sid(sk->sk_family, sk->sk_type,
3359                                         sk->sk_protocol, snum, &sid);
3360                 if (err)
3361                         goto out;
3362
3363                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3364                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3365
3366                 AVC_AUDIT_DATA_INIT(&ad,NET);
3367                 ad.u.net.dport = htons(snum);
3368                 ad.u.net.family = sk->sk_family;
3369                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3370                 if (err)
3371                         goto out;
3372         }
3373
3374 out:
3375         return err;
3376 }
3377
3378 static int selinux_socket_listen(struct socket *sock, int backlog)
3379 {
3380         return socket_has_perm(current, sock, SOCKET__LISTEN);
3381 }
3382
3383 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3384 {
3385         int err;
3386         struct inode_security_struct *isec;
3387         struct inode_security_struct *newisec;
3388
3389         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3390         if (err)
3391                 return err;
3392
3393         newisec = SOCK_INODE(newsock)->i_security;
3394
3395         isec = SOCK_INODE(sock)->i_security;
3396         newisec->sclass = isec->sclass;
3397         newisec->sid = isec->sid;
3398         newisec->initialized = 1;
3399
3400         return 0;
3401 }
3402
3403 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3404                                   int size)
3405 {
3406         int rc;
3407
3408         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3409         if (rc)
3410                 return rc;
3411
3412         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3413 }
3414
3415 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3416                                   int size, int flags)
3417 {
3418         return socket_has_perm(current, sock, SOCKET__READ);
3419 }
3420
3421 static int selinux_socket_getsockname(struct socket *sock)
3422 {
3423         return socket_has_perm(current, sock, SOCKET__GETATTR);
3424 }
3425
3426 static int selinux_socket_getpeername(struct socket *sock)
3427 {
3428         return socket_has_perm(current, sock, SOCKET__GETATTR);
3429 }
3430
3431 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3432 {
3433         int err;
3434
3435         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3436         if (err)
3437                 return err;
3438
3439         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3440 }
3441
3442 static int selinux_socket_getsockopt(struct socket *sock, int level,
3443                                      int optname)
3444 {
3445         return socket_has_perm(current, sock, SOCKET__GETOPT);
3446 }
3447
3448 static int selinux_socket_shutdown(struct socket *sock, int how)
3449 {
3450         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3451 }
3452
3453 static int selinux_socket_unix_stream_connect(struct socket *sock,
3454                                               struct socket *other,
3455                                               struct sock *newsk)
3456 {
3457         struct sk_security_struct *ssec;
3458         struct inode_security_struct *isec;
3459         struct inode_security_struct *other_isec;
3460         struct avc_audit_data ad;
3461         int err;
3462
3463         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3464         if (err)
3465                 return err;
3466
3467         isec = SOCK_INODE(sock)->i_security;
3468         other_isec = SOCK_INODE(other)->i_security;
3469
3470         AVC_AUDIT_DATA_INIT(&ad,NET);
3471         ad.u.net.sk = other->sk;
3472
3473         err = avc_has_perm(isec->sid, other_isec->sid,
3474                            isec->sclass,
3475                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3476         if (err)
3477                 return err;
3478
3479         /* connecting socket */
3480         ssec = sock->sk->sk_security;
3481         ssec->peer_sid = other_isec->sid;
3482
3483         /* server child socket */
3484         ssec = newsk->sk_security;
3485         ssec->peer_sid = isec->sid;
3486         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3487
3488         return err;
3489 }
3490
3491 static int selinux_socket_unix_may_send(struct socket *sock,
3492                                         struct socket *other)
3493 {
3494         struct inode_security_struct *isec;
3495         struct inode_security_struct *other_isec;
3496         struct avc_audit_data ad;
3497         int err;
3498
3499         isec = SOCK_INODE(sock)->i_security;
3500         other_isec = SOCK_INODE(other)->i_security;
3501
3502         AVC_AUDIT_DATA_INIT(&ad,NET);
3503         ad.u.net.sk = other->sk;
3504
3505         err = avc_has_perm(isec->sid, other_isec->sid,
3506                            isec->sclass, SOCKET__SENDTO, &ad);
3507         if (err)
3508                 return err;
3509
3510         return 0;
3511 }
3512
3513 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3514                 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3515 {
3516         int err = 0;
3517         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3518         struct socket *sock;
3519         u16 sock_class = 0;
3520         u32 sock_sid = 0;
3521
3522         read_lock_bh(&sk->sk_callback_lock);
3523         sock = sk->sk_socket;
3524         if (sock) {
3525                 struct inode *inode;
3526                 inode = SOCK_INODE(sock);
3527                 if (inode) {
3528                         struct inode_security_struct *isec;
3529                         isec = inode->i_security;
3530                         sock_sid = isec->sid;
3531                         sock_class = isec->sclass;
3532                 }
3533         }
3534         read_unlock_bh(&sk->sk_callback_lock);
3535         if (!sock_sid)
3536                 goto out;
3537
3538         if (!skb->dev)
3539                 goto out;
3540
3541         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3542         if (err)
3543                 goto out;
3544
3545         switch (sock_class) {
3546         case SECCLASS_UDP_SOCKET:
3547                 netif_perm = NETIF__UDP_RECV;
3548                 node_perm = NODE__UDP_RECV;
3549                 recv_perm = UDP_SOCKET__RECV_MSG;
3550                 break;
3551
3552         case SECCLASS_TCP_SOCKET:
3553                 netif_perm = NETIF__TCP_RECV;
3554                 node_perm = NODE__TCP_RECV;
3555                 recv_perm = TCP_SOCKET__RECV_MSG;
3556                 break;
3557
3558         case SECCLASS_DCCP_SOCKET:
3559                 netif_perm = NETIF__DCCP_RECV;
3560                 node_perm = NODE__DCCP_RECV;
3561                 recv_perm = DCCP_SOCKET__RECV_MSG;
3562                 break;
3563
3564         default:
3565                 netif_perm = NETIF__RAWIP_RECV;
