security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 /* Special handling. Genfs but also in-core setxattr handler */
 407                 !strcmp(sb->s_type->name, "sysfs") ||
 408                 !strcmp(sb->s_type->name, "pstore") ||
 409                 !strcmp(sb->s_type->name, "debugfs") ||
 410                 !strcmp(sb->s_type->name, "rootfs");
 411 }
 412
 413 static int sb_finish_set_opts(struct super_block *sb)
 414 {
 415         struct superblock_security_struct *sbsec = sb->s_security;
 416         struct dentry *root = sb->s_root;
 417         struct inode *root_inode = d_backing_inode(root);
 418         int rc = 0;
 419
 420         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 421                 /* Make sure that the xattr handler exists and that no
 422                    error other than -ENODATA is returned by getxattr on
 423                    the root directory.  -ENODATA is ok, as this may be
 424                    the first boot of the SELinux kernel before we have
 425                    assigned xattr values to the filesystem. */
 426                 if (!root_inode->i_op->getxattr) {
 427                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 428                                "xattr support\n", sb->s_id, sb->s_type->name);
 429                         rc = -EOPNOTSUPP;
 430                         goto out;
 431                 }
 432                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 433                 if (rc < 0 && rc != -ENODATA) {
 434                         if (rc == -EOPNOTSUPP)
 435                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 436                                        "%s) has no security xattr handler\n",
 437                                        sb->s_id, sb->s_type->name);
 438                         else
 439                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 440                                        "%s) getxattr errno %d\n", sb->s_id,
 441                                        sb->s_type->name, -rc);
 442                         goto out;
 443                 }
 444         }
 445
 446         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 447                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 448                        sb->s_id, sb->s_type->name);
 449
 450         sbsec->flags |= SE_SBINITIALIZED;
 451         if (selinux_is_sblabel_mnt(sb))
 452                 sbsec->flags |= SBLABEL_MNT;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 list_del_init(&isec->list);
 469                 spin_unlock(&sbsec->isec_lock);
 470                 inode = igrab(inode);
 471                 if (inode) {
 472                         if (!IS_PRIVATE(inode))
 473                                 inode_doinit(inode);
 474                         iput(inode);
 475                 }
 476                 spin_lock(&sbsec->isec_lock);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         /* make sure we always check enough bits to cover the mask */
 507         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 508
 509         tmp = sbsec->flags & SE_MNTMASK;
 510         /* count the number of mount options for this sb */
 511         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 512                 if (tmp & 0x01)
 513                         opts->num_mnt_opts++;
 514                 tmp >>= 1;
 515         }
 516         /* Check if the Label support flag is set */
 517         if (sbsec->flags & SBLABEL_MNT)
 518                 opts->num_mnt_opts++;
 519
 520         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 521         if (!opts->mnt_opts) {
 522                 rc = -ENOMEM;
 523                 goto out_free;
 524         }
 525
 526         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 527         if (!opts->mnt_opts_flags) {
 528                 rc = -ENOMEM;
 529                 goto out_free;
 530         }
 531
 532         i = 0;
 533         if (sbsec->flags & FSCONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 539         }
 540         if (sbsec->flags & CONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 546         }
 547         if (sbsec->flags & DEFCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & ROOTCONTEXT_MNT) {
 555                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 556                 struct inode_security_struct *isec = root->i_security;
 557
 558                 rc = security_sid_to_context(isec->sid, &context, &len);
 559                 if (rc)
 560                         goto out_free;
 561                 opts->mnt_opts[i] = context;
 562                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 563         }
 564         if (sbsec->flags & SBLABEL_MNT) {
 565                 opts->mnt_opts[i] = NULL;
 566                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 567         }
 568
 569         BUG_ON(i != opts->num_mnt_opts);
 570
 571         return 0;
 572
 573 out_free:
 574         security_free_mnt_opts(opts);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 struct security_mnt_opts *opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         int rc = 0, i;
 609         struct superblock_security_struct *sbsec = sb->s_security;
 610         const char *name = sb->s_type->name;
 611         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 612         struct inode_security_struct *root_isec = inode->i_security;
 613         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 614         u32 defcontext_sid = 0;
 615         char **mount_options = opts->mnt_opts;
 616         int *flags = opts->mnt_opts_flags;
 617         int num_opts = opts->num_mnt_opts;
 618
 619         mutex_lock(&sbsec->lock);
 620
 621         if (!ss_initialized) {
 622                 if (!num_opts) {
 623                         /* Defer initialization until selinux_complete_init,
 624                            after the initial policy is loaded and the security
 625                            server is ready to handle calls. */
 626                         goto out;
 627                 }
 628                 rc = -EINVAL;
 629                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 630                         "before the security server is initialized\n");
 631                 goto out;
 632         }
 633         if (kern_flags && !set_kern_flags) {
 634                 /* Specifying internal flags without providing a place to
 635                  * place the results is not allowed */
 636                 rc = -EINVAL;
 637                 goto out;
 638         }
 639
 640         /*
 641          * Binary mount data FS will come through this function twice.  Once
 642          * from an explicit call and once from the generic calls from the vfs.
 643          * Since the generic VFS calls will not contain any security mount data
 644          * we need to skip the double mount verification.
 645          *
 646          * This does open a hole in which we will not notice if the first
 647          * mount using this sb set explict options and a second mount using
 648          * this sb does not set any security options.  (The first options
 649          * will be used for both mounts)
 650          */
 651         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 652             && (num_opts == 0))
 653                 goto out;
 654
 655         /*
 656          * parse the mount options, check if they are valid sids.
 657          * also check if someone is trying to mount the same sb more
 658          * than once with different security options.
 659          */
 660         for (i = 0; i < num_opts; i++) {
 661                 u32 sid;
 662
 663                 if (flags[i] == SBLABEL_MNT)
 664                         continue;
 665                 rc = security_context_to_sid(mount_options[i],
 666                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 667                 if (rc) {
 668                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 669                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 670                                mount_options[i], sb->s_id, name, rc);
 671                         goto out;
 672                 }
 673                 switch (flags[i]) {
 674                 case FSCONTEXT_MNT:
 675                         fscontext_sid = sid;
 676
 677                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 678                                         fscontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= FSCONTEXT_MNT;
 682                         break;
 683                 case CONTEXT_MNT:
 684                         context_sid = sid;
 685
 686                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 687                                         context_sid))
 688                                 goto out_double_mount;
 689
 690                         sbsec->flags |= CONTEXT_MNT;
 691                         break;
 692                 case ROOTCONTEXT_MNT:
 693                         rootcontext_sid = sid;
 694
 695                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 696                                         rootcontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= ROOTCONTEXT_MNT;
 700
 701                         break;
 702                 case DEFCONTEXT_MNT:
 703                         defcontext_sid = sid;
 704
 705                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 706                                         defcontext_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= DEFCONTEXT_MNT;
 710
 711                         break;
 712                 default:
 713                         rc = -EINVAL;
 714                         goto out;
 715                 }
 716         }
 717
 718         if (sbsec->flags & SE_SBINITIALIZED) {
 719                 /* previously mounted with options, but not on this attempt? */
 720                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 721                         goto out_double_mount;
 722                 rc = 0;
 723                 goto out;
 724         }
 725
 726         if (strcmp(sb->s_type->name, "proc") == 0)
 727                 sbsec->flags |= SE_SBPROC;
 728
 729         if (!sbsec->behavior) {
 730                 /*
 731                  * Determine the labeling behavior to use for this
 732                  * filesystem type.
 733                  */
 734                 rc = security_fs_use(sb);
 735                 if (rc) {
 736                         printk(KERN_WARNING
 737                                 "%s: security_fs_use(%s) returned %d\n",
 738                                         __func__, sb->s_type->name, rc);
 739                         goto out;
 740                 }
 741         }
 742         /* sets the context of the superblock for the fs being mounted. */
 743         if (fscontext_sid) {
 744                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 745                 if (rc)
 746                         goto out;
 747
 748                 sbsec->sid = fscontext_sid;
 749         }
 750
 751         /*
 752          * Switch to using mount point labeling behavior.
 753          * sets the label used on all file below the mountpoint, and will set
 754          * the superblock context if not already set.
 755          */
 756         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 757                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 758                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 759         }
 760
 761         if (context_sid) {
 762                 if (!fscontext_sid) {
 763                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 764                                                           cred);
 765                         if (rc)
 766                                 goto out;
 767                         sbsec->sid = context_sid;
 768                 } else {
 769                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 770                                                              cred);
 771                         if (rc)
 772                                 goto out;
 773                 }
 774                 if (!rootcontext_sid)
 775                         rootcontext_sid = context_sid;
 776
 777                 sbsec->mntpoint_sid = context_sid;
 778                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 779         }
 780
 781         if (rootcontext_sid) {
 782                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 783                                                      cred);
 784                 if (rc)
 785                         goto out;
 786
 787                 root_isec->sid = rootcontext_sid;
 788                 root_isec->initialized = 1;
 789         }
 790
 791         if (defcontext_sid) {
 792                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 793                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 794                         rc = -EINVAL;
 795                         printk(KERN_WARNING "SELinux: defcontext option is "
 796                                "invalid for this filesystem type\n");
 797                         goto out;
 798                 }
 799
 800                 if (defcontext_sid != sbsec->def_sid) {
 801                         rc = may_context_mount_inode_relabel(defcontext_sid,
 802                                                              sbsec, cred);
 803                         if (rc)
 804                                 goto out;
 805                 }
 806
 807                 sbsec->def_sid = defcontext_sid;
 808         }
 809
 810         rc = sb_finish_set_opts(sb);
 811 out:
 812         mutex_unlock(&sbsec->lock);
 813         return rc;
 814 out_double_mount:
 815         rc = -EINVAL;
 816         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 817                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 818         goto out;
 819 }
 820
 821 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 822                                     const struct super_block *newsb)
 823 {
 824         struct superblock_security_struct *old = oldsb->s_security;
 825         struct superblock_security_struct *new = newsb->s_security;
 826         char oldflags = old->flags & SE_MNTMASK;
 827         char newflags = new->flags & SE_MNTMASK;
 828
 829         if (oldflags != newflags)
 830                 goto mismatch;
 831         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 832                 goto mismatch;
 833         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 834                 goto mismatch;
 835         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 836                 goto mismatch;
 837         if (oldflags & ROOTCONTEXT_MNT) {
 838                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 839                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 840                 if (oldroot->sid != newroot->sid)
 841                         goto mismatch;
 842         }
 843         return 0;
 844 mismatch:
 845         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 846                             "different security settings for (dev %s, "
 847                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 848         return -EBUSY;
 849 }
 850
 851 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 852                                         struct super_block *newsb)
 853 {
 854         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 855         struct superblock_security_struct *newsbsec = newsb->s_security;
 856
 857         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 858         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 859         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 860
 861         /*
 862          * if the parent was able to be mounted it clearly had no special lsm
 863          * mount options.  thus we can safely deal with this superblock later
 864          */
 865         if (!ss_initialized)
 866                 return 0;
 867
 868         /* how can we clone if the old one wasn't set up?? */
 869         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 870
 871         /* if fs is reusing a sb, make sure that the contexts match */
 872         if (newsbsec->flags & SE_SBINITIALIZED)
 873                 return selinux_cmp_sb_context(oldsb, newsb);
 874
 875         mutex_lock(&newsbsec->lock);
 876
 877         newsbsec->flags = oldsbsec->flags;
 878
 879         newsbsec->sid = oldsbsec->sid;
 880         newsbsec->def_sid = oldsbsec->def_sid;
 881         newsbsec->behavior = oldsbsec->behavior;
 882
 883         if (set_context) {
 884                 u32 sid = oldsbsec->mntpoint_sid;
 885
 886                 if (!set_fscontext)
 887                         newsbsec->sid = sid;
 888                 if (!set_rootcontext) {
 889                         struct inode *newinode = d_backing_inode(newsb->s_root);
 890                         struct inode_security_struct *newisec = newinode->i_security;
 891                         newisec->sid = sid;
 892                 }
 893                 newsbsec->mntpoint_sid = sid;
 894         }
 895         if (set_rootcontext) {
 896                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 897                 const struct inode_security_struct *oldisec = oldinode->i_security;
 898                 struct inode *newinode = d_backing_inode(newsb->s_root);
 899                 struct inode_security_struct *newisec = newinode->i_security;
 900
 901                 newisec->sid = oldisec->sid;
 902         }
 903
 904         sb_finish_set_opts(newsb);
 905         mutex_unlock(&newsbsec->lock);
 906         return 0;
 907 }
 908
 909 static int selinux_parse_opts_str(char *options,
 910                                   struct security_mnt_opts *opts)
 911 {
 912         char *p;
 913         char *context = NULL, *defcontext = NULL;
 914         char *fscontext = NULL, *rootcontext = NULL;
 915         int rc, num_mnt_opts = 0;
 916
 917         opts->num_mnt_opts = 0;
 918
 919         /* Standard string-based options. */
 920         while ((p = strsep(&options, "|")) != NULL) {
 921                 int token;
 922                 substring_t args[MAX_OPT_ARGS];
 923
 924                 if (!*p)
 925                         continue;
 926
 927                 token = match_token(p, tokens, args);
 928
 929                 switch (token) {
 930                 case Opt_context:
 931                         if (context || defcontext) {
 932                                 rc = -EINVAL;
 933                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 934                                 goto out_err;
 935                         }
 936                         context = match_strdup(&args[0]);
 937                         if (!context) {
 938                                 rc = -ENOMEM;
 939                                 goto out_err;
 940                         }
 941                         break;
 942
 943                 case Opt_fscontext:
 944                         if (fscontext) {
 945                                 rc = -EINVAL;
 946                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 947                                 goto out_err;
 948                         }
 949                         fscontext = match_strdup(&args[0]);
 950                         if (!fscontext) {
 951                                 rc = -ENOMEM;
 952                                 goto out_err;
 953                         }
 954                         break;
 955
 956                 case Opt_rootcontext:
 957                         if (rootcontext) {
 958                                 rc = -EINVAL;
 959                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 960                                 goto out_err;
 961                         }
 962                         rootcontext = match_strdup(&args[0]);
 963                         if (!rootcontext) {
 964                                 rc = -ENOMEM;
 965                                 goto out_err;
 966                         }
 967                         break;
 968
 969                 case Opt_defcontext:
 970                         if (context || defcontext) {
 971                                 rc = -EINVAL;
 972                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 973                                 goto out_err;
 974                         }
 975                         defcontext = match_strdup(&args[0]);
 976                         if (!defcontext) {
 977                                 rc = -ENOMEM;
 978                                 goto out_err;
 979                         }
 980                         break;
 981                 case Opt_labelsupport:
 982                         break;
 983                 default:
 984                         rc = -EINVAL;
 985                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 986                         goto out_err;
