security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/security.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 #define NUM_SEL_MNT_OPTS 5
  99
 100 extern struct security_operations *security_ops;
 101
 102 /* SECMARK reference count */
 103 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 104
 105 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 106 int selinux_enforcing;
 107
 108 static int __init enforcing_setup(char *str)
 109 {
 110         unsigned long enforcing;
 111         if (!strict_strtoul(str, 0, &enforcing))
 112                 selinux_enforcing = enforcing ? 1 : 0;
 113         return 1;
 114 }
 115 __setup("enforcing=", enforcing_setup);
 116 #endif
 117
 118 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 119 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 120
 121 static int __init selinux_enabled_setup(char *str)
 122 {
 123         unsigned long enabled;
 124         if (!strict_strtoul(str, 0, &enabled))
 125                 selinux_enabled = enabled ? 1 : 0;
 126         return 1;
 127 }
 128 __setup("selinux=", selinux_enabled_setup);
 129 #else
 130 int selinux_enabled = 1;
 131 #endif
 132
 133 static struct kmem_cache *sel_inode_cache;
 134
 135 /**
 136  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 137  *
 138  * Description:
 139  * This function checks the SECMARK reference counter to see if any SECMARK
 140  * targets are currently configured, if the reference counter is greater than
 141  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 142  * enabled, false (0) if SECMARK is disabled.
 143  *
 144  */
 145 static int selinux_secmark_enabled(void)
 146 {
 147         return (atomic_read(&selinux_secmark_refcount) > 0);
 148 }
 149
 150 /*
 151  * initialise the security for the init task
 152  */
 153 static void cred_init_security(void)
 154 {
 155         struct cred *cred = (struct cred *) current->real_cred;
 156         struct task_security_struct *tsec;
 157
 158         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 159         if (!tsec)
 160                 panic("SELinux:  Failed to initialize initial task.\n");
 161
 162         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 163         cred->security = tsec;
 164 }
 165
 166 /*
 167  * get the security ID of a set of credentials
 168  */
 169 static inline u32 cred_sid(const struct cred *cred)
 170 {
 171         const struct task_security_struct *tsec;
 172
 173         tsec = cred->security;
 174         return tsec->sid;
 175 }
 176
 177 /*
 178  * get the objective security ID of a task
 179  */
 180 static inline u32 task_sid(const struct task_struct *task)
 181 {
 182         u32 sid;
 183
 184         rcu_read_lock();
 185         sid = cred_sid(__task_cred(task));
 186         rcu_read_unlock();
 187         return sid;
 188 }
 189
 190 /*
 191  * get the subjective security ID of the current task
 192  */
 193 static inline u32 current_sid(void)
 194 {
 195         const struct task_security_struct *tsec = current_security();
 196
 197         return tsec->sid;
 198 }
 199
 200 /* Allocate and free functions for each kind of security blob. */
 201
 202 static int inode_alloc_security(struct inode *inode)
 203 {
 204         struct inode_security_struct *isec;
 205         u32 sid = current_sid();
 206
 207         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 208         if (!isec)
 209                 return -ENOMEM;
 210
 211         mutex_init(&isec->lock);
 212         INIT_LIST_HEAD(&isec->list);
 213         isec->inode = inode;
 214         isec->sid = SECINITSID_UNLABELED;
 215         isec->sclass = SECCLASS_FILE;
 216         isec->task_sid = sid;
 217         inode->i_security = isec;
 218
 219         return 0;
 220 }
 221
 222 static void inode_free_security(struct inode *inode)
 223 {
 224         struct inode_security_struct *isec = inode->i_security;
 225         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 226
 227         spin_lock(&sbsec->isec_lock);
 228         if (!list_empty(&isec->list))
 229                 list_del_init(&isec->list);
 230         spin_unlock(&sbsec->isec_lock);
 231
 232         inode->i_security = NULL;
 233         kmem_cache_free(sel_inode_cache, isec);
 234 }
 235
 236 static int file_alloc_security(struct file *file)
 237 {
 238         struct file_security_struct *fsec;
 239         u32 sid = current_sid();
 240
 241         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 242         if (!fsec)
 243                 return -ENOMEM;
 244
 245         fsec->sid = sid;
 246         fsec->fown_sid = sid;
 247         file->f_security = fsec;
 248
 249         return 0;
 250 }
 251
 252 static void file_free_security(struct file *file)
 253 {
 254         struct file_security_struct *fsec = file->f_security;
 255         file->f_security = NULL;
 256         kfree(fsec);
 257 }
 258
 259 static int superblock_alloc_security(struct super_block *sb)
 260 {
 261         struct superblock_security_struct *sbsec;
 262
 263         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 264         if (!sbsec)
 265                 return -ENOMEM;
 266
 267         mutex_init(&sbsec->lock);
 268         INIT_LIST_HEAD(&sbsec->isec_head);
 269         spin_lock_init(&sbsec->isec_lock);
 270         sbsec->sb = sb;
 271         sbsec->sid = SECINITSID_UNLABELED;
 272         sbsec->def_sid = SECINITSID_FILE;
 273         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 274         sb->s_security = sbsec;
 275
 276         return 0;
 277 }
 278
 279 static void superblock_free_security(struct super_block *sb)
 280 {
 281         struct superblock_security_struct *sbsec = sb->s_security;
 282         sb->s_security = NULL;
 283         kfree(sbsec);
 284 }
 285
 286 /* The file system's label must be initialized prior to use. */
 287
 288 static const char *labeling_behaviors[7] = {
 289         "uses xattr",
 290         "uses transition SIDs",
 291         "uses task SIDs",
 292         "uses genfs_contexts",
 293         "not configured for labeling",
 294         "uses mountpoint labeling",
 295         "uses native labeling",
 296 };
 297
 298 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 299
 300 static inline int inode_doinit(struct inode *inode)
 301 {
 302         return inode_doinit_with_dentry(inode, NULL);
 303 }
 304
 305 enum {
 306         Opt_error = -1,
 307         Opt_context = 1,
 308         Opt_fscontext = 2,
 309         Opt_defcontext = 3,
 310         Opt_rootcontext = 4,
 311         Opt_labelsupport = 5,
 312 };
 313
 314 static const match_table_t tokens = {
 315         {Opt_context, CONTEXT_STR "%s"},
 316         {Opt_fscontext, FSCONTEXT_STR "%s"},
 317         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 318         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 319         {Opt_labelsupport, LABELSUPP_STR},
 320         {Opt_error, NULL},
 321 };
 322
 323 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 324
 325 static int may_context_mount_sb_relabel(u32 sid,
 326                         struct superblock_security_struct *sbsec,
 327                         const struct cred *cred)
 328 {
 329         const struct task_security_struct *tsec = cred->security;
 330         int rc;
 331
 332         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 333                           FILESYSTEM__RELABELFROM, NULL);
 334         if (rc)
 335                 return rc;
 336
 337         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 338                           FILESYSTEM__RELABELTO, NULL);
 339         return rc;
 340 }
 341
 342 static int may_context_mount_inode_relabel(u32 sid,
 343                         struct superblock_security_struct *sbsec,
 344                         const struct cred *cred)
 345 {
 346         const struct task_security_struct *tsec = cred->security;
 347         int rc;
 348         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 349                           FILESYSTEM__RELABELFROM, NULL);
 350         if (rc)
 351                 return rc;
 352
 353         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 354                           FILESYSTEM__ASSOCIATE, NULL);
 355         return rc;
 356 }
 357
 358 static int sb_finish_set_opts(struct super_block *sb)
 359 {
 360         struct superblock_security_struct *sbsec = sb->s_security;
 361         struct dentry *root = sb->s_root;
 362         struct inode *root_inode = root->d_inode;
 363         int rc = 0;
 364
 365         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 366                 /* Make sure that the xattr handler exists and that no
 367                    error other than -ENODATA is returned by getxattr on
 368                    the root directory.  -ENODATA is ok, as this may be
 369                    the first boot of the SELinux kernel before we have
 370                    assigned xattr values to the filesystem. */
 371                 if (!root_inode->i_op->getxattr) {
 372                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 373                                "xattr support\n", sb->s_id, sb->s_type->name);
 374                         rc = -EOPNOTSUPP;
 375                         goto out;
 376                 }
 377                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 378                 if (rc < 0 && rc != -ENODATA) {
 379                         if (rc == -EOPNOTSUPP)
 380                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 381                                        "%s) has no security xattr handler\n",
 382                                        sb->s_id, sb->s_type->name);
 383                         else
 384                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 385                                        "%s) getxattr errno %d\n", sb->s_id,
 386                                        sb->s_type->name, -rc);
 387                         goto out;
 388                 }
 389         }
 390
 391         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 392
 393         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 394                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 395                        sb->s_id, sb->s_type->name);
 396         else
 397                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 398                        sb->s_id, sb->s_type->name,
 399                        labeling_behaviors[sbsec->behavior-1]);
 400
 401         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 402             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 403             sbsec->behavior == SECURITY_FS_USE_NONE ||
 404             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 405                 sbsec->flags &= ~SE_SBLABELSUPP;
 406
 407         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 408         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 409                 sbsec->flags |= SE_SBLABELSUPP;
 410
 411         /* Initialize the root inode. */
 412         rc = inode_doinit_with_dentry(root_inode, root);
 413
 414         /* Initialize any other inodes associated with the superblock, e.g.
 415            inodes created prior to initial policy load or inodes created
 416            during get_sb by a pseudo filesystem that directly
 417            populates itself. */
 418         spin_lock(&sbsec->isec_lock);
 419 next_inode:
 420         if (!list_empty(&sbsec->isec_head)) {
 421                 struct inode_security_struct *isec =
 422                                 list_entry(sbsec->isec_head.next,
 423                                            struct inode_security_struct, list);
 424                 struct inode *inode = isec->inode;
 425                 spin_unlock(&sbsec->isec_lock);
 426                 inode = igrab(inode);
 427                 if (inode) {
 428                         if (!IS_PRIVATE(inode))
 429                                 inode_doinit(inode);
 430                         iput(inode);
 431                 }
 432                 spin_lock(&sbsec->isec_lock);
 433                 list_del_init(&isec->list);
 434                 goto next_inode;
 435         }
 436         spin_unlock(&sbsec->isec_lock);
 437 out:
 438         return rc;
 439 }
 440
 441 /*
 442  * This function should allow an FS to ask what it's mount security
 443  * options were so it can use those later for submounts, displaying
 444  * mount options, or whatever.
 445  */
 446 static int selinux_get_mnt_opts(const struct super_block *sb,
 447                                 struct security_mnt_opts *opts)
 448 {
 449         int rc = 0, i;
 450         struct superblock_security_struct *sbsec = sb->s_security;
 451         char *context = NULL;
 452         u32 len;
 453         char tmp;
 454
 455         security_init_mnt_opts(opts);
 456
 457         if (!(sbsec->flags & SE_SBINITIALIZED))
 458                 return -EINVAL;
 459
 460         if (!ss_initialized)
 461                 return -EINVAL;
 462
 463         tmp = sbsec->flags & SE_MNTMASK;
 464         /* count the number of mount options for this sb */
 465         for (i = 0; i < 8; i++) {
 466                 if (tmp & 0x01)
 467                         opts->num_mnt_opts++;
 468                 tmp >>= 1;
 469         }
 470         /* Check if the Label support flag is set */
 471         if (sbsec->flags & SE_SBLABELSUPP)
 472                 opts->num_mnt_opts++;
 473
 474         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 475         if (!opts->mnt_opts) {
 476                 rc = -ENOMEM;
 477                 goto out_free;
 478         }
 479
 480         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 481         if (!opts->mnt_opts_flags) {
 482                 rc = -ENOMEM;
 483                 goto out_free;
 484         }
 485
 486         i = 0;
 487         if (sbsec->flags & FSCONTEXT_MNT) {
 488                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 489                 if (rc)
 490                         goto out_free;
 491                 opts->mnt_opts[i] = context;
 492                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 493         }
 494         if (sbsec->flags & CONTEXT_MNT) {
 495                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 496                 if (rc)
 497                         goto out_free;
 498                 opts->mnt_opts[i] = context;
 499                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 500         }
 501         if (sbsec->flags & DEFCONTEXT_MNT) {
 502                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 503                 if (rc)
 504                         goto out_free;
 505                 opts->mnt_opts[i] = context;
 506                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 507         }
 508         if (sbsec->flags & ROOTCONTEXT_MNT) {
 509                 struct inode *root = sbsec->sb->s_root->d_inode;
 510                 struct inode_security_struct *isec = root->i_security;
 511
 512                 rc = security_sid_to_context(isec->sid, &context, &len);
 513                 if (rc)
 514                         goto out_free;
 515                 opts->mnt_opts[i] = context;
 516                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 517         }
 518         if (sbsec->flags & SE_SBLABELSUPP) {
 519                 opts->mnt_opts[i] = NULL;
 520                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 521         }
 522
 523         BUG_ON(i != opts->num_mnt_opts);
 524
 525         return 0;
 526
 527 out_free:
 528         security_free_mnt_opts(opts);
 529         return rc;
 530 }
 531
 532 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 533                       u32 old_sid, u32 new_sid)
 534 {
 535         char mnt_flags = sbsec->flags & SE_MNTMASK;
 536
 537         /* check if the old mount command had the same options */
 538         if (sbsec->flags & SE_SBINITIALIZED)
 539                 if (!(sbsec->flags & flag) ||
 540                     (old_sid != new_sid))
 541                         return 1;
 542
 543         /* check if we were passed the same options twice,
 544          * aka someone passed context=a,context=b
 545          */
 546         if (!(sbsec->flags & SE_SBINITIALIZED))
 547                 if (mnt_flags & flag)
 548                         return 1;
 549         return 0;
 550 }
 551
 552 /*
 553  * Allow filesystems with binary mount data to explicitly set mount point
 554  * labeling information.
 555  */
 556 static int selinux_set_mnt_opts(struct super_block *sb,
 557                                 struct security_mnt_opts *opts,
 558                                 unsigned long kern_flags,
 559                                 unsigned long *set_kern_flags)
 560 {
 561         const struct cred *cred = current_cred();
 562         int rc = 0, i;
 563         struct superblock_security_struct *sbsec = sb->s_security;
 564         const char *name = sb->s_type->name;
 565         struct inode *inode = sbsec->sb->s_root->d_inode;
 566         struct inode_security_struct *root_isec = inode->i_security;
 567         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 568         u32 defcontext_sid = 0;
 569         char **mount_options = opts->mnt_opts;
 570         int *flags = opts->mnt_opts_flags;
 571         int num_opts = opts->num_mnt_opts;
 572
 573         mutex_lock(&sbsec->lock);
 574
 575         if (!ss_initialized) {
 576                 if (!num_opts) {
 577                         /* Defer initialization until selinux_complete_init,
 578                            after the initial policy is loaded and the security
 579                            server is ready to handle calls. */
 580                         goto out;
 581                 }
 582                 rc = -EINVAL;
 583                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 584                         "before the security server is initialized\n");
 585                 goto out;
 586         }
 587         if (kern_flags && !set_kern_flags) {
 588                 /* Specifying internal flags without providing a place to
 589                  * place the results is not allowed */
 590                 rc = -EINVAL;
 591                 goto out;
 592         }
 593
 594         /*
 595          * Binary mount data FS will come through this function twice.  Once
 596          * from an explicit call and once from the generic calls from the vfs.
 597          * Since the generic VFS calls will not contain any security mount data
 598          * we need to skip the double mount verification.
 599          *
 600          * This does open a hole in which we will not notice if the first
 601          * mount using this sb set explict options and a second mount using
 602          * this sb does not set any security options.  (The first options
 603          * will be used for both mounts)
 604          */
 605         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 606             && (num_opts == 0))
 607                 goto out;
 608
 609         /*
 610          * parse the mount options, check if they are valid sids.
 611          * also check if someone is trying to mount the same sb more
 612          * than once with different security options.
 613          */
 614         for (i = 0; i < num_opts; i++) {
 615                 u32 sid;
 616
 617                 if (flags[i] == SE_SBLABELSUPP)
 618                         continue;
 619                 rc = security_context_to_sid(mount_options[i],
 620                                              strlen(mount_options[i]), &sid);
 621                 if (rc) {
 622                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 623                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 624                                mount_options[i], sb->s_id, name, rc);
 625                         goto out;
 626                 }
 627                 switch (flags[i]) {
 628                 case FSCONTEXT_MNT:
 629                         fscontext_sid = sid;
 630
 631                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 632                                         fscontext_sid))
 633                                 goto out_double_mount;
 634
 635                         sbsec->flags |= FSCONTEXT_MNT;
 636                         break;
 637                 case CONTEXT_MNT:
 638                         context_sid = sid;
 639
 640                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 641                                         context_sid))
 642                                 goto out_double_mount;
 643
 644                         sbsec->flags |= CONTEXT_MNT;
 645                         break;
 646                 case ROOTCONTEXT_MNT:
 647                         rootcontext_sid = sid;
 648
 649                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 650                                         rootcontext_sid))
 651                                 goto out_double_mount;
 652
 653                         sbsec->flags |= ROOTCONTEXT_MNT;
 654
 655                         break;
 656                 case DEFCONTEXT_MNT:
 657                         defcontext_sid = sid;
 658
 659                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 660                                         defcontext_sid))
 661                                 goto out_double_mount;
 662
 663                         sbsec->flags |= DEFCONTEXT_MNT;
 664
 665                         break;
 666                 default:
 667                         rc = -EINVAL;
 668                         goto out;
 669                 }
 670         }
 671
 672         if (sbsec->flags & SE_SBINITIALIZED) {
 673                 /* previously mounted with options, but not on this attempt? */
 674                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 675                         goto out_double_mount;
 676                 rc = 0;
 677                 goto out;
 678         }
 679
 680         if (strcmp(sb->s_type->name, "proc") == 0)
 681                 sbsec->flags |= SE_SBPROC;
 682
 683         if (!sbsec->behavior) {
 684                 /*
 685                  * Determine the labeling behavior to use for this
 686                  * filesystem type.
 687                  */
 688                 rc = security_fs_use((sbsec->flags & SE_SBPROC) ?
 689                                         "proc" : sb->s_type->name,
 690                                         &sbsec->behavior, &sbsec->sid);
 691                 if (rc) {
 692                         printk(KERN_WARNING
 693                                 "%s: security_fs_use(%s) returned %d\n",
 694                                         __func__, sb->s_type->name, rc);
 695                         goto out;
 696                 }
 697         }
 698         /* sets the context of the superblock for the fs being mounted. */
 699         if (fscontext_sid) {
 700                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 701                 if (rc)
 702                         goto out;
 703
 704                 sbsec->sid = fscontext_sid;
 705         }
 706
 707         /*
 708          * Switch to using mount point labeling behavior.
 709          * sets the label used on all file below the mountpoint, and will set
 710          * the superblock context if not already set.