3566                 node_perm = NODE__RAWIP_RECV;
3567                 break;
3568         }
3569
3570         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3571         if (err)
3572                 goto out;
3573
3574         err = security_node_sid(family, addrp, len, &node_sid);
3575         if (err)
3576                 goto out;
3577
3578         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3579         if (err)
3580                 goto out;
3581
3582         if (recv_perm) {
3583                 u32 port_sid;
3584
3585                 err = security_port_sid(sk->sk_family, sk->sk_type,
3586                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3587                                         &port_sid);
3588                 if (err)
3589                         goto out;
3590
3591                 err = avc_has_perm(sock_sid, port_sid,
3592                                    sock_class, recv_perm, ad);
3593         }
3594
3595 out:
3596         return err;
3597 }
3598
3599 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3600 {
3601         u16 family;
3602         char *addrp;
3603         int len, err = 0;
3604         struct avc_audit_data ad;
3605         struct sk_security_struct *sksec = sk->sk_security;
3606
3607         family = sk->sk_family;
3608         if (family != PF_INET && family != PF_INET6)
3609                 goto out;
3610
3611         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3612         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3613                 family = PF_INET;
3614
3615         AVC_AUDIT_DATA_INIT(&ad, NET);
3616         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3617         ad.u.net.family = family;
3618
3619         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3620         if (err)
3621                 goto out;
3622
3623         if (selinux_compat_net)
3624                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3625                                                   addrp, len);
3626         else
3627                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3628                                    PACKET__RECV, &ad);
3629         if (err)
3630                 goto out;
3631
3632         err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3633         if (err)
3634                 goto out;
3635
3636         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3637 out:
3638         return err;
3639 }
3640
3641 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3642                                             int __user *optlen, unsigned len)
3643 {
3644         int err = 0;
3645         char *scontext;
3646         u32 scontext_len;
3647         struct sk_security_struct *ssec;
3648         struct inode_security_struct *isec;
3649         u32 peer_sid = SECSID_NULL;
3650
3651         isec = SOCK_INODE(sock)->i_security;
3652
3653         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3654             isec->sclass == SECCLASS_TCP_SOCKET) {
3655                 ssec = sock->sk->sk_security;
3656                 peer_sid = ssec->peer_sid;
3657         }
3658         if (peer_sid == SECSID_NULL) {
3659                 err = -ENOPROTOOPT;
3660                 goto out;
3661         }
3662
3663         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3664
3665         if (err)
3666                 goto out;
3667
3668         if (scontext_len > len) {
3669                 err = -ERANGE;
3670                 goto out_len;
3671         }
3672
3673         if (copy_to_user(optval, scontext, scontext_len))
3674                 err = -EFAULT;
3675
3676 out_len:
3677         if (put_user(scontext_len, optlen))
3678                 err = -EFAULT;
3679
3680         kfree(scontext);
3681 out:
3682         return err;
3683 }
3684
3685 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3686 {
3687         u32 peer_secid = SECSID_NULL;
3688         int err = 0;
3689
3690         if (sock && sock->sk->sk_family == PF_UNIX)
3691                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3692         else if (skb)
3693                 selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peer_secid);
3694
3695         if (peer_secid == SECSID_NULL)
3696                 err = -EINVAL;
3697         *secid = peer_secid;
3698
3699         return err;
3700 }
3701
3702 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3703 {
3704         return sk_alloc_security(sk, family, priority);
3705 }
3706
3707 static void selinux_sk_free_security(struct sock *sk)
3708 {
3709         sk_free_security(sk);
3710 }
3711
3712 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3713 {
3714         struct sk_security_struct *ssec = sk->sk_security;
3715         struct sk_security_struct *newssec = newsk->sk_security;
3716
3717         newssec->sid = ssec->sid;
3718         newssec->peer_sid = ssec->peer_sid;
3719
3720         selinux_netlbl_sk_security_clone(ssec, newssec);
3721 }
3722
3723 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3724 {
3725         if (!sk)
3726                 *secid = SECINITSID_ANY_SOCKET;
3727         else {
3728                 struct sk_security_struct *sksec = sk->sk_security;
3729
3730                 *secid = sksec->sid;
3731         }
3732 }
3733
3734 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3735 {
3736         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3737         struct sk_security_struct *sksec = sk->sk_security;
3738
3739         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3740             sk->sk_family == PF_UNIX)
3741                 isec->sid = sksec->sid;
3742
3743         selinux_netlbl_sock_graft(sk, parent);
3744 }
3745
3746 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3747                                      struct request_sock *req)
3748 {
3749         struct sk_security_struct *sksec = sk->sk_security;
3750         int err;
3751         u32 newsid;
3752         u32 peersid;
3753
3754         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &peersid);
3755         if (peersid == SECSID_NULL) {
3756                 req->secid = sksec->sid;
3757                 req->peer_secid = SECSID_NULL;
3758                 return 0;
3759         }
3760
3761         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3762         if (err)
3763                 return err;
3764
3765         req->secid = newsid;
3766         req->peer_secid = peersid;
3767         return 0;
3768 }
3769
3770 static void selinux_inet_csk_clone(struct sock *newsk,
3771                                    const struct request_sock *req)
3772 {
3773         struct sk_security_struct *newsksec = newsk->sk_security;
3774
3775         newsksec->sid = req->secid;
3776         newsksec->peer_sid = req->peer_secid;
3777         /* NOTE: Ideally, we should also get the isec->sid for the
3778            new socket in sync, but we don't have the isec available yet.