 987
 988                 }
 989         }
 990
 991         rc = -ENOMEM;
 992         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 993         if (!opts->mnt_opts)
 994                 goto out_err;
 995
 996         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 997         if (!opts->mnt_opts_flags) {
 998                 kfree(opts->mnt_opts);
 999                 goto out_err;
1000         }
1001
1002         if (fscontext) {
1003                 opts->mnt_opts[num_mnt_opts] = fscontext;
1004                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1005         }
1006         if (context) {
1007                 opts->mnt_opts[num_mnt_opts] = context;
1008                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1009         }
1010         if (rootcontext) {
1011                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1012                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1013         }
1014         if (defcontext) {
1015                 opts->mnt_opts[num_mnt_opts] = defcontext;
1016                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1017         }
1018
1019         opts->num_mnt_opts = num_mnt_opts;
1020         return 0;
1021
1022 out_err:
1023         kfree(context);
1024         kfree(defcontext);
1025         kfree(fscontext);
1026         kfree(rootcontext);
1027         return rc;
1028 }
1029 /*
1030  * string mount options parsing and call set the sbsec
1031  */
1032 static int superblock_doinit(struct super_block *sb, void *data)
1033 {
1034         int rc = 0;
1035         char *options = data;
1036         struct security_mnt_opts opts;
1037
1038         security_init_mnt_opts(&opts);
1039
1040         if (!data)
1041                 goto out;
1042
1043         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1044
1045         rc = selinux_parse_opts_str(options, &opts);
1046         if (rc)
1047                 goto out_err;
1048
1049 out:
1050         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1051
1052 out_err:
1053         security_free_mnt_opts(&opts);
1054         return rc;
1055 }
1056
1057 static void selinux_write_opts(struct seq_file *m,
1058                                struct security_mnt_opts *opts)
1059 {
1060         int i;
1061         char *prefix;
1062
1063         for (i = 0; i < opts->num_mnt_opts; i++) {
1064                 char *has_comma;
1065
1066                 if (opts->mnt_opts[i])
1067                         has_comma = strchr(opts->mnt_opts[i], ',');
1068                 else
1069                         has_comma = NULL;
1070
1071                 switch (opts->mnt_opts_flags[i]) {
1072                 case CONTEXT_MNT:
1073                         prefix = CONTEXT_STR;
1074                         break;
1075                 case FSCONTEXT_MNT:
1076                         prefix = FSCONTEXT_STR;
1077                         break;
1078                 case ROOTCONTEXT_MNT:
1079                         prefix = ROOTCONTEXT_STR;
1080                         break;
1081                 case DEFCONTEXT_MNT:
1082                         prefix = DEFCONTEXT_STR;
1083                         break;
1084                 case SBLABEL_MNT:
1085                         seq_putc(m, ',');
1086                         seq_puts(m, LABELSUPP_STR);
1087                         continue;
1088                 default:
1089                         BUG();
1090                         return;
1091                 };
1092                 /* we need a comma before each option */
1093                 seq_putc(m, ',');
1094                 seq_puts(m, prefix);
1095                 if (has_comma)
1096                         seq_putc(m, '\"');
1097                 seq_puts(m, opts->mnt_opts[i]);
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100         }
1101 }
1102
1103 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1104 {
1105         struct security_mnt_opts opts;
1106         int rc;
1107
1108         rc = selinux_get_mnt_opts(sb, &opts);
1109         if (rc) {
1110                 /* before policy load we may get EINVAL, don't show anything */
1111                 if (rc == -EINVAL)
1112                         rc = 0;
1113                 return rc;
1114         }
1115
1116         selinux_write_opts(m, &opts);
1117
1118         security_free_mnt_opts(&opts);
1119
1120         return rc;
1121 }
1122
1123 static inline u16 inode_mode_to_security_class(umode_t mode)
1124 {
1125         switch (mode & S_IFMT) {
1126         case S_IFSOCK:
1127                 return SECCLASS_SOCK_FILE;
1128         case S_IFLNK:
1129                 return SECCLASS_LNK_FILE;
1130         case S_IFREG:
1131                 return SECCLASS_FILE;
1132         case S_IFBLK:
1133                 return SECCLASS_BLK_FILE;
1134         case S_IFDIR:
1135                 return SECCLASS_DIR;
1136         case S_IFCHR:
1137                 return SECCLASS_CHR_FILE;
1138         case S_IFIFO:
1139                 return SECCLASS_FIFO_FILE;
1140
1141         }
1142
1143         return SECCLASS_FILE;
1144 }
1145
1146 static inline int default_protocol_stream(int protocol)
1147 {
1148         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1149 }
1150
1151 static inline int default_protocol_dgram(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1154 }
1155
1156 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 {
1158         switch (family) {
1159         case PF_UNIX:
1160                 switch (type) {
1161                 case SOCK_STREAM:
1162                 case SOCK_SEQPACKET:
1163                         return SECCLASS_UNIX_STREAM_SOCKET;
1164                 case SOCK_DGRAM:
1165                         return SECCLASS_UNIX_DGRAM_SOCKET;
1166                 }
1167                 break;
1168         case PF_INET:
1169         case PF_INET6:
1170                 switch (type) {
1171                 case SOCK_STREAM:
1172                         if (default_protocol_stream(protocol))
1173                                 return SECCLASS_TCP_SOCKET;
1174                         else
1175                                 return SECCLASS_RAWIP_SOCKET;
1176                 case SOCK_DGRAM:
1177                         if (default_protocol_dgram(protocol))
1178                                 return SECCLASS_UDP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DCCP:
1182                         return SECCLASS_DCCP_SOCKET;
1183                 default:
1184                         return SECCLASS_RAWIP_SOCKET;
1185                 }
1186                 break;
1187         case PF_NETLINK:
1188                 switch (protocol) {
1189                 case NETLINK_ROUTE:
1190                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1191                 case NETLINK_SOCK_DIAG:
1192                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1193                 case NETLINK_NFLOG:
1194                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1195                 case NETLINK_XFRM:
1196                         return SECCLASS_NETLINK_XFRM_SOCKET;
1197                 case NETLINK_SELINUX:
1198                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1199                 case NETLINK_ISCSI:
1200                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1201                 case NETLINK_AUDIT:
1202                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1203                 case NETLINK_FIB_LOOKUP:
1204                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1205                 case NETLINK_CONNECTOR:
1206                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1207                 case NETLINK_NETFILTER:
1208                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1209                 case NETLINK_DNRTMSG:
1210                         return SECCLASS_NETLINK_DNRT_SOCKET;
1211                 case NETLINK_KOBJECT_UEVENT:
1212                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1213                 case NETLINK_GENERIC:
1214                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1215                 case NETLINK_SCSITRANSPORT:
1216                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1217                 case NETLINK_RDMA:
1218                         return SECCLASS_NETLINK_RDMA_SOCKET;
1219                 case NETLINK_CRYPTO:
1220                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1221                 default:
1222                         return SECCLASS_NETLINK_SOCKET;
1223                 }
1224         case PF_PACKET:
1225                 return SECCLASS_PACKET_SOCKET;
1226         case PF_KEY:
1227                 return SECCLASS_KEY_SOCKET;
1228         case PF_APPLETALK:
1229                 return SECCLASS_APPLETALK_SOCKET;
1230         }
1231
1232         return SECCLASS_SOCKET;
1233 }
1234
1235 #ifdef CONFIG_PROC_FS
1236 static int selinux_proc_get_sid(struct dentry *dentry,
1237                                 u16 tclass,
1238                                 u32 *sid)
1239 {
1240         int rc;
1241         char *buffer, *path;
1242
1243         buffer = (char *)__get_free_page(GFP_KERNEL);
1244         if (!buffer)
1245                 return -ENOMEM;
1246
1247         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1248         if (IS_ERR(path))
1249                 rc = PTR_ERR(path);
1250         else {
1251                 /* each process gets a /proc/PID/ entry. Strip off the
1252                  * PID part to get a valid selinux labeling.
1253                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1254                 while (path[1] >= '0' && path[1] <= '9') {
1255                         path[1] = '/';
1256                         path++;
1257                 }
1258                 rc = security_genfs_sid("proc", path, tclass, sid);
1259         }
1260         free_page((unsigned long)buffer);
1261         return rc;
1262 }
1263 #else
1264 static int selinux_proc_get_sid(struct dentry *dentry,
1265                                 u16 tclass,
1266                                 u32 *sid)
1267 {
1268         return -EINVAL;
1269 }
1270 #endif
1271
1272 /* The inode's security attributes must be initialized before first use. */
1273 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1274 {
1275         struct superblock_security_struct *sbsec = NULL;
1276         struct inode_security_struct *isec = inode->i_security;
1277         u32 sid;
1278         struct dentry *dentry;
1279 #define INITCONTEXTLEN 255
1280         char *context = NULL;
1281         unsigned len = 0;
1282         int rc = 0;
1283
1284         if (isec->initialized)
1285                 goto out;
1286
1287         mutex_lock(&isec->lock);
1288         if (isec->initialized)
1289                 goto out_unlock;
1290
1291         sbsec = inode->i_sb->s_security;
1292         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1293                 /* Defer initialization until selinux_complete_init,
1294                    after the initial policy is loaded and the security
1295                    server is ready to handle calls. */
1296                 spin_lock(&sbsec->isec_lock);
1297                 if (list_empty(&isec->list))
1298                         list_add(&isec->list, &sbsec->isec_head);
1299                 spin_unlock(&sbsec->isec_lock);
1300                 goto out_unlock;
1301         }
1302
1303         switch (sbsec->behavior) {
1304         case SECURITY_FS_USE_NATIVE:
1305                 break;
1306         case SECURITY_FS_USE_XATTR:
1307                 if (!inode->i_op->getxattr) {
1308                         isec->sid = sbsec->def_sid;
1309                         break;
1310                 }
1311
1312                 /* Need a dentry, since the xattr API requires one.
1313                    Life would be simpler if we could just pass the inode. */
1314                 if (opt_dentry) {
1315                         /* Called from d_instantiate or d_splice_alias. */
1316                         dentry = dget(opt_dentry);
1317                 } else {
1318                         /* Called from selinux_complete_init, try to find a dentry. */
1319                         dentry = d_find_alias(inode);
1320                 }
1321                 if (!dentry) {
1322                         /*
1323                          * this is can be hit on boot when a file is accessed
1324                          * before the policy is loaded.  When we load policy we
1325                          * may find inodes that have no dentry on the
1326                          * sbsec->isec_head list.  No reason to complain as these
1327                          * will get fixed up the next time we go through
1328                          * inode_doinit with a dentry, before these inodes could
1329                          * be used again by userspace.
1330                          */
1331                         goto out_unlock;
1332                 }
1333
1334                 len = INITCONTEXTLEN;
1335                 context = kmalloc(len+1, GFP_NOFS);
1336                 if (!context) {
1337                         rc = -ENOMEM;
1338                         dput(dentry);
1339                         goto out_unlock;
1340                 }
1341                 context[len] = '\0';
1342                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1343                                            context, len);
1344                 if (rc == -ERANGE) {
1345                         kfree(context);
1346
1347                         /* Need a larger buffer.  Query for the right size. */
1348                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1349                                                    NULL, 0);
1350                         if (rc < 0) {
1351                                 dput(dentry);
1352                                 goto out_unlock;
1353                         }
1354                         len = rc;
1355                         context = kmalloc(len+1, GFP_NOFS);
1356                         if (!context) {
1357                                 rc = -ENOMEM;
1358                                 dput(dentry);
1359                                 goto out_unlock;
1360                         }
1361                         context[len] = '\0';
1362                         rc = inode->i_op->getxattr(dentry,
1363                                                    XATTR_NAME_SELINUX,
1364                                                    context, len);
1365                 }
1366                 dput(dentry);
1367                 if (rc < 0) {
1368                         if (rc != -ENODATA) {
1369                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1370                                        "%d for dev=%s ino=%ld\n", __func__,
1371                                        -rc, inode->i_sb->s_id, inode->i_ino);
1372                                 kfree(context);
1373                                 goto out_unlock;
1374                         }
1375                         /* Map ENODATA to the default file SID */
1376                         sid = sbsec->def_sid;
1377                         rc = 0;
1378                 } else {
1379                         rc = security_context_to_sid_default(context, rc, &sid,
1380                                                              sbsec->def_sid,
1381                                                              GFP_NOFS);
1382                         if (rc) {
1383                                 char *dev = inode->i_sb->s_id;
1384                                 unsigned long ino = inode->i_ino;
1385
1386                                 if (rc == -EINVAL) {
1387                                         if (printk_ratelimit())
1388                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1389                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1390                                                         "filesystem in question.\n", ino, dev, context);
1391                                 } else {
1392                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1393                                                "returned %d for dev=%s ino=%ld\n",
1394                                                __func__, context, -rc, dev, ino);
1395                                 }
1396                                 kfree(context);
1397                                 /* Leave with the unlabeled SID */
1398                                 rc = 0;
1399                                 break;
1400                         }
1401                 }
1402                 kfree(context);
1403                 isec->sid = sid;
1404                 break;
1405         case SECURITY_FS_USE_TASK:
1406                 isec->sid = isec->task_sid;
1407                 break;
1408         case SECURITY_FS_USE_TRANS:
1409                 /* Default to the fs SID. */
1410                 isec->sid = sbsec->sid;
1411
1412                 /* Try to obtain a transition SID. */
1413                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1414                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1415                                              isec->sclass, NULL, &sid);
1416                 if (rc)
1417                         goto out_unlock;
1418                 isec->sid = sid;
1419                 break;
1420         case SECURITY_FS_USE_MNTPOINT:
1421                 isec->sid = sbsec->mntpoint_sid;
1422                 break;
1423         default:
1424                 /* Default to the fs superblock SID. */
1425                 isec->sid = sbsec->sid;
1426
1427                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1428                         /* We must have a dentry to determine the label on
1429                          * procfs inodes */
1430                         if (opt_dentry)
1431                                 /* Called from d_instantiate or
1432                                  * d_splice_alias. */
1433                                 dentry = dget(opt_dentry);
1434                         else
1435                                 /* Called from selinux_complete_init, try to
1436                                  * find a dentry. */
1437                                 dentry = d_find_alias(inode);
1438                         /*
1439                          * This can be hit on boot when a file is accessed
1440                          * before the policy is loaded.  When we load policy we
1441                          * may find inodes that have no dentry on the
1442                          * sbsec->isec_head list.  No reason to complain as
1443                          * these will get fixed up the next time we go through
1444                          * inode_doinit() with a dentry, before these inodes
1445                          * could be used again by userspace.
1446                          */
1447                         if (!dentry)
1448                                 goto out_unlock;
1449                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1450                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1451                         dput(dentry);
1452                         if (rc)
1453                                 goto out_unlock;
1454                         isec->sid = sid;
1455                 }
1456                 break;
1457         }
1458
1459         isec->initialized = 1;
1460
1461 out_unlock:
1462         mutex_unlock(&isec->lock);
1463 out:
1464         if (isec->sclass == SECCLASS_FILE)
1465                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1466         return rc;
1467 }
1468
1469 /* Convert a Linux signal to an access vector. */
1470 static inline u32 signal_to_av(int sig)
1471 {
1472         u32 perm = 0;
1473
1474         switch (sig) {
1475         case SIGCHLD:
1476                 /* Commonly granted from child to parent. */
1477                 perm = PROCESS__SIGCHLD;
1478                 break;
1479         case SIGKILL:
1480                 /* Cannot be caught or ignored */
1481                 perm = PROCESS__SIGKILL;
1482                 break;
1483         case SIGSTOP:
1484                 /* Cannot be caught or ignored */
1485                 perm = PROCESS__SIGSTOP;
1486                 break;
1487         default:
1488                 /* All other signals. */
1489                 perm = PROCESS__SIGNAL;
1490                 break;
1491         }
1492
1493         return perm;
1494 }
1495
1496 /*
1497  * Check permission between a pair of credentials
1498  * fork check, ptrace check, etc.
1499  */
1500 static int cred_has_perm(const struct cred *actor,
1501                          const struct cred *target,
1502                          u32 perms)
1503 {
1504         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1505
1506         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1507 }
1508
1509 /*
1510  * Check permission between a pair of tasks, e.g. signal checks,
1511  * fork check, ptrace check, etc.
