security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         /*
 259          * As not all inode security structures are in a list, we check for
 260          * empty list outside of the lock to make sure that we won't waste
 261          * time taking a lock doing nothing.
 262          *
 263          * The list_del_init() function can be safely called more than once.
 264          * It should not be possible for this function to be called with
 265          * concurrent list_add(), but for better safety against future changes
 266          * in the code, we use list_empty_careful() here.
 267          */
 268         if (!list_empty_careful(&isec->list)) {
 269                 spin_lock(&sbsec->isec_lock);
 270                 list_del_init(&isec->list);
 271                 spin_unlock(&sbsec->isec_lock);
 272         }
 273
 274         /*
 275          * The inode may still be referenced in a path walk and
 276          * a call to selinux_inode_permission() can be made
 277          * after inode_free_security() is called. Ideally, the VFS
 278          * wouldn't do this, but fixing that is a much harder
 279          * job. For now, simply free the i_security via RCU, and
 280          * leave the current inode->i_security pointer intact.
 281          * The inode will be freed after the RCU grace period too.
 282          */
 283         call_rcu(&isec->rcu, inode_free_rcu);
 284 }
 285
 286 static int file_alloc_security(struct file *file)
 287 {
 288         struct file_security_struct *fsec;
 289         u32 sid = current_sid();
 290
 291         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 292         if (!fsec)
 293                 return -ENOMEM;
 294
 295         fsec->sid = sid;
 296         fsec->fown_sid = sid;
 297         file->f_security = fsec;
 298
 299         return 0;
 300 }
 301
 302 static void file_free_security(struct file *file)
 303 {
 304         struct file_security_struct *fsec = file->f_security;
 305         file->f_security = NULL;
 306         kmem_cache_free(file_security_cache, fsec);
 307 }
 308
 309 static int superblock_alloc_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec;
 312
 313         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 314         if (!sbsec)
 315                 return -ENOMEM;
 316
 317         mutex_init(&sbsec->lock);
 318         INIT_LIST_HEAD(&sbsec->isec_head);
 319         spin_lock_init(&sbsec->isec_lock);
 320         sbsec->sb = sb;
 321         sbsec->sid = SECINITSID_UNLABELED;
 322         sbsec->def_sid = SECINITSID_FILE;
 323         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 324         sb->s_security = sbsec;
 325
 326         return 0;
 327 }
 328
 329 static void superblock_free_security(struct super_block *sb)
 330 {
 331         struct superblock_security_struct *sbsec = sb->s_security;
 332         sb->s_security = NULL;
 333         kfree(sbsec);
 334 }
 335
 336 /* The file system's label must be initialized prior to use. */
 337
 338 static const char *labeling_behaviors[7] = {
 339         "uses xattr",
 340         "uses transition SIDs",
 341         "uses task SIDs",
 342         "uses genfs_contexts",
 343         "not configured for labeling",
 344         "uses mountpoint labeling",
 345         "uses native labeling",
 346 };
 347
 348 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 349
 350 static inline int inode_doinit(struct inode *inode)
 351 {
 352         return inode_doinit_with_dentry(inode, NULL);
 353 }
 354
 355 enum {
 356         Opt_error = -1,
 357         Opt_context = 1,
 358         Opt_fscontext = 2,
 359         Opt_defcontext = 3,
 360         Opt_rootcontext = 4,
 361         Opt_labelsupport = 5,
 362         Opt_nextmntopt = 6,
 363 };
 364
 365 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 366
 367 static const match_table_t tokens = {
 368         {Opt_context, CONTEXT_STR "%s"},
 369         {Opt_fscontext, FSCONTEXT_STR "%s"},
 370         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 371         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 372         {Opt_labelsupport, LABELSUPP_STR},
 373         {Opt_error, NULL},
 374 };
 375
 376 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 377
 378 static int may_context_mount_sb_relabel(u32 sid,
 379                         struct superblock_security_struct *sbsec,
 380                         const struct cred *cred)
 381 {
 382         const struct task_security_struct *tsec = cred->security;
 383         int rc;
 384
 385         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 386                           FILESYSTEM__RELABELFROM, NULL);
 387         if (rc)
 388                 return rc;
 389
 390         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELTO, NULL);
 392         return rc;
 393 }
 394
 395 static int may_context_mount_inode_relabel(u32 sid,
 396                         struct superblock_security_struct *sbsec,
 397                         const struct cred *cred)
 398 {
 399         const struct task_security_struct *tsec = cred->security;
 400         int rc;
 401         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 402                           FILESYSTEM__RELABELFROM, NULL);
 403         if (rc)
 404                 return rc;
 405
 406         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 407                           FILESYSTEM__ASSOCIATE, NULL);
 408         return rc;
 409 }
 410
 411 static int selinux_is_sblabel_mnt(struct super_block *sb)
 412 {
 413         struct superblock_security_struct *sbsec = sb->s_security;
 414
 415         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 416                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 417                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 418                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 419                 /* Special handling. Genfs but also in-core setxattr handler */
 420                 !strcmp(sb->s_type->name, "sysfs") ||
 421                 !strcmp(sb->s_type->name, "pstore") ||
 422                 !strcmp(sb->s_type->name, "debugfs") ||
 423                 !strcmp(sb->s_type->name, "rootfs");
 424 }
 425
 426 static int sb_finish_set_opts(struct super_block *sb)
 427 {
 428         struct superblock_security_struct *sbsec = sb->s_security;
 429         struct dentry *root = sb->s_root;
 430         struct inode *root_inode = d_backing_inode(root);
 431         int rc = 0;
 432
 433         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 434                 /* Make sure that the xattr handler exists and that no
 435                    error other than -ENODATA is returned by getxattr on
 436                    the root directory.  -ENODATA is ok, as this may be
 437                    the first boot of the SELinux kernel before we have
 438                    assigned xattr values to the filesystem. */
 439                 if (!root_inode->i_op->getxattr) {
 440                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 441                                "xattr support\n", sb->s_id, sb->s_type->name);
 442                         rc = -EOPNOTSUPP;
 443                         goto out;
 444                 }
 445                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 446                 if (rc < 0 && rc != -ENODATA) {
 447                         if (rc == -EOPNOTSUPP)
 448                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 449                                        "%s) has no security xattr handler\n",
 450                                        sb->s_id, sb->s_type->name);
 451                         else
 452                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 453                                        "%s) getxattr errno %d\n", sb->s_id,
 454                                        sb->s_type->name, -rc);
 455                         goto out;
 456                 }
 457         }
 458
 459         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 460                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 461                        sb->s_id, sb->s_type->name);
 462
 463         sbsec->flags |= SE_SBINITIALIZED;
 464         if (selinux_is_sblabel_mnt(sb))
 465                 sbsec->flags |= SBLABEL_MNT;
 466
 467         /*
 468          * Special handling for rootfs. Is genfs but supports
 469          * setting SELinux context on in-core inodes.
 470          */
 471         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 472                 sbsec->flags |= SE_SBLABELSUPP;
 473
 474         /* Initialize the root inode. */
 475         rc = inode_doinit_with_dentry(root_inode, root);
 476
 477         /* Initialize any other inodes associated with the superblock, e.g.
 478            inodes created prior to initial policy load or inodes created
 479            during get_sb by a pseudo filesystem that directly
 480            populates itself. */
 481         spin_lock(&sbsec->isec_lock);
 482 next_inode:
 483         if (!list_empty(&sbsec->isec_head)) {
 484                 struct inode_security_struct *isec =
 485                                 list_entry(sbsec->isec_head.next,
 486                                            struct inode_security_struct, list);
 487                 struct inode *inode = isec->inode;
 488                 list_del_init(&isec->list);
 489                 spin_unlock(&sbsec->isec_lock);
 490                 inode = igrab(inode);
 491                 if (inode) {
 492                         if (!IS_PRIVATE(inode))
 493                                 inode_doinit(inode);
 494                         iput(inode);
 495                 }
 496                 spin_lock(&sbsec->isec_lock);
 497                 goto next_inode;
 498         }
 499         spin_unlock(&sbsec->isec_lock);
 500 out:
 501         return rc;
 502 }
 503
 504 /*
 505  * This function should allow an FS to ask what it's mount security
 506  * options were so it can use those later for submounts, displaying
 507  * mount options, or whatever.
 508  */
 509 static int selinux_get_mnt_opts(const struct super_block *sb,
 510                                 struct security_mnt_opts *opts)
 511 {
 512         int rc = 0, i;
 513         struct superblock_security_struct *sbsec = sb->s_security;
 514         char *context = NULL;
 515         u32 len;
 516         char tmp;
 517
 518         security_init_mnt_opts(opts);
 519
 520         if (!(sbsec->flags & SE_SBINITIALIZED))
 521                 return -EINVAL;
 522
 523         if (!ss_initialized)
 524                 return -EINVAL;
 525
 526         /* make sure we always check enough bits to cover the mask */
 527         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 528
 529         tmp = sbsec->flags & SE_MNTMASK;
 530         /* count the number of mount options for this sb */
 531         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 532                 if (tmp & 0x01)
 533                         opts->num_mnt_opts++;
 534                 tmp >>= 1;
 535         }
 536         /* Check if the Label support flag is set */
 537         if (sbsec->flags & SBLABEL_MNT)
 538                 opts->num_mnt_opts++;
 539
 540         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 541         if (!opts->mnt_opts) {
 542                 rc = -ENOMEM;
 543                 goto out_free;
 544         }
 545
 546         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 547         if (!opts->mnt_opts_flags) {
 548                 rc = -ENOMEM;
 549                 goto out_free;
 550         }
 551
 552         i = 0;
 553         if (sbsec->flags & FSCONTEXT_MNT) {
 554                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 555                 if (rc)
 556                         goto out_free;
 557                 opts->mnt_opts[i] = context;
 558                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 559         }
 560         if (sbsec->flags & CONTEXT_MNT) {
 561                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 562                 if (rc)
 563                         goto out_free;
 564                 opts->mnt_opts[i] = context;
 565                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 566         }
 567         if (sbsec->flags & DEFCONTEXT_MNT) {
 568                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 569                 if (rc)
 570                         goto out_free;
 571                 opts->mnt_opts[i] = context;
 572                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 573         }
 574         if (sbsec->flags & ROOTCONTEXT_MNT) {
 575                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 576                 struct inode_security_struct *isec = root->i_security;
 577
 578                 rc = security_sid_to_context(isec->sid, &context, &len);
 579                 if (rc)
 580                         goto out_free;
 581                 opts->mnt_opts[i] = context;
 582                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 583         }
 584         if (sbsec->flags & SBLABEL_MNT) {
 585                 opts->mnt_opts[i] = NULL;
 586                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 587         }
 588
 589         BUG_ON(i != opts->num_mnt_opts);
 590
 591         return 0;
 592
 593 out_free:
 594         security_free_mnt_opts(opts);
 595         return rc;
 596 }
 597
 598 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 599                       u32 old_sid, u32 new_sid)
 600 {
 601         char mnt_flags = sbsec->flags & SE_MNTMASK;
 602
 603         /* check if the old mount command had the same options */
 604         if (sbsec->flags & SE_SBINITIALIZED)
 605                 if (!(sbsec->flags & flag) ||
 606                     (old_sid != new_sid))
 607                         return 1;
 608
 609         /* check if we were passed the same options twice,
 610          * aka someone passed context=a,context=b
 611          */
 612         if (!(sbsec->flags & SE_SBINITIALIZED))
 613                 if (mnt_flags & flag)
 614                         return 1;
 615         return 0;
 616 }
 617
 618 /*
 619  * Allow filesystems with binary mount data to explicitly set mount point
 620  * labeling information.
 621  */
 622 static int selinux_set_mnt_opts(struct super_block *sb,
 623                                 struct security_mnt_opts *opts,
 624                                 unsigned long kern_flags,
 625                                 unsigned long *set_kern_flags)
 626 {
 627         const struct cred *cred = current_cred();
 628         int rc = 0, i;
 629         struct superblock_security_struct *sbsec = sb->s_security;
 630         const char *name = sb->s_type->name;
 631         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 632         struct inode_security_struct *root_isec = inode->i_security;
 633         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 634         u32 defcontext_sid = 0;
 635         char **mount_options = opts->mnt_opts;
 636         int *flags = opts->mnt_opts_flags;
 637         int num_opts = opts->num_mnt_opts;
 638
 639         mutex_lock(&sbsec->lock);
 640
 641         if (!ss_initialized) {
 642                 if (!num_opts) {
 643                         /* Defer initialization until selinux_complete_init,
 644                            after the initial policy is loaded and the security
 645                            server is ready to handle calls. */
 646                         goto out;
 647                 }
 648                 rc = -EINVAL;
 649                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 650                         "before the security server is initialized\n");
 651                 goto out;
 652         }
 653         if (kern_flags && !set_kern_flags) {
 654                 /* Specifying internal flags without providing a place to
 655                  * place the results is not allowed */
 656                 rc = -EINVAL;
 657                 goto out;
 658         }
 659
 660         /*
 661          * Binary mount data FS will come through this function twice.  Once
 662          * from an explicit call and once from the generic calls from the vfs.
 663          * Since the generic VFS calls will not contain any security mount data
 664          * we need to skip the double mount verification.
 665          *
 666          * This does open a hole in which we will not notice if the first
 667          * mount using this sb set explict options and a second mount using
 668          * this sb does not set any security options.  (The first options
 669          * will be used for both mounts)
 670          */
 671         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 672             && (num_opts == 0))
 673                 goto out;
 674
 675         /*
 676          * parse the mount options, check if they are valid sids.
 677          * also check if someone is trying to mount the same sb more
 678          * than once with different security options.
 679          */
 680         for (i = 0; i < num_opts; i++) {
 681                 u32 sid;
 682
 683                 if (flags[i] == SBLABEL_MNT)
 684                         continue;
 685                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 686                 if (rc) {
 687                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 688                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 689                                mount_options[i], sb->s_id, name, rc);
 690                         goto out;
 691                 }
 692                 switch (flags[i]) {
 693                 case FSCONTEXT_MNT:
 694                         fscontext_sid = sid;
 695
 696                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 697                                         fscontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= FSCONTEXT_MNT;
 701                         break;
 702                 case CONTEXT_MNT:
 703                         context_sid = sid;
 704
 705                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 706                                         context_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= CONTEXT_MNT;
 710                         break;
 711                 case ROOTCONTEXT_MNT:
 712                         rootcontext_sid = sid;
 713
 714                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 715                                         rootcontext_sid))
 716                                 goto out_double_mount;
 717
 718                         sbsec->flags |= ROOTCONTEXT_MNT;
 719
 720                         break;
 721                 case DEFCONTEXT_MNT:
 722                         defcontext_sid = sid;
 723
 724                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 725                                         defcontext_sid))
 726                                 goto out_double_mount;
 727
 728                         sbsec->flags |= DEFCONTEXT_MNT;
 729
 730                         break;
 731                 default:
 732                         rc = -EINVAL;
 733                         goto out;
 734                 }
 735         }
 736
 737         if (sbsec->flags & SE_SBINITIALIZED) {
 738                 /* previously mounted with options, but not on this attempt? */
 739                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 740                         goto out_double_mount;
 741                 rc = 0;
 742                 goto out;
 743         }
 744
 745         if (strcmp(sb->s_type->name, "proc") == 0)
 746                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 747
 748         if (!strcmp(sb->s_type->name, "debugfs") ||
 749             !strcmp(sb->s_type->name, "sysfs") ||
 750             !strcmp(sb->s_type->name, "pstore"))
 751                 sbsec->flags |= SE_SBGENFS;
 752
 753         if (!sbsec->behavior) {
 754                 /*
 755                  * Determine the labeling behavior to use for this
 756                  * filesystem type.
 757                  */
 758                 rc = security_fs_use(sb);
 759                 if (rc) {
 760                         printk(KERN_WARNING
 761                                 "%s: security_fs_use(%s) returned %d\n",
 762                                         __func__, sb->s_type->name, rc);
 763                         goto out;
 764                 }
 765         }
 766         /* sets the context of the superblock for the fs being mounted. */
 767         if (fscontext_sid) {
 768                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 769                 if (rc)
 770                         goto out;
 771
 772                 sbsec->sid = fscontext_sid;
 773         }
 774
 775         /*
 776          * Switch to using mount point labeling behavior.
 777          * sets the label used on all file below the mountpoint, and will set
 778          * the superblock context if not already set.