 711          */
 712         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 713                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 714                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 715         }
 716
 717         if (context_sid) {
 718                 if (!fscontext_sid) {
 719                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 720                                                           cred);
 721                         if (rc)
 722                                 goto out;
 723                         sbsec->sid = context_sid;
 724                 } else {
 725                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 726                                                              cred);
 727                         if (rc)
 728                                 goto out;
 729                 }
 730                 if (!rootcontext_sid)
 731                         rootcontext_sid = context_sid;
 732
 733                 sbsec->mntpoint_sid = context_sid;
 734                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 735         }
 736
 737         if (rootcontext_sid) {
 738                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 739                                                      cred);
 740                 if (rc)
 741                         goto out;
 742
 743                 root_isec->sid = rootcontext_sid;
 744                 root_isec->initialized = 1;
 745         }
 746
 747         if (defcontext_sid) {
 748                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 749                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 750                         rc = -EINVAL;
 751                         printk(KERN_WARNING "SELinux: defcontext option is "
 752                                "invalid for this filesystem type\n");
 753                         goto out;
 754                 }
 755
 756                 if (defcontext_sid != sbsec->def_sid) {
 757                         rc = may_context_mount_inode_relabel(defcontext_sid,
 758                                                              sbsec, cred);
 759                         if (rc)
 760                                 goto out;
 761                 }
 762
 763                 sbsec->def_sid = defcontext_sid;
 764         }
 765
 766         rc = sb_finish_set_opts(sb);
 767 out:
 768         mutex_unlock(&sbsec->lock);
 769         return rc;
 770 out_double_mount:
 771         rc = -EINVAL;
 772         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 773                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 774         goto out;
 775 }
 776
 777 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 778                                     const struct super_block *newsb)
 779 {
 780         struct superblock_security_struct *old = oldsb->s_security;
 781         struct superblock_security_struct *new = newsb->s_security;
 782         char oldflags = old->flags & SE_MNTMASK;
 783         char newflags = new->flags & SE_MNTMASK;
 784
 785         if (oldflags != newflags)
 786                 goto mismatch;
 787         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 788                 goto mismatch;
 789         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 790                 goto mismatch;
 791         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 792                 goto mismatch;
 793         if (oldflags & ROOTCONTEXT_MNT) {
 794                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 795                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 796                 if (oldroot->sid != newroot->sid)
 797                         goto mismatch;
 798         }
 799         return 0;
 800 mismatch:
 801         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 802                             "different security settings for (dev %s, "
 803                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 804         return -EBUSY;
 805 }
 806
 807 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 808                                         struct super_block *newsb)
 809 {
 810         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 811         struct superblock_security_struct *newsbsec = newsb->s_security;
 812
 813         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 814         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 815         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 816
 817         /*
 818          * if the parent was able to be mounted it clearly had no special lsm
 819          * mount options.  thus we can safely deal with this superblock later
 820          */
 821         if (!ss_initialized)
 822                 return 0;
 823
 824         /* how can we clone if the old one wasn't set up?? */
 825         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 826
 827         /* if fs is reusing a sb, make sure that the contexts match */
 828         if (newsbsec->flags & SE_SBINITIALIZED)
 829                 return selinux_cmp_sb_context(oldsb, newsb);
 830
 831         mutex_lock(&newsbsec->lock);
 832
 833         newsbsec->flags = oldsbsec->flags;
 834
 835         newsbsec->sid = oldsbsec->sid;
 836         newsbsec->def_sid = oldsbsec->def_sid;
 837         newsbsec->behavior = oldsbsec->behavior;
 838
 839         if (set_context) {
 840                 u32 sid = oldsbsec->mntpoint_sid;
 841
 842                 if (!set_fscontext)
 843                         newsbsec->sid = sid;
 844                 if (!set_rootcontext) {
 845                         struct inode *newinode = newsb->s_root->d_inode;
 846                         struct inode_security_struct *newisec = newinode->i_security;
 847                         newisec->sid = sid;
 848                 }
 849                 newsbsec->mntpoint_sid = sid;
 850         }
 851         if (set_rootcontext) {
 852                 const struct inode *oldinode = oldsb->s_root->d_inode;
 853                 const struct inode_security_struct *oldisec = oldinode->i_security;
 854                 struct inode *newinode = newsb->s_root->d_inode;
 855                 struct inode_security_struct *newisec = newinode->i_security;
 856
 857                 newisec->sid = oldisec->sid;
 858         }
 859
 860         sb_finish_set_opts(newsb);
 861         mutex_unlock(&newsbsec->lock);
 862         return 0;
 863 }
 864
 865 static int selinux_parse_opts_str(char *options,
 866                                   struct security_mnt_opts *opts)
 867 {
 868         char *p;
 869         char *context = NULL, *defcontext = NULL;
 870         char *fscontext = NULL, *rootcontext = NULL;
 871         int rc, num_mnt_opts = 0;
 872
 873         opts->num_mnt_opts = 0;
 874
 875         /* Standard string-based options. */
 876         while ((p = strsep(&options, "|")) != NULL) {
 877                 int token;
 878                 substring_t args[MAX_OPT_ARGS];
 879
 880                 if (!*p)
 881                         continue;
 882
 883                 token = match_token(p, tokens, args);
 884
 885                 switch (token) {
 886                 case Opt_context:
 887                         if (context || defcontext) {
 888                                 rc = -EINVAL;
 889                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 890                                 goto out_err;
 891                         }
 892                         context = match_strdup(&args[0]);
 893                         if (!context) {
 894                                 rc = -ENOMEM;
 895                                 goto out_err;
 896                         }
 897                         break;
 898
 899                 case Opt_fscontext:
 900                         if (fscontext) {
 901                                 rc = -EINVAL;
 902                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 903                                 goto out_err;
 904                         }
 905                         fscontext = match_strdup(&args[0]);
 906                         if (!fscontext) {
 907                                 rc = -ENOMEM;
 908                                 goto out_err;
 909                         }
 910                         break;
 911
 912                 case Opt_rootcontext:
 913                         if (rootcontext) {
 914                                 rc = -EINVAL;
 915                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 916                                 goto out_err;
 917                         }
 918                         rootcontext = match_strdup(&args[0]);
 919                         if (!rootcontext) {
 920                                 rc = -ENOMEM;
 921                                 goto out_err;
 922                         }
 923                         break;
 924
 925                 case Opt_defcontext:
 926                         if (context || defcontext) {
 927                                 rc = -EINVAL;
 928                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 929                                 goto out_err;
 930                         }
 931                         defcontext = match_strdup(&args[0]);
 932                         if (!defcontext) {
 933                                 rc = -ENOMEM;
 934                                 goto out_err;
 935                         }
 936                         break;
 937                 case Opt_labelsupport:
 938                         break;
 939                 default:
 940                         rc = -EINVAL;
 941                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 942                         goto out_err;
 943
 944                 }
 945         }
 946
 947         rc = -ENOMEM;
 948         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 949         if (!opts->mnt_opts)
 950                 goto out_err;
 951
 952         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 953         if (!opts->mnt_opts_flags) {
 954                 kfree(opts->mnt_opts);
 955                 goto out_err;
 956         }
 957
 958         if (fscontext) {
 959                 opts->mnt_opts[num_mnt_opts] = fscontext;
 960                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 961         }
 962         if (context) {
 963                 opts->mnt_opts[num_mnt_opts] = context;
 964                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 965         }
 966         if (rootcontext) {
 967                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 968                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 969         }
 970         if (defcontext) {
 971                 opts->mnt_opts[num_mnt_opts] = defcontext;
 972                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 973         }
 974
 975         opts->num_mnt_opts = num_mnt_opts;
 976         return 0;
 977
 978 out_err:
 979         kfree(context);
 980         kfree(defcontext);
 981         kfree(fscontext);
 982         kfree(rootcontext);
 983         return rc;
 984 }
 985 /*
 986  * string mount options parsing and call set the sbsec
 987  */
 988 static int superblock_doinit(struct super_block *sb, void *data)
 989 {
 990         int rc = 0;
 991         char *options = data;
 992         struct security_mnt_opts opts;
 993
 994         security_init_mnt_opts(&opts);
 995
 996         if (!data)
 997                 goto out;
 998
 999         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1000
1001         rc = selinux_parse_opts_str(options, &opts);
1002         if (rc)
1003                 goto out_err;
1004
1005 out:
1006         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1007
1008 out_err:
1009         security_free_mnt_opts(&opts);
1010         return rc;
1011 }
1012
1013 static void selinux_write_opts(struct seq_file *m,
1014                                struct security_mnt_opts *opts)
1015 {
1016         int i;
1017         char *prefix;
1018
1019         for (i = 0; i < opts->num_mnt_opts; i++) {
1020                 char *has_comma;
1021
1022                 if (opts->mnt_opts[i])
1023                         has_comma = strchr(opts->mnt_opts[i], ',');
1024                 else
1025                         has_comma = NULL;
1026
1027                 switch (opts->mnt_opts_flags[i]) {
1028                 case CONTEXT_MNT:
1029                         prefix = CONTEXT_STR;
1030                         break;
1031                 case FSCONTEXT_MNT:
1032                         prefix = FSCONTEXT_STR;
1033                         break;
1034                 case ROOTCONTEXT_MNT:
1035                         prefix = ROOTCONTEXT_STR;
1036                         break;
1037                 case DEFCONTEXT_MNT:
1038                         prefix = DEFCONTEXT_STR;
1039                         break;
1040                 case SE_SBLABELSUPP:
1041                         seq_putc(m, ',');
1042                         seq_puts(m, LABELSUPP_STR);
1043                         continue;
1044                 default:
1045                         BUG();
1046                         return;
1047                 };
1048                 /* we need a comma before each option */
1049                 seq_putc(m, ',');
1050                 seq_puts(m, prefix);
1051                 if (has_comma)
1052                         seq_putc(m, '\"');
1053                 seq_puts(m, opts->mnt_opts[i]);
1054                 if (has_comma)
1055                         seq_putc(m, '\"');
1056         }
1057 }
1058
1059 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1060 {
1061         struct security_mnt_opts opts;
1062         int rc;
1063
1064         rc = selinux_get_mnt_opts(sb, &opts);
1065         if (rc) {
1066                 /* before policy load we may get EINVAL, don't show anything */
1067                 if (rc == -EINVAL)
1068                         rc = 0;
1069                 return rc;
1070         }
1071
1072         selinux_write_opts(m, &opts);
1073
1074         security_free_mnt_opts(&opts);
1075
1076         return rc;
1077 }
1078
1079 static inline u16 inode_mode_to_security_class(umode_t mode)
1080 {
1081         switch (mode & S_IFMT) {
1082         case S_IFSOCK:
1083                 return SECCLASS_SOCK_FILE;
1084         case S_IFLNK:
1085                 return SECCLASS_LNK_FILE;
1086         case S_IFREG:
1087                 return SECCLASS_FILE;
1088         case S_IFBLK:
1089                 return SECCLASS_BLK_FILE;
1090         case S_IFDIR:
1091                 return SECCLASS_DIR;
1092         case S_IFCHR:
1093                 return SECCLASS_CHR_FILE;
1094         case S_IFIFO:
1095                 return SECCLASS_FIFO_FILE;
1096
1097         }
1098
1099         return SECCLASS_FILE;
1100 }
1101
1102 static inline int default_protocol_stream(int protocol)
1103 {
1104         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1105 }
1106
1107 static inline int default_protocol_dgram(int protocol)
1108 {
1109         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1110 }
1111
1112 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1113 {
1114         switch (family) {
1115         case PF_UNIX:
1116                 switch (type) {
1117                 case SOCK_STREAM:
1118                 case SOCK_SEQPACKET:
1119                         return SECCLASS_UNIX_STREAM_SOCKET;
1120                 case SOCK_DGRAM:
1121                         return SECCLASS_UNIX_DGRAM_SOCKET;
1122                 }
1123                 break;
1124         case PF_INET:
1125         case PF_INET6:
1126                 switch (type) {
1127                 case SOCK_STREAM:
1128                         if (default_protocol_stream(protocol))
1129                                 return SECCLASS_TCP_SOCKET;
1130                         else
1131                                 return SECCLASS_RAWIP_SOCKET;
1132                 case SOCK_DGRAM:
1133                         if (default_protocol_dgram(protocol))
1134                                 return SECCLASS_UDP_SOCKET;
1135                         else
1136                                 return SECCLASS_RAWIP_SOCKET;
1137                 case SOCK_DCCP:
1138                         return SECCLASS_DCCP_SOCKET;
1139                 default:
1140                         return SECCLASS_RAWIP_SOCKET;
1141                 }
1142                 break;
1143         case PF_NETLINK:
1144                 switch (protocol) {
1145                 case NETLINK_ROUTE:
1146                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1147                 case NETLINK_FIREWALL:
1148                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1149                 case NETLINK_SOCK_DIAG:
1150                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1151                 case NETLINK_NFLOG:
1152                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1153                 case NETLINK_XFRM:
1154                         return SECCLASS_NETLINK_XFRM_SOCKET;
1155                 case NETLINK_SELINUX:
1156                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1157                 case NETLINK_AUDIT:
1158                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1159                 case NETLINK_IP6_FW:
1160                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1161                 case NETLINK_DNRTMSG:
1162                         return SECCLASS_NETLINK_DNRT_SOCKET;
1163                 case NETLINK_KOBJECT_UEVENT:
1164                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1165                 default:
1166                         return SECCLASS_NETLINK_SOCKET;
1167                 }
1168         case PF_PACKET:
1169                 return SECCLASS_PACKET_SOCKET;
1170         case PF_KEY:
1171                 return SECCLASS_KEY_SOCKET;
1172         case PF_APPLETALK:
1173                 return SECCLASS_APPLETALK_SOCKET;
1174         }
1175
1176         return SECCLASS_SOCKET;
1177 }
1178
1179 #ifdef CONFIG_PROC_FS
1180 static int selinux_proc_get_sid(struct dentry *dentry,
1181                                 u16 tclass,
1182                                 u32 *sid)
1183 {
1184         int rc;
1185         char *buffer, *path;
1186
1187         buffer = (char *)__get_free_page(GFP_KERNEL);
1188         if (!buffer)
1189                 return -ENOMEM;
1190
1191         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1192         if (IS_ERR(path))
1193                 rc = PTR_ERR(path);
1194         else {
1195                 /* each process gets a /proc/PID/ entry. Strip off the
1196                  * PID part to get a valid selinux labeling.
1197                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1198                 while (path[1] >= '0' && path[1] <= '9') {
1199                         path[1] = '/';
1200                         path++;
1201                 }
1202                 rc = security_genfs_sid("proc", path, tclass, sid);
1203         }
1204         free_page((unsigned long)buffer);
1205         return rc;
1206 }
1207 #else
1208 static int selinux_proc_get_sid(struct dentry *dentry,
1209                                 u16 tclass,
1210                                 u32 *sid)
1211 {
1212         return -EINVAL;
1213 }
1214 #endif
1215
1216 /* The inode's security attributes must be initialized before first use. */
1217 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1218 {
1219         struct superblock_security_struct *sbsec = NULL;
1220         struct inode_security_struct *isec = inode->i_security;
1221         u32 sid;
1222         struct dentry *dentry;
1223 #define INITCONTEXTLEN 255
1224         char *context = NULL;
1225         unsigned len = 0;
1226         int rc = 0;
1227
1228         if (isec->initialized)
1229                 goto out;
1230
1231         mutex_lock(&isec->lock);
1232         if (isec->initialized)
1233                 goto out_unlock;
1234
1235         sbsec = inode->i_sb->s_security;
1236         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1237                 /* Defer initialization until selinux_complete_init,
1238                    after the initial policy is loaded and the security
1239                    server is ready to handle calls. */
1240                 spin_lock(&sbsec->isec_lock);
1241                 if (list_empty(&isec->list))
1242                         list_add(&isec->list, &sbsec->isec_head);
1243                 spin_unlock(&sbsec->isec_lock);
1244                 goto out_unlock;
1245         }
1246
1247         switch (sbsec->behavior) {
1248         case SECURITY_FS_USE_NATIVE:
1249                 break;
1250         case SECURITY_FS_USE_XATTR:
1251                 if (!inode->i_op->getxattr) {
1252                         isec->sid = sbsec->def_sid;
1253                         break;
1254                 }
1255
1256                 /* Need a dentry, since the xattr API requires one.
1257                    Life would be simpler if we could just pass the inode. */
1258                 if (opt_dentry) {
1259                         /* Called from d_instantiate or d_splice_alias. */
1260                         dentry = dget(opt_dentry);
1261                 } else {
1262                         /* Called from selinux_complete_init, try to find a dentry. */
1263                         dentry = d_find_alias(inode);
1264                 }
1265                 if (!dentry) {
1266                         /*
1267                          * this is can be hit on boot when a file is accessed
1268                          * before the policy is loaded.  When we load policy we
1269                          * may find inodes that have no dentry on the
1270                          * sbsec->isec_head list.  No reason to complain as these
1271                          * will get fixed up the next time we go through
1272                          * inode_doinit with a dentry, before these inodes could
1273                          * be used again by userspace.
1274                          */
1275                         goto out_unlock;
1276                 }
1277
1278                 len = INITCONTEXTLEN;
1279                 context = kmalloc(len+1, GFP_NOFS);
1280                 if (!context) {
1281                         rc = -ENOMEM;
1282                         dput(dentry);
1283                         goto out_unlock;
1284                 }
1285                 context[len] = '\0';
1286                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1287                                            context, len);
1288                 if (rc == -ERANGE) {
1289                         kfree(context);
1290
1291                         /* Need a larger buffer.  Query for the right size. */
1292                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1293                                                    NULL, 0);
1294                         if (rc < 0) {
1295                                 dput(dentry);
1296                                 goto out_unlock;
1297                         }
1298                         len = rc;
1299                         context = kmalloc(len+1, GFP_NOFS);
1300                         if (!context) {
1301                                 rc = -ENOMEM;
1302                                 dput(dentry);
1303                                 goto out_unlock;
1304                         }
1305                         context[len] = '\0';
1306                         rc = inode->i_op->getxattr(dentry,
1307                                                    XATTR_NAME_SELINUX,
1308                                                    context, len);
1309                 }
1310                 dput(dentry);
1311                 if (rc < 0) {
1312                         if (rc != -ENODATA) {
1313                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1314                                        "%d for dev=%s ino=%ld\n", __func__,
1315                                        -rc, inode->i_sb->s_id, inode->i_ino);
1316                                 kfree(context);
1317                                 goto out_unlock;
1318                         }
1319                         /* Map ENODATA to the default file SID */
1320                         sid = sbsec->def_sid;
1321                         rc = 0;
1322                 } else {
1323                         rc = security_context_to_sid_default(context, rc, &sid,
1324                                                              sbsec->def_sid,
1325                                                              GFP_NOFS);
1326                         if (rc) {
1327                                 char *dev = inode->i_sb->s_id;
1328                                 unsigned long ino = inode->i_ino;
1329
1330                                 if (rc == -EINVAL) {
1331                                         if (printk_ratelimit())
1332                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1333                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1334                                                         "filesystem in question.\n", ino, dev, context);
1335                                 } else {
1336                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1337                                                "returned %d for dev=%s ino=%ld\n",
1338                                                __func__, context, -rc, dev, ino);
1339                                 }
1340                                 kfree(context);
1341                                 /* Leave with the unlabeled SID */
1342                                 rc = 0;
1343                                 break;
1344                         }
1345                 }
1346                 kfree(context);
1347                 isec->sid = sid;
1348                 break;
1349         case SECURITY_FS_USE_TASK:
1350                 isec->sid = isec->task_sid;
1351                 break;
1352         case SECURITY_FS_USE_TRANS:
1353                 /* Default to the fs SID. */
1354                 isec->sid = sbsec->sid;
1355
1356                 /* Try to obtain a transition SID. */
1357                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1358                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1359                                              isec->sclass, NULL, &sid);
1360                 if (rc)
1361                         goto out_unlock;
1362                 isec->sid = sid;
1363                 break;
1364         case SECURITY_FS_USE_MNTPOINT:
1365                 isec->sid = sbsec->mntpoint_sid;
1366                 break;
1367         default:
1368                 /* Default to the fs superblock SID. */
1369                 isec->sid = sbsec->sid;
1370
1371                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1372                         if (opt_dentry) {
1373                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1374                                 rc = selinux_proc_get_sid(opt_dentry,
1375                                                           isec->sclass,
1376                                                           &sid);
1377                                 if (rc)
1378                                         goto out_unlock;
1379                                 isec->sid = sid;
1380                         }
1381                 }
1382                 break;
1383         }
1384
1385         isec->initialized = 1;
1386
1387 out_unlock:
1388         mutex_unlock(&isec->lock);
1389 out:
1390         if (isec->sclass == SECCLASS_FILE)
1391                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1392         return rc;
1393 }
1394
1395 /* Convert a Linux signal to an access vector. */
1396 static inline u32 signal_to_av(int sig)
1397 {
1398         u32 perm = 0;
1399
1400         switch (sig) {
1401         case SIGCHLD:
1402                 /* Commonly granted from child to parent. */
1403                 perm = PROCESS__SIGCHLD;
1404                 break;
1405         case SIGKILL:
1406                 /* Cannot be caught or ignored */
1407                 perm = PROCESS__SIGKILL;
1408                 break;
1409         case SIGSTOP:
1410                 /* Cannot be caught or ignored */
1411                 perm = PROCESS__SIGSTOP;
1412                 break;
1413         default:
1414                 /* All other signals. */
1415                 perm = PROCESS__SIGNAL;
1416                 break;
1417         }
1418
1419         return perm;
1420 }
1421
1422 /*
1423  * Check permission between a pair of credentials
1424  * fork check, ptrace check, etc.
1425  */
1426 static int cred_has_perm(const struct cred *actor,
1427                          const struct cred *target,
1428                          u32 perms)
1429 {
1430         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1431
1432         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1433 }
1434
1435 /*
1436  * Check permission between a pair of tasks, e.g. signal checks,
1437  * fork check, ptrace check, etc.
1438  * tsk1 is the actor and tsk2 is the target
1439  * - this uses the default subjective creds of tsk1
1440  */
1441 static int task_has_perm(const struct task_struct *tsk1,
1442                          const struct task_struct *tsk2,
1443                          u32 perms)
1444 {
1445         const struct task_security_struct *__tsec1, *__tsec2;
1446         u32 sid1, sid2;
1447
1448         rcu_read_lock();
1449         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1450         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1451         rcu_read_unlock();
1452         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1453 }
1454
1455 /*
1456  * Check permission between current and another task, e.g. signal checks,
1457  * fork check, ptrace check, etc.
1458  * current is the actor and tsk2 is the target
1459  * - this uses current's subjective creds
1460  */
1461 static int current_has_perm(const struct task_struct *tsk,
1462                             u32 perms)
1463 {
1464         u32 sid, tsid;
1465
1466         sid = current_sid();
1467         tsid = task_sid(tsk);
1468         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1469 }
1470
1471 #if CAP_LAST_CAP > 63
1472 #error Fix SELinux to handle capabilities > 63.
1473 #endif
1474
1475 /* Check whether a task is allowed to use a capability. */
1476 static int cred_has_capability(const struct cred *cred,
1477                                int cap, int audit)
1478 {
1479         struct common_audit_data ad;
1480         struct av_decision avd;
1481         u16 sclass;
1482         u32 sid = cred_sid(cred);
1483         u32 av = CAP_TO_MASK(cap);
1484         int rc;
1485
1486         ad.type = LSM_AUDIT_DATA_CAP;
1487         ad.u.cap = cap;
1488
1489         switch (CAP_TO_INDEX(cap)) {
1490         case 0:
1491                 sclass = SECCLASS_CAPABILITY;
1492                 break;
1493         case 1:
1494                 sclass = SECCLASS_CAPABILITY2;
1495                 break;
1496         default:
1497                 printk(KERN_ERR
1498                        "SELinux:  out of range capability %d\n", cap);
1499                 BUG();
1500                 return -EINVAL;
1501         }
1502
1503         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1504         if (audit == SECURITY_CAP_AUDIT) {
1505                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1506                 if (rc2)
1507                         return rc2;
1508         }
1509         return rc;
1510 }
1511
1512 /* Check whether a task is allowed to use a system operation. */
1513 static int task_has_system(struct task_struct *tsk,
1514                            u32 perms)
1515 {
1516         u32 sid = task_sid(tsk);
1517
1518         return avc_has_perm(sid, SECINITSID_KERNEL,
1519                             SECCLASS_SYSTEM, perms, NULL);
1520 }
1521
1522 /* Check whether a task has a particular permission to an inode.