1512  * tsk1 is the actor and tsk2 is the target
1513  * - this uses the default subjective creds of tsk1
1514  */
1515 static int task_has_perm(const struct task_struct *tsk1,
1516                          const struct task_struct *tsk2,
1517                          u32 perms)
1518 {
1519         const struct task_security_struct *__tsec1, *__tsec2;
1520         u32 sid1, sid2;
1521
1522         rcu_read_lock();
1523         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1524         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1525         rcu_read_unlock();
1526         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1527 }
1528
1529 /*
1530  * Check permission between current and another task, e.g. signal checks,
1531  * fork check, ptrace check, etc.
1532  * current is the actor and tsk2 is the target
1533  * - this uses current's subjective creds
1534  */
1535 static int current_has_perm(const struct task_struct *tsk,
1536                             u32 perms)
1537 {
1538         u32 sid, tsid;
1539
1540         sid = current_sid();
1541         tsid = task_sid(tsk);
1542         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1543 }
1544
1545 #if CAP_LAST_CAP > 63
1546 #error Fix SELinux to handle capabilities > 63.
1547 #endif
1548
1549 /* Check whether a task is allowed to use a capability. */
1550 static int cred_has_capability(const struct cred *cred,
1551                                int cap, int audit)
1552 {
1553         struct common_audit_data ad;
1554         struct av_decision avd;
1555         u16 sclass;
1556         u32 sid = cred_sid(cred);
1557         u32 av = CAP_TO_MASK(cap);
1558         int rc;
1559
1560         ad.type = LSM_AUDIT_DATA_CAP;
1561         ad.u.cap = cap;
1562
1563         switch (CAP_TO_INDEX(cap)) {
1564         case 0:
1565                 sclass = SECCLASS_CAPABILITY;
1566                 break;
1567         case 1:
1568                 sclass = SECCLASS_CAPABILITY2;
1569                 break;
1570         default:
1571                 printk(KERN_ERR
1572                        "SELinux:  out of range capability %d\n", cap);
1573                 BUG();
1574                 return -EINVAL;
1575         }
1576
1577         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1578         if (audit == SECURITY_CAP_AUDIT) {
1579                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1580                 if (rc2)
1581                         return rc2;
1582         }
1583         return rc;
1584 }
1585
1586 /* Check whether a task is allowed to use a system operation. */
1587 static int task_has_system(struct task_struct *tsk,
1588                            u32 perms)
1589 {
1590         u32 sid = task_sid(tsk);
1591
1592         return avc_has_perm(sid, SECINITSID_KERNEL,
1593                             SECCLASS_SYSTEM, perms, NULL);
1594 }
1595
1596 /* Check whether a task has a particular permission to an inode.
1597    The 'adp' parameter is optional and allows other audit
1598    data to be passed (e.g. the dentry). */
1599 static int inode_has_perm(const struct cred *cred,
1600                           struct inode *inode,
1601                           u32 perms,
1602                           struct common_audit_data *adp)
1603 {
1604         struct inode_security_struct *isec;
1605         u32 sid;
1606
1607         validate_creds(cred);
1608
1609         if (unlikely(IS_PRIVATE(inode)))
1610                 return 0;
1611
1612         sid = cred_sid(cred);
1613         isec = inode->i_security;
1614
1615         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1616 }
1617
1618 /* Same as inode_has_perm, but pass explicit audit data containing
1619    the dentry to help the auditing code to more easily generate the
1620    pathname if needed. */
1621 static inline int dentry_has_perm(const struct cred *cred,
1622                                   struct dentry *dentry,
1623                                   u32 av)
1624 {
1625         struct inode *inode = d_backing_inode(dentry);
1626         struct common_audit_data ad;
1627
1628         ad.type = LSM_AUDIT_DATA_DENTRY;
1629         ad.u.dentry = dentry;
1630         return inode_has_perm(cred, inode, av, &ad);
1631 }
1632
1633 /* Same as inode_has_perm, but pass explicit audit data containing
1634    the path to help the auditing code to more easily generate the
1635    pathname if needed. */
1636 static inline int path_has_perm(const struct cred *cred,
1637                                 const struct path *path,
1638                                 u32 av)
1639 {
1640         struct inode *inode = d_backing_inode(path->dentry);
1641         struct common_audit_data ad;
1642
1643         ad.type = LSM_AUDIT_DATA_PATH;
1644         ad.u.path = *path;
1645         return inode_has_perm(cred, inode, av, &ad);
1646 }
1647
1648 /* Same as path_has_perm, but uses the inode from the file struct. */
1649 static inline int file_path_has_perm(const struct cred *cred,
1650                                      struct file *file,
1651                                      u32 av)
1652 {
1653         struct common_audit_data ad;
1654
1655         ad.type = LSM_AUDIT_DATA_PATH;
1656         ad.u.path = file->f_path;
1657         return inode_has_perm(cred, file_inode(file), av, &ad);
1658 }
1659
1660 /* Check whether a task can use an open file descriptor to
1661    access an inode in a given way.  Check access to the
1662    descriptor itself, and then use dentry_has_perm to
1663    check a particular permission to the file.
1664    Access to the descriptor is implicitly granted if it
1665    has the same SID as the process.  If av is zero, then
1666    access to the file is not checked, e.g. for cases
1667    where only the descriptor is affected like seek. */
1668 static int file_has_perm(const struct cred *cred,
1669                          struct file *file,
1670                          u32 av)
1671 {
1672         struct file_security_struct *fsec = file->f_security;
1673         struct inode *inode = file_inode(file);
1674         struct common_audit_data ad;
1675         u32 sid = cred_sid(cred);
1676         int rc;
1677
1678         ad.type = LSM_AUDIT_DATA_PATH;
1679         ad.u.path = file->f_path;
1680
1681         if (sid != fsec->sid) {
1682                 rc = avc_has_perm(sid, fsec->sid,
1683                                   SECCLASS_FD,
1684                                   FD__USE,
1685                                   &ad);
1686                 if (rc)
1687                         goto out;
1688         }
1689
1690         /* av is zero if only checking access to the descriptor. */
1691         rc = 0;
1692         if (av)
1693                 rc = inode_has_perm(cred, inode, av, &ad);
1694
1695 out:
1696         return rc;
1697 }
1698
1699 /* Check whether a task can create a file. */
1700 static int may_create(struct inode *dir,
1701                       struct dentry *dentry,
1702                       u16 tclass)
1703 {
1704         const struct task_security_struct *tsec = current_security();
1705         struct inode_security_struct *dsec;
1706         struct superblock_security_struct *sbsec;
1707         u32 sid, newsid;
1708         struct common_audit_data ad;
1709         int rc;
1710
1711         dsec = dir->i_security;
1712         sbsec = dir->i_sb->s_security;
1713
1714         sid = tsec->sid;
1715         newsid = tsec->create_sid;
1716
1717         ad.type = LSM_AUDIT_DATA_DENTRY;
1718         ad.u.dentry = dentry;
1719
1720         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1721                           DIR__ADD_NAME | DIR__SEARCH,
1722                           &ad);
1723         if (rc)
1724                 return rc;
1725
1726         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1727                 rc = security_transition_sid(sid, dsec->sid, tclass,
1728                                              &dentry->d_name, &newsid);
1729                 if (rc)
1730                         return rc;
1731         }
1732
1733         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1734         if (rc)
1735                 return rc;
1736
1737         return avc_has_perm(newsid, sbsec->sid,
1738                             SECCLASS_FILESYSTEM,
1739                             FILESYSTEM__ASSOCIATE, &ad);
1740 }
1741
1742 /* Check whether a task can create a key. */
1743 static int may_create_key(u32 ksid,
1744                           struct task_struct *ctx)
1745 {
1746         u32 sid = task_sid(ctx);
1747
1748         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1749 }
1750
1751 #define MAY_LINK        0
1752 #define MAY_UNLINK      1
1753 #define MAY_RMDIR       2
1754
1755 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1756 static int may_link(struct inode *dir,
1757                     struct dentry *dentry,
1758                     int kind)
1759
1760 {
1761         struct inode_security_struct *dsec, *isec;
1762         struct common_audit_data ad;
1763         u32 sid = current_sid();
1764         u32 av;
1765         int rc;
1766
1767         dsec = dir->i_security;
1768         isec = d_backing_inode(dentry)->i_security;
1769
1770         ad.type = LSM_AUDIT_DATA_DENTRY;
1771         ad.u.dentry = dentry;
1772
1773         av = DIR__SEARCH;
1774         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1775         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1776         if (rc)
1777                 return rc;
1778
1779         switch (kind) {
1780         case MAY_LINK:
1781                 av = FILE__LINK;
1782                 break;
1783         case MAY_UNLINK:
1784                 av = FILE__UNLINK;
1785                 break;
1786         case MAY_RMDIR:
1787                 av = DIR__RMDIR;
1788                 break;
1789         default:
1790                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1791                         __func__, kind);
1792                 return 0;
1793         }
1794
1795         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1796         return rc;
1797 }
1798
1799 static inline int may_rename(struct inode *old_dir,
1800                              struct dentry *old_dentry,
1801                              struct inode *new_dir,
1802                              struct dentry *new_dentry)
1803 {
1804         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1805         struct common_audit_data ad;
1806         u32 sid = current_sid();
1807         u32 av;
1808         int old_is_dir, new_is_dir;
1809         int rc;
1810
1811         old_dsec = old_dir->i_security;
1812         old_isec = d_backing_inode(old_dentry)->i_security;
1813         old_is_dir = d_is_dir(old_dentry);
1814         new_dsec = new_dir->i_security;
1815
1816         ad.type = LSM_AUDIT_DATA_DENTRY;
1817
1818         ad.u.dentry = old_dentry;
1819         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1820                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1821         if (rc)
1822                 return rc;
1823         rc = avc_has_perm(sid, old_isec->sid,
1824                           old_isec->sclass, FILE__RENAME, &ad);
1825         if (rc)
1826                 return rc;
1827         if (old_is_dir && new_dir != old_dir) {
1828                 rc = avc_has_perm(sid, old_isec->sid,
1829                                   old_isec->sclass, DIR__REPARENT, &ad);
1830                 if (rc)
1831                         return rc;
1832         }
1833
1834         ad.u.dentry = new_dentry;
1835         av = DIR__ADD_NAME | DIR__SEARCH;
1836         if (d_is_positive(new_dentry))
1837                 av |= DIR__REMOVE_NAME;
1838         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1839         if (rc)
1840                 return rc;
1841         if (d_is_positive(new_dentry)) {
1842                 new_isec = d_backing_inode(new_dentry)->i_security;
1843                 new_is_dir = d_is_dir(new_dentry);
1844                 rc = avc_has_perm(sid, new_isec->sid,
1845                                   new_isec->sclass,
1846                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1847                 if (rc)
1848                         return rc;
1849         }
1850
1851         return 0;
1852 }
1853
1854 /* Check whether a task can perform a filesystem operation. */
1855 static int superblock_has_perm(const struct cred *cred,
1856                                struct super_block *sb,
1857                                u32 perms,
1858                                struct common_audit_data *ad)
1859 {
1860         struct superblock_security_struct *sbsec;
1861         u32 sid = cred_sid(cred);
1862
1863         sbsec = sb->s_security;
1864         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1865 }
1866
1867 /* Convert a Linux mode and permission mask to an access vector. */
1868 static inline u32 file_mask_to_av(int mode, int mask)
1869 {
1870         u32 av = 0;
1871
1872         if (!S_ISDIR(mode)) {
1873                 if (mask & MAY_EXEC)
1874                         av |= FILE__EXECUTE;
1875                 if (mask & MAY_READ)
1876                         av |= FILE__READ;
1877
1878                 if (mask & MAY_APPEND)
1879                         av |= FILE__APPEND;
1880                 else if (mask & MAY_WRITE)
1881                         av |= FILE__WRITE;
1882
1883         } else {
1884                 if (mask & MAY_EXEC)
1885                         av |= DIR__SEARCH;
1886                 if (mask & MAY_WRITE)
1887                         av |= DIR__WRITE;
1888                 if (mask & MAY_READ)
1889                         av |= DIR__READ;
1890         }
1891
1892         return av;
1893 }
1894
1895 /* Convert a Linux file to an access vector. */
1896 static inline u32 file_to_av(struct file *file)
1897 {
1898         u32 av = 0;
1899
1900         if (file->f_mode & FMODE_READ)
1901                 av |= FILE__READ;
1902         if (file->f_mode & FMODE_WRITE) {
1903                 if (file->f_flags & O_APPEND)
1904                         av |= FILE__APPEND;
1905                 else
1906                         av |= FILE__WRITE;
1907         }
1908         if (!av) {
1909                 /*
1910                  * Special file opened with flags 3 for ioctl-only use.
1911                  */
1912                 av = FILE__IOCTL;
1913         }
1914
1915         return av;
1916 }
1917
1918 /*
1919  * Convert a file to an access vector and include the correct open
1920  * open permission.
1921  */
1922 static inline u32 open_file_to_av(struct file *file)
1923 {
1924         u32 av = file_to_av(file);
1925
1926         if (selinux_policycap_openperm)
1927                 av |= FILE__OPEN;
1928
1929         return av;
1930 }
1931
1932 /* Hook functions begin here. */
1933
1934 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1935 {
1936         u32 mysid = current_sid();
1937         u32 mgrsid = task_sid(mgr);
1938
1939         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1940                             BINDER__SET_CONTEXT_MGR, NULL);
1941 }
1942
1943 static int selinux_binder_transaction(struct task_struct *from,
1944                                       struct task_struct *to)
1945 {
1946         u32 mysid = current_sid();
1947         u32 fromsid = task_sid(from);
1948         u32 tosid = task_sid(to);
1949         int rc;
1950
1951         if (mysid != fromsid) {
1952                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1953                                   BINDER__IMPERSONATE, NULL);
1954                 if (rc)
1955                         return rc;
1956         }
1957
1958         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1959                             NULL);
1960 }
1961
1962 static int selinux_binder_transfer_binder(struct task_struct *from,
1963                                           struct task_struct *to)
1964 {
1965         u32 fromsid = task_sid(from);
1966         u32 tosid = task_sid(to);
1967
1968         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1969                             NULL);
1970 }
1971
1972 static int selinux_binder_transfer_file(struct task_struct *from,
1973                                         struct task_struct *to,
1974                                         struct file *file)
1975 {
1976         u32 sid = task_sid(to);
1977         struct file_security_struct *fsec = file->f_security;
1978         struct inode *inode = d_backing_inode(file->f_path.dentry);
1979         struct inode_security_struct *isec = inode->i_security;
1980         struct common_audit_data ad;
1981         int rc;
1982
1983         ad.type = LSM_AUDIT_DATA_PATH;
1984         ad.u.path = file->f_path;
1985
1986         if (sid != fsec->sid) {
1987                 rc = avc_has_perm(sid, fsec->sid,
1988                                   SECCLASS_FD,
1989                                   FD__USE,
1990                                   &ad);
1991                 if (rc)
1992                         return rc;
1993         }
1994
1995         if (unlikely(IS_PRIVATE(inode)))
1996                 return 0;
1997
1998         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1999                             &ad);
2000 }
2001
2002 static int selinux_ptrace_access_check(struct task_struct *child,
2003                                      unsigned int mode)
2004 {
2005         if (mode & PTRACE_MODE_READ) {
2006                 u32 sid = current_sid();
2007                 u32 csid = task_sid(child);
2008                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2009         }
2010
2011         return current_has_perm(child, PROCESS__PTRACE);
2012 }
2013
2014 static int selinux_ptrace_traceme(struct task_struct *parent)
2015 {
2016         return task_has_perm(parent, current, PROCESS__PTRACE);
2017 }
2018
2019 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2020                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2021 {
2022         return current_has_perm(target, PROCESS__GETCAP);
2023 }
2024
2025 static int selinux_capset(struct cred *new, const struct cred *old,
2026                           const kernel_cap_t *effective,
2027                           const kernel_cap_t *inheritable,
2028                           const kernel_cap_t *permitted)
2029 {
2030         return cred_has_perm(old, new, PROCESS__SETCAP);
2031 }
2032
2033 /*
2034  * (This comment used to live with the selinux_task_setuid hook,
2035  * which was removed).
