security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         /*
 258          * As not all inode security structures are in a list, we check for
 259          * empty list outside of the lock to make sure that we won't waste
 260          * time taking a lock doing nothing.
 261          *
 262          * The list_del_init() function can be safely called more than once.
 263          * It should not be possible for this function to be called with
 264          * concurrent list_add(), but for better safety against future changes
 265          * in the code, we use list_empty_careful() here.
 266          */
 267         if (!list_empty_careful(&isec->list)) {
 268                 spin_lock(&sbsec->isec_lock);
 269                 list_del_init(&isec->list);
 270                 spin_unlock(&sbsec->isec_lock);
 271         }
 272
 273         /*
 274          * The inode may still be referenced in a path walk and
 275          * a call to selinux_inode_permission() can be made
 276          * after inode_free_security() is called. Ideally, the VFS
 277          * wouldn't do this, but fixing that is a much harder
 278          * job. For now, simply free the i_security via RCU, and
 279          * leave the current inode->i_security pointer intact.
 280          * The inode will be freed after the RCU grace period too.
 281          */
 282         call_rcu(&isec->rcu, inode_free_rcu);
 283 }
 284
 285 static int file_alloc_security(struct file *file)
 286 {
 287         struct file_security_struct *fsec;
 288         u32 sid = current_sid();
 289
 290         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 291         if (!fsec)
 292                 return -ENOMEM;
 293
 294         fsec->sid = sid;
 295         fsec->fown_sid = sid;
 296         file->f_security = fsec;
 297
 298         return 0;
 299 }
 300
 301 static void file_free_security(struct file *file)
 302 {
 303         struct file_security_struct *fsec = file->f_security;
 304         file->f_security = NULL;
 305         kfree(fsec);
 306 }
 307
 308 static int superblock_alloc_security(struct super_block *sb)
 309 {
 310         struct superblock_security_struct *sbsec;
 311
 312         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 313         if (!sbsec)
 314                 return -ENOMEM;
 315
 316         mutex_init(&sbsec->lock);
 317         INIT_LIST_HEAD(&sbsec->isec_head);
 318         spin_lock_init(&sbsec->isec_lock);
 319         sbsec->sb = sb;
 320         sbsec->sid = SECINITSID_UNLABELED;
 321         sbsec->def_sid = SECINITSID_FILE;
 322         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 323         sb->s_security = sbsec;
 324
 325         return 0;
 326 }
 327
 328 static void superblock_free_security(struct super_block *sb)
 329 {
 330         struct superblock_security_struct *sbsec = sb->s_security;
 331         sb->s_security = NULL;
 332         kfree(sbsec);
 333 }
 334
 335 /* The file system's label must be initialized prior to use. */
 336
 337 static const char *labeling_behaviors[7] = {
 338         "uses xattr",
 339         "uses transition SIDs",
 340         "uses task SIDs",
 341         "uses genfs_contexts",
 342         "not configured for labeling",
 343         "uses mountpoint labeling",
 344         "uses native labeling",
 345 };
 346
 347 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 348
 349 static inline int inode_doinit(struct inode *inode)
 350 {
 351         return inode_doinit_with_dentry(inode, NULL);
 352 }
 353
 354 enum {
 355         Opt_error = -1,
 356         Opt_context = 1,
 357         Opt_fscontext = 2,
 358         Opt_defcontext = 3,
 359         Opt_rootcontext = 4,
 360         Opt_labelsupport = 5,
 361         Opt_nextmntopt = 6,
 362 };
 363
 364 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 365
 366 static const match_table_t tokens = {
 367         {Opt_context, CONTEXT_STR "%s"},
 368         {Opt_fscontext, FSCONTEXT_STR "%s"},
 369         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 370         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 371         {Opt_labelsupport, LABELSUPP_STR},
 372         {Opt_error, NULL},
 373 };
 374
 375 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 376
 377 static int may_context_mount_sb_relabel(u32 sid,
 378                         struct superblock_security_struct *sbsec,
 379                         const struct cred *cred)
 380 {
 381         const struct task_security_struct *tsec = cred->security;
 382         int rc;
 383
 384         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 385                           FILESYSTEM__RELABELFROM, NULL);
 386         if (rc)
 387                 return rc;
 388
 389         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELTO, NULL);
 391         return rc;
 392 }
 393
 394 static int may_context_mount_inode_relabel(u32 sid,
 395                         struct superblock_security_struct *sbsec,
 396                         const struct cred *cred)
 397 {
 398         const struct task_security_struct *tsec = cred->security;
 399         int rc;
 400         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 401                           FILESYSTEM__RELABELFROM, NULL);
 402         if (rc)
 403                 return rc;
 404
 405         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 406                           FILESYSTEM__ASSOCIATE, NULL);
 407         return rc;
 408 }
 409
 410 static int selinux_is_sblabel_mnt(struct super_block *sb)
 411 {
 412         struct superblock_security_struct *sbsec = sb->s_security;
 413
 414         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 415                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 416                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 417                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 418                 /* Special handling. Genfs but also in-core setxattr handler */
 419                 !strcmp(sb->s_type->name, "sysfs") ||
 420                 !strcmp(sb->s_type->name, "pstore") ||
 421                 !strcmp(sb->s_type->name, "debugfs") ||
 422                 !strcmp(sb->s_type->name, "rootfs");
 423 }
 424
 425 static int sb_finish_set_opts(struct super_block *sb)
 426 {
 427         struct superblock_security_struct *sbsec = sb->s_security;
 428         struct dentry *root = sb->s_root;
 429         struct inode *root_inode = d_backing_inode(root);
 430         int rc = 0;
 431
 432         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 433                 /* Make sure that the xattr handler exists and that no
 434                    error other than -ENODATA is returned by getxattr on
 435                    the root directory.  -ENODATA is ok, as this may be
 436                    the first boot of the SELinux kernel before we have
 437                    assigned xattr values to the filesystem. */
 438                 if (!root_inode->i_op->getxattr) {
 439                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 440                                "xattr support\n", sb->s_id, sb->s_type->name);
 441                         rc = -EOPNOTSUPP;
 442                         goto out;
 443                 }
 444                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 445                 if (rc < 0 && rc != -ENODATA) {
 446                         if (rc == -EOPNOTSUPP)
 447                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 448                                        "%s) has no security xattr handler\n",
 449                                        sb->s_id, sb->s_type->name);
 450                         else
 451                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 452                                        "%s) getxattr errno %d\n", sb->s_id,
 453                                        sb->s_type->name, -rc);
 454                         goto out;
 455                 }
 456         }
 457
 458         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 459                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 460                        sb->s_id, sb->s_type->name);
 461
 462         sbsec->flags |= SE_SBINITIALIZED;
 463         if (selinux_is_sblabel_mnt(sb))
 464                 sbsec->flags |= SBLABEL_MNT;
 465
 466         /* Initialize the root inode. */
 467         rc = inode_doinit_with_dentry(root_inode, root);
 468
 469         /* Initialize any other inodes associated with the superblock, e.g.
 470            inodes created prior to initial policy load or inodes created
 471            during get_sb by a pseudo filesystem that directly
 472            populates itself. */
 473         spin_lock(&sbsec->isec_lock);
 474 next_inode:
 475         if (!list_empty(&sbsec->isec_head)) {
 476                 struct inode_security_struct *isec =
 477                                 list_entry(sbsec->isec_head.next,
 478                                            struct inode_security_struct, list);
 479                 struct inode *inode = isec->inode;
 480                 list_del_init(&isec->list);
 481                 spin_unlock(&sbsec->isec_lock);
 482                 inode = igrab(inode);
 483                 if (inode) {
 484                         if (!IS_PRIVATE(inode))
 485                                 inode_doinit(inode);
 486                         iput(inode);
 487                 }
 488                 spin_lock(&sbsec->isec_lock);
 489                 goto next_inode;
 490         }
 491         spin_unlock(&sbsec->isec_lock);
 492 out:
 493         return rc;
 494 }
 495
 496 /*
 497  * This function should allow an FS to ask what it's mount security
 498  * options were so it can use those later for submounts, displaying
 499  * mount options, or whatever.
 500  */
 501 static int selinux_get_mnt_opts(const struct super_block *sb,
 502                                 struct security_mnt_opts *opts)
 503 {
 504         int rc = 0, i;
 505         struct superblock_security_struct *sbsec = sb->s_security;
 506         char *context = NULL;
 507         u32 len;
 508         char tmp;
 509
 510         security_init_mnt_opts(opts);
 511
 512         if (!(sbsec->flags & SE_SBINITIALIZED))
 513                 return -EINVAL;
 514
 515         if (!ss_initialized)
 516                 return -EINVAL;
 517
 518         /* make sure we always check enough bits to cover the mask */
 519         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 520
 521         tmp = sbsec->flags & SE_MNTMASK;
 522         /* count the number of mount options for this sb */
 523         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 524                 if (tmp & 0x01)
 525                         opts->num_mnt_opts++;
 526                 tmp >>= 1;
 527         }
 528         /* Check if the Label support flag is set */
 529         if (sbsec->flags & SBLABEL_MNT)
 530                 opts->num_mnt_opts++;
 531
 532         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 533         if (!opts->mnt_opts) {
 534                 rc = -ENOMEM;
 535                 goto out_free;
 536         }
 537
 538         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 539         if (!opts->mnt_opts_flags) {
 540                 rc = -ENOMEM;
 541                 goto out_free;
 542         }
 543
 544         i = 0;
 545         if (sbsec->flags & FSCONTEXT_MNT) {
 546                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 547                 if (rc)
 548                         goto out_free;
 549                 opts->mnt_opts[i] = context;
 550                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 551         }
 552         if (sbsec->flags & CONTEXT_MNT) {
 553                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 554                 if (rc)
 555                         goto out_free;
 556                 opts->mnt_opts[i] = context;
 557                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 558         }
 559         if (sbsec->flags & DEFCONTEXT_MNT) {
 560                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 561                 if (rc)
 562                         goto out_free;
 563                 opts->mnt_opts[i] = context;
 564                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 565         }
 566         if (sbsec->flags & ROOTCONTEXT_MNT) {
 567                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 568                 struct inode_security_struct *isec = root->i_security;
 569
 570                 rc = security_sid_to_context(isec->sid, &context, &len);
 571                 if (rc)
 572                         goto out_free;
 573                 opts->mnt_opts[i] = context;
 574                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 575         }
 576         if (sbsec->flags & SBLABEL_MNT) {
 577                 opts->mnt_opts[i] = NULL;
 578                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 579         }
 580
 581         BUG_ON(i != opts->num_mnt_opts);
 582
 583         return 0;
 584
 585 out_free:
 586         security_free_mnt_opts(opts);
 587         return rc;
 588 }
 589
 590 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 591                       u32 old_sid, u32 new_sid)
 592 {
 593         char mnt_flags = sbsec->flags & SE_MNTMASK;
 594
 595         /* check if the old mount command had the same options */
 596         if (sbsec->flags & SE_SBINITIALIZED)
 597                 if (!(sbsec->flags & flag) ||
 598                     (old_sid != new_sid))
 599                         return 1;
 600
 601         /* check if we were passed the same options twice,
 602          * aka someone passed context=a,context=b
 603          */
 604         if (!(sbsec->flags & SE_SBINITIALIZED))
 605                 if (mnt_flags & flag)
 606                         return 1;
 607         return 0;
 608 }
 609
 610 /*
 611  * Allow filesystems with binary mount data to explicitly set mount point
 612  * labeling information.
 613  */
 614 static int selinux_set_mnt_opts(struct super_block *sb,
 615                                 struct security_mnt_opts *opts,
 616                                 unsigned long kern_flags,
 617                                 unsigned long *set_kern_flags)
 618 {
 619         const struct cred *cred = current_cred();
 620         int rc = 0, i;
 621         struct superblock_security_struct *sbsec = sb->s_security;
 622         const char *name = sb->s_type->name;
 623         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 624         struct inode_security_struct *root_isec = inode->i_security;
 625         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 626         u32 defcontext_sid = 0;
 627         char **mount_options = opts->mnt_opts;
 628         int *flags = opts->mnt_opts_flags;
 629         int num_opts = opts->num_mnt_opts;
 630
 631         mutex_lock(&sbsec->lock);
 632
 633         if (!ss_initialized) {
 634                 if (!num_opts) {
 635                         /* Defer initialization until selinux_complete_init,
 636                            after the initial policy is loaded and the security
 637                            server is ready to handle calls. */
 638                         goto out;
 639                 }
 640                 rc = -EINVAL;
 641                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 642                         "before the security server is initialized\n");
 643                 goto out;
 644         }
 645         if (kern_flags && !set_kern_flags) {
 646                 /* Specifying internal flags without providing a place to
 647                  * place the results is not allowed */
 648                 rc = -EINVAL;
 649                 goto out;
 650         }
 651
 652         /*
 653          * Binary mount data FS will come through this function twice.  Once
 654          * from an explicit call and once from the generic calls from the vfs.
 655          * Since the generic VFS calls will not contain any security mount data
 656          * we need to skip the double mount verification.
 657          *
 658          * This does open a hole in which we will not notice if the first
 659          * mount using this sb set explict options and a second mount using
 660          * this sb does not set any security options.  (The first options
 661          * will be used for both mounts)
 662          */
 663         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 664             && (num_opts == 0))
 665                 goto out;
 666
 667         /*
 668          * parse the mount options, check if they are valid sids.
 669          * also check if someone is trying to mount the same sb more
 670          * than once with different security options.
 671          */
 672         for (i = 0; i < num_opts; i++) {
 673                 u32 sid;
 674
 675                 if (flags[i] == SBLABEL_MNT)
 676                         continue;
 677                 rc = security_context_to_sid(mount_options[i],
 678                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 679                 if (rc) {
 680                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 681                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 682                                mount_options[i], sb->s_id, name, rc);
 683                         goto out;
 684                 }
 685                 switch (flags[i]) {
 686                 case FSCONTEXT_MNT:
 687                         fscontext_sid = sid;
 688
 689                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 690                                         fscontext_sid))
 691                                 goto out_double_mount;
 692
 693                         sbsec->flags |= FSCONTEXT_MNT;
 694                         break;
 695                 case CONTEXT_MNT:
 696                         context_sid = sid;
 697
 698                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 699                                         context_sid))
 700                                 goto out_double_mount;
 701
 702                         sbsec->flags |= CONTEXT_MNT;
 703                         break;
 704                 case ROOTCONTEXT_MNT:
 705                         rootcontext_sid = sid;
 706
 707                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 708                                         rootcontext_sid))
 709                                 goto out_double_mount;
 710
 711                         sbsec->flags |= ROOTCONTEXT_MNT;
 712
 713                         break;
 714                 case DEFCONTEXT_MNT:
 715                         defcontext_sid = sid;
 716
 717                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 718                                         defcontext_sid))
 719                                 goto out_double_mount;
 720
 721                         sbsec->flags |= DEFCONTEXT_MNT;
 722
 723                         break;
 724                 default:
 725                         rc = -EINVAL;
 726                         goto out;
 727                 }
 728         }
 729
 730         if (sbsec->flags & SE_SBINITIALIZED) {
 731                 /* previously mounted with options, but not on this attempt? */
 732                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 733                         goto out_double_mount;
 734                 rc = 0;
 735                 goto out;
 736         }
 737
 738         if (strcmp(sb->s_type->name, "proc") == 0)
 739                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 740
 741         if (!strcmp(sb->s_type->name, "debugfs") ||
 742             !strcmp(sb->s_type->name, "sysfs") ||
 743             !strcmp(sb->s_type->name, "pstore"))
 744                 sbsec->flags |= SE_SBGENFS;
 745
 746         if (!sbsec->behavior) {
 747                 /*
 748                  * Determine the labeling behavior to use for this
 749                  * filesystem type.
 750                  */
 751                 rc = security_fs_use(sb);
 752                 if (rc) {
 753                         printk(KERN_WARNING
 754                                 "%s: security_fs_use(%s) returned %d\n",
 755                                         __func__, sb->s_type->name, rc);
 756                         goto out;
 757                 }
 758         }
 759         /* sets the context of the superblock for the fs being mounted. */
 760         if (fscontext_sid) {
 761                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 762                 if (rc)
 763                         goto out;
 764
 765                 sbsec->sid = fscontext_sid;
 766         }
 767
 768         /*
 769          * Switch to using mount point labeling behavior.
 770          * sets the label used on all file below the mountpoint, and will set
 771          * the superblock context if not already set.