3779            So we will wait until sock_graft to do it, by which
3780            time it will have been created and available. */
3781
3782         /* We don't need to take any sort of lock here as we are the only
3783          * thread with access to newsksec */
3784         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3785 }
3786
3787 static void selinux_inet_conn_established(struct sock *sk,
3788                                 struct sk_buff *skb)
3789 {
3790         struct sk_security_struct *sksec = sk->sk_security;
3791
3792         selinux_skb_extlbl_sid(skb, SECINITSID_UNLABELED, &sksec->peer_sid);
3793 }
3794
3795 static void selinux_req_classify_flow(const struct request_sock *req,
3796                                       struct flowi *fl)
3797 {
3798         fl->secid = req->secid;
3799 }
3800
3801 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3802 {
3803         int err = 0;
3804         u32 perm;
3805         struct nlmsghdr *nlh;
3806         struct socket *sock = sk->sk_socket;
3807         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3808
3809         if (skb->len < NLMSG_SPACE(0)) {
3810                 err = -EINVAL;
3811                 goto out;
3812         }
3813         nlh = nlmsg_hdr(skb);
3814
3815         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3816         if (err) {
3817                 if (err == -EINVAL) {
3818                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3819                                   "SELinux:  unrecognized netlink message"
3820                                   " type=%hu for sclass=%hu\n",
3821                                   nlh->nlmsg_type, isec->sclass);
3822                         if (!selinux_enforcing)
3823                                 err = 0;
3824                 }
3825
3826                 /* Ignore */
3827                 if (err == -ENOENT)
3828                         err = 0;
3829                 goto out;
3830         }
3831
3832         err = socket_has_perm(current, sock, perm);
3833 out:
3834         return err;
3835 }
3836
3837 #ifdef CONFIG_NETFILTER
3838
3839 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3840                                             struct avc_audit_data *ad,
3841                                             u16 family, char *addrp, int len)
3842 {
3843         int err = 0;
3844         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3845         struct socket *sock;
3846         struct inode *inode;
3847         struct inode_security_struct *isec;
3848
3849         sock = sk->sk_socket;
3850         if (!sock)
3851                 goto out;
3852
3853         inode = SOCK_INODE(sock);
3854         if (!inode)
3855                 goto out;
3856
3857         isec = inode->i_security;
3858
3859         err = sel_netif_sids(dev, &if_sid, NULL);
3860         if (err)
3861                 goto out;
3862
3863         switch (isec->sclass) {
3864         case SECCLASS_UDP_SOCKET:
3865                 netif_perm = NETIF__UDP_SEND;
3866                 node_perm = NODE__UDP_SEND;
3867                 send_perm = UDP_SOCKET__SEND_MSG;
3868                 break;
3869
3870         case SECCLASS_TCP_SOCKET:
3871                 netif_perm = NETIF__TCP_SEND;
3872                 node_perm = NODE__TCP_SEND;
3873                 send_perm = TCP_SOCKET__SEND_MSG;
3874                 break;
3875
3876         case SECCLASS_DCCP_SOCKET:
3877                 netif_perm = NETIF__DCCP_SEND;
3878                 node_perm = NODE__DCCP_SEND;
3879                 send_perm = DCCP_SOCKET__SEND_MSG;
3880                 break;
3881
3882         default:
3883                 netif_perm = NETIF__RAWIP_SEND;
3884                 node_perm = NODE__RAWIP_SEND;
3885                 break;
3886         }
3887
3888         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3889         if (err)
3890                 goto out;
3891
3892         err = security_node_sid(family, addrp, len, &node_sid);
3893         if (err)
3894                 goto out;
3895
3896         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3897         if (err)
3898                 goto out;
3899
3900         if (send_perm) {
3901                 u32 port_sid;
3902
3903                 err = security_port_sid(sk->sk_family,
3904                                         sk->sk_type,
3905                                         sk->sk_protocol,
3906                                         ntohs(ad->u.net.dport),
3907                                         &port_sid);
3908                 if (err)
3909                         goto out;
3910
3911                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3912                                    send_perm, ad);
3913         }
3914 out:
3915         return err;
3916 }
3917
3918 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3919                                               struct sk_buff **pskb,
3920                                               const struct net_device *in,
3921                                               const struct net_device *out,
3922                                               int (*okfn)(struct sk_buff *),
3923                                               u16 family)
3924 {
3925         char *addrp;
3926         int len, err = 0;
3927         struct sock *sk;
3928         struct sk_buff *skb = *pskb;
3929         struct avc_audit_data ad;
3930         struct net_device *dev = (struct net_device *)out;
3931         struct sk_security_struct *sksec;
3932         u8 proto;
3933
3934         sk = skb->sk;
3935         if (!sk)
3936                 goto out;
3937
3938         sksec = sk->sk_security;
3939
3940         AVC_AUDIT_DATA_INIT(&ad, NET);
3941         ad.u.net.netif = dev->name;
3942         ad.u.net.family = family;
3943
3944         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3945         if (err)
3946                 goto out;
3947
3948         if (selinux_compat_net)
3949                 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3950                                                        family, addrp, len);
3951         else
3952                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3953                                    PACKET__SEND, &ad);
3954
3955         if (err)
3956                 goto out;
3957
3958         err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3959 out:
3960         return err ? NF_DROP : NF_ACCEPT;
3961 }
3962
3963 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3964                                                 struct sk_buff **pskb,
3965                                                 const struct net_device *in,
3966                                                 const struct net_device *out,
3967                                                 int (*okfn)(struct sk_buff *))
3968 {
3969         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3970 }
3971
3972 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3973
3974 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3975                                                 struct sk_buff **pskb,
3976                                                 const struct net_device *in,
3977                                                 const struct net_device *out,
3978                                                 int (*okfn)(struct sk_buff *))
3979 {
3980         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3981 }
3982
3983 #endif  /* IPV6 */
3984
3985 #endif  /* CONFIG_NETFILTER */
3986
3987 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3988 {
3989         int err;
3990
3991         err = secondary_ops->netlink_send(sk, skb);
3992         if (err)
3993                 return err;
3994
3995         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3996                 err = selinux_nlmsg_perm(sk, skb);
3997
3998         return err;
3999 }
4000
4001 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4002 {
4003         int err;
4004         struct avc_audit_data ad;
4005
4006         err = secondary_ops->netlink_recv(skb, capability);
4007         if (err)
4008                 return err;
4009
4010         AVC_AUDIT_DATA_INIT(&ad, CAP);
4011         ad.u.cap = capability;
4012
4013         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4014                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4015 }
4016
4017 static int ipc_alloc_security(struct task_struct *task,