2036  *
2037  * Since setuid only affects the current process, and since the SELinux
2038  * controls are not based on the Linux identity attributes, SELinux does not
2039  * need to control this operation.  However, SELinux does control the use of
2040  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2041  */
2042
2043 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2044                            int cap, int audit)
2045 {
2046         return cred_has_capability(cred, cap, audit);
2047 }
2048
2049 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2050 {
2051         const struct cred *cred = current_cred();
2052         int rc = 0;
2053
2054         if (!sb)
2055                 return 0;
2056
2057         switch (cmds) {
2058         case Q_SYNC:
2059         case Q_QUOTAON:
2060         case Q_QUOTAOFF:
2061         case Q_SETINFO:
2062         case Q_SETQUOTA:
2063                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2064                 break;
2065         case Q_GETFMT:
2066         case Q_GETINFO:
2067         case Q_GETQUOTA:
2068                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2069                 break;
2070         default:
2071                 rc = 0;  /* let the kernel handle invalid cmds */
2072                 break;
2073         }
2074         return rc;
2075 }
2076
2077 static int selinux_quota_on(struct dentry *dentry)
2078 {
2079         const struct cred *cred = current_cred();
2080
2081         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2082 }
2083
2084 static int selinux_syslog(int type)
2085 {
2086         int rc;
2087
2088         switch (type) {
2089         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2090         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2091                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2092                 break;
2093         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2094         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2095         /* Set level of messages printed to console */
2096         case SYSLOG_ACTION_CONSOLE_LEVEL:
2097                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2098                 break;
2099         case SYSLOG_ACTION_CLOSE:       /* Close log */
2100         case SYSLOG_ACTION_OPEN:        /* Open log */
2101         case SYSLOG_ACTION_READ:        /* Read from log */
2102         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2103         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2104         default:
2105                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2106                 break;
2107         }
2108         return rc;
2109 }
2110
2111 /*
2112  * Check that a process has enough memory to allocate a new virtual
2113  * mapping. 0 means there is enough memory for the allocation to
2114  * succeed and -ENOMEM implies there is not.
2115  *
2116  * Do not audit the selinux permission check, as this is applied to all
2117  * processes that allocate mappings.
2118  */
2119 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2120 {
2121         int rc, cap_sys_admin = 0;
2122
2123         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2124                                         SECURITY_CAP_NOAUDIT);
2125         if (rc == 0)
2126                 cap_sys_admin = 1;
2127
2128         return cap_sys_admin;
2129 }
2130
2131 /* binprm security operations */
2132
2133 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2134                             const struct task_security_struct *old_tsec,
2135                             const struct task_security_struct *new_tsec)
2136 {
2137         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2138         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2139         int rc;
2140
2141         if (!nnp && !nosuid)
2142                 return 0; /* neither NNP nor nosuid */
2143
2144         if (new_tsec->sid == old_tsec->sid)
2145                 return 0; /* No change in credentials */
2146
2147         /*
2148          * The only transitions we permit under NNP or nosuid
2149          * are transitions to bounded SIDs, i.e. SIDs that are
2150          * guaranteed to only be allowed a subset of the permissions
2151          * of the current SID.
2152          */
2153         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2154         if (rc) {
2155                 /*
2156                  * On failure, preserve the errno values for NNP vs nosuid.
2157                  * NNP:  Operation not permitted for caller.
2158                  * nosuid:  Permission denied to file.
2159                  */
2160                 if (nnp)
2161                         return -EPERM;
2162                 else
2163                         return -EACCES;
2164         }
2165         return 0;
2166 }
2167
2168 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2169 {
2170         const struct task_security_struct *old_tsec;
2171         struct task_security_struct *new_tsec;
2172         struct inode_security_struct *isec;
2173         struct common_audit_data ad;
2174         struct inode *inode = file_inode(bprm->file);
2175         int rc;
2176
2177         /* SELinux context only depends on initial program or script and not
2178          * the script interpreter */
2179         if (bprm->cred_prepared)
2180                 return 0;
2181
2182         old_tsec = current_security();
2183         new_tsec = bprm->cred->security;
2184         isec = inode->i_security;
2185
2186         /* Default to the current task SID. */
2187         new_tsec->sid = old_tsec->sid;
2188         new_tsec->osid = old_tsec->sid;
2189
2190         /* Reset fs, key, and sock SIDs on execve. */
2191         new_tsec->create_sid = 0;
2192         new_tsec->keycreate_sid = 0;
2193         new_tsec->sockcreate_sid = 0;
2194
2195         if (old_tsec->exec_sid) {
2196                 new_tsec->sid = old_tsec->exec_sid;
2197                 /* Reset exec SID on execve. */
2198                 new_tsec->exec_sid = 0;
2199
2200                 /* Fail on NNP or nosuid if not an allowed transition. */
2201                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2202                 if (rc)
2203                         return rc;
2204         } else {
2205                 /* Check for a default transition on this program. */
2206                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2207                                              SECCLASS_PROCESS, NULL,
2208                                              &new_tsec->sid);
2209                 if (rc)
2210                         return rc;
2211
2212                 /*
2213                  * Fallback to old SID on NNP or nosuid if not an allowed
2214                  * transition.
2215                  */
2216                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2217                 if (rc)
2218                         new_tsec->sid = old_tsec->sid;
2219         }
2220
2221         ad.type = LSM_AUDIT_DATA_PATH;
2222         ad.u.path = bprm->file->f_path;
2223
2224         if (new_tsec->sid == old_tsec->sid) {
2225                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2226                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2227                 if (rc)
2228                         return rc;
2229         } else {
2230                 /* Check permissions for the transition. */
2231                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2232                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2233                 if (rc)
2234                         return rc;
2235
2236                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2237                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2238                 if (rc)
2239                         return rc;
2240
2241                 /* Check for shared state */
2242                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2243                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2244                                           SECCLASS_PROCESS, PROCESS__SHARE,
2245                                           NULL);
2246                         if (rc)
2247                                 return -EPERM;
2248                 }
2249
2250                 /* Make sure that anyone attempting to ptrace over a task that
2251                  * changes its SID has the appropriate permit */
2252                 if (bprm->unsafe &
2253                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2254                         struct task_struct *tracer;
2255                         struct task_security_struct *sec;
2256                         u32 ptsid = 0;
2257
2258                         rcu_read_lock();
2259                         tracer = ptrace_parent(current);
2260                         if (likely(tracer != NULL)) {
2261                                 sec = __task_cred(tracer)->security;
2262                                 ptsid = sec->sid;
2263                         }
2264                         rcu_read_unlock();
2265
2266                         if (ptsid != 0) {
2267                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2268                                                   SECCLASS_PROCESS,
2269                                                   PROCESS__PTRACE, NULL);
2270                                 if (rc)
2271                                         return -EPERM;
2272                         }
2273                 }
2274
2275                 /* Clear any possibly unsafe personality bits on exec: */
2276                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2277         }
2278
2279         return 0;
2280 }
2281
2282 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2283 {
2284         const struct task_security_struct *tsec = current_security();
2285         u32 sid, osid;
2286         int atsecure = 0;
2287
2288         sid = tsec->sid;
2289         osid = tsec->osid;
2290
2291         if (osid != sid) {
2292                 /* Enable secure mode for SIDs transitions unless
2293                    the noatsecure permission is granted between
2294                    the two SIDs, i.e. ahp returns 0. */
2295                 atsecure = avc_has_perm(osid, sid,
2296                                         SECCLASS_PROCESS,
2297                                         PROCESS__NOATSECURE, NULL);
2298         }
2299
2300         return !!atsecure;
2301 }
2302
2303 static int match_file(const void *p, struct file *file, unsigned fd)
2304 {
2305         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2306 }
2307
2308 /* Derived from fs/exec.c:flush_old_files. */
2309 static inline void flush_unauthorized_files(const struct cred *cred,
2310                                             struct files_struct *files)
2311 {
2312         struct file *file, *devnull = NULL;
2313         struct tty_struct *tty;
2314         int drop_tty = 0;
2315         unsigned n;
2316
2317         tty = get_current_tty();
2318         if (tty) {
2319                 spin_lock(&tty_files_lock);
2320                 if (!list_empty(&tty->tty_files)) {
2321                         struct tty_file_private *file_priv;
2322
2323                         /* Revalidate access to controlling tty.
2324                            Use file_path_has_perm on the tty path directly
2325                            rather than using file_has_perm, as this particular
2326                            open file may belong to another process and we are
2327                            only interested in the inode-based check here. */
2328                         file_priv = list_first_entry(&tty->tty_files,
2329                                                 struct tty_file_private, list);
2330                         file = file_priv->file;
2331                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2332                                 drop_tty = 1;
2333                 }
2334                 spin_unlock(&tty_files_lock);
2335                 tty_kref_put(tty);
2336         }
2337         /* Reset controlling tty. */
2338         if (drop_tty)
2339                 no_tty();
2340
2341         /* Revalidate access to inherited open files. */
2342         n = iterate_fd(files, 0, match_file, cred);
2343         if (!n) /* none found? */
2344                 return;
2345
2346         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2347         if (IS_ERR(devnull))
2348                 devnull = NULL;
2349         /* replace all the matching ones with this */
2350         do {
2351                 replace_fd(n - 1, devnull, 0);
2352         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2353         if (devnull)
2354                 fput(devnull);
2355 }
2356
2357 /*
2358  * Prepare a process for imminent new credential changes due to exec
2359  */
2360 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2361 {
2362         struct task_security_struct *new_tsec;
2363         struct rlimit *rlim, *initrlim;
2364         int rc, i;
2365
2366         new_tsec = bprm->cred->security;
2367         if (new_tsec->sid == new_tsec->osid)
2368                 return;
2369
2370         /* Close files for which the new task SID is not authorized. */
2371         flush_unauthorized_files(bprm->cred, current->files);
2372
2373         /* Always clear parent death signal on SID transitions. */
2374         current->pdeath_signal = 0;
2375
2376         /* Check whether the new SID can inherit resource limits from the old
2377          * SID.  If not, reset all soft limits to the lower of the current
2378          * task's hard limit and the init task's soft limit.
2379          *
2380          * Note that the setting of hard limits (even to lower them) can be
2381          * controlled by the setrlimit check.  The inclusion of the init task's
2382          * soft limit into the computation is to avoid resetting soft limits
2383          * higher than the default soft limit for cases where the default is
2384          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2385          */
2386         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2387                           PROCESS__RLIMITINH, NULL);
2388         if (rc) {
2389                 /* protect against do_prlimit() */
2390                 task_lock(current);
2391                 for (i = 0; i < RLIM_NLIMITS; i++) {
2392                         rlim = current->signal->rlim + i;
2393                         initrlim = init_task.signal->rlim + i;
2394                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2395                 }
2396                 task_unlock(current);
2397                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2398         }
2399 }
2400
2401 /*
2402  * Clean up the process immediately after the installation of new credentials
2403  * due to exec
2404  */
2405 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2406 {
2407         const struct task_security_struct *tsec = current_security();
2408         struct itimerval itimer;
2409         u32 osid, sid;
2410         int rc, i;
2411
2412         osid = tsec->osid;
2413         sid = tsec->sid;
2414
2415         if (sid == osid)
2416                 return;
2417
2418         /* Check whether the new SID can inherit signal state from the old SID.
2419          * If not, clear itimers to avoid subsequent signal generation and
2420          * flush and unblock signals.
2421          *
2422          * This must occur _after_ the task SID has been updated so that any
2423          * kill done after the flush will be checked against the new SID.