 772          */
 773         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 774                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 775                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 776         }
 777
 778         if (context_sid) {
 779                 if (!fscontext_sid) {
 780                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 781                                                           cred);
 782                         if (rc)
 783                                 goto out;
 784                         sbsec->sid = context_sid;
 785                 } else {
 786                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 787                                                              cred);
 788                         if (rc)
 789                                 goto out;
 790                 }
 791                 if (!rootcontext_sid)
 792                         rootcontext_sid = context_sid;
 793
 794                 sbsec->mntpoint_sid = context_sid;
 795                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 796         }
 797
 798         if (rootcontext_sid) {
 799                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 800                                                      cred);
 801                 if (rc)
 802                         goto out;
 803
 804                 root_isec->sid = rootcontext_sid;
 805                 root_isec->initialized = 1;
 806         }
 807
 808         if (defcontext_sid) {
 809                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 810                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 811                         rc = -EINVAL;
 812                         printk(KERN_WARNING "SELinux: defcontext option is "
 813                                "invalid for this filesystem type\n");
 814                         goto out;
 815                 }
 816
 817                 if (defcontext_sid != sbsec->def_sid) {
 818                         rc = may_context_mount_inode_relabel(defcontext_sid,
 819                                                              sbsec, cred);
 820                         if (rc)
 821                                 goto out;
 822                 }
 823
 824                 sbsec->def_sid = defcontext_sid;
 825         }
 826
 827         rc = sb_finish_set_opts(sb);
 828 out:
 829         mutex_unlock(&sbsec->lock);
 830         return rc;
 831 out_double_mount:
 832         rc = -EINVAL;
 833         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 834                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 835         goto out;
 836 }
 837
 838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 839                                     const struct super_block *newsb)
 840 {
 841         struct superblock_security_struct *old = oldsb->s_security;
 842         struct superblock_security_struct *new = newsb->s_security;
 843         char oldflags = old->flags & SE_MNTMASK;
 844         char newflags = new->flags & SE_MNTMASK;
 845
 846         if (oldflags != newflags)
 847                 goto mismatch;
 848         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 849                 goto mismatch;
 850         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 851                 goto mismatch;
 852         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 853                 goto mismatch;
 854         if (oldflags & ROOTCONTEXT_MNT) {
 855                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 856                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 857                 if (oldroot->sid != newroot->sid)
 858                         goto mismatch;
 859         }
 860         return 0;
 861 mismatch:
 862         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 863                             "different security settings for (dev %s, "
 864                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 865         return -EBUSY;
 866 }
 867
 868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 869                                         struct super_block *newsb)
 870 {
 871         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 872         struct superblock_security_struct *newsbsec = newsb->s_security;
 873
 874         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 875         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 876         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 877
 878         /*
 879          * if the parent was able to be mounted it clearly had no special lsm
 880          * mount options.  thus we can safely deal with this superblock later
 881          */
 882         if (!ss_initialized)
 883                 return 0;
 884
 885         /* how can we clone if the old one wasn't set up?? */
 886         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 887
 888         /* if fs is reusing a sb, make sure that the contexts match */
 889         if (newsbsec->flags & SE_SBINITIALIZED)
 890                 return selinux_cmp_sb_context(oldsb, newsb);
 891
 892         mutex_lock(&newsbsec->lock);
 893
 894         newsbsec->flags = oldsbsec->flags;
 895
 896         newsbsec->sid = oldsbsec->sid;
 897         newsbsec->def_sid = oldsbsec->def_sid;
 898         newsbsec->behavior = oldsbsec->behavior;
 899
 900         if (set_context) {
 901                 u32 sid = oldsbsec->mntpoint_sid;
 902
 903                 if (!set_fscontext)
 904                         newsbsec->sid = sid;
 905                 if (!set_rootcontext) {
 906                         struct inode *newinode = d_backing_inode(newsb->s_root);
 907                         struct inode_security_struct *newisec = newinode->i_security;
 908                         newisec->sid = sid;
 909                 }
 910                 newsbsec->mntpoint_sid = sid;
 911         }
 912         if (set_rootcontext) {
 913                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 914                 const struct inode_security_struct *oldisec = oldinode->i_security;
 915                 struct inode *newinode = d_backing_inode(newsb->s_root);
 916                 struct inode_security_struct *newisec = newinode->i_security;
 917
 918                 newisec->sid = oldisec->sid;
 919         }
 920
 921         sb_finish_set_opts(newsb);
 922         mutex_unlock(&newsbsec->lock);
 923         return 0;
 924 }
 925
 926 static int selinux_parse_opts_str(char *options,
 927                                   struct security_mnt_opts *opts)
 928 {
 929         char *p;
 930         char *context = NULL, *defcontext = NULL;
 931         char *fscontext = NULL, *rootcontext = NULL;
 932         int rc, num_mnt_opts = 0;
 933
 934         opts->num_mnt_opts = 0;
 935
 936         /* Standard string-based options. */
 937         while ((p = strsep(&options, "|")) != NULL) {
 938                 int token;
 939                 substring_t args[MAX_OPT_ARGS];
 940
 941                 if (!*p)
 942                         continue;
 943
 944                 token = match_token(p, tokens, args);
 945
 946                 switch (token) {
 947                 case Opt_context:
 948                         if (context || defcontext) {
 949                                 rc = -EINVAL;
 950                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 951                                 goto out_err;
 952                         }
 953                         context = match_strdup(&args[0]);
 954                         if (!context) {
 955                                 rc = -ENOMEM;
 956                                 goto out_err;
 957                         }
 958                         break;
 959
 960                 case Opt_fscontext:
 961                         if (fscontext) {
 962                                 rc = -EINVAL;
 963                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 964                                 goto out_err;
 965                         }
 966                         fscontext = match_strdup(&args[0]);
 967                         if (!fscontext) {
 968                                 rc = -ENOMEM;
 969                                 goto out_err;
 970                         }
 971                         break;
 972
 973                 case Opt_rootcontext:
 974                         if (rootcontext) {
 975                                 rc = -EINVAL;
 976                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 977                                 goto out_err;
 978                         }
 979                         rootcontext = match_strdup(&args[0]);
 980                         if (!rootcontext) {
 981                                 rc = -ENOMEM;
 982                                 goto out_err;
 983                         }
 984                         break;
 985
 986                 case Opt_defcontext:
 987                         if (context || defcontext) {
 988                                 rc = -EINVAL;
 989                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 990                                 goto out_err;
 991                         }
 992                         defcontext = match_strdup(&args[0]);
 993                         if (!defcontext) {
 994                                 rc = -ENOMEM;
 995                                 goto out_err;
 996                         }
 997                         break;
 998                 case Opt_labelsupport:
 999                         break;
1000                 default:
1001                         rc = -EINVAL;
1002                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1003                         goto out_err;
1004
1005                 }
1006         }
1007
1008         rc = -ENOMEM;
1009         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010         if (!opts->mnt_opts)
1011                 goto out_err;
1012
1013         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014         if (!opts->mnt_opts_flags) {
1015                 kfree(opts->mnt_opts);
1016                 goto out_err;
1017         }
1018
1019         if (fscontext) {
1020                 opts->mnt_opts[num_mnt_opts] = fscontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1022         }
1023         if (context) {
1024                 opts->mnt_opts[num_mnt_opts] = context;
1025                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1026         }
1027         if (rootcontext) {
1028                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1030         }
1031         if (defcontext) {
1032                 opts->mnt_opts[num_mnt_opts] = defcontext;
1033                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1034         }
1035
1036         opts->num_mnt_opts = num_mnt_opts;
1037         return 0;
1038
1039 out_err:
1040         kfree(context);
1041         kfree(defcontext);
1042         kfree(fscontext);
1043         kfree(rootcontext);
1044         return rc;
1045 }
1046 /*
1047  * string mount options parsing and call set the sbsec
1048  */
1049 static int superblock_doinit(struct super_block *sb, void *data)
1050 {
1051         int rc = 0;
1052         char *options = data;
1053         struct security_mnt_opts opts;
1054
1055         security_init_mnt_opts(&opts);
1056
1057         if (!data)
1058                 goto out;
1059
1060         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061
1062         rc = selinux_parse_opts_str(options, &opts);
1063         if (rc)
1064                 goto out_err;
1065
1066 out:
1067         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1068
1069 out_err:
1070         security_free_mnt_opts(&opts);
1071         return rc;
1072 }
1073
1074 static void selinux_write_opts(struct seq_file *m,
1075                                struct security_mnt_opts *opts)
1076 {
1077         int i;
1078         char *prefix;
1079
1080         for (i = 0; i < opts->num_mnt_opts; i++) {
1081                 char *has_comma;
1082
1083                 if (opts->mnt_opts[i])
1084                         has_comma = strchr(opts->mnt_opts[i], ',');
1085                 else
1086                         has_comma = NULL;
1087
1088                 switch (opts->mnt_opts_flags[i]) {
1089                 case CONTEXT_MNT:
1090                         prefix = CONTEXT_STR;
1091                         break;
1092                 case FSCONTEXT_MNT:
1093                         prefix = FSCONTEXT_STR;
1094                         break;
1095                 case ROOTCONTEXT_MNT:
1096                         prefix = ROOTCONTEXT_STR;
1097                         break;
1098                 case DEFCONTEXT_MNT:
1099                         prefix = DEFCONTEXT_STR;
1100                         break;
1101                 case SBLABEL_MNT:
1102                         seq_putc(m, ',');
1103                         seq_puts(m, LABELSUPP_STR);
1104                         continue;
1105                 default:
1106                         BUG();
1107                         return;
1108                 };
1109                 /* we need a comma before each option */
1110                 seq_putc(m, ',');
1111                 seq_puts(m, prefix);
1112                 if (has_comma)
1113                         seq_putc(m, '\"');
1114                 seq_puts(m, opts->mnt_opts[i]);
1115                 if (has_comma)
1116                         seq_putc(m, '\"');
1117         }
1118 }
1119
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121 {
1122         struct security_mnt_opts opts;
1123         int rc;
1124
1125         rc = selinux_get_mnt_opts(sb, &opts);
1126         if (rc) {
1127                 /* before policy load we may get EINVAL, don't show anything */
1128                 if (rc == -EINVAL)
1129                         rc = 0;
1130                 return rc;
1131         }
1132
1133         selinux_write_opts(m, &opts);
1134
1135         security_free_mnt_opts(&opts);
1136
1137         return rc;
1138 }
1139
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1141 {
1142         switch (mode & S_IFMT) {
1143         case S_IFSOCK:
1144                 return SECCLASS_SOCK_FILE;
1145         case S_IFLNK:
1146                 return SECCLASS_LNK_FILE;
1147         case S_IFREG:
1148                 return SECCLASS_FILE;
1149         case S_IFBLK:
1150                 return SECCLASS_BLK_FILE;
1151         case S_IFDIR:
1152                 return SECCLASS_DIR;
1153         case S_IFCHR:
1154                 return SECCLASS_CHR_FILE;
1155         case S_IFIFO:
1156                 return SECCLASS_FIFO_FILE;
1157
1158         }
1159
1160         return SECCLASS_FILE;
1161 }
1162
1163 static inline int default_protocol_stream(int protocol)
1164 {
1165         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166 }
1167
1168 static inline int default_protocol_dgram(int protocol)
1169 {
1170         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171 }
1172
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174 {
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                         return SECCLASS_UNIX_DGRAM_SOCKET;
1183                 }
1184                 break;
1185         case PF_INET:
1186         case PF_INET6:
1187                 switch (type) {
1188                 case SOCK_STREAM:
1189                         if (default_protocol_stream(protocol))
1190                                 return SECCLASS_TCP_SOCKET;
1191                         else
1192                                 return SECCLASS_RAWIP_SOCKET;
1193                 case SOCK_DGRAM:
1194                         if (default_protocol_dgram(protocol))
1195                                 return SECCLASS_UDP_SOCKET;
1196                         else
1197                                 return SECCLASS_RAWIP_SOCKET;
1198                 case SOCK_DCCP:
1199                         return SECCLASS_DCCP_SOCKET;
1200                 default:
1201                         return SECCLASS_RAWIP_SOCKET;
1202                 }
1203                 break;
1204         case PF_NETLINK:
1205                 switch (protocol) {
1206                 case NETLINK_ROUTE:
1207                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1208                 case NETLINK_SOCK_DIAG:
1209                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210                 case NETLINK_NFLOG:
1211                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1212                 case NETLINK_XFRM:
1213                         return SECCLASS_NETLINK_XFRM_SOCKET;
1214                 case NETLINK_SELINUX:
1215                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1216                 case NETLINK_ISCSI:
1217                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1218                 case NETLINK_AUDIT:
1219                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1220                 case NETLINK_FIB_LOOKUP:
1221                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222                 case NETLINK_CONNECTOR:
1223                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224                 case NETLINK_NETFILTER:
1225                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226                 case NETLINK_DNRTMSG:
1227                         return SECCLASS_NETLINK_DNRT_SOCKET;
1228                 case NETLINK_KOBJECT_UEVENT:
1229                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230                 case NETLINK_GENERIC:
1231                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1232                 case NETLINK_SCSITRANSPORT:
1233                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234                 case NETLINK_RDMA:
1235                         return SECCLASS_NETLINK_RDMA_SOCKET;
1236                 case NETLINK_CRYPTO:
1237                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1238                 default:
1239                         return SECCLASS_NETLINK_SOCKET;
1240                 }
1241         case PF_PACKET:
1242                 return SECCLASS_PACKET_SOCKET;
1243         case PF_KEY:
1244                 return SECCLASS_KEY_SOCKET;
1245         case PF_APPLETALK:
1246                 return SECCLASS_APPLETALK_SOCKET;
1247         }
1248
1249         return SECCLASS_SOCKET;
1250 }
1251
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1253                                  u16 tclass,
1254                                  u16 flags,
1255                                  u32 *sid)
1256 {
1257         int rc;
1258         struct super_block *sb = dentry->d_inode->i_sb;
1259         char *buffer, *path;
1260
1261         buffer = (char *)__get_free_page(GFP_KERNEL);
1262         if (!buffer)
1263                 return -ENOMEM;
1264
1265         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266         if (IS_ERR(path))
1267                 rc = PTR_ERR(path);
1268         else {
1269                 if (flags & SE_SBPROC) {
1270                         /* each process gets a /proc/PID/ entry. Strip off the
1271                          * PID part to get a valid selinux labeling.
1272                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273                         while (path[1] >= '0' && path[1] <= '9') {
1274                                 path[1] = '/';
1275                                 path++;
1276                         }
1277                 }
1278                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1279         }
1280         free_page((unsigned long)buffer);
1281         return rc;
1282 }
1283
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286 {
1287         struct superblock_security_struct *sbsec = NULL;
1288         struct inode_security_struct *isec = inode->i_security;
1289         u32 sid;
1290         struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292         char *context = NULL;
1293         unsigned len = 0;
1294         int rc = 0;
1295
1296         if (isec->initialized)
1297                 goto out;
1298
1299         mutex_lock(&isec->lock);
1300         if (isec->initialized)
1301                 goto out_unlock;
1302
1303         sbsec = inode->i_sb->s_security;
1304         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305                 /* Defer initialization until selinux_complete_init,
1306                    after the initial policy is loaded and the security
1307                    server is ready to handle calls. */
1308                 spin_lock(&sbsec->isec_lock);
1309                 if (list_empty(&isec->list))
1310                         list_add(&isec->list, &sbsec->isec_head);
1311                 spin_unlock(&sbsec->isec_lock);
1312                 goto out_unlock;
1313         }
1314
1315         switch (sbsec->behavior) {
1316         case SECURITY_FS_USE_NATIVE:
1317                 break;
1318         case SECURITY_FS_USE_XATTR:
1319                 if (!inode->i_op->getxattr) {
1320                         isec->sid = sbsec->def_sid;
1321                         break;
1322                 }
1323
1324                 /* Need a dentry, since the xattr API requires one.
1325                    Life would be simpler if we could just pass the inode. */
1326                 if (opt_dentry) {
1327                         /* Called from d_instantiate or d_splice_alias. */
1328                         dentry = dget(opt_dentry);
1329                 } else {
1330                         /* Called from selinux_complete_init, try to find a dentry. */
1331                         dentry = d_find_alias(inode);
1332                 }
1333                 if (!dentry) {
1334                         /*
1335                          * this is can be hit on boot when a file is accessed
1336                          * before the policy is loaded.  When we load policy we
1337                          * may find inodes that have no dentry on the
1338                          * sbsec->isec_head list.  No reason to complain as these
1339                          * will get fixed up the next time we go through
1340                          * inode_doinit with a dentry, before these inodes could
1341                          * be used again by userspace.
1342                          */
1343                         goto out_unlock;
1344                 }
1345
1346                 len = INITCONTEXTLEN;
1347                 context = kmalloc(len+1, GFP_NOFS);
1348                 if (!context) {
1349                         rc = -ENOMEM;
1350                         dput(dentry);
1351                         goto out_unlock;
1352                 }
1353                 context[len] = '\0';
1354                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355                                            context, len);
1356                 if (rc == -ERANGE) {
1357                         kfree(context);
1358
1359                         /* Need a larger buffer.  Query for the right size. */
1360                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361                                                    NULL, 0);
1362                         if (rc < 0) {
1363                                 dput(dentry);
1364                                 goto out_unlock;
1365                         }
1366                         len = rc;
1367                         context = kmalloc(len+1, GFP_NOFS);
1368                         if (!context) {
1369                                 rc = -ENOMEM;
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         context[len] = '\0';
1374                         rc = inode->i_op->getxattr(dentry,
1375                                                    XATTR_NAME_SELINUX,
1376                                                    context, len);
1377                 }
1378                 dput(dentry);
1379                 if (rc < 0) {
1380                         if (rc != -ENODATA) {
1381                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1382                                        "%d for dev=%s ino=%ld\n", __func__,
1383                                        -rc, inode->i_sb->s_id, inode->i_ino);
1384                                 kfree(context);
1385                                 goto out_unlock;
1386                         }
1387                         /* Map ENODATA to the default file SID */
1388                         sid = sbsec->def_sid;
1389                         rc = 0;
1390                 } else {
1391                         rc = security_context_to_sid_default(context, rc, &sid,
1392                                                              sbsec->def_sid,
1393                                                              GFP_NOFS);
1394                         if (rc) {
1395                                 char *dev = inode->i_sb->s_id;
1396                                 unsigned long ino = inode->i_ino;
1397
1398                                 if (rc == -EINVAL) {
1399                                         if (printk_ratelimit())
1400                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1402                                                         "filesystem in question.\n", ino, dev, context);
1403                                 } else {
1404                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1405                                                "returned %d for dev=%s ino=%ld\n",
1406                                                __func__, context, -rc, dev, ino);
1407                                 }
1408                                 kfree(context);
1409                                 /* Leave with the unlabeled SID */
1410                                 rc = 0;
1411                                 break;
1412                         }
1413                 }
1414                 kfree(context);
1415                 isec->sid = sid;
1416                 break;
1417         case SECURITY_FS_USE_TASK:
1418                 isec->sid = isec->task_sid;
1419                 break;
1420         case SECURITY_FS_USE_TRANS:
1421                 /* Default to the fs SID. */
1422                 isec->sid = sbsec->sid;
1423
1424                 /* Try to obtain a transition SID. */
1425                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427                                              isec->sclass, NULL, &sid);
1428                 if (rc)
1429                         goto out_unlock;
1430                 isec->sid = sid;
1431                 break;
1432         case SECURITY_FS_USE_MNTPOINT:
1433                 isec->sid = sbsec->mntpoint_sid;
1434                 break;
1435         default:
1436                 /* Default to the fs superblock SID. */
1437                 isec->sid = sbsec->sid;
1438
1439                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440                         /* We must have a dentry to determine the label on
1441                          * procfs inodes */
1442                         if (opt_dentry)
1443                                 /* Called from d_instantiate or
1444                                  * d_splice_alias. */
1445                                 dentry = dget(opt_dentry);
1446                         else
1447                                 /* Called from selinux_complete_init, try to
1448                                  * find a dentry. */
1449                                 dentry = d_find_alias(inode);
1450                         /*
1451                          * This can be hit on boot when a file is accessed
1452                          * before the policy is loaded.  When we load policy we
1453                          * may find inodes that have no dentry on the
1454                          * sbsec->isec_head list.  No reason to complain as
1455                          * these will get fixed up the next time we go through
1456                          * inode_doinit() with a dentry, before these inodes
1457                          * could be used again by userspace.
1458                          */
1459                         if (!dentry)
1460                                 goto out_unlock;
1461                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463                                                    sbsec->flags, &sid);
1464                         dput(dentry);
1465                         if (rc)
1466                                 goto out_unlock;
1467                         isec->sid = sid;
1468                 }
1469                 break;
1470         }
1471
1472         isec->initialized = 1;
1473
1474 out_unlock:
1475         mutex_unlock(&isec->lock);
1476 out:
1477         if (isec->sclass == SECCLASS_FILE)
1478                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1479         return rc;
1480 }
1481
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1484 {
1485         u32 perm = 0;
1486
1487         switch (sig) {
1488         case SIGCHLD:
1489                 /* Commonly granted from child to parent. */
1490                 perm = PROCESS__SIGCHLD;
1491                 break;
1492         case SIGKILL:
1493                 /* Cannot be caught or ignored */
1494                 perm = PROCESS__SIGKILL;
1495                 break;
1496         case SIGSTOP:
1497                 /* Cannot be caught or ignored */
1498                 perm = PROCESS__SIGSTOP;
1499                 break;
1500         default:
1501                 /* All other signals. */
1502                 perm = PROCESS__SIGNAL;
1503                 break;
1504         }
1505
1506         return perm;
1507 }
1508
1509 /*
1510  * Check permission between a pair of credentials
1511  * fork check, ptrace check, etc.
1512  */
1513 static int cred_has_perm(const struct cred *actor,
1514                          const struct cred *target,
1515                          u32 perms)
1516 {
1517         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518
1519         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523  * Check permission between a pair of tasks, e.g. signal checks,
1524  * fork check, ptrace check, etc.
1525  * tsk1 is the actor and tsk2 is the target
1526  * - this uses the default subjective creds of tsk1
1527  */
1528 static int task_has_perm(const struct task_struct *tsk1,
1529                          const struct task_struct *tsk2,
1530                          u32 perms)
1531 {
1532         const struct task_security_struct *__tsec1, *__tsec2;
1533         u32 sid1, sid2;
1534
1535         rcu_read_lock();
1536         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1537         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1538         rcu_read_unlock();
1539         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1540 }
1541
1542 /*
1543  * Check permission between current and another task, e.g. signal checks,
1544  * fork check, ptrace check, etc.
1545  * current is the actor and tsk2 is the target
1546  * - this uses current's subjective creds
1547  */
1548 static int current_has_perm(const struct task_struct *tsk,
1549                             u32 perms)
1550 {
1551         u32 sid, tsid;
1552
1553         sid = current_sid();
1554         tsid = task_sid(tsk);
1555         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556 }
1557
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1560 #endif
1561
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1564                                int cap, int audit)
1565 {
1566         struct common_audit_data ad;
1567         struct av_decision avd;
1568         u16 sclass;
1569         u32 sid = cred_sid(cred);
1570         u32 av = CAP_TO_MASK(cap);
1571         int rc;
1572
1573         ad.type = LSM_AUDIT_DATA_CAP;
1574         ad.u.cap = cap;
1575
1576         switch (CAP_TO_INDEX(cap)) {
1577         case 0:
1578                 sclass = SECCLASS_CAPABILITY;
1579                 break;
1580         case 1:
1581                 sclass = SECCLASS_CAPABILITY2;
1582                 break;
1583         default:
1584                 printk(KERN_ERR
1585                        "SELinux:  out of range capability %d\n", cap);
1586                 BUG();
1587                 return -EINVAL;
1588         }
1589
1590         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591         if (audit == SECURITY_CAP_AUDIT) {
1592                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1593                 if (rc2)
1594                         return rc2;
1595         }
1596         return rc;
1597 }
1598
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1601                            u32 perms)
1602 {
1603         u32 sid = task_sid(tsk);
1604
1605         return avc_has_perm(sid, SECINITSID_KERNEL,
1606                             SECCLASS_SYSTEM, perms, NULL);
1607 }
1608
1609 /* Check whether a task has a particular permission to an inode.
1610    The 'adp' parameter is optional and allows other audit
1611    data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613                           struct inode *inode,
1614                           u32 perms,
1615                           struct common_audit_data *adp)
1616 {
1617         struct inode_security_struct *isec;
1618         u32 sid;
1619
1620         validate_creds(cred);
1621
1622         if (unlikely(IS_PRIVATE(inode)))
1623                 return 0;
1624
1625         sid = cred_sid(cred);
1626         isec = inode->i_security;
1627
1628         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1629 }
1630
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632    the dentry to help the auditing code to more easily generate the
1633    pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635                                   struct dentry *dentry,
1636                                   u32 av)
1637 {
1638         struct inode *inode = d_backing_inode(dentry);
1639         struct common_audit_data ad;
1640
1641         ad.type = LSM_AUDIT_DATA_DENTRY;
1642         ad.u.dentry = dentry;
1643         return inode_has_perm(cred, inode, av, &ad);
1644 }
1645
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647    the path to help the auditing code to more easily generate the
1648    pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650                                 const struct path *path,
1651                                 u32 av)
1652 {
1653         struct inode *inode = d_backing_inode(path->dentry);
1654         struct common_audit_data ad;
1655
1656         ad.type = LSM_AUDIT_DATA_PATH;
1657         ad.u.path = *path;
1658         return inode_has_perm(cred, inode, av, &ad);
1659 }
1660
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1663                                      struct file *file,
1664                                      u32 av)
1665 {
1666         struct common_audit_data ad;
1667
1668         ad.type = LSM_AUDIT_DATA_PATH;
1669         ad.u.path = file->f_path;
1670         return inode_has_perm(cred, file_inode(file), av, &ad);
1671 }
1672
1673 /* Check whether a task can use an open file descriptor to
1674    access an inode in a given way.  Check access to the
1675    descriptor itself, and then use dentry_has_perm to
1676    check a particular permission to the file.