4018                               struct kern_ipc_perm *perm,
4019                               u16 sclass)
4020 {
4021         struct task_security_struct *tsec = task->security;
4022         struct ipc_security_struct *isec;
4023
4024         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4025         if (!isec)
4026                 return -ENOMEM;
4027
4028         isec->sclass = sclass;
4029         isec->ipc_perm = perm;
4030         isec->sid = tsec->sid;
4031         perm->security = isec;
4032
4033         return 0;
4034 }
4035
4036 static void ipc_free_security(struct kern_ipc_perm *perm)
4037 {
4038         struct ipc_security_struct *isec = perm->security;
4039         perm->security = NULL;
4040         kfree(isec);
4041 }
4042
4043 static int msg_msg_alloc_security(struct msg_msg *msg)
4044 {
4045         struct msg_security_struct *msec;
4046
4047         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4048         if (!msec)
4049                 return -ENOMEM;
4050
4051         msec->msg = msg;
4052         msec->sid = SECINITSID_UNLABELED;
4053         msg->security = msec;
4054
4055         return 0;
4056 }
4057
4058 static void msg_msg_free_security(struct msg_msg *msg)
4059 {
4060         struct msg_security_struct *msec = msg->security;
4061
4062         msg->security = NULL;
4063         kfree(msec);
4064 }
4065
4066 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4067                         u32 perms)
4068 {
4069         struct task_security_struct *tsec;
4070         struct ipc_security_struct *isec;
4071         struct avc_audit_data ad;
4072
4073         tsec = current->security;
4074         isec = ipc_perms->security;
4075
4076         AVC_AUDIT_DATA_INIT(&ad, IPC);
4077         ad.u.ipc_id = ipc_perms->key;
4078
4079         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4080 }
4081
4082 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4083 {
4084         return msg_msg_alloc_security(msg);
4085 }
4086
4087 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4088 {
4089         msg_msg_free_security(msg);
4090 }
4091
4092 /* message queue security operations */
4093 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4094 {
4095         struct task_security_struct *tsec;
4096         struct ipc_security_struct *isec;
4097         struct avc_audit_data ad;
4098         int rc;
4099
4100         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4101         if (rc)
4102                 return rc;
4103
4104         tsec = current->security;
4105         isec = msq->q_perm.security;
4106
4107         AVC_AUDIT_DATA_INIT(&ad, IPC);
4108         ad.u.ipc_id = msq->q_perm.key;
4109
4110         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4111                           MSGQ__CREATE, &ad);
4112         if (rc) {
4113                 ipc_free_security(&msq->q_perm);
4114                 return rc;
4115         }
4116         return 0;
4117 }
4118
4119 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4120 {
4121         ipc_free_security(&msq->q_perm);
4122 }
4123
4124 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4125 {
4126         struct task_security_struct *tsec;
4127         struct ipc_security_struct *isec;
4128         struct avc_audit_data ad;
4129
4130         tsec = current->security;
4131         isec = msq->q_perm.security;
4132
4133         AVC_AUDIT_DATA_INIT(&ad, IPC);
4134         ad.u.ipc_id = msq->q_perm.key;
4135
4136         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4137                             MSGQ__ASSOCIATE, &ad);
4138 }
4139
4140 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4141 {
4142         int err;
4143         int perms;
4144
4145         switch(cmd) {
4146         case IPC_INFO:
4147         case MSG_INFO:
4148                 /* No specific object, just general system-wide information. */
4149                 return task_has_system(current, SYSTEM__IPC_INFO);
4150         case IPC_STAT:
4151         case MSG_STAT:
4152                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4153                 break;
4154         case IPC_SET:
4155                 perms = MSGQ__SETATTR;
4156                 break;
4157         case IPC_RMID:
4158                 perms = MSGQ__DESTROY;
4159                 break;
4160         default:
4161                 return 0;
4162         }
4163
4164         err = ipc_has_perm(&msq->q_perm, perms);
4165         return err;
4166 }
4167
4168 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4169 {
4170         struct task_security_struct *tsec;
4171         struct ipc_security_struct *isec;
4172         struct msg_security_struct *msec;
4173         struct avc_audit_data ad;
4174         int rc;
4175
4176         tsec = current->security;
4177         isec = msq->q_perm.security;
4178         msec = msg->security;
4179
4180         /*
4181          * First time through, need to assign label to the message
4182          */
4183         if (msec->sid == SECINITSID_UNLABELED) {
4184                 /*
4185                  * Compute new sid based on current process and
4186                  * message queue this message will be stored in
4187                  */
4188                 rc = security_transition_sid(tsec->sid,
4189                                              isec->sid,
4190                                              SECCLASS_MSG,
4191                                              &msec->sid);
4192                 if (rc)
4193                         return rc;
4194         }
4195
4196         AVC_AUDIT_DATA_INIT(&ad, IPC);
4197         ad.u.ipc_id = msq->q_perm.key;
4198
4199         /* Can this process write to the queue? */
4200         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4201                           MSGQ__WRITE, &ad);
4202         if (!rc)
4203                 /* Can this process send the message */
4204                 rc = avc_has_perm(tsec->sid, msec->sid,
4205                                   SECCLASS_MSG, MSG__SEND, &ad);
4206         if (!rc)
4207                 /* Can the message be put in the queue? */
4208                 rc = avc_has_perm(msec->sid, isec->sid,
4209                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4210
4211         return rc;
4212 }
4213
4214 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4215                                     struct task_struct *target,
4216                                     long type, int mode)
4217 {
4218         struct task_security_struct *tsec;
4219         struct ipc_security_struct *isec;
4220         struct msg_security_struct *msec;
4221         struct avc_audit_data ad;
4222         int rc;
4223
4224         tsec = target->security;
4225         isec = msq->q_perm.security;
4226         msec = msg->security;
4227
4228         AVC_AUDIT_DATA_INIT(&ad, IPC);
4229         ad.u.ipc_id = msq->q_perm.key;
4230
4231         rc = avc_has_perm(tsec->sid, isec->sid,
4232                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4233         if (!rc)
4234                 rc = avc_has_perm(tsec->sid, msec->sid,
4235                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4236         return rc;
4237 }
4238
4239 /* Shared Memory security operations */
4240 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4241 {
4242         struct task_security_struct *tsec;
4243         struct ipc_security_struct *isec;
4244         struct avc_audit_data ad;
4245         int rc;
4246
4247         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4248         if (rc)
4249                 return rc;
4250
4251         tsec = current->security;
4252         isec = shp->shm_perm.security;
4253
4254         AVC_AUDIT_DATA_INIT(&ad, IPC);
4255         ad.u.ipc_id = shp->shm_perm.key;
4256
4257         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4258                           SHM__CREATE, &ad);
4259         if (rc) {
4260                 ipc_free_security(&shp->shm_perm);
4261                 return rc;
4262         }
4263         return 0;
4264 }
4265
4266 static void selinux_shm_free_security(struct shmid_kernel *shp)
4267 {
4268         ipc_free_security(&shp->shm_perm);
4269 }
4270
4271 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4272 {
4273         struct task_security_struct *tsec;
4274         struct ipc_security_struct *isec;
4275         struct avc_audit_data ad;
4276
4277         tsec = current->security;
4278         isec = shp->shm_perm.security;