 779          */
 780         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 781                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 782                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 783         }
 784
 785         if (context_sid) {
 786                 if (!fscontext_sid) {
 787                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 788                                                           cred);
 789                         if (rc)
 790                                 goto out;
 791                         sbsec->sid = context_sid;
 792                 } else {
 793                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 794                                                              cred);
 795                         if (rc)
 796                                 goto out;
 797                 }
 798                 if (!rootcontext_sid)
 799                         rootcontext_sid = context_sid;
 800
 801                 sbsec->mntpoint_sid = context_sid;
 802                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 803         }
 804
 805         if (rootcontext_sid) {
 806                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 807                                                      cred);
 808                 if (rc)
 809                         goto out;
 810
 811                 root_isec->sid = rootcontext_sid;
 812                 root_isec->initialized = 1;
 813         }
 814
 815         if (defcontext_sid) {
 816                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 817                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 818                         rc = -EINVAL;
 819                         printk(KERN_WARNING "SELinux: defcontext option is "
 820                                "invalid for this filesystem type\n");
 821                         goto out;
 822                 }
 823
 824                 if (defcontext_sid != sbsec->def_sid) {
 825                         rc = may_context_mount_inode_relabel(defcontext_sid,
 826                                                              sbsec, cred);
 827                         if (rc)
 828                                 goto out;
 829                 }
 830
 831                 sbsec->def_sid = defcontext_sid;
 832         }
 833
 834         rc = sb_finish_set_opts(sb);
 835 out:
 836         mutex_unlock(&sbsec->lock);
 837         return rc;
 838 out_double_mount:
 839         rc = -EINVAL;
 840         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 841                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 842         goto out;
 843 }
 844
 845 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 846                                     const struct super_block *newsb)
 847 {
 848         struct superblock_security_struct *old = oldsb->s_security;
 849         struct superblock_security_struct *new = newsb->s_security;
 850         char oldflags = old->flags & SE_MNTMASK;
 851         char newflags = new->flags & SE_MNTMASK;
 852
 853         if (oldflags != newflags)
 854                 goto mismatch;
 855         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 856                 goto mismatch;
 857         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 858                 goto mismatch;
 859         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 860                 goto mismatch;
 861         if (oldflags & ROOTCONTEXT_MNT) {
 862                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 863                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 864                 if (oldroot->sid != newroot->sid)
 865                         goto mismatch;
 866         }
 867         return 0;
 868 mismatch:
 869         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 870                             "different security settings for (dev %s, "
 871                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 872         return -EBUSY;
 873 }
 874
 875 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 876                                         struct super_block *newsb)
 877 {
 878         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 879         struct superblock_security_struct *newsbsec = newsb->s_security;
 880
 881         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 882         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 883         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 884
 885         /*
 886          * if the parent was able to be mounted it clearly had no special lsm
 887          * mount options.  thus we can safely deal with this superblock later
 888          */
 889         if (!ss_initialized)
 890                 return 0;
 891
 892         /* how can we clone if the old one wasn't set up?? */
 893         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 894
 895         /* if fs is reusing a sb, make sure that the contexts match */
 896         if (newsbsec->flags & SE_SBINITIALIZED)
 897                 return selinux_cmp_sb_context(oldsb, newsb);
 898
 899         mutex_lock(&newsbsec->lock);
 900
 901         newsbsec->flags = oldsbsec->flags;
 902
 903         newsbsec->sid = oldsbsec->sid;
 904         newsbsec->def_sid = oldsbsec->def_sid;
 905         newsbsec->behavior = oldsbsec->behavior;
 906
 907         if (set_context) {
 908                 u32 sid = oldsbsec->mntpoint_sid;
 909
 910                 if (!set_fscontext)
 911                         newsbsec->sid = sid;
 912                 if (!set_rootcontext) {
 913                         struct inode *newinode = d_backing_inode(newsb->s_root);
 914                         struct inode_security_struct *newisec = newinode->i_security;
 915                         newisec->sid = sid;
 916                 }
 917                 newsbsec->mntpoint_sid = sid;
 918         }
 919         if (set_rootcontext) {
 920                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 921                 const struct inode_security_struct *oldisec = oldinode->i_security;
 922                 struct inode *newinode = d_backing_inode(newsb->s_root);
 923                 struct inode_security_struct *newisec = newinode->i_security;
 924
 925                 newisec->sid = oldisec->sid;
 926         }
 927
 928         sb_finish_set_opts(newsb);
 929         mutex_unlock(&newsbsec->lock);
 930         return 0;
 931 }
 932
 933 static int selinux_parse_opts_str(char *options,
 934                                   struct security_mnt_opts *opts)
 935 {
 936         char *p;
 937         char *context = NULL, *defcontext = NULL;
 938         char *fscontext = NULL, *rootcontext = NULL;
 939         int rc, num_mnt_opts = 0;
 940
 941         opts->num_mnt_opts = 0;
 942
 943         /* Standard string-based options. */
 944         while ((p = strsep(&options, "|")) != NULL) {
 945                 int token;
 946                 substring_t args[MAX_OPT_ARGS];
 947
 948                 if (!*p)
 949                         continue;
 950
 951                 token = match_token(p, tokens, args);
 952
 953                 switch (token) {
 954                 case Opt_context:
 955                         if (context || defcontext) {
 956                                 rc = -EINVAL;
 957                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 958                                 goto out_err;
 959                         }
 960                         context = match_strdup(&args[0]);
 961                         if (!context) {
 962                                 rc = -ENOMEM;
 963                                 goto out_err;
 964                         }
 965                         break;
 966
 967                 case Opt_fscontext:
 968                         if (fscontext) {
 969                                 rc = -EINVAL;
 970                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 971                                 goto out_err;
 972                         }
 973                         fscontext = match_strdup(&args[0]);
 974                         if (!fscontext) {
 975                                 rc = -ENOMEM;
 976                                 goto out_err;
 977                         }
 978                         break;
 979
 980                 case Opt_rootcontext:
 981                         if (rootcontext) {
 982                                 rc = -EINVAL;
 983                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 984                                 goto out_err;
 985                         }
 986                         rootcontext = match_strdup(&args[0]);
 987                         if (!rootcontext) {
 988                                 rc = -ENOMEM;
 989                                 goto out_err;
 990                         }
 991                         break;
 992
 993                 case Opt_defcontext:
 994                         if (context || defcontext) {
 995                                 rc = -EINVAL;
 996                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 997                                 goto out_err;
 998                         }
 999                         defcontext = match_strdup(&args[0]);
1000                         if (!defcontext) {
1001                                 rc = -ENOMEM;
1002                                 goto out_err;
1003                         }
1004                         break;
1005                 case Opt_labelsupport:
1006                         break;
1007                 default:
1008                         rc = -EINVAL;
1009                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1010                         goto out_err;
1011
1012                 }
1013         }
1014
1015         rc = -ENOMEM;
1016         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1017         if (!opts->mnt_opts)
1018                 goto out_err;
1019
1020         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1021         if (!opts->mnt_opts_flags) {
1022                 kfree(opts->mnt_opts);
1023                 goto out_err;
1024         }
1025
1026         if (fscontext) {
1027                 opts->mnt_opts[num_mnt_opts] = fscontext;
1028                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1029         }
1030         if (context) {
1031                 opts->mnt_opts[num_mnt_opts] = context;
1032                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1033         }
1034         if (rootcontext) {
1035                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1036                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1037         }
1038         if (defcontext) {
1039                 opts->mnt_opts[num_mnt_opts] = defcontext;
1040                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1041         }
1042
1043         opts->num_mnt_opts = num_mnt_opts;
1044         return 0;
1045
1046 out_err:
1047         kfree(context);
1048         kfree(defcontext);
1049         kfree(fscontext);
1050         kfree(rootcontext);
1051         return rc;
1052 }
1053 /*
1054  * string mount options parsing and call set the sbsec
1055  */
1056 static int superblock_doinit(struct super_block *sb, void *data)
1057 {
1058         int rc = 0;
1059         char *options = data;
1060         struct security_mnt_opts opts;
1061
1062         security_init_mnt_opts(&opts);
1063
1064         if (!data)
1065                 goto out;
1066
1067         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1068
1069         rc = selinux_parse_opts_str(options, &opts);
1070         if (rc)
1071                 goto out_err;
1072
1073 out:
1074         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1075
1076 out_err:
1077         security_free_mnt_opts(&opts);
1078         return rc;
1079 }
1080
1081 static void selinux_write_opts(struct seq_file *m,
1082                                struct security_mnt_opts *opts)
1083 {
1084         int i;
1085         char *prefix;
1086
1087         for (i = 0; i < opts->num_mnt_opts; i++) {
1088                 char *has_comma;
1089
1090                 if (opts->mnt_opts[i])
1091                         has_comma = strchr(opts->mnt_opts[i], ',');
1092                 else
1093                         has_comma = NULL;
1094
1095                 switch (opts->mnt_opts_flags[i]) {
1096                 case CONTEXT_MNT:
1097                         prefix = CONTEXT_STR;
1098                         break;
1099                 case FSCONTEXT_MNT:
1100                         prefix = FSCONTEXT_STR;
1101                         break;
1102                 case ROOTCONTEXT_MNT:
1103                         prefix = ROOTCONTEXT_STR;
1104                         break;
1105                 case DEFCONTEXT_MNT:
1106                         prefix = DEFCONTEXT_STR;
1107                         break;
1108                 case SBLABEL_MNT:
1109                         seq_putc(m, ',');
1110                         seq_puts(m, LABELSUPP_STR);
1111                         continue;
1112                 default:
1113                         BUG();
1114                         return;
1115                 };
1116                 /* we need a comma before each option */
1117                 seq_putc(m, ',');
1118                 seq_puts(m, prefix);
1119                 if (has_comma)
1120                         seq_putc(m, '\"');
1121                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1122                 if (has_comma)
1123                         seq_putc(m, '\"');
1124         }
1125 }
1126
1127 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1128 {
1129         struct security_mnt_opts opts;
1130         int rc;
1131
1132         rc = selinux_get_mnt_opts(sb, &opts);
1133         if (rc) {
1134                 /* before policy load we may get EINVAL, don't show anything */
1135                 if (rc == -EINVAL)
1136                         rc = 0;
1137                 return rc;
1138         }
1139
1140         selinux_write_opts(m, &opts);
1141
1142         security_free_mnt_opts(&opts);
1143
1144         return rc;
1145 }
1146
1147 static inline u16 inode_mode_to_security_class(umode_t mode)
1148 {
1149         switch (mode & S_IFMT) {
1150         case S_IFSOCK:
1151                 return SECCLASS_SOCK_FILE;
1152         case S_IFLNK:
1153                 return SECCLASS_LNK_FILE;
1154         case S_IFREG:
1155                 return SECCLASS_FILE;
1156         case S_IFBLK:
1157                 return SECCLASS_BLK_FILE;
1158         case S_IFDIR:
1159                 return SECCLASS_DIR;
1160         case S_IFCHR:
1161                 return SECCLASS_CHR_FILE;
1162         case S_IFIFO:
1163                 return SECCLASS_FIFO_FILE;
1164
1165         }
1166
1167         return SECCLASS_FILE;
1168 }
1169
1170 static inline int default_protocol_stream(int protocol)
1171 {
1172         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1173 }
1174
1175 static inline int default_protocol_dgram(int protocol)
1176 {
1177         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1178 }
1179
1180 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1181 {
1182         switch (family) {
1183         case PF_UNIX:
1184                 switch (type) {
1185                 case SOCK_STREAM:
1186                 case SOCK_SEQPACKET:
1187                         return SECCLASS_UNIX_STREAM_SOCKET;
1188                 case SOCK_DGRAM:
1189                         return SECCLASS_UNIX_DGRAM_SOCKET;
1190                 }
1191                 break;
1192         case PF_INET:
1193         case PF_INET6:
1194                 switch (type) {
1195                 case SOCK_STREAM:
1196                         if (default_protocol_stream(protocol))
1197                                 return SECCLASS_TCP_SOCKET;
1198                         else
1199                                 return SECCLASS_RAWIP_SOCKET;
1200                 case SOCK_DGRAM:
1201                         if (default_protocol_dgram(protocol))
1202                                 return SECCLASS_UDP_SOCKET;
1203                         else
1204                                 return SECCLASS_RAWIP_SOCKET;
1205                 case SOCK_DCCP:
1206                         return SECCLASS_DCCP_SOCKET;
1207                 default:
1208                         return SECCLASS_RAWIP_SOCKET;
1209                 }
1210                 break;
1211         case PF_NETLINK:
1212                 switch (protocol) {
1213                 case NETLINK_ROUTE:
1214                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1215                 case NETLINK_SOCK_DIAG:
1216                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1217                 case NETLINK_NFLOG:
1218                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1219                 case NETLINK_XFRM:
1220                         return SECCLASS_NETLINK_XFRM_SOCKET;
1221                 case NETLINK_SELINUX:
1222                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1223                 case NETLINK_ISCSI:
1224                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1225                 case NETLINK_AUDIT:
1226                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1227                 case NETLINK_FIB_LOOKUP:
1228                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1229                 case NETLINK_CONNECTOR:
1230                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1231                 case NETLINK_NETFILTER:
1232                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1233                 case NETLINK_DNRTMSG:
1234                         return SECCLASS_NETLINK_DNRT_SOCKET;
1235                 case NETLINK_KOBJECT_UEVENT:
1236                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1237                 case NETLINK_GENERIC:
1238                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1239                 case NETLINK_SCSITRANSPORT:
1240                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1241                 case NETLINK_RDMA:
1242                         return SECCLASS_NETLINK_RDMA_SOCKET;
1243                 case NETLINK_CRYPTO:
1244                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1245                 default:
1246                         return SECCLASS_NETLINK_SOCKET;
1247                 }
1248         case PF_PACKET:
1249                 return SECCLASS_PACKET_SOCKET;
1250         case PF_KEY:
1251                 return SECCLASS_KEY_SOCKET;
1252         case PF_APPLETALK:
1253                 return SECCLASS_APPLETALK_SOCKET;
1254         }
1255
1256         return SECCLASS_SOCKET;
1257 }
1258
1259 static int selinux_genfs_get_sid(struct dentry *dentry,
1260                                  u16 tclass,
1261                                  u16 flags,
1262                                  u32 *sid)
1263 {
1264         int rc;
1265         struct super_block *sb = dentry->d_inode->i_sb;
1266         char *buffer, *path;
1267
1268         buffer = (char *)__get_free_page(GFP_KERNEL);
1269         if (!buffer)
1270                 return -ENOMEM;
1271
1272         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1273         if (IS_ERR(path))
1274                 rc = PTR_ERR(path);
1275         else {
1276                 if (flags & SE_SBPROC) {
1277                         /* each process gets a /proc/PID/ entry. Strip off the
1278                          * PID part to get a valid selinux labeling.
1279                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1280                         while (path[1] >= '0' && path[1] <= '9') {
1281                                 path[1] = '/';
1282                                 path++;
1283                         }
1284                 }
1285                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1286         }
1287         free_page((unsigned long)buffer);
1288         return rc;
1289 }
1290
1291 /* The inode's security attributes must be initialized before first use. */
1292 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1293 {
1294         struct superblock_security_struct *sbsec = NULL;
1295         struct inode_security_struct *isec = inode->i_security;
1296         u32 sid;
1297         struct dentry *dentry;
1298 #define INITCONTEXTLEN 255
1299         char *context = NULL;
1300         unsigned len = 0;
1301         int rc = 0;
1302
1303         if (isec->initialized)
1304                 goto out;
1305
1306         mutex_lock(&isec->lock);
1307         if (isec->initialized)
1308                 goto out_unlock;
1309
1310         sbsec = inode->i_sb->s_security;
1311         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1312                 /* Defer initialization until selinux_complete_init,
1313                    after the initial policy is loaded and the security
1314                    server is ready to handle calls. */
1315                 spin_lock(&sbsec->isec_lock);
1316                 if (list_empty(&isec->list))
1317                         list_add(&isec->list, &sbsec->isec_head);
1318                 spin_unlock(&sbsec->isec_lock);
1319                 goto out_unlock;
1320         }
1321
1322         switch (sbsec->behavior) {
1323         case SECURITY_FS_USE_NATIVE:
1324                 break;
1325         case SECURITY_FS_USE_XATTR:
1326                 if (!inode->i_op->getxattr) {
1327                         isec->sid = sbsec->def_sid;
1328                         break;
1329                 }
1330
1331                 /* Need a dentry, since the xattr API requires one.
1332                    Life would be simpler if we could just pass the inode. */
1333                 if (opt_dentry) {
1334                         /* Called from d_instantiate or d_splice_alias. */
1335                         dentry = dget(opt_dentry);
1336                 } else {
1337                         /* Called from selinux_complete_init, try to find a dentry. */
1338                         dentry = d_find_alias(inode);
1339                 }
1340                 if (!dentry) {
1341                         /*
1342                          * this is can be hit on boot when a file is accessed
1343                          * before the policy is loaded.  When we load policy we
1344                          * may find inodes that have no dentry on the
1345                          * sbsec->isec_head list.  No reason to complain as these
1346                          * will get fixed up the next time we go through
1347                          * inode_doinit with a dentry, before these inodes could
1348                          * be used again by userspace.
1349                          */
1350                         goto out_unlock;
1351                 }
1352
1353                 len = INITCONTEXTLEN;
1354                 context = kmalloc(len+1, GFP_NOFS);
1355                 if (!context) {
1356                         rc = -ENOMEM;
1357                         dput(dentry);
1358                         goto out_unlock;
1359                 }
1360                 context[len] = '\0';
1361                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1362                                            context, len);
1363                 if (rc == -ERANGE) {
1364                         kfree(context);
1365
1366                         /* Need a larger buffer.  Query for the right size. */
1367                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1368                                                    NULL, 0);
1369                         if (rc < 0) {
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         len = rc;
1374                         context = kmalloc(len+1, GFP_NOFS);
1375                         if (!context) {
1376                                 rc = -ENOMEM;
1377                                 dput(dentry);
1378                                 goto out_unlock;
1379                         }
1380                         context[len] = '\0';
1381                         rc = inode->i_op->getxattr(dentry,
1382                                                    XATTR_NAME_SELINUX,
1383                                                    context, len);
1384                 }
1385                 dput(dentry);
1386                 if (rc < 0) {
1387                         if (rc != -ENODATA) {
1388                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1389                                        "%d for dev=%s ino=%ld\n", __func__,
1390                                        -rc, inode->i_sb->s_id, inode->i_ino);
1391                                 kfree(context);
1392                                 goto out_unlock;
1393                         }
1394                         /* Map ENODATA to the default file SID */
1395                         sid = sbsec->def_sid;
1396                         rc = 0;
1397                 } else {
1398                         rc = security_context_to_sid_default(context, rc, &sid,
1399                                                              sbsec->def_sid,
1400                                                              GFP_NOFS);
1401                         if (rc) {
1402                                 char *dev = inode->i_sb->s_id;
1403                                 unsigned long ino = inode->i_ino;
1404
1405                                 if (rc == -EINVAL) {
1406                                         if (printk_ratelimit())
1407                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1408                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1409                                                         "filesystem in question.\n", ino, dev, context);
1410                                 } else {
1411                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1412                                                "returned %d for dev=%s ino=%ld\n",
1413                                                __func__, context, -rc, dev, ino);
1414                                 }
1415                                 kfree(context);
1416                                 /* Leave with the unlabeled SID */
1417                                 rc = 0;
1418                                 break;
1419                         }
1420                 }
1421                 kfree(context);
1422                 isec->sid = sid;
1423                 break;
1424         case SECURITY_FS_USE_TASK:
1425                 isec->sid = isec->task_sid;
1426                 break;
1427         case SECURITY_FS_USE_TRANS:
1428                 /* Default to the fs SID. */
1429                 isec->sid = sbsec->sid;
1430
1431                 /* Try to obtain a transition SID. */
1432                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1433                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1434                                              isec->sclass, NULL, &sid);
1435                 if (rc)
1436                         goto out_unlock;
1437                 isec->sid = sid;
1438                 break;
1439         case SECURITY_FS_USE_MNTPOINT:
1440                 isec->sid = sbsec->mntpoint_sid;
1441                 break;
1442         default:
1443                 /* Default to the fs superblock SID. */
1444                 isec->sid = sbsec->sid;
1445
1446                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1447                         /* We must have a dentry to determine the label on
1448                          * procfs inodes */
1449                         if (opt_dentry)
1450                                 /* Called from d_instantiate or
1451                                  * d_splice_alias. */
1452                                 dentry = dget(opt_dentry);
1453                         else
1454                                 /* Called from selinux_complete_init, try to
1455                                  * find a dentry. */
1456                                 dentry = d_find_alias(inode);
1457                         /*
1458                          * This can be hit on boot when a file is accessed
1459                          * before the policy is loaded.  When we load policy we
1460                          * may find inodes that have no dentry on the
1461                          * sbsec->isec_head list.  No reason to complain as
1462                          * these will get fixed up the next time we go through
1463                          * inode_doinit() with a dentry, before these inodes
1464                          * could be used again by userspace.
1465                          */
1466                         if (!dentry)
1467                                 goto out_unlock;
1468                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1469                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1470                                                    sbsec->flags, &sid);
1471                         dput(dentry);
1472                         if (rc)
1473                                 goto out_unlock;
1474                         isec->sid = sid;
1475                 }
1476                 break;
1477         }
1478
1479         isec->initialized = 1;
1480
1481 out_unlock:
1482         mutex_unlock(&isec->lock);
1483 out:
1484         if (isec->sclass == SECCLASS_FILE)
1485                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1486         return rc;
1487 }
1488
1489 /* Convert a Linux signal to an access vector. */
1490 static inline u32 signal_to_av(int sig)
1491 {
1492         u32 perm = 0;
1493
1494         switch (sig) {
1495         case SIGCHLD:
1496                 /* Commonly granted from child to parent. */
1497                 perm = PROCESS__SIGCHLD;
1498                 break;
1499         case SIGKILL:
1500                 /* Cannot be caught or ignored */
1501                 perm = PROCESS__SIGKILL;
1502                 break;
1503         case SIGSTOP:
1504                 /* Cannot be caught or ignored */
1505                 perm = PROCESS__SIGSTOP;
1506                 break;
1507         default:
1508                 /* All other signals. */
1509                 perm = PROCESS__SIGNAL;
1510                 break;
1511         }
1512
1513         return perm;
1514 }
1515
1516 /*
1517  * Check permission between a pair of credentials
1518  * fork check, ptrace check, etc.
1519  */
1520 static int cred_has_perm(const struct cred *actor,
1521                          const struct cred *target,
1522                          u32 perms)
1523 {
1524         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1525
1526         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1527 }
1528
1529 /*
1530  * Check permission between a pair of tasks, e.g. signal checks,
1531  * fork check, ptrace check, etc.
1532  * tsk1 is the actor and tsk2 is the target
1533  * - this uses the default subjective creds of tsk1
1534  */
1535 static int task_has_perm(const struct task_struct *tsk1,
1536                          const struct task_struct *tsk2,
1537                          u32 perms)
1538 {
1539         const struct task_security_struct *__tsec1, *__tsec2;
1540         u32 sid1, sid2;
1541
1542         rcu_read_lock();
1543         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1544         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1545         rcu_read_unlock();
1546         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1547 }
1548
1549 /*
1550  * Check permission between current and another task, e.g. signal checks,
1551  * fork check, ptrace check, etc.
1552  * current is the actor and tsk2 is the target
1553  * - this uses current's subjective creds
1554  */
1555 static int current_has_perm(const struct task_struct *tsk,
1556                             u32 perms)
1557 {
1558         u32 sid, tsid;
1559
1560         sid = current_sid();
1561         tsid = task_sid(tsk);
1562         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1563 }
1564
1565 #if CAP_LAST_CAP > 63
1566 #error Fix SELinux to handle capabilities > 63.
1567 #endif
1568
1569 /* Check whether a task is allowed to use a capability. */
1570 static int cred_has_capability(const struct cred *cred,
1571                                int cap, int audit)
1572 {
1573         struct common_audit_data ad;
1574         struct av_decision avd;
1575         u16 sclass;
1576         u32 sid = cred_sid(cred);
1577         u32 av = CAP_TO_MASK(cap);
1578         int rc;
1579
1580         ad.type = LSM_AUDIT_DATA_CAP;
1581         ad.u.cap = cap;
1582
1583         switch (CAP_TO_INDEX(cap)) {
1584         case 0:
1585                 sclass = SECCLASS_CAPABILITY;
1586                 break;
1587         case 1:
1588                 sclass = SECCLASS_CAPABILITY2;
1589                 break;
1590         default:
1591                 printk(KERN_ERR
1592                        "SELinux:  out of range capability %d\n", cap);
1593                 BUG();
1594                 return -EINVAL;
1595         }
1596
1597         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1598         if (audit == SECURITY_CAP_AUDIT) {
1599                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1600                 if (rc2)
1601                         return rc2;
1602         }
1603         return rc;
1604 }
1605
1606 /* Check whether a task is allowed to use a system operation. */
1607 static int task_has_system(struct task_struct *tsk,
1608                            u32 perms)
1609 {
1610         u32 sid = task_sid(tsk);
1611
1612         return avc_has_perm(sid, SECINITSID_KERNEL,
1613                             SECCLASS_SYSTEM, perms, NULL);
1614 }
1615
1616 /* Check whether a task has a particular permission to an inode.
1617    The 'adp' parameter is optional and allows other audit
1618    data to be passed (e.g. the dentry). */
1619 static int inode_has_perm(const struct cred *cred,
1620                           struct inode *inode,
1621                           u32 perms,
1622                           struct common_audit_data *adp)
1623 {
1624         struct inode_security_struct *isec;
1625         u32 sid;
1626
1627         validate_creds(cred);
1628
1629         if (unlikely(IS_PRIVATE(inode)))
1630                 return 0;
1631
1632         sid = cred_sid(cred);
1633         isec = inode->i_security;
1634
1635         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1636 }
1637
1638 /* Same as inode_has_perm, but pass explicit audit data containing
1639    the dentry to help the auditing code to more easily generate the
1640    pathname if needed. */
1641 static inline int dentry_has_perm(const struct cred *cred,
1642                                   struct dentry *dentry,
1643                                   u32 av)
1644 {
1645         struct inode *inode = d_backing_inode(dentry);
1646         struct common_audit_data ad;
1647
1648         ad.type = LSM_AUDIT_DATA_DENTRY;
1649         ad.u.dentry = dentry;
1650         return inode_has_perm(cred, inode, av, &ad);
1651 }
1652
1653 /* Same as inode_has_perm, but pass explicit audit data containing
1654    the path to help the auditing code to more easily generate the
1655    pathname if needed. */
1656 static inline int path_has_perm(const struct cred *cred,
1657                                 const struct path *path,
1658                                 u32 av)
1659 {
1660         struct inode *inode = d_backing_inode(path->dentry);
1661         struct common_audit_data ad;
1662
1663         ad.type = LSM_AUDIT_DATA_PATH;
1664         ad.u.path = *path;
1665         return inode_has_perm(cred, inode, av, &ad);
1666 }
1667
1668 /* Same as path_has_perm, but uses the inode from the file struct. */
1669 static inline int file_path_has_perm(const struct cred *cred,
1670                                      struct file *file,
1671                                      u32 av)
1672 {
1673         struct common_audit_data ad;
1674
1675         ad.type = LSM_AUDIT_DATA_PATH;
1676         ad.u.path = file->f_path;
1677         return inode_has_perm(cred, file_inode(file), av, &ad);
1678 }
1679
1680 /* Check whether a task can use an open file descriptor to
1681    access an inode in a given way.  Check access to the
1682    descriptor itself, and then use dentry_has_perm to
1683    check a particular permission to the file.