1677    Access to the descriptor is implicitly granted if it
1678    has the same SID as the process.  If av is zero, then
1679    access to the file is not checked, e.g. for cases
1680    where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1682                          struct file *file,
1683                          u32 av)
1684 {
1685         struct file_security_struct *fsec = file->f_security;
1686         struct inode *inode = file_inode(file);
1687         struct common_audit_data ad;
1688         u32 sid = cred_sid(cred);
1689         int rc;
1690
1691         ad.type = LSM_AUDIT_DATA_PATH;
1692         ad.u.path = file->f_path;
1693
1694         if (sid != fsec->sid) {
1695                 rc = avc_has_perm(sid, fsec->sid,
1696                                   SECCLASS_FD,
1697                                   FD__USE,
1698                                   &ad);
1699                 if (rc)
1700                         goto out;
1701         }
1702
1703         /* av is zero if only checking access to the descriptor. */
1704         rc = 0;
1705         if (av)
1706                 rc = inode_has_perm(cred, inode, av, &ad);
1707
1708 out:
1709         return rc;
1710 }
1711
1712 /* Check whether a task can create a file. */
1713 static int may_create(struct inode *dir,
1714                       struct dentry *dentry,
1715                       u16 tclass)
1716 {
1717         const struct task_security_struct *tsec = current_security();
1718         struct inode_security_struct *dsec;
1719         struct superblock_security_struct *sbsec;
1720         u32 sid, newsid;
1721         struct common_audit_data ad;
1722         int rc;
1723
1724         dsec = dir->i_security;
1725         sbsec = dir->i_sb->s_security;
1726
1727         sid = tsec->sid;
1728         newsid = tsec->create_sid;
1729
1730         ad.type = LSM_AUDIT_DATA_DENTRY;
1731         ad.u.dentry = dentry;
1732
1733         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1734                           DIR__ADD_NAME | DIR__SEARCH,
1735                           &ad);
1736         if (rc)
1737                 return rc;
1738
1739         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1740                 rc = security_transition_sid(sid, dsec->sid, tclass,
1741                                              &dentry->d_name, &newsid);
1742                 if (rc)
1743                         return rc;
1744         }
1745
1746         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1747         if (rc)
1748                 return rc;
1749
1750         return avc_has_perm(newsid, sbsec->sid,
1751                             SECCLASS_FILESYSTEM,
1752                             FILESYSTEM__ASSOCIATE, &ad);
1753 }
1754
1755 /* Check whether a task can create a key. */
1756 static int may_create_key(u32 ksid,
1757                           struct task_struct *ctx)
1758 {
1759         u32 sid = task_sid(ctx);
1760
1761         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1762 }
1763
1764 #define MAY_LINK        0
1765 #define MAY_UNLINK      1
1766 #define MAY_RMDIR       2
1767
1768 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1769 static int may_link(struct inode *dir,
1770                     struct dentry *dentry,
1771                     int kind)
1772
1773 {
1774         struct inode_security_struct *dsec, *isec;
1775         struct common_audit_data ad;
1776         u32 sid = current_sid();
1777         u32 av;
1778         int rc;
1779
1780         dsec = dir->i_security;
1781         isec = d_backing_inode(dentry)->i_security;
1782
1783         ad.type = LSM_AUDIT_DATA_DENTRY;
1784         ad.u.dentry = dentry;
1785
1786         av = DIR__SEARCH;
1787         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1788         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1789         if (rc)
1790                 return rc;
1791
1792         switch (kind) {
1793         case MAY_LINK:
1794                 av = FILE__LINK;
1795                 break;
1796         case MAY_UNLINK:
1797                 av = FILE__UNLINK;
1798                 break;
1799         case MAY_RMDIR:
1800                 av = DIR__RMDIR;
1801                 break;
1802         default:
1803                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1804                         __func__, kind);
1805                 return 0;
1806         }
1807
1808         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1809         return rc;
1810 }
1811
1812 static inline int may_rename(struct inode *old_dir,
1813                              struct dentry *old_dentry,
1814                              struct inode *new_dir,
1815                              struct dentry *new_dentry)
1816 {
1817         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1818         struct common_audit_data ad;
1819         u32 sid = current_sid();
1820         u32 av;
1821         int old_is_dir, new_is_dir;
1822         int rc;
1823
1824         old_dsec = old_dir->i_security;
1825         old_isec = d_backing_inode(old_dentry)->i_security;
1826         old_is_dir = d_is_dir(old_dentry);
1827         new_dsec = new_dir->i_security;
1828
1829         ad.type = LSM_AUDIT_DATA_DENTRY;
1830
1831         ad.u.dentry = old_dentry;
1832         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1833                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1834         if (rc)
1835                 return rc;
1836         rc = avc_has_perm(sid, old_isec->sid,
1837                           old_isec->sclass, FILE__RENAME, &ad);
1838         if (rc)
1839                 return rc;
1840         if (old_is_dir && new_dir != old_dir) {
1841                 rc = avc_has_perm(sid, old_isec->sid,
1842                                   old_isec->sclass, DIR__REPARENT, &ad);
1843                 if (rc)
1844                         return rc;
1845         }
1846
1847         ad.u.dentry = new_dentry;
1848         av = DIR__ADD_NAME | DIR__SEARCH;
1849         if (d_is_positive(new_dentry))
1850                 av |= DIR__REMOVE_NAME;
1851         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1852         if (rc)
1853                 return rc;
1854         if (d_is_positive(new_dentry)) {
1855                 new_isec = d_backing_inode(new_dentry)->i_security;
1856                 new_is_dir = d_is_dir(new_dentry);
1857                 rc = avc_has_perm(sid, new_isec->sid,
1858                                   new_isec->sclass,
1859                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1860                 if (rc)
1861                         return rc;
1862         }
1863
1864         return 0;
1865 }
1866
1867 /* Check whether a task can perform a filesystem operation. */
1868 static int superblock_has_perm(const struct cred *cred,
1869                                struct super_block *sb,
1870                                u32 perms,
1871                                struct common_audit_data *ad)
1872 {
1873         struct superblock_security_struct *sbsec;
1874         u32 sid = cred_sid(cred);
1875
1876         sbsec = sb->s_security;
1877         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1878 }
1879
1880 /* Convert a Linux mode and permission mask to an access vector. */
1881 static inline u32 file_mask_to_av(int mode, int mask)
1882 {
1883         u32 av = 0;
1884
1885         if (!S_ISDIR(mode)) {
1886                 if (mask & MAY_EXEC)
1887                         av |= FILE__EXECUTE;
1888                 if (mask & MAY_READ)
1889                         av |= FILE__READ;
1890
1891                 if (mask & MAY_APPEND)
1892                         av |= FILE__APPEND;
1893                 else if (mask & MAY_WRITE)
1894                         av |= FILE__WRITE;
1895
1896         } else {
1897                 if (mask & MAY_EXEC)
1898                         av |= DIR__SEARCH;
1899                 if (mask & MAY_WRITE)
1900                         av |= DIR__WRITE;
1901                 if (mask & MAY_READ)
1902                         av |= DIR__READ;
1903         }
1904
1905         return av;
1906 }
1907
1908 /* Convert a Linux file to an access vector. */
1909 static inline u32 file_to_av(struct file *file)
1910 {
1911         u32 av = 0;
1912
1913         if (file->f_mode & FMODE_READ)
1914                 av |= FILE__READ;
1915         if (file->f_mode & FMODE_WRITE) {
1916                 if (file->f_flags & O_APPEND)
1917                         av |= FILE__APPEND;
1918                 else
1919                         av |= FILE__WRITE;
1920         }
1921         if (!av) {
1922                 /*
1923                  * Special file opened with flags 3 for ioctl-only use.
1924                  */
1925                 av = FILE__IOCTL;
1926         }
1927
1928         return av;
1929 }
1930
1931 /*
1932  * Convert a file to an access vector and include the correct open
1933  * open permission.
1934  */
1935 static inline u32 open_file_to_av(struct file *file)
1936 {
1937         u32 av = file_to_av(file);
1938
1939         if (selinux_policycap_openperm)
1940                 av |= FILE__OPEN;
1941
1942         return av;
1943 }
1944
1945 /* Hook functions begin here. */
1946
1947 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1948 {
1949         u32 mysid = current_sid();
1950         u32 mgrsid = task_sid(mgr);
1951
1952         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1953                             BINDER__SET_CONTEXT_MGR, NULL);
1954 }
1955
1956 static int selinux_binder_transaction(struct task_struct *from,
1957                                       struct task_struct *to)
1958 {
1959         u32 mysid = current_sid();
1960         u32 fromsid = task_sid(from);
1961         u32 tosid = task_sid(to);
1962         int rc;
1963
1964         if (mysid != fromsid) {
1965                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1966                                   BINDER__IMPERSONATE, NULL);
1967                 if (rc)
1968                         return rc;
1969         }
1970
1971         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1972                             NULL);
1973 }
1974
1975 static int selinux_binder_transfer_binder(struct task_struct *from,
1976                                           struct task_struct *to)
1977 {
1978         u32 fromsid = task_sid(from);
1979         u32 tosid = task_sid(to);
1980
1981         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1982                             NULL);
1983 }
1984
1985 static int selinux_binder_transfer_file(struct task_struct *from,
1986                                         struct task_struct *to,
1987                                         struct file *file)
1988 {
1989         u32 sid = task_sid(to);
1990         struct file_security_struct *fsec = file->f_security;
1991         struct inode *inode = d_backing_inode(file->f_path.dentry);
1992         struct inode_security_struct *isec = inode->i_security;
1993         struct common_audit_data ad;
1994         int rc;
1995
1996         ad.type = LSM_AUDIT_DATA_PATH;
1997         ad.u.path = file->f_path;
1998
1999         if (sid != fsec->sid) {
2000                 rc = avc_has_perm(sid, fsec->sid,
2001                                   SECCLASS_FD,
2002                                   FD__USE,
2003                                   &ad);
2004                 if (rc)
2005                         return rc;
2006         }
2007
2008         if (unlikely(IS_PRIVATE(inode)))
2009                 return 0;
2010
2011         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2012                             &ad);
2013 }
2014
2015 static int selinux_ptrace_access_check(struct task_struct *child,
2016                                      unsigned int mode)
2017 {
2018         if (mode & PTRACE_MODE_READ) {
2019                 u32 sid = current_sid();
2020                 u32 csid = task_sid(child);
2021                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2022         }
2023
2024         return current_has_perm(child, PROCESS__PTRACE);
2025 }
2026
2027 static int selinux_ptrace_traceme(struct task_struct *parent)
2028 {
2029         return task_has_perm(parent, current, PROCESS__PTRACE);
2030 }
2031
2032 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2033                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2034 {
2035         return current_has_perm(target, PROCESS__GETCAP);
2036 }
2037
2038 static int selinux_capset(struct cred *new, const struct cred *old,
2039                           const kernel_cap_t *effective,
2040                           const kernel_cap_t *inheritable,
2041                           const kernel_cap_t *permitted)
2042 {
2043         return cred_has_perm(old, new, PROCESS__SETCAP);
2044 }
2045
2046 /*
2047  * (This comment used to live with the selinux_task_setuid hook,
2048  * which was removed).
2049  *
2050  * Since setuid only affects the current process, and since the SELinux
2051  * controls are not based on the Linux identity attributes, SELinux does not
2052  * need to control this operation.  However, SELinux does control the use of
2053  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2054  */
2055
2056 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2057                            int cap, int audit)
2058 {
2059         return cred_has_capability(cred, cap, audit);
2060 }
2061
2062 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2063 {
2064         const struct cred *cred = current_cred();
2065         int rc = 0;
2066
2067         if (!sb)
2068                 return 0;
2069
2070         switch (cmds) {
2071         case Q_SYNC:
2072         case Q_QUOTAON:
2073         case Q_QUOTAOFF:
2074         case Q_SETINFO:
2075         case Q_SETQUOTA:
2076                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2077                 break;
2078         case Q_GETFMT:
2079         case Q_GETINFO:
2080         case Q_GETQUOTA:
2081                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2082                 break;
2083         default:
2084                 rc = 0;  /* let the kernel handle invalid cmds */
2085                 break;
2086         }
2087         return rc;
2088 }
2089
2090 static int selinux_quota_on(struct dentry *dentry)
2091 {
2092         const struct cred *cred = current_cred();
2093
2094         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2095 }
2096
2097 static int selinux_syslog(int type)
2098 {
2099         int rc;
2100
2101         switch (type) {
2102         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2103         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2104                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2105                 break;
2106         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2107         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2108         /* Set level of messages printed to console */
2109         case SYSLOG_ACTION_CONSOLE_LEVEL:
2110                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2111                 break;
2112         case SYSLOG_ACTION_CLOSE:       /* Close log */
2113         case SYSLOG_ACTION_OPEN:        /* Open log */
2114         case SYSLOG_ACTION_READ:        /* Read from log */
2115         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2116         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2117         default:
2118                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2119                 break;
2120         }
2121         return rc;
2122 }
2123
2124 /*
2125  * Check that a process has enough memory to allocate a new virtual
2126  * mapping. 0 means there is enough memory for the allocation to
2127  * succeed and -ENOMEM implies there is not.
2128  *
2129  * Do not audit the selinux permission check, as this is applied to all
2130  * processes that allocate mappings.
2131  */
2132 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2133 {
2134         int rc, cap_sys_admin = 0;
2135
2136         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2137                                         SECURITY_CAP_NOAUDIT);
2138         if (rc == 0)
2139                 cap_sys_admin = 1;
2140
2141         return cap_sys_admin;
2142 }
2143
2144 /* binprm security operations */
2145
2146 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2147                             const struct task_security_struct *old_tsec,
2148                             const struct task_security_struct *new_tsec)
2149 {
2150         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2151         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2152         int rc;
2153
2154         if (!nnp && !nosuid)
2155                 return 0; /* neither NNP nor nosuid */
2156
2157         if (new_tsec->sid == old_tsec->sid)
2158                 return 0; /* No change in credentials */
2159
2160         /*
2161          * The only transitions we permit under NNP or nosuid
2162          * are transitions to bounded SIDs, i.e. SIDs that are
2163          * guaranteed to only be allowed a subset of the permissions
2164          * of the current SID.
2165          */
2166         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2167         if (rc) {
2168                 /*
2169                  * On failure, preserve the errno values for NNP vs nosuid.
2170                  * NNP:  Operation not permitted for caller.
2171                  * nosuid:  Permission denied to file.
2172                  */
2173                 if (nnp)
2174                         return -EPERM;
2175                 else
2176                         return -EACCES;
2177         }
2178         return 0;
2179 }
2180
2181 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2182 {
2183         const struct task_security_struct *old_tsec;
2184         struct task_security_struct *new_tsec;
2185         struct inode_security_struct *isec;
2186         struct common_audit_data ad;
2187         struct inode *inode = file_inode(bprm->file);
2188         int rc;
2189
2190         /* SELinux context only depends on initial program or script and not
2191          * the script interpreter */
2192         if (bprm->cred_prepared)
2193                 return 0;
2194
2195         old_tsec = current_security();
2196         new_tsec = bprm->cred->security;
2197         isec = inode->i_security;
2198
2199         /* Default to the current task SID. */
2200         new_tsec->sid = old_tsec->sid;
2201         new_tsec->osid = old_tsec->sid;
2202
2203         /* Reset fs, key, and sock SIDs on execve. */
2204         new_tsec->create_sid = 0;
2205         new_tsec->keycreate_sid = 0;
2206         new_tsec->sockcreate_sid = 0;
2207
2208         if (old_tsec->exec_sid) {
2209                 new_tsec->sid = old_tsec->exec_sid;
2210                 /* Reset exec SID on execve. */
2211                 new_tsec->exec_sid = 0;
2212
2213                 /* Fail on NNP or nosuid if not an allowed transition. */
2214                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2215                 if (rc)
2216                         return rc;
2217         } else {
2218                 /* Check for a default transition on this program. */
2219                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2220                                              SECCLASS_PROCESS, NULL,
2221                                              &new_tsec->sid);
2222                 if (rc)
2223                         return rc;
2224
2225                 /*
2226                  * Fallback to old SID on NNP or nosuid if not an allowed
2227                  * transition.
2228                  */
2229                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2230                 if (rc)
2231                         new_tsec->sid = old_tsec->sid;
2232         }
2233
2234         ad.type = LSM_AUDIT_DATA_PATH;
2235         ad.u.path = bprm->file->f_path;
2236
2237         if (new_tsec->sid == old_tsec->sid) {
2238                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2239                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2240                 if (rc)
2241                         return rc;
2242         } else {
2243                 /* Check permissions for the transition. */
2244                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2245                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2246                 if (rc)
2247                         return rc;
2248
2249                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2250                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2251                 if (rc)
2252                         return rc;
2253
2254                 /* Check for shared state */
2255                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2256                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2257                                           SECCLASS_PROCESS, PROCESS__SHARE,
2258                                           NULL);
2259                         if (rc)
2260                                 return -EPERM;
2261                 }
2262
2263                 /* Make sure that anyone attempting to ptrace over a task that
2264                  * changes its SID has the appropriate permit */
2265                 if (bprm->unsafe &
2266                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2267                         struct task_struct *tracer;
2268                         struct task_security_struct *sec;
2269                         u32 ptsid = 0;
2270
2271                         rcu_read_lock();
2272                         tracer = ptrace_parent(current);
2273                         if (likely(tracer != NULL)) {
2274                                 sec = __task_cred(tracer)->security;
2275                                 ptsid = sec->sid;
2276                         }
2277                         rcu_read_unlock();
2278
2279                         if (ptsid != 0) {
2280                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2281                                                   SECCLASS_PROCESS,
2282                                                   PROCESS__PTRACE, NULL);
2283                                 if (rc)
2284                                         return -EPERM;
2285                         }
2286                 }
2287
2288                 /* Clear any possibly unsafe personality bits on exec: */
2289                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2290         }
2291
2292         return 0;
2293 }
2294
2295 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2296 {
2297         const struct task_security_struct *tsec = current_security();
2298         u32 sid, osid;
2299         int atsecure = 0;
2300
2301         sid = tsec->sid;
2302         osid = tsec->osid;
2303
2304         if (osid != sid) {
2305                 /* Enable secure mode for SIDs transitions unless
2306                    the noatsecure permission is granted between
2307                    the two SIDs, i.e. ahp returns 0. */
2308                 atsecure = avc_has_perm(osid, sid,
2309                                         SECCLASS_PROCESS,
2310                                         PROCESS__NOATSECURE, NULL);
2311         }
2312
2313         return !!atsecure;
2314 }
2315
2316 static int match_file(const void *p, struct file *file, unsigned fd)
2317 {
2318         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2319 }
2320
2321 /* Derived from fs/exec.c:flush_old_files. */
2322 static inline void flush_unauthorized_files(const struct cred *cred,
2323                                             struct files_struct *files)
2324 {
2325         struct file *file, *devnull = NULL;
2326         struct tty_struct *tty;
2327         int drop_tty = 0;
2328         unsigned n;
2329
2330         tty = get_current_tty();
2331         if (tty) {
2332                 spin_lock(&tty_files_lock);
2333                 if (!list_empty(&tty->tty_files)) {
2334                         struct tty_file_private *file_priv;
2335
2336                         /* Revalidate access to controlling tty.
2337                            Use file_path_has_perm on the tty path directly
2338                            rather than using file_has_perm, as this particular
2339                            open file may belong to another process and we are
2340                            only interested in the inode-based check here. */
2341                         file_priv = list_first_entry(&tty->tty_files,
2342                                                 struct tty_file_private, list);
2343                         file = file_priv->file;
2344                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2345                                 drop_tty = 1;
2346                 }
2347                 spin_unlock(&tty_files_lock);
2348                 tty_kref_put(tty);
2349         }
2350         /* Reset controlling tty. */
2351         if (drop_tty)
2352                 no_tty();
2353
2354         /* Revalidate access to inherited open files. */
2355         n = iterate_fd(files, 0, match_file, cred);
2356         if (!n) /* none found? */
2357                 return;
2358
2359         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2360         if (IS_ERR(devnull))
2361                 devnull = NULL;
2362         /* replace all the matching ones with this */
2363         do {
2364                 replace_fd(n - 1, devnull, 0);
2365         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2366         if (devnull)
2367                 fput(devnull);
2368 }
2369
2370 /*
2371  * Prepare a process for imminent new credential changes due to exec
2372  */
2373 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2374 {
2375         struct task_security_struct *new_tsec;
2376         struct rlimit *rlim, *initrlim;
2377         int rc, i;
2378
2379         new_tsec = bprm->cred->security;
2380         if (new_tsec->sid == new_tsec->osid)
2381                 return;
2382
2383         /* Close files for which the new task SID is not authorized. */
2384         flush_unauthorized_files(bprm->cred, current->files);
2385
2386         /* Always clear parent death signal on SID transitions. */
2387         current->pdeath_signal = 0;
2388
2389         /* Check whether the new SID can inherit resource limits from the old
2390          * SID.  If not, reset all soft limits to the lower of the current
2391          * task's hard limit and the init task's soft limit.