4279
4280         AVC_AUDIT_DATA_INIT(&ad, IPC);
4281         ad.u.ipc_id = shp->shm_perm.key;
4282
4283         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4284                             SHM__ASSOCIATE, &ad);
4285 }
4286
4287 /* Note, at this point, shp is locked down */
4288 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4289 {
4290         int perms;
4291         int err;
4292
4293         switch(cmd) {
4294         case IPC_INFO:
4295         case SHM_INFO:
4296                 /* No specific object, just general system-wide information. */
4297                 return task_has_system(current, SYSTEM__IPC_INFO);
4298         case IPC_STAT:
4299         case SHM_STAT:
4300                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4301                 break;
4302         case IPC_SET:
4303                 perms = SHM__SETATTR;
4304                 break;
4305         case SHM_LOCK:
4306         case SHM_UNLOCK:
4307                 perms = SHM__LOCK;
4308                 break;
4309         case IPC_RMID:
4310                 perms = SHM__DESTROY;
4311                 break;
4312         default:
4313                 return 0;
4314         }
4315
4316         err = ipc_has_perm(&shp->shm_perm, perms);
4317         return err;
4318 }
4319
4320 static int selinux_shm_shmat(struct shmid_kernel *shp,
4321                              char __user *shmaddr, int shmflg)
4322 {
4323         u32 perms;
4324         int rc;
4325
4326         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4327         if (rc)
4328                 return rc;
4329
4330         if (shmflg & SHM_RDONLY)
4331                 perms = SHM__READ;
4332         else
4333                 perms = SHM__READ | SHM__WRITE;
4334
4335         return ipc_has_perm(&shp->shm_perm, perms);
4336 }
4337
4338 /* Semaphore security operations */
4339 static int selinux_sem_alloc_security(struct sem_array *sma)
4340 {
4341         struct task_security_struct *tsec;
4342         struct ipc_security_struct *isec;
4343         struct avc_audit_data ad;
4344         int rc;
4345
4346         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4347         if (rc)
4348                 return rc;
4349
4350         tsec = current->security;
4351         isec = sma->sem_perm.security;
4352
4353         AVC_AUDIT_DATA_INIT(&ad, IPC);
4354         ad.u.ipc_id = sma->sem_perm.key;
4355
4356         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4357                           SEM__CREATE, &ad);
4358         if (rc) {
4359                 ipc_free_security(&sma->sem_perm);
4360                 return rc;
4361         }
4362         return 0;
4363 }
4364
4365 static void selinux_sem_free_security(struct sem_array *sma)
4366 {
4367         ipc_free_security(&sma->sem_perm);
4368 }
4369
4370 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4371 {
4372         struct task_security_struct *tsec;
4373         struct ipc_security_struct *isec;
4374         struct avc_audit_data ad;
4375
4376         tsec = current->security;
4377         isec = sma->sem_perm.security;
4378
4379         AVC_AUDIT_DATA_INIT(&ad, IPC);
4380         ad.u.ipc_id = sma->sem_perm.key;
4381
4382         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4383                             SEM__ASSOCIATE, &ad);
4384 }
4385
4386 /* Note, at this point, sma is locked down */
4387 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4388 {
4389         int err;
4390         u32 perms;
4391
4392         switch(cmd) {
4393         case IPC_INFO:
4394         case SEM_INFO:
4395                 /* No specific object, just general system-wide information. */
4396                 return task_has_system(current, SYSTEM__IPC_INFO);
4397         case GETPID:
4398         case GETNCNT:
4399         case GETZCNT:
4400                 perms = SEM__GETATTR;
4401                 break;
4402         case GETVAL:
4403         case GETALL:
4404                 perms = SEM__READ;
4405                 break;
4406         case SETVAL:
4407         case SETALL:
4408                 perms = SEM__WRITE;
4409                 break;
4410         case IPC_RMID:
4411                 perms = SEM__DESTROY;
4412                 break;
4413         case IPC_SET:
4414                 perms = SEM__SETATTR;
4415                 break;
4416         case IPC_STAT:
4417         case SEM_STAT:
4418                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4419                 break;
4420         default:
4421                 return 0;
4422         }
4423
4424         err = ipc_has_perm(&sma->sem_perm, perms);
4425         return err;
4426 }
4427
4428 static int selinux_sem_semop(struct sem_array *sma,
4429                              struct sembuf *sops, unsigned nsops, int alter)
4430 {
4431         u32 perms;
4432
4433         if (alter)
4434                 perms = SEM__READ | SEM__WRITE;
4435         else
4436                 perms = SEM__READ;
4437
4438         return ipc_has_perm(&sma->sem_perm, perms);
4439 }
4440
4441 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4442 {
4443         u32 av = 0;
4444
4445         av = 0;
4446         if (flag & S_IRUGO)
4447                 av |= IPC__UNIX_READ;
4448         if (flag & S_IWUGO)
4449                 av |= IPC__UNIX_WRITE;
4450
4451         if (av == 0)
4452                 return 0;
4453
4454         return ipc_has_perm(ipcp, av);
4455 }
4456
4457 /* module stacking operations */
4458 static int selinux_register_security (const char *name, struct security_operations *ops)
4459 {
4460         if (secondary_ops != original_ops) {
4461                 printk(KERN_ERR "%s:  There is already a secondary security "
4462                        "module registered.\n", __FUNCTION__);
4463                 return -EINVAL;
4464         }
4465
4466         secondary_ops = ops;
4467
4468         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4469                __FUNCTION__,
4470                name);
4471
4472         return 0;
4473 }
4474
4475 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4476 {
4477         if (ops != secondary_ops) {
4478                 printk(KERN_ERR "%s:  trying to unregister a security module "
4479                         "that is not registered.\n", __FUNCTION__);
4480                 return -EINVAL;
4481         }
4482
4483         secondary_ops = original_ops;
4484
4485         return 0;
4486 }
4487
4488 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4489 {
4490         if (inode)
4491                 inode_doinit_with_dentry(inode, dentry);
4492 }
4493
4494 static int selinux_getprocattr(struct task_struct *p,
4495                                char *name, char **value)
4496 {
4497         struct task_security_struct *tsec;
4498         u32 sid;
4499         int error;
4500         unsigned len;
4501
4502         if (current != p) {
4503                 error = task_has_perm(current, p, PROCESS__GETATTR);
4504                 if (error)
4505                         return error;
4506         }
4507
4508         tsec = p->security;
4509
4510         if (!strcmp(name, "current"))
4511                 sid = tsec->sid;
4512         else if (!strcmp(name, "prev"))
4513                 sid = tsec->osid;
4514         else if (!strcmp(name, "exec"))
4515                 sid = tsec->exec_sid;
4516         else if (!strcmp(name, "fscreate"))
4517                 sid = tsec->create_sid;
4518         else if (!strcmp(name, "keycreate"))
4519                 sid = tsec->keycreate_sid;
4520         else if (!strcmp(name, "sockcreate"))
4521                 sid = tsec->sockcreate_sid;
4522         else
4523                 return -EINVAL;
4524
4525         if (!sid)
4526                 return 0;
4527
4528         error = security_sid_to_context(sid, value, &len);
4529         if (error)
4530                 return error;
4531         return len;
4532 }
4533
4534 static int selinux_setprocattr(struct task_struct *p,
4535                                char *name, void *value, size_t size)
4536 {
4537         struct task_security_struct *tsec;
4538         u32 sid = 0;
4539         int error;
4540         char *str = value;
4541
4542         if (current != p) {
4543                 /* SELinux only allows a process to change its own
4544                    security attributes. */
4545                 return -EACCES;
4546         }
4547
4548         /*
4549          * Basic control over ability to set these attributes at all.