1684    Access to the descriptor is implicitly granted if it
1685    has the same SID as the process.  If av is zero, then
1686    access to the file is not checked, e.g. for cases
1687    where only the descriptor is affected like seek. */
1688 static int file_has_perm(const struct cred *cred,
1689                          struct file *file,
1690                          u32 av)
1691 {
1692         struct file_security_struct *fsec = file->f_security;
1693         struct inode *inode = file_inode(file);
1694         struct common_audit_data ad;
1695         u32 sid = cred_sid(cred);
1696         int rc;
1697
1698         ad.type = LSM_AUDIT_DATA_PATH;
1699         ad.u.path = file->f_path;
1700
1701         if (sid != fsec->sid) {
1702                 rc = avc_has_perm(sid, fsec->sid,
1703                                   SECCLASS_FD,
1704                                   FD__USE,
1705                                   &ad);
1706                 if (rc)
1707                         goto out;
1708         }
1709
1710         /* av is zero if only checking access to the descriptor. */
1711         rc = 0;
1712         if (av)
1713                 rc = inode_has_perm(cred, inode, av, &ad);
1714
1715 out:
1716         return rc;
1717 }
1718
1719 /*
1720  * Determine the label for an inode that might be unioned.
1721  */
1722 static int selinux_determine_inode_label(const struct inode *dir,
1723                                          const struct qstr *name,
1724                                          u16 tclass,
1725                                          u32 *_new_isid)
1726 {
1727         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1728         const struct inode_security_struct *dsec = dir->i_security;
1729         const struct task_security_struct *tsec = current_security();
1730
1731         if ((sbsec->flags & SE_SBINITIALIZED) &&
1732             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1733                 *_new_isid = sbsec->mntpoint_sid;
1734         } else if ((sbsec->flags & SBLABEL_MNT) &&
1735                    tsec->create_sid) {
1736                 *_new_isid = tsec->create_sid;
1737         } else {
1738                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1739                                                name, _new_isid);
1740         }
1741
1742         return 0;
1743 }
1744
1745 /* Check whether a task can create a file. */
1746 static int may_create(struct inode *dir,
1747                       struct dentry *dentry,
1748                       u16 tclass)
1749 {
1750         const struct task_security_struct *tsec = current_security();
1751         struct inode_security_struct *dsec;
1752         struct superblock_security_struct *sbsec;
1753         u32 sid, newsid;
1754         struct common_audit_data ad;
1755         int rc;
1756
1757         dsec = dir->i_security;
1758         sbsec = dir->i_sb->s_security;
1759
1760         sid = tsec->sid;
1761
1762         ad.type = LSM_AUDIT_DATA_DENTRY;
1763         ad.u.dentry = dentry;
1764
1765         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1766                           DIR__ADD_NAME | DIR__SEARCH,
1767                           &ad);
1768         if (rc)
1769                 return rc;
1770
1771         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1772                                            &newsid);
1773         if (rc)
1774                 return rc;
1775
1776         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1777         if (rc)
1778                 return rc;
1779
1780         return avc_has_perm(newsid, sbsec->sid,
1781                             SECCLASS_FILESYSTEM,
1782                             FILESYSTEM__ASSOCIATE, &ad);
1783 }
1784
1785 /* Check whether a task can create a key. */
1786 static int may_create_key(u32 ksid,
1787                           struct task_struct *ctx)
1788 {
1789         u32 sid = task_sid(ctx);
1790
1791         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1792 }
1793
1794 #define MAY_LINK        0
1795 #define MAY_UNLINK      1
1796 #define MAY_RMDIR       2
1797
1798 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1799 static int may_link(struct inode *dir,
1800                     struct dentry *dentry,
1801                     int kind)
1802
1803 {
1804         struct inode_security_struct *dsec, *isec;
1805         struct common_audit_data ad;
1806         u32 sid = current_sid();
1807         u32 av;
1808         int rc;
1809
1810         dsec = dir->i_security;
1811         isec = d_backing_inode(dentry)->i_security;
1812
1813         ad.type = LSM_AUDIT_DATA_DENTRY;
1814         ad.u.dentry = dentry;
1815
1816         av = DIR__SEARCH;
1817         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1818         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1819         if (rc)
1820                 return rc;
1821
1822         switch (kind) {
1823         case MAY_LINK:
1824                 av = FILE__LINK;
1825                 break;
1826         case MAY_UNLINK:
1827                 av = FILE__UNLINK;
1828                 break;
1829         case MAY_RMDIR:
1830                 av = DIR__RMDIR;
1831                 break;
1832         default:
1833                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1834                         __func__, kind);
1835                 return 0;
1836         }
1837
1838         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1839         return rc;
1840 }
1841
1842 static inline int may_rename(struct inode *old_dir,
1843                              struct dentry *old_dentry,
1844                              struct inode *new_dir,
1845                              struct dentry *new_dentry)
1846 {
1847         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1848         struct common_audit_data ad;
1849         u32 sid = current_sid();
1850         u32 av;
1851         int old_is_dir, new_is_dir;
1852         int rc;
1853
1854         old_dsec = old_dir->i_security;
1855         old_isec = d_backing_inode(old_dentry)->i_security;
1856         old_is_dir = d_is_dir(old_dentry);
1857         new_dsec = new_dir->i_security;
1858
1859         ad.type = LSM_AUDIT_DATA_DENTRY;
1860
1861         ad.u.dentry = old_dentry;
1862         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1863                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1864         if (rc)
1865                 return rc;
1866         rc = avc_has_perm(sid, old_isec->sid,
1867                           old_isec->sclass, FILE__RENAME, &ad);
1868         if (rc)
1869                 return rc;
1870         if (old_is_dir && new_dir != old_dir) {
1871                 rc = avc_has_perm(sid, old_isec->sid,
1872                                   old_isec->sclass, DIR__REPARENT, &ad);
1873                 if (rc)
1874                         return rc;
1875         }
1876
1877         ad.u.dentry = new_dentry;
1878         av = DIR__ADD_NAME | DIR__SEARCH;
1879         if (d_is_positive(new_dentry))
1880                 av |= DIR__REMOVE_NAME;
1881         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1882         if (rc)
1883                 return rc;
1884         if (d_is_positive(new_dentry)) {
1885                 new_isec = d_backing_inode(new_dentry)->i_security;
1886                 new_is_dir = d_is_dir(new_dentry);
1887                 rc = avc_has_perm(sid, new_isec->sid,
1888                                   new_isec->sclass,
1889                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1890                 if (rc)
1891                         return rc;
1892         }
1893
1894         return 0;
1895 }
1896
1897 /* Check whether a task can perform a filesystem operation. */
1898 static int superblock_has_perm(const struct cred *cred,
1899                                struct super_block *sb,
1900                                u32 perms,
1901                                struct common_audit_data *ad)
1902 {
1903         struct superblock_security_struct *sbsec;
1904         u32 sid = cred_sid(cred);
1905
1906         sbsec = sb->s_security;
1907         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1908 }
1909
1910 /* Convert a Linux mode and permission mask to an access vector. */
1911 static inline u32 file_mask_to_av(int mode, int mask)
1912 {
1913         u32 av = 0;
1914
1915         if (!S_ISDIR(mode)) {
1916                 if (mask & MAY_EXEC)
1917                         av |= FILE__EXECUTE;
1918                 if (mask & MAY_READ)
1919                         av |= FILE__READ;
1920
1921                 if (mask & MAY_APPEND)
1922                         av |= FILE__APPEND;
1923                 else if (mask & MAY_WRITE)
1924                         av |= FILE__WRITE;
1925
1926         } else {
1927                 if (mask & MAY_EXEC)
1928                         av |= DIR__SEARCH;
1929                 if (mask & MAY_WRITE)
1930                         av |= DIR__WRITE;
1931                 if (mask & MAY_READ)
1932                         av |= DIR__READ;
1933         }
1934
1935         return av;
1936 }
1937
1938 /* Convert a Linux file to an access vector. */
1939 static inline u32 file_to_av(struct file *file)
1940 {
1941         u32 av = 0;
1942
1943         if (file->f_mode & FMODE_READ)
1944                 av |= FILE__READ;
1945         if (file->f_mode & FMODE_WRITE) {
1946                 if (file->f_flags & O_APPEND)
1947                         av |= FILE__APPEND;
1948                 else
1949                         av |= FILE__WRITE;
1950         }
1951         if (!av) {
1952                 /*
1953                  * Special file opened with flags 3 for ioctl-only use.
1954                  */
1955                 av = FILE__IOCTL;
1956         }
1957
1958         return av;
1959 }
1960
1961 /*
1962  * Convert a file to an access vector and include the correct open
1963  * open permission.
1964  */
1965 static inline u32 open_file_to_av(struct file *file)
1966 {
1967         u32 av = file_to_av(file);
1968
1969         if (selinux_policycap_openperm)
1970                 av |= FILE__OPEN;
1971
1972         return av;
1973 }
1974
1975 /* Hook functions begin here. */
1976
1977 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1978 {
1979         u32 mysid = current_sid();
1980         u32 mgrsid = task_sid(mgr);
1981
1982         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1983                             BINDER__SET_CONTEXT_MGR, NULL);
1984 }
1985
1986 static int selinux_binder_transaction(struct task_struct *from,
1987                                       struct task_struct *to)
1988 {
1989         u32 mysid = current_sid();
1990         u32 fromsid = task_sid(from);
1991         u32 tosid = task_sid(to);
1992         int rc;
1993
1994         if (mysid != fromsid) {
1995                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1996                                   BINDER__IMPERSONATE, NULL);
1997                 if (rc)
1998                         return rc;
1999         }
2000
2001         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
2002                             NULL);
2003 }
2004
2005 static int selinux_binder_transfer_binder(struct task_struct *from,
2006                                           struct task_struct *to)
2007 {
2008         u32 fromsid = task_sid(from);
2009         u32 tosid = task_sid(to);
2010
2011         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2012                             NULL);
2013 }
2014
2015 static int selinux_binder_transfer_file(struct task_struct *from,
2016                                         struct task_struct *to,
2017                                         struct file *file)
2018 {
2019         u32 sid = task_sid(to);
2020         struct file_security_struct *fsec = file->f_security;
2021         struct inode *inode = d_backing_inode(file->f_path.dentry);
2022         struct inode_security_struct *isec = inode->i_security;
2023         struct common_audit_data ad;
2024         int rc;
2025
2026         ad.type = LSM_AUDIT_DATA_PATH;
2027         ad.u.path = file->f_path;
2028
2029         if (sid != fsec->sid) {
2030                 rc = avc_has_perm(sid, fsec->sid,
2031                                   SECCLASS_FD,
2032                                   FD__USE,
2033                                   &ad);
2034                 if (rc)
2035                         return rc;
2036         }
2037
2038         if (unlikely(IS_PRIVATE(inode)))
2039                 return 0;
2040
2041         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2042                             &ad);
2043 }
2044
2045 static int selinux_ptrace_access_check(struct task_struct *child,
2046                                      unsigned int mode)
2047 {
2048         if (mode & PTRACE_MODE_READ) {
2049                 u32 sid = current_sid();
2050                 u32 csid = task_sid(child);
2051                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2052         }
2053
2054         return current_has_perm(child, PROCESS__PTRACE);
2055 }
2056
2057 static int selinux_ptrace_traceme(struct task_struct *parent)
2058 {
2059         return task_has_perm(parent, current, PROCESS__PTRACE);
2060 }
2061
2062 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2063                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2064 {
2065         return current_has_perm(target, PROCESS__GETCAP);
2066 }
2067
2068 static int selinux_capset(struct cred *new, const struct cred *old,
2069                           const kernel_cap_t *effective,
2070                           const kernel_cap_t *inheritable,
2071                           const kernel_cap_t *permitted)
2072 {
2073         return cred_has_perm(old, new, PROCESS__SETCAP);
2074 }
2075
2076 /*
2077  * (This comment used to live with the selinux_task_setuid hook,
2078  * which was removed).
2079  *
2080  * Since setuid only affects the current process, and since the SELinux
2081  * controls are not based on the Linux identity attributes, SELinux does not
2082  * need to control this operation.  However, SELinux does control the use of
2083  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2084  */
2085
2086 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2087                            int cap, int audit)
2088 {
2089         return cred_has_capability(cred, cap, audit);
2090 }
2091
2092 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2093 {
2094         const struct cred *cred = current_cred();
2095         int rc = 0;
2096
2097         if (!sb)
2098                 return 0;
2099
2100         switch (cmds) {
2101         case Q_SYNC:
2102         case Q_QUOTAON:
2103         case Q_QUOTAOFF:
2104         case Q_SETINFO:
2105         case Q_SETQUOTA:
2106                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2107                 break;
2108         case Q_GETFMT:
2109         case Q_GETINFO:
2110         case Q_GETQUOTA:
2111                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2112                 break;
2113         default:
2114                 rc = 0;  /* let the kernel handle invalid cmds */
2115                 break;
2116         }
2117         return rc;
2118 }
2119
2120 static int selinux_quota_on(struct dentry *dentry)
2121 {
2122         const struct cred *cred = current_cred();
2123
2124         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2125 }
2126
2127 static int selinux_syslog(int type)
2128 {
2129         int rc;
2130
2131         switch (type) {
2132         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2133         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2134                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2135                 break;
2136         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2137         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2138         /* Set level of messages printed to console */
2139         case SYSLOG_ACTION_CONSOLE_LEVEL:
2140                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2141                 break;
2142         case SYSLOG_ACTION_CLOSE:       /* Close log */
2143         case SYSLOG_ACTION_OPEN:        /* Open log */
2144         case SYSLOG_ACTION_READ:        /* Read from log */
2145         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2146         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2147         default:
2148                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2149                 break;
2150         }
2151         return rc;
2152 }
2153
2154 /*
2155  * Check that a process has enough memory to allocate a new virtual
2156  * mapping. 0 means there is enough memory for the allocation to
2157  * succeed and -ENOMEM implies there is not.
2158  *
2159  * Do not audit the selinux permission check, as this is applied to all
2160  * processes that allocate mappings.
2161  */
2162 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2163 {
2164         int rc, cap_sys_admin = 0;
2165
2166         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2167                                         SECURITY_CAP_NOAUDIT);
2168         if (rc == 0)
2169                 cap_sys_admin = 1;
2170
2171         return cap_sys_admin;
2172 }
2173
2174 /* binprm security operations */
2175
2176 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2177                             const struct task_security_struct *old_tsec,
2178                             const struct task_security_struct *new_tsec)
2179 {
2180         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2181         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2182         int rc;
2183
2184         if (!nnp && !nosuid)
2185                 return 0; /* neither NNP nor nosuid */
2186
2187         if (new_tsec->sid == old_tsec->sid)
2188                 return 0; /* No change in credentials */
2189
2190         /*
2191          * The only transitions we permit under NNP or nosuid
2192          * are transitions to bounded SIDs, i.e. SIDs that are
2193          * guaranteed to only be allowed a subset of the permissions
2194          * of the current SID.
2195          */
2196         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2197         if (rc) {
2198                 /*
2199                  * On failure, preserve the errno values for NNP vs nosuid.
2200                  * NNP:  Operation not permitted for caller.
2201                  * nosuid:  Permission denied to file.
2202                  */
2203                 if (nnp)
2204                         return -EPERM;
2205                 else
2206                         return -EACCES;
2207         }
2208         return 0;
2209 }
2210
2211 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2212 {
2213         const struct task_security_struct *old_tsec;
2214         struct task_security_struct *new_tsec;
2215         struct inode_security_struct *isec;
2216         struct common_audit_data ad;
2217         struct inode *inode = file_inode(bprm->file);
2218         int rc;
2219
2220         /* SELinux context only depends on initial program or script and not
2221          * the script interpreter */
2222         if (bprm->cred_prepared)
2223                 return 0;
2224
2225         old_tsec = current_security();
2226         new_tsec = bprm->cred->security;
2227         isec = inode->i_security;
2228
2229         /* Default to the current task SID. */
2230         new_tsec->sid = old_tsec->sid;
2231         new_tsec->osid = old_tsec->sid;
2232
2233         /* Reset fs, key, and sock SIDs on execve. */
2234         new_tsec->create_sid = 0;
2235         new_tsec->keycreate_sid = 0;
2236         new_tsec->sockcreate_sid = 0;
2237
2238         if (old_tsec->exec_sid) {
2239                 new_tsec->sid = old_tsec->exec_sid;
2240                 /* Reset exec SID on execve. */
2241                 new_tsec->exec_sid = 0;
2242
2243                 /* Fail on NNP or nosuid if not an allowed transition. */
2244                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2245                 if (rc)
2246                         return rc;
2247         } else {
2248                 /* Check for a default transition on this program. */
2249                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2250                                              SECCLASS_PROCESS, NULL,
2251                                              &new_tsec->sid);
2252                 if (rc)
2253                         return rc;
2254
2255                 /*
2256                  * Fallback to old SID on NNP or nosuid if not an allowed
2257                  * transition.
2258                  */
2259                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2260                 if (rc)
2261                         new_tsec->sid = old_tsec->sid;
2262         }
2263
2264         ad.type = LSM_AUDIT_DATA_PATH;
2265         ad.u.path = bprm->file->f_path;
2266
2267         if (new_tsec->sid == old_tsec->sid) {
2268                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2269                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2270                 if (rc)
2271                         return rc;
2272         } else {
2273                 /* Check permissions for the transition. */
2274                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2275                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2276                 if (rc)
2277                         return rc;
2278
2279                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2280                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2281                 if (rc)
2282                         return rc;
2283
2284                 /* Check for shared state */
2285                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2286                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2287                                           SECCLASS_PROCESS, PROCESS__SHARE,
2288                                           NULL);
2289                         if (rc)
2290                                 return -EPERM;
2291                 }
2292
2293                 /* Make sure that anyone attempting to ptrace over a task that
2294                  * changes its SID has the appropriate permit */
2295                 if (bprm->unsafe &
2296                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2297                         struct task_struct *tracer;
2298                         struct task_security_struct *sec;
2299                         u32 ptsid = 0;
2300
2301                         rcu_read_lock();
2302                         tracer = ptrace_parent(current);
2303                         if (likely(tracer != NULL)) {
2304                                 sec = __task_cred(tracer)->security;
2305                                 ptsid = sec->sid;
2306                         }
2307                         rcu_read_unlock();
2308
2309                         if (ptsid != 0) {
2310                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2311                                                   SECCLASS_PROCESS,
2312                                                   PROCESS__PTRACE, NULL);
2313                                 if (rc)
2314                                         return -EPERM;
2315                         }
2316                 }
2317
2318                 /* Clear any possibly unsafe personality bits on exec: */
2319                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2320         }
2321
2322         return 0;
2323 }
2324
2325 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2326 {
2327         const struct task_security_struct *tsec = current_security();
2328         u32 sid, osid;
2329         int atsecure = 0;
2330
2331         sid = tsec->sid;
2332         osid = tsec->osid;
2333
2334         if (osid != sid) {
2335                 /* Enable secure mode for SIDs transitions unless
2336                    the noatsecure permission is granted between
2337                    the two SIDs, i.e. ahp returns 0. */
2338                 atsecure = avc_has_perm(osid, sid,
2339                                         SECCLASS_PROCESS,
2340                                         PROCESS__NOATSECURE, NULL);
2341         }
2342
2343         return !!atsecure;
2344 }
2345
2346 static int match_file(const void *p, struct file *file, unsigned fd)
2347 {
2348         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2349 }
2350
2351 /* Derived from fs/exec.c:flush_old_files. */
2352 static inline void flush_unauthorized_files(const struct cred *cred,
2353                                             struct files_struct *files)
2354 {
2355         struct file *file, *devnull = NULL;
2356         struct tty_struct *tty;
2357         int drop_tty = 0;
2358         unsigned n;
2359
2360         tty = get_current_tty();
2361         if (tty) {
2362                 spin_lock(&tty_files_lock);
2363                 if (!list_empty(&tty->tty_files)) {
2364                         struct tty_file_private *file_priv;
2365
2366                         /* Revalidate access to controlling tty.