2392          *
2393          * Note that the setting of hard limits (even to lower them) can be
2394          * controlled by the setrlimit check.  The inclusion of the init task's
2395          * soft limit into the computation is to avoid resetting soft limits
2396          * higher than the default soft limit for cases where the default is
2397          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2398          */
2399         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2400                           PROCESS__RLIMITINH, NULL);
2401         if (rc) {
2402                 /* protect against do_prlimit() */
2403                 task_lock(current);
2404                 for (i = 0; i < RLIM_NLIMITS; i++) {
2405                         rlim = current->signal->rlim + i;
2406                         initrlim = init_task.signal->rlim + i;
2407                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2408                 }
2409                 task_unlock(current);
2410                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2411         }
2412 }
2413
2414 /*
2415  * Clean up the process immediately after the installation of new credentials
2416  * due to exec
2417  */
2418 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2419 {
2420         const struct task_security_struct *tsec = current_security();
2421         struct itimerval itimer;
2422         u32 osid, sid;
2423         int rc, i;
2424
2425         osid = tsec->osid;
2426         sid = tsec->sid;
2427
2428         if (sid == osid)
2429                 return;
2430
2431         /* Check whether the new SID can inherit signal state from the old SID.
2432          * If not, clear itimers to avoid subsequent signal generation and
2433          * flush and unblock signals.
2434          *
2435          * This must occur _after_ the task SID has been updated so that any
2436          * kill done after the flush will be checked against the new SID.
2437          */
2438         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2439         if (rc) {
2440                 memset(&itimer, 0, sizeof itimer);
2441                 for (i = 0; i < 3; i++)
2442                         do_setitimer(i, &itimer, NULL);
2443                 spin_lock_irq(&current->sighand->siglock);
2444                 if (!fatal_signal_pending(current)) {
2445                         flush_sigqueue(&current->pending);
2446                         flush_sigqueue(&current->signal->shared_pending);
2447                         flush_signal_handlers(current, 1);
2448                         sigemptyset(&current->blocked);
2449                         recalc_sigpending();
2450                 }
2451                 spin_unlock_irq(&current->sighand->siglock);
2452         }
2453
2454         /* Wake up the parent if it is waiting so that it can recheck
2455          * wait permission to the new task SID. */
2456         read_lock(&tasklist_lock);
2457         __wake_up_parent(current, current->real_parent);
2458         read_unlock(&tasklist_lock);
2459 }
2460
2461 /* superblock security operations */
2462
2463 static int selinux_sb_alloc_security(struct super_block *sb)
2464 {
2465         return superblock_alloc_security(sb);
2466 }
2467
2468 static void selinux_sb_free_security(struct super_block *sb)
2469 {
2470         superblock_free_security(sb);
2471 }
2472
2473 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2474 {
2475         if (plen > olen)
2476                 return 0;
2477
2478         return !memcmp(prefix, option, plen);
2479 }
2480
2481 static inline int selinux_option(char *option, int len)
2482 {
2483         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2484                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2485                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2486                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2487                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2488 }
2489
2490 static inline void take_option(char **to, char *from, int *first, int len)
2491 {
2492         if (!*first) {
2493                 **to = ',';
2494                 *to += 1;
2495         } else
2496                 *first = 0;
2497         memcpy(*to, from, len);
2498         *to += len;
2499 }
2500
2501 static inline void take_selinux_option(char **to, char *from, int *first,
2502                                        int len)
2503 {
2504         int current_size = 0;
2505
2506         if (!*first) {
2507                 **to = '|';
2508                 *to += 1;
2509         } else
2510                 *first = 0;
2511
2512         while (current_size < len) {
2513                 if (*from != '"') {
2514                         **to = *from;
2515                         *to += 1;
2516                 }
2517                 from += 1;
2518                 current_size += 1;
2519         }
2520 }
2521
2522 static int selinux_sb_copy_data(char *orig, char *copy)
2523 {
2524         int fnosec, fsec, rc = 0;
2525         char *in_save, *in_curr, *in_end;
2526         char *sec_curr, *nosec_save, *nosec;
2527         int open_quote = 0;
2528
2529         in_curr = orig;
2530         sec_curr = copy;
2531
2532         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2533         if (!nosec) {
2534                 rc = -ENOMEM;
2535                 goto out;
2536         }
2537
2538         nosec_save = nosec;
2539         fnosec = fsec = 1;
2540         in_save = in_end = orig;
2541
2542         do {
2543                 if (*in_end == '"')
2544                         open_quote = !open_quote;
2545                 if ((*in_end == ',' && open_quote == 0) ||
2546                                 *in_end == '\0') {
2547                         int len = in_end - in_curr;
2548
2549                         if (selinux_option(in_curr, len))
2550                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2551                         else
2552                                 take_option(&nosec, in_curr, &fnosec, len);
2553
2554                         in_curr = in_end + 1;
2555                 }
2556         } while (*in_end++);
2557
2558         strcpy(in_save, nosec_save);
2559         free_page((unsigned long)nosec_save);
2560 out:
2561         return rc;
2562 }
2563
2564 static int selinux_sb_remount(struct super_block *sb, void *data)
2565 {
2566         int rc, i, *flags;
2567         struct security_mnt_opts opts;
2568         char *secdata, **mount_options;
2569         struct superblock_security_struct *sbsec = sb->s_security;
2570
2571         if (!(sbsec->flags & SE_SBINITIALIZED))
2572                 return 0;
2573
2574         if (!data)
2575                 return 0;
2576
2577         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2578                 return 0;
2579
2580         security_init_mnt_opts(&opts);
2581         secdata = alloc_secdata();
2582         if (!secdata)
2583                 return -ENOMEM;
2584         rc = selinux_sb_copy_data(data, secdata);
2585         if (rc)
2586                 goto out_free_secdata;
2587
2588         rc = selinux_parse_opts_str(secdata, &opts);
2589         if (rc)
2590                 goto out_free_secdata;
2591
2592         mount_options = opts.mnt_opts;
2593         flags = opts.mnt_opts_flags;
2594
2595         for (i = 0; i < opts.num_mnt_opts; i++) {
2596                 u32 sid;
2597                 size_t len;
2598
2599                 if (flags[i] == SBLABEL_MNT)
2600                         continue;
2601                 len = strlen(mount_options[i]);
2602                 rc = security_context_to_sid(mount_options[i], len, &sid,
2603                                              GFP_KERNEL);
2604                 if (rc) {
2605                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2606                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2607                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2608                         goto out_free_opts;
2609                 }
2610                 rc = -EINVAL;
2611                 switch (flags[i]) {
2612                 case FSCONTEXT_MNT:
2613                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2614                                 goto out_bad_option;
2615                         break;
2616                 case CONTEXT_MNT:
2617                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2618                                 goto out_bad_option;
2619                         break;
2620                 case ROOTCONTEXT_MNT: {
2621                         struct inode_security_struct *root_isec;
2622                         root_isec = d_backing_inode(sb->s_root)->i_security;
2623
2624                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2625                                 goto out_bad_option;
2626                         break;
2627                 }
2628                 case DEFCONTEXT_MNT:
2629                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2630                                 goto out_bad_option;
2631                         break;
2632                 default:
2633                         goto out_free_opts;
2634                 }
2635         }
2636
2637         rc = 0;
2638 out_free_opts:
2639         security_free_mnt_opts(&opts);
2640 out_free_secdata:
2641         free_secdata(secdata);
2642         return rc;
2643 out_bad_option:
2644         printk(KERN_WARNING "SELinux: unable to change security options "
2645                "during remount (dev %s, type=%s)\n", sb->s_id,
2646                sb->s_type->name);
2647         goto out_free_opts;
2648 }
2649
2650 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2651 {
2652         const struct cred *cred = current_cred();
2653         struct common_audit_data ad;
2654         int rc;
2655
2656         rc = superblock_doinit(sb, data);
2657         if (rc)
2658                 return rc;
2659
2660         /* Allow all mounts performed by the kernel */
2661         if (flags & MS_KERNMOUNT)
2662                 return 0;
2663
2664         ad.type = LSM_AUDIT_DATA_DENTRY;
2665         ad.u.dentry = sb->s_root;
2666         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2667 }
2668
2669 static int selinux_sb_statfs(struct dentry *dentry)
2670 {
2671         const struct cred *cred = current_cred();
2672         struct common_audit_data ad;
2673
2674         ad.type = LSM_AUDIT_DATA_DENTRY;
2675         ad.u.dentry = dentry->d_sb->s_root;
2676         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2677 }
2678
2679 static int selinux_mount(const char *dev_name,
2680                          struct path *path,
2681                          const char *type,
2682                          unsigned long flags,
2683                          void *data)
2684 {
2685         const struct cred *cred = current_cred();
2686
2687         if (flags & MS_REMOUNT)
2688                 return superblock_has_perm(cred, path->dentry->d_sb,
2689                                            FILESYSTEM__REMOUNT, NULL);
2690         else
2691                 return path_has_perm(cred, path, FILE__MOUNTON);
2692 }
2693
2694 static int selinux_umount(struct vfsmount *mnt, int flags)
2695 {
2696         const struct cred *cred = current_cred();
2697
2698         return superblock_has_perm(cred, mnt->mnt_sb,
2699                                    FILESYSTEM__UNMOUNT, NULL);
2700 }
2701
2702 /* inode security operations */
2703
2704 static int selinux_inode_alloc_security(struct inode *inode)
2705 {
2706         return inode_alloc_security(inode);
2707 }
2708
2709 static void selinux_inode_free_security(struct inode *inode)
2710 {
2711         inode_free_security(inode);
2712 }
2713
2714 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2715                                         struct qstr *name, void **ctx,
2716                                         u32 *ctxlen)
2717 {
2718         const struct cred *cred = current_cred();
2719         struct task_security_struct *tsec;
2720         struct inode_security_struct *dsec;
2721         struct superblock_security_struct *sbsec;
2722         struct inode *dir = d_backing_inode(dentry->d_parent);
2723         u32 newsid;
2724         int rc;
2725
2726         tsec = cred->security;
2727         dsec = dir->i_security;
2728         sbsec = dir->i_sb->s_security;
2729
2730         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2731                 newsid = tsec->create_sid;
2732         } else {
2733                 rc = security_transition_sid(tsec->sid, dsec->sid,
2734                                              inode_mode_to_security_class(mode),
2735                                              name,
2736                                              &newsid);
2737                 if (rc) {
2738                         printk(KERN_WARNING
2739                                 "%s: security_transition_sid failed, rc=%d\n",
2740                                __func__, -rc);
2741                         return rc;
2742                 }
2743         }
2744
2745         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2746 }
2747
2748 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2749                                        const struct qstr *qstr,
2750                                        const char **name,
2751                                        void **value, size_t *len)
2752 {
2753         const struct task_security_struct *tsec = current_security();
2754         struct inode_security_struct *dsec;
2755         struct superblock_security_struct *sbsec;
2756         u32 sid, newsid, clen;
2757         int rc;
2758         char *context;
2759
2760         dsec = dir->i_security;
2761         sbsec = dir->i_sb->s_security;
2762
2763         sid = tsec->sid;
2764         newsid = tsec->create_sid;
2765
2766         if ((sbsec->flags & SE_SBINITIALIZED) &&
2767             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2768                 newsid = sbsec->mntpoint_sid;
2769         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2770                 rc = security_transition_sid(sid, dsec->sid,
2771                                              inode_mode_to_security_class(inode->i_mode),
2772                                              qstr, &newsid);
2773                 if (rc) {
2774                         printk(KERN_WARNING "%s:  "
2775                                "security_transition_sid failed, rc=%d (dev=%s "
2776                                "ino=%ld)\n",
2777                                __func__,
2778                                -rc, inode->i_sb->s_id, inode->i_ino);
2779                         return rc;
2780                 }
2781         }
2782
2783         /* Possibly defer initialization to selinux_complete_init. */
2784         if (sbsec->flags & SE_SBINITIALIZED) {
2785                 struct inode_security_struct *isec = inode->i_security;
2786                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2787                 isec->sid = newsid;
2788                 isec->initialized = 1;
2789         }
2790
2791         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2792                 return -EOPNOTSUPP;
2793
2794         if (name)
2795                 *name = XATTR_SELINUX_SUFFIX;
2796
2797         if (value && len) {
2798                 rc = security_sid_to_context_force(newsid, &context, &clen);
2799                 if (rc)
2800                         return rc;
2801                 *value = context;
2802                 *len = clen;
2803         }
2804
2805         return 0;
2806 }
2807
2808 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2809 {
2810         return may_create(dir, dentry, SECCLASS_FILE);
2811 }
2812
2813 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2814 {
2815         return may_link(dir, old_dentry, MAY_LINK);
2816 }
2817
2818 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2819 {
2820         return may_link(dir, dentry, MAY_UNLINK);
2821 }
2822
2823 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2824 {
2825         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2826 }
2827
2828 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2829 {
2830         return may_create(dir, dentry, SECCLASS_DIR);
2831 }
2832
2833 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2834 {
2835         return may_link(dir, dentry, MAY_RMDIR);
2836 }
2837
2838 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2839 {
2840         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2841 }
2842
2843 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2844                                 struct inode *new_inode, struct dentry *new_dentry)
2845 {
2846         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2847 }
2848
2849 static int selinux_inode_readlink(struct dentry *dentry)
2850 {
2851         const struct cred *cred = current_cred();
2852
2853         return dentry_has_perm(cred, dentry, FILE__READ);
2854 }
2855
2856 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2857 {
2858         const struct cred *cred = current_cred();
2859
2860         return dentry_has_perm(cred, dentry, FILE__READ);
2861 }
2862
2863 static noinline int audit_inode_permission(struct inode *inode,
2864                                            u32 perms, u32 audited, u32 denied,
2865                                            int result,
2866                                            unsigned flags)
2867 {
2868         struct common_audit_data ad;
2869         struct inode_security_struct *isec = inode->i_security;
2870         int rc;
2871
2872         ad.type = LSM_AUDIT_DATA_INODE;
2873         ad.u.inode = inode;
2874
2875         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2876                             audited, denied, result, &ad, flags);
2877         if (rc)
2878                 return rc;
2879         return 0;
2880 }
2881
2882 static int selinux_inode_permission(struct inode *inode, int mask)
2883 {
2884         const struct cred *cred = current_cred();
2885         u32 perms;
2886         bool from_access;
2887         unsigned flags = mask & MAY_NOT_BLOCK;
2888         struct inode_security_struct *isec;
2889         u32 sid;
2890         struct av_decision avd;
2891         int rc, rc2;
2892         u32 audited, denied;
2893
2894         from_access = mask & MAY_ACCESS;
2895         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2896
2897         /* No permission to check.  Existence test. */
2898         if (!mask)
2899                 return 0;
2900
2901         validate_creds(cred);
2902
2903         if (unlikely(IS_PRIVATE(inode)))
2904                 return 0;
2905
2906         perms = file_mask_to_av(inode->i_mode, mask);
2907
2908         sid = cred_sid(cred);
2909         isec = inode->i_security;
2910
2911         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2912         audited = avc_audit_required(perms, &avd, rc,
2913                                      from_access ? FILE__AUDIT_ACCESS : 0,
2914                                      &denied);
2915         if (likely(!audited))
2916                 return rc;
2917
2918         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2919         if (rc2)
2920                 return rc2;
2921         return rc;
2922 }
2923
2924 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2925 {
2926         const struct cred *cred = current_cred();
2927         unsigned int ia_valid = iattr->ia_valid;
2928         __u32 av = FILE__WRITE;
2929
2930         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2931         if (ia_valid & ATTR_FORCE) {
2932                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2933                               ATTR_FORCE);
2934                 if (!ia_valid)
2935                         return 0;
2936         }
2937
2938         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2939                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2940                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2941
2942         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2943                 av |= FILE__OPEN;
2944
2945         return dentry_has_perm(cred, dentry, av);
2946 }
2947
2948 static int selinux_inode_getattr(const struct path *path)
2949 {
2950         return path_has_perm(current_cred(), path, FILE__GETATTR);
2951 }
2952
2953 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2954 {
2955         const struct cred *cred = current_cred();
2956
2957         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2958                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2959                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2960                         if (!capable(CAP_SETFCAP))
2961                                 return -EPERM;
2962                 } else if (!capable(CAP_SYS_ADMIN)) {
2963                         /* A different attribute in the security namespace.
2964                            Restrict to administrator. */
2965                         return -EPERM;
2966                 }
2967         }
2968
2969         /* Not an attribute we recognize, so just check the
2970            ordinary setattr permission. */
2971         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2972 }
2973
2974 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2975                                   const void *value, size_t size, int flags)
2976 {
2977         struct inode *inode = d_backing_inode(dentry);
2978         struct inode_security_struct *isec = inode->i_security;
2979         struct superblock_security_struct *sbsec;
2980         struct common_audit_data ad;
2981         u32 newsid, sid = current_sid();
2982         int rc = 0;
2983
2984         if (strcmp(name, XATTR_NAME_SELINUX))
2985                 return selinux_inode_setotherxattr(dentry, name);
2986
2987         sbsec = inode->i_sb->s_security;
2988         if (!(sbsec->flags & SBLABEL_MNT))
2989                 return -EOPNOTSUPP;
2990
2991         if (!inode_owner_or_capable(inode))
2992                 return -EPERM;
2993
2994         ad.type = LSM_AUDIT_DATA_DENTRY;
2995         ad.u.dentry = dentry;
2996
2997         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2998                           FILE__RELABELFROM, &ad);
2999         if (rc)
3000                 return rc;
3001
3002         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3003         if (rc == -EINVAL) {
3004                 if (!capable(CAP_MAC_ADMIN)) {
3005                         struct audit_buffer *ab;
3006                         size_t audit_size;
3007                         const char *str;
3008
3009                         /* We strip a nul only if it is at the end, otherwise the
3010                          * context contains a nul and we should audit that */
3011                         if (value) {
3012                                 str = value;
3013                                 if (str[size - 1] == '\0')
3014                                         audit_size = size - 1;
3015                                 else
3016                                         audit_size = size;
3017                         } else {
3018                                 str = "";
3019                                 audit_size = 0;
3020                         }
3021                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3022                         audit_log_format(ab, "op=setxattr invalid_context=");
3023                         audit_log_n_untrustedstring(ab, value, audit_size);
3024                         audit_log_end(ab);
3025
3026                         return rc;
3027                 }
3028                 rc = security_context_to_sid_force(value, size, &newsid);
3029         }
3030         if (rc)
3031                 return rc;
3032
3033         rc = avc_has_perm(sid, newsid, isec->sclass,
3034                           FILE__RELABELTO, &ad);
3035         if (rc)
3036                 return rc;
3037
3038         rc = security_validate_transition(isec->sid, newsid, sid,
3039                                           isec->sclass);
3040         if (rc)
3041                 return rc;
3042
3043         return avc_has_perm(newsid,
3044                             sbsec->sid,
3045                             SECCLASS_FILESYSTEM,
3046                             FILESYSTEM__ASSOCIATE,
3047                             &ad);
3048 }
3049
3050 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3051                                         const void *value, size_t size,
3052                                         int flags)
3053 {
3054         struct inode *inode = d_backing_inode(dentry);
3055         struct inode_security_struct *isec = inode->i_security;
3056         u32 newsid;
3057         int rc;
3058
3059         if (strcmp(name, XATTR_NAME_SELINUX)) {
3060                 /* Not an attribute we recognize, so nothing to do. */
3061                 return;
3062         }
3063
3064         rc = security_context_to_sid_force(value, size, &newsid);
3065         if (rc) {
3066                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3067                        "for (%s, %lu), rc=%d\n",
3068                        inode->i_sb->s_id, inode->i_ino, -rc);
3069                 return;
3070         }
3071
3072         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3073         isec->sid = newsid;
3074         isec->initialized = 1;
3075
3076         return;
3077 }
3078
3079 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3080 {
3081         const struct cred *cred = current_cred();
3082
3083         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3084 }
3085
3086 static int selinux_inode_listxattr(struct dentry *dentry)
3087 {
3088         const struct cred *cred = current_cred();
3089
3090         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3091 }
3092
3093 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3094 {
3095         if (strcmp(name, XATTR_NAME_SELINUX))
3096                 return selinux_inode_setotherxattr(dentry, name);
3097
3098         /* No one is allowed to remove a SELinux security label.
3099            You can change the label, but all data must be labeled. */
3100         return -EACCES;
3101 }
3102
3103 /*
3104  * Copy the inode security context value to the user.
3105  *
3106  * Permission check is handled by selinux_inode_getxattr hook.
3107  */
3108 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3109 {
3110         u32 size;
3111         int error;
3112         char *context = NULL;
3113         struct inode_security_struct *isec = inode->i_security;
3114
3115         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3116                 return -EOPNOTSUPP;
3117
3118         /*
3119          * If the caller has CAP_MAC_ADMIN, then get the raw context
3120          * value even if it is not defined by current policy; otherwise,
3121          * use the in-core value under current policy.