1523    The 'adp' parameter is optional and allows other audit
1524    data to be passed (e.g. the dentry). */
1525 static int inode_has_perm(const struct cred *cred,
1526                           struct inode *inode,
1527                           u32 perms,
1528                           struct common_audit_data *adp,
1529                           unsigned flags)
1530 {
1531         struct inode_security_struct *isec;
1532         u32 sid;
1533
1534         validate_creds(cred);
1535
1536         if (unlikely(IS_PRIVATE(inode)))
1537                 return 0;
1538
1539         sid = cred_sid(cred);
1540         isec = inode->i_security;
1541
1542         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1543 }
1544
1545 /* Same as inode_has_perm, but pass explicit audit data containing
1546    the dentry to help the auditing code to more easily generate the
1547    pathname if needed. */
1548 static inline int dentry_has_perm(const struct cred *cred,
1549                                   struct dentry *dentry,
1550                                   u32 av)
1551 {
1552         struct inode *inode = dentry->d_inode;
1553         struct common_audit_data ad;
1554
1555         ad.type = LSM_AUDIT_DATA_DENTRY;
1556         ad.u.dentry = dentry;
1557         return inode_has_perm(cred, inode, av, &ad, 0);
1558 }
1559
1560 /* Same as inode_has_perm, but pass explicit audit data containing
1561    the path to help the auditing code to more easily generate the
1562    pathname if needed. */
1563 static inline int path_has_perm(const struct cred *cred,
1564                                 struct path *path,
1565                                 u32 av)
1566 {
1567         struct inode *inode = path->dentry->d_inode;
1568         struct common_audit_data ad;
1569
1570         ad.type = LSM_AUDIT_DATA_PATH;
1571         ad.u.path = *path;
1572         return inode_has_perm(cred, inode, av, &ad, 0);
1573 }
1574
1575 /* Same as path_has_perm, but uses the inode from the file struct. */
1576 static inline int file_path_has_perm(const struct cred *cred,
1577                                      struct file *file,
1578                                      u32 av)
1579 {
1580         struct common_audit_data ad;
1581
1582         ad.type = LSM_AUDIT_DATA_PATH;
1583         ad.u.path = file->f_path;
1584         return inode_has_perm(cred, file_inode(file), av, &ad, 0);
1585 }
1586
1587 /* Check whether a task can use an open file descriptor to
1588    access an inode in a given way.  Check access to the
1589    descriptor itself, and then use dentry_has_perm to
1590    check a particular permission to the file.
1591    Access to the descriptor is implicitly granted if it
1592    has the same SID as the process.  If av is zero, then
1593    access to the file is not checked, e.g. for cases
1594    where only the descriptor is affected like seek. */
1595 static int file_has_perm(const struct cred *cred,
1596                          struct file *file,
1597                          u32 av)
1598 {
1599         struct file_security_struct *fsec = file->f_security;
1600         struct inode *inode = file_inode(file);
1601         struct common_audit_data ad;
1602         u32 sid = cred_sid(cred);
1603         int rc;
1604
1605         ad.type = LSM_AUDIT_DATA_PATH;
1606         ad.u.path = file->f_path;
1607
1608         if (sid != fsec->sid) {
1609                 rc = avc_has_perm(sid, fsec->sid,
1610                                   SECCLASS_FD,
1611                                   FD__USE,
1612                                   &ad);
1613                 if (rc)
1614                         goto out;
1615         }
1616
1617         /* av is zero if only checking access to the descriptor. */
1618         rc = 0;
1619         if (av)
1620                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1621
1622 out:
1623         return rc;
1624 }
1625
1626 /* Check whether a task can create a file. */
1627 static int may_create(struct inode *dir,
1628                       struct dentry *dentry,
1629                       u16 tclass)
1630 {
1631         const struct task_security_struct *tsec = current_security();
1632         struct inode_security_struct *dsec;
1633         struct superblock_security_struct *sbsec;
1634         u32 sid, newsid;
1635         struct common_audit_data ad;
1636         int rc;
1637
1638         dsec = dir->i_security;
1639         sbsec = dir->i_sb->s_security;
1640
1641         sid = tsec->sid;
1642         newsid = tsec->create_sid;
1643
1644         ad.type = LSM_AUDIT_DATA_DENTRY;
1645         ad.u.dentry = dentry;
1646
1647         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1648                           DIR__ADD_NAME | DIR__SEARCH,
1649                           &ad);
1650         if (rc)
1651                 return rc;
1652
1653         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1654                 rc = security_transition_sid(sid, dsec->sid, tclass,
1655                                              &dentry->d_name, &newsid);
1656                 if (rc)
1657                         return rc;
1658         }
1659
1660         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1661         if (rc)
1662                 return rc;
1663
1664         return avc_has_perm(newsid, sbsec->sid,
1665                             SECCLASS_FILESYSTEM,
1666                             FILESYSTEM__ASSOCIATE, &ad);
1667 }
1668
1669 /* Check whether a task can create a key. */
1670 static int may_create_key(u32 ksid,
1671                           struct task_struct *ctx)
1672 {
1673         u32 sid = task_sid(ctx);
1674
1675         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1676 }
1677
1678 #define MAY_LINK        0
1679 #define MAY_UNLINK      1
1680 #define MAY_RMDIR       2
1681
1682 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1683 static int may_link(struct inode *dir,
1684                     struct dentry *dentry,
1685                     int kind)
1686
1687 {
1688         struct inode_security_struct *dsec, *isec;
1689         struct common_audit_data ad;
1690         u32 sid = current_sid();
1691         u32 av;
1692         int rc;
1693
1694         dsec = dir->i_security;
1695         isec = dentry->d_inode->i_security;
1696
1697         ad.type = LSM_AUDIT_DATA_DENTRY;
1698         ad.u.dentry = dentry;
1699
1700         av = DIR__SEARCH;
1701         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1702         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1703         if (rc)
1704                 return rc;
1705
1706         switch (kind) {
1707         case MAY_LINK:
1708                 av = FILE__LINK;
1709                 break;
1710         case MAY_UNLINK:
1711                 av = FILE__UNLINK;
1712                 break;
1713         case MAY_RMDIR:
1714                 av = DIR__RMDIR;
1715                 break;
1716         default:
1717                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1718                         __func__, kind);
1719                 return 0;
1720         }
1721
1722         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1723         return rc;
1724 }
1725
1726 static inline int may_rename(struct inode *old_dir,
1727                              struct dentry *old_dentry,
1728                              struct inode *new_dir,
1729                              struct dentry *new_dentry)
1730 {
1731         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1732         struct common_audit_data ad;
1733         u32 sid = current_sid();
1734         u32 av;
1735         int old_is_dir, new_is_dir;
1736         int rc;
1737
1738         old_dsec = old_dir->i_security;
1739         old_isec = old_dentry->d_inode->i_security;
1740         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1741         new_dsec = new_dir->i_security;
1742
1743         ad.type = LSM_AUDIT_DATA_DENTRY;
1744
1745         ad.u.dentry = old_dentry;
1746         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1747                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1748         if (rc)
1749                 return rc;
1750         rc = avc_has_perm(sid, old_isec->sid,
1751                           old_isec->sclass, FILE__RENAME, &ad);
1752         if (rc)
1753                 return rc;
1754         if (old_is_dir && new_dir != old_dir) {
1755                 rc = avc_has_perm(sid, old_isec->sid,
1756                                   old_isec->sclass, DIR__REPARENT, &ad);
1757                 if (rc)
1758                         return rc;
1759         }
1760
1761         ad.u.dentry = new_dentry;
1762         av = DIR__ADD_NAME | DIR__SEARCH;
1763         if (new_dentry->d_inode)
1764                 av |= DIR__REMOVE_NAME;
1765         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1766         if (rc)
1767                 return rc;
1768         if (new_dentry->d_inode) {
1769                 new_isec = new_dentry->d_inode->i_security;
1770                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1771                 rc = avc_has_perm(sid, new_isec->sid,
1772                                   new_isec->sclass,
1773                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1774                 if (rc)
1775                         return rc;
1776         }
1777
1778         return 0;
1779 }
1780
1781 /* Check whether a task can perform a filesystem operation. */
1782 static int superblock_has_perm(const struct cred *cred,
1783                                struct super_block *sb,
1784                                u32 perms,
1785                                struct common_audit_data *ad)
1786 {
1787         struct superblock_security_struct *sbsec;
1788         u32 sid = cred_sid(cred);
1789
1790         sbsec = sb->s_security;
1791         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1792 }
1793
1794 /* Convert a Linux mode and permission mask to an access vector. */
1795 static inline u32 file_mask_to_av(int mode, int mask)
1796 {
1797         u32 av = 0;
1798
1799         if (!S_ISDIR(mode)) {
1800                 if (mask & MAY_EXEC)
1801                         av |= FILE__EXECUTE;
1802                 if (mask & MAY_READ)
1803                         av |= FILE__READ;
1804
1805                 if (mask & MAY_APPEND)
1806                         av |= FILE__APPEND;
1807                 else if (mask & MAY_WRITE)
1808                         av |= FILE__WRITE;
1809
1810         } else {
1811                 if (mask & MAY_EXEC)
1812                         av |= DIR__SEARCH;
1813                 if (mask & MAY_WRITE)
1814                         av |= DIR__WRITE;
1815                 if (mask & MAY_READ)
1816                         av |= DIR__READ;
1817         }
1818
1819         return av;
1820 }
1821
1822 /* Convert a Linux file to an access vector. */
1823 static inline u32 file_to_av(struct file *file)
1824 {
1825         u32 av = 0;
1826
1827         if (file->f_mode & FMODE_READ)
1828                 av |= FILE__READ;
1829         if (file->f_mode & FMODE_WRITE) {
1830                 if (file->f_flags & O_APPEND)
1831                         av |= FILE__APPEND;
1832                 else
1833                         av |= FILE__WRITE;
1834         }
1835         if (!av) {
1836                 /*
1837                  * Special file opened with flags 3 for ioctl-only use.
1838                  */
1839                 av = FILE__IOCTL;
1840         }
1841
1842         return av;
1843 }
1844
1845 /*
1846  * Convert a file to an access vector and include the correct open
1847  * open permission.
1848  */
1849 static inline u32 open_file_to_av(struct file *file)
1850 {
1851         u32 av = file_to_av(file);
1852
1853         if (selinux_policycap_openperm)
1854                 av |= FILE__OPEN;
1855
1856         return av;
1857 }
1858
1859 /* Hook functions begin here. */
1860
1861 static int selinux_ptrace_access_check(struct task_struct *child,
1862                                      unsigned int mode)
1863 {
1864         int rc;
1865
1866         rc = cap_ptrace_access_check(child, mode);
1867         if (rc)
1868                 return rc;
1869
1870         if (mode & PTRACE_MODE_READ) {
1871                 u32 sid = current_sid();
1872                 u32 csid = task_sid(child);
1873                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1874         }
1875
1876         return current_has_perm(child, PROCESS__PTRACE);
1877 }
1878
1879 static int selinux_ptrace_traceme(struct task_struct *parent)
1880 {
1881         int rc;
1882
1883         rc = cap_ptrace_traceme(parent);
1884         if (rc)
1885                 return rc;
1886
1887         return task_has_perm(parent, current, PROCESS__PTRACE);
1888 }
1889
1890 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1891                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1892 {
1893         int error;
1894
1895         error = current_has_perm(target, PROCESS__GETCAP);
1896         if (error)
1897                 return error;
1898
1899         return cap_capget(target, effective, inheritable, permitted);
1900 }
1901
1902 static int selinux_capset(struct cred *new, const struct cred *old,
1903                           const kernel_cap_t *effective,
1904                           const kernel_cap_t *inheritable,
1905                           const kernel_cap_t *permitted)
1906 {
1907         int error;
1908
1909         error = cap_capset(new, old,
1910                                       effective, inheritable, permitted);
1911         if (error)
1912                 return error;
1913
1914         return cred_has_perm(old, new, PROCESS__SETCAP);
1915 }
1916
1917 /*
1918  * (This comment used to live with the selinux_task_setuid hook,
1919  * which was removed).
1920  *
1921  * Since setuid only affects the current process, and since the SELinux
1922  * controls are not based on the Linux identity attributes, SELinux does not
1923  * need to control this operation.  However, SELinux does control the use of
1924  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1925  */
1926
1927 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1928                            int cap, int audit)
1929 {
1930         int rc;
1931
1932         rc = cap_capable(cred, ns, cap, audit);
1933         if (rc)
1934                 return rc;
1935
1936         return cred_has_capability(cred, cap, audit);
1937 }
1938
1939 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1940 {
1941         const struct cred *cred = current_cred();
1942         int rc = 0;
1943
1944         if (!sb)
1945                 return 0;
1946
1947         switch (cmds) {
1948         case Q_SYNC:
1949         case Q_QUOTAON:
1950         case Q_QUOTAOFF:
1951         case Q_SETINFO:
1952         case Q_SETQUOTA:
1953                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1954                 break;
1955         case Q_GETFMT:
1956         case Q_GETINFO:
1957         case Q_GETQUOTA:
1958                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1959                 break;
1960         default:
1961                 rc = 0;  /* let the kernel handle invalid cmds */
1962                 break;
1963         }
1964         return rc;
1965 }
1966
1967 static int selinux_quota_on(struct dentry *dentry)
1968 {
1969         const struct cred *cred = current_cred();
1970
1971         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1972 }
1973
1974 static int selinux_syslog(int type)
1975 {
1976         int rc;
1977
1978         switch (type) {
1979         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1980         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1981                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1982                 break;
1983         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1984         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1985         /* Set level of messages printed to console */
1986         case SYSLOG_ACTION_CONSOLE_LEVEL:
1987                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1988                 break;
1989         case SYSLOG_ACTION_CLOSE:       /* Close log */
1990         case SYSLOG_ACTION_OPEN:        /* Open log */
1991         case SYSLOG_ACTION_READ:        /* Read from log */
1992         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1993         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1994         default:
1995                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1996                 break;
1997         }
1998         return rc;
1999 }
2000
2001 /*
2002  * Check that a process has enough memory to allocate a new virtual
2003  * mapping. 0 means there is enough memory for the allocation to
2004  * succeed and -ENOMEM implies there is not.
2005  *
2006  * Do not audit the selinux permission check, as this is applied to all
2007  * processes that allocate mappings.
2008  */
2009 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2010 {
2011         int rc, cap_sys_admin = 0;
2012
2013         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2014                              SECURITY_CAP_NOAUDIT);
2015         if (rc == 0)
2016                 cap_sys_admin = 1;
2017
2018         return __vm_enough_memory(mm, pages, cap_sys_admin);
2019 }
2020
2021 /* binprm security operations */
2022
2023 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2024 {
2025         const struct task_security_struct *old_tsec;
2026         struct task_security_struct *new_tsec;
2027         struct inode_security_struct *isec;
2028         struct common_audit_data ad;
2029         struct inode *inode = file_inode(bprm->file);
2030         int rc;
2031
2032         rc = cap_bprm_set_creds(bprm);
2033         if (rc)
2034                 return rc;
2035
2036         /* SELinux context only depends on initial program or script and not
2037          * the script interpreter */
2038         if (bprm->cred_prepared)
2039                 return 0;
2040
2041         old_tsec = current_security();
2042         new_tsec = bprm->cred->security;
2043         isec = inode->i_security;
2044
2045         /* Default to the current task SID. */
2046         new_tsec->sid = old_tsec->sid;
2047         new_tsec->osid = old_tsec->sid;
2048
2049         /* Reset fs, key, and sock SIDs on execve. */
2050         new_tsec->create_sid = 0;
2051         new_tsec->keycreate_sid = 0;
2052         new_tsec->sockcreate_sid = 0;
2053
2054         if (old_tsec->exec_sid) {
2055                 new_tsec->sid = old_tsec->exec_sid;
2056                 /* Reset exec SID on execve. */
2057                 new_tsec->exec_sid = 0;
2058
2059                 /*
2060                  * Minimize confusion: if no_new_privs and a transition is
2061                  * explicitly requested, then fail the exec.
2062                  */
2063                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2064                         return -EPERM;
2065         } else {
2066                 /* Check for a default transition on this program. */
2067                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2068                                              SECCLASS_PROCESS, NULL,
2069                                              &new_tsec->sid);
2070                 if (rc)
2071                         return rc;
2072         }
2073
2074         ad.type = LSM_AUDIT_DATA_PATH;
2075         ad.u.path = bprm->file->f_path;
2076
2077         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2078             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2079                 new_tsec->sid = old_tsec->sid;
2080
2081         if (new_tsec->sid == old_tsec->sid) {
2082                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2083                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2084                 if (rc)
2085                         return rc;
2086         } else {
2087                 /* Check permissions for the transition. */
2088                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2089                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2090                 if (rc)
2091                         return rc;
2092
2093                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2094                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2095                 if (rc)
2096                         return rc;
2097
2098                 /* Check for shared state */
2099                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2100                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2101                                           SECCLASS_PROCESS, PROCESS__SHARE,
2102                                           NULL);
2103                         if (rc)
2104                                 return -EPERM;
2105                 }
2106
2107                 /* Make sure that anyone attempting to ptrace over a task that
2108                  * changes its SID has the appropriate permit */
2109                 if (bprm->unsafe &
2110                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2111                         struct task_struct *tracer;
2112                         struct task_security_struct *sec;
2113                         u32 ptsid = 0;
2114
2115                         rcu_read_lock();
2116                         tracer = ptrace_parent(current);
2117                         if (likely(tracer != NULL)) {
2118                                 sec = __task_cred(tracer)->security;
2119                                 ptsid = sec->sid;
2120                         }
2121                         rcu_read_unlock();
2122
2123                         if (ptsid != 0) {
2124                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2125                                                   SECCLASS_PROCESS,
2126                                                   PROCESS__PTRACE, NULL);
2127                                 if (rc)
2128                                         return -EPERM;
2129                         }
2130                 }
2131
2132                 /* Clear any possibly unsafe personality bits on exec: */
2133                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2134         }
2135
2136         return 0;
2137 }
2138
2139 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2140 {
2141         const struct task_security_struct *tsec = current_security();
2142         u32 sid, osid;
2143         int atsecure = 0;
2144
2145         sid = tsec->sid;
2146         osid = tsec->osid;
2147
2148         if (osid != sid) {
2149                 /* Enable secure mode for SIDs transitions unless
2150                    the noatsecure permission is granted between
2151                    the two SIDs, i.e. ahp returns 0. */
2152                 atsecure = avc_has_perm(osid, sid,
2153                                         SECCLASS_PROCESS,
2154                                         PROCESS__NOATSECURE, NULL);
2155         }
2156
2157         return (atsecure || cap_bprm_secureexec(bprm));
2158 }
2159
2160 static int match_file(const void *p, struct file *file, unsigned fd)
2161 {
2162         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2163 }
2164
2165 /* Derived from fs/exec.c:flush_old_files. */
2166 static inline void flush_unauthorized_files(const struct cred *cred,
2167                                             struct files_struct *files)
2168 {
2169         struct file *file, *devnull = NULL;
2170         struct tty_struct *tty;
2171         int drop_tty = 0;
2172         unsigned n;
2173
2174         tty = get_current_tty();
2175         if (tty) {
2176                 spin_lock(&tty_files_lock);
2177                 if (!list_empty(&tty->tty_files)) {
2178                         struct tty_file_private *file_priv;
2179
2180                         /* Revalidate access to controlling tty.
2181                            Use file_path_has_perm on the tty path directly
2182                            rather than using file_has_perm, as this particular
2183                            open file may belong to another process and we are
2184                            only interested in the inode-based check here. */
2185                         file_priv = list_first_entry(&tty->tty_files,
2186                                                 struct tty_file_private, list);
2187                         file = file_priv->file;
2188                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2189                                 drop_tty = 1;
2190                 }
2191                 spin_unlock(&tty_files_lock);
2192                 tty_kref_put(tty);
2193         }
2194         /* Reset controlling tty. */
2195         if (drop_tty)
2196                 no_tty();
2197
2198         /* Revalidate access to inherited open files. */
2199         n = iterate_fd(files, 0, match_file, cred);
2200         if (!n) /* none found? */
2201                 return;
2202
2203         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2204         if (IS_ERR(devnull))
2205                 devnull = NULL;
2206         /* replace all the matching ones with this */
2207         do {
2208                 replace_fd(n - 1, devnull, 0);
2209         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2210         if (devnull)
2211                 fput(devnull);
2212 }
2213
2214 /*
2215  * Prepare a process for imminent new credential changes due to exec
2216  */
2217 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2218 {
2219         struct task_security_struct *new_tsec;
2220         struct rlimit *rlim, *initrlim;
2221         int rc, i;
2222
2223         new_tsec = bprm->cred->security;
2224         if (new_tsec->sid == new_tsec->osid)
2225                 return;
2226
2227         /* Close files for which the new task SID is not authorized. */
2228         flush_unauthorized_files(bprm->cred, current->files);
2229
2230         /* Always clear parent death signal on SID transitions. */
2231         current->pdeath_signal = 0;
2232
2233         /* Check whether the new SID can inherit resource limits from the old
2234          * SID.  If not, reset all soft limits to the lower of the current
2235          * task's hard limit and the init task's soft limit.