2367                            Use file_path_has_perm on the tty path directly
2368                            rather than using file_has_perm, as this particular
2369                            open file may belong to another process and we are
2370                            only interested in the inode-based check here. */
2371                         file_priv = list_first_entry(&tty->tty_files,
2372                                                 struct tty_file_private, list);
2373                         file = file_priv->file;
2374                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2375                                 drop_tty = 1;
2376                 }
2377                 spin_unlock(&tty_files_lock);
2378                 tty_kref_put(tty);
2379         }
2380         /* Reset controlling tty. */
2381         if (drop_tty)
2382                 no_tty();
2383
2384         /* Revalidate access to inherited open files. */
2385         n = iterate_fd(files, 0, match_file, cred);
2386         if (!n) /* none found? */
2387                 return;
2388
2389         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2390         if (IS_ERR(devnull))
2391                 devnull = NULL;
2392         /* replace all the matching ones with this */
2393         do {
2394                 replace_fd(n - 1, devnull, 0);
2395         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2396         if (devnull)
2397                 fput(devnull);
2398 }
2399
2400 /*
2401  * Prepare a process for imminent new credential changes due to exec
2402  */
2403 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2404 {
2405         struct task_security_struct *new_tsec;
2406         struct rlimit *rlim, *initrlim;
2407         int rc, i;
2408
2409         new_tsec = bprm->cred->security;
2410         if (new_tsec->sid == new_tsec->osid)
2411                 return;
2412
2413         /* Close files for which the new task SID is not authorized. */
2414         flush_unauthorized_files(bprm->cred, current->files);
2415
2416         /* Always clear parent death signal on SID transitions. */
2417         current->pdeath_signal = 0;
2418
2419         /* Check whether the new SID can inherit resource limits from the old
2420          * SID.  If not, reset all soft limits to the lower of the current
2421          * task's hard limit and the init task's soft limit.
2422          *
2423          * Note that the setting of hard limits (even to lower them) can be
2424          * controlled by the setrlimit check.  The inclusion of the init task's
2425          * soft limit into the computation is to avoid resetting soft limits
2426          * higher than the default soft limit for cases where the default is
2427          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2428          */
2429         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2430                           PROCESS__RLIMITINH, NULL);
2431         if (rc) {
2432                 /* protect against do_prlimit() */
2433                 task_lock(current);
2434                 for (i = 0; i < RLIM_NLIMITS; i++) {
2435                         rlim = current->signal->rlim + i;
2436                         initrlim = init_task.signal->rlim + i;
2437                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2438                 }
2439                 task_unlock(current);
2440                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2441         }
2442 }
2443
2444 /*
2445  * Clean up the process immediately after the installation of new credentials
2446  * due to exec
2447  */
2448 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2449 {
2450         const struct task_security_struct *tsec = current_security();
2451         struct itimerval itimer;
2452         u32 osid, sid;
2453         int rc, i;
2454
2455         osid = tsec->osid;
2456         sid = tsec->sid;
2457
2458         if (sid == osid)
2459                 return;
2460
2461         /* Check whether the new SID can inherit signal state from the old SID.
2462          * If not, clear itimers to avoid subsequent signal generation and
2463          * flush and unblock signals.
2464          *
2465          * This must occur _after_ the task SID has been updated so that any
2466          * kill done after the flush will be checked against the new SID.
2467          */
2468         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2469         if (rc) {
2470                 memset(&itimer, 0, sizeof itimer);
2471                 for (i = 0; i < 3; i++)
2472                         do_setitimer(i, &itimer, NULL);
2473                 spin_lock_irq(&current->sighand->siglock);
2474                 if (!fatal_signal_pending(current)) {
2475                         flush_sigqueue(&current->pending);
2476                         flush_sigqueue(&current->signal->shared_pending);
2477                         flush_signal_handlers(current, 1);
2478                         sigemptyset(&current->blocked);
2479                         recalc_sigpending();
2480                 }
2481                 spin_unlock_irq(&current->sighand->siglock);
2482         }
2483
2484         /* Wake up the parent if it is waiting so that it can recheck
2485          * wait permission to the new task SID. */
2486         read_lock(&tasklist_lock);
2487         __wake_up_parent(current, current->real_parent);
2488         read_unlock(&tasklist_lock);
2489 }
2490
2491 /* superblock security operations */
2492
2493 static int selinux_sb_alloc_security(struct super_block *sb)
2494 {
2495         return superblock_alloc_security(sb);
2496 }
2497
2498 static void selinux_sb_free_security(struct super_block *sb)
2499 {
2500         superblock_free_security(sb);
2501 }
2502
2503 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2504 {
2505         if (plen > olen)
2506                 return 0;
2507
2508         return !memcmp(prefix, option, plen);
2509 }
2510
2511 static inline int selinux_option(char *option, int len)
2512 {
2513         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2514                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2515                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2516                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2517                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2518 }
2519
2520 static inline void take_option(char **to, char *from, int *first, int len)
2521 {
2522         if (!*first) {
2523                 **to = ',';
2524                 *to += 1;
2525         } else
2526                 *first = 0;
2527         memcpy(*to, from, len);
2528         *to += len;
2529 }
2530
2531 static inline void take_selinux_option(char **to, char *from, int *first,
2532                                        int len)
2533 {
2534         int current_size = 0;
2535
2536         if (!*first) {
2537                 **to = '|';
2538                 *to += 1;
2539         } else
2540                 *first = 0;
2541
2542         while (current_size < len) {
2543                 if (*from != '"') {
2544                         **to = *from;
2545                         *to += 1;
2546                 }
2547                 from += 1;
2548                 current_size += 1;
2549         }
2550 }
2551
2552 static int selinux_sb_copy_data(char *orig, char *copy)
2553 {
2554         int fnosec, fsec, rc = 0;
2555         char *in_save, *in_curr, *in_end;
2556         char *sec_curr, *nosec_save, *nosec;
2557         int open_quote = 0;
2558
2559         in_curr = orig;
2560         sec_curr = copy;
2561
2562         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2563         if (!nosec) {
2564                 rc = -ENOMEM;
2565                 goto out;
2566         }
2567
2568         nosec_save = nosec;
2569         fnosec = fsec = 1;
2570         in_save = in_end = orig;
2571
2572         do {
2573                 if (*in_end == '"')
2574                         open_quote = !open_quote;
2575                 if ((*in_end == ',' && open_quote == 0) ||
2576                                 *in_end == '\0') {
2577                         int len = in_end - in_curr;
2578
2579                         if (selinux_option(in_curr, len))
2580                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2581                         else
2582                                 take_option(&nosec, in_curr, &fnosec, len);
2583
2584                         in_curr = in_end + 1;
2585                 }
2586         } while (*in_end++);
2587
2588         strcpy(in_save, nosec_save);
2589         free_page((unsigned long)nosec_save);
2590 out:
2591         return rc;
2592 }
2593
2594 static int selinux_sb_remount(struct super_block *sb, void *data)
2595 {
2596         int rc, i, *flags;
2597         struct security_mnt_opts opts;
2598         char *secdata, **mount_options;
2599         struct superblock_security_struct *sbsec = sb->s_security;
2600
2601         if (!(sbsec->flags & SE_SBINITIALIZED))
2602                 return 0;
2603
2604         if (!data)
2605                 return 0;
2606
2607         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2608                 return 0;
2609
2610         security_init_mnt_opts(&opts);
2611         secdata = alloc_secdata();
2612         if (!secdata)
2613                 return -ENOMEM;
2614         rc = selinux_sb_copy_data(data, secdata);
2615         if (rc)
2616                 goto out_free_secdata;
2617
2618         rc = selinux_parse_opts_str(secdata, &opts);
2619         if (rc)
2620                 goto out_free_secdata;
2621
2622         mount_options = opts.mnt_opts;
2623         flags = opts.mnt_opts_flags;
2624
2625         for (i = 0; i < opts.num_mnt_opts; i++) {
2626                 u32 sid;
2627
2628                 if (flags[i] == SBLABEL_MNT)
2629                         continue;
2630                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2631                 if (rc) {
2632                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2633                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2634                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2635                         goto out_free_opts;
2636                 }
2637                 rc = -EINVAL;
2638                 switch (flags[i]) {
2639                 case FSCONTEXT_MNT:
2640                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2641                                 goto out_bad_option;
2642                         break;
2643                 case CONTEXT_MNT:
2644                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2645                                 goto out_bad_option;
2646                         break;
2647                 case ROOTCONTEXT_MNT: {
2648                         struct inode_security_struct *root_isec;
2649                         root_isec = d_backing_inode(sb->s_root)->i_security;
2650
2651                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2652                                 goto out_bad_option;
2653                         break;
2654                 }
2655                 case DEFCONTEXT_MNT:
2656                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2657                                 goto out_bad_option;
2658                         break;
2659                 default:
2660                         goto out_free_opts;
2661                 }
2662         }
2663
2664         rc = 0;
2665 out_free_opts:
2666         security_free_mnt_opts(&opts);
2667 out_free_secdata:
2668         free_secdata(secdata);
2669         return rc;
2670 out_bad_option:
2671         printk(KERN_WARNING "SELinux: unable to change security options "
2672                "during remount (dev %s, type=%s)\n", sb->s_id,
2673                sb->s_type->name);
2674         goto out_free_opts;
2675 }
2676
2677 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2678 {
2679         const struct cred *cred = current_cred();
2680         struct common_audit_data ad;
2681         int rc;
2682
2683         rc = superblock_doinit(sb, data);
2684         if (rc)
2685                 return rc;
2686
2687         /* Allow all mounts performed by the kernel */
2688         if (flags & MS_KERNMOUNT)
2689                 return 0;
2690
2691         ad.type = LSM_AUDIT_DATA_DENTRY;
2692         ad.u.dentry = sb->s_root;
2693         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2694 }
2695
2696 static int selinux_sb_statfs(struct dentry *dentry)
2697 {
2698         const struct cred *cred = current_cred();
2699         struct common_audit_data ad;
2700
2701         ad.type = LSM_AUDIT_DATA_DENTRY;
2702         ad.u.dentry = dentry->d_sb->s_root;
2703         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2704 }
2705
2706 static int selinux_mount(const char *dev_name,
2707                          struct path *path,
2708                          const char *type,
2709                          unsigned long flags,
2710                          void *data)
2711 {
2712         const struct cred *cred = current_cred();
2713
2714         if (flags & MS_REMOUNT)
2715                 return superblock_has_perm(cred, path->dentry->d_sb,
2716                                            FILESYSTEM__REMOUNT, NULL);
2717         else
2718                 return path_has_perm(cred, path, FILE__MOUNTON);
2719 }
2720
2721 static int selinux_umount(struct vfsmount *mnt, int flags)
2722 {
2723         const struct cred *cred = current_cred();
2724
2725         return superblock_has_perm(cred, mnt->mnt_sb,
2726                                    FILESYSTEM__UNMOUNT, NULL);
2727 }
2728
2729 /* inode security operations */
2730
2731 static int selinux_inode_alloc_security(struct inode *inode)
2732 {
2733         return inode_alloc_security(inode);
2734 }
2735
2736 static void selinux_inode_free_security(struct inode *inode)
2737 {
2738         inode_free_security(inode);
2739 }
2740
2741 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2742                                         struct qstr *name, void **ctx,
2743                                         u32 *ctxlen)
2744 {
2745         u32 newsid;
2746         int rc;
2747
2748         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2749                                            inode_mode_to_security_class(mode),
2750                                            &newsid);
2751         if (rc)
2752                 return rc;
2753
2754         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2755 }
2756
2757 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758                                        const struct qstr *qstr,
2759                                        const char **name,
2760                                        void **value, size_t *len)
2761 {
2762         const struct task_security_struct *tsec = current_security();
2763         struct inode_security_struct *dsec;
2764         struct superblock_security_struct *sbsec;
2765         u32 sid, newsid, clen;
2766         int rc;
2767         char *context;
2768
2769         dsec = dir->i_security;
2770         sbsec = dir->i_sb->s_security;
2771
2772         sid = tsec->sid;
2773         newsid = tsec->create_sid;
2774
2775         rc = selinux_determine_inode_label(
2776                 dir, qstr,
2777                 inode_mode_to_security_class(inode->i_mode),
2778                 &newsid);
2779         if (rc)
2780                 return rc;
2781
2782         /* Possibly defer initialization to selinux_complete_init. */
2783         if (sbsec->flags & SE_SBINITIALIZED) {
2784                 struct inode_security_struct *isec = inode->i_security;
2785                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2786                 isec->sid = newsid;
2787                 isec->initialized = 1;
2788         }
2789
2790         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2791                 return -EOPNOTSUPP;
2792
2793         if (name)
2794                 *name = XATTR_SELINUX_SUFFIX;
2795
2796         if (value && len) {
2797                 rc = security_sid_to_context_force(newsid, &context, &clen);
2798                 if (rc)
2799                         return rc;
2800                 *value = context;
2801                 *len = clen;
2802         }
2803
2804         return 0;
2805 }
2806
2807 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2808 {
2809         return may_create(dir, dentry, SECCLASS_FILE);
2810 }
2811
2812 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2813 {
2814         return may_link(dir, old_dentry, MAY_LINK);
2815 }
2816
2817 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2818 {
2819         return may_link(dir, dentry, MAY_UNLINK);
2820 }
2821
2822 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2823 {
2824         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2825 }
2826
2827 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2828 {
2829         return may_create(dir, dentry, SECCLASS_DIR);
2830 }
2831
2832 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2833 {
2834         return may_link(dir, dentry, MAY_RMDIR);
2835 }
2836
2837 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2838 {
2839         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2840 }
2841
2842 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2843                                 struct inode *new_inode, struct dentry *new_dentry)
2844 {
2845         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2846 }
2847
2848 static int selinux_inode_readlink(struct dentry *dentry)
2849 {
2850         const struct cred *cred = current_cred();
2851
2852         return dentry_has_perm(cred, dentry, FILE__READ);
2853 }
2854
2855 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2856                                      bool rcu)
2857 {
2858         const struct cred *cred = current_cred();
2859         struct common_audit_data ad;
2860         struct inode_security_struct *isec;
2861         u32 sid;
2862
2863         validate_creds(cred);
2864
2865         ad.type = LSM_AUDIT_DATA_DENTRY;
2866         ad.u.dentry = dentry;
2867         sid = cred_sid(cred);
2868         isec = inode->i_security;
2869
2870         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2871                                   rcu ? MAY_NOT_BLOCK : 0);
2872 }
2873
2874 static noinline int audit_inode_permission(struct inode *inode,
2875                                            u32 perms, u32 audited, u32 denied,
2876                                            int result,
2877                                            unsigned flags)
2878 {
2879         struct common_audit_data ad;
2880         struct inode_security_struct *isec = inode->i_security;
2881         int rc;
2882
2883         ad.type = LSM_AUDIT_DATA_INODE;
2884         ad.u.inode = inode;
2885
2886         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2887                             audited, denied, result, &ad, flags);
2888         if (rc)
2889                 return rc;
2890         return 0;
2891 }
2892
2893 static int selinux_inode_permission(struct inode *inode, int mask)
2894 {
2895         const struct cred *cred = current_cred();
2896         u32 perms;
2897         bool from_access;
2898         unsigned flags = mask & MAY_NOT_BLOCK;
2899         struct inode_security_struct *isec;
2900         u32 sid;
2901         struct av_decision avd;
2902         int rc, rc2;
2903         u32 audited, denied;
2904
2905         from_access = mask & MAY_ACCESS;
2906         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2907
2908         /* No permission to check.  Existence test. */
2909         if (!mask)
2910                 return 0;
2911
2912         validate_creds(cred);
2913
2914         if (unlikely(IS_PRIVATE(inode)))
2915                 return 0;
2916
2917         perms = file_mask_to_av(inode->i_mode, mask);
2918
2919         sid = cred_sid(cred);
2920         isec = inode->i_security;
2921
2922         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2923         audited = avc_audit_required(perms, &avd, rc,
2924                                      from_access ? FILE__AUDIT_ACCESS : 0,
2925                                      &denied);
2926         if (likely(!audited))
2927                 return rc;
2928
2929         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2930         if (rc2)
2931                 return rc2;
2932         return rc;
2933 }
2934
2935 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2936 {
2937         const struct cred *cred = current_cred();
2938         unsigned int ia_valid = iattr->ia_valid;
2939         __u32 av = FILE__WRITE;
2940
2941         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2942         if (ia_valid & ATTR_FORCE) {
2943                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2944                               ATTR_FORCE);
2945                 if (!ia_valid)
2946                         return 0;
2947         }
2948
2949         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2950                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2951                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2952
2953         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2954                         && !(ia_valid & ATTR_FILE))
2955                 av |= FILE__OPEN;
2956
2957         return dentry_has_perm(cred, dentry, av);
2958 }
2959
2960 static int selinux_inode_getattr(const struct path *path)
2961 {
2962         return path_has_perm(current_cred(), path, FILE__GETATTR);
2963 }
2964
2965 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2966 {
2967         const struct cred *cred = current_cred();
2968
2969         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2970                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2971                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2972                         if (!capable(CAP_SETFCAP))
2973                                 return -EPERM;
2974                 } else if (!capable(CAP_SYS_ADMIN)) {
2975                         /* A different attribute in the security namespace.
2976                            Restrict to administrator. */
2977                         return -EPERM;
2978                 }
2979         }
2980
2981         /* Not an attribute we recognize, so just check the
2982            ordinary setattr permission. */
2983         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2984 }
2985
2986 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2987                                   const void *value, size_t size, int flags)
2988 {
2989         struct inode *inode = d_backing_inode(dentry);
2990         struct inode_security_struct *isec = inode->i_security;
2991         struct superblock_security_struct *sbsec;
2992         struct common_audit_data ad;
2993         u32 newsid, sid = current_sid();
2994         int rc = 0;
2995
2996         if (strcmp(name, XATTR_NAME_SELINUX))
2997                 return selinux_inode_setotherxattr(dentry, name);
2998
2999         sbsec = inode->i_sb->s_security;
3000         if (!(sbsec->flags & SBLABEL_MNT))
3001                 return -EOPNOTSUPP;
3002
3003         if (!inode_owner_or_capable(inode))
3004                 return -EPERM;
3005
3006         ad.type = LSM_AUDIT_DATA_DENTRY;
3007         ad.u.dentry = dentry;
3008
3009         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3010                           FILE__RELABELFROM, &ad);
3011         if (rc)
3012                 return rc;
3013
3014         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3015         if (rc == -EINVAL) {
3016                 if (!capable(CAP_MAC_ADMIN)) {
3017                         struct audit_buffer *ab;
3018                         size_t audit_size;
3019                         const char *str;
3020
3021                         /* We strip a nul only if it is at the end, otherwise the
3022                          * context contains a nul and we should audit that */
3023                         if (value) {
3024                                 str = value;
3025                                 if (str[size - 1] == '\0')
3026                                         audit_size = size - 1;
3027                                 else
3028                                         audit_size = size;
3029                         } else {
3030                                 str = "";
3031                                 audit_size = 0;
3032                         }
3033                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3034                         audit_log_format(ab, "op=setxattr invalid_context=");
3035                         audit_log_n_untrustedstring(ab, value, audit_size);
3036                         audit_log_end(ab);
3037
3038                         return rc;
3039                 }
3040                 rc = security_context_to_sid_force(value, size, &newsid);
3041         }
3042         if (rc)
3043                 return rc;
3044
3045         rc = avc_has_perm(sid, newsid, isec->sclass,
3046                           FILE__RELABELTO, &ad);
3047         if (rc)
3048                 return rc;
3049
3050         rc = security_validate_transition(isec->sid, newsid, sid,
3051                                           isec->sclass);
3052         if (rc)
3053                 return rc;
3054
3055         return avc_has_perm(newsid,
3056                             sbsec->sid,
3057                             SECCLASS_FILESYSTEM,
3058                             FILESYSTEM__ASSOCIATE,
3059                             &ad);
3060 }
3061
3062 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3063                                         const void *value, size_t size,
3064                                         int flags)
3065 {
3066         struct inode *inode = d_backing_inode(dentry);
3067         struct inode_security_struct *isec = inode->i_security;
3068         u32 newsid;
3069         int rc;
3070
3071         if (strcmp(name, XATTR_NAME_SELINUX)) {
3072                 /* Not an attribute we recognize, so nothing to do. */
3073                 return;
3074         }
3075
3076         rc = security_context_to_sid_force(value, size, &newsid);
3077         if (rc) {
3078                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3079                        "for (%s, %lu), rc=%d\n",
3080                        inode->i_sb->s_id, inode->i_ino, -rc);
3081                 return;
3082         }
3083
3084         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3085         isec->sid = newsid;
3086         isec->initialized = 1;
3087
3088         return;
3089 }
3090
3091 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3092 {
3093         const struct cred *cred = current_cred();
3094
3095         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3096 }
3097
3098 static int selinux_inode_listxattr(struct dentry *dentry)
3099 {
3100         const struct cred *cred = current_cred();
3101
3102         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3103 }
3104
3105 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3106 {
3107         if (strcmp(name, XATTR_NAME_SELINUX))
3108                 return selinux_inode_setotherxattr(dentry, name);
3109
3110         /* No one is allowed to remove a SELinux security label.
3111            You can change the label, but all data must be labeled. */
3112         return -EACCES;
3113 }
3114
3115 /*
3116  * Copy the inode security context value to the user.
3117  *
3118  * Permission check is handled by selinux_inode_getxattr hook.
3119  */
3120 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3121 {
3122         u32 size;
3123         int error;
3124         char *context = NULL;
3125         struct inode_security_struct *isec = inode->i_security;
3126
3127         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3128                 return -EOPNOTSUPP;
3129
3130         /*
3131          * If the caller has CAP_MAC_ADMIN, then get the raw context
3132          * value even if it is not defined by current policy; otherwise,
3133          * use the in-core value under current policy.
3134          * Use the non-auditing forms of the permission checks since
3135          * getxattr may be called by unprivileged processes commonly
3136          * and lack of permission just means that we fall back to the
3137          * in-core context value, not a denial.