3122          * Use the non-auditing forms of the permission checks since
3123          * getxattr may be called by unprivileged processes commonly
3124          * and lack of permission just means that we fall back to the
3125          * in-core context value, not a denial.
3126          */
3127         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3128                             SECURITY_CAP_NOAUDIT);
3129         if (!error)
3130                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3131                                             SECURITY_CAP_NOAUDIT);
3132         if (!error)
3133                 error = security_sid_to_context_force(isec->sid, &context,
3134                                                       &size);
3135         else
3136                 error = security_sid_to_context(isec->sid, &context, &size);
3137         if (error)
3138                 return error;
3139         error = size;
3140         if (alloc) {
3141                 *buffer = context;
3142                 goto out_nofree;
3143         }
3144         kfree(context);
3145 out_nofree:
3146         return error;
3147 }
3148
3149 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3150                                      const void *value, size_t size, int flags)
3151 {
3152         struct inode_security_struct *isec = inode->i_security;
3153         u32 newsid;
3154         int rc;
3155
3156         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3157                 return -EOPNOTSUPP;
3158
3159         if (!value || !size)
3160                 return -EACCES;
3161
3162         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3163         if (rc)
3164                 return rc;
3165
3166         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3167         isec->sid = newsid;
3168         isec->initialized = 1;
3169         return 0;
3170 }
3171
3172 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3173 {
3174         const int len = sizeof(XATTR_NAME_SELINUX);
3175         if (buffer && len <= buffer_size)
3176                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3177         return len;
3178 }
3179
3180 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3181 {
3182         struct inode_security_struct *isec = inode->i_security;
3183         *secid = isec->sid;
3184 }
3185
3186 /* file security operations */
3187
3188 static int selinux_revalidate_file_permission(struct file *file, int mask)
3189 {
3190         const struct cred *cred = current_cred();
3191         struct inode *inode = file_inode(file);
3192
3193         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3194         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3195                 mask |= MAY_APPEND;
3196
3197         return file_has_perm(cred, file,
3198                              file_mask_to_av(inode->i_mode, mask));
3199 }
3200
3201 static int selinux_file_permission(struct file *file, int mask)
3202 {
3203         struct inode *inode = file_inode(file);
3204         struct file_security_struct *fsec = file->f_security;
3205         struct inode_security_struct *isec = inode->i_security;
3206         u32 sid = current_sid();
3207
3208         if (!mask)
3209                 /* No permission to check.  Existence test. */
3210                 return 0;
3211
3212         if (sid == fsec->sid && fsec->isid == isec->sid &&
3213             fsec->pseqno == avc_policy_seqno())
3214                 /* No change since file_open check. */
3215                 return 0;
3216
3217         return selinux_revalidate_file_permission(file, mask);
3218 }
3219
3220 static int selinux_file_alloc_security(struct file *file)
3221 {
3222         return file_alloc_security(file);
3223 }
3224
3225 static void selinux_file_free_security(struct file *file)
3226 {
3227         file_free_security(file);
3228 }
3229
3230 /*
3231  * Check whether a task has the ioctl permission and cmd
3232  * operation to an inode.
3233  */
3234 int ioctl_has_perm(const struct cred *cred, struct file *file,
3235                 u32 requested, u16 cmd)
3236 {
3237         struct common_audit_data ad;
3238         struct file_security_struct *fsec = file->f_security;
3239         struct inode *inode = file_inode(file);
3240         struct inode_security_struct *isec = inode->i_security;
3241         struct lsm_ioctlop_audit ioctl;
3242         u32 ssid = cred_sid(cred);
3243         int rc;
3244         u8 driver = cmd >> 8;
3245         u8 xperm = cmd & 0xff;
3246
3247         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3248         ad.u.op = &ioctl;
3249         ad.u.op->cmd = cmd;
3250         ad.u.op->path = file->f_path;
3251
3252         if (ssid != fsec->sid) {
3253                 rc = avc_has_perm(ssid, fsec->sid,
3254                                 SECCLASS_FD,
3255                                 FD__USE,
3256                                 &ad);
3257                 if (rc)
3258                         goto out;
3259         }
3260
3261         if (unlikely(IS_PRIVATE(inode)))
3262                 return 0;
3263
3264         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3265                         requested, driver, xperm, &ad);
3266 out:
3267         return rc;
3268 }
3269
3270 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3271                               unsigned long arg)
3272 {
3273         const struct cred *cred = current_cred();
3274         int error = 0;
3275
3276         switch (cmd) {
3277         case FIONREAD:
3278         /* fall through */
3279         case FIBMAP:
3280         /* fall through */
3281         case FIGETBSZ:
3282         /* fall through */
3283         case FS_IOC_GETFLAGS:
3284         /* fall through */
3285         case FS_IOC_GETVERSION:
3286                 error = file_has_perm(cred, file, FILE__GETATTR);
3287                 break;
3288
3289         case FS_IOC_SETFLAGS:
3290         /* fall through */
3291         case FS_IOC_SETVERSION:
3292                 error = file_has_perm(cred, file, FILE__SETATTR);
3293                 break;
3294
3295         /* sys_ioctl() checks */
3296         case FIONBIO:
3297         /* fall through */
3298         case FIOASYNC:
3299                 error = file_has_perm(cred, file, 0);
3300                 break;
3301
3302         case KDSKBENT:
3303         case KDSKBSENT:
3304                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3305                                             SECURITY_CAP_AUDIT);
3306                 break;
3307
3308         /* default case assumes that the command will go
3309          * to the file's ioctl() function.
3310          */
3311         default:
3312                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3313         }
3314         return error;
3315 }
3316
3317 static int default_noexec;
3318
3319 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3320 {
3321         const struct cred *cred = current_cred();
3322         int rc = 0;
3323
3324         if (default_noexec &&
3325             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3326                                    (!shared && (prot & PROT_WRITE)))) {
3327                 /*
3328                  * We are making executable an anonymous mapping or a
3329                  * private file mapping that will also be writable.
3330                  * This has an additional check.
3331                  */
3332                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3333                 if (rc)
3334                         goto error;
3335         }
3336
3337         if (file) {
3338                 /* read access is always possible with a mapping */
3339                 u32 av = FILE__READ;
3340
3341                 /* write access only matters if the mapping is shared */
3342                 if (shared && (prot & PROT_WRITE))
3343                         av |= FILE__WRITE;
3344
3345                 if (prot & PROT_EXEC)
3346                         av |= FILE__EXECUTE;
3347
3348                 return file_has_perm(cred, file, av);
3349         }
3350
3351 error:
3352         return rc;
3353 }
3354
3355 static int selinux_mmap_addr(unsigned long addr)
3356 {
3357         int rc = 0;
3358
3359         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3360                 u32 sid = current_sid();
3361                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3362                                   MEMPROTECT__MMAP_ZERO, NULL);
3363         }
3364
3365         return rc;
3366 }
3367
3368 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3369                              unsigned long prot, unsigned long flags)
3370 {
3371         if (selinux_checkreqprot)
3372                 prot = reqprot;
3373
3374         return file_map_prot_check(file, prot,
3375                                    (flags & MAP_TYPE) == MAP_SHARED);
3376 }
3377
3378 static int selinux_file_mprotect(struct vm_area_struct *vma,
3379                                  unsigned long reqprot,
3380                                  unsigned long prot)
3381 {
3382         const struct cred *cred = current_cred();
3383
3384         if (selinux_checkreqprot)
3385                 prot = reqprot;
3386
3387         if (default_noexec &&
3388             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3389                 int rc = 0;
3390                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3391                     vma->vm_end <= vma->vm_mm->brk) {
3392                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3393                 } else if (!vma->vm_file &&
3394                            vma->vm_start <= vma->vm_mm->start_stack &&
3395                            vma->vm_end >= vma->vm_mm->start_stack) {
3396                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3397                 } else if (vma->vm_file && vma->anon_vma) {
3398                         /*
3399                          * We are making executable a file mapping that has
3400                          * had some COW done. Since pages might have been
3401                          * written, check ability to execute the possibly
3402                          * modified content.  This typically should only
3403                          * occur for text relocations.
3404                          */
3405                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3406                 }
3407                 if (rc)
3408                         return rc;
3409         }
3410
3411         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3412 }
3413
3414 static int selinux_file_lock(struct file *file, unsigned int cmd)
3415 {
3416         const struct cred *cred = current_cred();
3417
3418         return file_has_perm(cred, file, FILE__LOCK);
3419 }
3420
3421 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3422                               unsigned long arg)
3423 {
3424         const struct cred *cred = current_cred();
3425         int err = 0;
3426
3427         switch (cmd) {
3428         case F_SETFL:
3429                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3430                         err = file_has_perm(cred, file, FILE__WRITE);
3431                         break;
3432                 }
3433                 /* fall through */
3434         case F_SETOWN:
3435         case F_SETSIG:
3436         case F_GETFL:
3437         case F_GETOWN:
3438         case F_GETSIG:
3439         case F_GETOWNER_UIDS:
3440                 /* Just check FD__USE permission */
3441                 err = file_has_perm(cred, file, 0);
3442                 break;
3443         case F_GETLK:
3444         case F_SETLK:
3445         case F_SETLKW:
3446         case F_OFD_GETLK:
3447         case F_OFD_SETLK:
3448         case F_OFD_SETLKW:
3449 #if BITS_PER_LONG == 32
3450         case F_GETLK64:
3451         case F_SETLK64:
3452         case F_SETLKW64:
3453 #endif
3454                 err = file_has_perm(cred, file, FILE__LOCK);
3455                 break;
3456         }
3457
3458         return err;
3459 }
3460
3461 static void selinux_file_set_fowner(struct file *file)
3462 {
3463         struct file_security_struct *fsec;
3464
3465         fsec = file->f_security;
3466         fsec->fown_sid = current_sid();
3467 }
3468
3469 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3470                                        struct fown_struct *fown, int signum)
3471 {
3472         struct file *file;
3473         u32 sid = task_sid(tsk);
3474         u32 perm;
3475         struct file_security_struct *fsec;
3476
3477         /* struct fown_struct is never outside the context of a struct file */
3478         file = container_of(fown, struct file, f_owner);
3479
3480         fsec = file->f_security;
3481
3482         if (!signum)
3483                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3484         else
3485                 perm = signal_to_av(signum);
3486
3487         return avc_has_perm(fsec->fown_sid, sid,
3488                             SECCLASS_PROCESS, perm, NULL);
3489 }
3490
3491 static int selinux_file_receive(struct file *file)
3492 {
3493         const struct cred *cred = current_cred();
3494
3495         return file_has_perm(cred, file, file_to_av(file));
3496 }
3497
3498 static int selinux_file_open(struct file *file, const struct cred *cred)
3499 {
3500         struct file_security_struct *fsec;
3501         struct inode_security_struct *isec;
3502
3503         fsec = file->f_security;
3504         isec = file_inode(file)->i_security;
3505         /*
3506          * Save inode label and policy sequence number
3507          * at open-time so that selinux_file_permission
3508          * can determine whether revalidation is necessary.
3509          * Task label is already saved in the file security
3510          * struct as its SID.
3511          */
3512         fsec->isid = isec->sid;
3513         fsec->pseqno = avc_policy_seqno();
3514         /*
3515          * Since the inode label or policy seqno may have changed
3516          * between the selinux_inode_permission check and the saving
3517          * of state above, recheck that access is still permitted.
3518          * Otherwise, access might never be revalidated against the
3519          * new inode label or new policy.
3520          * This check is not redundant - do not remove.
3521          */
3522         return file_path_has_perm(cred, file, open_file_to_av(file));
3523 }
3524
3525 /* task security operations */
3526
3527 static int selinux_task_create(unsigned long clone_flags)
3528 {
3529         return current_has_perm(current, PROCESS__FORK);
3530 }
3531
3532 /*
3533  * allocate the SELinux part of blank credentials
3534  */
3535 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3536 {
3537         struct task_security_struct *tsec;
3538
3539         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3540         if (!tsec)
3541                 return -ENOMEM;
3542
3543         cred->security = tsec;
3544         return 0;
3545 }
3546
3547 /*
3548  * detach and free the LSM part of a set of credentials
3549  */
3550 static void selinux_cred_free(struct cred *cred)
3551 {
3552         struct task_security_struct *tsec = cred->security;
3553
3554         /*
3555          * cred->security == NULL if security_cred_alloc_blank() or
3556          * security_prepare_creds() returned an error.
3557          */
3558         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3559         cred->security = (void *) 0x7UL;
3560         kfree(tsec);
3561 }
3562
3563 /*
3564  * prepare a new set of credentials for modification
3565  */
3566 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3567                                 gfp_t gfp)
3568 {
3569         const struct task_security_struct *old_tsec;
3570         struct task_security_struct *tsec;
3571
3572         old_tsec = old->security;
3573
3574         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3575         if (!tsec)
3576                 return -ENOMEM;
3577
3578         new->security = tsec;
3579         return 0;
3580 }
3581
3582 /*
3583  * transfer the SELinux data to a blank set of creds
3584  */
3585 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3586 {
3587         const struct task_security_struct *old_tsec = old->security;
3588         struct task_security_struct *tsec = new->security;
3589
3590         *tsec = *old_tsec;
3591 }
3592
3593 /*
3594  * set the security data for a kernel service
3595  * - all the creation contexts are set to unlabelled
3596  */
3597 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3598 {
3599         struct task_security_struct *tsec = new->security;
3600         u32 sid = current_sid();
3601         int ret;
3602
3603         ret = avc_has_perm(sid, secid,
3604                            SECCLASS_KERNEL_SERVICE,
3605                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3606                            NULL);
3607         if (ret == 0) {
3608                 tsec->sid = secid;
3609                 tsec->create_sid = 0;
3610                 tsec->keycreate_sid = 0;
3611                 tsec->sockcreate_sid = 0;
3612         }
3613         return ret;
3614 }
3615
3616 /*
3617  * set the file creation context in a security record to the same as the
3618  * objective context of the specified inode
3619  */
3620 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3621 {
3622         struct inode_security_struct *isec = inode->i_security;
3623         struct task_security_struct *tsec = new->security;
3624         u32 sid = current_sid();
3625         int ret;
3626
3627         ret = avc_has_perm(sid, isec->sid,
3628                            SECCLASS_KERNEL_SERVICE,
3629                            KERNEL_SERVICE__CREATE_FILES_AS,
3630                            NULL);
3631
3632         if (ret == 0)
3633                 tsec->create_sid = isec->sid;
3634         return ret;
3635 }
3636
3637 static int selinux_kernel_module_request(char *kmod_name)
3638 {
3639         u32 sid;
3640         struct common_audit_data ad;
3641
3642         sid = task_sid(current);
3643
3644         ad.type = LSM_AUDIT_DATA_KMOD;
3645         ad.u.kmod_name = kmod_name;
3646
3647         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3648                             SYSTEM__MODULE_REQUEST, &ad);
3649 }
3650
3651 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3652 {
3653         return current_has_perm(p, PROCESS__SETPGID);
3654 }
3655
3656 static int selinux_task_getpgid(struct task_struct *p)
3657 {
3658         return current_has_perm(p, PROCESS__GETPGID);
3659 }
3660
3661 static int selinux_task_getsid(struct task_struct *p)
3662 {
3663         return current_has_perm(p, PROCESS__GETSESSION);
3664 }
3665
3666 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3667 {
3668         *secid = task_sid(p);
3669 }
3670
3671 static int selinux_task_setnice(struct task_struct *p, int nice)
3672 {
3673         return current_has_perm(p, PROCESS__SETSCHED);
3674 }
3675
3676 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3677 {
3678         return current_has_perm(p, PROCESS__SETSCHED);
3679 }
3680
3681 static int selinux_task_getioprio(struct task_struct *p)
3682 {
3683         return current_has_perm(p, PROCESS__GETSCHED);
3684 }
3685
3686 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3687                 struct rlimit *new_rlim)
3688 {
3689         struct rlimit *old_rlim = p->signal->rlim + resource;
3690
3691         /* Control the ability to change the hard limit (whether
3692            lowering or raising it), so that the hard limit can
3693            later be used as a safe reset point for the soft limit
3694            upon context transitions.  See selinux_bprm_committing_creds. */
3695         if (old_rlim->rlim_max != new_rlim->rlim_max)
3696                 return current_has_perm(p, PROCESS__SETRLIMIT);
3697
3698         return 0;
3699 }
3700
3701 static int selinux_task_setscheduler(struct task_struct *p)
3702 {
3703         return current_has_perm(p, PROCESS__SETSCHED);
3704 }
3705
3706 static int selinux_task_getscheduler(struct task_struct *p)
3707 {
3708         return current_has_perm(p, PROCESS__GETSCHED);
3709 }
3710
3711 static int selinux_task_movememory(struct task_struct *p)
3712 {
3713         return current_has_perm(p, PROCESS__SETSCHED);
3714 }
3715
3716 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3717                                 int sig, u32 secid)
3718 {
3719         u32 perm;
3720         int rc;
3721
3722         if (!sig)
3723                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3724         else
3725                 perm = signal_to_av(sig);
3726         if (secid)
3727                 rc = avc_has_perm(secid, task_sid(p),
3728                                   SECCLASS_PROCESS, perm, NULL);
3729         else
3730                 rc = current_has_perm(p, perm);
3731         return rc;
3732 }
3733
3734 static int selinux_task_wait(struct task_struct *p)
3735 {
3736         return task_has_perm(p, current, PROCESS__SIGCHLD);
3737 }
3738
3739 static void selinux_task_to_inode(struct task_struct *p,
3740                                   struct inode *inode)
3741 {
3742         struct inode_security_struct *isec = inode->i_security;
3743         u32 sid = task_sid(p);
3744
3745         isec->sid = sid;
3746         isec->initialized = 1;
3747 }
3748
3749 /* Returns error only if unable to parse addresses */
3750 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3751                         struct common_audit_data *ad, u8 *proto)
3752 {
3753         int offset, ihlen, ret = -EINVAL;
3754         struct iphdr _iph, *ih;
3755
3756         offset = skb_network_offset(skb);
3757         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3758         if (ih == NULL)
3759                 goto out;
3760
3761         ihlen = ih->ihl * 4;
3762         if (ihlen < sizeof(_iph))
3763                 goto out;
3764
3765         ad->u.net->v4info.saddr = ih->saddr;
3766         ad->u.net->v4info.daddr = ih->daddr;
3767         ret = 0;
3768
3769         if (proto)
3770                 *proto = ih->protocol;
3771
3772         switch (ih->protocol) {
3773         case IPPROTO_TCP: {
3774                 struct tcphdr _tcph, *th;
3775
3776                 if (ntohs(ih->frag_off) & IP_OFFSET)
3777                         break;
3778
3779                 offset += ihlen;
3780                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3781                 if (th == NULL)
3782                         break;
3783
3784                 ad->u.net->sport = th->source;
3785                 ad->u.net->dport = th->dest;
3786                 break;
3787         }
3788
3789         case IPPROTO_UDP: {
3790                 struct udphdr _udph, *uh;
3791
3792                 if (ntohs(ih->frag_off) & IP_OFFSET)
3793                         break;
3794
3795                 offset += ihlen;
3796                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3797                 if (uh == NULL)
3798                         break;
3799
3800                 ad->u.net->sport = uh->source;
3801                 ad->u.net->dport = uh->dest;
3802                 break;
3803         }
3804
3805         case IPPROTO_DCCP: {
3806                 struct dccp_hdr _dccph, *dh;
3807
3808                 if (ntohs(ih->frag_off) & IP_OFFSET)
3809                         break;
3810
3811                 offset += ihlen;
3812                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3813                 if (dh == NULL)
3814                         break;
3815
3816                 ad->u.net->sport = dh->dccph_sport;
3817                 ad->u.net->dport = dh->dccph_dport;
3818                 break;
3819         }
3820
3821         default:
3822                 break;
3823         }
3824 out:
3825         return ret;
3826 }
3827
3828 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3829
3830 /* Returns error only if unable to parse addresses */
3831 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3832                         struct common_audit_data *ad, u8 *proto)
3833 {
3834         u8 nexthdr;
3835         int ret = -EINVAL, offset;
3836         struct ipv6hdr _ipv6h, *ip6;
3837         __be16 frag_off;
3838
3839         offset = skb_network_offset(skb);
3840         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3841         if (ip6 == NULL)
3842                 goto out;
3843
3844         ad->u.net->v6info.saddr = ip6->saddr;
3845         ad->u.net->v6info.daddr = ip6->daddr;
3846         ret = 0;
3847
3848         nexthdr = ip6->nexthdr;
3849         offset += sizeof(_ipv6h);
3850         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3851         if (offset < 0)
3852                 goto out;
3853
3854         if (proto)
3855                 *proto = nexthdr;
3856
3857         switch (nexthdr) {
3858         case IPPROTO_TCP: {
3859                 struct tcphdr _tcph, *th;
3860
3861                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3862                 if (th == NULL)
3863                         break;
3864
3865                 ad->u.net->sport = th->source;
3866                 ad->u.net->dport = th->dest;
3867                 break;
3868         }
3869
3870         case IPPROTO_UDP: {
3871                 struct udphdr _udph, *uh;
3872
3873                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3874                 if (uh == NULL)
3875                         break;
3876
3877                 ad->u.net->sport = uh->source;
3878                 ad->u.net->dport = uh->dest;
3879                 break;
3880         }
3881
3882         case IPPROTO_DCCP: {
3883                 struct dccp_hdr _dccph, *dh;
3884
3885                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3886                 if (dh == NULL)
3887                         break;
3888
3889                 ad->u.net->sport = dh->dccph_sport;
3890                 ad->u.net->dport = dh->dccph_dport;
3891                 break;
3892         }
3893
3894         /* includes fragments */
3895         default:
3896                 break;
3897         }
3898 out:
3899         return ret;
3900 }
3901
3902 #endif /* IPV6 */
3903
3904 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3905                              char **_addrp, int src, u8 *proto)
3906 {
3907         char *addrp;
3908         int ret;
3909
3910         switch (ad->u.net->family) {
3911         case PF_INET:
3912                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3913                 if (ret)
3914                         goto parse_error;
3915                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3916                                        &ad->u.net->v4info.daddr);
3917                 goto okay;
3918
3919 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3920         case PF_INET6:
3921                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3922                 if (ret)
3923                         goto parse_error;
3924                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3925                                        &ad->u.net->v6info.daddr);
3926                 goto okay;
3927 #endif  /* IPV6 */
3928         default:
3929                 addrp = NULL;
3930                 goto okay;
3931         }
3932
3933 parse_error:
3934         printk(KERN_WARNING
3935                "SELinux: failure in selinux_parse_skb(),"
3936                " unable to parse packet\n");
3937         return ret;
3938
3939 okay:
3940         if (_addrp)
3941                 *_addrp = addrp;
3942         return 0;
3943 }
3944
3945 /**
3946  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3947  * @skb: the packet
3948  * @family: protocol family
3949  * @sid: the packet's peer label SID
3950  *
3951  * Description:
3952  * Check the various different forms of network peer labeling and determine
3953  * the peer label/SID for the packet; most of the magic actually occurs in
3954  * the security server function security_net_peersid_cmp().  The function
3955  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3956  * or -EACCES if @sid is invalid due to inconsistencies with the different
3957  * peer labels.