2424          */
2425         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2426         if (rc) {
2427                 memset(&itimer, 0, sizeof itimer);
2428                 for (i = 0; i < 3; i++)
2429                         do_setitimer(i, &itimer, NULL);
2430                 spin_lock_irq(&current->sighand->siglock);
2431                 if (!fatal_signal_pending(current)) {
2432                         flush_sigqueue(&current->pending);
2433                         flush_sigqueue(&current->signal->shared_pending);
2434                         flush_signal_handlers(current, 1);
2435                         sigemptyset(&current->blocked);
2436                         recalc_sigpending();
2437                 }
2438                 spin_unlock_irq(&current->sighand->siglock);
2439         }
2440
2441         /* Wake up the parent if it is waiting so that it can recheck
2442          * wait permission to the new task SID. */
2443         read_lock(&tasklist_lock);
2444         __wake_up_parent(current, current->real_parent);
2445         read_unlock(&tasklist_lock);
2446 }
2447
2448 /* superblock security operations */
2449
2450 static int selinux_sb_alloc_security(struct super_block *sb)
2451 {
2452         return superblock_alloc_security(sb);
2453 }
2454
2455 static void selinux_sb_free_security(struct super_block *sb)
2456 {
2457         superblock_free_security(sb);
2458 }
2459
2460 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2461 {
2462         if (plen > olen)
2463                 return 0;
2464
2465         return !memcmp(prefix, option, plen);
2466 }
2467
2468 static inline int selinux_option(char *option, int len)
2469 {
2470         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2471                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2472                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2473                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2474                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2475 }
2476
2477 static inline void take_option(char **to, char *from, int *first, int len)
2478 {
2479         if (!*first) {
2480                 **to = ',';
2481                 *to += 1;
2482         } else
2483                 *first = 0;
2484         memcpy(*to, from, len);
2485         *to += len;
2486 }
2487
2488 static inline void take_selinux_option(char **to, char *from, int *first,
2489                                        int len)
2490 {
2491         int current_size = 0;
2492
2493         if (!*first) {
2494                 **to = '|';
2495                 *to += 1;
2496         } else
2497                 *first = 0;
2498
2499         while (current_size < len) {
2500                 if (*from != '"') {
2501                         **to = *from;
2502                         *to += 1;
2503                 }
2504                 from += 1;
2505                 current_size += 1;
2506         }
2507 }
2508
2509 static int selinux_sb_copy_data(char *orig, char *copy)
2510 {
2511         int fnosec, fsec, rc = 0;
2512         char *in_save, *in_curr, *in_end;
2513         char *sec_curr, *nosec_save, *nosec;
2514         int open_quote = 0;
2515
2516         in_curr = orig;
2517         sec_curr = copy;
2518
2519         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2520         if (!nosec) {
2521                 rc = -ENOMEM;
2522                 goto out;
2523         }
2524
2525         nosec_save = nosec;
2526         fnosec = fsec = 1;
2527         in_save = in_end = orig;
2528
2529         do {
2530                 if (*in_end == '"')
2531                         open_quote = !open_quote;
2532                 if ((*in_end == ',' && open_quote == 0) ||
2533                                 *in_end == '\0') {
2534                         int len = in_end - in_curr;
2535
2536                         if (selinux_option(in_curr, len))
2537                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2538                         else
2539                                 take_option(&nosec, in_curr, &fnosec, len);
2540
2541                         in_curr = in_end + 1;
2542                 }
2543         } while (*in_end++);
2544
2545         strcpy(in_save, nosec_save);
2546         free_page((unsigned long)nosec_save);
2547 out:
2548         return rc;
2549 }
2550
2551 static int selinux_sb_remount(struct super_block *sb, void *data)
2552 {
2553         int rc, i, *flags;
2554         struct security_mnt_opts opts;
2555         char *secdata, **mount_options;
2556         struct superblock_security_struct *sbsec = sb->s_security;
2557
2558         if (!(sbsec->flags & SE_SBINITIALIZED))
2559                 return 0;
2560
2561         if (!data)
2562                 return 0;
2563
2564         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2565                 return 0;
2566
2567         security_init_mnt_opts(&opts);
2568         secdata = alloc_secdata();
2569         if (!secdata)
2570                 return -ENOMEM;
2571         rc = selinux_sb_copy_data(data, secdata);
2572         if (rc)
2573                 goto out_free_secdata;
2574
2575         rc = selinux_parse_opts_str(secdata, &opts);
2576         if (rc)
2577                 goto out_free_secdata;
2578
2579         mount_options = opts.mnt_opts;
2580         flags = opts.mnt_opts_flags;
2581
2582         for (i = 0; i < opts.num_mnt_opts; i++) {
2583                 u32 sid;
2584                 size_t len;
2585
2586                 if (flags[i] == SBLABEL_MNT)
2587                         continue;
2588                 len = strlen(mount_options[i]);
2589                 rc = security_context_to_sid(mount_options[i], len, &sid,
2590                                              GFP_KERNEL);
2591                 if (rc) {
2592                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2593                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2594                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2595                         goto out_free_opts;
2596                 }
2597                 rc = -EINVAL;
2598                 switch (flags[i]) {
2599                 case FSCONTEXT_MNT:
2600                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2601                                 goto out_bad_option;
2602                         break;
2603                 case CONTEXT_MNT:
2604                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2605                                 goto out_bad_option;
2606                         break;
2607                 case ROOTCONTEXT_MNT: {
2608                         struct inode_security_struct *root_isec;
2609                         root_isec = d_backing_inode(sb->s_root)->i_security;
2610
2611                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2612                                 goto out_bad_option;
2613                         break;
2614                 }
2615                 case DEFCONTEXT_MNT:
2616                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2617                                 goto out_bad_option;
2618                         break;
2619                 default:
2620                         goto out_free_opts;
2621                 }
2622         }
2623
2624         rc = 0;
2625 out_free_opts:
2626         security_free_mnt_opts(&opts);
2627 out_free_secdata:
2628         free_secdata(secdata);
2629         return rc;
2630 out_bad_option:
2631         printk(KERN_WARNING "SELinux: unable to change security options "
2632                "during remount (dev %s, type=%s)\n", sb->s_id,
2633                sb->s_type->name);
2634         goto out_free_opts;
2635 }
2636
2637 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2638 {
2639         const struct cred *cred = current_cred();
2640         struct common_audit_data ad;
2641         int rc;
2642
2643         rc = superblock_doinit(sb, data);
2644         if (rc)
2645                 return rc;
2646
2647         /* Allow all mounts performed by the kernel */
2648         if (flags & MS_KERNMOUNT)
2649                 return 0;
2650
2651         ad.type = LSM_AUDIT_DATA_DENTRY;
2652         ad.u.dentry = sb->s_root;
2653         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2654 }
2655
2656 static int selinux_sb_statfs(struct dentry *dentry)
2657 {
2658         const struct cred *cred = current_cred();
2659         struct common_audit_data ad;
2660
2661         ad.type = LSM_AUDIT_DATA_DENTRY;
2662         ad.u.dentry = dentry->d_sb->s_root;
2663         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2664 }
2665
2666 static int selinux_mount(const char *dev_name,
2667                          struct path *path,
2668                          const char *type,
2669                          unsigned long flags,
2670                          void *data)
2671 {
2672         const struct cred *cred = current_cred();
2673
2674         if (flags & MS_REMOUNT)
2675                 return superblock_has_perm(cred, path->dentry->d_sb,
2676                                            FILESYSTEM__REMOUNT, NULL);
2677         else
2678                 return path_has_perm(cred, path, FILE__MOUNTON);
2679 }
2680
2681 static int selinux_umount(struct vfsmount *mnt, int flags)
2682 {
2683         const struct cred *cred = current_cred();
2684
2685         return superblock_has_perm(cred, mnt->mnt_sb,
2686                                    FILESYSTEM__UNMOUNT, NULL);
2687 }
2688
2689 /* inode security operations */
2690
2691 static int selinux_inode_alloc_security(struct inode *inode)
2692 {
2693         return inode_alloc_security(inode);
2694 }
2695
2696 static void selinux_inode_free_security(struct inode *inode)
2697 {
2698         inode_free_security(inode);
2699 }
2700
2701 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2702                                         struct qstr *name, void **ctx,
2703                                         u32 *ctxlen)
2704 {
2705         const struct cred *cred = current_cred();
2706         struct task_security_struct *tsec;
2707         struct inode_security_struct *dsec;
2708         struct superblock_security_struct *sbsec;
2709         struct inode *dir = d_backing_inode(dentry->d_parent);
2710         u32 newsid;
2711         int rc;
2712
2713         tsec = cred->security;
2714         dsec = dir->i_security;
2715         sbsec = dir->i_sb->s_security;
2716
2717         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2718                 newsid = tsec->create_sid;
2719         } else {
2720                 rc = security_transition_sid(tsec->sid, dsec->sid,
2721                                              inode_mode_to_security_class(mode),
2722                                              name,
2723                                              &newsid);
2724                 if (rc) {
2725                         printk(KERN_WARNING
2726                                 "%s: security_transition_sid failed, rc=%d\n",
2727                                __func__, -rc);
2728                         return rc;
2729                 }
2730         }
2731
2732         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2733 }
2734
2735 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2736                                        const struct qstr *qstr,
2737                                        const char **name,
2738                                        void **value, size_t *len)
2739 {
2740         const struct task_security_struct *tsec = current_security();
2741         struct inode_security_struct *dsec;
2742         struct superblock_security_struct *sbsec;
2743         u32 sid, newsid, clen;
2744         int rc;
2745         char *context;
2746
2747         dsec = dir->i_security;
2748         sbsec = dir->i_sb->s_security;
2749
2750         sid = tsec->sid;
2751         newsid = tsec->create_sid;
2752
2753         if ((sbsec->flags & SE_SBINITIALIZED) &&
2754             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2755                 newsid = sbsec->mntpoint_sid;
2756         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2757                 rc = security_transition_sid(sid, dsec->sid,
2758                                              inode_mode_to_security_class(inode->i_mode),
2759                                              qstr, &newsid);
2760                 if (rc) {
2761                         printk(KERN_WARNING "%s:  "
2762                                "security_transition_sid failed, rc=%d (dev=%s "
2763                                "ino=%ld)\n",
2764                                __func__,
2765                                -rc, inode->i_sb->s_id, inode->i_ino);
2766                         return rc;
2767                 }
2768         }
2769
2770         /* Possibly defer initialization to selinux_complete_init. */
2771         if (sbsec->flags & SE_SBINITIALIZED) {
2772                 struct inode_security_struct *isec = inode->i_security;
2773                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2774                 isec->sid = newsid;
2775                 isec->initialized = 1;
2776         }
2777
2778         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2779                 return -EOPNOTSUPP;
2780
2781         if (name)
2782                 *name = XATTR_SELINUX_SUFFIX;
2783
2784         if (value && len) {
2785                 rc = security_sid_to_context_force(newsid, &context, &clen);
2786                 if (rc)
2787                         return rc;
2788                 *value = context;
2789                 *len = clen;
2790         }
2791
2792         return 0;
2793 }
2794
2795 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2796 {
2797         return may_create(dir, dentry, SECCLASS_FILE);
2798 }
2799
2800 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2801 {
2802         return may_link(dir, old_dentry, MAY_LINK);
2803 }
2804
2805 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2806 {
2807         return may_link(dir, dentry, MAY_UNLINK);
2808 }
2809
2810 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2811 {
2812         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2813 }
2814
2815 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2816 {
2817         return may_create(dir, dentry, SECCLASS_DIR);
2818 }
2819
2820 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2821 {
2822         return may_link(dir, dentry, MAY_RMDIR);
2823 }
2824
2825 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2826 {
2827         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2828 }
2829
2830 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2831                                 struct inode *new_inode, struct dentry *new_dentry)
2832 {
2833         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2834 }
2835
2836 static int selinux_inode_readlink(struct dentry *dentry)
2837 {
2838         const struct cred *cred = current_cred();
2839
2840         return dentry_has_perm(cred, dentry, FILE__READ);
2841 }
2842
2843 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2844 {
2845         const struct cred *cred = current_cred();
2846
2847         return dentry_has_perm(cred, dentry, FILE__READ);
2848 }
2849
2850 static noinline int audit_inode_permission(struct inode *inode,
2851                                            u32 perms, u32 audited, u32 denied,
2852                                            int result,
2853                                            unsigned flags)
2854 {
2855         struct common_audit_data ad;
2856         struct inode_security_struct *isec = inode->i_security;
2857         int rc;
2858
2859         ad.type = LSM_AUDIT_DATA_INODE;
2860         ad.u.inode = inode;
2861
2862         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2863                             audited, denied, result, &ad, flags);
2864         if (rc)
2865                 return rc;
2866         return 0;
2867 }
2868
2869 static int selinux_inode_permission(struct inode *inode, int mask)
2870 {
2871         const struct cred *cred = current_cred();
2872         u32 perms;
2873         bool from_access;
2874         unsigned flags = mask & MAY_NOT_BLOCK;
2875         struct inode_security_struct *isec;
2876         u32 sid;
2877         struct av_decision avd;
2878         int rc, rc2;
2879         u32 audited, denied;
2880
2881         from_access = mask & MAY_ACCESS;
2882         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2883
2884         /* No permission to check.  Existence test. */
2885         if (!mask)
2886                 return 0;
2887
2888         validate_creds(cred);
2889
2890         if (unlikely(IS_PRIVATE(inode)))
2891                 return 0;
2892
2893         perms = file_mask_to_av(inode->i_mode, mask);
2894
2895         sid = cred_sid(cred);
2896         isec = inode->i_security;
2897
2898         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2899         audited = avc_audit_required(perms, &avd, rc,
2900                                      from_access ? FILE__AUDIT_ACCESS : 0,
2901                                      &denied);
2902         if (likely(!audited))
2903                 return rc;
2904
2905         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2906         if (rc2)
2907                 return rc2;
2908         return rc;
2909 }
2910
2911 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2912 {
2913         const struct cred *cred = current_cred();
2914         unsigned int ia_valid = iattr->ia_valid;
2915         __u32 av = FILE__WRITE;
2916
2917         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2918         if (ia_valid & ATTR_FORCE) {
2919                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2920                               ATTR_FORCE);
2921                 if (!ia_valid)
2922                         return 0;
2923         }
2924
2925         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2926                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2927                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2928
2929         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2930                 av |= FILE__OPEN;
2931
2932         return dentry_has_perm(cred, dentry, av);
2933 }
2934
2935 static int selinux_inode_getattr(const struct path *path)
2936 {
2937         return path_has_perm(current_cred(), path, FILE__GETATTR);
2938 }
2939
2940 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2941 {
2942         const struct cred *cred = current_cred();
2943
2944         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2945                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2946                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2947                         if (!capable(CAP_SETFCAP))
2948                                 return -EPERM;
2949                 } else if (!capable(CAP_SYS_ADMIN)) {
2950                         /* A different attribute in the security namespace.
2951                            Restrict to administrator. */
2952                         return -EPERM;
2953                 }
2954         }
2955
2956         /* Not an attribute we recognize, so just check the
2957            ordinary setattr permission. */
2958         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2959 }
2960
2961 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2962                                   const void *value, size_t size, int flags)
2963 {
2964         struct inode *inode = d_backing_inode(dentry);
2965         struct inode_security_struct *isec = inode->i_security;
2966         struct superblock_security_struct *sbsec;
2967         struct common_audit_data ad;
2968         u32 newsid, sid = current_sid();
2969         int rc = 0;
2970
2971         if (strcmp(name, XATTR_NAME_SELINUX))
2972                 return selinux_inode_setotherxattr(dentry, name);
2973
2974         sbsec = inode->i_sb->s_security;
2975         if (!(sbsec->flags & SBLABEL_MNT))
2976                 return -EOPNOTSUPP;
2977
2978         if (!inode_owner_or_capable(inode))
2979                 return -EPERM;
2980
2981         ad.type = LSM_AUDIT_DATA_DENTRY;
2982         ad.u.dentry = dentry;
2983
2984         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2985                           FILE__RELABELFROM, &ad);
2986         if (rc)
2987                 return rc;
2988
2989         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2990         if (rc == -EINVAL) {
2991                 if (!capable(CAP_MAC_ADMIN)) {
2992                         struct audit_buffer *ab;
2993                         size_t audit_size;
2994                         const char *str;
2995
2996                         /* We strip a nul only if it is at the end, otherwise the
2997                          * context contains a nul and we should audit that */
2998                         if (value) {
2999                                 str = value;
3000                                 if (str[size - 1] == '\0')
3001                                         audit_size = size - 1;
3002                                 else
3003                                         audit_size = size;
3004                         } else {
3005                                 str = "";
3006                                 audit_size = 0;
3007                         }
3008                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3009                         audit_log_format(ab, "op=setxattr invalid_context=");
3010                         audit_log_n_untrustedstring(ab, value, audit_size);
3011                         audit_log_end(ab);
3012
3013                         return rc;
3014                 }
3015                 rc = security_context_to_sid_force(value, size, &newsid);
3016         }
3017         if (rc)
3018                 return rc;
3019
3020         rc = avc_has_perm(sid, newsid, isec->sclass,
3021                           FILE__RELABELTO, &ad);
3022         if (rc)
3023                 return rc;
3024
3025         rc = security_validate_transition(isec->sid, newsid, sid,
3026                                           isec->sclass);
3027         if (rc)
3028                 return rc;
3029
3030         return avc_has_perm(newsid,
3031                             sbsec->sid,
3032                             SECCLASS_FILESYSTEM,
3033                             FILESYSTEM__ASSOCIATE,
3034                             &ad);
3035 }
3036
3037 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3038                                         const void *value, size_t size,
3039                                         int flags)
3040 {
3041         struct inode *inode = d_backing_inode(dentry);
3042         struct inode_security_struct *isec = inode->i_security;
3043         u32 newsid;
3044         int rc;
3045
3046         if (strcmp(name, XATTR_NAME_SELINUX)) {
3047                 /* Not an attribute we recognize, so nothing to do. */
3048                 return;
3049         }
3050
3051         rc = security_context_to_sid_force(value, size, &newsid);
3052         if (rc) {
3053                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3054                        "for (%s, %lu), rc=%d\n",
3055                        inode->i_sb->s_id, inode->i_ino, -rc);
3056                 return;
3057         }
3058
3059         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3060         isec->sid = newsid;
3061         isec->initialized = 1;
3062
3063         return;
3064 }
3065
3066 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3067 {
3068         const struct cred *cred = current_cred();
3069
3070         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3071 }
3072
3073 static int selinux_inode_listxattr(struct dentry *dentry)
3074 {
3075         const struct cred *cred = current_cred();
3076
3077         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3078 }
3079
3080 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3081 {
3082         if (strcmp(name, XATTR_NAME_SELINUX))
3083                 return selinux_inode_setotherxattr(dentry, name);
3084
3085         /* No one is allowed to remove a SELinux security label.