3138          */
3139         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3140                             SECURITY_CAP_NOAUDIT);
3141         if (!error)
3142                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3143                                             SECURITY_CAP_NOAUDIT);
3144         if (!error)
3145                 error = security_sid_to_context_force(isec->sid, &context,
3146                                                       &size);
3147         else
3148                 error = security_sid_to_context(isec->sid, &context, &size);
3149         if (error)
3150                 return error;
3151         error = size;
3152         if (alloc) {
3153                 *buffer = context;
3154                 goto out_nofree;
3155         }
3156         kfree(context);
3157 out_nofree:
3158         return error;
3159 }
3160
3161 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3162                                      const void *value, size_t size, int flags)
3163 {
3164         struct inode_security_struct *isec = inode->i_security;
3165         u32 newsid;
3166         int rc;
3167
3168         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3169                 return -EOPNOTSUPP;
3170
3171         if (!value || !size)
3172                 return -EACCES;
3173
3174         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3175         if (rc)
3176                 return rc;
3177
3178         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3179         isec->sid = newsid;
3180         isec->initialized = 1;
3181         return 0;
3182 }
3183
3184 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3185 {
3186         const int len = sizeof(XATTR_NAME_SELINUX);
3187         if (buffer && len <= buffer_size)
3188                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3189         return len;
3190 }
3191
3192 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3193 {
3194         struct inode_security_struct *isec = inode->i_security;
3195         *secid = isec->sid;
3196 }
3197
3198 /* file security operations */
3199
3200 static int selinux_revalidate_file_permission(struct file *file, int mask)
3201 {
3202         const struct cred *cred = current_cred();
3203         struct inode *inode = file_inode(file);
3204
3205         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3206         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3207                 mask |= MAY_APPEND;
3208
3209         return file_has_perm(cred, file,
3210                              file_mask_to_av(inode->i_mode, mask));
3211 }
3212
3213 static int selinux_file_permission(struct file *file, int mask)
3214 {
3215         struct inode *inode = file_inode(file);
3216         struct file_security_struct *fsec = file->f_security;
3217         struct inode_security_struct *isec = inode->i_security;
3218         u32 sid = current_sid();
3219
3220         if (!mask)
3221                 /* No permission to check.  Existence test. */
3222                 return 0;
3223
3224         if (sid == fsec->sid && fsec->isid == isec->sid &&
3225             fsec->pseqno == avc_policy_seqno())
3226                 /* No change since file_open check. */
3227                 return 0;
3228
3229         return selinux_revalidate_file_permission(file, mask);
3230 }
3231
3232 static int selinux_file_alloc_security(struct file *file)
3233 {
3234         return file_alloc_security(file);
3235 }
3236
3237 static void selinux_file_free_security(struct file *file)
3238 {
3239         file_free_security(file);
3240 }
3241
3242 /*
3243  * Check whether a task has the ioctl permission and cmd
3244  * operation to an inode.
3245  */
3246 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3247                 u32 requested, u16 cmd)
3248 {
3249         struct common_audit_data ad;
3250         struct file_security_struct *fsec = file->f_security;
3251         struct inode *inode = file_inode(file);
3252         struct inode_security_struct *isec = inode->i_security;
3253         struct lsm_ioctlop_audit ioctl;
3254         u32 ssid = cred_sid(cred);
3255         int rc;
3256         u8 driver = cmd >> 8;
3257         u8 xperm = cmd & 0xff;
3258
3259         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3260         ad.u.op = &ioctl;
3261         ad.u.op->cmd = cmd;
3262         ad.u.op->path = file->f_path;
3263
3264         if (ssid != fsec->sid) {
3265                 rc = avc_has_perm(ssid, fsec->sid,
3266                                 SECCLASS_FD,
3267                                 FD__USE,
3268                                 &ad);
3269                 if (rc)
3270                         goto out;
3271         }
3272
3273         if (unlikely(IS_PRIVATE(inode)))
3274                 return 0;
3275
3276         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3277                         requested, driver, xperm, &ad);
3278 out:
3279         return rc;
3280 }
3281
3282 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3283                               unsigned long arg)
3284 {
3285         const struct cred *cred = current_cred();
3286         int error = 0;
3287
3288         switch (cmd) {
3289         case FIONREAD:
3290         /* fall through */
3291         case FIBMAP:
3292         /* fall through */
3293         case FIGETBSZ:
3294         /* fall through */
3295         case FS_IOC_GETFLAGS:
3296         /* fall through */
3297         case FS_IOC_GETVERSION:
3298                 error = file_has_perm(cred, file, FILE__GETATTR);
3299                 break;
3300
3301         case FS_IOC_SETFLAGS:
3302         /* fall through */
3303         case FS_IOC_SETVERSION:
3304                 error = file_has_perm(cred, file, FILE__SETATTR);
3305                 break;
3306
3307         /* sys_ioctl() checks */
3308         case FIONBIO:
3309         /* fall through */
3310         case FIOASYNC:
3311                 error = file_has_perm(cred, file, 0);
3312                 break;
3313
3314         case KDSKBENT:
3315         case KDSKBSENT:
3316                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3317                                             SECURITY_CAP_AUDIT);
3318                 break;
3319
3320         /* default case assumes that the command will go
3321          * to the file's ioctl() function.
3322          */
3323         default:
3324                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3325         }
3326         return error;
3327 }
3328
3329 static int default_noexec;
3330
3331 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3332 {
3333         const struct cred *cred = current_cred();
3334         int rc = 0;
3335
3336         if (default_noexec &&
3337             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3338                                    (!shared && (prot & PROT_WRITE)))) {
3339                 /*
3340                  * We are making executable an anonymous mapping or a
3341                  * private file mapping that will also be writable.
3342                  * This has an additional check.
3343                  */
3344                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3345                 if (rc)
3346                         goto error;
3347         }
3348
3349         if (file) {
3350                 /* read access is always possible with a mapping */
3351                 u32 av = FILE__READ;
3352
3353                 /* write access only matters if the mapping is shared */
3354                 if (shared && (prot & PROT_WRITE))
3355                         av |= FILE__WRITE;
3356
3357                 if (prot & PROT_EXEC)
3358                         av |= FILE__EXECUTE;
3359
3360                 return file_has_perm(cred, file, av);
3361         }
3362
3363 error:
3364         return rc;
3365 }
3366
3367 static int selinux_mmap_addr(unsigned long addr)
3368 {
3369         int rc = 0;
3370
3371         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3372                 u32 sid = current_sid();
3373                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3374                                   MEMPROTECT__MMAP_ZERO, NULL);
3375         }
3376
3377         return rc;
3378 }
3379
3380 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3381                              unsigned long prot, unsigned long flags)
3382 {
3383         if (selinux_checkreqprot)
3384                 prot = reqprot;
3385
3386         return file_map_prot_check(file, prot,
3387                                    (flags & MAP_TYPE) == MAP_SHARED);
3388 }
3389
3390 static int selinux_file_mprotect(struct vm_area_struct *vma,
3391                                  unsigned long reqprot,
3392                                  unsigned long prot)
3393 {
3394         const struct cred *cred = current_cred();
3395
3396         if (selinux_checkreqprot)
3397                 prot = reqprot;
3398
3399         if (default_noexec &&
3400             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3401                 int rc = 0;
3402                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3403                     vma->vm_end <= vma->vm_mm->brk) {
3404                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3405                 } else if (!vma->vm_file &&
3406                            vma->vm_start <= vma->vm_mm->start_stack &&
3407                            vma->vm_end >= vma->vm_mm->start_stack) {
3408                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3409                 } else if (vma->vm_file && vma->anon_vma) {
3410                         /*
3411                          * We are making executable a file mapping that has
3412                          * had some COW done. Since pages might have been
3413                          * written, check ability to execute the possibly
3414                          * modified content.  This typically should only
3415                          * occur for text relocations.
3416                          */
3417                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3418                 }
3419                 if (rc)
3420                         return rc;
3421         }
3422
3423         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3424 }
3425
3426 static int selinux_file_lock(struct file *file, unsigned int cmd)
3427 {
3428         const struct cred *cred = current_cred();
3429
3430         return file_has_perm(cred, file, FILE__LOCK);
3431 }
3432
3433 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3434                               unsigned long arg)
3435 {
3436         const struct cred *cred = current_cred();
3437         int err = 0;
3438
3439         switch (cmd) {
3440         case F_SETFL:
3441                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3442                         err = file_has_perm(cred, file, FILE__WRITE);
3443                         break;
3444                 }
3445                 /* fall through */
3446         case F_SETOWN:
3447         case F_SETSIG:
3448         case F_GETFL:
3449         case F_GETOWN:
3450         case F_GETSIG:
3451         case F_GETOWNER_UIDS:
3452                 /* Just check FD__USE permission */
3453                 err = file_has_perm(cred, file, 0);
3454                 break;
3455         case F_GETLK:
3456         case F_SETLK:
3457         case F_SETLKW:
3458         case F_OFD_GETLK:
3459         case F_OFD_SETLK:
3460         case F_OFD_SETLKW:
3461 #if BITS_PER_LONG == 32
3462         case F_GETLK64:
3463         case F_SETLK64:
3464         case F_SETLKW64:
3465 #endif
3466                 err = file_has_perm(cred, file, FILE__LOCK);
3467                 break;
3468         }
3469
3470         return err;
3471 }
3472
3473 static void selinux_file_set_fowner(struct file *file)
3474 {
3475         struct file_security_struct *fsec;
3476
3477         fsec = file->f_security;
3478         fsec->fown_sid = current_sid();
3479 }
3480
3481 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3482                                        struct fown_struct *fown, int signum)
3483 {
3484         struct file *file;
3485         u32 sid = task_sid(tsk);
3486         u32 perm;
3487         struct file_security_struct *fsec;
3488
3489         /* struct fown_struct is never outside the context of a struct file */
3490         file = container_of(fown, struct file, f_owner);
3491
3492         fsec = file->f_security;
3493
3494         if (!signum)
3495                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3496         else
3497                 perm = signal_to_av(signum);
3498
3499         return avc_has_perm(fsec->fown_sid, sid,
3500                             SECCLASS_PROCESS, perm, NULL);
3501 }
3502
3503 static int selinux_file_receive(struct file *file)
3504 {
3505         const struct cred *cred = current_cred();
3506
3507         return file_has_perm(cred, file, file_to_av(file));
3508 }
3509
3510 static int selinux_file_open(struct file *file, const struct cred *cred)
3511 {
3512         struct file_security_struct *fsec;
3513         struct inode_security_struct *isec;
3514
3515         fsec = file->f_security;
3516         isec = file_inode(file)->i_security;
3517         /*
3518          * Save inode label and policy sequence number
3519          * at open-time so that selinux_file_permission
3520          * can determine whether revalidation is necessary.
3521          * Task label is already saved in the file security
3522          * struct as its SID.
3523          */
3524         fsec->isid = isec->sid;
3525         fsec->pseqno = avc_policy_seqno();
3526         /*
3527          * Since the inode label or policy seqno may have changed
3528          * between the selinux_inode_permission check and the saving
3529          * of state above, recheck that access is still permitted.
3530          * Otherwise, access might never be revalidated against the
3531          * new inode label or new policy.
3532          * This check is not redundant - do not remove.
3533          */
3534         return file_path_has_perm(cred, file, open_file_to_av(file));
3535 }
3536
3537 /* task security operations */
3538
3539 static int selinux_task_create(unsigned long clone_flags)
3540 {
3541         return current_has_perm(current, PROCESS__FORK);
3542 }
3543
3544 /*
3545  * allocate the SELinux part of blank credentials
3546  */
3547 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3548 {
3549         struct task_security_struct *tsec;
3550
3551         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3552         if (!tsec)
3553                 return -ENOMEM;
3554
3555         cred->security = tsec;
3556         return 0;
3557 }
3558
3559 /*
3560  * detach and free the LSM part of a set of credentials
3561  */
3562 static void selinux_cred_free(struct cred *cred)
3563 {
3564         struct task_security_struct *tsec = cred->security;
3565
3566         /*
3567          * cred->security == NULL if security_cred_alloc_blank() or
3568          * security_prepare_creds() returned an error.
3569          */
3570         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3571         cred->security = (void *) 0x7UL;
3572         kfree(tsec);
3573 }
3574
3575 /*
3576  * prepare a new set of credentials for modification
3577  */
3578 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3579                                 gfp_t gfp)
3580 {
3581         const struct task_security_struct *old_tsec;
3582         struct task_security_struct *tsec;
3583
3584         old_tsec = old->security;
3585
3586         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3587         if (!tsec)
3588                 return -ENOMEM;
3589
3590         new->security = tsec;
3591         return 0;
3592 }
3593
3594 /*
3595  * transfer the SELinux data to a blank set of creds
3596  */
3597 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3598 {
3599         const struct task_security_struct *old_tsec = old->security;
3600         struct task_security_struct *tsec = new->security;
3601
3602         *tsec = *old_tsec;
3603 }
3604
3605 /*
3606  * set the security data for a kernel service
3607  * - all the creation contexts are set to unlabelled
3608  */
3609 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3610 {
3611         struct task_security_struct *tsec = new->security;
3612         u32 sid = current_sid();
3613         int ret;
3614
3615         ret = avc_has_perm(sid, secid,
3616                            SECCLASS_KERNEL_SERVICE,
3617                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3618                            NULL);
3619         if (ret == 0) {
3620                 tsec->sid = secid;
3621                 tsec->create_sid = 0;
3622                 tsec->keycreate_sid = 0;
3623                 tsec->sockcreate_sid = 0;
3624         }
3625         return ret;
3626 }
3627
3628 /*
3629  * set the file creation context in a security record to the same as the
3630  * objective context of the specified inode
3631  */
3632 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3633 {
3634         struct inode_security_struct *isec = inode->i_security;
3635         struct task_security_struct *tsec = new->security;
3636         u32 sid = current_sid();
3637         int ret;
3638
3639         ret = avc_has_perm(sid, isec->sid,
3640                            SECCLASS_KERNEL_SERVICE,
3641                            KERNEL_SERVICE__CREATE_FILES_AS,
3642                            NULL);
3643
3644         if (ret == 0)
3645                 tsec->create_sid = isec->sid;
3646         return ret;
3647 }
3648
3649 static int selinux_kernel_module_request(char *kmod_name)
3650 {
3651         u32 sid;
3652         struct common_audit_data ad;
3653
3654         sid = task_sid(current);
3655
3656         ad.type = LSM_AUDIT_DATA_KMOD;
3657         ad.u.kmod_name = kmod_name;
3658
3659         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3660                             SYSTEM__MODULE_REQUEST, &ad);
3661 }
3662
3663 static int selinux_kernel_module_from_file(struct file *file)
3664 {
3665         struct common_audit_data ad;
3666         struct inode_security_struct *isec;
3667         struct file_security_struct *fsec;
3668         struct inode *inode;
3669         u32 sid = current_sid();
3670         int rc;
3671
3672         /* init_module */
3673         if (file == NULL)
3674                 return avc_has_perm(sid, sid, SECCLASS_SYSTEM,
3675                                         SYSTEM__MODULE_LOAD, NULL);
3676
3677         /* finit_module */
3678         ad.type = LSM_AUDIT_DATA_PATH;
3679         ad.u.path = file->f_path;
3680
3681         inode = file_inode(file);
3682         isec = inode->i_security;
3683         fsec = file->f_security;
3684
3685         if (sid != fsec->sid) {
3686                 rc = avc_has_perm(sid, fsec->sid, SECCLASS_FD, FD__USE, &ad);
3687                 if (rc)
3688                         return rc;
3689         }
3690
3691         return avc_has_perm(sid, isec->sid, SECCLASS_SYSTEM,
3692                                 SYSTEM__MODULE_LOAD, &ad);
3693 }
3694
3695 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3696 {
3697         return current_has_perm(p, PROCESS__SETPGID);
3698 }
3699
3700 static int selinux_task_getpgid(struct task_struct *p)
3701 {
3702         return current_has_perm(p, PROCESS__GETPGID);
3703 }
3704
3705 static int selinux_task_getsid(struct task_struct *p)
3706 {
3707         return current_has_perm(p, PROCESS__GETSESSION);
3708 }
3709
3710 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3711 {
3712         *secid = task_sid(p);
3713 }
3714
3715 static int selinux_task_setnice(struct task_struct *p, int nice)
3716 {
3717         return current_has_perm(p, PROCESS__SETSCHED);
3718 }
3719
3720 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3721 {
3722         return current_has_perm(p, PROCESS__SETSCHED);
3723 }
3724
3725 static int selinux_task_getioprio(struct task_struct *p)
3726 {
3727         return current_has_perm(p, PROCESS__GETSCHED);
3728 }
3729
3730 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3731                 struct rlimit *new_rlim)
3732 {
3733         struct rlimit *old_rlim = p->signal->rlim + resource;
3734
3735         /* Control the ability to change the hard limit (whether
3736            lowering or raising it), so that the hard limit can
3737            later be used as a safe reset point for the soft limit
3738            upon context transitions.  See selinux_bprm_committing_creds. */
3739         if (old_rlim->rlim_max != new_rlim->rlim_max)
3740                 return current_has_perm(p, PROCESS__SETRLIMIT);
3741
3742         return 0;
3743 }
3744
3745 static int selinux_task_setscheduler(struct task_struct *p)
3746 {
3747         return current_has_perm(p, PROCESS__SETSCHED);
3748 }
3749
3750 static int selinux_task_getscheduler(struct task_struct *p)
3751 {
3752         return current_has_perm(p, PROCESS__GETSCHED);
3753 }
3754
3755 static int selinux_task_movememory(struct task_struct *p)
3756 {
3757         return current_has_perm(p, PROCESS__SETSCHED);
3758 }
3759
3760 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3761                                 int sig, u32 secid)
3762 {
3763         u32 perm;
3764         int rc;
3765
3766         if (!sig)
3767                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3768         else
3769                 perm = signal_to_av(sig);
3770         if (secid)
3771                 rc = avc_has_perm(secid, task_sid(p),
3772                                   SECCLASS_PROCESS, perm, NULL);
3773         else
3774                 rc = current_has_perm(p, perm);
3775         return rc;
3776 }
3777
3778 static int selinux_task_wait(struct task_struct *p)
3779 {
3780         return task_has_perm(p, current, PROCESS__SIGCHLD);
3781 }
3782
3783 static void selinux_task_to_inode(struct task_struct *p,
3784                                   struct inode *inode)
3785 {
3786         struct inode_security_struct *isec = inode->i_security;
3787         u32 sid = task_sid(p);
3788
3789         isec->sid = sid;
3790         isec->initialized = 1;
3791 }
3792
3793 /* Returns error only if unable to parse addresses */
3794 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3795                         struct common_audit_data *ad, u8 *proto)
3796 {
3797         int offset, ihlen, ret = -EINVAL;
3798         struct iphdr _iph, *ih;
3799
3800         offset = skb_network_offset(skb);
3801         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3802         if (ih == NULL)
3803                 goto out;
3804
3805         ihlen = ih->ihl * 4;
3806         if (ihlen < sizeof(_iph))
3807                 goto out;
3808
3809         ad->u.net->v4info.saddr = ih->saddr;
3810         ad->u.net->v4info.daddr = ih->daddr;
3811         ret = 0;
3812
3813         if (proto)
3814                 *proto = ih->protocol;
3815
3816         switch (ih->protocol) {
3817         case IPPROTO_TCP: {
3818                 struct tcphdr _tcph, *th;
3819
3820                 if (ntohs(ih->frag_off) & IP_OFFSET)
3821                         break;
3822
3823                 offset += ihlen;
3824                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3825                 if (th == NULL)
3826                         break;
3827
3828                 ad->u.net->sport = th->source;
3829                 ad->u.net->dport = th->dest;
3830                 break;
3831         }
3832
3833         case IPPROTO_UDP: {
3834                 struct udphdr _udph, *uh;
3835
3836                 if (ntohs(ih->frag_off) & IP_OFFSET)
3837                         break;
3838
3839                 offset += ihlen;
3840                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3841                 if (uh == NULL)
3842                         break;
3843
3844                 ad->u.net->sport = uh->source;
3845                 ad->u.net->dport = uh->dest;
3846                 break;
3847         }
3848
3849         case IPPROTO_DCCP: {
3850                 struct dccp_hdr _dccph, *dh;
3851
3852                 if (ntohs(ih->frag_off) & IP_OFFSET)
3853                         break;
3854
3855                 offset += ihlen;
3856                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3857                 if (dh == NULL)
3858                         break;
3859
3860                 ad->u.net->sport = dh->dccph_sport;
3861                 ad->u.net->dport = dh->dccph_dport;
3862                 break;
3863         }
3864
3865         default:
3866                 break;
3867         }
3868 out:
3869         return ret;
3870 }
3871
3872 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3873
3874 /* Returns error only if unable to parse addresses */
3875 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3876                         struct common_audit_data *ad, u8 *proto)
3877 {
3878         u8 nexthdr;
3879         int ret = -EINVAL, offset;
3880         struct ipv6hdr _ipv6h, *ip6;
3881         __be16 frag_off;
3882
3883         offset = skb_network_offset(skb);
3884         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3885         if (ip6 == NULL)
3886                 goto out;
3887
3888         ad->u.net->v6info.saddr = ip6->saddr;
3889         ad->u.net->v6info.daddr = ip6->daddr;
3890         ret = 0;
3891
3892         nexthdr = ip6->nexthdr;
3893         offset += sizeof(_ipv6h);
3894         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3895         if (offset < 0)
3896                 goto out;
3897
3898         if (proto)
3899                 *proto = nexthdr;
3900
3901         switch (nexthdr) {
3902         case IPPROTO_TCP: {
3903                 struct tcphdr _tcph, *th;
3904
3905                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3906                 if (th == NULL)
3907                         break;
3908
3909                 ad->u.net->sport = th->source;
3910                 ad->u.net->dport = th->dest;
3911                 break;
3912         }
3913
3914         case IPPROTO_UDP: {
3915                 struct udphdr _udph, *uh;
3916
3917                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3918                 if (uh == NULL)
3919                         break;
3920
3921                 ad->u.net->sport = uh->source;
3922                 ad->u.net->dport = uh->dest;
3923                 break;
3924         }
3925
3926         case IPPROTO_DCCP: {
3927                 struct dccp_hdr _dccph, *dh;
3928
3929                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3930                 if (dh == NULL)
3931                         break;
3932
3933                 ad->u.net->sport = dh->dccph_sport;
3934                 ad->u.net->dport = dh->dccph_dport;
3935                 break;
3936         }
3937
3938         /* includes fragments */
3939         default:
3940                 break;
3941         }
3942 out:
3943         return ret;
3944 }
3945
3946 #endif /* IPV6 */
3947
3948 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3949                              char **_addrp, int src, u8 *proto)
3950 {
3951         char *addrp;
3952         int ret;
3953
3954         switch (ad->u.net->family) {
3955         case PF_INET:
3956                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3957                 if (ret)
3958                         goto parse_error;
3959                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3960                                        &ad->u.net->v4info.daddr);
3961                 goto okay;
3962
3963 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3964         case PF_INET6:
3965                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3966                 if (ret)
3967                         goto parse_error;
3968                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3969                                        &ad->u.net->v6info.daddr);
3970                 goto okay;
3971 #endif  /* IPV6 */
3972         default:
3973                 addrp = NULL;
3974                 goto okay;
3975         }
3976
3977 parse_error:
3978         printk(KERN_WARNING
3979                "SELinux: failure in selinux_parse_skb(),"
3980                " unable to parse packet\n");
3981         return ret;
3982
3983 okay:
3984         if (_addrp)
3985                 *_addrp = addrp;
3986         return 0;
3987 }
3988
3989 /**
3990  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3991  * @skb: the packet
3992  * @family: protocol family
3993  * @sid: the packet's peer label SID
3994  *
3995  * Description:
3996  * Check the various different forms of network peer labeling and determine
3997  * the peer label/SID for the packet; most of the magic actually occurs in
3998  * the security server function security_net_peersid_cmp().  The function
3999  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
4000  * or -EACCES if @sid is invalid due to inconsistencies with the different
4001  * peer labels.