3958  *
3959  */
3960 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3961 {
3962         int err;
3963         u32 xfrm_sid;
3964         u32 nlbl_sid;
3965         u32 nlbl_type;
3966
3967         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3968         if (unlikely(err))
3969                 return -EACCES;
3970         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3971         if (unlikely(err))
3972                 return -EACCES;
3973
3974         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3975         if (unlikely(err)) {
3976                 printk(KERN_WARNING
3977                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3978                        " unable to determine packet's peer label\n");
3979                 return -EACCES;
3980         }
3981
3982         return 0;
3983 }
3984
3985 /**
3986  * selinux_conn_sid - Determine the child socket label for a connection
3987  * @sk_sid: the parent socket's SID
3988  * @skb_sid: the packet's SID
3989  * @conn_sid: the resulting connection SID
3990  *
3991  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3992  * combined with the MLS information from @skb_sid in order to create
3993  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3994  * of @sk_sid.  Returns zero on success, negative values on failure.
3995  *
3996  */
3997 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3998 {
3999         int err = 0;
4000
4001         if (skb_sid != SECSID_NULL)
4002                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4003         else
4004                 *conn_sid = sk_sid;
4005
4006         return err;
4007 }
4008
4009 /* socket security operations */
4010
4011 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4012                                  u16 secclass, u32 *socksid)
4013 {
4014         if (tsec->sockcreate_sid > SECSID_NULL) {
4015                 *socksid = tsec->sockcreate_sid;
4016                 return 0;
4017         }
4018
4019         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4020                                        socksid);
4021 }
4022
4023 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4024 {
4025         struct sk_security_struct *sksec = sk->sk_security;
4026         struct common_audit_data ad;
4027         struct lsm_network_audit net = {0,};
4028         u32 tsid = task_sid(task);
4029
4030         if (sksec->sid == SECINITSID_KERNEL)
4031                 return 0;
4032
4033         ad.type = LSM_AUDIT_DATA_NET;
4034         ad.u.net = &net;
4035         ad.u.net->sk = sk;
4036
4037         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4038 }
4039
4040 static int selinux_socket_create(int family, int type,
4041                                  int protocol, int kern)
4042 {
4043         const struct task_security_struct *tsec = current_security();
4044         u32 newsid;
4045         u16 secclass;
4046         int rc;
4047
4048         if (kern)
4049                 return 0;
4050
4051         secclass = socket_type_to_security_class(family, type, protocol);
4052         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4053         if (rc)
4054                 return rc;
4055
4056         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4057 }
4058
4059 static int selinux_socket_post_create(struct socket *sock, int family,
4060                                       int type, int protocol, int kern)
4061 {
4062         const struct task_security_struct *tsec = current_security();
4063         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4064         struct sk_security_struct *sksec;
4065         int err = 0;
4066
4067         isec->sclass = socket_type_to_security_class(family, type, protocol);
4068
4069         if (kern)
4070                 isec->sid = SECINITSID_KERNEL;
4071         else {
4072                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4073                 if (err)
4074                         return err;
4075         }
4076
4077         isec->initialized = 1;
4078
4079         if (sock->sk) {
4080                 sksec = sock->sk->sk_security;
4081                 sksec->sid = isec->sid;
4082                 sksec->sclass = isec->sclass;
4083                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4084         }
4085
4086         return err;
4087 }
4088
4089 /* Range of port numbers used to automatically bind.
4090    Need to determine whether we should perform a name_bind
4091    permission check between the socket and the port number. */
4092
4093 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4094 {
4095         struct sock *sk = sock->sk;
4096         u16 family;
4097         int err;
4098
4099         err = sock_has_perm(current, sk, SOCKET__BIND);
4100         if (err)
4101                 goto out;
4102
4103         /*
4104          * If PF_INET or PF_INET6, check name_bind permission for the port.
4105          * Multiple address binding for SCTP is not supported yet: we just
4106          * check the first address now.
4107          */
4108         family = sk->sk_family;
4109         if (family == PF_INET || family == PF_INET6) {
4110                 char *addrp;
4111                 struct sk_security_struct *sksec = sk->sk_security;
4112                 struct common_audit_data ad;
4113                 struct lsm_network_audit net = {0,};
4114                 struct sockaddr_in *addr4 = NULL;
4115                 struct sockaddr_in6 *addr6 = NULL;
4116                 unsigned short snum;
4117                 u32 sid, node_perm;
4118
4119                 if (family == PF_INET) {
4120                         addr4 = (struct sockaddr_in *)address;
4121                         snum = ntohs(addr4->sin_port);
4122                         addrp = (char *)&addr4->sin_addr.s_addr;
4123                 } else {
4124                         addr6 = (struct sockaddr_in6 *)address;
4125                         snum = ntohs(addr6->sin6_port);
4126                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4127                 }
4128
4129                 if (snum) {
4130                         int low, high;
4131
4132                         inet_get_local_port_range(sock_net(sk), &low, &high);
4133
4134                         if (snum < max(PROT_SOCK, low) || snum > high) {
4135                                 err = sel_netport_sid(sk->sk_protocol,
4136                                                       snum, &sid);
4137                                 if (err)
4138                                         goto out;
4139                                 ad.type = LSM_AUDIT_DATA_NET;
4140                                 ad.u.net = &net;
4141                                 ad.u.net->sport = htons(snum);
4142                                 ad.u.net->family = family;
4143                                 err = avc_has_perm(sksec->sid, sid,
4144                                                    sksec->sclass,
4145                                                    SOCKET__NAME_BIND, &ad);
4146                                 if (err)
4147                                         goto out;
4148                         }
4149                 }
4150
4151                 switch (sksec->sclass) {
4152                 case SECCLASS_TCP_SOCKET:
4153                         node_perm = TCP_SOCKET__NODE_BIND;
4154                         break;
4155
4156                 case SECCLASS_UDP_SOCKET:
4157                         node_perm = UDP_SOCKET__NODE_BIND;
4158                         break;
4159
4160                 case SECCLASS_DCCP_SOCKET:
4161                         node_perm = DCCP_SOCKET__NODE_BIND;
4162                         break;
4163
4164                 default:
4165                         node_perm = RAWIP_SOCKET__NODE_BIND;
4166                         break;
4167                 }
4168
4169                 err = sel_netnode_sid(addrp, family, &sid);
4170                 if (err)
4171                         goto out;
4172
4173                 ad.type = LSM_AUDIT_DATA_NET;
4174                 ad.u.net = &net;
4175                 ad.u.net->sport = htons(snum);
4176                 ad.u.net->family = family;
4177
4178                 if (family == PF_INET)
4179                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4180                 else
4181                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4182
4183                 err = avc_has_perm(sksec->sid, sid,
4184                                    sksec->sclass, node_perm, &ad);
4185                 if (err)
4186                         goto out;
4187         }
4188 out:
4189         return err;
4190 }
4191
4192 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4193 {
4194         struct sock *sk = sock->sk;
4195         struct sk_security_struct *sksec = sk->sk_security;
4196         int err;
4197
4198         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4199         if (err)
4200                 return err;
4201
4202         /*
4203          * If a TCP or DCCP socket, check name_connect permission for the port.
4204          */
4205         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4206             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4207                 struct common_audit_data ad;
4208                 struct lsm_network_audit net = {0,};
4209                 struct sockaddr_in *addr4 = NULL;
4210                 struct sockaddr_in6 *addr6 = NULL;
4211                 unsigned short snum;
4212                 u32 sid, perm;
4213
4214                 if (sk->sk_family == PF_INET) {
4215                         addr4 = (struct sockaddr_in *)address;
4216                         if (addrlen < sizeof(struct sockaddr_in))
4217                                 return -EINVAL;
4218                         snum = ntohs(addr4->sin_port);
4219                 } else {
4220                         addr6 = (struct sockaddr_in6 *)address;
4221                         if (addrlen < SIN6_LEN_RFC2133)
4222                                 return -EINVAL;
4223                         snum = ntohs(addr6->sin6_port);
4224                 }
4225
4226                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4227                 if (err)
4228                         goto out;
4229
4230                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4231                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4232
4233                 ad.type = LSM_AUDIT_DATA_NET;
4234                 ad.u.net = &net;
4235                 ad.u.net->dport = htons(snum);
4236                 ad.u.net->family = sk->sk_family;
4237                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4238                 if (err)
4239                         goto out;
4240         }
4241
4242         err = selinux_netlbl_socket_connect(sk, address);
4243
4244 out:
4245         return err;
4246 }
4247
4248 static int selinux_socket_listen(struct socket *sock, int backlog)
4249 {
4250         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4251 }
4252
4253 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4254 {
4255         int err;
4256         struct inode_security_struct *isec;
4257         struct inode_security_struct *newisec;
4258
4259         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4260         if (err)
4261                 return err;
4262
4263         newisec = SOCK_INODE(newsock)->i_security;
4264
4265         isec = SOCK_INODE(sock)->i_security;
4266         newisec->sclass = isec->sclass;
4267         newisec->sid = isec->sid;
4268         newisec->initialized = 1;
4269
4270         return 0;
4271 }
4272
4273 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4274                                   int size)
4275 {
4276         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4277 }
4278
4279 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4280                                   int size, int flags)
4281 {
4282         return sock_has_perm(current, sock->sk, SOCKET__READ);
4283 }
4284
4285 static int selinux_socket_getsockname(struct socket *sock)
4286 {
4287         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4288 }
4289
4290 static int selinux_socket_getpeername(struct socket *sock)
4291 {
4292         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4293 }
4294
4295 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4296 {
4297         int err;
4298
4299         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4300         if (err)
4301                 return err;
4302
4303         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4304 }
4305
4306 static int selinux_socket_getsockopt(struct socket *sock, int level,
4307                                      int optname)
4308 {
4309         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4310 }
4311
4312 static int selinux_socket_shutdown(struct socket *sock, int how)
4313 {
4314         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4315 }
4316
4317 static int selinux_socket_unix_stream_connect(struct sock *sock,
4318                                               struct sock *other,
4319                                               struct sock *newsk)
4320 {
4321         struct sk_security_struct *sksec_sock = sock->sk_security;
4322         struct sk_security_struct *sksec_other = other->sk_security;
4323         struct sk_security_struct *sksec_new = newsk->sk_security;
4324         struct common_audit_data ad;
4325         struct lsm_network_audit net = {0,};
4326         int err;
4327
4328         ad.type = LSM_AUDIT_DATA_NET;
4329         ad.u.net = &net;
4330         ad.u.net->sk = other;
4331
4332         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4333                            sksec_other->sclass,
4334                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4335         if (err)
4336                 return err;
4337
4338         /* server child socket */
4339         sksec_new->peer_sid = sksec_sock->sid;
4340         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4341                                     &sksec_new->sid);
4342         if (err)
4343                 return err;
4344
4345         /* connecting socket */
4346         sksec_sock->peer_sid = sksec_new->sid;
4347
4348         return 0;
4349 }
4350
4351 static int selinux_socket_unix_may_send(struct socket *sock,
4352                                         struct socket *other)
4353 {
4354         struct sk_security_struct *ssec = sock->sk->sk_security;
4355         struct sk_security_struct *osec = other->sk->sk_security;
4356         struct common_audit_data ad;
4357         struct lsm_network_audit net = {0,};
4358
4359         ad.type = LSM_AUDIT_DATA_NET;
4360         ad.u.net = &net;
4361         ad.u.net->sk = other->sk;
4362
4363         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4364                             &ad);
4365 }
4366
4367 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4368                                     char *addrp, u16 family, u32 peer_sid,
4369                                     struct common_audit_data *ad)
4370 {
4371         int err;
4372         u32 if_sid;
4373         u32 node_sid;
4374
4375         err = sel_netif_sid(ns, ifindex, &if_sid);
4376         if (err)
4377                 return err;
4378         err = avc_has_perm(peer_sid, if_sid,
4379                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4380         if (err)
4381                 return err;
4382
4383         err = sel_netnode_sid(addrp, family, &node_sid);
4384         if (err)
4385                 return err;
4386         return avc_has_perm(peer_sid, node_sid,
4387                             SECCLASS_NODE, NODE__RECVFROM, ad);
4388 }
4389
4390 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4391                                        u16 family)
4392 {
4393         int err = 0;
4394         struct sk_security_struct *sksec = sk->sk_security;
4395         u32 sk_sid = sksec->sid;
4396         struct common_audit_data ad;
4397         struct lsm_network_audit net = {0,};
4398         char *addrp;
4399
4400         ad.type = LSM_AUDIT_DATA_NET;
4401         ad.u.net = &net;
4402         ad.u.net->netif = skb->skb_iif;
4403         ad.u.net->family = family;
4404         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4405         if (err)
4406                 return err;
4407
4408         if (selinux_secmark_enabled()) {
4409                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4410                                    PACKET__RECV, &ad);
4411                 if (err)
4412                         return err;
4413         }
4414
4415         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4416         if (err)
4417                 return err;
4418         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4419
4420         return err;
4421 }
4422
4423 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4424 {
4425         int err;
4426         struct sk_security_struct *sksec = sk->sk_security;
4427         u16 family = sk->sk_family;
4428         u32 sk_sid = sksec->sid;
4429         struct common_audit_data ad;
4430         struct lsm_network_audit net = {0,};
4431         char *addrp;
4432         u8 secmark_active;
4433         u8 peerlbl_active;
4434
4435         if (family != PF_INET && family != PF_INET6)
4436                 return 0;
4437
4438         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4439         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4440                 family = PF_INET;
4441
4442         /* If any sort of compatibility mode is enabled then handoff processing
4443          * to the selinux_sock_rcv_skb_compat() function to deal with the
4444          * special handling.  We do this in an attempt to keep this function
4445          * as fast and as clean as possible. */
4446         if (!selinux_policycap_netpeer)
4447                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4448
4449         secmark_active = selinux_secmark_enabled();
4450         peerlbl_active = selinux_peerlbl_enabled();
4451         if (!secmark_active && !peerlbl_active)
4452                 return 0;
4453
4454         ad.type = LSM_AUDIT_DATA_NET;
4455         ad.u.net = &net;
4456         ad.u.net->netif = skb->skb_iif;
4457         ad.u.net->family = family;
4458         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4459         if (err)
4460                 return err;
4461
4462         if (peerlbl_active) {
4463                 u32 peer_sid;
4464
4465                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4466                 if (err)
4467                         return err;
4468                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4469                                                addrp, family, peer_sid, &ad);
4470                 if (err) {
4471                         selinux_netlbl_err(skb, err, 0);
4472                         return err;
4473                 }
4474                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4475                                    PEER__RECV, &ad);
4476                 if (err) {
4477                         selinux_netlbl_err(skb, err, 0);
4478                         return err;
4479                 }
4480         }
4481
4482         if (secmark_active) {
4483                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4484                                    PACKET__RECV, &ad);
4485                 if (err)
4486                         return err;
4487         }
4488
4489         return err;
4490 }
4491
4492 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4493                                             int __user *optlen, unsigned len)
4494 {
4495         int err = 0;
4496         char *scontext;
4497         u32 scontext_len;
4498         struct sk_security_struct *sksec = sock->sk->sk_security;
4499         u32 peer_sid = SECSID_NULL;
4500
4501         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4502             sksec->sclass == SECCLASS_TCP_SOCKET)
4503                 peer_sid = sksec->peer_sid;
4504         if (peer_sid == SECSID_NULL)
4505                 return -ENOPROTOOPT;
4506
4507         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4508         if (err)
4509                 return err;
4510
4511         if (scontext_len > len) {
4512                 err = -ERANGE;
4513                 goto out_len;
4514         }
4515
4516         if (copy_to_user(optval, scontext, scontext_len))
4517                 err = -EFAULT;
4518
4519 out_len:
4520         if (put_user(scontext_len, optlen))
4521                 err = -EFAULT;
4522         kfree(scontext);
4523         return err;
4524 }
4525
4526 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4527 {
4528         u32 peer_secid = SECSID_NULL;
4529         u16 family;
4530
4531         if (skb && skb->protocol == htons(ETH_P_IP))
4532                 family = PF_INET;
4533         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4534                 family = PF_INET6;
4535         else if (sock)
4536                 family = sock->sk->sk_family;
4537         else
4538                 goto out;
4539
4540         if (sock && family == PF_UNIX)
4541                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4542         else if (skb)
4543                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4544
4545 out:
4546         *secid = peer_secid;
4547         if (peer_secid == SECSID_NULL)
4548                 return -EINVAL;
4549         return 0;
4550 }
4551
4552 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4553 {
4554         struct sk_security_struct *sksec;
4555
4556         sksec = kzalloc(sizeof(*sksec), priority);
4557         if (!sksec)
4558                 return -ENOMEM;
4559
4560         sksec->peer_sid = SECINITSID_UNLABELED;
4561         sksec->sid = SECINITSID_UNLABELED;
4562         sksec->sclass = SECCLASS_SOCKET;
4563         selinux_netlbl_sk_security_reset(sksec);
4564         sk->sk_security = sksec;
4565
4566         return 0;
4567 }
4568
4569 static void selinux_sk_free_security(struct sock *sk)
4570 {
4571         struct sk_security_struct *sksec = sk->sk_security;
4572
4573         sk->sk_security = NULL;
4574         selinux_netlbl_sk_security_free(sksec);
4575         kfree(sksec);
4576 }
4577
4578 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4579 {
4580         struct sk_security_struct *sksec = sk->sk_security;
4581         struct sk_security_struct *newsksec = newsk->sk_security;
4582
4583         newsksec->sid = sksec->sid;
4584         newsksec->peer_sid = sksec->peer_sid;
4585         newsksec->sclass = sksec->sclass;
4586
4587         selinux_netlbl_sk_security_reset(newsksec);
4588 }
4589
4590 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4591 {
4592         if (!sk)
4593                 *secid = SECINITSID_ANY_SOCKET;
4594         else {
4595                 struct sk_security_struct *sksec = sk->sk_security;
4596
4597                 *secid = sksec->sid;
4598         }
4599 }
4600
4601 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4602 {
4603         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4604         struct sk_security_struct *sksec = sk->sk_security;
4605
4606         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4607             sk->sk_family == PF_UNIX)
4608                 isec->sid = sksec->sid;
4609         sksec->sclass = isec->sclass;
4610 }
4611
4612 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4613                                      struct request_sock *req)
4614 {
4615         struct sk_security_struct *sksec = sk->sk_security;
4616         int err;
4617         u16 family = req->rsk_ops->family;
4618         u32 connsid;
4619         u32 peersid;
4620
4621         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4622         if (err)
4623                 return err;
4624         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4625         if (err)
4626                 return err;
4627         req->secid = connsid;
4628         req->peer_secid = peersid;
4629
4630         return selinux_netlbl_inet_conn_request(req, family);
4631 }
4632
4633 static void selinux_inet_csk_clone(struct sock *newsk,
4634                                    const struct request_sock *req)
4635 {
4636         struct sk_security_struct *newsksec = newsk->sk_security;
4637
4638         newsksec->sid = req->secid;
4639         newsksec->peer_sid = req->peer_secid;
4640         /* NOTE: Ideally, we should also get the isec->sid for the
4641            new socket in sync, but we don't have the isec available yet.