4550          * current == p, but we'll pass them separately in case the
4551          * above restriction is ever removed.
4552          */
4553         if (!strcmp(name, "exec"))
4554                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4555         else if (!strcmp(name, "fscreate"))
4556                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4557         else if (!strcmp(name, "keycreate"))
4558                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4559         else if (!strcmp(name, "sockcreate"))
4560                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4561         else if (!strcmp(name, "current"))
4562                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4563         else
4564                 error = -EINVAL;
4565         if (error)
4566                 return error;
4567
4568         /* Obtain a SID for the context, if one was specified. */
4569         if (size && str[1] && str[1] != '\n') {
4570                 if (str[size-1] == '\n') {
4571                         str[size-1] = 0;
4572                         size--;
4573                 }
4574                 error = security_context_to_sid(value, size, &sid);
4575                 if (error)
4576                         return error;
4577         }
4578
4579         /* Permission checking based on the specified context is
4580            performed during the actual operation (execve,
4581            open/mkdir/...), when we know the full context of the
4582            operation.  See selinux_bprm_set_security for the execve
4583            checks and may_create for the file creation checks. The
4584            operation will then fail if the context is not permitted. */
4585         tsec = p->security;
4586         if (!strcmp(name, "exec"))
4587                 tsec->exec_sid = sid;
4588         else if (!strcmp(name, "fscreate"))
4589                 tsec->create_sid = sid;
4590         else if (!strcmp(name, "keycreate")) {
4591                 error = may_create_key(sid, p);
4592                 if (error)
4593                         return error;
4594                 tsec->keycreate_sid = sid;
4595         } else if (!strcmp(name, "sockcreate"))
4596                 tsec->sockcreate_sid = sid;
4597         else if (!strcmp(name, "current")) {
4598                 struct av_decision avd;
4599
4600                 if (sid == 0)
4601                         return -EINVAL;
4602
4603                 /* Only allow single threaded processes to change context */
4604                 if (atomic_read(&p->mm->mm_users) != 1) {
4605                         struct task_struct *g, *t;
4606                         struct mm_struct *mm = p->mm;
4607                         read_lock(&tasklist_lock);
4608                         do_each_thread(g, t)
4609                                 if (t->mm == mm && t != p) {
4610                                         read_unlock(&tasklist_lock);
4611                                         return -EPERM;
4612                                 }
4613                         while_each_thread(g, t);
4614                         read_unlock(&tasklist_lock);
4615                 }
4616
4617                 /* Check permissions for the transition. */
4618                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4619                                      PROCESS__DYNTRANSITION, NULL);
4620                 if (error)
4621                         return error;
4622
4623                 /* Check for ptracing, and update the task SID if ok.
4624                    Otherwise, leave SID unchanged and fail. */
4625                 task_lock(p);
4626                 if (p->ptrace & PT_PTRACED) {
4627                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4628                                                      SECCLASS_PROCESS,
4629                                                      PROCESS__PTRACE, &avd);
4630                         if (!error)
4631                                 tsec->sid = sid;
4632                         task_unlock(p);
4633                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4634                                   PROCESS__PTRACE, &avd, error, NULL);
4635                         if (error)
4636                                 return error;
4637                 } else {
4638                         tsec->sid = sid;
4639                         task_unlock(p);
4640                 }
4641         }
4642         else
4643                 return -EINVAL;
4644
4645         return size;
4646 }
4647
4648 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4649 {
4650         return security_sid_to_context(secid, secdata, seclen);
4651 }
4652
4653 static void selinux_release_secctx(char *secdata, u32 seclen)
4654 {
4655         if (secdata)
4656                 kfree(secdata);
4657 }
4658
4659 #ifdef CONFIG_KEYS
4660
4661 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4662                              unsigned long flags)
4663 {
4664         struct task_security_struct *tsec = tsk->security;
4665         struct key_security_struct *ksec;
4666
4667         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4668         if (!ksec)
4669                 return -ENOMEM;
4670
4671         ksec->obj = k;
4672         if (tsec->keycreate_sid)
4673                 ksec->sid = tsec->keycreate_sid;
4674         else
4675                 ksec->sid = tsec->sid;
4676         k->security = ksec;
4677
4678         return 0;
4679 }
4680
4681 static void selinux_key_free(struct key *k)
4682 {
4683         struct key_security_struct *ksec = k->security;
4684
4685         k->security = NULL;
4686         kfree(ksec);
4687 }
4688
4689 static int selinux_key_permission(key_ref_t key_ref,
4690                             struct task_struct *ctx,
4691                             key_perm_t perm)
4692 {
4693         struct key *key;
4694         struct task_security_struct *tsec;
4695         struct key_security_struct *ksec;
4696
4697         key = key_ref_to_ptr(key_ref);
4698
4699         tsec = ctx->security;
4700         ksec = key->security;
4701
4702         /* if no specific permissions are requested, we skip the
4703            permission check. No serious, additional covert channels
4704            appear to be created. */
4705         if (perm == 0)
4706                 return 0;
4707
4708         return avc_has_perm(tsec->sid, ksec->sid,
4709                             SECCLASS_KEY, perm, NULL);
4710 }
4711
4712 #endif
4713
4714 static struct security_operations selinux_ops = {
4715         .ptrace =                       selinux_ptrace,
4716         .capget =                       selinux_capget,
4717         .capset_check =                 selinux_capset_check,
4718         .capset_set =                   selinux_capset_set,
4719         .sysctl =                       selinux_sysctl,
4720         .capable =                      selinux_capable,
4721         .quotactl =                     selinux_quotactl,
4722         .quota_on =                     selinux_quota_on,
4723         .syslog =                       selinux_syslog,
4724         .vm_enough_memory =             selinux_vm_enough_memory,
4725
4726         .netlink_send =                 selinux_netlink_send,
4727         .netlink_recv =                 selinux_netlink_recv,
4728
4729         .bprm_alloc_security =          selinux_bprm_alloc_security,
4730         .bprm_free_security =           selinux_bprm_free_security,
4731         .bprm_apply_creds =             selinux_bprm_apply_creds,
4732         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4733         .bprm_set_security =            selinux_bprm_set_security,
4734         .bprm_check_security =          selinux_bprm_check_security,