4002  *
4003  */
4004 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
4005 {
4006         int err;
4007         u32 xfrm_sid;
4008         u32 nlbl_sid;
4009         u32 nlbl_type;
4010
4011         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
4012         if (unlikely(err))
4013                 return -EACCES;
4014         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
4015         if (unlikely(err))
4016                 return -EACCES;
4017
4018         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
4019         if (unlikely(err)) {
4020                 printk(KERN_WARNING
4021                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
4022                        " unable to determine packet's peer label\n");
4023                 return -EACCES;
4024         }
4025
4026         return 0;
4027 }
4028
4029 /**
4030  * selinux_conn_sid - Determine the child socket label for a connection
4031  * @sk_sid: the parent socket's SID
4032  * @skb_sid: the packet's SID
4033  * @conn_sid: the resulting connection SID
4034  *
4035  * If @skb_sid is valid then the user:role:type information from @sk_sid is
4036  * combined with the MLS information from @skb_sid in order to create
4037  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4038  * of @sk_sid.  Returns zero on success, negative values on failure.
4039  *
4040  */
4041 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4042 {
4043         int err = 0;
4044
4045         if (skb_sid != SECSID_NULL)
4046                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4047         else
4048                 *conn_sid = sk_sid;
4049
4050         return err;
4051 }
4052
4053 /* socket security operations */
4054
4055 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4056                                  u16 secclass, u32 *socksid)
4057 {
4058         if (tsec->sockcreate_sid > SECSID_NULL) {
4059                 *socksid = tsec->sockcreate_sid;
4060                 return 0;
4061         }
4062
4063         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4064                                        socksid);
4065 }
4066
4067 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4068 {
4069         struct sk_security_struct *sksec = sk->sk_security;
4070         struct common_audit_data ad;
4071         struct lsm_network_audit net = {0,};
4072         u32 tsid = task_sid(task);
4073
4074         if (sksec->sid == SECINITSID_KERNEL)
4075                 return 0;
4076
4077         ad.type = LSM_AUDIT_DATA_NET;
4078         ad.u.net = &net;
4079         ad.u.net->sk = sk;
4080
4081         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4082 }
4083
4084 static int selinux_socket_create(int family, int type,
4085                                  int protocol, int kern)
4086 {
4087         const struct task_security_struct *tsec = current_security();
4088         u32 newsid;
4089         u16 secclass;
4090         int rc;
4091
4092         if (kern)
4093                 return 0;
4094
4095         secclass = socket_type_to_security_class(family, type, protocol);
4096         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4097         if (rc)
4098                 return rc;
4099
4100         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4101 }
4102
4103 static int selinux_socket_post_create(struct socket *sock, int family,
4104                                       int type, int protocol, int kern)
4105 {
4106         const struct task_security_struct *tsec = current_security();
4107         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4108         struct sk_security_struct *sksec;
4109         int err = 0;
4110
4111         isec->sclass = socket_type_to_security_class(family, type, protocol);
4112
4113         if (kern)
4114                 isec->sid = SECINITSID_KERNEL;
4115         else {
4116                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4117                 if (err)
4118                         return err;
4119         }
4120
4121         isec->initialized = 1;
4122
4123         if (sock->sk) {
4124                 sksec = sock->sk->sk_security;
4125                 sksec->sid = isec->sid;
4126                 sksec->sclass = isec->sclass;
4127                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4128         }
4129
4130         return err;
4131 }
4132
4133 /* Range of port numbers used to automatically bind.
4134    Need to determine whether we should perform a name_bind
4135    permission check between the socket and the port number. */
4136
4137 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4138 {
4139         struct sock *sk = sock->sk;
4140         u16 family;
4141         int err;
4142
4143         err = sock_has_perm(current, sk, SOCKET__BIND);
4144         if (err)
4145                 goto out;
4146
4147         /*
4148          * If PF_INET or PF_INET6, check name_bind permission for the port.
4149          * Multiple address binding for SCTP is not supported yet: we just
4150          * check the first address now.
4151          */
4152         family = sk->sk_family;
4153         if (family == PF_INET || family == PF_INET6) {
4154                 char *addrp;
4155                 struct sk_security_struct *sksec = sk->sk_security;
4156                 struct common_audit_data ad;
4157                 struct lsm_network_audit net = {0,};
4158                 struct sockaddr_in *addr4 = NULL;
4159                 struct sockaddr_in6 *addr6 = NULL;
4160                 unsigned short snum;
4161                 u32 sid, node_perm;
4162
4163                 if (family == PF_INET) {
4164                         addr4 = (struct sockaddr_in *)address;
4165                         snum = ntohs(addr4->sin_port);
4166                         addrp = (char *)&addr4->sin_addr.s_addr;
4167                 } else {
4168                         addr6 = (struct sockaddr_in6 *)address;
4169                         snum = ntohs(addr6->sin6_port);
4170                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4171                 }
4172
4173                 if (snum) {
4174                         int low, high;
4175
4176                         inet_get_local_port_range(sock_net(sk), &low, &high);
4177
4178                         if (snum < max(PROT_SOCK, low) || snum > high) {
4179                                 err = sel_netport_sid(sk->sk_protocol,
4180                                                       snum, &sid);
4181                                 if (err)
4182                                         goto out;
4183                                 ad.type = LSM_AUDIT_DATA_NET;
4184                                 ad.u.net = &net;
4185                                 ad.u.net->sport = htons(snum);
4186                                 ad.u.net->family = family;
4187                                 err = avc_has_perm(sksec->sid, sid,
4188                                                    sksec->sclass,
4189                                                    SOCKET__NAME_BIND, &ad);
4190                                 if (err)
4191                                         goto out;
4192                         }
4193                 }
4194
4195                 switch (sksec->sclass) {
4196                 case SECCLASS_TCP_SOCKET:
4197                         node_perm = TCP_SOCKET__NODE_BIND;
4198                         break;
4199
4200                 case SECCLASS_UDP_SOCKET:
4201                         node_perm = UDP_SOCKET__NODE_BIND;
4202                         break;
4203
4204                 case SECCLASS_DCCP_SOCKET:
4205                         node_perm = DCCP_SOCKET__NODE_BIND;
4206                         break;
4207
4208                 default:
4209                         node_perm = RAWIP_SOCKET__NODE_BIND;
4210                         break;
4211                 }
4212
4213                 err = sel_netnode_sid(addrp, family, &sid);
4214                 if (err)
4215                         goto out;
4216
4217                 ad.type = LSM_AUDIT_DATA_NET;
4218                 ad.u.net = &net;
4219                 ad.u.net->sport = htons(snum);
4220                 ad.u.net->family = family;
4221
4222                 if (family == PF_INET)
4223                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4224                 else
4225                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4226
4227                 err = avc_has_perm(sksec->sid, sid,
4228                                    sksec->sclass, node_perm, &ad);
4229                 if (err)
4230                         goto out;
4231         }
4232 out:
4233         return err;
4234 }
4235
4236 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4237 {
4238         struct sock *sk = sock->sk;
4239         struct sk_security_struct *sksec = sk->sk_security;
4240         int err;
4241
4242         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4243         if (err)
4244                 return err;
4245
4246         /*
4247          * If a TCP or DCCP socket, check name_connect permission for the port.
4248          */
4249         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4250             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4251                 struct common_audit_data ad;
4252                 struct lsm_network_audit net = {0,};
4253                 struct sockaddr_in *addr4 = NULL;
4254                 struct sockaddr_in6 *addr6 = NULL;
4255                 unsigned short snum;
4256                 u32 sid, perm;
4257
4258                 if (sk->sk_family == PF_INET) {
4259                         addr4 = (struct sockaddr_in *)address;
4260                         if (addrlen < sizeof(struct sockaddr_in))
4261                                 return -EINVAL;
4262                         snum = ntohs(addr4->sin_port);
4263                 } else {
4264                         addr6 = (struct sockaddr_in6 *)address;
4265                         if (addrlen < SIN6_LEN_RFC2133)
4266                                 return -EINVAL;
4267                         snum = ntohs(addr6->sin6_port);
4268                 }
4269
4270                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4271                 if (err)
4272                         goto out;
4273
4274                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4275                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4276
4277                 ad.type = LSM_AUDIT_DATA_NET;
4278                 ad.u.net = &net;
4279                 ad.u.net->dport = htons(snum);
4280                 ad.u.net->family = sk->sk_family;
4281                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4282                 if (err)
4283                         goto out;
4284         }
4285
4286         err = selinux_netlbl_socket_connect(sk, address);
4287
4288 out:
4289         return err;
4290 }
4291
4292 static int selinux_socket_listen(struct socket *sock, int backlog)
4293 {
4294         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4295 }
4296
4297 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4298 {
4299         int err;
4300         struct inode_security_struct *isec;
4301         struct inode_security_struct *newisec;
4302
4303         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4304         if (err)
4305                 return err;
4306
4307         newisec = SOCK_INODE(newsock)->i_security;
4308
4309         isec = SOCK_INODE(sock)->i_security;
4310         newisec->sclass = isec->sclass;
4311         newisec->sid = isec->sid;
4312         newisec->initialized = 1;
4313
4314         return 0;
4315 }
4316
4317 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4318                                   int size)
4319 {
4320         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4321 }
4322
4323 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4324                                   int size, int flags)
4325 {
4326         return sock_has_perm(current, sock->sk, SOCKET__READ);
4327 }
4328
4329 static int selinux_socket_getsockname(struct socket *sock)
4330 {
4331         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4332 }
4333
4334 static int selinux_socket_getpeername(struct socket *sock)
4335 {
4336         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4337 }
4338
4339 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4340 {
4341         int err;
4342
4343         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4344         if (err)
4345                 return err;
4346
4347         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4348 }
4349
4350 static int selinux_socket_getsockopt(struct socket *sock, int level,
4351                                      int optname)
4352 {
4353         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4354 }
4355
4356 static int selinux_socket_shutdown(struct socket *sock, int how)
4357 {
4358         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4359 }
4360
4361 static int selinux_socket_unix_stream_connect(struct sock *sock,
4362                                               struct sock *other,
4363                                               struct sock *newsk)
4364 {
4365         struct sk_security_struct *sksec_sock = sock->sk_security;
4366         struct sk_security_struct *sksec_other = other->sk_security;
4367         struct sk_security_struct *sksec_new = newsk->sk_security;
4368         struct common_audit_data ad;
4369         struct lsm_network_audit net = {0,};
4370         int err;
4371
4372         ad.type = LSM_AUDIT_DATA_NET;
4373         ad.u.net = &net;
4374         ad.u.net->sk = other;
4375
4376         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4377                            sksec_other->sclass,
4378                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4379         if (err)
4380                 return err;
4381
4382         /* server child socket */
4383         sksec_new->peer_sid = sksec_sock->sid;
4384         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4385                                     &sksec_new->sid);
4386         if (err)
4387                 return err;
4388
4389         /* connecting socket */
4390         sksec_sock->peer_sid = sksec_new->sid;
4391
4392         return 0;
4393 }
4394
4395 static int selinux_socket_unix_may_send(struct socket *sock,
4396                                         struct socket *other)
4397 {
4398         struct sk_security_struct *ssec = sock->sk->sk_security;
4399         struct sk_security_struct *osec = other->sk->sk_security;
4400         struct common_audit_data ad;
4401         struct lsm_network_audit net = {0,};
4402
4403         ad.type = LSM_AUDIT_DATA_NET;
4404         ad.u.net = &net;
4405         ad.u.net->sk = other->sk;
4406
4407         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4408                             &ad);
4409 }
4410
4411 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4412                                     char *addrp, u16 family, u32 peer_sid,
4413                                     struct common_audit_data *ad)
4414 {
4415         int err;
4416         u32 if_sid;
4417         u32 node_sid;
4418
4419         err = sel_netif_sid(ns, ifindex, &if_sid);
4420         if (err)
4421                 return err;
4422         err = avc_has_perm(peer_sid, if_sid,
4423                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4424         if (err)
4425                 return err;
4426
4427         err = sel_netnode_sid(addrp, family, &node_sid);
4428         if (err)
4429                 return err;
4430         return avc_has_perm(peer_sid, node_sid,
4431                             SECCLASS_NODE, NODE__RECVFROM, ad);
4432 }
4433
4434 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4435                                        u16 family)
4436 {
4437         int err = 0;
4438         struct sk_security_struct *sksec = sk->sk_security;
4439         u32 sk_sid = sksec->sid;
4440         struct common_audit_data ad;
4441         struct lsm_network_audit net = {0,};
4442         char *addrp;
4443
4444         ad.type = LSM_AUDIT_DATA_NET;
4445         ad.u.net = &net;
4446         ad.u.net->netif = skb->skb_iif;
4447         ad.u.net->family = family;
4448         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4449         if (err)
4450                 return err;
4451
4452         if (selinux_secmark_enabled()) {
4453                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4454                                    PACKET__RECV, &ad);
4455                 if (err)
4456                         return err;
4457         }
4458
4459         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4460         if (err)
4461                 return err;
4462         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4463
4464         return err;
4465 }
4466
4467 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4468 {
4469         int err;
4470         struct sk_security_struct *sksec = sk->sk_security;
4471         u16 family = sk->sk_family;
4472         u32 sk_sid = sksec->sid;
4473         struct common_audit_data ad;
4474         struct lsm_network_audit net = {0,};
4475         char *addrp;
4476         u8 secmark_active;
4477         u8 peerlbl_active;
4478
4479         if (family != PF_INET && family != PF_INET6)
4480                 return 0;
4481
4482         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4483         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4484                 family = PF_INET;
4485
4486         /* If any sort of compatibility mode is enabled then handoff processing
4487          * to the selinux_sock_rcv_skb_compat() function to deal with the
4488          * special handling.  We do this in an attempt to keep this function
4489          * as fast and as clean as possible. */
4490         if (!selinux_policycap_netpeer)
4491                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4492
4493         secmark_active = selinux_secmark_enabled();
4494         peerlbl_active = selinux_peerlbl_enabled();
4495         if (!secmark_active && !peerlbl_active)
4496                 return 0;
4497
4498         ad.type = LSM_AUDIT_DATA_NET;
4499         ad.u.net = &net;
4500         ad.u.net->netif = skb->skb_iif;
4501         ad.u.net->family = family;
4502         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4503         if (err)
4504                 return err;
4505
4506         if (peerlbl_active) {
4507                 u32 peer_sid;
4508
4509                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4510                 if (err)
4511                         return err;
4512                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4513                                                addrp, family, peer_sid, &ad);
4514                 if (err) {
4515                         selinux_netlbl_err(skb, err, 0);
4516                         return err;
4517                 }
4518                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4519                                    PEER__RECV, &ad);
4520                 if (err) {
4521                         selinux_netlbl_err(skb, err, 0);
4522                         return err;
4523                 }
4524         }
4525
4526         if (secmark_active) {
4527                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4528                                    PACKET__RECV, &ad);
4529                 if (err)
4530                         return err;
4531         }
4532
4533         return err;
4534 }
4535
4536 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4537                                             int __user *optlen, unsigned len)
4538 {
4539         int err = 0;
4540         char *scontext;
4541         u32 scontext_len;
4542         struct sk_security_struct *sksec = sock->sk->sk_security;
4543         u32 peer_sid = SECSID_NULL;
4544
4545         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4546             sksec->sclass == SECCLASS_TCP_SOCKET)
4547                 peer_sid = sksec->peer_sid;
4548         if (peer_sid == SECSID_NULL)
4549                 return -ENOPROTOOPT;
4550
4551         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4552         if (err)
4553                 return err;
4554
4555         if (scontext_len > len) {
4556                 err = -ERANGE;
4557                 goto out_len;
4558         }
4559
4560         if (copy_to_user(optval, scontext, scontext_len))
4561                 err = -EFAULT;
4562
4563 out_len:
4564         if (put_user(scontext_len, optlen))
4565                 err = -EFAULT;
4566         kfree(scontext);
4567         return err;
4568 }
4569
4570 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4571 {
4572         u32 peer_secid = SECSID_NULL;
4573         u16 family;
4574
4575         if (skb && skb->protocol == htons(ETH_P_IP))
4576                 family = PF_INET;
4577         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4578                 family = PF_INET6;
4579         else if (sock)
4580                 family = sock->sk->sk_family;
4581         else
4582                 goto out;
4583
4584         if (sock && family == PF_UNIX)
4585                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4586         else if (skb)
4587                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4588
4589 out:
4590         *secid = peer_secid;
4591         if (peer_secid == SECSID_NULL)
4592                 return -EINVAL;
4593         return 0;
4594 }
4595
4596 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4597 {
4598         struct sk_security_struct *sksec;
4599
4600         sksec = kzalloc(sizeof(*sksec), priority);
4601         if (!sksec)
4602                 return -ENOMEM;
4603
4604         sksec->peer_sid = SECINITSID_UNLABELED;
4605         sksec->sid = SECINITSID_UNLABELED;
4606         sksec->sclass = SECCLASS_SOCKET;
4607         selinux_netlbl_sk_security_reset(sksec);
4608         sk->sk_security = sksec;
4609
4610         return 0;
4611 }
4612
4613 static void selinux_sk_free_security(struct sock *sk)
4614 {
4615         struct sk_security_struct *sksec = sk->sk_security;
4616
4617         sk->sk_security = NULL;
4618         selinux_netlbl_sk_security_free(sksec);
4619         kfree(sksec);
4620 }
4621
4622 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4623 {
4624         struct sk_security_struct *sksec = sk->sk_security;
4625         struct sk_security_struct *newsksec = newsk->sk_security;
4626
4627         newsksec->sid = sksec->sid;
4628         newsksec->peer_sid = sksec->peer_sid;
4629         newsksec->sclass = sksec->sclass;
4630
4631         selinux_netlbl_sk_security_reset(newsksec);
4632 }
4633
4634 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4635 {
4636         if (!sk)
4637                 *secid = SECINITSID_ANY_SOCKET;
4638         else {
4639                 struct sk_security_struct *sksec = sk->sk_security;
4640
4641                 *secid = sksec->sid;
4642         }
4643 }
4644
4645 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4646 {
4647         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4648         struct sk_security_struct *sksec = sk->sk_security;
4649
4650         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4651             sk->sk_family == PF_UNIX)
4652                 isec->sid = sksec->sid;
4653         sksec->sclass = isec->sclass;
4654 }
4655
4656 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4657                                      struct request_sock *req)
4658 {
4659         struct sk_security_struct *sksec = sk->sk_security;
4660         int err;
4661         u16 family = req->rsk_ops->family;
4662         u32 connsid;
4663         u32 peersid;
4664
4665         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4666         if (err)
4667                 return err;
4668         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4669         if (err)
4670                 return err;
4671         req->secid = connsid;
4672         req->peer_secid = peersid;
4673
4674         return selinux_netlbl_inet_conn_request(req, family);
4675 }
4676
4677 static void selinux_inet_csk_clone(struct sock *newsk,
4678                                    const struct request_sock *req)
4679 {
4680         struct sk_security_struct *newsksec = newsk->sk_security;
4681
4682         newsksec->sid = req->secid;
4683         newsksec->peer_sid = req->peer_secid;
4684         /* NOTE: Ideally, we should also get the isec->sid for the
4685            new socket in sync, but we don't have the isec available yet.