4642            So we will wait until sock_graft to do it, by which
4643            time it will have been created and available. */
4644
4645         /* We don't need to take any sort of lock here as we are the only
4646          * thread with access to newsksec */
4647         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4648 }
4649
4650 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4651 {
4652         u16 family = sk->sk_family;
4653         struct sk_security_struct *sksec = sk->sk_security;
4654
4655         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4656         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4657                 family = PF_INET;
4658
4659         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4660 }
4661
4662 static int selinux_secmark_relabel_packet(u32 sid)
4663 {
4664         const struct task_security_struct *__tsec;
4665         u32 tsid;
4666
4667         __tsec = current_security();
4668         tsid = __tsec->sid;
4669
4670         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4671 }
4672
4673 static void selinux_secmark_refcount_inc(void)
4674 {
4675         atomic_inc(&selinux_secmark_refcount);
4676 }
4677
4678 static void selinux_secmark_refcount_dec(void)
4679 {
4680         atomic_dec(&selinux_secmark_refcount);
4681 }
4682
4683 static void selinux_req_classify_flow(const struct request_sock *req,
4684                                       struct flowi *fl)
4685 {
4686         fl->flowi_secid = req->secid;
4687 }
4688
4689 static int selinux_tun_dev_alloc_security(void **security)
4690 {
4691         struct tun_security_struct *tunsec;
4692
4693         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4694         if (!tunsec)
4695                 return -ENOMEM;
4696         tunsec->sid = current_sid();
4697
4698         *security = tunsec;
4699         return 0;
4700 }
4701
4702 static void selinux_tun_dev_free_security(void *security)
4703 {
4704         kfree(security);
4705 }
4706
4707 static int selinux_tun_dev_create(void)
4708 {
4709         u32 sid = current_sid();
4710
4711         /* we aren't taking into account the "sockcreate" SID since the socket
4712          * that is being created here is not a socket in the traditional sense,
4713          * instead it is a private sock, accessible only to the kernel, and
4714          * representing a wide range of network traffic spanning multiple
4715          * connections unlike traditional sockets - check the TUN driver to
4716          * get a better understanding of why this socket is special */
4717
4718         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4719                             NULL);
4720 }
4721
4722 static int selinux_tun_dev_attach_queue(void *security)
4723 {
4724         struct tun_security_struct *tunsec = security;
4725
4726         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4727                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4728 }
4729
4730 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4731 {
4732         struct tun_security_struct *tunsec = security;
4733         struct sk_security_struct *sksec = sk->sk_security;
4734
4735         /* we don't currently perform any NetLabel based labeling here and it
4736          * isn't clear that we would want to do so anyway; while we could apply
4737          * labeling without the support of the TUN user the resulting labeled
4738          * traffic from the other end of the connection would almost certainly
4739          * cause confusion to the TUN user that had no idea network labeling
4740          * protocols were being used */
4741
4742         sksec->sid = tunsec->sid;
4743         sksec->sclass = SECCLASS_TUN_SOCKET;
4744
4745         return 0;
4746 }
4747
4748 static int selinux_tun_dev_open(void *security)
4749 {
4750         struct tun_security_struct *tunsec = security;
4751         u32 sid = current_sid();
4752         int err;
4753
4754         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4755                            TUN_SOCKET__RELABELFROM, NULL);
4756         if (err)
4757                 return err;
4758         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4759                            TUN_SOCKET__RELABELTO, NULL);
4760         if (err)
4761                 return err;
4762         tunsec->sid = sid;
4763
4764         return 0;
4765 }
4766
4767 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4768 {
4769         int err = 0;
4770         u32 perm;
4771         struct nlmsghdr *nlh;
4772         struct sk_security_struct *sksec = sk->sk_security;
4773
4774         if (skb->len < NLMSG_HDRLEN) {
4775                 err = -EINVAL;
4776                 goto out;
4777         }
4778         nlh = nlmsg_hdr(skb);
4779
4780         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4781         if (err) {
4782                 if (err == -EINVAL) {
4783                         printk(KERN_WARNING
4784                                "SELinux: unrecognized netlink message:"
4785                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4786                                sk->sk_protocol, nlh->nlmsg_type,
4787                                secclass_map[sksec->sclass - 1].name);
4788                         if (!selinux_enforcing || security_get_allow_unknown())
4789                                 err = 0;
4790                 }
4791
4792                 /* Ignore */
4793                 if (err == -ENOENT)
4794                         err = 0;
4795                 goto out;
4796         }
4797
4798         err = sock_has_perm(current, sk, perm);
4799 out:
4800         return err;
4801 }
4802
4803 #ifdef CONFIG_NETFILTER
4804
4805 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4806                                        const struct net_device *indev,
4807                                        u16 family)
4808 {
4809         int err;
4810         char *addrp;
4811         u32 peer_sid;
4812         struct common_audit_data ad;
4813         struct lsm_network_audit net = {0,};
4814         u8 secmark_active;
4815         u8 netlbl_active;
4816         u8 peerlbl_active;
4817
4818         if (!selinux_policycap_netpeer)
4819                 return NF_ACCEPT;
4820
4821         secmark_active = selinux_secmark_enabled();
4822         netlbl_active = netlbl_enabled();
4823         peerlbl_active = selinux_peerlbl_enabled();
4824         if (!secmark_active && !peerlbl_active)
4825                 return NF_ACCEPT;
4826
4827         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4828                 return NF_DROP;
4829
4830         ad.type = LSM_AUDIT_DATA_NET;
4831         ad.u.net = &net;
4832         ad.u.net->netif = indev->ifindex;
4833         ad.u.net->family = family;
4834         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4835                 return NF_DROP;
4836
4837         if (peerlbl_active) {
4838                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4839                                                addrp, family, peer_sid, &ad);
4840                 if (err) {
4841                         selinux_netlbl_err(skb, err, 1);
4842                         return NF_DROP;
4843                 }
4844         }
4845
4846         if (secmark_active)
4847                 if (avc_has_perm(peer_sid, skb->secmark,
4848                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4849                         return NF_DROP;
4850
4851         if (netlbl_active)
4852                 /* we do this in the FORWARD path and not the POST_ROUTING
4853                  * path because we want to make sure we apply the necessary
4854                  * labeling before IPsec is applied so we can leverage AH
4855                  * protection */
4856                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4857                         return NF_DROP;
4858
4859         return NF_ACCEPT;
4860 }
4861
4862 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4863                                          struct sk_buff *skb,
4864                                          const struct nf_hook_state *state)
4865 {
4866         return selinux_ip_forward(skb, state->in, PF_INET);
4867 }
4868
4869 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4870 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4871                                          struct sk_buff *skb,
4872                                          const struct nf_hook_state *state)
4873 {
4874         return selinux_ip_forward(skb, state->in, PF_INET6);
4875 }
4876 #endif  /* IPV6 */
4877
4878 static unsigned int selinux_ip_output(struct sk_buff *skb,
4879                                       u16 family)
4880 {
4881         struct sock *sk;
4882         u32 sid;
4883
4884         if (!netlbl_enabled())
4885                 return NF_ACCEPT;
4886
4887         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4888          * because we want to make sure we apply the necessary labeling
4889          * before IPsec is applied so we can leverage AH protection */
4890         sk = skb->sk;
4891         if (sk) {
4892                 struct sk_security_struct *sksec;
4893
4894                 if (sk->sk_state == TCP_LISTEN)
4895                         /* if the socket is the listening state then this
4896                          * packet is a SYN-ACK packet which means it needs to
4897                          * be labeled based on the connection/request_sock and
4898                          * not the parent socket.  unfortunately, we can't
4899                          * lookup the request_sock yet as it isn't queued on
4900                          * the parent socket until after the SYN-ACK is sent.
4901                          * the "solution" is to simply pass the packet as-is
4902                          * as any IP option based labeling should be copied
4903                          * from the initial connection request (in the IP
4904                          * layer).  it is far from ideal, but until we get a
4905                          * security label in the packet itself this is the
4906                          * best we can do. */
4907                         return NF_ACCEPT;
4908
4909                 /* standard practice, label using the parent socket */
4910                 sksec = sk->sk_security;
4911                 sid = sksec->sid;
4912         } else
4913                 sid = SECINITSID_KERNEL;
4914         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4915                 return NF_DROP;
4916
4917         return NF_ACCEPT;
4918 }
4919
4920 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4921                                         struct sk_buff *skb,
4922                                         const struct nf_hook_state *state)
4923 {
4924         return selinux_ip_output(skb, PF_INET);
4925 }
4926
4927 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4928                                                 int ifindex,
4929                                                 u16 family)
4930 {
4931         struct sock *sk = skb->sk;
4932         struct sk_security_struct *sksec;
4933         struct common_audit_data ad;
4934         struct lsm_network_audit net = {0,};
4935         char *addrp;
4936         u8 proto;
4937
4938         if (sk == NULL)
4939                 return NF_ACCEPT;
4940         sksec = sk->sk_security;
4941
4942         ad.type = LSM_AUDIT_DATA_NET;
4943         ad.u.net = &net;
4944         ad.u.net->netif = ifindex;
4945         ad.u.net->family = family;
4946         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4947                 return NF_DROP;
4948
4949         if (selinux_secmark_enabled())
4950                 if (avc_has_perm(sksec->sid, skb->secmark,
4951                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4952                         return NF_DROP_ERR(-ECONNREFUSED);
4953
4954         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4955                 return NF_DROP_ERR(-ECONNREFUSED);
4956
4957         return NF_ACCEPT;
4958 }
4959
4960 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4961                                          const struct net_device *outdev,
4962                                          u16 family)
4963 {
4964         u32 secmark_perm;
4965         u32 peer_sid;
4966         int ifindex = outdev->ifindex;
4967         struct sock *sk;
4968         struct common_audit_data ad;
4969         struct lsm_network_audit net = {0,};
4970         char *addrp;
4971         u8 secmark_active;
4972         u8 peerlbl_active;
4973
4974         /* If any sort of compatibility mode is enabled then handoff processing
4975          * to the selinux_ip_postroute_compat() function to deal with the
4976          * special handling.  We do this in an attempt to keep this function
4977          * as fast and as clean as possible. */
4978         if (!selinux_policycap_netpeer)
4979                 return selinux_ip_postroute_compat(skb, ifindex, family);
4980
4981         secmark_active = selinux_secmark_enabled();
4982         peerlbl_active = selinux_peerlbl_enabled();
4983         if (!secmark_active && !peerlbl_active)
4984                 return NF_ACCEPT;
4985
4986         sk = skb->sk;
4987
4988 #ifdef CONFIG_XFRM
4989         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4990          * packet transformation so allow the packet to pass without any checks
4991          * since we'll have another chance to perform access control checks
4992          * when the packet is on it's final way out.
4993          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4994          *       is NULL, in this case go ahead and apply access control.
4995          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4996          *       TCP listening state we cannot wait until the XFRM processing
4997          *       is done as we will miss out on the SA label if we do;
4998          *       unfortunately, this means more work, but it is only once per
4999          *       connection. */
5000         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5001             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5002                 return NF_ACCEPT;
5003 #endif
5004
5005         if (sk == NULL) {
5006                 /* Without an associated socket the packet is either coming
5007                  * from the kernel or it is being forwarded; check the packet
5008                  * to determine which and if the packet is being forwarded
5009                  * query the packet directly to determine the security label. */
5010                 if (skb->skb_iif) {
5011                         secmark_perm = PACKET__FORWARD_OUT;
5012                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5013                                 return NF_DROP;
5014                 } else {
5015                         secmark_perm = PACKET__SEND;
5016                         peer_sid = SECINITSID_KERNEL;
5017                 }
5018         } else if (sk->sk_state == TCP_LISTEN) {
5019                 /* Locally generated packet but the associated socket is in the
5020                  * listening state which means this is a SYN-ACK packet.  In
5021                  * this particular case the correct security label is assigned
5022                  * to the connection/request_sock but unfortunately we can't
5023                  * query the request_sock as it isn't queued on the parent
5024                  * socket until after the SYN-ACK packet is sent; the only
5025                  * viable choice is to regenerate the label like we do in
5026                  * selinux_inet_conn_request().  See also selinux_ip_output()
5027                  * for similar problems. */
5028                 u32 skb_sid;
5029                 struct sk_security_struct *sksec = sk->sk_security;
5030                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5031                         return NF_DROP;
5032                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5033                  * and the packet has been through at least one XFRM
5034                  * transformation then we must be dealing with the "final"
5035                  * form of labeled IPsec packet; since we've already applied
5036                  * all of our access controls on this packet we can safely
5037                  * pass the packet. */
5038                 if (skb_sid == SECSID_NULL) {
5039                         switch (family) {
5040                         case PF_INET:
5041                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5042                                         return NF_ACCEPT;
5043                                 break;
5044                         case PF_INET6:
5045                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5046                                         return NF_ACCEPT;
5047                                 break;
5048                         default:
5049                                 return NF_DROP_ERR(-ECONNREFUSED);
5050                         }
5051                 }
5052                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5053                         return NF_DROP;
5054                 secmark_perm = PACKET__SEND;
5055         } else {
5056                 /* Locally generated packet, fetch the security label from the
5057                  * associated socket. */
5058                 struct sk_security_struct *sksec = sk->sk_security;
5059                 peer_sid = sksec->sid;
5060                 secmark_perm = PACKET__SEND;
5061         }
5062
5063         ad.type = LSM_AUDIT_DATA_NET;
5064         ad.u.net = &net;
5065         ad.u.net->netif = ifindex;
5066         ad.u.net->family = family;
5067         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5068                 return NF_DROP;
5069
5070         if (secmark_active)
5071                 if (avc_has_perm(peer_sid, skb->secmark,
5072                                  SECCLASS_PACKET, secmark_perm, &ad))
5073                         return NF_DROP_ERR(-ECONNREFUSED);
5074
5075         if (peerlbl_active) {
5076                 u32 if_sid;
5077                 u32 node_sid;
5078
5079                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5080                         return NF_DROP;
5081                 if (avc_has_perm(peer_sid, if_sid,
5082                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5083                         return NF_DROP_ERR(-ECONNREFUSED);
5084
5085                 if (sel_netnode_sid(addrp, family, &node_sid))
5086                         return NF_DROP;
5087                 if (avc_has_perm(peer_sid, node_sid,
5088                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5089                         return NF_DROP_ERR(-ECONNREFUSED);
5090         }
5091
5092         return NF_ACCEPT;
5093 }
5094
5095 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5096                                            struct sk_buff *skb,
5097                                            const struct nf_hook_state *state)
5098 {
5099         return selinux_ip_postroute(skb, state->out, PF_INET);
5100 }
5101
5102 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5103 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5104                                            struct sk_buff *skb,
5105                                            const struct nf_hook_state *state)
5106 {
5107         return selinux_ip_postroute(skb, state->out, PF_INET6);
5108 }
5109 #endif  /* IPV6 */
5110
5111 #endif  /* CONFIG_NETFILTER */
5112
5113 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5114 {
5115         return selinux_nlmsg_perm(sk, skb);
5116 }
5117
5118 static int ipc_alloc_security(struct task_struct *task,
5119                               struct kern_ipc_perm *perm,
5120                               u16 sclass)
5121 {
5122         struct ipc_security_struct *isec;
5123         u32 sid;
5124
5125         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5126         if (!isec)
5127                 return -ENOMEM;
5128
5129         sid = task_sid(task);
5130         isec->sclass = sclass;
5131         isec->sid = sid;
5132         perm->security = isec;
5133
5134         return 0;
5135 }
5136
5137 static void ipc_free_security(struct kern_ipc_perm *perm)
5138 {
5139         struct ipc_security_struct *isec = perm->security;
5140         perm->security = NULL;
5141         kfree(isec);
5142 }
5143
5144 static int msg_msg_alloc_security(struct msg_msg *msg)
5145 {
5146         struct msg_security_struct *msec;
5147
5148         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5149         if (!msec)
5150                 return -ENOMEM;
5151
5152         msec->sid = SECINITSID_UNLABELED;
5153         msg->security = msec;
5154
5155         return 0;
5156 }
5157
5158 static void msg_msg_free_security(struct msg_msg *msg)
5159 {
5160         struct msg_security_struct *msec = msg->security;
5161
5162         msg->security = NULL;
5163         kfree(msec);
5164 }
5165
5166 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5167                         u32 perms)
5168 {
5169         struct ipc_security_struct *isec;
5170         struct common_audit_data ad;
5171         u32 sid = current_sid();
5172
5173         isec = ipc_perms->security;
5174
5175         ad.type = LSM_AUDIT_DATA_IPC;
5176         ad.u.ipc_id = ipc_perms->key;
5177
5178         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5179 }
5180
5181 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5182 {
5183         return msg_msg_alloc_security(msg);
5184 }
5185
5186 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5187 {
5188         msg_msg_free_security(msg);
5189 }
5190
5191 /* message queue security operations */
5192 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5193 {
5194         struct ipc_security_struct *isec;
5195         struct common_audit_data ad;
5196         u32 sid = current_sid();
5197         int rc;
5198
5199         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5200         if (rc)
5201                 return rc;
5202
5203         isec = msq->q_perm.security;
5204
5205         ad.type = LSM_AUDIT_DATA_IPC;
5206         ad.u.ipc_id = msq->q_perm.key;
5207
5208         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5209                           MSGQ__CREATE, &ad);
5210         if (rc) {
5211                 ipc_free_security(&msq->q_perm);
5212                 return rc;
5213         }
5214         return 0;
5215 }
5216
5217 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5218 {
5219         ipc_free_security(&msq->q_perm);
5220 }
5221
5222 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5223 {
5224         struct ipc_security_struct *isec;
5225         struct common_audit_data ad;
5226         u32 sid = current_sid();
5227
5228         isec = msq->q_perm.security;
5229
5230         ad.type = LSM_AUDIT_DATA_IPC;
5231         ad.u.ipc_id = msq->q_perm.key;
5232
5233         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5234                             MSGQ__ASSOCIATE, &ad);
5235 }
5236
5237 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5238 {
5239         int err;
5240         int perms;
5241
5242         switch (cmd) {
5243         case IPC_INFO:
5244         case MSG_INFO:
5245                 /* No specific object, just general system-wide information. */
5246                 return task_has_system(current, SYSTEM__IPC_INFO);
5247         case IPC_STAT:
5248         case MSG_STAT:
5249                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5250                 break;
5251         case IPC_SET:
5252                 perms = MSGQ__SETATTR;
5253                 break;
5254         case IPC_RMID:
5255                 perms = MSGQ__DESTROY;
5256                 break;
5257         default:
5258                 return 0;
5259         }
5260
5261         err = ipc_has_perm(&msq->q_perm, perms);
5262         return err;
5263 }
5264
5265 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5266 {
5267         struct ipc_security_struct *isec;
5268         struct msg_security_struct *msec;
5269         struct common_audit_data ad;
5270         u32 sid = current_sid();
5271         int rc;
5272
5273         isec = msq->q_perm.security;
5274         msec = msg->security;
5275
5276         /*
5277          * First time through, need to assign label to the message
5278          */
5279         if (msec->sid == SECINITSID_UNLABELED) {
5280                 /*
5281                  * Compute new sid based on current process and
5282                  * message queue this message will be stored in
5283                  */
5284                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5285                                              NULL, &msec->sid);
5286                 if (rc)
5287                         return rc;
5288         }
5289
5290         ad.type = LSM_AUDIT_DATA_IPC;
5291         ad.u.ipc_id = msq->q_perm.key;
5292
5293         /* Can this process write to the queue? */
5294         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5295                           MSGQ__WRITE, &ad);
5296         if (!rc)
5297                 /* Can this process send the message */
5298                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5299                                   MSG__SEND, &ad);
5300         if (!rc)
5301                 /* Can the message be put in the queue? */
5302                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5303                                   MSGQ__ENQUEUE, &ad);
5304
5305         return rc;
5306 }
5307
5308 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5309                                     struct task_struct *target,
5310                                     long type, int mode)
5311 {
5312         struct ipc_security_struct *isec;
5313         struct msg_security_struct *msec;
5314         struct common_audit_data ad;
5315         u32 sid = task_sid(target);
5316         int rc;
5317
5318         isec = msq->q_perm.security;
5319         msec = msg->security;
5320
5321         ad.type = LSM_AUDIT_DATA_IPC;
5322         ad.u.ipc_id = msq->q_perm.key;
5323
5324         rc = avc_has_perm(sid, isec->sid,
5325                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5326         if (!rc)
5327                 rc = avc_has_perm(sid, msec->sid,
5328                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5329         return rc;
5330 }
5331
5332 /* Shared Memory security operations */
5333 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5334 {
5335         struct ipc_security_struct *isec;
5336         struct common_audit_data ad;
5337         u32 sid = current_sid();
5338         int rc;
5339
5340         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5341         if (rc)
5342                 return rc;
5343
5344         isec = shp->shm_perm.security;
5345
5346         ad.type = LSM_AUDIT_DATA_IPC;
5347         ad.u.ipc_id = shp->shm_perm.key;
5348
5349         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5350                           SHM__CREATE, &ad);
5351         if (rc) {
5352                 ipc_free_security(&shp->shm_perm);
5353                 return rc;
5354         }
5355         return 0;
5356 }
5357
5358 static void selinux_shm_free_security(struct shmid_kernel *shp)
5359 {
5360         ipc_free_security(&shp->shm_perm);
5361 }
5362
5363 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5364 {
5365         struct ipc_security_struct *isec;
5366         struct common_audit_data ad;
5367         u32 sid = current_sid();
5368
5369         isec = shp->shm_perm.security;
5370
5371         ad.type = LSM_AUDIT_DATA_IPC;
5372         ad.u.ipc_id = shp->shm_perm.key;
5373
5374         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5375                             SHM__ASSOCIATE, &ad);
5376 }
5377
5378 /* Note, at this point, shp is locked down */
5379 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5380 {
5381         int perms;
5382         int err;
5383
5384         switch (cmd) {
5385         case IPC_INFO:
5386         case SHM_INFO:
5387                 /* No specific object, just general system-wide information. */
5388                 return task_has_system(current, SYSTEM__IPC_INFO);
5389         case IPC_STAT:
5390         case SHM_STAT:
5391                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5392                 break;
5393         case IPC_SET:
5394                 perms = SHM__SETATTR;
5395                 break;
5396         case SHM_LOCK:
5397         case SHM_UNLOCK:
5398                 perms = SHM__LOCK;
5399                 break;
5400         case IPC_RMID:
5401                 perms = SHM__DESTROY;
5402                 break;
5403         default:
5404                 return 0;
5405         }
5406
5407         err = ipc_has_perm(&shp->shm_perm, perms);
5408         return err;
5409 }
5410
5411 static int selinux_shm_shmat(struct shmid_kernel *shp,
5412                              char __user *shmaddr, int shmflg)
5413 {
5414         u32 perms;
5415
5416         if (shmflg & SHM_RDONLY)
5417                 perms = SHM__READ;
5418         else
5419                 perms = SHM__READ | SHM__WRITE;
5420
5421         return ipc_has_perm(&shp->shm_perm, perms);
5422 }
5423
5424 /* Semaphore security operations */
5425 static int selinux_sem_alloc_security(struct sem_array *sma)
5426 {
5427         struct ipc_security_struct *isec;
5428         struct common_audit_data ad;
5429         u32 sid = current_sid();
5430         int rc;
5431
5432         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5433         if (rc)
5434                 return rc;
5435
5436         isec = sma->sem_perm.security;
5437
5438         ad.type = LSM_AUDIT_DATA_IPC;
5439         ad.u.ipc_id = sma->sem_perm.key;
5440
5441         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5442                           SEM__CREATE, &ad);
5443         if (rc) {
5444                 ipc_free_security(&sma->sem_perm);
5445                 return rc;
5446         }
5447         return 0;
5448 }
5449
5450 static void selinux_sem_free_security(struct sem_array *sma)
5451 {
5452         ipc_free_security(&sma->sem_perm);
5453 }
5454
5455 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5456 {
5457         struct ipc_security_struct *isec;
5458         struct common_audit_data ad;
5459         u32 sid = current_sid();
5460
5461         isec = sma->sem_perm.security;
5462
5463         ad.type = LSM_AUDIT_DATA_IPC;
5464         ad.u.ipc_id = sma->sem_perm.key;
5465
5466         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5467                             SEM__ASSOCIATE, &ad);
5468 }
5469