2236          *
2237          * Note that the setting of hard limits (even to lower them) can be
2238          * controlled by the setrlimit check.  The inclusion of the init task's
2239          * soft limit into the computation is to avoid resetting soft limits
2240          * higher than the default soft limit for cases where the default is
2241          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2242          */
2243         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2244                           PROCESS__RLIMITINH, NULL);
2245         if (rc) {
2246                 /* protect against do_prlimit() */
2247                 task_lock(current);
2248                 for (i = 0; i < RLIM_NLIMITS; i++) {
2249                         rlim = current->signal->rlim + i;
2250                         initrlim = init_task.signal->rlim + i;
2251                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2252                 }
2253                 task_unlock(current);
2254                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2255         }
2256 }
2257
2258 /*
2259  * Clean up the process immediately after the installation of new credentials
2260  * due to exec
2261  */
2262 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2263 {
2264         const struct task_security_struct *tsec = current_security();
2265         struct itimerval itimer;
2266         u32 osid, sid;
2267         int rc, i;
2268
2269         osid = tsec->osid;
2270         sid = tsec->sid;
2271
2272         if (sid == osid)
2273                 return;
2274
2275         /* Check whether the new SID can inherit signal state from the old SID.
2276          * If not, clear itimers to avoid subsequent signal generation and
2277          * flush and unblock signals.
2278          *
2279          * This must occur _after_ the task SID has been updated so that any
2280          * kill done after the flush will be checked against the new SID.
2281          */
2282         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2283         if (rc) {
2284                 memset(&itimer, 0, sizeof itimer);
2285                 for (i = 0; i < 3; i++)
2286                         do_setitimer(i, &itimer, NULL);
2287                 spin_lock_irq(&current->sighand->siglock);
2288                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2289                         __flush_signals(current);
2290                         flush_signal_handlers(current, 1);
2291                         sigemptyset(&current->blocked);
2292                 }
2293                 spin_unlock_irq(&current->sighand->siglock);
2294         }
2295
2296         /* Wake up the parent if it is waiting so that it can recheck
2297          * wait permission to the new task SID. */
2298         read_lock(&tasklist_lock);
2299         __wake_up_parent(current, current->real_parent);
2300         read_unlock(&tasklist_lock);
2301 }
2302
2303 /* superblock security operations */
2304
2305 static int selinux_sb_alloc_security(struct super_block *sb)
2306 {
2307         return superblock_alloc_security(sb);
2308 }
2309
2310 static void selinux_sb_free_security(struct super_block *sb)
2311 {
2312         superblock_free_security(sb);
2313 }
2314
2315 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2316 {
2317         if (plen > olen)
2318                 return 0;
2319
2320         return !memcmp(prefix, option, plen);
2321 }
2322
2323 static inline int selinux_option(char *option, int len)
2324 {
2325         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2326                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2327                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2328                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2329                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2330 }
2331
2332 static inline void take_option(char **to, char *from, int *first, int len)
2333 {
2334         if (!*first) {
2335                 **to = ',';
2336                 *to += 1;
2337         } else
2338                 *first = 0;
2339         memcpy(*to, from, len);
2340         *to += len;
2341 }
2342
2343 static inline void take_selinux_option(char **to, char *from, int *first,
2344                                        int len)
2345 {
2346         int current_size = 0;
2347
2348         if (!*first) {
2349                 **to = '|';
2350                 *to += 1;
2351         } else
2352                 *first = 0;
2353
2354         while (current_size < len) {
2355                 if (*from != '"') {
2356                         **to = *from;
2357                         *to += 1;
2358                 }
2359                 from += 1;
2360                 current_size += 1;
2361         }
2362 }
2363
2364 static int selinux_sb_copy_data(char *orig, char *copy)
2365 {
2366         int fnosec, fsec, rc = 0;
2367         char *in_save, *in_curr, *in_end;
2368         char *sec_curr, *nosec_save, *nosec;
2369         int open_quote = 0;
2370
2371         in_curr = orig;
2372         sec_curr = copy;
2373
2374         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2375         if (!nosec) {
2376                 rc = -ENOMEM;
2377                 goto out;
2378         }
2379
2380         nosec_save = nosec;
2381         fnosec = fsec = 1;
2382         in_save = in_end = orig;
2383
2384         do {
2385                 if (*in_end == '"')
2386                         open_quote = !open_quote;
2387                 if ((*in_end == ',' && open_quote == 0) ||
2388                                 *in_end == '\0') {
2389                         int len = in_end - in_curr;
2390
2391                         if (selinux_option(in_curr, len))
2392                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2393                         else
2394                                 take_option(&nosec, in_curr, &fnosec, len);
2395
2396                         in_curr = in_end + 1;
2397                 }
2398         } while (*in_end++);
2399
2400         strcpy(in_save, nosec_save);
2401         free_page((unsigned long)nosec_save);
2402 out:
2403         return rc;
2404 }
2405
2406 static int selinux_sb_remount(struct super_block *sb, void *data)
2407 {
2408         int rc, i, *flags;
2409         struct security_mnt_opts opts;
2410         char *secdata, **mount_options;
2411         struct superblock_security_struct *sbsec = sb->s_security;
2412
2413         if (!(sbsec->flags & SE_SBINITIALIZED))
2414                 return 0;
2415
2416         if (!data)
2417                 return 0;
2418
2419         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2420                 return 0;
2421
2422         security_init_mnt_opts(&opts);
2423         secdata = alloc_secdata();
2424         if (!secdata)
2425                 return -ENOMEM;
2426         rc = selinux_sb_copy_data(data, secdata);
2427         if (rc)
2428                 goto out_free_secdata;
2429
2430         rc = selinux_parse_opts_str(secdata, &opts);
2431         if (rc)
2432                 goto out_free_secdata;
2433
2434         mount_options = opts.mnt_opts;
2435         flags = opts.mnt_opts_flags;
2436
2437         for (i = 0; i < opts.num_mnt_opts; i++) {
2438                 u32 sid;
2439                 size_t len;
2440
2441                 if (flags[i] == SE_SBLABELSUPP)
2442                         continue;
2443                 len = strlen(mount_options[i]);
2444                 rc = security_context_to_sid(mount_options[i], len, &sid);
2445                 if (rc) {
2446                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2447                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2448                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2449                         goto out_free_opts;
2450                 }
2451                 rc = -EINVAL;
2452                 switch (flags[i]) {
2453                 case FSCONTEXT_MNT:
2454                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2455                                 goto out_bad_option;
2456                         break;
2457                 case CONTEXT_MNT:
2458                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2459                                 goto out_bad_option;
2460                         break;
2461                 case ROOTCONTEXT_MNT: {
2462                         struct inode_security_struct *root_isec;
2463                         root_isec = sb->s_root->d_inode->i_security;
2464
2465                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2466                                 goto out_bad_option;
2467                         break;
2468                 }
2469                 case DEFCONTEXT_MNT:
2470                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2471                                 goto out_bad_option;
2472                         break;
2473                 default:
2474                         goto out_free_opts;
2475                 }
2476         }
2477
2478         rc = 0;
2479 out_free_opts:
2480         security_free_mnt_opts(&opts);
2481 out_free_secdata:
2482         free_secdata(secdata);
2483         return rc;
2484 out_bad_option:
2485         printk(KERN_WARNING "SELinux: unable to change security options "
2486                "during remount (dev %s, type=%s)\n", sb->s_id,
2487                sb->s_type->name);
2488         goto out_free_opts;
2489 }
2490
2491 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2492 {
2493         const struct cred *cred = current_cred();
2494         struct common_audit_data ad;
2495         int rc;
2496
2497         rc = superblock_doinit(sb, data);
2498         if (rc)
2499                 return rc;
2500
2501         /* Allow all mounts performed by the kernel */
2502         if (flags & MS_KERNMOUNT)
2503                 return 0;
2504
2505         ad.type = LSM_AUDIT_DATA_DENTRY;
2506         ad.u.dentry = sb->s_root;
2507         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2508 }
2509
2510 static int selinux_sb_statfs(struct dentry *dentry)
2511 {
2512         const struct cred *cred = current_cred();
2513         struct common_audit_data ad;
2514
2515         ad.type = LSM_AUDIT_DATA_DENTRY;
2516         ad.u.dentry = dentry->d_sb->s_root;
2517         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2518 }
2519
2520 static int selinux_mount(const char *dev_name,
2521                          struct path *path,
2522                          const char *type,
2523                          unsigned long flags,
2524                          void *data)
2525 {
2526         const struct cred *cred = current_cred();
2527
2528         if (flags & MS_REMOUNT)
2529                 return superblock_has_perm(cred, path->dentry->d_sb,
2530                                            FILESYSTEM__REMOUNT, NULL);
2531         else
2532                 return path_has_perm(cred, path, FILE__MOUNTON);
2533 }
2534
2535 static int selinux_umount(struct vfsmount *mnt, int flags)
2536 {
2537         const struct cred *cred = current_cred();
2538
2539         return superblock_has_perm(cred, mnt->mnt_sb,
2540                                    FILESYSTEM__UNMOUNT, NULL);
2541 }
2542
2543 /* inode security operations */
2544
2545 static int selinux_inode_alloc_security(struct inode *inode)
2546 {
2547         return inode_alloc_security(inode);
2548 }
2549
2550 static void selinux_inode_free_security(struct inode *inode)
2551 {
2552         inode_free_security(inode);
2553 }
2554
2555 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2556                                         struct qstr *name, void **ctx,
2557                                         u32 *ctxlen)
2558 {
2559         const struct cred *cred = current_cred();
2560         struct task_security_struct *tsec;
2561         struct inode_security_struct *dsec;
2562         struct superblock_security_struct *sbsec;
2563         struct inode *dir = dentry->d_parent->d_inode;
2564         u32 newsid;
2565         int rc;
2566
2567         tsec = cred->security;
2568         dsec = dir->i_security;
2569         sbsec = dir->i_sb->s_security;
2570
2571         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2572                 newsid = tsec->create_sid;
2573         } else {
2574                 rc = security_transition_sid(tsec->sid, dsec->sid,
2575                                              inode_mode_to_security_class(mode),
2576                                              name,
2577                                              &newsid);
2578                 if (rc) {
2579                         printk(KERN_WARNING
2580                                 "%s: security_transition_sid failed, rc=%d\n",
2581                                __func__, -rc);
2582                         return rc;
2583                 }
2584         }
2585
2586         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2587 }
2588
2589 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2590                                        const struct qstr *qstr,
2591                                        const char **name,
2592                                        void **value, size_t *len)
2593 {
2594         const struct task_security_struct *tsec = current_security();
2595         struct inode_security_struct *dsec;
2596         struct superblock_security_struct *sbsec;
2597         u32 sid, newsid, clen;
2598         int rc;
2599         char *context;
2600
2601         dsec = dir->i_security;
2602         sbsec = dir->i_sb->s_security;
2603
2604         sid = tsec->sid;
2605         newsid = tsec->create_sid;
2606
2607         if ((sbsec->flags & SE_SBINITIALIZED) &&
2608             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2609                 newsid = sbsec->mntpoint_sid;
2610         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2611                 rc = security_transition_sid(sid, dsec->sid,
2612                                              inode_mode_to_security_class(inode->i_mode),
2613                                              qstr, &newsid);
2614                 if (rc) {
2615                         printk(KERN_WARNING "%s:  "
2616                                "security_transition_sid failed, rc=%d (dev=%s "
2617                                "ino=%ld)\n",
2618                                __func__,
2619                                -rc, inode->i_sb->s_id, inode->i_ino);
2620                         return rc;
2621                 }
2622         }
2623
2624         /* Possibly defer initialization to selinux_complete_init. */
2625         if (sbsec->flags & SE_SBINITIALIZED) {
2626                 struct inode_security_struct *isec = inode->i_security;
2627                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2628                 isec->sid = newsid;
2629                 isec->initialized = 1;
2630         }
2631
2632         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2633                 return -EOPNOTSUPP;
2634
2635         if (name)
2636                 *name = XATTR_SELINUX_SUFFIX;
2637
2638         if (value && len) {
2639                 rc = security_sid_to_context_force(newsid, &context, &clen);
2640                 if (rc)
2641                         return rc;
2642                 *value = context;
2643                 *len = clen;
2644         }
2645
2646         return 0;
2647 }
2648
2649 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2650 {
2651         return may_create(dir, dentry, SECCLASS_FILE);
2652 }
2653
2654 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2655 {
2656         return may_link(dir, old_dentry, MAY_LINK);
2657 }
2658
2659 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2660 {
2661         return may_link(dir, dentry, MAY_UNLINK);
2662 }
2663
2664 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2665 {
2666         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2667 }
2668
2669 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2670 {
2671         return may_create(dir, dentry, SECCLASS_DIR);
2672 }
2673
2674 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2675 {
2676         return may_link(dir, dentry, MAY_RMDIR);
2677 }
2678
2679 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2680 {
2681         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2682 }
2683
2684 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2685                                 struct inode *new_inode, struct dentry *new_dentry)
2686 {
2687         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2688 }
2689
2690 static int selinux_inode_readlink(struct dentry *dentry)
2691 {
2692         const struct cred *cred = current_cred();
2693
2694         return dentry_has_perm(cred, dentry, FILE__READ);
2695 }
2696
2697 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2698 {
2699         const struct cred *cred = current_cred();
2700
2701         return dentry_has_perm(cred, dentry, FILE__READ);
2702 }
2703
2704 static noinline int audit_inode_permission(struct inode *inode,
2705                                            u32 perms, u32 audited, u32 denied,
2706                                            unsigned flags)
2707 {
2708         struct common_audit_data ad;
2709         struct inode_security_struct *isec = inode->i_security;
2710         int rc;
2711
2712         ad.type = LSM_AUDIT_DATA_INODE;
2713         ad.u.inode = inode;
2714
2715         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2716                             audited, denied, &ad, flags);
2717         if (rc)
2718                 return rc;
2719         return 0;
2720 }
2721
2722 static int selinux_inode_permission(struct inode *inode, int mask)
2723 {
2724         const struct cred *cred = current_cred();
2725         u32 perms;
2726         bool from_access;
2727         unsigned flags = mask & MAY_NOT_BLOCK;
2728         struct inode_security_struct *isec;
2729         u32 sid;
2730         struct av_decision avd;
2731         int rc, rc2;
2732         u32 audited, denied;
2733
2734         from_access = mask & MAY_ACCESS;
2735         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2736
2737         /* No permission to check.  Existence test. */
2738         if (!mask)
2739                 return 0;
2740
2741         validate_creds(cred);
2742
2743         if (unlikely(IS_PRIVATE(inode)))
2744                 return 0;
2745
2746         perms = file_mask_to_av(inode->i_mode, mask);
2747
2748         sid = cred_sid(cred);
2749         isec = inode->i_security;
2750
2751         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2752         audited = avc_audit_required(perms, &avd, rc,
2753                                      from_access ? FILE__AUDIT_ACCESS : 0,
2754                                      &denied);
2755         if (likely(!audited))
2756                 return rc;
2757
2758         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2759         if (rc2)
2760                 return rc2;
2761         return rc;
2762 }
2763
2764 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2765 {
2766         const struct cred *cred = current_cred();
2767         unsigned int ia_valid = iattr->ia_valid;
2768         __u32 av = FILE__WRITE;
2769
2770         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2771         if (ia_valid & ATTR_FORCE) {
2772                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2773                               ATTR_FORCE);
2774                 if (!ia_valid)
2775                         return 0;
2776         }
2777
2778         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2779                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2780                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2781
2782         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2783                 av |= FILE__OPEN;
2784
2785         return dentry_has_perm(cred, dentry, av);
2786 }
2787
2788 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2789 {
2790         const struct cred *cred = current_cred();
2791         struct path path;
2792
2793         path.dentry = dentry;
2794         path.mnt = mnt;
2795
2796         return path_has_perm(cred, &path, FILE__GETATTR);
2797 }
2798
2799 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2800 {
2801         const struct cred *cred = current_cred();
2802
2803         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2804                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2805                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2806                         if (!capable(CAP_SETFCAP))
2807                                 return -EPERM;
2808                 } else if (!capable(CAP_SYS_ADMIN)) {
2809                         /* A different attribute in the security namespace.
2810                            Restrict to administrator. */
2811                         return -EPERM;
2812                 }
2813         }
2814
2815         /* Not an attribute we recognize, so just check the
2816            ordinary setattr permission. */
2817         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2818 }
2819
2820 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2821                                   const void *value, size_t size, int flags)
2822 {
2823         struct inode *inode = dentry->d_inode;
2824         struct inode_security_struct *isec = inode->i_security;
2825         struct superblock_security_struct *sbsec;
2826         struct common_audit_data ad;
2827         u32 newsid, sid = current_sid();
2828         int rc = 0;
2829
2830         if (strcmp(name, XATTR_NAME_SELINUX))
2831                 return selinux_inode_setotherxattr(dentry, name);
2832
2833         sbsec = inode->i_sb->s_security;
2834         if (!(sbsec->flags & SE_SBLABELSUPP))
2835                 return -EOPNOTSUPP;
2836
2837         if (!inode_owner_or_capable(inode))
2838                 return -EPERM;
2839
2840         ad.type = LSM_AUDIT_DATA_DENTRY;
2841         ad.u.dentry = dentry;
2842
2843         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2844                           FILE__RELABELFROM, &ad);
2845         if (rc)
2846                 return rc;
2847
2848         rc = security_context_to_sid(value, size, &newsid);
2849         if (rc == -EINVAL) {
2850                 if (!capable(CAP_MAC_ADMIN)) {
2851                         struct audit_buffer *ab;
2852                         size_t audit_size;
2853                         const char *str;
2854
2855                         /* We strip a nul only if it is at the end, otherwise the
2856                          * context contains a nul and we should audit that */
2857                         if (value) {
2858                                 str = value;
2859                                 if (str[size - 1] == '\0')
2860                                         audit_size = size - 1;
2861                                 else
2862                                         audit_size = size;
2863                         } else {
2864                                 str = "";
2865                                 audit_size = 0;
2866                         }
2867                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2868                         audit_log_format(ab, "op=setxattr invalid_context=");
2869                         audit_log_n_untrustedstring(ab, value, audit_size);
2870                         audit_log_end(ab);
2871
2872                         return rc;
2873                 }
2874                 rc = security_context_to_sid_force(value, size, &newsid);
2875         }
2876         if (rc)
2877                 return rc;
2878
2879         rc = avc_has_perm(sid, newsid, isec->sclass,
2880                           FILE__RELABELTO, &ad);
2881         if (rc)
2882                 return rc;
2883
2884         rc = security_validate_transition(isec->sid, newsid, sid,
2885                                           isec->sclass);
2886         if (rc)
2887                 return rc;
2888
2889         return avc_has_perm(newsid,
2890                             sbsec->sid,
2891                             SECCLASS_FILESYSTEM,
2892                             FILESYSTEM__ASSOCIATE,
2893                             &ad);
2894 }
2895
2896 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2897                                         const void *value, size_t size,
2898                                         int flags)
2899 {
2900         struct inode *inode = dentry->d_inode;
2901         struct inode_security_struct *isec = inode->i_security;
2902         u32 newsid;
2903         int rc;
2904
2905         if (strcmp(name, XATTR_NAME_SELINUX)) {
2906                 /* Not an attribute we recognize, so nothing to do. */
2907                 return;
2908         }
2909
2910         rc = security_context_to_sid_force(value, size, &newsid);
2911         if (rc) {
2912                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2913                        "for (%s, %lu), rc=%d\n",
2914                        inode->i_sb->s_id, inode->i_ino, -rc);
2915                 return;
2916         }
2917
2918         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2919         isec->sid = newsid;
2920         isec->initialized = 1;
2921
2922         return;
2923 }
2924
2925 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2926 {
2927         const struct cred *cred = current_cred();
2928
2929         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2930 }
2931
2932 static int selinux_inode_listxattr(struct dentry *dentry)
2933 {
2934         const struct cred *cred = current_cred();
2935
2936         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2937 }
2938
2939 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2940 {
2941         if (strcmp(name, XATTR_NAME_SELINUX))
2942                 return selinux_inode_setotherxattr(dentry, name);
2943
2944         /* No one is allowed to remove a SELinux security label.
2945            You can change the label, but all data must be labeled. */
2946         return -EACCES;
2947 }
2948
2949 /*
2950  * Copy the inode security context value to the user.
2951  *
2952  * Permission check is handled by selinux_inode_getxattr hook.
2953  */
2954 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2955 {
2956         u32 size;
2957         int error;
2958         char *context = NULL;
2959         struct inode_security_struct *isec = inode->i_security;
2960
2961         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2962                 return -EOPNOTSUPP;
2963
2964         /*
2965          * If the caller has CAP_MAC_ADMIN, then get the raw context
2966          * value even if it is not defined by current policy; otherwise,
2967          * use the in-core value under current policy.
2968          * Use the non-auditing forms of the permission checks since
2969          * getxattr may be called by unprivileged processes commonly
2970          * and lack of permission just means that we fall back to the
2971          * in-core context value, not a denial.