3086            You can change the label, but all data must be labeled. */
3087         return -EACCES;
3088 }
3089
3090 /*
3091  * Copy the inode security context value to the user.
3092  *
3093  * Permission check is handled by selinux_inode_getxattr hook.
3094  */
3095 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3096 {
3097         u32 size;
3098         int error;
3099         char *context = NULL;
3100         struct inode_security_struct *isec = inode->i_security;
3101
3102         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3103                 return -EOPNOTSUPP;
3104
3105         /*
3106          * If the caller has CAP_MAC_ADMIN, then get the raw context
3107          * value even if it is not defined by current policy; otherwise,
3108          * use the in-core value under current policy.
3109          * Use the non-auditing forms of the permission checks since
3110          * getxattr may be called by unprivileged processes commonly
3111          * and lack of permission just means that we fall back to the
3112          * in-core context value, not a denial.
3113          */
3114         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3115                             SECURITY_CAP_NOAUDIT);
3116         if (!error)
3117                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3118                                             SECURITY_CAP_NOAUDIT);
3119         if (!error)
3120                 error = security_sid_to_context_force(isec->sid, &context,
3121                                                       &size);
3122         else
3123                 error = security_sid_to_context(isec->sid, &context, &size);
3124         if (error)
3125                 return error;
3126         error = size;
3127         if (alloc) {
3128                 *buffer = context;
3129                 goto out_nofree;
3130         }
3131         kfree(context);
3132 out_nofree:
3133         return error;
3134 }
3135
3136 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3137                                      const void *value, size_t size, int flags)
3138 {
3139         struct inode_security_struct *isec = inode->i_security;
3140         u32 newsid;
3141         int rc;
3142
3143         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3144                 return -EOPNOTSUPP;
3145
3146         if (!value || !size)
3147                 return -EACCES;
3148
3149         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3150         if (rc)
3151                 return rc;
3152
3153         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3154         isec->sid = newsid;
3155         isec->initialized = 1;
3156         return 0;
3157 }
3158
3159 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3160 {
3161         const int len = sizeof(XATTR_NAME_SELINUX);
3162         if (buffer && len <= buffer_size)
3163                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3164         return len;
3165 }
3166
3167 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3168 {
3169         struct inode_security_struct *isec = inode->i_security;
3170         *secid = isec->sid;
3171 }
3172
3173 /* file security operations */
3174
3175 static int selinux_revalidate_file_permission(struct file *file, int mask)
3176 {
3177         const struct cred *cred = current_cred();
3178         struct inode *inode = file_inode(file);
3179
3180         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3181         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3182                 mask |= MAY_APPEND;
3183
3184         return file_has_perm(cred, file,
3185                              file_mask_to_av(inode->i_mode, mask));
3186 }
3187
3188 static int selinux_file_permission(struct file *file, int mask)
3189 {
3190         struct inode *inode = file_inode(file);
3191         struct file_security_struct *fsec = file->f_security;
3192         struct inode_security_struct *isec = inode->i_security;
3193         u32 sid = current_sid();
3194
3195         if (!mask)
3196                 /* No permission to check.  Existence test. */
3197                 return 0;
3198
3199         if (sid == fsec->sid && fsec->isid == isec->sid &&
3200             fsec->pseqno == avc_policy_seqno())
3201                 /* No change since file_open check. */
3202                 return 0;
3203
3204         return selinux_revalidate_file_permission(file, mask);
3205 }
3206
3207 static int selinux_file_alloc_security(struct file *file)
3208 {
3209         return file_alloc_security(file);
3210 }
3211
3212 static void selinux_file_free_security(struct file *file)
3213 {
3214         file_free_security(file);
3215 }
3216
3217 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3218                               unsigned long arg)
3219 {
3220         const struct cred *cred = current_cred();
3221         int error = 0;
3222
3223         switch (cmd) {
3224         case FIONREAD:
3225         /* fall through */
3226         case FIBMAP:
3227         /* fall through */
3228         case FIGETBSZ:
3229         /* fall through */
3230         case FS_IOC_GETFLAGS:
3231         /* fall through */
3232         case FS_IOC_GETVERSION:
3233                 error = file_has_perm(cred, file, FILE__GETATTR);
3234                 break;
3235
3236         case FS_IOC_SETFLAGS:
3237         /* fall through */
3238         case FS_IOC_SETVERSION:
3239                 error = file_has_perm(cred, file, FILE__SETATTR);
3240                 break;
3241
3242         /* sys_ioctl() checks */
3243         case FIONBIO:
3244         /* fall through */
3245         case FIOASYNC:
3246                 error = file_has_perm(cred, file, 0);
3247                 break;
3248
3249         case KDSKBENT:
3250         case KDSKBSENT:
3251                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3252                                             SECURITY_CAP_AUDIT);
3253                 break;
3254
3255         /* default case assumes that the command will go
3256          * to the file's ioctl() function.
3257          */
3258         default:
3259                 error = file_has_perm(cred, file, FILE__IOCTL);
3260         }
3261         return error;
3262 }
3263
3264 static int default_noexec;
3265
3266 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3267 {
3268         const struct cred *cred = current_cred();
3269         int rc = 0;
3270
3271         if (default_noexec &&
3272             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3273                 /*
3274                  * We are making executable an anonymous mapping or a
3275                  * private file mapping that will also be writable.
3276                  * This has an additional check.
3277                  */
3278                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3279                 if (rc)
3280                         goto error;
3281         }
3282
3283         if (file) {
3284                 /* read access is always possible with a mapping */
3285                 u32 av = FILE__READ;
3286
3287                 /* write access only matters if the mapping is shared */
3288                 if (shared && (prot & PROT_WRITE))
3289                         av |= FILE__WRITE;
3290
3291                 if (prot & PROT_EXEC)
3292                         av |= FILE__EXECUTE;
3293
3294                 return file_has_perm(cred, file, av);
3295         }
3296
3297 error:
3298         return rc;
3299 }
3300
3301 static int selinux_mmap_addr(unsigned long addr)
3302 {
3303         int rc = 0;
3304
3305         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3306                 u32 sid = current_sid();
3307                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3308                                   MEMPROTECT__MMAP_ZERO, NULL);
3309         }
3310
3311         return rc;
3312 }
3313
3314 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3315                              unsigned long prot, unsigned long flags)
3316 {
3317         if (selinux_checkreqprot)
3318                 prot = reqprot;
3319
3320         return file_map_prot_check(file, prot,
3321                                    (flags & MAP_TYPE) == MAP_SHARED);
3322 }
3323
3324 static int selinux_file_mprotect(struct vm_area_struct *vma,
3325                                  unsigned long reqprot,
3326                                  unsigned long prot)
3327 {
3328         const struct cred *cred = current_cred();
3329
3330         if (selinux_checkreqprot)
3331                 prot = reqprot;
3332
3333         if (default_noexec &&
3334             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3335                 int rc = 0;
3336                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3337                     vma->vm_end <= vma->vm_mm->brk) {
3338                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3339                 } else if (!vma->vm_file &&
3340                            vma->vm_start <= vma->vm_mm->start_stack &&
3341                            vma->vm_end >= vma->vm_mm->start_stack) {
3342                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3343                 } else if (vma->vm_file && vma->anon_vma) {
3344                         /*
3345                          * We are making executable a file mapping that has
3346                          * had some COW done. Since pages might have been
3347                          * written, check ability to execute the possibly
3348                          * modified content.  This typically should only
3349                          * occur for text relocations.
3350                          */
3351                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3352                 }
3353                 if (rc)
3354                         return rc;
3355         }
3356
3357         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3358 }
3359
3360 static int selinux_file_lock(struct file *file, unsigned int cmd)
3361 {
3362         const struct cred *cred = current_cred();
3363
3364         return file_has_perm(cred, file, FILE__LOCK);
3365 }
3366
3367 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3368                               unsigned long arg)
3369 {
3370         const struct cred *cred = current_cred();
3371         int err = 0;
3372
3373         switch (cmd) {
3374         case F_SETFL:
3375                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3376                         err = file_has_perm(cred, file, FILE__WRITE);
3377                         break;
3378                 }
3379                 /* fall through */
3380         case F_SETOWN:
3381         case F_SETSIG:
3382         case F_GETFL:
3383         case F_GETOWN:
3384         case F_GETSIG:
3385         case F_GETOWNER_UIDS:
3386                 /* Just check FD__USE permission */
3387                 err = file_has_perm(cred, file, 0);
3388                 break;
3389         case F_GETLK:
3390         case F_SETLK:
3391         case F_SETLKW:
3392         case F_OFD_GETLK:
3393         case F_OFD_SETLK:
3394         case F_OFD_SETLKW:
3395 #if BITS_PER_LONG == 32
3396         case F_GETLK64:
3397         case F_SETLK64:
3398         case F_SETLKW64:
3399 #endif
3400                 err = file_has_perm(cred, file, FILE__LOCK);
3401                 break;
3402         }
3403
3404         return err;
3405 }
3406
3407 static void selinux_file_set_fowner(struct file *file)
3408 {
3409         struct file_security_struct *fsec;
3410
3411         fsec = file->f_security;
3412         fsec->fown_sid = current_sid();
3413 }
3414
3415 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3416                                        struct fown_struct *fown, int signum)
3417 {
3418         struct file *file;
3419         u32 sid = task_sid(tsk);
3420         u32 perm;
3421         struct file_security_struct *fsec;
3422
3423         /* struct fown_struct is never outside the context of a struct file */
3424         file = container_of(fown, struct file, f_owner);
3425
3426         fsec = file->f_security;
3427
3428         if (!signum)
3429                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3430         else
3431                 perm = signal_to_av(signum);
3432
3433         return avc_has_perm(fsec->fown_sid, sid,
3434                             SECCLASS_PROCESS, perm, NULL);
3435 }
3436
3437 static int selinux_file_receive(struct file *file)
3438 {
3439         const struct cred *cred = current_cred();
3440
3441         return file_has_perm(cred, file, file_to_av(file));
3442 }
3443
3444 static int selinux_file_open(struct file *file, const struct cred *cred)
3445 {
3446         struct file_security_struct *fsec;
3447         struct inode_security_struct *isec;
3448
3449         fsec = file->f_security;
3450         isec = file_inode(file)->i_security;
3451         /*
3452          * Save inode label and policy sequence number
3453          * at open-time so that selinux_file_permission
3454          * can determine whether revalidation is necessary.
3455          * Task label is already saved in the file security
3456          * struct as its SID.
3457          */
3458         fsec->isid = isec->sid;
3459         fsec->pseqno = avc_policy_seqno();
3460         /*
3461          * Since the inode label or policy seqno may have changed
3462          * between the selinux_inode_permission check and the saving
3463          * of state above, recheck that access is still permitted.
3464          * Otherwise, access might never be revalidated against the
3465          * new inode label or new policy.
3466          * This check is not redundant - do not remove.
3467          */
3468         return file_path_has_perm(cred, file, open_file_to_av(file));
3469 }
3470
3471 /* task security operations */
3472
3473 static int selinux_task_create(unsigned long clone_flags)
3474 {
3475         return current_has_perm(current, PROCESS__FORK);
3476 }
3477
3478 /*
3479  * allocate the SELinux part of blank credentials
3480  */
3481 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3482 {
3483         struct task_security_struct *tsec;
3484
3485         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3486         if (!tsec)
3487                 return -ENOMEM;
3488
3489         cred->security = tsec;
3490         return 0;
3491 }
3492
3493 /*
3494  * detach and free the LSM part of a set of credentials
3495  */
3496 static void selinux_cred_free(struct cred *cred)
3497 {
3498         struct task_security_struct *tsec = cred->security;
3499
3500         /*
3501          * cred->security == NULL if security_cred_alloc_blank() or
3502          * security_prepare_creds() returned an error.