5470 /* Note, at this point, sma is locked down */
5471 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5472 {
5473         int err;
5474         u32 perms;
5475
5476         switch (cmd) {
5477         case IPC_INFO:
5478         case SEM_INFO:
5479                 /* No specific object, just general system-wide information. */
5480                 return task_has_system(current, SYSTEM__IPC_INFO);
5481         case GETPID:
5482         case GETNCNT:
5483         case GETZCNT:
5484                 perms = SEM__GETATTR;
5485                 break;
5486         case GETVAL:
5487         case GETALL:
5488                 perms = SEM__READ;
5489                 break;
5490         case SETVAL:
5491         case SETALL:
5492                 perms = SEM__WRITE;
5493                 break;
5494         case IPC_RMID:
5495                 perms = SEM__DESTROY;
5496                 break;
5497         case IPC_SET:
5498                 perms = SEM__SETATTR;
5499                 break;
5500         case IPC_STAT:
5501         case SEM_STAT:
5502                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5503                 break;
5504         default:
5505                 return 0;
5506         }
5507
5508         err = ipc_has_perm(&sma->sem_perm, perms);
5509         return err;
5510 }
5511
5512 static int selinux_sem_semop(struct sem_array *sma,
5513                              struct sembuf *sops, unsigned nsops, int alter)
5514 {
5515         u32 perms;
5516
5517         if (alter)
5518                 perms = SEM__READ | SEM__WRITE;
5519         else
5520                 perms = SEM__READ;
5521
5522         return ipc_has_perm(&sma->sem_perm, perms);
5523 }
5524
5525 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5526 {
5527         u32 av = 0;
5528
5529         av = 0;
5530         if (flag & S_IRUGO)
5531                 av |= IPC__UNIX_READ;
5532         if (flag & S_IWUGO)
5533                 av |= IPC__UNIX_WRITE;
5534
5535         if (av == 0)
5536                 return 0;
5537
5538         return ipc_has_perm(ipcp, av);
5539 }
5540
5541 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5542 {
5543         struct ipc_security_struct *isec = ipcp->security;
5544         *secid = isec->sid;
5545 }
5546
5547 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5548 {
5549         if (inode)
5550                 inode_doinit_with_dentry(inode, dentry);
5551 }
5552
5553 static int selinux_getprocattr(struct task_struct *p,
5554                                char *name, char **value)
5555 {
5556         const struct task_security_struct *__tsec;
5557         u32 sid;
5558         int error;
5559         unsigned len;
5560
5561         if (current != p) {
5562                 error = current_has_perm(p, PROCESS__GETATTR);
5563                 if (error)
5564                         return error;
5565         }
5566
5567         rcu_read_lock();
5568         __tsec = __task_cred(p)->security;
5569
5570         if (!strcmp(name, "current"))
5571                 sid = __tsec->sid;
5572         else if (!strcmp(name, "prev"))
5573                 sid = __tsec->osid;
5574         else if (!strcmp(name, "exec"))
5575                 sid = __tsec->exec_sid;
5576         else if (!strcmp(name, "fscreate"))
5577                 sid = __tsec->create_sid;
5578         else if (!strcmp(name, "keycreate"))
5579                 sid = __tsec->keycreate_sid;
5580         else if (!strcmp(name, "sockcreate"))
5581                 sid = __tsec->sockcreate_sid;
5582         else
5583                 goto invalid;
5584         rcu_read_unlock();
5585
5586         if (!sid)
5587                 return 0;
5588
5589         error = security_sid_to_context(sid, value, &len);
5590         if (error)
5591                 return error;
5592         return len;
5593
5594 invalid:
5595         rcu_read_unlock();
5596         return -EINVAL;
5597 }
5598
5599 static int selinux_setprocattr(struct task_struct *p,
5600                                char *name, void *value, size_t size)
5601 {
5602         struct task_security_struct *tsec;
5603         struct task_struct *tracer;
5604         struct cred *new;
5605         u32 sid = 0, ptsid;
5606         int error;
5607         char *str = value;
5608
5609         if (current != p) {
5610                 /* SELinux only allows a process to change its own
5611                    security attributes. */
5612                 return -EACCES;
5613         }
5614
5615         /*
5616          * Basic control over ability to set these attributes at all.
5617          * current == p, but we'll pass them separately in case the
5618          * above restriction is ever removed.
5619          */
5620         if (!strcmp(name, "exec"))
5621                 error = current_has_perm(p, PROCESS__SETEXEC);
5622         else if (!strcmp(name, "fscreate"))
5623                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5624         else if (!strcmp(name, "keycreate"))
5625                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5626         else if (!strcmp(name, "sockcreate"))
5627                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5628         else if (!strcmp(name, "current"))
5629                 error = current_has_perm(p, PROCESS__SETCURRENT);
5630         else
5631                 error = -EINVAL;
5632         if (error)
5633                 return error;
5634
5635         /* Obtain a SID for the context, if one was specified. */
5636         if (size && str[1] && str[1] != '\n') {
5637                 if (str[size-1] == '\n') {
5638                         str[size-1] = 0;
5639                         size--;
5640                 }
5641                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5642                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5643                         if (!capable(CAP_MAC_ADMIN)) {
5644                                 struct audit_buffer *ab;
5645                                 size_t audit_size;
5646
5647                                 /* We strip a nul only if it is at the end, otherwise the
5648                                  * context contains a nul and we should audit that */
5649                                 if (str[size - 1] == '\0')
5650                                         audit_size = size - 1;
5651                                 else
5652                                         audit_size = size;
5653                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5654                                 audit_log_format(ab, "op=fscreate invalid_context=");
5655                                 audit_log_n_untrustedstring(ab, value, audit_size);
5656                                 audit_log_end(ab);
5657
5658                                 return error;
5659                         }
5660                         error = security_context_to_sid_force(value, size,
5661                                                               &sid);
5662                 }
5663                 if (error)
5664                         return error;
5665         }
5666
5667         new = prepare_creds();
5668         if (!new)
5669                 return -ENOMEM;
5670
5671         /* Permission checking based on the specified context is
5672            performed during the actual operation (execve,
5673            open/mkdir/...), when we know the full context of the
5674            operation.  See selinux_bprm_set_creds for the execve
5675            checks and may_create for the file creation checks. The
5676            operation will then fail if the context is not permitted. */
5677         tsec = new->security;
5678         if (!strcmp(name, "exec")) {
5679                 tsec->exec_sid = sid;
5680         } else if (!strcmp(name, "fscreate")) {
5681                 tsec->create_sid = sid;
5682         } else if (!strcmp(name, "keycreate")) {
5683                 error = may_create_key(sid, p);
5684                 if (error)
5685                         goto abort_change;
5686                 tsec->keycreate_sid = sid;
5687         } else if (!strcmp(name, "sockcreate")) {
5688                 tsec->sockcreate_sid = sid;
5689         } else if (!strcmp(name, "current")) {
5690                 error = -EINVAL;
5691                 if (sid == 0)
5692                         goto abort_change;
5693
5694                 /* Only allow single threaded processes to change context */
5695                 error = -EPERM;
5696                 if (!current_is_single_threaded()) {
5697                         error = security_bounded_transition(tsec->sid, sid);
5698                         if (error)
5699                                 goto abort_change;
5700                 }
5701
5702                 /* Check permissions for the transition. */
5703                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5704                                      PROCESS__DYNTRANSITION, NULL);
5705                 if (error)
5706                         goto abort_change;
5707
5708                 /* Check for ptracing, and update the task SID if ok.
5709                    Otherwise, leave SID unchanged and fail. */
5710                 ptsid = 0;
5711                 rcu_read_lock();
5712                 tracer = ptrace_parent(p);
5713                 if (tracer)
5714                         ptsid = task_sid(tracer);
5715                 rcu_read_unlock();
5716
5717                 if (tracer) {
5718                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5719                                              PROCESS__PTRACE, NULL);
5720                         if (error)
5721                                 goto abort_change;
5722                 }
5723
5724                 tsec->sid = sid;
5725         } else {
5726                 error = -EINVAL;
5727                 goto abort_change;
5728         }
5729
5730         commit_creds(new);
5731         return size;
5732
5733 abort_change:
5734         abort_creds(new);
5735         return error;
5736 }
5737
5738 static int selinux_ismaclabel(const char *name)
5739 {
5740         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5741 }
5742
5743 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5744 {
5745         return security_sid_to_context(secid, secdata, seclen);
5746 }
5747
5748 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5749 {
5750         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5751 }
5752
5753 static void selinux_release_secctx(char *secdata, u32 seclen)
5754 {
5755         kfree(secdata);
5756 }
5757
5758 /*
5759  *      called with inode->i_mutex locked
5760  */
5761 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5762 {
5763         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5764 }
5765
5766 /*
5767  *      called with inode->i_mutex locked
5768  */
5769 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5770 {
5771         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5772 }
5773
5774 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5775 {
5776         int len = 0;
5777         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5778                                                 ctx, true);
5779         if (len < 0)
5780                 return len;
5781         *ctxlen = len;
5782         return 0;
5783 }
5784 #ifdef CONFIG_KEYS
5785
5786 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5787                              unsigned long flags)
5788 {
5789         const struct task_security_struct *tsec;
5790         struct key_security_struct *ksec;
5791
5792         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5793         if (!ksec)
5794                 return -ENOMEM;
5795
5796         tsec = cred->security;
5797         if (tsec->keycreate_sid)
5798                 ksec->sid = tsec->keycreate_sid;
5799         else
5800                 ksec->sid = tsec->sid;
5801
5802         k->security = ksec;
5803         return 0;
5804 }
5805
5806 static void selinux_key_free(struct key *k)
5807 {
5808         struct key_security_struct *ksec = k->security;
5809
5810         k->security = NULL;
5811         kfree(ksec);
5812 }
5813
5814 static int selinux_key_permission(key_ref_t key_ref,
5815                                   const struct cred *cred,
5816                                   unsigned perm)
5817 {
5818         struct key *key;
5819         struct key_security_struct *ksec;
5820         u32 sid;
5821
5822         /* if no specific permissions are requested, we skip the
5823            permission check. No serious, additional covert channels
5824            appear to be created. */
5825         if (perm == 0)
5826                 return 0;
5827
5828         sid = cred_sid(cred);
5829
5830         key = key_ref_to_ptr(key_ref);
5831         ksec = key->security;
5832
5833         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5834 }
5835
5836 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5837 {
5838         struct key_security_struct *ksec = key->security;
5839         char *context = NULL;
5840         unsigned len;
5841         int rc;
5842
5843         rc = security_sid_to_context(ksec->sid, &context, &len);
5844         if (!rc)
5845                 rc = len;
5846         *_buffer = context;
5847         return rc;
5848 }
5849
5850 #endif
5851
5852 static struct security_hook_list selinux_hooks[] = {
5853         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5854         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5855         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5856         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5857
5858         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5859         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5860         LSM_HOOK_INIT(capget, selinux_capget),
5861         LSM_HOOK_INIT(capset, selinux_capset),
5862         LSM_HOOK_INIT(capable, selinux_capable),
5863         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5864         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5865         LSM_HOOK_INIT(syslog, selinux_syslog),
5866         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5867
5868         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5869
5870         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5871         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5872         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5873         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5874
5875         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5876         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5877         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5878         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5879         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5880         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5881         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5882         LSM_HOOK_INIT(sb_mount, selinux_mount),
5883         LSM_HOOK_INIT(sb_umount, selinux_umount),
5884         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5885         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5886         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5887
5888         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5889
5890         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5891         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5892         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5893         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5894         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5895         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5896         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5897         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5898         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5899         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5900         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5901         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5902         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5903         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5904         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5905         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5906         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5907         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5908         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5909         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5910         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5911         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5912         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5913         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5914         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5915
5916         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5917         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5918         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5919         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5920         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5921         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5922         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5923         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5924         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5925         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5926         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5927         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5928
5929         LSM_HOOK_INIT(file_open, selinux_file_open),
5930
5931         LSM_HOOK_INIT(task_create, selinux_task_create),
5932         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5933         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5934         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5935         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5936         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5937         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5938         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5939         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5940         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5941         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5942         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5943         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5944         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5945         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5946         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5947         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5948         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5949         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5950         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5951         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5952         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5953
5954         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5955         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5956
5957         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5958         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5959
5960         LSM_HOOK_INIT(msg_queue_alloc_security,
5961                         selinux_msg_queue_alloc_security),
5962         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5963         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5964         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5965         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5966         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5967
5968         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5969         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5970         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5971         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5972         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5973
5974         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5975         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5976         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5977         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5978         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5979
5980         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5981
5982         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5983         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5984
5985         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5986         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5987         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5988         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5989         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5990         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5991         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5992
5993         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5994         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5995
5996         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5997         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5998         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5999         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6000         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6001         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6002         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6003         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6004         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6005         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6006         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6007         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6008         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6009         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6010         LSM_HOOK_INIT(socket_getpeersec_stream,
6011                         selinux_socket_getpeersec_stream),
6012         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6013         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6014         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6015         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6016         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6017         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6018         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6019         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6020         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6021         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6022         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6023         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6024         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6025         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6026         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6027         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6028         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6029         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6030         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6031
6032 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6033         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6034         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6035         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6036         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6037         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6038         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6039                         selinux_xfrm_state_alloc_acquire),
6040         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6041         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6042         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6043         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6044                         selinux_xfrm_state_pol_flow_match),
6045         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6046 #endif
6047
6048 #ifdef CONFIG_KEYS
6049         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6050         LSM_HOOK_INIT(key_free, selinux_key_free),
6051         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6052         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6053 #endif
6054
6055 #ifdef CONFIG_AUDIT
6056         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6057         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6058         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6059         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6060 #endif
6061 };
6062
6063 static __init int selinux_init(void)
6064 {
6065         if (!security_module_enable("selinux")) {
6066                 selinux_enabled = 0;
6067                 return 0;
6068         }
6069
6070         if (!selinux_enabled) {
6071                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6072                 return 0;
6073         }
6074
6075         printk(KERN_INFO "SELinux:  Initializing.\n");
6076
6077         /* Set the security state for the initial task. */
6078         cred_init_security();
6079
6080         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6081
6082         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6083                                             sizeof(struct inode_security_struct),
6084                                             0, SLAB_PANIC, NULL);
6085         avc_init();
6086
6087         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6088
6089         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6090                 panic("SELinux: Unable to register AVC netcache callback\n");
6091
6092         if (selinux_enforcing)
6093                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6094         else
6095                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6096
6097         return 0;
6098 }
6099
6100 static void delayed_superblock_init(struct super_block *sb, void *unused)
6101 {
6102         superblock_doinit(sb, NULL);
6103 }
6104
6105 void selinux_complete_init(void)
6106 {
6107         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6108
6109         /* Set up any superblocks initialized prior to the policy load. */
6110         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6111         iterate_supers(delayed_superblock_init, NULL);
6112 }
6113
6114 /* SELinux requires early initialization in order to label
6115    all processes and objects when they are created. */
6116 security_initcall(selinux_init);
6117
6118 #if defined(CONFIG_NETFILTER)
6119
6120 static struct nf_hook_ops selinux_nf_ops[] = {
6121         {
6122                 .hook =         selinux_ipv4_postroute,
6123                 .owner =        THIS_MODULE,
6124                 .pf =           NFPROTO_IPV4,
6125                 .hooknum =      NF_INET_POST_ROUTING,
6126                 .priority =     NF_IP_PRI_SELINUX_LAST,
6127         },
6128         {
6129                 .hook =         selinux_ipv4_forward,
6130                 .owner =        THIS_MODULE,
6131                 .pf =           NFPROTO_IPV4,
6132                 .hooknum =      NF_INET_FORWARD,
6133                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6134         },
6135         {
6136                 .hook =         selinux_ipv4_output,
6137                 .owner =        THIS_MODULE,
6138                 .pf =           NFPROTO_IPV4,
6139                 .hooknum =      NF_INET_LOCAL_OUT,
6140                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6141         },
6142 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6143         {
6144                 .hook =         selinux_ipv6_postroute,
6145                 .owner =        THIS_MODULE,
6146                 .pf =           NFPROTO_IPV6,
6147                 .hooknum =      NF_INET_POST_ROUTING,
6148                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6149         },
6150         {
6151                 .hook =         selinux_ipv6_forward,
6152                 .owner =        THIS_MODULE,
6153                 .pf =           NFPROTO_IPV6,
6154                 .hooknum =      NF_INET_FORWARD,
6155                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6156         },
6157 #endif  /* IPV6 */
6158 };
6159
6160 static int __init selinux_nf_ip_init(void)
6161 {
6162         int err;
6163
6164         if (!selinux_enabled)
6165                 return 0;
6166
6167         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6168
6169         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6170         if (err)
6171                 panic("SELinux: nf_register_hooks: error %d\n", err);
6172
6173         return 0;
6174 }
6175
6176 __initcall(selinux_nf_ip_init);
6177
6178 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6179 static void selinux_nf_ip_exit(void)
6180 {
6181         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6182
6183         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6184 }
6185 #endif
6186
6187 #else /* CONFIG_NETFILTER */
6188
6189 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6190 #define selinux_nf_ip_exit()
6191 #endif
6192
6193 #endif /* CONFIG_NETFILTER */
6194
6195 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6196 static int selinux_disabled;
6197
6198 int selinux_disable(void)
6199 {
6200         if (ss_initialized) {
6201                 /* Not permitted after initial policy load. */
6202                 return -EINVAL;
6203         }
6204
6205         if (selinux_disabled) {
6206                 /* Only do this once. */
6207                 return -EINVAL;
6208         }
6209
6210         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6211
6212         selinux_disabled = 1;
6213         selinux_enabled = 0;
6214
6215         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6216
6217         /* Try to destroy the avc node cache */
6218         avc_disable();
6219
6220         /* Unregister netfilter hooks. */
6221         selinux_nf_ip_exit();
6222
6223         /* Unregister selinuxfs. */
6224         exit_sel_fs();
6225
6226         return 0;
6227 }
6228 #endif