4686            So we will wait until sock_graft to do it, by which
4687            time it will have been created and available. */
4688
4689         /* We don't need to take any sort of lock here as we are the only
4690          * thread with access to newsksec */
4691         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4692 }
4693
4694 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4695 {
4696         u16 family = sk->sk_family;
4697         struct sk_security_struct *sksec = sk->sk_security;
4698
4699         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4700         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4701                 family = PF_INET;
4702
4703         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4704 }
4705
4706 static int selinux_secmark_relabel_packet(u32 sid)
4707 {
4708         const struct task_security_struct *__tsec;
4709         u32 tsid;
4710
4711         __tsec = current_security();
4712         tsid = __tsec->sid;
4713
4714         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4715 }
4716
4717 static void selinux_secmark_refcount_inc(void)
4718 {
4719         atomic_inc(&selinux_secmark_refcount);
4720 }
4721
4722 static void selinux_secmark_refcount_dec(void)
4723 {
4724         atomic_dec(&selinux_secmark_refcount);
4725 }
4726
4727 static void selinux_req_classify_flow(const struct request_sock *req,
4728                                       struct flowi *fl)
4729 {
4730         fl->flowi_secid = req->secid;
4731 }
4732
4733 static int selinux_tun_dev_alloc_security(void **security)
4734 {
4735         struct tun_security_struct *tunsec;
4736
4737         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4738         if (!tunsec)
4739                 return -ENOMEM;
4740         tunsec->sid = current_sid();
4741
4742         *security = tunsec;
4743         return 0;
4744 }
4745
4746 static void selinux_tun_dev_free_security(void *security)
4747 {
4748         kfree(security);
4749 }
4750
4751 static int selinux_tun_dev_create(void)
4752 {
4753         u32 sid = current_sid();
4754
4755         /* we aren't taking into account the "sockcreate" SID since the socket
4756          * that is being created here is not a socket in the traditional sense,
4757          * instead it is a private sock, accessible only to the kernel, and
4758          * representing a wide range of network traffic spanning multiple
4759          * connections unlike traditional sockets - check the TUN driver to
4760          * get a better understanding of why this socket is special */
4761
4762         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4763                             NULL);
4764 }
4765
4766 static int selinux_tun_dev_attach_queue(void *security)
4767 {
4768         struct tun_security_struct *tunsec = security;
4769
4770         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4771                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4772 }
4773
4774 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4775 {
4776         struct tun_security_struct *tunsec = security;
4777         struct sk_security_struct *sksec = sk->sk_security;
4778
4779         /* we don't currently perform any NetLabel based labeling here and it
4780          * isn't clear that we would want to do so anyway; while we could apply
4781          * labeling without the support of the TUN user the resulting labeled
4782          * traffic from the other end of the connection would almost certainly
4783          * cause confusion to the TUN user that had no idea network labeling
4784          * protocols were being used */
4785
4786         sksec->sid = tunsec->sid;
4787         sksec->sclass = SECCLASS_TUN_SOCKET;
4788
4789         return 0;
4790 }
4791
4792 static int selinux_tun_dev_open(void *security)
4793 {
4794         struct tun_security_struct *tunsec = security;
4795         u32 sid = current_sid();
4796         int err;
4797
4798         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4799                            TUN_SOCKET__RELABELFROM, NULL);
4800         if (err)
4801                 return err;
4802         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4803                            TUN_SOCKET__RELABELTO, NULL);
4804         if (err)
4805                 return err;
4806         tunsec->sid = sid;
4807
4808         return 0;
4809 }
4810
4811 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4812 {
4813         int err = 0;
4814         u32 perm;
4815         struct nlmsghdr *nlh;
4816         struct sk_security_struct *sksec = sk->sk_security;
4817
4818         if (skb->len < NLMSG_HDRLEN) {
4819                 err = -EINVAL;
4820                 goto out;
4821         }
4822         nlh = nlmsg_hdr(skb);
4823
4824         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4825         if (err) {
4826                 if (err == -EINVAL) {
4827                         printk(KERN_WARNING
4828                                "SELinux: unrecognized netlink message:"
4829                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4830                                sk->sk_protocol, nlh->nlmsg_type,
4831                                secclass_map[sksec->sclass - 1].name);
4832                         if (!selinux_enforcing || security_get_allow_unknown())
4833                                 err = 0;
4834                 }
4835
4836                 /* Ignore */
4837                 if (err == -ENOENT)
4838                         err = 0;
4839                 goto out;
4840         }
4841
4842         err = sock_has_perm(current, sk, perm);
4843 out:
4844         return err;
4845 }
4846
4847 #ifdef CONFIG_NETFILTER
4848
4849 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4850                                        const struct net_device *indev,
4851                                        u16 family)
4852 {
4853         int err;
4854         char *addrp;
4855         u32 peer_sid;
4856         struct common_audit_data ad;
4857         struct lsm_network_audit net = {0,};
4858         u8 secmark_active;
4859         u8 netlbl_active;
4860         u8 peerlbl_active;
4861
4862         if (!selinux_policycap_netpeer)
4863                 return NF_ACCEPT;
4864
4865         secmark_active = selinux_secmark_enabled();
4866         netlbl_active = netlbl_enabled();
4867         peerlbl_active = selinux_peerlbl_enabled();
4868         if (!secmark_active && !peerlbl_active)
4869                 return NF_ACCEPT;
4870
4871         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4872                 return NF_DROP;
4873
4874         ad.type = LSM_AUDIT_DATA_NET;
4875         ad.u.net = &net;
4876         ad.u.net->netif = indev->ifindex;
4877         ad.u.net->family = family;
4878         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4879                 return NF_DROP;
4880
4881         if (peerlbl_active) {
4882                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4883                                                addrp, family, peer_sid, &ad);
4884                 if (err) {
4885                         selinux_netlbl_err(skb, err, 1);
4886                         return NF_DROP;
4887                 }
4888         }
4889
4890         if (secmark_active)
4891                 if (avc_has_perm(peer_sid, skb->secmark,
4892                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4893                         return NF_DROP;
4894
4895         if (netlbl_active)
4896                 /* we do this in the FORWARD path and not the POST_ROUTING
4897                  * path because we want to make sure we apply the necessary
4898                  * labeling before IPsec is applied so we can leverage AH
4899                  * protection */
4900                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4901                         return NF_DROP;
4902
4903         return NF_ACCEPT;
4904 }
4905
4906 static unsigned int selinux_ipv4_forward(void *priv,
4907                                          struct sk_buff *skb,
4908                                          const struct nf_hook_state *state)
4909 {
4910         return selinux_ip_forward(skb, state->in, PF_INET);
4911 }
4912
4913 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4914 static unsigned int selinux_ipv6_forward(void *priv,
4915                                          struct sk_buff *skb,
4916                                          const struct nf_hook_state *state)
4917 {
4918         return selinux_ip_forward(skb, state->in, PF_INET6);
4919 }
4920 #endif  /* IPV6 */
4921
4922 static unsigned int selinux_ip_output(struct sk_buff *skb,
4923                                       u16 family)
4924 {
4925         struct sock *sk;
4926         u32 sid;
4927
4928         if (!netlbl_enabled())
4929                 return NF_ACCEPT;
4930
4931         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4932          * because we want to make sure we apply the necessary labeling
4933          * before IPsec is applied so we can leverage AH protection */
4934         sk = skb->sk;
4935         if (sk) {
4936                 struct sk_security_struct *sksec;
4937
4938                 if (sk_listener(sk))
4939                         /* if the socket is the listening state then this
4940                          * packet is a SYN-ACK packet which means it needs to
4941                          * be labeled based on the connection/request_sock and
4942                          * not the parent socket.  unfortunately, we can't
4943                          * lookup the request_sock yet as it isn't queued on
4944                          * the parent socket until after the SYN-ACK is sent.
4945                          * the "solution" is to simply pass the packet as-is
4946                          * as any IP option based labeling should be copied
4947                          * from the initial connection request (in the IP
4948                          * layer).  it is far from ideal, but until we get a
4949                          * security label in the packet itself this is the
4950                          * best we can do. */
4951                         return NF_ACCEPT;
4952
4953                 /* standard practice, label using the parent socket */
4954                 sksec = sk->sk_security;
4955                 sid = sksec->sid;
4956         } else
4957                 sid = SECINITSID_KERNEL;
4958         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4959                 return NF_DROP;
4960
4961         return NF_ACCEPT;
4962 }
4963
4964 static unsigned int selinux_ipv4_output(void *priv,
4965                                         struct sk_buff *skb,
4966                                         const struct nf_hook_state *state)
4967 {
4968         return selinux_ip_output(skb, PF_INET);
4969 }
4970
4971 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4972                                                 int ifindex,
4973                                                 u16 family)
4974 {
4975         struct sock *sk = skb_to_full_sk(skb);
4976         struct sk_security_struct *sksec;
4977         struct common_audit_data ad;
4978         struct lsm_network_audit net = {0,};
4979         char *addrp;
4980         u8 proto;
4981
4982         if (sk == NULL)
4983                 return NF_ACCEPT;
4984         sksec = sk->sk_security;
4985
4986         ad.type = LSM_AUDIT_DATA_NET;
4987         ad.u.net = &net;
4988         ad.u.net->netif = ifindex;
4989         ad.u.net->family = family;
4990         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4991                 return NF_DROP;
4992
4993         if (selinux_secmark_enabled())
4994                 if (avc_has_perm(sksec->sid, skb->secmark,
4995                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4996                         return NF_DROP_ERR(-ECONNREFUSED);
4997
4998         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4999                 return NF_DROP_ERR(-ECONNREFUSED);
5000
5001         return NF_ACCEPT;
5002 }
5003
5004 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
5005                                          const struct net_device *outdev,
5006                                          u16 family)
5007 {
5008         u32 secmark_perm;
5009         u32 peer_sid;
5010         int ifindex = outdev->ifindex;
5011         struct sock *sk;
5012         struct common_audit_data ad;
5013         struct lsm_network_audit net = {0,};
5014         char *addrp;
5015         u8 secmark_active;
5016         u8 peerlbl_active;
5017
5018         /* If any sort of compatibility mode is enabled then handoff processing
5019          * to the selinux_ip_postroute_compat() function to deal with the
5020          * special handling.  We do this in an attempt to keep this function
5021          * as fast and as clean as possible. */
5022         if (!selinux_policycap_netpeer)
5023                 return selinux_ip_postroute_compat(skb, ifindex, family);
5024
5025         secmark_active = selinux_secmark_enabled();
5026         peerlbl_active = selinux_peerlbl_enabled();
5027         if (!secmark_active && !peerlbl_active)
5028                 return NF_ACCEPT;
5029
5030         sk = skb_to_full_sk(skb);
5031
5032 #ifdef CONFIG_XFRM
5033         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5034          * packet transformation so allow the packet to pass without any checks
5035          * since we'll have another chance to perform access control checks
5036          * when the packet is on it's final way out.
5037          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5038          *       is NULL, in this case go ahead and apply access control.
5039          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5040          *       TCP listening state we cannot wait until the XFRM processing
5041          *       is done as we will miss out on the SA label if we do;
5042          *       unfortunately, this means more work, but it is only once per
5043          *       connection. */
5044         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5045             !(sk && sk_listener(sk)))
5046                 return NF_ACCEPT;
5047 #endif
5048
5049         if (sk == NULL) {
5050                 /* Without an associated socket the packet is either coming
5051                  * from the kernel or it is being forwarded; check the packet
5052                  * to determine which and if the packet is being forwarded
5053                  * query the packet directly to determine the security label. */
5054                 if (skb->skb_iif) {
5055                         secmark_perm = PACKET__FORWARD_OUT;
5056                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5057                                 return NF_DROP;
5058                 } else {
5059                         secmark_perm = PACKET__SEND;
5060                         peer_sid = SECINITSID_KERNEL;
5061                 }
5062         } else if (sk_listener(sk)) {
5063                 /* Locally generated packet but the associated socket is in the
5064                  * listening state which means this is a SYN-ACK packet.  In
5065                  * this particular case the correct security label is assigned
5066                  * to the connection/request_sock but unfortunately we can't
5067                  * query the request_sock as it isn't queued on the parent
5068                  * socket until after the SYN-ACK packet is sent; the only
5069                  * viable choice is to regenerate the label like we do in
5070                  * selinux_inet_conn_request().  See also selinux_ip_output()
5071                  * for similar problems. */
5072                 u32 skb_sid;
5073                 struct sk_security_struct *sksec;
5074
5075                 sksec = sk->sk_security;
5076                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5077                         return NF_DROP;
5078                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5079                  * and the packet has been through at least one XFRM
5080                  * transformation then we must be dealing with the "final"
5081                  * form of labeled IPsec packet; since we've already applied
5082                  * all of our access controls on this packet we can safely
5083                  * pass the packet. */
5084                 if (skb_sid == SECSID_NULL) {
5085                         switch (family) {
5086                         case PF_INET:
5087                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5088                                         return NF_ACCEPT;
5089                                 break;
5090                         case PF_INET6:
5091                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5092                                         return NF_ACCEPT;
5093                                 break;
5094                         default:
5095                                 return NF_DROP_ERR(-ECONNREFUSED);
5096                         }
5097                 }
5098                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5099                         return NF_DROP;
5100                 secmark_perm = PACKET__SEND;
5101         } else {
5102                 /* Locally generated packet, fetch the security label from the
5103                  * associated socket. */
5104                 struct sk_security_struct *sksec = sk->sk_security;
5105                 peer_sid = sksec->sid;
5106                 secmark_perm = PACKET__SEND;
5107         }
5108
5109         ad.type = LSM_AUDIT_DATA_NET;
5110         ad.u.net = &net;
5111         ad.u.net->netif = ifindex;
5112         ad.u.net->family = family;
5113         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5114                 return NF_DROP;
5115
5116         if (secmark_active)
5117                 if (avc_has_perm(peer_sid, skb->secmark,
5118                                  SECCLASS_PACKET, secmark_perm, &ad))
5119                         return NF_DROP_ERR(-ECONNREFUSED);
5120
5121         if (peerlbl_active) {
5122                 u32 if_sid;
5123                 u32 node_sid;
5124
5125                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5126                         return NF_DROP;
5127                 if (avc_has_perm(peer_sid, if_sid,
5128                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5129                         return NF_DROP_ERR(-ECONNREFUSED);
5130
5131                 if (sel_netnode_sid(addrp, family, &node_sid))
5132                         return NF_DROP;
5133                 if (avc_has_perm(peer_sid, node_sid,
5134                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5135                         return NF_DROP_ERR(-ECONNREFUSED);
5136         }
5137
5138         return NF_ACCEPT;
5139 }
5140
5141 static unsigned int selinux_ipv4_postroute(void *priv,
5142                                            struct sk_buff *skb,
5143                                            const struct nf_hook_state *state)
5144 {
5145         return selinux_ip_postroute(skb, state->out, PF_INET);
5146 }
5147
5148 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5149 static unsigned int selinux_ipv6_postroute(void *priv,
5150                                            struct sk_buff *skb,
5151                                            const struct nf_hook_state *state)
5152 {
5153         return selinux_ip_postroute(skb, state->out, PF_INET6);
5154 }
5155 #endif  /* IPV6 */
5156
5157 #endif  /* CONFIG_NETFILTER */
5158
5159 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5160 {
5161         return selinux_nlmsg_perm(sk, skb);
5162 }
5163
5164 static int ipc_alloc_security(struct task_struct *task,
5165                               struct kern_ipc_perm *perm,
5166                               u16 sclass)
5167 {
5168         struct ipc_security_struct *isec;
5169         u32 sid;
5170
5171         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5172         if (!isec)
5173                 return -ENOMEM;
5174
5175         sid = task_sid(task);
5176         isec->sclass = sclass;
5177         isec->sid = sid;
5178         perm->security = isec;
5179
5180         return 0;
5181 }
5182
5183 static void ipc_free_security(struct kern_ipc_perm *perm)
5184 {
5185         struct ipc_security_struct *isec = perm->security;
5186         perm->security = NULL;
5187         kfree(isec);
5188 }
5189
5190 static int msg_msg_alloc_security(struct msg_msg *msg)
5191 {
5192         struct msg_security_struct *msec;
5193
5194         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5195         if (!msec)
5196                 return -ENOMEM;
5197
5198         msec->sid = SECINITSID_UNLABELED;
5199         msg->security = msec;
5200
5201         return 0;
5202 }
5203
5204 static void msg_msg_free_security(struct msg_msg *msg)
5205 {
5206         struct msg_security_struct *msec = msg->security;
5207
5208         msg->security = NULL;
5209         kfree(msec);
5210 }
5211
5212 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5213                         u32 perms)
5214 {
5215         struct ipc_security_struct *isec;
5216         struct common_audit_data ad;
5217         u32 sid = current_sid();
5218
5219         isec = ipc_perms->security;
5220
5221         ad.type = LSM_AUDIT_DATA_IPC;
5222         ad.u.ipc_id = ipc_perms->key;
5223
5224         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5225 }
5226
5227 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5228 {
5229         return msg_msg_alloc_security(msg);
5230 }
5231
5232 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5233 {
5234         msg_msg_free_security(msg);
5235 }
5236
5237 /* message queue security operations */
5238 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5239 {
5240         struct ipc_security_struct *isec;
5241         struct common_audit_data ad;
5242         u32 sid = current_sid();
5243         int rc;
5244
5245         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5246         if (rc)
5247                 return rc;
5248
5249         isec = msq->q_perm.security;
5250
5251         ad.type = LSM_AUDIT_DATA_IPC;
5252         ad.u.ipc_id = msq->q_perm.key;
5253
5254         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5255                           MSGQ__CREATE, &ad);
5256         if (rc) {
5257                 ipc_free_security(&msq->q_perm);
5258                 return rc;
5259         }
5260         return 0;
5261 }
5262
5263 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5264 {
5265         ipc_free_security(&msq->q_perm);
5266 }
5267
5268 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5269 {
5270         struct ipc_security_struct *isec;
5271         struct common_audit_data ad;
5272         u32 sid = current_sid();
5273
5274         isec = msq->q_perm.security;
5275
5276         ad.type = LSM_AUDIT_DATA_IPC;
5277         ad.u.ipc_id = msq->q_perm.key;
5278
5279         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5280                             MSGQ__ASSOCIATE, &ad);
5281 }
5282
5283 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5284 {
5285         int err;
5286         int perms;
5287
5288         switch (cmd) {
5289         case IPC_INFO:
5290         case MSG_INFO:
5291                 /* No specific object, just general system-wide information. */
5292                 return task_has_system(current, SYSTEM__IPC_INFO);
5293         case IPC_STAT:
5294         case MSG_STAT:
5295                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5296                 break;
5297         case IPC_SET:
5298                 perms = MSGQ__SETATTR;
5299                 break;
5300         case IPC_RMID:
5301                 perms = MSGQ__DESTROY;
5302                 break;
5303         default:
5304                 return 0;
5305         }
5306
5307         err = ipc_has_perm(&msq->q_perm, perms);
5308         return err;
5309 }
5310
5311 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5312 {
5313         struct ipc_security_struct *isec;
5314         struct msg_security_struct *msec;
5315         struct common_audit_data ad;
5316         u32 sid = current_sid();
5317         int rc;
5318
5319         isec = msq->q_perm.security;
5320         msec = msg->security;
5321
5322         /*
5323          * First time through, need to assign label to the message
5324          */
5325         if (msec->sid == SECINITSID_UNLABELED) {
5326                 /*
5327                  * Compute new sid based on current process and
5328                  * message queue this message will be stored in
5329                  */
5330                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5331                                              NULL, &msec->sid);
5332                 if (rc)
5333                         return rc;
5334         }
5335
5336         ad.type = LSM_AUDIT_DATA_IPC;
5337         ad.u.ipc_id = msq->q_perm.key;
5338
5339         /* Can this process write to the queue? */
5340         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5341                           MSGQ__WRITE, &ad);
5342         if (!rc)
5343                 /* Can this process send the message */
5344                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5345                                   MSG__SEND, &ad);
5346         if (!rc)
5347                 /* Can the message be put in the queue? */
5348                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5349                                   MSGQ__ENQUEUE, &ad);
5350
5351         return rc;
5352 }
5353
5354 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5355                                     struct task_struct *target,
5356                                     long type, int mode)
5357 {
5358         struct ipc_security_struct *isec;
5359         struct msg_security_struct *msec;
5360         struct common_audit_data ad;
5361         u32 sid = task_sid(target);
5362         int rc;
5363
5364         isec = msq->q_perm.security;
5365         msec = msg->security;
5366
5367         ad.type = LSM_AUDIT_DATA_IPC;
5368         ad.u.ipc_id = msq->q_perm.key;
5369
5370         rc = avc_has_perm(sid, isec->sid,
5371                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5372         if (!rc)
5373                 rc = avc_has_perm(sid, msec->sid,
5374                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5375         return rc;
5376 }
5377
5378 /* Shared Memory security operations */
5379 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5380 {
5381         struct ipc_security_struct *isec;
5382         struct common_audit_data ad;
5383         u32 sid = current_sid();
5384         int rc;
5385
5386         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5387         if (rc)
5388                 return rc;
5389
5390         isec = shp->shm_perm.security;
5391
5392         ad.type = LSM_AUDIT_DATA_IPC;
5393         ad.u.ipc_id = shp->shm_perm.key;
5394
5395         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5396                           SHM__CREATE, &ad);
5397         if (rc) {
5398                 ipc_free_security(&shp->shm_perm);
5399                 return rc;
5400         }
5401         return 0;
5402 }
5403
5404 static void selinux_shm_free_security(struct shmid_kernel *shp)
5405 {
5406         ipc_free_security(&shp->shm_perm);
5407 }
5408
5409 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5410 {
5411         struct ipc_security_struct *isec;
5412         struct common_audit_data ad;
5413         u32 sid = current_sid();
5414
5415         isec = shp->shm_perm.security;
5416
5417         ad.type = LSM_AUDIT_DATA_IPC;
5418         ad.u.ipc_id = shp->shm_perm.key;
5419
5420         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5421                             SHM__ASSOCIATE, &ad);
5422 }
5423
5424 /* Note, at this point, shp is locked down */
5425 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5426 {
5427         int perms;
5428         int err;
5429
5430         switch (cmd) {
5431         case IPC_INFO:
5432         case SHM_INFO:
5433                 /* No specific object, just general system-wide information. */
5434                 return task_has_system(current, SYSTEM__IPC_INFO);
5435         case IPC_STAT:
5436         case SHM_STAT:
5437                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5438                 break;
5439         case IPC_SET:
5440                 perms = SHM__SETATTR;
5441                 break;
5442         case SHM_LOCK:
5443         case SHM_UNLOCK:
5444                 perms = SHM__LOCK;
5445                 break;
5446         case IPC_RMID:
5447                 perms = SHM__DESTROY;
5448                 break;
5449         default:
5450                 return 0;
5451         }
5452
5453         err = ipc_has_perm(&shp->shm_perm, perms);
5454         return err;
5455 }
5456
5457 static int selinux_shm_shmat(struct shmid_kernel *shp,
5458                              char __user *shmaddr, int shmflg)
5459 {
5460         u32 perms;
5461
5462         if (shmflg & SHM_RDONLY)
5463                 perms = SHM__READ;
5464         else
5465                 perms = SHM__READ | SHM__WRITE;
5466
5467         return ipc_has_perm(&shp->shm_perm, perms);
5468 }
5469
5470 /* Semaphore security operations */
5471 static int selinux_sem_alloc_security(struct sem_array *sma)
5472 {
5473         struct ipc_security_struct *isec;
5474         struct common_audit_data ad;
5475         u32 sid = current_sid();
5476         int rc;
5477
5478         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5479         if (rc)
5480                 return rc;
5481
5482         isec = sma->sem_perm.security;
5483
5484         ad.type = LSM_AUDIT_DATA_IPC;
5485         ad.u.ipc_id = sma->sem_perm.key;
5486
5487         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5488                           SEM__CREATE, &ad);
5489         if (rc) {
5490                 ipc_free_security(&sma->sem_perm);
5491                 return rc;
5492         }
5493         return 0;
5494 }
5495
5496 static void selinux_sem_free_security(struct sem_array *sma)
5497 {
5498         ipc_free_security(&sma->sem_perm);
5499 }
5500
5501 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5502 {
5503         struct ipc_security_struct *isec;
5504         struct common_audit_data ad;
5505         u32 sid = current_sid();
5506
5507         isec = sma->sem_perm.security;
5508
5509         ad.type = LSM_AUDIT_DATA_IPC;
5510         ad.u.ipc_id = sma->sem_perm.key;
5511
5512         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5513                             SEM__ASSOCIATE, &ad);
5514 }
5515
5516 /* Note, at this point, sma is locked down */