3503          */
3504         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3505         cred->security = (void *) 0x7UL;
3506         kfree(tsec);
3507 }
3508
3509 /*
3510  * prepare a new set of credentials for modification
3511  */
3512 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3513                                 gfp_t gfp)
3514 {
3515         const struct task_security_struct *old_tsec;
3516         struct task_security_struct *tsec;
3517
3518         old_tsec = old->security;
3519
3520         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3521         if (!tsec)
3522                 return -ENOMEM;
3523
3524         new->security = tsec;
3525         return 0;
3526 }
3527
3528 /*
3529  * transfer the SELinux data to a blank set of creds
3530  */
3531 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3532 {
3533         const struct task_security_struct *old_tsec = old->security;
3534         struct task_security_struct *tsec = new->security;
3535
3536         *tsec = *old_tsec;
3537 }
3538
3539 /*
3540  * set the security data for a kernel service
3541  * - all the creation contexts are set to unlabelled
3542  */
3543 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3544 {
3545         struct task_security_struct *tsec = new->security;
3546         u32 sid = current_sid();
3547         int ret;
3548
3549         ret = avc_has_perm(sid, secid,
3550                            SECCLASS_KERNEL_SERVICE,
3551                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3552                            NULL);
3553         if (ret == 0) {
3554                 tsec->sid = secid;
3555                 tsec->create_sid = 0;
3556                 tsec->keycreate_sid = 0;
3557                 tsec->sockcreate_sid = 0;
3558         }
3559         return ret;
3560 }
3561
3562 /*
3563  * set the file creation context in a security record to the same as the
3564  * objective context of the specified inode
3565  */
3566 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3567 {
3568         struct inode_security_struct *isec = inode->i_security;
3569         struct task_security_struct *tsec = new->security;
3570         u32 sid = current_sid();
3571         int ret;
3572
3573         ret = avc_has_perm(sid, isec->sid,
3574                            SECCLASS_KERNEL_SERVICE,
3575                            KERNEL_SERVICE__CREATE_FILES_AS,
3576                            NULL);
3577
3578         if (ret == 0)
3579                 tsec->create_sid = isec->sid;
3580         return ret;
3581 }
3582
3583 static int selinux_kernel_module_request(char *kmod_name)
3584 {
3585         u32 sid;
3586         struct common_audit_data ad;
3587
3588         sid = task_sid(current);
3589
3590         ad.type = LSM_AUDIT_DATA_KMOD;
3591         ad.u.kmod_name = kmod_name;
3592
3593         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3594                             SYSTEM__MODULE_REQUEST, &ad);
3595 }
3596
3597 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3598 {
3599         return current_has_perm(p, PROCESS__SETPGID);
3600 }
3601
3602 static int selinux_task_getpgid(struct task_struct *p)
3603 {
3604         return current_has_perm(p, PROCESS__GETPGID);
3605 }
3606
3607 static int selinux_task_getsid(struct task_struct *p)
3608 {
3609         return current_has_perm(p, PROCESS__GETSESSION);
3610 }
3611
3612 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3613 {
3614         *secid = task_sid(p);
3615 }
3616
3617 static int selinux_task_setnice(struct task_struct *p, int nice)
3618 {
3619         return current_has_perm(p, PROCESS__SETSCHED);
3620 }
3621
3622 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3623 {
3624         return current_has_perm(p, PROCESS__SETSCHED);
3625 }
3626
3627 static int selinux_task_getioprio(struct task_struct *p)
3628 {
3629         return current_has_perm(p, PROCESS__GETSCHED);
3630 }
3631
3632 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3633                 struct rlimit *new_rlim)
3634 {
3635         struct rlimit *old_rlim = p->signal->rlim + resource;
3636
3637         /* Control the ability to change the hard limit (whether
3638            lowering or raising it), so that the hard limit can
3639            later be used as a safe reset point for the soft limit
3640            upon context transitions.  See selinux_bprm_committing_creds. */
3641         if (old_rlim->rlim_max != new_rlim->rlim_max)
3642                 return current_has_perm(p, PROCESS__SETRLIMIT);
3643
3644         return 0;
3645 }
3646
3647 static int selinux_task_setscheduler(struct task_struct *p)
3648 {
3649         return current_has_perm(p, PROCESS__SETSCHED);
3650 }
3651
3652 static int selinux_task_getscheduler(struct task_struct *p)
3653 {
3654         return current_has_perm(p, PROCESS__GETSCHED);
3655 }
3656
3657 static int selinux_task_movememory(struct task_struct *p)
3658 {
3659         return current_has_perm(p, PROCESS__SETSCHED);
3660 }
3661
3662 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3663                                 int sig, u32 secid)
3664 {
3665         u32 perm;
3666         int rc;
3667
3668         if (!sig)
3669                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3670         else
3671                 perm = signal_to_av(sig);
3672         if (secid)
3673                 rc = avc_has_perm(secid, task_sid(p),
3674                                   SECCLASS_PROCESS, perm, NULL);
3675         else
3676                 rc = current_has_perm(p, perm);
3677         return rc;
3678 }
3679
3680 static int selinux_task_wait(struct task_struct *p)
3681 {
3682         return task_has_perm(p, current, PROCESS__SIGCHLD);
3683 }
3684
3685 static void selinux_task_to_inode(struct task_struct *p,
3686                                   struct inode *inode)
3687 {
3688         struct inode_security_struct *isec = inode->i_security;
3689         u32 sid = task_sid(p);
3690
3691         isec->sid = sid;
3692         isec->initialized = 1;
3693 }
3694
3695 /* Returns error only if unable to parse addresses */
3696 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3697                         struct common_audit_data *ad, u8 *proto)
3698 {
3699         int offset, ihlen, ret = -EINVAL;
3700         struct iphdr _iph, *ih;
3701
3702         offset = skb_network_offset(skb);
3703         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3704         if (ih == NULL)
3705                 goto out;
3706
3707         ihlen = ih->ihl * 4;
3708         if (ihlen < sizeof(_iph))
3709                 goto out;
3710
3711         ad->u.net->v4info.saddr = ih->saddr;
3712         ad->u.net->v4info.daddr = ih->daddr;
3713         ret = 0;
3714
3715         if (proto)
3716                 *proto = ih->protocol;
3717
3718         switch (ih->protocol) {
3719         case IPPROTO_TCP: {
3720                 struct tcphdr _tcph, *th;
3721
3722                 if (ntohs(ih->frag_off) & IP_OFFSET)
3723                         break;
3724
3725                 offset += ihlen;
3726                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3727                 if (th == NULL)
3728                         break;
3729
3730                 ad->u.net->sport = th->source;
3731                 ad->u.net->dport = th->dest;
3732                 break;
3733         }
3734
3735         case IPPROTO_UDP: {
3736                 struct udphdr _udph, *uh;
3737
3738                 if (ntohs(ih->frag_off) & IP_OFFSET)
3739                         break;
3740
3741                 offset += ihlen;
3742                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3743                 if (uh == NULL)
3744                         break;
3745
3746                 ad->u.net->sport = uh->source;
3747                 ad->u.net->dport = uh->dest;
3748                 break;
3749         }
3750
3751         case IPPROTO_DCCP: {
3752                 struct dccp_hdr _dccph, *dh;
3753
3754                 if (ntohs(ih->frag_off) & IP_OFFSET)
3755                         break;
3756
3757                 offset += ihlen;
3758                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3759                 if (dh == NULL)
3760                         break;
3761
3762                 ad->u.net->sport = dh->dccph_sport;
3763                 ad->u.net->dport = dh->dccph_dport;
3764                 break;
3765         }
3766
3767         default:
3768                 break;
3769         }
3770 out:
3771         return ret;
3772 }
3773
3774 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3775
3776 /* Returns error only if unable to parse addresses */
3777 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3778                         struct common_audit_data *ad, u8 *proto)
3779 {
3780         u8 nexthdr;
3781         int ret = -EINVAL, offset;
3782         struct ipv6hdr _ipv6h, *ip6;
3783         __be16 frag_off;
3784
3785         offset = skb_network_offset(skb);
3786         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3787         if (ip6 == NULL)
3788                 goto out;
3789
3790         ad->u.net->v6info.saddr = ip6->saddr;
3791         ad->u.net->v6info.daddr = ip6->daddr;
3792         ret = 0;
3793
3794         nexthdr = ip6->nexthdr;
3795         offset += sizeof(_ipv6h);
3796         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3797         if (offset < 0)
3798                 goto out;
3799
3800         if (proto)
3801                 *proto = nexthdr;
3802
3803         switch (nexthdr) {
3804         case IPPROTO_TCP: {
3805                 struct tcphdr _tcph, *th;
3806
3807                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3808                 if (th == NULL)
3809                         break;
3810
3811                 ad->u.net->sport = th->source;
3812                 ad->u.net->dport = th->dest;
3813                 break;
3814         }
3815
3816         case IPPROTO_UDP: {
3817                 struct udphdr _udph, *uh;
3818
3819                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3820                 if (uh == NULL)
3821                         break;
3822
3823                 ad->u.net->sport = uh->source;
3824                 ad->u.net->dport = uh->dest;
3825                 break;
3826         }
3827
3828         case IPPROTO_DCCP: {
3829                 struct dccp_hdr _dccph, *dh;
3830
3831                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3832                 if (dh == NULL)
3833                         break;
3834
3835                 ad->u.net->sport = dh->dccph_sport;
3836                 ad->u.net->dport = dh->dccph_dport;
3837                 break;
3838         }
3839
3840         /* includes fragments */
3841         default:
3842                 break;
3843         }
3844 out:
3845         return ret;
3846 }
3847
3848 #endif /* IPV6 */
3849
3850 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3851                              char **_addrp, int src, u8 *proto)
3852 {
3853         char *addrp;
3854         int ret;
3855
3856         switch (ad->u.net->family) {
3857         case PF_INET:
3858                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3859                 if (ret)
3860                         goto parse_error;
3861                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3862                                        &ad->u.net->v4info.daddr);
3863                 goto okay;
3864
3865 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3866         case PF_INET6:
3867                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3868                 if (ret)
3869                         goto parse_error;
3870                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3871                                        &ad->u.net->v6info.daddr);
3872                 goto okay;
3873 #endif  /* IPV6 */
3874         default:
3875                 addrp = NULL;
3876                 goto okay;
3877         }
3878
3879 parse_error:
3880         printk(KERN_WARNING
3881                "SELinux: failure in selinux_parse_skb(),"
3882                " unable to parse packet\n");
3883         return ret;
3884
3885 okay:
3886         if (_addrp)
3887                 *_addrp = addrp;
3888         return 0;
3889 }
3890
3891 /**
3892  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3893  * @skb: the packet
3894  * @family: protocol family
3895  * @sid: the packet's peer label SID
3896  *
3897  * Description:
3898  * Check the various different forms of network peer labeling and determine
3899  * the peer label/SID for the packet; most of the magic actually occurs in
3900  * the security server function security_net_peersid_cmp().  The function
3901  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3902  * or -EACCES if @sid is invalid due to inconsistencies with the different
3903  * peer labels.
3904  *
3905  */
3906 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3907 {
3908         int err;
3909         u32 xfrm_sid;
3910         u32 nlbl_sid;
3911         u32 nlbl_type;
3912
3913         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3914         if (unlikely(err))
3915                 return -EACCES;
3916         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3917         if (unlikely(err))
3918                 return -EACCES;
3919
3920         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3921         if (unlikely(err)) {
3922                 printk(KERN_WARNING
3923                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3924                        " unable to determine packet's peer label\n");
3925                 return -EACCES;
3926         }
3927
3928         return 0;
3929 }
3930
3931 /**
3932  * selinux_conn_sid - Determine the child socket label for a connection
3933  * @sk_sid: the parent socket's SID
3934  * @skb_sid: the packet's SID
3935  * @conn_sid: the resulting connection SID
3936  *
3937  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3938  * combined with the MLS information from @skb_sid in order to create
3939  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3940  * of @sk_sid.  Returns zero on success, negative values on failure.
3941  *
3942  */
3943 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3944 {
3945         int err = 0;
3946
3947         if (skb_sid != SECSID_NULL)
3948                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3949         else
3950                 *conn_sid = sk_sid;
3951
3952         return err;
3953 }
3954
3955 /* socket security operations */
3956
3957 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3958                                  u16 secclass, u32 *socksid)
3959 {
3960         if (tsec->sockcreate_sid > SECSID_NULL) {
3961                 *socksid = tsec->sockcreate_sid;
3962                 return 0;
3963         }
3964
3965         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3966                                        socksid);
3967 }
3968
3969 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3970 {
3971         struct sk_security_struct *sksec = sk->sk_security;
3972         struct common_audit_data ad;
3973         struct lsm_network_audit net = {0,};
3974         u32 tsid = task_sid(task);
3975
3976         if (sksec->sid == SECINITSID_KERNEL)
3977                 return 0;
3978
3979         ad.type = LSM_AUDIT_DATA_NET;
3980         ad.u.net = &net;
3981         ad.u.net->sk = sk;
3982
3983         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3984 }
3985
3986 static int selinux_socket_create(int family, int type,
3987                                  int protocol, int kern)
3988 {
3989         const struct task_security_struct *tsec = current_security();
3990         u32 newsid;
3991         u16 secclass;
3992         int rc;
3993
3994         if (kern)
3995                 return 0;
3996
3997         secclass = socket_type_to_security_class(family, type, protocol);
3998         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3999         if (rc)
4000                 return rc;
4001
4002         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4003 }
4004
4005 static int selinux_socket_post_create(struct socket *sock, int family,
4006                                       int type, int protocol, int kern)
4007 {
4008         const struct task_security_struct *tsec = current_security();
4009         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4010         struct sk_security_struct *sksec;
4011         int err = 0;
4012
4013         isec->sclass = socket_type_to_security_class(family, type, protocol);
4014
4015         if (kern)
4016                 isec->sid = SECINITSID_KERNEL;
4017         else {
4018                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4019                 if (err)
4020                         return err;
4021         }
4022
4023         isec->initialized = 1;
4024
4025         if (sock->sk) {
4026                 sksec = sock->sk->sk_security;
4027                 sksec->sid = isec->sid;
4028                 sksec->sclass = isec->sclass;
4029                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4030         }
4031
4032         return err;
4033 }
4034
4035 /* Range of port numbers used to automatically bind.
4036    Need to determine whether we should perform a name_bind
4037    permission check between the socket and the port number. */
4038
4039 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4040 {
4041         struct sock *sk = sock->sk;
4042         u16 family;
4043         int err;
4044
4045         err = sock_has_perm(current, sk, SOCKET__BIND);
4046         if (err)
4047                 goto out;
4048
4049         /*
4050          * If PF_INET or PF_INET6, check name_bind permission for the port.
4051          * Multiple address binding for SCTP is not supported yet: we just
4052          * check the first address now.
4053          */
4054         family = sk->sk_family;
4055         if (family == PF_INET || family == PF_INET6) {
4056                 char *addrp;
4057                 struct sk_security_struct *sksec = sk->sk_security;
4058                 struct common_audit_data ad;
4059                 struct lsm_network_audit net = {0,};
4060                 struct sockaddr_in *addr4 = NULL;
4061                 struct sockaddr_in6 *addr6 = NULL;
4062                 unsigned short snum;
4063                 u32 sid, node_perm;
4064
4065                 if (family == PF_INET) {
4066                         addr4 = (struct sockaddr_in *)address;
4067                         snum = ntohs(addr4->sin_port);
4068                         addrp = (char *)&addr4->sin_addr.s_addr;
4069                 } else {
4070                         addr6 = (struct sockaddr_in6 *)address;
4071                         snum = ntohs(addr6->sin6_port);
4072                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4073                 }
4074
4075                 if (snum) {
4076                         int low, high;
4077
4078                         inet_get_local_port_range(sock_net(sk), &low, &high);
4079
4080                         if (snum < max(PROT_SOCK, low) || snum > high) {
4081                                 err = sel_netport_sid(sk->sk_protocol,
4082                                                       snum, &sid);
4083                                 if (err)
4084                                         goto out;
4085                                 ad.type = LSM_AUDIT_DATA_NET;
4086                                 ad.u.net = &net;
4087                                 ad.u.net->sport = htons(snum);
4088                                 ad.u.net->family = family;
4089                                 err = avc_has_perm(sksec->sid, sid,
4090                                                    sksec->sclass,
4091                                                    SOCKET__NAME_BIND, &ad);
4092                                 if (err)
4093                                         goto out;
4094                         }
4095                 }
4096
4097                 switch (sksec->sclass) {
4098                 case SECCLASS_TCP_SOCKET:
4099                         node_perm = TCP_SOCKET__NODE_BIND;
4100                         break;
4101
4102                 case SECCLASS_UDP_SOCKET:
4103                         node_perm = UDP_SOCKET__NODE_BIND;
4104                         break;
4105
4106                 case SECCLASS_DCCP_SOCKET:
4107                         node_perm = DCCP_SOCKET__NODE_BIND;
4108                         break;
4109
4110                 default:
4111                         node_perm = RAWIP_SOCKET__NODE_BIND;
4112                         break;
4113                 }
4114
4115                 err = sel_netnode_sid(addrp, family, &sid);
4116                 if (err)
4117                         goto out;
4118
4119                 ad.type = LSM_AUDIT_DATA_NET;
4120                 ad.u.net = &net;
4121                 ad.u.net->sport = htons(snum);
4122                 ad.u.net->family = family;
4123
4124                 if (family == PF_INET)
4125                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4126                 else
4127                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4128
4129                 err = avc_has_perm(sksec->sid, sid,
4130                                    sksec->sclass, node_perm, &ad);
4131                 if (err)
4132                         goto out;
4133         }
4134 out:
4135         return err;
4136 }
4137
4138 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4139 {
4140         struct sock *sk = sock->sk;
4141         struct sk_security_struct *sksec = sk->sk_security;
4142         int err;
4143
4144         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4145         if (err)
4146                 return err;
4147
4148         /*
4149          * If a TCP or DCCP socket, check name_connect permission for the port.