4735         .bprm_secureexec =              selinux_bprm_secureexec,
4736
4737         .sb_alloc_security =            selinux_sb_alloc_security,
4738         .sb_free_security =             selinux_sb_free_security,
4739         .sb_copy_data =                 selinux_sb_copy_data,
4740         .sb_kern_mount =                selinux_sb_kern_mount,
4741         .sb_statfs =                    selinux_sb_statfs,
4742         .sb_mount =                     selinux_mount,
4743         .sb_umount =                    selinux_umount,
4744
4745         .inode_alloc_security =         selinux_inode_alloc_security,
4746         .inode_free_security =          selinux_inode_free_security,
4747         .inode_init_security =          selinux_inode_init_security,
4748         .inode_create =                 selinux_inode_create,
4749         .inode_link =                   selinux_inode_link,
4750         .inode_unlink =                 selinux_inode_unlink,
4751         .inode_symlink =                selinux_inode_symlink,
4752         .inode_mkdir =                  selinux_inode_mkdir,
4753         .inode_rmdir =                  selinux_inode_rmdir,
4754         .inode_mknod =                  selinux_inode_mknod,
4755         .inode_rename =                 selinux_inode_rename,
4756         .inode_readlink =               selinux_inode_readlink,
4757         .inode_follow_link =            selinux_inode_follow_link,
4758         .inode_permission =             selinux_inode_permission,
4759         .inode_setattr =                selinux_inode_setattr,
4760         .inode_getattr =                selinux_inode_getattr,
4761         .inode_setxattr =               selinux_inode_setxattr,
4762         .inode_post_setxattr =          selinux_inode_post_setxattr,
4763         .inode_getxattr =               selinux_inode_getxattr,
4764         .inode_listxattr =              selinux_inode_listxattr,
4765         .inode_removexattr =            selinux_inode_removexattr,
4766         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4767         .inode_getsecurity =            selinux_inode_getsecurity,
4768         .inode_setsecurity =            selinux_inode_setsecurity,
4769         .inode_listsecurity =           selinux_inode_listsecurity,
4770
4771         .file_permission =              selinux_file_permission,
4772         .file_alloc_security =          selinux_file_alloc_security,
4773         .file_free_security =           selinux_file_free_security,
4774         .file_ioctl =                   selinux_file_ioctl,
4775         .file_mmap =                    selinux_file_mmap,
4776         .file_mprotect =                selinux_file_mprotect,
4777         .file_lock =                    selinux_file_lock,
4778         .file_fcntl =                   selinux_file_fcntl,
4779         .file_set_fowner =              selinux_file_set_fowner,
4780         .file_send_sigiotask =          selinux_file_send_sigiotask,
4781         .file_receive =                 selinux_file_receive,
4782
4783         .task_create =                  selinux_task_create,
4784         .task_alloc_security =          selinux_task_alloc_security,
4785         .task_free_security =           selinux_task_free_security,
4786         .task_setuid =                  selinux_task_setuid,
4787         .task_post_setuid =             selinux_task_post_setuid,
4788         .task_setgid =                  selinux_task_setgid,
4789         .task_setpgid =                 selinux_task_setpgid,
4790         .task_getpgid =                 selinux_task_getpgid,
4791         .task_getsid =                  selinux_task_getsid,
4792         .task_getsecid =                selinux_task_getsecid,
4793         .task_setgroups =               selinux_task_setgroups,
4794         .task_setnice =                 selinux_task_setnice,
4795         .task_setioprio =               selinux_task_setioprio,
4796         .task_getioprio =               selinux_task_getioprio,
4797         .task_setrlimit =               selinux_task_setrlimit,
4798         .task_setscheduler =            selinux_task_setscheduler,
4799         .task_getscheduler =            selinux_task_getscheduler,
4800         .task_movememory =              selinux_task_movememory,
4801         .task_kill =                    selinux_task_kill,
4802         .task_wait =                    selinux_task_wait,
4803         .task_prctl =                   selinux_task_prctl,
4804         .task_reparent_to_init =        selinux_task_reparent_to_init,
4805         .task_to_inode =                selinux_task_to_inode,
4806
4807         .ipc_permission =               selinux_ipc_permission,
4808
4809         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4810         .msg_msg_free_security =        selinux_msg_msg_free_security,
4811
4812         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4813         .msg_queue_free_security =      selinux_msg_queue_free_security,
4814         .msg_queue_associate =          selinux_msg_queue_associate,
4815         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4816         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4817         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4818
4819         .shm_alloc_security =           selinux_shm_alloc_security,
4820         .shm_free_security =            selinux_shm_free_security,
4821         .shm_associate =                selinux_shm_associate,
4822         .shm_shmctl =                   selinux_shm_shmctl,
4823         .shm_shmat =                    selinux_shm_shmat,
4824
4825         .sem_alloc_security =           selinux_sem_alloc_security,
4826         .sem_free_security =            selinux_sem_free_security,
4827         .sem_associate =                selinux_sem_associate,
4828         .sem_semctl =                   selinux_sem_semctl,
4829         .sem_semop =                    selinux_sem_semop,
4830
4831         .register_security =            selinux_register_security,
4832         .unregister_security =          selinux_unregister_security,
4833
4834         .d_instantiate =                selinux_d_instantiate,
4835
4836         .getprocattr =                  selinux_getprocattr,
4837         .setprocattr =                  selinux_setprocattr,
4838
4839         .secid_to_secctx =              selinux_secid_to_secctx,
4840         .release_secctx =               selinux_release_secctx,
4841
4842         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4843         .unix_may_send =                selinux_socket_unix_may_send,
4844
4845         .socket_create =                selinux_socket_create,
4846         .socket_post_create =           selinux_socket_post_create,
4847         .socket_bind =                  selinux_socket_bind,
4848         .socket_connect =               selinux_socket_connect,
4849         .socket_listen =                selinux_socket_listen,
4850         .socket_accept =                selinux_socket_accept,
4851         .socket_sendmsg =               selinux_socket_sendmsg,
4852         .socket_recvmsg =               selinux_socket_recvmsg,
4853         .socket_getsockname =           selinux_socket_getsockname,
4854         .socket_getpeername =           selinux_socket_getpeername,
4855         .socket_getsockopt =            selinux_socket_getsockopt,
4856         .socket_setsockopt =            selinux_socket_setsockopt,
4857         .socket_shutdown =              selinux_socket_shutdown,
4858         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4859         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4860         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4861         .sk_alloc_security =            selinux_sk_alloc_security,
4862         .sk_free_security =             selinux_sk_free_security,