2972          */
2973         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2974                                 SECURITY_CAP_NOAUDIT);
2975         if (!error)
2976                 error = security_sid_to_context_force(isec->sid, &context,
2977                                                       &size);
2978         else
2979                 error = security_sid_to_context(isec->sid, &context, &size);
2980         if (error)
2981                 return error;
2982         error = size;
2983         if (alloc) {
2984                 *buffer = context;
2985                 goto out_nofree;
2986         }
2987         kfree(context);
2988 out_nofree:
2989         return error;
2990 }
2991
2992 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2993                                      const void *value, size_t size, int flags)
2994 {
2995         struct inode_security_struct *isec = inode->i_security;
2996         u32 newsid;
2997         int rc;
2998
2999         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3000                 return -EOPNOTSUPP;
3001
3002         if (!value || !size)
3003                 return -EACCES;
3004
3005         rc = security_context_to_sid((void *)value, size, &newsid);
3006         if (rc)
3007                 return rc;
3008
3009         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3010         isec->sid = newsid;
3011         isec->initialized = 1;
3012         return 0;
3013 }
3014
3015 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3016 {
3017         const int len = sizeof(XATTR_NAME_SELINUX);
3018         if (buffer && len <= buffer_size)
3019                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3020         return len;
3021 }
3022
3023 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3024 {
3025         struct inode_security_struct *isec = inode->i_security;
3026         *secid = isec->sid;
3027 }
3028
3029 /* file security operations */
3030
3031 static int selinux_revalidate_file_permission(struct file *file, int mask)
3032 {
3033         const struct cred *cred = current_cred();
3034         struct inode *inode = file_inode(file);
3035
3036         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3037         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3038                 mask |= MAY_APPEND;
3039
3040         return file_has_perm(cred, file,
3041                              file_mask_to_av(inode->i_mode, mask));
3042 }
3043
3044 static int selinux_file_permission(struct file *file, int mask)
3045 {
3046         struct inode *inode = file_inode(file);
3047         struct file_security_struct *fsec = file->f_security;
3048         struct inode_security_struct *isec = inode->i_security;
3049         u32 sid = current_sid();
3050
3051         if (!mask)
3052                 /* No permission to check.  Existence test. */
3053                 return 0;
3054
3055         if (sid == fsec->sid && fsec->isid == isec->sid &&
3056             fsec->pseqno == avc_policy_seqno())
3057                 /* No change since file_open check. */
3058                 return 0;
3059
3060         return selinux_revalidate_file_permission(file, mask);
3061 }
3062
3063 static int selinux_file_alloc_security(struct file *file)
3064 {
3065         return file_alloc_security(file);
3066 }
3067
3068 static void selinux_file_free_security(struct file *file)
3069 {
3070         file_free_security(file);
3071 }
3072
3073 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3074                               unsigned long arg)
3075 {
3076         const struct cred *cred = current_cred();
3077         int error = 0;
3078
3079         switch (cmd) {
3080         case FIONREAD:
3081         /* fall through */
3082         case FIBMAP:
3083         /* fall through */
3084         case FIGETBSZ:
3085         /* fall through */
3086         case FS_IOC_GETFLAGS:
3087         /* fall through */
3088         case FS_IOC_GETVERSION:
3089                 error = file_has_perm(cred, file, FILE__GETATTR);
3090                 break;
3091
3092         case FS_IOC_SETFLAGS:
3093         /* fall through */
3094         case FS_IOC_SETVERSION:
3095                 error = file_has_perm(cred, file, FILE__SETATTR);
3096                 break;
3097
3098         /* sys_ioctl() checks */
3099         case FIONBIO:
3100         /* fall through */
3101         case FIOASYNC:
3102                 error = file_has_perm(cred, file, 0);
3103                 break;
3104
3105         case KDSKBENT:
3106         case KDSKBSENT:
3107                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3108                                             SECURITY_CAP_AUDIT);
3109                 break;
3110
3111         /* default case assumes that the command will go
3112          * to the file's ioctl() function.
3113          */
3114         default:
3115                 error = file_has_perm(cred, file, FILE__IOCTL);
3116         }
3117         return error;
3118 }
3119
3120 static int default_noexec;
3121
3122 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3123 {
3124         const struct cred *cred = current_cred();
3125         int rc = 0;
3126
3127         if (default_noexec &&
3128             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3129                 /*
3130                  * We are making executable an anonymous mapping or a
3131                  * private file mapping that will also be writable.
3132                  * This has an additional check.
3133                  */
3134                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3135                 if (rc)
3136                         goto error;
3137         }
3138
3139         if (file) {
3140                 /* read access is always possible with a mapping */
3141                 u32 av = FILE__READ;
3142
3143                 /* write access only matters if the mapping is shared */
3144                 if (shared && (prot & PROT_WRITE))
3145                         av |= FILE__WRITE;
3146
3147                 if (prot & PROT_EXEC)
3148                         av |= FILE__EXECUTE;
3149
3150                 return file_has_perm(cred, file, av);
3151         }
3152
3153 error:
3154         return rc;
3155 }
3156
3157 static int selinux_mmap_addr(unsigned long addr)
3158 {
3159         int rc = 0;
3160         u32 sid = current_sid();
3161
3162         /*
3163          * notice that we are intentionally putting the SELinux check before
3164          * the secondary cap_file_mmap check.  This is such a likely attempt
3165          * at bad behaviour/exploit that we always want to get the AVC, even
3166          * if DAC would have also denied the operation.
3167          */
3168         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3169                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3170                                   MEMPROTECT__MMAP_ZERO, NULL);
3171                 if (rc)
3172                         return rc;
3173         }
3174
3175         /* do DAC check on address space usage */
3176         return cap_mmap_addr(addr);
3177 }
3178
3179 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3180                              unsigned long prot, unsigned long flags)
3181 {
3182         if (selinux_checkreqprot)
3183                 prot = reqprot;
3184
3185         return file_map_prot_check(file, prot,
3186                                    (flags & MAP_TYPE) == MAP_SHARED);
3187 }
3188
3189 static int selinux_file_mprotect(struct vm_area_struct *vma,
3190                                  unsigned long reqprot,
3191                                  unsigned long prot)
3192 {
3193         const struct cred *cred = current_cred();
3194
3195         if (selinux_checkreqprot)
3196                 prot = reqprot;
3197
3198         if (default_noexec &&
3199             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3200                 int rc = 0;
3201                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3202                     vma->vm_end <= vma->vm_mm->brk) {
3203                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3204                 } else if (!vma->vm_file &&
3205                            vma->vm_start <= vma->vm_mm->start_stack &&
3206                            vma->vm_end >= vma->vm_mm->start_stack) {
3207                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3208                 } else if (vma->vm_file && vma->anon_vma) {
3209                         /*
3210                          * We are making executable a file mapping that has
3211                          * had some COW done. Since pages might have been
3212                          * written, check ability to execute the possibly
3213                          * modified content.  This typically should only
3214                          * occur for text relocations.
3215                          */
3216                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3217                 }
3218                 if (rc)
3219                         return rc;
3220         }
3221
3222         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3223 }
3224
3225 static int selinux_file_lock(struct file *file, unsigned int cmd)
3226 {
3227         const struct cred *cred = current_cred();
3228
3229         return file_has_perm(cred, file, FILE__LOCK);
3230 }
3231
3232 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3233                               unsigned long arg)
3234 {
3235         const struct cred *cred = current_cred();
3236         int err = 0;
3237
3238         switch (cmd) {
3239         case F_SETFL:
3240                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3241                         err = file_has_perm(cred, file, FILE__WRITE);
3242                         break;
3243                 }
3244                 /* fall through */
3245         case F_SETOWN:
3246         case F_SETSIG:
3247         case F_GETFL:
3248         case F_GETOWN:
3249         case F_GETSIG:
3250         case F_GETOWNER_UIDS:
3251                 /* Just check FD__USE permission */
3252                 err = file_has_perm(cred, file, 0);
3253                 break;
3254         case F_GETLK:
3255         case F_SETLK:
3256         case F_SETLKW:
3257 #if BITS_PER_LONG == 32
3258         case F_GETLK64:
3259         case F_SETLK64:
3260         case F_SETLKW64:
3261 #endif
3262                 err = file_has_perm(cred, file, FILE__LOCK);
3263                 break;
3264         }
3265
3266         return err;
3267 }
3268
3269 static int selinux_file_set_fowner(struct file *file)
3270 {
3271         struct file_security_struct *fsec;
3272
3273         fsec = file->f_security;
3274         fsec->fown_sid = current_sid();
3275
3276         return 0;
3277 }
3278
3279 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3280                                        struct fown_struct *fown, int signum)
3281 {
3282         struct file *file;
3283         u32 sid = task_sid(tsk);
3284         u32 perm;
3285         struct file_security_struct *fsec;
3286
3287         /* struct fown_struct is never outside the context of a struct file */
3288         file = container_of(fown, struct file, f_owner);
3289
3290         fsec = file->f_security;
3291
3292         if (!signum)
3293                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3294         else
3295                 perm = signal_to_av(signum);
3296
3297         return avc_has_perm(fsec->fown_sid, sid,
3298                             SECCLASS_PROCESS, perm, NULL);
3299 }
3300
3301 static int selinux_file_receive(struct file *file)
3302 {
3303         const struct cred *cred = current_cred();
3304
3305         return file_has_perm(cred, file, file_to_av(file));
3306 }
3307
3308 static int selinux_file_open(struct file *file, const struct cred *cred)
3309 {
3310         struct file_security_struct *fsec;
3311         struct inode_security_struct *isec;
3312
3313         fsec = file->f_security;
3314         isec = file_inode(file)->i_security;
3315         /*
3316          * Save inode label and policy sequence number
3317          * at open-time so that selinux_file_permission
3318          * can determine whether revalidation is necessary.
3319          * Task label is already saved in the file security
3320          * struct as its SID.
3321          */
3322         fsec->isid = isec->sid;
3323         fsec->pseqno = avc_policy_seqno();
3324         /*
3325          * Since the inode label or policy seqno may have changed
3326          * between the selinux_inode_permission check and the saving
3327          * of state above, recheck that access is still permitted.
3328          * Otherwise, access might never be revalidated against the
3329          * new inode label or new policy.
3330          * This check is not redundant - do not remove.
3331          */
3332         return file_path_has_perm(cred, file, open_file_to_av(file));
3333 }
3334
3335 /* task security operations */
3336
3337 static int selinux_task_create(unsigned long clone_flags)
3338 {
3339         return current_has_perm(current, PROCESS__FORK);
3340 }
3341
3342 /*
3343  * allocate the SELinux part of blank credentials
3344  */
3345 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3346 {
3347         struct task_security_struct *tsec;
3348
3349         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3350         if (!tsec)
3351                 return -ENOMEM;
3352
3353         cred->security = tsec;
3354         return 0;
3355 }
3356
3357 /*
3358  * detach and free the LSM part of a set of credentials
3359  */
3360 static void selinux_cred_free(struct cred *cred)
3361 {
3362         struct task_security_struct *tsec = cred->security;
3363
3364         /*
3365          * cred->security == NULL if security_cred_alloc_blank() or
3366          * security_prepare_creds() returned an error.
3367          */
3368         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3369         cred->security = (void *) 0x7UL;
3370         kfree(tsec);
3371 }
3372
3373 /*
3374  * prepare a new set of credentials for modification
3375  */
3376 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3377                                 gfp_t gfp)
3378 {
3379         const struct task_security_struct *old_tsec;
3380         struct task_security_struct *tsec;
3381
3382         old_tsec = old->security;
3383
3384         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3385         if (!tsec)
3386                 return -ENOMEM;
3387
3388         new->security = tsec;
3389         return 0;
3390 }
3391
3392 /*
3393  * transfer the SELinux data to a blank set of creds
3394  */
3395 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3396 {
3397         const struct task_security_struct *old_tsec = old->security;
3398         struct task_security_struct *tsec = new->security;
3399
3400         *tsec = *old_tsec;
3401 }
3402
3403 /*
3404  * set the security data for a kernel service
3405  * - all the creation contexts are set to unlabelled
3406  */
3407 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3408 {
3409         struct task_security_struct *tsec = new->security;
3410         u32 sid = current_sid();
3411         int ret;
3412
3413         ret = avc_has_perm(sid, secid,
3414                            SECCLASS_KERNEL_SERVICE,
3415                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3416                            NULL);
3417         if (ret == 0) {
3418                 tsec->sid = secid;
3419                 tsec->create_sid = 0;
3420                 tsec->keycreate_sid = 0;
3421                 tsec->sockcreate_sid = 0;
3422         }
3423         return ret;
3424 }
3425
3426 /*
3427  * set the file creation context in a security record to the same as the
3428  * objective context of the specified inode
3429  */
3430 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3431 {
3432         struct inode_security_struct *isec = inode->i_security;
3433         struct task_security_struct *tsec = new->security;
3434         u32 sid = current_sid();
3435         int ret;
3436
3437         ret = avc_has_perm(sid, isec->sid,
3438                            SECCLASS_KERNEL_SERVICE,
3439                            KERNEL_SERVICE__CREATE_FILES_AS,
3440                            NULL);
3441
3442         if (ret == 0)
3443                 tsec->create_sid = isec->sid;
3444         return ret;
3445 }
3446
3447 static int selinux_kernel_module_request(char *kmod_name)
3448 {
3449         u32 sid;
3450         struct common_audit_data ad;
3451
3452         sid = task_sid(current);
3453
3454         ad.type = LSM_AUDIT_DATA_KMOD;
3455         ad.u.kmod_name = kmod_name;
3456
3457         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3458                             SYSTEM__MODULE_REQUEST, &ad);
3459 }
3460
3461 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3462 {
3463         return current_has_perm(p, PROCESS__SETPGID);
3464 }
3465
3466 static int selinux_task_getpgid(struct task_struct *p)
3467 {
3468         return current_has_perm(p, PROCESS__GETPGID);
3469 }
3470
3471 static int selinux_task_getsid(struct task_struct *p)
3472 {
3473         return current_has_perm(p, PROCESS__GETSESSION);
3474 }
3475
3476 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3477 {
3478         *secid = task_sid(p);
3479 }
3480
3481 static int selinux_task_setnice(struct task_struct *p, int nice)
3482 {
3483         int rc;
3484
3485         rc = cap_task_setnice(p, nice);
3486         if (rc)
3487                 return rc;
3488
3489         return current_has_perm(p, PROCESS__SETSCHED);
3490 }
3491
3492 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3493 {
3494         int rc;
3495
3496         rc = cap_task_setioprio(p, ioprio);
3497         if (rc)
3498                 return rc;
3499
3500         return current_has_perm(p, PROCESS__SETSCHED);
3501 }
3502
3503 static int selinux_task_getioprio(struct task_struct *p)
3504 {
3505         return current_has_perm(p, PROCESS__GETSCHED);
3506 }
3507
3508 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3509                 struct rlimit *new_rlim)
3510 {
3511         struct rlimit *old_rlim = p->signal->rlim + resource;
3512
3513         /* Control the ability to change the hard limit (whether
3514            lowering or raising it), so that the hard limit can
3515            later be used as a safe reset point for the soft limit
3516            upon context transitions.  See selinux_bprm_committing_creds. */
3517         if (old_rlim->rlim_max != new_rlim->rlim_max)
3518                 return current_has_perm(p, PROCESS__SETRLIMIT);
3519
3520         return 0;
3521 }
3522
3523 static int selinux_task_setscheduler(struct task_struct *p)
3524 {
3525         int rc;
3526
3527         rc = cap_task_setscheduler(p);
3528         if (rc)
3529                 return rc;
3530
3531         return current_has_perm(p, PROCESS__SETSCHED);
3532 }
3533
3534 static int selinux_task_getscheduler(struct task_struct *p)
3535 {
3536         return current_has_perm(p, PROCESS__GETSCHED);
3537 }
3538
3539 static int selinux_task_movememory(struct task_struct *p)
3540 {
3541         return current_has_perm(p, PROCESS__SETSCHED);
3542 }
3543
3544 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3545                                 int sig, u32 secid)
3546 {
3547         u32 perm;
3548         int rc;
3549
3550         if (!sig)
3551                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3552         else
3553                 perm = signal_to_av(sig);
3554         if (secid)
3555                 rc = avc_has_perm(secid, task_sid(p),
3556                                   SECCLASS_PROCESS, perm, NULL);
3557         else
3558                 rc = current_has_perm(p, perm);
3559         return rc;
3560 }
3561
3562 static int selinux_task_wait(struct task_struct *p)
3563 {
3564         return task_has_perm(p, current, PROCESS__SIGCHLD);
3565 }
3566
3567 static void selinux_task_to_inode(struct task_struct *p,
3568                                   struct inode *inode)
3569 {
3570         struct inode_security_struct *isec = inode->i_security;
3571         u32 sid = task_sid(p);
3572
3573         isec->sid = sid;
3574         isec->initialized = 1;
3575 }
3576
3577 /* Returns error only if unable to parse addresses */
3578 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3579                         struct common_audit_data *ad, u8 *proto)
3580 {
3581         int offset, ihlen, ret = -EINVAL;
3582         struct iphdr _iph, *ih;
3583
3584         offset = skb_network_offset(skb);
3585         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3586         if (ih == NULL)
3587                 goto out;
3588
3589         ihlen = ih->ihl * 4;
3590         if (ihlen < sizeof(_iph))
3591                 goto out;
3592
3593         ad->u.net->v4info.saddr = ih->saddr;
3594         ad->u.net->v4info.daddr = ih->daddr;
3595         ret = 0;
3596
3597         if (proto)
3598                 *proto = ih->protocol;
3599
3600         switch (ih->protocol) {
3601         case IPPROTO_TCP: {
3602                 struct tcphdr _tcph, *th;
3603
3604                 if (ntohs(ih->frag_off) & IP_OFFSET)
3605                         break;
3606
3607                 offset += ihlen;
3608                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3609                 if (th == NULL)
3610                         break;
3611
3612                 ad->u.net->sport = th->source;
3613                 ad->u.net->dport = th->dest;
3614                 break;
3615         }
3616
3617         case IPPROTO_UDP: {
3618                 struct udphdr _udph, *uh;
3619
3620                 if (ntohs(ih->frag_off) & IP_OFFSET)
3621                         break;
3622
3623                 offset += ihlen;
3624                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3625                 if (uh == NULL)
3626                         break;
3627
3628                 ad->u.net->sport = uh->source;
3629                 ad->u.net->dport = uh->dest;
3630                 break;
3631         }
3632
3633         case IPPROTO_DCCP: {
3634                 struct dccp_hdr _dccph, *dh;
3635
3636                 if (ntohs(ih->frag_off) & IP_OFFSET)
3637                         break;
3638
3639                 offset += ihlen;
3640                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3641                 if (dh == NULL)
3642                         break;
3643
3644                 ad->u.net->sport = dh->dccph_sport;
3645                 ad->u.net->dport = dh->dccph_dport;
3646                 break;
3647         }
3648
3649         default:
3650                 break;
3651         }
3652 out:
3653         return ret;
3654 }
3655
3656 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3657
3658 /* Returns error only if unable to parse addresses */
3659 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3660                         struct common_audit_data *ad, u8 *proto)
3661 {
3662         u8 nexthdr;
3663         int ret = -EINVAL, offset;
3664         struct ipv6hdr _ipv6h, *ip6;
3665         __be16 frag_off;
3666
3667         offset = skb_network_offset(skb);
3668         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3669         if (ip6 == NULL)
3670                 goto out;
3671
3672         ad->u.net->v6info.saddr = ip6->saddr;
3673         ad->u.net->v6info.daddr = ip6->daddr;
3674         ret = 0;
3675
3676         nexthdr = ip6->nexthdr;
3677         offset += sizeof(_ipv6h);
3678         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3679         if (offset < 0)
3680                 goto out;
3681
3682         if (proto)
3683                 *proto = nexthdr;
3684
3685         switch (nexthdr) {
3686         case IPPROTO_TCP: {
3687                 struct tcphdr _tcph, *th;
3688
3689                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3690                 if (th == NULL)
3691                         break;
3692
3693                 ad->u.net->sport = th->source;
3694                 ad->u.net->dport = th->dest;
3695                 break;
3696         }
3697
3698         case IPPROTO_UDP: {
3699                 struct udphdr _udph, *uh;
3700
3701                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3702                 if (uh == NULL)
3703                         break;
3704
3705                 ad->u.net->sport = uh->source;
3706                 ad->u.net->dport = uh->dest;
3707                 break;
3708         }
3709
3710         case IPPROTO_DCCP: {
3711                 struct dccp_hdr _dccph, *dh;
3712
3713                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3714                 if (dh == NULL)
3715                         break;
3716
3717                 ad->u.net->sport = dh->dccph_sport;
3718                 ad->u.net->dport = dh->dccph_dport;
3719                 break;
3720         }
3721
3722         /* includes fragments */
3723         default:
3724                 break;
3725         }
3726 out:
3727         return ret;
3728 }
3729
3730 #endif /* IPV6 */
3731
3732 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3733                              char **_addrp, int src, u8 *proto)
3734 {
3735         char *addrp;
3736         int ret;
3737
3738         switch (ad->u.net->family) {
3739         case PF_INET:
3740                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3741                 if (ret)
3742                         goto parse_error;
3743                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3744                                        &ad->u.net->v4info.daddr);
3745                 goto okay;
3746
3747 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3748         case PF_INET6:
3749                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3750                 if (ret)
3751                         goto parse_error;
3752                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3753                                        &ad->u.net->v6info.daddr);
3754                 goto okay;
3755 #endif  /* IPV6 */
3756         default:
3757                 addrp = NULL;
3758                 goto okay;
3759         }
3760
3761 parse_error:
3762         printk(KERN_WARNING
3763                "SELinux: failure in selinux_parse_skb(),"
3764                " unable to parse packet\n");
3765         return ret;
3766
3767 okay:
3768         if (_addrp)
3769                 *_addrp = addrp;
3770         return 0;
3771 }
3772
3773 /**
3774  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3775  * @skb: the packet
3776  * @family: protocol family
3777  * @sid: the packet's peer label SID
3778  *
3779  * Description:
3780  * Check the various different forms of network peer labeling and determine
3781  * the peer label/SID for the packet; most of the magic actually occurs in
3782  * the security server function security_net_peersid_cmp().  The function
3783  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3784  * or -EACCES if @sid is invalid due to inconsistencies with the different
3785  * peer labels.