5517 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5518 {
5519         int err;
5520         u32 perms;
5521
5522         switch (cmd) {
5523         case IPC_INFO:
5524         case SEM_INFO:
5525                 /* No specific object, just general system-wide information. */
5526                 return task_has_system(current, SYSTEM__IPC_INFO);
5527         case GETPID:
5528         case GETNCNT:
5529         case GETZCNT:
5530                 perms = SEM__GETATTR;
5531                 break;
5532         case GETVAL:
5533         case GETALL:
5534                 perms = SEM__READ;
5535                 break;
5536         case SETVAL:
5537         case SETALL:
5538                 perms = SEM__WRITE;
5539                 break;
5540         case IPC_RMID:
5541                 perms = SEM__DESTROY;
5542                 break;
5543         case IPC_SET:
5544                 perms = SEM__SETATTR;
5545                 break;
5546         case IPC_STAT:
5547         case SEM_STAT:
5548                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5549                 break;
5550         default:
5551                 return 0;
5552         }
5553
5554         err = ipc_has_perm(&sma->sem_perm, perms);
5555         return err;
5556 }
5557
5558 static int selinux_sem_semop(struct sem_array *sma,
5559                              struct sembuf *sops, unsigned nsops, int alter)
5560 {
5561         u32 perms;
5562
5563         if (alter)
5564                 perms = SEM__READ | SEM__WRITE;
5565         else
5566                 perms = SEM__READ;
5567
5568         return ipc_has_perm(&sma->sem_perm, perms);
5569 }
5570
5571 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5572 {
5573         u32 av = 0;
5574
5575         av = 0;
5576         if (flag & S_IRUGO)
5577                 av |= IPC__UNIX_READ;
5578         if (flag & S_IWUGO)
5579                 av |= IPC__UNIX_WRITE;
5580
5581         if (av == 0)
5582                 return 0;
5583
5584         return ipc_has_perm(ipcp, av);
5585 }
5586
5587 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5588 {
5589         struct ipc_security_struct *isec = ipcp->security;
5590         *secid = isec->sid;
5591 }
5592
5593 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5594 {
5595         if (inode)
5596                 inode_doinit_with_dentry(inode, dentry);
5597 }
5598
5599 static int selinux_getprocattr(struct task_struct *p,
5600                                char *name, char **value)
5601 {
5602         const struct task_security_struct *__tsec;
5603         u32 sid;
5604         int error;
5605         unsigned len;
5606
5607         if (current != p) {
5608                 error = current_has_perm(p, PROCESS__GETATTR);
5609                 if (error)
5610                         return error;
5611         }
5612
5613         rcu_read_lock();
5614         __tsec = __task_cred(p)->security;
5615
5616         if (!strcmp(name, "current"))
5617                 sid = __tsec->sid;
5618         else if (!strcmp(name, "prev"))
5619                 sid = __tsec->osid;
5620         else if (!strcmp(name, "exec"))
5621                 sid = __tsec->exec_sid;
5622         else if (!strcmp(name, "fscreate"))
5623                 sid = __tsec->create_sid;
5624         else if (!strcmp(name, "keycreate"))
5625                 sid = __tsec->keycreate_sid;
5626         else if (!strcmp(name, "sockcreate"))
5627                 sid = __tsec->sockcreate_sid;
5628         else
5629                 goto invalid;
5630         rcu_read_unlock();
5631
5632         if (!sid)
5633                 return 0;
5634
5635         error = security_sid_to_context(sid, value, &len);
5636         if (error)
5637                 return error;
5638         return len;
5639
5640 invalid:
5641         rcu_read_unlock();
5642         return -EINVAL;
5643 }
5644
5645 static int selinux_setprocattr(struct task_struct *p,
5646                                char *name, void *value, size_t size)
5647 {
5648         struct task_security_struct *tsec;
5649         struct task_struct *tracer;
5650         struct cred *new;
5651         u32 sid = 0, ptsid;
5652         int error;
5653         char *str = value;
5654
5655         if (current != p) {
5656                 /* SELinux only allows a process to change its own
5657                    security attributes. */
5658                 return -EACCES;
5659         }
5660
5661         /*
5662          * Basic control over ability to set these attributes at all.
5663          * current == p, but we'll pass them separately in case the
5664          * above restriction is ever removed.
5665          */
5666         if (!strcmp(name, "exec"))
5667                 error = current_has_perm(p, PROCESS__SETEXEC);
5668         else if (!strcmp(name, "fscreate"))
5669                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5670         else if (!strcmp(name, "keycreate"))
5671                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5672         else if (!strcmp(name, "sockcreate"))
5673                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5674         else if (!strcmp(name, "current"))
5675                 error = current_has_perm(p, PROCESS__SETCURRENT);
5676         else
5677                 error = -EINVAL;
5678         if (error)
5679                 return error;
5680
5681         /* Obtain a SID for the context, if one was specified. */
5682         if (size && str[1] && str[1] != '\n') {
5683                 if (str[size-1] == '\n') {
5684                         str[size-1] = 0;
5685                         size--;
5686                 }
5687                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5688                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5689                         if (!capable(CAP_MAC_ADMIN)) {
5690                                 struct audit_buffer *ab;
5691                                 size_t audit_size;
5692
5693                                 /* We strip a nul only if it is at the end, otherwise the
5694                                  * context contains a nul and we should audit that */
5695                                 if (str[size - 1] == '\0')
5696                                         audit_size = size - 1;
5697                                 else
5698                                         audit_size = size;
5699                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5700                                 audit_log_format(ab, "op=fscreate invalid_context=");
5701                                 audit_log_n_untrustedstring(ab, value, audit_size);
5702                                 audit_log_end(ab);
5703
5704                                 return error;
5705                         }
5706                         error = security_context_to_sid_force(value, size,
5707                                                               &sid);
5708                 }
5709                 if (error)
5710                         return error;
5711         }
5712
5713         new = prepare_creds();
5714         if (!new)
5715                 return -ENOMEM;
5716
5717         /* Permission checking based on the specified context is
5718            performed during the actual operation (execve,
5719            open/mkdir/...), when we know the full context of the
5720            operation.  See selinux_bprm_set_creds for the execve
5721            checks and may_create for the file creation checks. The
5722            operation will then fail if the context is not permitted. */
5723         tsec = new->security;
5724         if (!strcmp(name, "exec")) {
5725                 tsec->exec_sid = sid;
5726         } else if (!strcmp(name, "fscreate")) {
5727                 tsec->create_sid = sid;
5728         } else if (!strcmp(name, "keycreate")) {
5729                 error = may_create_key(sid, p);
5730                 if (error)
5731                         goto abort_change;
5732                 tsec->keycreate_sid = sid;
5733         } else if (!strcmp(name, "sockcreate")) {
5734                 tsec->sockcreate_sid = sid;
5735         } else if (!strcmp(name, "current")) {
5736                 error = -EINVAL;
5737                 if (sid == 0)
5738                         goto abort_change;
5739
5740                 /* Only allow single threaded processes to change context */
5741                 error = -EPERM;
5742                 if (!current_is_single_threaded()) {
5743                         error = security_bounded_transition(tsec->sid, sid);
5744                         if (error)
5745                                 goto abort_change;
5746                 }
5747
5748                 /* Check permissions for the transition. */
5749                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5750                                      PROCESS__DYNTRANSITION, NULL);
5751                 if (error)
5752                         goto abort_change;
5753
5754                 /* Check for ptracing, and update the task SID if ok.
5755                    Otherwise, leave SID unchanged and fail. */
5756                 ptsid = 0;
5757                 rcu_read_lock();
5758                 tracer = ptrace_parent(p);
5759                 if (tracer)
5760                         ptsid = task_sid(tracer);
5761                 rcu_read_unlock();
5762
5763                 if (tracer) {
5764                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5765                                              PROCESS__PTRACE, NULL);
5766                         if (error)
5767                                 goto abort_change;
5768                 }
5769
5770                 tsec->sid = sid;
5771         } else {
5772                 error = -EINVAL;
5773                 goto abort_change;
5774         }
5775
5776         commit_creds(new);
5777         return size;
5778
5779 abort_change:
5780         abort_creds(new);
5781         return error;
5782 }
5783
5784 static int selinux_ismaclabel(const char *name)
5785 {
5786         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5787 }
5788
5789 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5790 {
5791         return security_sid_to_context(secid, secdata, seclen);
5792 }
5793
5794 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5795 {
5796         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5797 }
5798
5799 static void selinux_release_secctx(char *secdata, u32 seclen)
5800 {
5801         kfree(secdata);
5802 }
5803
5804 /*
5805  *      called with inode->i_mutex locked
5806  */
5807 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5808 {
5809         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5810 }
5811
5812 /*
5813  *      called with inode->i_mutex locked
5814  */
5815 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5816 {
5817         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5818 }
5819
5820 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5821 {
5822         int len = 0;
5823         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5824                                                 ctx, true);
5825         if (len < 0)
5826                 return len;
5827         *ctxlen = len;
5828         return 0;
5829 }
5830 #ifdef CONFIG_KEYS
5831
5832 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5833                              unsigned long flags)
5834 {
5835         const struct task_security_struct *tsec;
5836         struct key_security_struct *ksec;
5837
5838         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5839         if (!ksec)
5840                 return -ENOMEM;
5841
5842         tsec = cred->security;
5843         if (tsec->keycreate_sid)
5844                 ksec->sid = tsec->keycreate_sid;
5845         else
5846                 ksec->sid = tsec->sid;
5847
5848         k->security = ksec;
5849         return 0;
5850 }
5851
5852 static void selinux_key_free(struct key *k)
5853 {
5854         struct key_security_struct *ksec = k->security;
5855
5856         k->security = NULL;
5857         kfree(ksec);
5858 }
5859
5860 static int selinux_key_permission(key_ref_t key_ref,
5861                                   const struct cred *cred,
5862                                   unsigned perm)
5863 {
5864         struct key *key;
5865         struct key_security_struct *ksec;
5866         u32 sid;
5867
5868         /* if no specific permissions are requested, we skip the
5869            permission check. No serious, additional covert channels
5870            appear to be created. */
5871         if (perm == 0)
5872                 return 0;
5873
5874         sid = cred_sid(cred);
5875
5876         key = key_ref_to_ptr(key_ref);
5877         ksec = key->security;
5878
5879         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5880 }
5881
5882 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5883 {
5884         struct key_security_struct *ksec = key->security;
5885         char *context = NULL;
5886         unsigned len;
5887         int rc;
5888
5889         rc = security_sid_to_context(ksec->sid, &context, &len);
5890         if (!rc)
5891                 rc = len;
5892         *_buffer = context;
5893         return rc;
5894 }
5895
5896 #endif
5897
5898 static struct security_hook_list selinux_hooks[] = {
5899         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5900         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5901         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5902         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5903
5904         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5905         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5906         LSM_HOOK_INIT(capget, selinux_capget),
5907         LSM_HOOK_INIT(capset, selinux_capset),
5908         LSM_HOOK_INIT(capable, selinux_capable),
5909         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5910         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5911         LSM_HOOK_INIT(syslog, selinux_syslog),
5912         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5913
5914         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5915
5916         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5917         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5918         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5919         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5920
5921         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5922         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5923         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5924         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5925         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5926         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5927         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5928         LSM_HOOK_INIT(sb_mount, selinux_mount),
5929         LSM_HOOK_INIT(sb_umount, selinux_umount),
5930         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5931         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5932         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5933
5934         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5935
5936         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5937         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5938         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5939         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5940         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5941         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5942         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5943         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5944         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5945         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5946         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5947         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5948         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5949         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5950         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5951         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5952         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5953         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5954         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5955         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5956         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5957         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5958         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5959         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5960         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5961
5962         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5963         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5964         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5965         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5966         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5967         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5968         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5969         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5970         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5971         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5972         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5973         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5974
5975         LSM_HOOK_INIT(file_open, selinux_file_open),
5976
5977         LSM_HOOK_INIT(task_create, selinux_task_create),
5978         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5979         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5980         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5981         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5982         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5983         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5984         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5985         LSM_HOOK_INIT(kernel_module_from_file, selinux_kernel_module_from_file),
5986         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5987         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5988         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5989         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5990         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5991         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5992         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5993         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5994         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5995         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5996         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5997         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5998         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5999         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
6000
6001         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
6002         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
6003
6004         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
6005         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
6006
6007         LSM_HOOK_INIT(msg_queue_alloc_security,
6008                         selinux_msg_queue_alloc_security),
6009         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
6010         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
6011         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
6012         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
6013         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
6014
6015         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
6016         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
6017         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
6018         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
6019         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
6020
6021         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
6022         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
6023         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
6024         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
6025         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
6026
6027         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
6028
6029         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
6030         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
6031
6032         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
6033         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
6034         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
6035         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
6036         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
6037         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6038         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6039
6040         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6041         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6042
6043         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6044         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6045         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6046         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6047         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6048         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6049         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6050         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6051         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6052         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6053         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6054         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6055         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6056         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6057         LSM_HOOK_INIT(socket_getpeersec_stream,
6058                         selinux_socket_getpeersec_stream),
6059         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6060         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6061         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6062         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6063         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6064         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6065         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6066         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6067         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6068         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6069         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6070         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6071         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6072         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6073         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6074         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6075         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6076         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6077         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6078
6079 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6080         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6081         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6082         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6083         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6084         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6085         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6086                         selinux_xfrm_state_alloc_acquire),
6087         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6088         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6089         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6090         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6091                         selinux_xfrm_state_pol_flow_match),
6092         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6093 #endif
6094
6095 #ifdef CONFIG_KEYS
6096         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6097         LSM_HOOK_INIT(key_free, selinux_key_free),
6098         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6099         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6100 #endif
6101
6102 #ifdef CONFIG_AUDIT
6103         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6104         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6105         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6106         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6107 #endif
6108 };
6109
6110 static __init int selinux_init(void)
6111 {
6112         if (!security_module_enable("selinux")) {
6113                 selinux_enabled = 0;
6114                 return 0;
6115         }
6116
6117         if (!selinux_enabled) {
6118                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6119                 return 0;
6120         }
6121
6122         printk(KERN_INFO "SELinux:  Initializing.\n");
6123
6124         /* Set the security state for the initial task. */
6125         cred_init_security();
6126
6127         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6128
6129         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6130                                             sizeof(struct inode_security_struct),
6131                                             0, SLAB_PANIC, NULL);
6132         file_security_cache = kmem_cache_create("selinux_file_security",
6133                                             sizeof(struct file_security_struct),
6134                                             0, SLAB_PANIC, NULL);
6135         avc_init();
6136
6137         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6138
6139         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6140                 panic("SELinux: Unable to register AVC netcache callback\n");
6141
6142         if (selinux_enforcing)
6143                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6144         else
6145                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6146
6147         return 0;
6148 }
6149
6150 static void delayed_superblock_init(struct super_block *sb, void *unused)
6151 {
6152         superblock_doinit(sb, NULL);
6153 }
6154
6155 void selinux_complete_init(void)
6156 {
6157         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6158
6159         /* Set up any superblocks initialized prior to the policy load. */
6160         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6161         iterate_supers(delayed_superblock_init, NULL);
6162 }
6163
6164 /* SELinux requires early initialization in order to label
6165    all processes and objects when they are created. */
6166 security_initcall(selinux_init);
6167
6168 #if defined(CONFIG_NETFILTER)
6169
6170 static struct nf_hook_ops selinux_nf_ops[] = {
6171         {
6172                 .hook =         selinux_ipv4_postroute,
6173                 .pf =           NFPROTO_IPV4,
6174                 .hooknum =      NF_INET_POST_ROUTING,
6175                 .priority =     NF_IP_PRI_SELINUX_LAST,
6176         },
6177         {
6178                 .hook =         selinux_ipv4_forward,
6179                 .pf =           NFPROTO_IPV4,
6180                 .hooknum =      NF_INET_FORWARD,
6181                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6182         },
6183         {
6184                 .hook =         selinux_ipv4_output,
6185                 .pf =           NFPROTO_IPV4,
6186                 .hooknum =      NF_INET_LOCAL_OUT,
6187                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6188         },
6189 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6190         {
6191                 .hook =         selinux_ipv6_postroute,
6192                 .pf =           NFPROTO_IPV6,
6193                 .hooknum =      NF_INET_POST_ROUTING,
6194                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6195         },
6196         {
6197                 .hook =         selinux_ipv6_forward,
6198                 .pf =           NFPROTO_IPV6,
6199                 .hooknum =      NF_INET_FORWARD,
6200                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6201         },
6202 #endif  /* IPV6 */
6203 };
6204
6205 static int __init selinux_nf_ip_init(void)
6206 {
6207         int err;
6208
6209         if (!selinux_enabled)
6210                 return 0;
6211
6212         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6213
6214         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6215         if (err)
6216                 panic("SELinux: nf_register_hooks: error %d\n", err);
6217
6218         return 0;
6219 }
6220
6221 __initcall(selinux_nf_ip_init);
6222
6223 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6224 static void selinux_nf_ip_exit(void)
6225 {
6226         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6227
6228         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6229 }
6230 #endif
6231
6232 #else /* CONFIG_NETFILTER */
6233
6234 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6235 #define selinux_nf_ip_exit()
6236 #endif
6237
6238 #endif /* CONFIG_NETFILTER */
6239
6240 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6241 static int selinux_disabled;
6242
6243 int selinux_disable(void)
6244 {
6245         if (ss_initialized) {
6246                 /* Not permitted after initial policy load. */
6247                 return -EINVAL;
6248         }
6249
6250         if (selinux_disabled) {
6251                 /* Only do this once. */
6252                 return -EINVAL;
6253         }
6254
6255         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6256
6257         selinux_disabled = 1;
6258         selinux_enabled = 0;
6259
6260         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6261
6262         /* Try to destroy the avc node cache */
6263         avc_disable();
6264
6265         /* Unregister netfilter hooks. */
6266         selinux_nf_ip_exit();
6267
6268         /* Unregister selinuxfs. */
6269         exit_sel_fs();
6270
6271         return 0;
6272 }
6273 #endif