4863         .sk_clone_security =            selinux_sk_clone_security,
4864         .sk_getsecid =                  selinux_sk_getsecid,
4865         .sock_graft =                   selinux_sock_graft,
4866         .inet_conn_request =            selinux_inet_conn_request,
4867         .inet_csk_clone =               selinux_inet_csk_clone,
4868         .inet_conn_established =        selinux_inet_conn_established,
4869         .req_classify_flow =            selinux_req_classify_flow,
4870
4871 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4872         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4873         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4874         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4875         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4876         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4877         .xfrm_state_free_security =     selinux_xfrm_state_free,
4878         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4879         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4880         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
4881         .xfrm_decode_session =          selinux_xfrm_decode_session,
4882 #endif
4883
4884 #ifdef CONFIG_KEYS
4885         .key_alloc =                    selinux_key_alloc,
4886         .key_free =                     selinux_key_free,
4887         .key_permission =               selinux_key_permission,
4888 #endif
4889 };
4890
4891 static __init int selinux_init(void)
4892 {
4893         struct task_security_struct *tsec;
4894
4895         if (!selinux_enabled) {
4896                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4897                 return 0;
4898         }
4899
4900         printk(KERN_INFO "SELinux:  Initializing.\n");
4901
4902         /* Set the security state for the initial task. */
4903         if (task_alloc_security(current))
4904                 panic("SELinux:  Failed to initialize initial task.\n");
4905         tsec = current->security;
4906         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4907
4908         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4909                                             sizeof(struct inode_security_struct),
4910                                             0, SLAB_PANIC, NULL, NULL);
4911         avc_init();
4912
4913         original_ops = secondary_ops = security_ops;
4914         if (!secondary_ops)
4915                 panic ("SELinux: No initial security operations\n");
4916         if (register_security (&selinux_ops))
4917                 panic("SELinux: Unable to register with kernel.\n");
4918
4919         if (selinux_enforcing) {
4920                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
4921         } else {
4922                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
4923         }
4924
4925 #ifdef CONFIG_KEYS
4926         /* Add security information to initial keyrings */
4927         selinux_key_alloc(&root_user_keyring, current,
4928                           KEY_ALLOC_NOT_IN_QUOTA);
4929         selinux_key_alloc(&root_session_keyring, current,
4930                           KEY_ALLOC_NOT_IN_QUOTA);
4931 #endif
4932
4933         return 0;
4934 }
4935
4936 void selinux_complete_init(void)
4937 {
4938         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
4939
4940         /* Set up any superblocks initialized prior to the policy load. */
4941         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
4942         spin_lock(&sb_lock);
4943         spin_lock(&sb_security_lock);
4944 next_sb:
4945         if (!list_empty(&superblock_security_head)) {
4946                 struct superblock_security_struct *sbsec =
4947                                 list_entry(superblock_security_head.next,
4948                                            struct superblock_security_struct,
4949                                            list);
4950                 struct super_block *sb = sbsec->sb;
4951                 sb->s_count++;
4952                 spin_unlock(&sb_security_lock);
4953                 spin_unlock(&sb_lock);
4954                 down_read(&sb->s_umount);
4955                 if (sb->s_root)
4956                         superblock_doinit(sb, NULL);
4957                 drop_super(sb);
4958                 spin_lock(&sb_lock);
4959                 spin_lock(&sb_security_lock);
4960                 list_del_init(&sbsec->list);
4961                 goto next_sb;
4962         }
4963         spin_unlock(&sb_security_lock);
4964         spin_unlock(&sb_lock);
4965 }
4966
4967 /* SELinux requires early initialization in order to label
4968    all processes and objects when they are created. */
4969 security_initcall(selinux_init);
4970
4971 #if defined(CONFIG_NETFILTER)
4972
4973 static struct nf_hook_ops selinux_ipv4_op = {
4974         .hook =         selinux_ipv4_postroute_last,
4975         .owner =        THIS_MODULE,
4976         .pf =           PF_INET,
4977         .hooknum =      NF_IP_POST_ROUTING,
4978         .priority =     NF_IP_PRI_SELINUX_LAST,
4979 };
4980
4981 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4982
4983 static struct nf_hook_ops selinux_ipv6_op = {
4984         .hook =         selinux_ipv6_postroute_last,
4985         .owner =        THIS_MODULE,
4986         .pf =           PF_INET6,
4987         .hooknum =      NF_IP6_POST_ROUTING,
4988         .priority =     NF_IP6_PRI_SELINUX_LAST,
4989 };
4990
4991 #endif  /* IPV6 */
4992
4993 static int __init selinux_nf_ip_init(void)
4994 {
4995         int err = 0;
4996
4997         if (!selinux_enabled)
4998                 goto out;
4999
5000         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5001
5002         err = nf_register_hook(&selinux_ipv4_op);
5003         if (err)
5004                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5005
5006 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5007
5008         err = nf_register_hook(&selinux_ipv6_op);
5009         if (err)
5010                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5011
5012 #endif  /* IPV6 */
5013
5014 out:
5015         return err;
5016 }
5017
5018 __initcall(selinux_nf_ip_init);
5019
5020 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5021 static void selinux_nf_ip_exit(void)
5022 {
5023         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5024
5025         nf_unregister_hook(&selinux_ipv4_op);
5026 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5027         nf_unregister_hook(&selinux_ipv6_op);
5028 #endif  /* IPV6 */
5029 }
5030 #endif
5031
5032 #else /* CONFIG_NETFILTER */
5033
5034 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5035 #define selinux_nf_ip_exit()
5036 #endif
5037
5038 #endif /* CONFIG_NETFILTER */
5039
5040 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5041 int selinux_disable(void)
5042 {
5043         extern void exit_sel_fs(void);
5044         static int selinux_disabled = 0;
5045
5046         if (ss_initialized) {
5047                 /* Not permitted after initial policy load. */
5048                 return -EINVAL;
5049         }
5050
5051         if (selinux_disabled) {
5052                 /* Only do this once. */
5053                 return -EINVAL;
5054         }
5055
5056         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5057
5058         selinux_disabled = 1;
5059         selinux_enabled = 0;
5060
5061         /* Reset security_ops to the secondary module, dummy or capability. */
5062         security_ops = secondary_ops;
5063
5064         /* Unregister netfilter hooks. */
5065         selinux_nf_ip_exit();
5066
5067         /* Unregister selinuxfs. */
5068         exit_sel_fs();
5069
5070         return 0;
5071 }
5072 #endif
5073
5074