3786  *
3787  */
3788 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3789 {
3790         int err;
3791         u32 xfrm_sid;
3792         u32 nlbl_sid;
3793         u32 nlbl_type;
3794
3795         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3796         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3797
3798         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3799         if (unlikely(err)) {
3800                 printk(KERN_WARNING
3801                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3802                        " unable to determine packet's peer label\n");
3803                 return -EACCES;
3804         }
3805
3806         return 0;
3807 }
3808
3809 /* socket security operations */
3810
3811 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3812                                  u16 secclass, u32 *socksid)
3813 {
3814         if (tsec->sockcreate_sid > SECSID_NULL) {
3815                 *socksid = tsec->sockcreate_sid;
3816                 return 0;
3817         }
3818
3819         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3820                                        socksid);
3821 }
3822
3823 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3824 {
3825         struct sk_security_struct *sksec = sk->sk_security;
3826         struct common_audit_data ad;
3827         struct lsm_network_audit net = {0,};
3828         u32 tsid = task_sid(task);
3829
3830         if (sksec->sid == SECINITSID_KERNEL)
3831                 return 0;
3832
3833         ad.type = LSM_AUDIT_DATA_NET;
3834         ad.u.net = &net;
3835         ad.u.net->sk = sk;
3836
3837         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3838 }
3839
3840 static int selinux_socket_create(int family, int type,
3841                                  int protocol, int kern)
3842 {
3843         const struct task_security_struct *tsec = current_security();
3844         u32 newsid;
3845         u16 secclass;
3846         int rc;
3847
3848         if (kern)
3849                 return 0;
3850
3851         secclass = socket_type_to_security_class(family, type, protocol);
3852         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3853         if (rc)
3854                 return rc;
3855
3856         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3857 }
3858
3859 static int selinux_socket_post_create(struct socket *sock, int family,
3860                                       int type, int protocol, int kern)
3861 {
3862         const struct task_security_struct *tsec = current_security();
3863         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3864         struct sk_security_struct *sksec;
3865         int err = 0;
3866
3867         isec->sclass = socket_type_to_security_class(family, type, protocol);
3868
3869         if (kern)
3870                 isec->sid = SECINITSID_KERNEL;
3871         else {
3872                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3873                 if (err)
3874                         return err;
3875         }
3876
3877         isec->initialized = 1;
3878
3879         if (sock->sk) {
3880                 sksec = sock->sk->sk_security;
3881                 sksec->sid = isec->sid;
3882                 sksec->sclass = isec->sclass;
3883                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3884         }
3885
3886         return err;
3887 }
3888
3889 /* Range of port numbers used to automatically bind.
3890    Need to determine whether we should perform a name_bind
3891    permission check between the socket and the port number. */
3892
3893 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3894 {
3895         struct sock *sk = sock->sk;
3896         u16 family;
3897         int err;
3898
3899         err = sock_has_perm(current, sk, SOCKET__BIND);
3900         if (err)
3901                 goto out;
3902
3903         /*
3904          * If PF_INET or PF_INET6, check name_bind permission for the port.
3905          * Multiple address binding for SCTP is not supported yet: we just
3906          * check the first address now.
3907          */
3908         family = sk->sk_family;
3909         if (family == PF_INET || family == PF_INET6) {
3910                 char *addrp;
3911                 struct sk_security_struct *sksec = sk->sk_security;
3912                 struct common_audit_data ad;
3913                 struct lsm_network_audit net = {0,};
3914                 struct sockaddr_in *addr4 = NULL;
3915                 struct sockaddr_in6 *addr6 = NULL;
3916                 unsigned short snum;
3917                 u32 sid, node_perm;
3918
3919                 if (family == PF_INET) {
3920                         addr4 = (struct sockaddr_in *)address;
3921                         snum = ntohs(addr4->sin_port);
3922                         addrp = (char *)&addr4->sin_addr.s_addr;
3923                 } else {
3924                         addr6 = (struct sockaddr_in6 *)address;
3925                         snum = ntohs(addr6->sin6_port);
3926                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3927                 }
3928
3929                 if (snum) {
3930                         int low, high;
3931
3932                         inet_get_local_port_range(&low, &high);
3933
3934                         if (snum < max(PROT_SOCK, low) || snum > high) {
3935                                 err = sel_netport_sid(sk->sk_protocol,
3936                                                       snum, &sid);
3937                                 if (err)
3938                                         goto out;
3939                                 ad.type = LSM_AUDIT_DATA_NET;
3940                                 ad.u.net = &net;
3941                                 ad.u.net->sport = htons(snum);
3942                                 ad.u.net->family = family;
3943                                 err = avc_has_perm(sksec->sid, sid,
3944                                                    sksec->sclass,
3945                                                    SOCKET__NAME_BIND, &ad);
3946                                 if (err)
3947                                         goto out;
3948                         }
3949                 }
3950
3951                 switch (sksec->sclass) {
3952                 case SECCLASS_TCP_SOCKET:
3953                         node_perm = TCP_SOCKET__NODE_BIND;
3954                         break;
3955
3956                 case SECCLASS_UDP_SOCKET:
3957                         node_perm = UDP_SOCKET__NODE_BIND;
3958                         break;
3959
3960                 case SECCLASS_DCCP_SOCKET:
3961                         node_perm = DCCP_SOCKET__NODE_BIND;
3962                         break;
3963
3964                 default:
3965                         node_perm = RAWIP_SOCKET__NODE_BIND;
3966                         break;
3967                 }
3968
3969                 err = sel_netnode_sid(addrp, family, &sid);
3970                 if (err)
3971                         goto out;
3972
3973                 ad.type = LSM_AUDIT_DATA_NET;
3974                 ad.u.net = &net;
3975                 ad.u.net->sport = htons(snum);
3976                 ad.u.net->family = family;
3977
3978                 if (family == PF_INET)
3979                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3980                 else
3981                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3982
3983                 err = avc_has_perm(sksec->sid, sid,
3984                                    sksec->sclass, node_perm, &ad);
3985                 if (err)
3986                         goto out;
3987         }
3988 out:
3989         return err;
3990 }
3991
3992 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3993 {
3994         struct sock *sk = sock->sk;
3995         struct sk_security_struct *sksec = sk->sk_security;
3996         int err;
3997
3998         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3999         if (err)
4000                 return err;
4001
4002         /*
4003          * If a TCP or DCCP socket, check name_connect permission for the port.
4004          */
4005         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4006             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4007                 struct common_audit_data ad;
4008                 struct lsm_network_audit net = {0,};
4009                 struct sockaddr_in *addr4 = NULL;
4010                 struct sockaddr_in6 *addr6 = NULL;
4011                 unsigned short snum;
4012                 u32 sid, perm;
4013
4014                 if (sk->sk_family == PF_INET) {
4015                         addr4 = (struct sockaddr_in *)address;
4016                         if (addrlen < sizeof(struct sockaddr_in))
4017                                 return -EINVAL;
4018                         snum = ntohs(addr4->sin_port);
4019                 } else {
4020                         addr6 = (struct sockaddr_in6 *)address;
4021                         if (addrlen < SIN6_LEN_RFC2133)
4022                                 return -EINVAL;
4023                         snum = ntohs(addr6->sin6_port);
4024                 }
4025
4026                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4027                 if (err)
4028                         goto out;
4029
4030                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4031                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4032
4033                 ad.type = LSM_AUDIT_DATA_NET;
4034                 ad.u.net = &net;
4035                 ad.u.net->dport = htons(snum);
4036                 ad.u.net->family = sk->sk_family;
4037                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4038                 if (err)
4039                         goto out;
4040         }
4041
4042         err = selinux_netlbl_socket_connect(sk, address);
4043
4044 out:
4045         return err;
4046 }
4047
4048 static int selinux_socket_listen(struct socket *sock, int backlog)
4049 {
4050         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4051 }
4052
4053 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4054 {
4055         int err;
4056         struct inode_security_struct *isec;
4057         struct inode_security_struct *newisec;
4058
4059         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4060         if (err)
4061                 return err;
4062
4063         newisec = SOCK_INODE(newsock)->i_security;
4064
4065         isec = SOCK_INODE(sock)->i_security;
4066         newisec->sclass = isec->sclass;
4067         newisec->sid = isec->sid;
4068         newisec->initialized = 1;
4069
4070         return 0;
4071 }
4072
4073 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4074                                   int size)
4075 {
4076         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4077 }
4078
4079 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4080                                   int size, int flags)
4081 {
4082         return sock_has_perm(current, sock->sk, SOCKET__READ);
4083 }
4084
4085 static int selinux_socket_getsockname(struct socket *sock)
4086 {
4087         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4088 }
4089
4090 static int selinux_socket_getpeername(struct socket *sock)
4091 {
4092         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4093 }
4094
4095 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4096 {
4097         int err;
4098
4099         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4100         if (err)
4101                 return err;
4102
4103         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4104 }
4105
4106 static int selinux_socket_getsockopt(struct socket *sock, int level,
4107                                      int optname)
4108 {
4109         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4110 }
4111
4112 static int selinux_socket_shutdown(struct socket *sock, int how)
4113 {
4114         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4115 }
4116
4117 static int selinux_socket_unix_stream_connect(struct sock *sock,
4118                                               struct sock *other,
4119                                               struct sock *newsk)
4120 {
4121         struct sk_security_struct *sksec_sock = sock->sk_security;
4122         struct sk_security_struct *sksec_other = other->sk_security;
4123         struct sk_security_struct *sksec_new = newsk->sk_security;
4124         struct common_audit_data ad;
4125         struct lsm_network_audit net = {0,};
4126         int err;
4127
4128         ad.type = LSM_AUDIT_DATA_NET;
4129         ad.u.net = &net;
4130         ad.u.net->sk = other;
4131
4132         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4133                            sksec_other->sclass,
4134                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4135         if (err)
4136                 return err;
4137
4138         /* server child socket */
4139         sksec_new->peer_sid = sksec_sock->sid;
4140         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4141                                     &sksec_new->sid);
4142         if (err)
4143                 return err;
4144
4145         /* connecting socket */
4146         sksec_sock->peer_sid = sksec_new->sid;
4147
4148         return 0;
4149 }
4150
4151 static int selinux_socket_unix_may_send(struct socket *sock,
4152                                         struct socket *other)
4153 {
4154         struct sk_security_struct *ssec = sock->sk->sk_security;
4155         struct sk_security_struct *osec = other->sk->sk_security;
4156         struct common_audit_data ad;
4157         struct lsm_network_audit net = {0,};
4158
4159         ad.type = LSM_AUDIT_DATA_NET;
4160         ad.u.net = &net;
4161         ad.u.net->sk = other->sk;
4162
4163         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4164                             &ad);
4165 }
4166
4167 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4168                                     u32 peer_sid,
4169                                     struct common_audit_data *ad)
4170 {
4171         int err;
4172         u32 if_sid;
4173         u32 node_sid;
4174
4175         err = sel_netif_sid(ifindex, &if_sid);
4176         if (err)
4177                 return err;
4178         err = avc_has_perm(peer_sid, if_sid,
4179                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4180         if (err)
4181                 return err;
4182
4183         err = sel_netnode_sid(addrp, family, &node_sid);
4184         if (err)
4185                 return err;
4186         return avc_has_perm(peer_sid, node_sid,
4187                             SECCLASS_NODE, NODE__RECVFROM, ad);
4188 }
4189
4190 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4191                                        u16 family)
4192 {
4193         int err = 0;
4194         struct sk_security_struct *sksec = sk->sk_security;
4195         u32 sk_sid = sksec->sid;
4196         struct common_audit_data ad;
4197         struct lsm_network_audit net = {0,};
4198         char *addrp;
4199
4200         ad.type = LSM_AUDIT_DATA_NET;
4201         ad.u.net = &net;
4202         ad.u.net->netif = skb->skb_iif;
4203         ad.u.net->family = family;
4204         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4205         if (err)
4206                 return err;
4207
4208         if (selinux_secmark_enabled()) {
4209                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4210                                    PACKET__RECV, &ad);
4211                 if (err)
4212                         return err;
4213         }
4214
4215         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4216         if (err)
4217                 return err;
4218         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4219
4220         return err;
4221 }
4222
4223 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4224 {
4225         int err;
4226         struct sk_security_struct *sksec = sk->sk_security;
4227         u16 family = sk->sk_family;
4228         u32 sk_sid = sksec->sid;
4229         struct common_audit_data ad;
4230         struct lsm_network_audit net = {0,};
4231         char *addrp;
4232         u8 secmark_active;
4233         u8 peerlbl_active;
4234
4235         if (family != PF_INET && family != PF_INET6)
4236                 return 0;
4237
4238         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4239         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4240                 family = PF_INET;
4241
4242         /* If any sort of compatibility mode is enabled then handoff processing
4243          * to the selinux_sock_rcv_skb_compat() function to deal with the
4244          * special handling.  We do this in an attempt to keep this function
4245          * as fast and as clean as possible. */
4246         if (!selinux_policycap_netpeer)
4247                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4248
4249         secmark_active = selinux_secmark_enabled();
4250         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4251         if (!secmark_active && !peerlbl_active)
4252                 return 0;
4253
4254         ad.type = LSM_AUDIT_DATA_NET;
4255         ad.u.net = &net;
4256         ad.u.net->netif = skb->skb_iif;
4257         ad.u.net->family = family;
4258         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4259         if (err)
4260                 return err;
4261
4262         if (peerlbl_active) {
4263                 u32 peer_sid;
4264
4265                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4266                 if (err)
4267                         return err;
4268                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4269                                                peer_sid, &ad);
4270                 if (err) {
4271                         selinux_netlbl_err(skb, err, 0);
4272                         return err;
4273                 }
4274                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4275                                    PEER__RECV, &ad);
4276                 if (err)
4277                         selinux_netlbl_err(skb, err, 0);
4278         }
4279
4280         if (secmark_active) {
4281                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4282                                    PACKET__RECV, &ad);
4283                 if (err)
4284                         return err;
4285         }
4286
4287         return err;
4288 }
4289
4290 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4291                                             int __user *optlen, unsigned len)
4292 {
4293         int err = 0;
4294         char *scontext;
4295         u32 scontext_len;
4296         struct sk_security_struct *sksec = sock->sk->sk_security;
4297         u32 peer_sid = SECSID_NULL;
4298
4299         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4300             sksec->sclass == SECCLASS_TCP_SOCKET)
4301                 peer_sid = sksec->peer_sid;
4302         if (peer_sid == SECSID_NULL)
4303                 return -ENOPROTOOPT;
4304
4305         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4306         if (err)
4307                 return err;
4308
4309         if (scontext_len > len) {
4310                 err = -ERANGE;
4311                 goto out_len;
4312         }
4313
4314         if (copy_to_user(optval, scontext, scontext_len))
4315                 err = -EFAULT;
4316
4317 out_len:
4318         if (put_user(scontext_len, optlen))
4319                 err = -EFAULT;
4320         kfree(scontext);
4321         return err;
4322 }
4323
4324 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4325 {
4326         u32 peer_secid = SECSID_NULL;
4327         u16 family;
4328
4329         if (skb && skb->protocol == htons(ETH_P_IP))
4330                 family = PF_INET;
4331         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4332                 family = PF_INET6;
4333         else if (sock)
4334                 family = sock->sk->sk_family;
4335         else
4336                 goto out;
4337
4338         if (sock && family == PF_UNIX)
4339                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4340         else if (skb)
4341                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4342
4343 out:
4344         *secid = peer_secid;
4345         if (peer_secid == SECSID_NULL)
4346                 return -EINVAL;
4347         return 0;
4348 }
4349
4350 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4351 {
4352         struct sk_security_struct *sksec;
4353
4354         sksec = kzalloc(sizeof(*sksec), priority);
4355         if (!sksec)
4356                 return -ENOMEM;
4357
4358         sksec->peer_sid = SECINITSID_UNLABELED;
4359         sksec->sid = SECINITSID_UNLABELED;
4360         selinux_netlbl_sk_security_reset(sksec);
4361         sk->sk_security = sksec;
4362
4363         return 0;
4364 }
4365
4366 static void selinux_sk_free_security(struct sock *sk)
4367 {
4368         struct sk_security_struct *sksec = sk->sk_security;
4369
4370         sk->sk_security = NULL;
4371         selinux_netlbl_sk_security_free(sksec);
4372         kfree(sksec);
4373 }
4374
4375 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4376 {
4377         struct sk_security_struct *sksec = sk->sk_security;
4378         struct sk_security_struct *newsksec = newsk->sk_security;
4379
4380         newsksec->sid = sksec->sid;
4381         newsksec->peer_sid = sksec->peer_sid;
4382         newsksec->sclass = sksec->sclass;
4383
4384         selinux_netlbl_sk_security_reset(newsksec);
4385 }
4386
4387 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4388 {
4389         if (!sk)
4390                 *secid = SECINITSID_ANY_SOCKET;
4391         else {
4392                 struct sk_security_struct *sksec = sk->sk_security;
4393
4394                 *secid = sksec->sid;
4395         }
4396 }
4397
4398 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4399 {
4400         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4401         struct sk_security_struct *sksec = sk->sk_security;
4402
4403         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4404             sk->sk_family == PF_UNIX)
4405                 isec->sid = sksec->sid;
4406         sksec->sclass = isec->sclass;
4407 }
4408
4409 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4410                                      struct request_sock *req)
4411 {
4412         struct sk_security_struct *sksec = sk->sk_security;
4413         int err;
4414         u16 family = sk->sk_family;
4415         u32 newsid;
4416         u32 peersid;
4417
4418         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4419         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4420                 family = PF_INET;
4421
4422         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4423         if (err)
4424                 return err;
4425         if (peersid == SECSID_NULL) {
4426                 req->secid = sksec->sid;
4427                 req->peer_secid = SECSID_NULL;
4428         } else {
4429                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4430                 if (err)
4431                         return err;
4432                 req->secid = newsid;
4433                 req->peer_secid = peersid;
4434         }
4435
4436         return selinux_netlbl_inet_conn_request(req, family);
4437 }
4438
4439 static void selinux_inet_csk_clone(struct sock *newsk,
4440                                    const struct request_sock *req)
4441 {
4442         struct sk_security_struct *newsksec = newsk->sk_security;
4443
4444         newsksec->sid = req->secid;
4445         newsksec->peer_sid = req->peer_secid;
4446         /* NOTE: Ideally, we should also get the isec->sid for the
4447            new socket in sync, but we don't have the isec available yet.
4448            So we will wait until sock_graft to do it, by which
4449            time it will have been created and available. */
4450
4451         /* We don't need to take any sort of lock here as we are the only
4452          * thread with access to newsksec */
4453         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4454 }
4455
4456 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4457 {
4458         u16 family = sk->sk_family;
4459         struct sk_security_struct *sksec = sk->sk_security;
4460
4461         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4462         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4463                 family = PF_INET;
4464
4465         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4466 }
4467
4468 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4469 {
4470         skb_set_owner_w(skb, sk);
4471 }
4472
4473 static int selinux_secmark_relabel_packet(u32 sid)
4474 {
4475         const struct task_security_struct *__tsec;
4476         u32 tsid;
4477
4478         __tsec = current_security();
4479         tsid = __tsec->sid;
4480
4481         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4482 }
4483
4484 static void selinux_secmark_refcount_inc(void)
4485 {
4486         atomic_inc(&selinux_secmark_refcount);
4487 }
4488
4489 static void selinux_secmark_refcount_dec(void)
4490 {
4491         atomic_dec(&selinux_secmark_refcount);
4492 }
4493
4494 static void selinux_req_classify_flow(const struct request_sock *req,
4495                                       struct flowi *fl)
4496 {
4497         fl->flowi_secid = req->secid;
4498 }
4499
4500 static int selinux_tun_dev_alloc_security(void **security)
4501 {
4502         struct tun_security_struct *tunsec;
4503
4504         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4505         if (!tunsec)
4506                 return -ENOMEM;
4507         tunsec->sid = current_sid();
4508
4509         *security = tunsec;
4510         return 0;
4511 }
4512
4513 static void selinux_tun_dev_free_security(void *security)
4514 {
4515         kfree(security);
4516 }
4517
4518 static int selinux_tun_dev_create(void)
4519 {
4520         u32 sid = current_sid();
4521
4522         /* we aren't taking into account the "sockcreate" SID since the socket
4523          * that is being created here is not a socket in the traditional sense,
4524          * instead it is a private sock, accessible only to the kernel, and
4525          * representing a wide range of network traffic spanning multiple
4526          * connections unlike traditional sockets - check the TUN driver to
4527          * get a better understanding of why this socket is special */
4528
4529         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4530                             NULL);
4531 }
4532
4533 static int selinux_tun_dev_attach_queue(void *security)
4534 {
4535         struct tun_security_struct *tunsec = security;
4536
4537         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4538                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4539 }
4540
4541 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4542 {
4543         struct tun_security_struct *tunsec = security;
4544         struct sk_security_struct *sksec = sk->sk_security;
4545
4546         /* we don't currently perform any NetLabel based labeling here and it
4547          * isn't clear that we would want to do so anyway; while we could apply
4548          * labeling without the support of the TUN user the resulting labeled
4549          * traffic from the other end of the connection would almost certainly
4550          * cause confusion to the TUN user that had no idea network labeling
4551          * protocols were being used */
4552
4553         sksec->sid = tunsec->sid;
4554         sksec->sclass = SECCLASS_TUN_SOCKET;
4555
4556         return 0;
4557 }
4558
4559 static int selinux_tun_dev_open(void *security)
4560 {
4561         struct tun_security_struct *tunsec = security;
4562         u32 sid = current_sid();
4563         int err;
4564
4565         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4566                            TUN_SOCKET__RELABELFROM, NULL);
4567         if (err)
4568                 return err;
4569         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4570                            TUN_SOCKET__RELABELTO, NULL);
4571         if (err)
4572                 return err;
4573         tunsec->sid = sid;
4574
4575         return 0;
4576 }
4577
4578 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4579 {
4580         int err = 0;
4581         u32 perm;
4582         struct nlmsghdr *nlh;
4583         struct sk_security_struct *sksec = sk->sk_security;
4584
4585         if (skb->len < NLMSG_HDRLEN) {
4586                 err = -EINVAL;
4587                 goto out;
4588         }
4589         nlh = nlmsg_hdr(skb);
4590
4591         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4592         if (err) {
4593                 if (err == -EINVAL) {
4594                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4595                                   "SELinux:  unrecognized netlink message"
4596                                   " type=%hu for sclass=%hu\n",
4597                                   nlh->nlmsg_type, sksec->sclass);
4598                         if (!selinux_enforcing || security_get_allow_unknown())
4599                                 err = 0;
4600                 }
4601
4602                 /* Ignore */
4603                 if (err == -ENOENT)
4604                         err = 0;
4605                 goto out;
4606         }
4607
4608         err = sock_has_perm(current, sk, perm);
4609 out:
4610         return err;
4611 }
4612
4613 #ifdef CONFIG_NETFILTER
4614
4615 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4616                                        u16 family)
4617 {
4618         int err;
4619         char *addrp;
4620         u32 peer_sid;
4621         struct common_audit_data ad;
4622         struct lsm_network_audit net = {0,};
4623         u8 secmark_active;
4624         u8 netlbl_active;
4625         u8 peerlbl_active;
4626
4627         if (!selinux_policycap_netpeer)
4628                 return NF_ACCEPT;
4629
4630         secmark_active = selinux_secmark_enabled();
4631         netlbl_active = netlbl_enabled();
4632         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4633         if (!secmark_active && !peerlbl_active)
4634                 return NF_ACCEPT;
4635
4636         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4637                 return NF_DROP;
4638
4639         ad.type = LSM_AUDIT_DATA_NET;
4640         ad.u.net = &net;
4641         ad.u.net->netif = ifindex;
4642         ad.u.net->family = family;
4643         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4644                 return NF_DROP;
4645
4646         if (peerlbl_active) {
4647                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4648                                                peer_sid, &ad);
4649                 if (err) {
4650                         selinux_netlbl_err(skb, err, 1);
4651                         return NF_DROP;
4652                 }
4653         }
4654
4655         if (secmark_active)
4656                 if (avc_has_perm(peer_sid, skb->secmark,
4657                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4658                         return NF_DROP;
4659
4660         if (netlbl_active)
4661                 /* we do this in the FORWARD path and not the POST_ROUTING
4662                  * path because we want to make sure we apply the necessary
4663                  * labeling before IPsec is applied so we can leverage AH
4664                  * protection */
4665                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4666                         return NF_DROP;
4667
4668         return NF_ACCEPT;
4669 }
4670
4671 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4672                                          struct sk_buff *skb,
4673                                          const struct net_device *in,
4674                                          const struct net_device *out,
4675                                          int (*okfn)(struct sk_buff *))
4676 {
4677         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4678 }
4679
4680 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4681 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4682                                          struct sk_buff *skb,
4683                                          const struct net_device *in,
4684                                          const struct net_device *out,
4685                                          int (*okfn)(struct sk_buff *))
4686 {
4687         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4688 }
4689 #endif  /* IPV6 */
4690
4691 static unsigned int selinux_ip_output(struct sk_buff *skb,
4692                                       u16 family)
4693 {
4694         u32 sid;
4695
4696         if (!netlbl_enabled())
4697                 return NF_ACCEPT;
4698
4699         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4700          * because we want to make sure we apply the necessary labeling
4701          * before IPsec is applied so we can leverage AH protection */
4702         if (skb->sk) {
4703                 struct sk_security_struct *sksec = skb->sk->sk_security;
4704                 sid = sksec->sid;
4705         } else
4706                 sid = SECINITSID_KERNEL;
4707         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4708                 return NF_DROP;
4709
4710         return NF_ACCEPT;
4711 }
4712
4713 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4714                                         struct sk_buff *skb,
4715                                         const struct net_device *in,
4716                                         const struct net_device *out,
4717                                         int (*okfn)(struct sk_buff *))
4718 {
4719         return selinux_ip_output(skb, PF_INET);
4720 }
4721
4722 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4723                                                 int ifindex,
4724                                                 u16 family)
4725 {
4726         struct sock *sk = skb->sk;
4727         struct sk_security_struct *sksec;
4728         struct common_audit_data ad;
4729         struct lsm_network_audit net = {0,};
4730         char *addrp;
4731         u8 proto;
4732
4733         if (sk == NULL)
4734                 return NF_ACCEPT;
4735         sksec = sk->sk_security;
4736
4737         ad.type = LSM_AUDIT_DATA_NET;
4738         ad.u.net = &net;
4739         ad.u.net->netif = ifindex;
4740         ad.u.net->family = family;
4741         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4742                 return NF_DROP;
4743
4744         if (selinux_secmark_enabled())
4745                 if (avc_has_perm(sksec->sid, skb->secmark,
4746                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4747                         return NF_DROP_ERR(-ECONNREFUSED);
4748
4749         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4750                 return NF_DROP_ERR(-ECONNREFUSED);
4751
4752         return NF_ACCEPT;
4753 }
4754
4755 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4756                                          u16 family)
4757 {
4758         u32 secmark_perm;
4759         u32 peer_sid;
4760         struct sock *sk;
4761         struct common_audit_data ad;
4762         struct lsm_network_audit net = {0,};
4763         char *addrp;
4764         u8 secmark_active;
4765         u8 peerlbl_active;
4766
4767         /* If any sort of compatibility mode is enabled then handoff processing
4768          * to the selinux_ip_postroute_compat() function to deal with the
4769          * special handling.  We do this in an attempt to keep this function
4770          * as fast and as clean as possible. */
4771         if (!selinux_policycap_netpeer)
4772                 return selinux_ip_postroute_compat(skb, ifindex, family);
4773 #ifdef CONFIG_XFRM
4774         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4775          * packet transformation so allow the packet to pass without any checks
4776          * since we'll have another chance to perform access control checks
4777          * when the packet is on it's final way out.
4778          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4779          *       is NULL, in this case go ahead and apply access control. */
4780         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4781                 return NF_ACCEPT;
4782 #endif
4783         secmark_active = selinux_secmark_enabled();
4784         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4785         if (!secmark_active && !peerlbl_active)
4786                 return NF_ACCEPT;
4787
4788         /* if the packet is being forwarded then get the peer label from the
4789          * packet itself; otherwise check to see if it is from a local
4790          * application or the kernel, if from an application get the peer label
4791          * from the sending socket, otherwise use the kernel's sid */
4792         sk = skb->sk;
4793         if (sk == NULL) {
4794                 if (skb->skb_iif) {
4795                         secmark_perm = PACKET__FORWARD_OUT;
4796                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4797                                 return NF_DROP;
4798                 } else {
4799                         secmark_perm = PACKET__SEND;
4800                         peer_sid = SECINITSID_KERNEL;
4801                 }
4802         } else {
4803                 struct sk_security_struct *sksec = sk->sk_security;
4804                 peer_sid = sksec->sid;
4805                 secmark_perm = PACKET__SEND;
4806         }
4807
4808         ad.type = LSM_AUDIT_DATA_NET;
4809         ad.u.net = &net;
4810         ad.u.net->netif = ifindex;
4811         ad.u.net->family = family;
4812         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4813                 return NF_DROP;
4814
4815         if (secmark_active)
4816                 if (avc_has_perm(peer_sid, skb->secmark,
4817                                  SECCLASS_PACKET, secmark_perm, &ad))
4818                         return NF_DROP_ERR(-ECONNREFUSED);
4819
4820         if (peerlbl_active) {
4821                 u32 if_sid;
4822                 u32 node_sid;
4823
4824                 if (sel_netif_sid(ifindex, &if_sid))
4825                         return NF_DROP;
4826                 if (avc_has_perm(peer_sid, if_sid,
4827                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4828                         return NF_DROP_ERR(-ECONNREFUSED);
4829
4830                 if (sel_netnode_sid(addrp, family, &node_sid))
4831                         return NF_DROP;
4832                 if (avc_has_perm(peer_sid, node_sid,
4833                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4834                         return NF_DROP_ERR(-ECONNREFUSED);
4835         }
4836
4837         return NF_ACCEPT;
4838 }
4839
4840 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4841                                            struct sk_buff *skb,
4842                                            const struct net_device *in,
4843                                            const struct net_device *out,
4844                                            int (*okfn)(struct sk_buff *))
4845 {
4846         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4847 }
4848
4849 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4850 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4851                                            struct sk_buff *skb,
4852                                            const struct net_device *in,
4853                                            const struct net_device *out,
4854                                            int (*okfn)(struct sk_buff *))
4855 {
4856         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4857 }
4858 #endif  /* IPV6 */
4859
4860 #endif  /* CONFIG_NETFILTER */
4861
4862 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4863 {
4864         int err;
4865
4866         err = cap_netlink_send(sk, skb);
4867         if (err)
4868                 return err;
4869
4870         return selinux_nlmsg_perm(sk, skb);
4871 }
4872
4873 static int ipc_alloc_security(struct task_struct *task,
4874                               struct kern_ipc_perm *perm,
4875                               u16 sclass)
4876 {
4877         struct ipc_security_struct *isec;
4878         u32 sid;
4879
4880         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4881         if (!isec)
4882                 return -ENOMEM;
4883
4884         sid = task_sid(task);
4885         isec->sclass = sclass;
4886         isec->sid = sid;
4887         perm->security = isec;
4888
4889         return 0;
4890 }
4891
4892 static void ipc_free_security(struct kern_ipc_perm *perm)
4893 {
4894         struct ipc_security_struct *isec = perm->security;
4895         perm->security = NULL;
4896         kfree(isec);
4897 }
4898
4899 static int msg_msg_alloc_security(struct msg_msg *msg)
4900 {
4901         struct msg_security_struct *msec;
4902
4903         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4904         if (!msec)
4905                 return -ENOMEM;
4906
4907         msec->sid = SECINITSID_UNLABELED;
4908         msg->security = msec;
4909
4910         return 0;
4911 }
4912
4913 static void msg_msg_free_security(struct msg_msg *msg)
4914 {
4915         struct msg_security_struct *msec = msg->security;
4916
4917         msg->security = NULL;
4918         kfree(msec);
4919 }
4920
4921 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4922                         u32 perms)
4923 {
4924         struct ipc_security_struct *isec;
4925         struct common_audit_data ad;
4926         u32 sid = current_sid();
4927
4928         isec = ipc_perms->security;
4929
4930         ad.type = LSM_AUDIT_DATA_IPC;
4931         ad.u.ipc_id = ipc_perms->key;
4932
4933         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4934 }
4935
4936 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4937 {
4938         return msg_msg_alloc_security(msg);
4939 }
4940
4941 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4942 {
4943         msg_msg_free_security(msg);
4944 }
4945
4946 /* message queue security operations */
4947 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4948 {
4949         struct ipc_security_struct *isec;
4950         struct common_audit_data ad;
4951         u32 sid = current_sid();
4952         int rc;
4953
4954         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4955         if (rc)
4956                 return rc;
4957
4958         isec = msq->q_perm.security;
4959
4960         ad.type = LSM_AUDIT_DATA_IPC;
4961         ad.u.ipc_id = msq->q_perm.key;
4962
4963         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4964                           MSGQ__CREATE, &ad);
4965         if (rc) {
4966                 ipc_free_security(&msq->q_perm);
4967                 return rc;
4968         }
4969         return 0;
4970 }
4971
4972 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4973 {
4974         ipc_free_security(&msq->q_perm);
4975 }
4976
4977 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4978 {
4979         struct ipc_security_struct *isec;
4980         struct common_audit_data ad;
4981         u32 sid = current_sid();
4982
4983         isec = msq->q_perm.security;
4984
4985         ad.type = LSM_AUDIT_DATA_IPC;
4986         ad.u.ipc_id = msq->q_perm.key;
4987
4988         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4989                             MSGQ__ASSOCIATE, &ad);
4990 }
4991
4992 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4993 {
4994         int err;
4995         int perms;
4996
4997         switch (cmd) {
4998         case IPC_INFO:
4999         case MSG_INFO:
5000                 /* No specific object, just general system-wide information. */
5001                 return task_has_system(current, SYSTEM__IPC_INFO);
5002         case IPC_STAT:
5003         case MSG_STAT:
5004                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5005                 break;
5006         case IPC_SET:
5007                 perms = MSGQ__SETATTR;
5008                 break;
5009         case IPC_RMID:
5010                 perms = MSGQ__DESTROY;
5011                 break;
5012         default:
5013                 return 0;
5014         }
5015
5016         err = ipc_has_perm(&msq->q_perm, perms);
5017         return err;
5018 }
5019
5020 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5021 {
5022         struct ipc_security_struct *isec;
5023         struct msg_security_struct *msec;
5024         struct common_audit_data ad;
5025         u32 sid = current_sid();
5026         int rc;
5027
5028         isec = msq->q_perm.security;
5029         msec = msg->security;
5030
5031         /*
5032          * First time through, need to assign label to the message
5033          */
5034         if (msec->sid == SECINITSID_UNLABELED) {
5035                 /*
5036                  * Compute new sid based on current process and
5037                  * message queue this message will be stored in
5038                  */
5039                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5040                                              NULL, &msec->sid);
5041                 if (rc)
5042                         return rc;
5043         }
5044
5045         ad.type = LSM_AUDIT_DATA_IPC;
5046         ad.u.ipc_id = msq->q_perm.key;
5047
5048         /* Can this process write to the queue? */
5049         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5050                           MSGQ__WRITE, &ad);
5051         if (!rc)
5052                 /* Can this process send the message */
5053                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5054                                   MSG__SEND, &ad);
5055         if (!rc)
5056                 /* Can the message be put in the queue? */
5057                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5058                                   MSGQ__ENQUEUE, &ad);
5059
5060         return rc;
5061 }
5062
5063 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5064                                     struct task_struct *target,
5065                                     long type, int mode)
5066 {
5067         struct ipc_security_struct *isec;
5068         struct msg_security_struct *msec;
5069         struct common_audit_data ad;
5070         u32 sid = task_sid(target);
5071         int rc;
5072
5073         isec = msq->q_perm.security;
5074         msec = msg->security;
5075
5076         ad.type = LSM_AUDIT_DATA_IPC;
5077         ad.u.ipc_id = msq->q_perm.key;
5078
5079         rc = avc_has_perm(sid, isec->sid,
5080                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5081         if (!rc)
5082                 rc = avc_has_perm(sid, msec->sid,
5083                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5084         return rc;
5085 }
5086
5087 /* Shared Memory security operations */
5088 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5089 {
5090         struct ipc_security_struct *isec;
5091         struct common_audit_data ad;
5092         u32 sid = current_sid();
5093         int rc;
5094
5095         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5096         if (rc)
5097                 return rc;
5098
5099         isec = shp->shm_perm.security;
5100
5101         ad.type = LSM_AUDIT_DATA_IPC;
5102         ad.u.ipc_id = shp->shm_perm.key;
5103
5104         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5105                           SHM__CREATE, &ad);
5106         if (rc) {
5107                 ipc_free_security(&shp->shm_perm);
5108                 return rc;
5109         }
5110         return 0;
5111 }
5112
5113 static void selinux_shm_free_security(struct shmid_kernel *shp)
5114 {
5115         ipc_free_security(&shp->shm_perm);
5116 }
5117
5118 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5119 {
5120         struct ipc_security_struct *isec;
5121         struct common_audit_data ad;
5122         u32 sid = current_sid();
5123
5124         isec = shp->shm_perm.security;
5125
5126         ad.type = LSM_AUDIT_DATA_IPC;
5127         ad.u.ipc_id = shp->shm_perm.key;
5128
5129         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5130                             SHM__ASSOCIATE, &ad);
5131 }
5132
5133 /* Note, at this point, shp is locked down */
5134 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5135 {
5136         int perms;
5137         int err;
5138
5139         switch (cmd) {
5140         case IPC_INFO:
5141         case SHM_INFO:
5142                 /* No specific object, just general system-wide information. */
5143                 return task_has_system(current, SYSTEM__IPC_INFO);
5144         case IPC_STAT:
5145         case SHM_STAT:
5146                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5147                 break;
5148         case IPC_SET:
5149                 perms = SHM__SETATTR;
5150                 break;
5151         case SHM_LOCK:
5152         case SHM_UNLOCK:
5153                 perms = SHM__LOCK;
5154                 break;
5155         case IPC_RMID:
5156                 perms = SHM__DESTROY;
5157                 break;
5158         default:
5159                 return 0;
5160         }
5161
5162         err = ipc_has_perm(&shp->shm_perm, perms);
5163         return err;
5164 }
5165
5166 static int selinux_shm_shmat(struct shmid_kernel *shp,
5167                              char __user *shmaddr, int shmflg)
5168 {
5169         u32 perms;
5170
5171         if (shmflg & SHM_RDONLY)
5172                 perms = SHM__READ;
5173         else
5174                 perms = SHM__READ | SHM__WRITE;
5175
5176         return ipc_has_perm(&shp->shm_perm, perms);
5177 }
5178
5179 /* Semaphore security operations */
5180 static int selinux_sem_alloc_security(struct sem_array *sma)
5181 {
5182         struct ipc_security_struct *isec;
5183         struct common_audit_data ad;
5184         u32 sid = current_sid();
5185         int rc;
5186
5187         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5188         if (rc)
5189                 return rc;
5190
5191         isec = sma->sem_perm.security;
5192
5193         ad.type = LSM_AUDIT_DATA_IPC;
5194         ad.u.ipc_id = sma->sem_perm.key;
5195
5196         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5197                           SEM__CREATE, &ad);
5198         if (rc) {
5199                 ipc_free_security(&sma->sem_perm);
5200                 return rc;
5201         }
5202         return 0;
5203 }
5204
5205 static void selinux_sem_free_security(struct sem_array *sma)
5206 {
5207         ipc_free_security(&sma->sem_perm);
5208 }
5209
5210 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5211 {
5212         struct ipc_security_struct *isec;
5213         struct common_audit_data ad;
5214         u32 sid = current_sid();
5215
5216         isec = sma->sem_perm.security;
5217
5218         ad.type = LSM_AUDIT_DATA_IPC;
5219         ad.u.ipc_id = sma->sem_perm.key;
5220
5221         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5222                             SEM__ASSOCIATE, &ad);
5223 }
5224
5225 /* Note, at this point, sma is locked down */
5226 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5227 {
5228         int err;
5229         u32 perms;
5230
5231         switch (cmd) {
5232         case IPC_INFO:
5233         case SEM_INFO:
5234                 /* No specific object, just general system-wide information. */
5235                 return task_has_system(current, SYSTEM__IPC_INFO);
5236         case GETPID:
5237         case GETNCNT:
5238         case GETZCNT:
5239                 perms = SEM__GETATTR;
5240                 break;
5241         case GETVAL:
5242         case GETALL:
5243                 perms = SEM__READ;
5244                 break;
5245         case SETVAL:
5246         case SETALL:
5247                 perms = SEM__WRITE;
5248                 break;
5249         case IPC_RMID:
5250                 perms = SEM__DESTROY;
5251                 break;
5252         case IPC_SET:
5253                 perms = SEM__SETATTR;
5254                 break;
5255         case IPC_STAT:
5256         case SEM_STAT:
5257                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5258                 break;
5259         default:
5260                 return 0;
5261         }
5262
5263         err = ipc_has_perm(&sma->sem_perm, perms);
5264         return err;
5265 }
5266
5267 static int selinux_sem_semop(struct sem_array *sma,
5268                              struct sembuf *sops, unsigned nsops, int alter)
5269 {
5270         u32 perms;
5271
5272         if (alter)
5273                 perms = SEM__READ | SEM__WRITE;
5274         else
5275                 perms = SEM__READ;
5276
5277         return ipc_has_perm(&sma->sem_perm, perms);
5278 }
5279
5280 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5281 {
5282         u32 av = 0;
5283
5284         av = 0;
5285         if (flag & S_IRUGO)
5286                 av |= IPC__UNIX_READ;
5287         if (flag & S_IWUGO)
5288                 av |= IPC__UNIX_WRITE;
5289
5290         if (av == 0)
5291                 return 0;
5292
5293         return ipc_has_perm(ipcp, av);
5294 }
5295
5296 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5297 {
5298         struct ipc_security_struct *isec = ipcp->security;
5299         *secid = isec->sid;
5300 }
5301
5302 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5303 {
5304         if (inode)
5305                 inode_doinit_with_dentry(inode, dentry);
5306 }
5307
5308 static int selinux_getprocattr(struct task_struct *p,
5309                                char *name, char **value)
5310 {
5311         const struct task_security_struct *__tsec;
5312         u32 sid;
5313         int error;
5314         unsigned len;
5315
5316         if (current != p) {
5317                 error = current_has_perm(p, PROCESS__GETATTR);
5318                 if (error)
5319                         return error;
5320         }
5321
5322         rcu_read_lock();
5323         __tsec = __task_cred(p)->security;
5324
5325         if (!strcmp(name, "current"))
5326                 sid = __tsec->sid;
5327         else if (!strcmp(name, "prev"))
5328                 sid = __tsec->osid;
5329         else if (!strcmp(name, "exec"))
5330                 sid = __tsec->exec_sid;
5331         else if (!strcmp(name, "fscreate"))
5332                 sid = __tsec->create_sid;
5333         else if (!strcmp(name, "keycreate"))
5334                 sid = __tsec->keycreate_sid;
5335         else if (!strcmp(name, "sockcreate"))
5336                 sid = __tsec->sockcreate_sid;
5337         else
5338                 goto invalid;
5339         rcu_read_unlock();
5340
5341         if (!sid)
5342                 return 0;
5343
5344         error = security_sid_to_context(sid, value, &len);
5345         if (error)
5346                 return error;
5347         return len;
5348
5349 invalid:
5350         rcu_read_unlock();
5351         return -EINVAL;
5352 }
5353
5354 static int selinux_setprocattr(struct task_struct *p,
5355                                char *name, void *value, size_t size)
5356 {
5357         struct task_security_struct *tsec;
5358         struct task_struct *tracer;
5359         struct cred *new;
5360         u32 sid = 0, ptsid;
5361         int error;
5362         char *str = value;
5363
5364         if (current != p) {
5365                 /* SELinux only allows a process to change its own
5366                    security attributes. */
5367                 return -EACCES;
5368         }
5369
5370         /*
5371          * Basic control over ability to set these attributes at all.
5372          * current == p, but we'll pass them separately in case the
5373          * above restriction is ever removed.
5374          */
5375         if (!strcmp(name, "exec"))
5376                 error = current_has_perm(p, PROCESS__SETEXEC);
5377         else if (!strcmp(name, "fscreate"))
5378                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5379         else if (!strcmp(name, "keycreate"))
5380                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5381         else if (!strcmp(name, "sockcreate"))
5382                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5383         else if (!strcmp(name, "current"))
5384                 error = current_has_perm(p, PROCESS__SETCURRENT);
5385         else
5386                 error = -EINVAL;
5387         if (error)
5388                 return error;
5389
5390         /* Obtain a SID for the context, if one was specified. */
5391         if (size && str[1] && str[1] != '\n') {
5392                 if (str[size-1] == '\n') {
5393                         str[size-1] = 0;
5394                         size--;
5395                 }
5396                 error = security_context_to_sid(value, size, &sid);
5397                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5398                         if (!capable(CAP_MAC_ADMIN)) {
5399                                 struct audit_buffer *ab;
5400                                 size_t audit_size;
5401
5402                                 /* We strip a nul only if it is at the end, otherwise the
5403                                  * context contains a nul and we should audit that */
5404                                 if (str[size - 1] == '\0')
5405                                         audit_size = size - 1;
5406                                 else
5407                                         audit_size = size;
5408                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5409                                 audit_log_format(ab, "op=fscreate invalid_context=");
5410                                 audit_log_n_untrustedstring(ab, value, audit_size);
5411                                 audit_log_end(ab);
5412
5413                                 return error;
5414                         }
5415                         error = security_context_to_sid_force(value, size,
5416                                                               &sid);
5417                 }
5418                 if (error)
5419                         return error;
5420         }
5421
5422         new = prepare_creds();
5423         if (!new)
5424                 return -ENOMEM;
5425
5426         /* Permission checking based on the specified context is
5427            performed during the actual operation (execve,
5428            open/mkdir/...), when we know the full context of the
5429            operation.  See selinux_bprm_set_creds for the execve
5430            checks and may_create for the file creation checks. The
5431            operation will then fail if the context is not permitted. */
5432         tsec = new->security;
5433         if (!strcmp(name, "exec")) {
5434                 tsec->exec_sid = sid;
5435         } else if (!strcmp(name, "fscreate")) {
5436                 tsec->create_sid = sid;
5437         } else if (!strcmp(name, "keycreate")) {
5438                 error = may_create_key(sid, p);
5439                 if (error)
5440                         goto abort_change;
5441                 tsec->keycreate_sid = sid;
5442         } else if (!strcmp(name, "sockcreate")) {
5443                 tsec->sockcreate_sid = sid;
5444         } else if (!strcmp(name, "current")) {
5445                 error = -EINVAL;
5446                 if (sid == 0)
5447                         goto abort_change;
5448
5449                 /* Only allow single threaded processes to change context */
5450                 error = -EPERM;
5451                 if (!current_is_single_threaded()) {
5452                         error = security_bounded_transition(tsec->sid, sid);
5453                         if (error)
5454                                 goto abort_change;
5455                 }
5456
5457                 /* Check permissions for the transition. */
5458                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5459                                      PROCESS__DYNTRANSITION, NULL);
5460                 if (error)
5461                         goto abort_change;
5462
5463                 /* Check for ptracing, and update the task SID if ok.
5464                    Otherwise, leave SID unchanged and fail. */
5465                 ptsid = 0;
5466                 task_lock(p);
5467                 tracer = ptrace_parent(p);
5468                 if (tracer)
5469                         ptsid = task_sid(tracer);
5470                 task_unlock(p);
5471
5472                 if (tracer) {
5473                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5474                                              PROCESS__PTRACE, NULL);
5475                         if (error)
5476                                 goto abort_change;
5477                 }
5478
5479                 tsec->sid = sid;
5480         } else {
5481                 error = -EINVAL;
5482                 goto abort_change;
5483         }
5484
5485         commit_creds(new);
5486         return size;
5487
5488 abort_change:
5489         abort_creds(new);
5490         return error;
5491 }
5492
5493 static int selinux_ismaclabel(const char *name)
5494 {
5495         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5496 }
5497
5498 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5499 {
5500         return security_sid_to_context(secid, secdata, seclen);
5501 }
5502
5503 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5504 {
5505         return security_context_to_sid(secdata, seclen, secid);
5506 }
5507
5508 static void selinux_release_secctx(char *secdata, u32 seclen)
5509 {
5510         kfree(secdata);
5511 }
5512
5513 /*
5514  *      called with inode->i_mutex locked
5515  */
5516 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5517 {
5518         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5519 }
5520
5521 /*
5522  *      called with inode->i_mutex locked
5523  */
5524 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5525 {
5526         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5527 }
5528
5529 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5530 {
5531         int len = 0;
5532         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5533                                                 ctx, true);
5534         if (len < 0)
5535                 return len;
5536         *ctxlen = len;
5537         return 0;
5538 }
5539 #ifdef CONFIG_KEYS
5540
5541 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5542                              unsigned long flags)
5543 {
5544         const struct task_security_struct *tsec;
5545         struct key_security_struct *ksec;
5546
5547         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5548         if (!ksec)
5549                 return -ENOMEM;
5550
5551         tsec = cred->security;
5552         if (tsec->keycreate_sid)
5553                 ksec->sid = tsec->keycreate_sid;
5554         else
5555                 ksec->sid = tsec->sid;
5556
5557         k->security = ksec;
5558         return 0;
5559 }
5560
5561 static void selinux_key_free(struct key *k)
5562 {
5563         struct key_security_struct *ksec = k->security;
5564
5565         k->security = NULL;
5566         kfree(ksec);
5567 }
5568
5569 static int selinux_key_permission(key_ref_t key_ref,
5570                                   const struct cred *cred,
5571                                   key_perm_t perm)
5572 {
5573         struct key *key;
5574         struct key_security_struct *ksec;
5575         u32 sid;
5576
5577         /* if no specific permissions are requested, we skip the
5578            permission check. No serious, additional covert channels
5579            appear to be created. */
5580         if (perm == 0)
5581                 return 0;
5582
5583         sid = cred_sid(cred);
5584
5585         key = key_ref_to_ptr(key_ref);
5586         ksec = key->security;
5587
5588         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5589 }
5590
5591 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5592 {
5593         struct key_security_struct *ksec = key->security;
5594         char *context = NULL;
5595         unsigned len;
5596         int rc;
5597
5598         rc = security_sid_to_context(ksec->sid, &context, &len);
5599         if (!rc)
5600                 rc = len;
5601         *_buffer = context;
5602         return rc;
5603 }
5604
5605 #endif
5606
5607 static struct security_operations selinux_ops = {
5608         .name =                         "selinux",
5609
5610         .ptrace_access_check =          selinux_ptrace_access_check,
5611         .ptrace_traceme =               selinux_ptrace_traceme,
5612         .capget =                       selinux_capget,
5613         .capset =                       selinux_capset,
5614         .capable =                      selinux_capable,
5615         .quotactl =                     selinux_quotactl,
5616         .quota_on =                     selinux_quota_on,
5617         .syslog =                       selinux_syslog,
5618         .vm_enough_memory =             selinux_vm_enough_memory,
5619
5620         .netlink_send =                 selinux_netlink_send,
5621
5622         .bprm_set_creds =               selinux_bprm_set_creds,
5623         .bprm_committing_creds =        selinux_bprm_committing_creds,
5624         .bprm_committed_creds =         selinux_bprm_committed_creds,
5625         .bprm_secureexec =              selinux_bprm_secureexec,
5626
5627         .sb_alloc_security =            selinux_sb_alloc_security,
5628         .sb_free_security =             selinux_sb_free_security,
5629         .sb_copy_data =                 selinux_sb_copy_data,
5630         .sb_remount =                   selinux_sb_remount,
5631         .sb_kern_mount =                selinux_sb_kern_mount,
5632         .sb_show_options =              selinux_sb_show_options,
5633         .sb_statfs =                    selinux_sb_statfs,
5634         .sb_mount =                     selinux_mount,
5635         .sb_umount =                    selinux_umount,
5636         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5637         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5638         .sb_parse_opts_str =            selinux_parse_opts_str,
5639
5640         .dentry_init_security =         selinux_dentry_init_security,
5641
5642         .inode_alloc_security =         selinux_inode_alloc_security,
5643         .inode_free_security =          selinux_inode_free_security,
5644         .inode_init_security =          selinux_inode_init_security,
5645         .inode_create =                 selinux_inode_create,
5646         .inode_link =                   selinux_inode_link,
5647         .inode_unlink =                 selinux_inode_unlink,
5648         .inode_symlink =                selinux_inode_symlink,
5649         .inode_mkdir =                  selinux_inode_mkdir,
5650         .inode_rmdir =                  selinux_inode_rmdir,
5651         .inode_mknod =                  selinux_inode_mknod,
5652         .inode_rename =                 selinux_inode_rename,
5653         .inode_readlink =               selinux_inode_readlink,
5654         .inode_follow_link =            selinux_inode_follow_link,
5655         .inode_permission =             selinux_inode_permission,
5656         .inode_setattr =                selinux_inode_setattr,
5657         .inode_getattr =                selinux_inode_getattr,
5658         .inode_setxattr =               selinux_inode_setxattr,
5659         .inode_post_setxattr =          selinux_inode_post_setxattr,
5660         .inode_getxattr =               selinux_inode_getxattr,
5661         .inode_listxattr =              selinux_inode_listxattr,
5662         .inode_removexattr =            selinux_inode_removexattr,
5663         .inode_getsecurity =            selinux_inode_getsecurity,
5664         .inode_setsecurity =            selinux_inode_setsecurity,
5665         .inode_listsecurity =           selinux_inode_listsecurity,
5666         .inode_getsecid =               selinux_inode_getsecid,
5667
5668         .file_permission =              selinux_file_permission,
5669         .file_alloc_security =          selinux_file_alloc_security,
5670         .file_free_security =           selinux_file_free_security,
5671         .file_ioctl =                   selinux_file_ioctl,
5672         .mmap_file =                    selinux_mmap_file,
5673         .mmap_addr =                    selinux_mmap_addr,
5674         .file_mprotect =                selinux_file_mprotect,
5675         .file_lock =                    selinux_file_lock,
5676         .file_fcntl =                   selinux_file_fcntl,
5677         .file_set_fowner =              selinux_file_set_fowner,
5678         .file_send_sigiotask =          selinux_file_send_sigiotask,
5679         .file_receive =                 selinux_file_receive,
5680
5681         .file_open =                    selinux_file_open,
5682
5683         .task_create =                  selinux_task_create,
5684         .cred_alloc_blank =             selinux_cred_alloc_blank,
5685         .cred_free =                    selinux_cred_free,
5686         .cred_prepare =                 selinux_cred_prepare,
5687         .cred_transfer =                selinux_cred_transfer,
5688         .kernel_act_as =                selinux_kernel_act_as,
5689         .kernel_create_files_as =       selinux_kernel_create_files_as,
5690         .kernel_module_request =        selinux_kernel_module_request,
5691         .task_setpgid =                 selinux_task_setpgid,
5692         .task_getpgid =                 selinux_task_getpgid,
5693         .task_getsid =                  selinux_task_getsid,
5694         .task_getsecid =                selinux_task_getsecid,
5695         .task_setnice =                 selinux_task_setnice,
5696         .task_setioprio =               selinux_task_setioprio,
5697         .task_getioprio =               selinux_task_getioprio,
5698         .task_setrlimit =               selinux_task_setrlimit,
5699         .task_setscheduler =            selinux_task_setscheduler,
5700         .task_getscheduler =            selinux_task_getscheduler,
5701         .task_movememory =              selinux_task_movememory,
5702         .task_kill =                    selinux_task_kill,
5703         .task_wait =                    selinux_task_wait,
5704         .task_to_inode =                selinux_task_to_inode,
5705
5706         .ipc_permission =               selinux_ipc_permission,
5707         .ipc_getsecid =                 selinux_ipc_getsecid,
5708
5709         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5710         .msg_msg_free_security =        selinux_msg_msg_free_security,
5711
5712         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5713         .msg_queue_free_security =      selinux_msg_queue_free_security,
5714         .msg_queue_associate =          selinux_msg_queue_associate,
5715         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5716         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5717         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5718
5719         .shm_alloc_security =           selinux_shm_alloc_security,
5720         .shm_free_security =            selinux_shm_free_security,
5721         .shm_associate =                selinux_shm_associate,
5722         .shm_shmctl =                   selinux_shm_shmctl,
5723         .shm_shmat =                    selinux_shm_shmat,
5724
5725         .sem_alloc_security =           selinux_sem_alloc_security,
5726         .sem_free_security =            selinux_sem_free_security,
5727         .sem_associate =                selinux_sem_associate,
5728         .sem_semctl =                   selinux_sem_semctl,
5729         .sem_semop =                    selinux_sem_semop,
5730
5731         .d_instantiate =                selinux_d_instantiate,
5732
5733         .getprocattr =                  selinux_getprocattr,
5734         .setprocattr =                  selinux_setprocattr,
5735
5736         .ismaclabel =                   selinux_ismaclabel,
5737         .secid_to_secctx =              selinux_secid_to_secctx,
5738         .secctx_to_secid =              selinux_secctx_to_secid,
5739         .release_secctx =               selinux_release_secctx,
5740         .inode_notifysecctx =           selinux_inode_notifysecctx,
5741         .inode_setsecctx =              selinux_inode_setsecctx,
5742         .inode_getsecctx =              selinux_inode_getsecctx,
5743
5744         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5745         .unix_may_send =                selinux_socket_unix_may_send,
5746
5747         .socket_create =                selinux_socket_create,
5748         .socket_post_create =           selinux_socket_post_create,
5749         .socket_bind =                  selinux_socket_bind,
5750         .socket_connect =               selinux_socket_connect,
5751         .socket_listen =                selinux_socket_listen,
5752         .socket_accept =                selinux_socket_accept,
5753         .socket_sendmsg =               selinux_socket_sendmsg,
5754         .socket_recvmsg =               selinux_socket_recvmsg,
5755         .socket_getsockname =           selinux_socket_getsockname,
5756         .socket_getpeername =           selinux_socket_getpeername,
5757         .socket_getsockopt =            selinux_socket_getsockopt,
5758         .socket_setsockopt =            selinux_socket_setsockopt,
5759         .socket_shutdown =              selinux_socket_shutdown,
5760         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5761         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5762         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5763         .sk_alloc_security =            selinux_sk_alloc_security,
5764         .sk_free_security =             selinux_sk_free_security,
5765         .sk_clone_security =            selinux_sk_clone_security,
5766         .sk_getsecid =                  selinux_sk_getsecid,
5767         .sock_graft =                   selinux_sock_graft,
5768         .inet_conn_request =            selinux_inet_conn_request,
5769         .inet_csk_clone =               selinux_inet_csk_clone,
5770         .inet_conn_established =        selinux_inet_conn_established,
5771         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5772         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5773         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5774         .req_classify_flow =            selinux_req_classify_flow,
5775         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5776         .tun_dev_free_security =        selinux_tun_dev_free_security,
5777         .tun_dev_create =               selinux_tun_dev_create,
5778         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5779         .tun_dev_attach =               selinux_tun_dev_attach,
5780         .tun_dev_open =                 selinux_tun_dev_open,
5781         .skb_owned_by =                 selinux_skb_owned_by,
5782
5783 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5784         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5785         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5786         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5787         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5788         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5789         .xfrm_state_free_security =     selinux_xfrm_state_free,
5790         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5791         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5792         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5793         .xfrm_decode_session =          selinux_xfrm_decode_session,
5794 #endif
5795
5796 #ifdef CONFIG_KEYS
5797         .key_alloc =                    selinux_key_alloc,
5798         .key_free =                     selinux_key_free,
5799         .key_permission =               selinux_key_permission,
5800         .key_getsecurity =              selinux_key_getsecurity,
5801 #endif
5802
5803 #ifdef CONFIG_AUDIT
5804         .audit_rule_init =              selinux_audit_rule_init,
5805         .audit_rule_known =             selinux_audit_rule_known,
5806         .audit_rule_match =             selinux_audit_rule_match,
5807         .audit_rule_free =              selinux_audit_rule_free,
5808 #endif
5809 };
5810
5811 static __init int selinux_init(void)
5812 {
5813         if (!security_module_enable(&selinux_ops)) {
5814                 selinux_enabled = 0;
5815                 return 0;
5816         }
5817
5818         if (!selinux_enabled) {
5819                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5820                 return 0;
5821         }
5822
5823         printk(KERN_INFO "SELinux:  Initializing.\n");
5824
5825         /* Set the security state for the initial task. */
5826         cred_init_security();
5827
5828         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5829
5830         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5831                                             sizeof(struct inode_security_struct),
5832                                             0, SLAB_PANIC, NULL);
5833         avc_init();
5834
5835         if (register_security(&selinux_ops))
5836                 panic("SELinux: Unable to register with kernel.\n");
5837
5838         if (selinux_enforcing)
5839                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5840         else
5841                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5842
5843         return 0;
5844 }
5845
5846 static void delayed_superblock_init(struct super_block *sb, void *unused)
5847 {
5848         superblock_doinit(sb, NULL);
5849 }
5850
5851 void selinux_complete_init(void)
5852 {
5853         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5854
5855         /* Set up any superblocks initialized prior to the policy load. */
5856         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5857         iterate_supers(delayed_superblock_init, NULL);
5858 }
5859
5860 /* SELinux requires early initialization in order to label
5861    all processes and objects when they are created. */
5862 security_initcall(selinux_init);
5863
5864 #if defined(CONFIG_NETFILTER)
5865
5866 static struct nf_hook_ops selinux_ipv4_ops[] = {
5867         {
5868                 .hook =         selinux_ipv4_postroute,
5869                 .owner =        THIS_MODULE,
5870                 .pf =           NFPROTO_IPV4,
5871                 .hooknum =      NF_INET_POST_ROUTING,
5872                 .priority =     NF_IP_PRI_SELINUX_LAST,
5873         },
5874         {
5875                 .hook =         selinux_ipv4_forward,
5876                 .owner =        THIS_MODULE,
5877                 .pf =           NFPROTO_IPV4,
5878                 .hooknum =      NF_INET_FORWARD,
5879                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5880         },
5881         {
5882                 .hook =         selinux_ipv4_output,
5883                 .owner =        THIS_MODULE,
5884                 .pf =           NFPROTO_IPV4,
5885                 .hooknum =      NF_INET_LOCAL_OUT,
5886                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5887         }
5888 };
5889
5890 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5891
5892 static struct nf_hook_ops selinux_ipv6_ops[] = {
5893         {
5894                 .hook =         selinux_ipv6_postroute,
5895                 .owner =        THIS_MODULE,
5896                 .pf =           NFPROTO_IPV6,
5897                 .hooknum =      NF_INET_POST_ROUTING,
5898                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5899         },
5900         {
5901                 .hook =         selinux_ipv6_forward,
5902                 .owner =        THIS_MODULE,
5903                 .pf =           NFPROTO_IPV6,
5904                 .hooknum =      NF_INET_FORWARD,
5905                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5906         }
5907 };
5908
5909 #endif  /* IPV6 */
5910
5911 static int __init selinux_nf_ip_init(void)
5912 {
5913         int err = 0;
5914
5915         if (!selinux_enabled)
5916                 goto out;
5917
5918         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5919
5920         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5921         if (err)
5922                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5923
5924 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5925         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5926         if (err)
5927                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5928 #endif  /* IPV6 */
5929
5930 out:
5931         return err;
5932 }
5933
5934 __initcall(selinux_nf_ip_init);
5935
5936 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5937 static void selinux_nf_ip_exit(void)
5938 {
5939         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5940
5941         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5942 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5943         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5944 #endif  /* IPV6 */
5945 }
5946 #endif
5947
5948 #else /* CONFIG_NETFILTER */
5949
5950 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5951 #define selinux_nf_ip_exit()
5952 #endif
5953
5954 #endif /* CONFIG_NETFILTER */
5955
5956 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5957 static int selinux_disabled;
5958
5959 int selinux_disable(void)
5960 {
5961         if (ss_initialized) {
5962                 /* Not permitted after initial policy load. */
5963                 return -EINVAL;
5964         }
5965
5966         if (selinux_disabled) {
5967                 /* Only do this once. */
5968                 return -EINVAL;
5969         }
5970
5971         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5972
5973         selinux_disabled = 1;
5974         selinux_enabled = 0;
5975
5976         reset_security_ops();
5977
5978         /* Try to destroy the avc node cache */
5979         avc_disable();
5980
5981         /* Unregister netfilter hooks. */
5982         selinux_nf_ip_exit();
5983
5984         /* Unregister selinuxfs. */
5985         exit_sel_fs();
5986
5987         return 0;
5988 }
5989 #endif