4150          */
4151         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4152             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4153                 struct common_audit_data ad;
4154                 struct lsm_network_audit net = {0,};
4155                 struct sockaddr_in *addr4 = NULL;
4156                 struct sockaddr_in6 *addr6 = NULL;
4157                 unsigned short snum;
4158                 u32 sid, perm;
4159
4160                 if (sk->sk_family == PF_INET) {
4161                         addr4 = (struct sockaddr_in *)address;
4162                         if (addrlen < sizeof(struct sockaddr_in))
4163                                 return -EINVAL;
4164                         snum = ntohs(addr4->sin_port);
4165                 } else {
4166                         addr6 = (struct sockaddr_in6 *)address;
4167                         if (addrlen < SIN6_LEN_RFC2133)
4168                                 return -EINVAL;
4169                         snum = ntohs(addr6->sin6_port);
4170                 }
4171
4172                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4173                 if (err)
4174                         goto out;
4175
4176                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4177                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4178
4179                 ad.type = LSM_AUDIT_DATA_NET;
4180                 ad.u.net = &net;
4181                 ad.u.net->dport = htons(snum);
4182                 ad.u.net->family = sk->sk_family;
4183                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4184                 if (err)
4185                         goto out;
4186         }
4187
4188         err = selinux_netlbl_socket_connect(sk, address);
4189
4190 out:
4191         return err;
4192 }
4193
4194 static int selinux_socket_listen(struct socket *sock, int backlog)
4195 {
4196         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4197 }
4198
4199 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4200 {
4201         int err;
4202         struct inode_security_struct *isec;
4203         struct inode_security_struct *newisec;
4204
4205         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4206         if (err)
4207                 return err;
4208
4209         newisec = SOCK_INODE(newsock)->i_security;
4210
4211         isec = SOCK_INODE(sock)->i_security;
4212         newisec->sclass = isec->sclass;
4213         newisec->sid = isec->sid;
4214         newisec->initialized = 1;
4215
4216         return 0;
4217 }
4218
4219 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4220                                   int size)
4221 {
4222         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4223 }
4224
4225 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4226                                   int size, int flags)
4227 {
4228         return sock_has_perm(current, sock->sk, SOCKET__READ);
4229 }
4230
4231 static int selinux_socket_getsockname(struct socket *sock)
4232 {
4233         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4234 }
4235
4236 static int selinux_socket_getpeername(struct socket *sock)
4237 {
4238         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4239 }
4240
4241 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4242 {
4243         int err;
4244
4245         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4246         if (err)
4247                 return err;
4248
4249         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4250 }
4251
4252 static int selinux_socket_getsockopt(struct socket *sock, int level,
4253                                      int optname)
4254 {
4255         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4256 }
4257
4258 static int selinux_socket_shutdown(struct socket *sock, int how)
4259 {
4260         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4261 }
4262
4263 static int selinux_socket_unix_stream_connect(struct sock *sock,
4264                                               struct sock *other,
4265                                               struct sock *newsk)
4266 {
4267         struct sk_security_struct *sksec_sock = sock->sk_security;
4268         struct sk_security_struct *sksec_other = other->sk_security;
4269         struct sk_security_struct *sksec_new = newsk->sk_security;
4270         struct common_audit_data ad;
4271         struct lsm_network_audit net = {0,};
4272         int err;
4273
4274         ad.type = LSM_AUDIT_DATA_NET;
4275         ad.u.net = &net;
4276         ad.u.net->sk = other;
4277
4278         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4279                            sksec_other->sclass,
4280                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4281         if (err)
4282                 return err;
4283
4284         /* server child socket */
4285         sksec_new->peer_sid = sksec_sock->sid;
4286         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4287                                     &sksec_new->sid);
4288         if (err)
4289                 return err;
4290
4291         /* connecting socket */
4292         sksec_sock->peer_sid = sksec_new->sid;
4293
4294         return 0;
4295 }
4296
4297 static int selinux_socket_unix_may_send(struct socket *sock,
4298                                         struct socket *other)
4299 {
4300         struct sk_security_struct *ssec = sock->sk->sk_security;
4301         struct sk_security_struct *osec = other->sk->sk_security;
4302         struct common_audit_data ad;
4303         struct lsm_network_audit net = {0,};
4304
4305         ad.type = LSM_AUDIT_DATA_NET;
4306         ad.u.net = &net;
4307         ad.u.net->sk = other->sk;
4308
4309         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4310                             &ad);
4311 }
4312
4313 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4314                                     char *addrp, u16 family, u32 peer_sid,
4315                                     struct common_audit_data *ad)
4316 {
4317         int err;
4318         u32 if_sid;
4319         u32 node_sid;
4320
4321         err = sel_netif_sid(ns, ifindex, &if_sid);
4322         if (err)
4323                 return err;
4324         err = avc_has_perm(peer_sid, if_sid,
4325                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4326         if (err)
4327                 return err;
4328
4329         err = sel_netnode_sid(addrp, family, &node_sid);
4330         if (err)
4331                 return err;
4332         return avc_has_perm(peer_sid, node_sid,
4333                             SECCLASS_NODE, NODE__RECVFROM, ad);
4334 }
4335
4336 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4337                                        u16 family)
4338 {
4339         int err = 0;
4340         struct sk_security_struct *sksec = sk->sk_security;
4341         u32 sk_sid = sksec->sid;
4342         struct common_audit_data ad;
4343         struct lsm_network_audit net = {0,};
4344         char *addrp;
4345
4346         ad.type = LSM_AUDIT_DATA_NET;
4347         ad.u.net = &net;
4348         ad.u.net->netif = skb->skb_iif;
4349         ad.u.net->family = family;
4350         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4351         if (err)
4352                 return err;
4353
4354         if (selinux_secmark_enabled()) {
4355                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4356                                    PACKET__RECV, &ad);
4357                 if (err)
4358                         return err;
4359         }
4360
4361         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4362         if (err)
4363                 return err;
4364         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4365
4366         return err;
4367 }
4368
4369 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4370 {
4371         int err;
4372         struct sk_security_struct *sksec = sk->sk_security;
4373         u16 family = sk->sk_family;
4374         u32 sk_sid = sksec->sid;
4375         struct common_audit_data ad;
4376         struct lsm_network_audit net = {0,};
4377         char *addrp;
4378         u8 secmark_active;
4379         u8 peerlbl_active;
4380
4381         if (family != PF_INET && family != PF_INET6)
4382                 return 0;
4383
4384         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4385         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4386                 family = PF_INET;
4387
4388         /* If any sort of compatibility mode is enabled then handoff processing
4389          * to the selinux_sock_rcv_skb_compat() function to deal with the
4390          * special handling.  We do this in an attempt to keep this function
4391          * as fast and as clean as possible. */
4392         if (!selinux_policycap_netpeer)
4393                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4394
4395         secmark_active = selinux_secmark_enabled();
4396         peerlbl_active = selinux_peerlbl_enabled();
4397         if (!secmark_active && !peerlbl_active)
4398                 return 0;
4399
4400         ad.type = LSM_AUDIT_DATA_NET;
4401         ad.u.net = &net;
4402         ad.u.net->netif = skb->skb_iif;
4403         ad.u.net->family = family;
4404         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4405         if (err)
4406                 return err;
4407
4408         if (peerlbl_active) {
4409                 u32 peer_sid;
4410
4411                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4412                 if (err)
4413                         return err;
4414                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4415                                                addrp, family, peer_sid, &ad);
4416                 if (err) {
4417                         selinux_netlbl_err(skb, err, 0);
4418                         return err;
4419                 }
4420                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4421                                    PEER__RECV, &ad);
4422                 if (err) {
4423                         selinux_netlbl_err(skb, err, 0);
4424                         return err;
4425                 }
4426         }
4427
4428         if (secmark_active) {
4429                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4430                                    PACKET__RECV, &ad);
4431                 if (err)
4432                         return err;
4433         }
4434
4435         return err;
4436 }
4437
4438 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4439                                             int __user *optlen, unsigned len)
4440 {
4441         int err = 0;
4442         char *scontext;
4443         u32 scontext_len;
4444         struct sk_security_struct *sksec = sock->sk->sk_security;
4445         u32 peer_sid = SECSID_NULL;
4446
4447         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4448             sksec->sclass == SECCLASS_TCP_SOCKET)
4449                 peer_sid = sksec->peer_sid;
4450         if (peer_sid == SECSID_NULL)
4451                 return -ENOPROTOOPT;
4452
4453         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4454         if (err)
4455                 return err;
4456
4457         if (scontext_len > len) {
4458                 err = -ERANGE;
4459                 goto out_len;
4460         }
4461
4462         if (copy_to_user(optval, scontext, scontext_len))
4463                 err = -EFAULT;
4464
4465 out_len:
4466         if (put_user(scontext_len, optlen))
4467                 err = -EFAULT;
4468         kfree(scontext);
4469         return err;
4470 }
4471
4472 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4473 {
4474         u32 peer_secid = SECSID_NULL;
4475         u16 family;
4476
4477         if (skb && skb->protocol == htons(ETH_P_IP))
4478                 family = PF_INET;
4479         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4480                 family = PF_INET6;
4481         else if (sock)
4482                 family = sock->sk->sk_family;
4483         else
4484                 goto out;
4485
4486         if (sock && family == PF_UNIX)
4487                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4488         else if (skb)
4489                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4490
4491 out:
4492         *secid = peer_secid;
4493         if (peer_secid == SECSID_NULL)
4494                 return -EINVAL;
4495         return 0;
4496 }
4497
4498 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4499 {
4500         struct sk_security_struct *sksec;
4501
4502         sksec = kzalloc(sizeof(*sksec), priority);
4503         if (!sksec)
4504                 return -ENOMEM;
4505
4506         sksec->peer_sid = SECINITSID_UNLABELED;
4507         sksec->sid = SECINITSID_UNLABELED;
4508         selinux_netlbl_sk_security_reset(sksec);
4509         sk->sk_security = sksec;
4510
4511         return 0;
4512 }
4513
4514 static void selinux_sk_free_security(struct sock *sk)
4515 {
4516         struct sk_security_struct *sksec = sk->sk_security;
4517
4518         sk->sk_security = NULL;
4519         selinux_netlbl_sk_security_free(sksec);
4520         kfree(sksec);
4521 }
4522
4523 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4524 {
4525         struct sk_security_struct *sksec = sk->sk_security;
4526         struct sk_security_struct *newsksec = newsk->sk_security;
4527
4528         newsksec->sid = sksec->sid;
4529         newsksec->peer_sid = sksec->peer_sid;
4530         newsksec->sclass = sksec->sclass;
4531
4532         selinux_netlbl_sk_security_reset(newsksec);
4533 }
4534
4535 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4536 {
4537         if (!sk)
4538                 *secid = SECINITSID_ANY_SOCKET;
4539         else {
4540                 struct sk_security_struct *sksec = sk->sk_security;
4541
4542                 *secid = sksec->sid;
4543         }
4544 }
4545
4546 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4547 {
4548         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4549         struct sk_security_struct *sksec = sk->sk_security;
4550
4551         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4552             sk->sk_family == PF_UNIX)
4553                 isec->sid = sksec->sid;
4554         sksec->sclass = isec->sclass;
4555 }
4556
4557 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4558                                      struct request_sock *req)
4559 {
4560         struct sk_security_struct *sksec = sk->sk_security;
4561         int err;
4562         u16 family = req->rsk_ops->family;
4563         u32 connsid;
4564         u32 peersid;
4565
4566         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4567         if (err)
4568                 return err;
4569         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4570         if (err)
4571                 return err;
4572         req->secid = connsid;
4573         req->peer_secid = peersid;
4574
4575         return selinux_netlbl_inet_conn_request(req, family);
4576 }
4577
4578 static void selinux_inet_csk_clone(struct sock *newsk,
4579                                    const struct request_sock *req)
4580 {
4581         struct sk_security_struct *newsksec = newsk->sk_security;
4582
4583         newsksec->sid = req->secid;
4584         newsksec->peer_sid = req->peer_secid;
4585         /* NOTE: Ideally, we should also get the isec->sid for the
4586            new socket in sync, but we don't have the isec available yet.
4587            So we will wait until sock_graft to do it, by which
4588            time it will have been created and available. */
4589
4590         /* We don't need to take any sort of lock here as we are the only
4591          * thread with access to newsksec */
4592         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4593 }
4594
4595 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4596 {
4597         u16 family = sk->sk_family;
4598         struct sk_security_struct *sksec = sk->sk_security;
4599
4600         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4601         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4602                 family = PF_INET;
4603
4604         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4605 }
4606
4607 static int selinux_secmark_relabel_packet(u32 sid)
4608 {
4609         const struct task_security_struct *__tsec;
4610         u32 tsid;
4611
4612         __tsec = current_security();
4613         tsid = __tsec->sid;
4614
4615         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4616 }
4617
4618 static void selinux_secmark_refcount_inc(void)
4619 {
4620         atomic_inc(&selinux_secmark_refcount);
4621 }
4622
4623 static void selinux_secmark_refcount_dec(void)
4624 {
4625         atomic_dec(&selinux_secmark_refcount);
4626 }
4627
4628 static void selinux_req_classify_flow(const struct request_sock *req,
4629                                       struct flowi *fl)
4630 {
4631         fl->flowi_secid = req->secid;
4632 }
4633
4634 static int selinux_tun_dev_alloc_security(void **security)
4635 {
4636         struct tun_security_struct *tunsec;
4637
4638         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4639         if (!tunsec)
4640                 return -ENOMEM;
4641         tunsec->sid = current_sid();
4642
4643         *security = tunsec;
4644         return 0;
4645 }
4646
4647 static void selinux_tun_dev_free_security(void *security)
4648 {
4649         kfree(security);
4650 }
4651
4652 static int selinux_tun_dev_create(void)
4653 {
4654         u32 sid = current_sid();
4655
4656         /* we aren't taking into account the "sockcreate" SID since the socket
4657          * that is being created here is not a socket in the traditional sense,
4658          * instead it is a private sock, accessible only to the kernel, and
4659          * representing a wide range of network traffic spanning multiple
4660          * connections unlike traditional sockets - check the TUN driver to
4661          * get a better understanding of why this socket is special */
4662
4663         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4664                             NULL);
4665 }
4666
4667 static int selinux_tun_dev_attach_queue(void *security)
4668 {
4669         struct tun_security_struct *tunsec = security;
4670
4671         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4672                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4673 }
4674
4675 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4676 {
4677         struct tun_security_struct *tunsec = security;
4678         struct sk_security_struct *sksec = sk->sk_security;
4679
4680         /* we don't currently perform any NetLabel based labeling here and it
4681          * isn't clear that we would want to do so anyway; while we could apply
4682          * labeling without the support of the TUN user the resulting labeled
4683          * traffic from the other end of the connection would almost certainly
4684          * cause confusion to the TUN user that had no idea network labeling
4685          * protocols were being used */
4686
4687         sksec->sid = tunsec->sid;
4688         sksec->sclass = SECCLASS_TUN_SOCKET;
4689
4690         return 0;
4691 }
4692
4693 static int selinux_tun_dev_open(void *security)
4694 {
4695         struct tun_security_struct *tunsec = security;
4696         u32 sid = current_sid();
4697         int err;
4698
4699         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4700                            TUN_SOCKET__RELABELFROM, NULL);
4701         if (err)
4702                 return err;
4703         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4704                            TUN_SOCKET__RELABELTO, NULL);
4705         if (err)
4706                 return err;
4707         tunsec->sid = sid;
4708
4709         return 0;
4710 }
4711
4712 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4713 {
4714         int err = 0;
4715         u32 perm;
4716         struct nlmsghdr *nlh;
4717         struct sk_security_struct *sksec = sk->sk_security;
4718
4719         if (skb->len < NLMSG_HDRLEN) {
4720                 err = -EINVAL;
4721                 goto out;
4722         }
4723         nlh = nlmsg_hdr(skb);
4724
4725         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4726         if (err) {
4727                 if (err == -EINVAL) {
4728                         printk(KERN_WARNING
4729                                "SELinux: unrecognized netlink message:"
4730                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4731                                sk->sk_protocol, nlh->nlmsg_type,
4732                                secclass_map[sksec->sclass - 1].name);
4733                         if (!selinux_enforcing || security_get_allow_unknown())
4734                                 err = 0;
4735                 }
4736
4737                 /* Ignore */
4738                 if (err == -ENOENT)
4739                         err = 0;
4740                 goto out;
4741         }
4742
4743         err = sock_has_perm(current, sk, perm);
4744 out:
4745         return err;
4746 }
4747
4748 #ifdef CONFIG_NETFILTER
4749
4750 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4751                                        const struct net_device *indev,
4752                                        u16 family)
4753 {
4754         int err;
4755         char *addrp;
4756         u32 peer_sid;
4757         struct common_audit_data ad;
4758         struct lsm_network_audit net = {0,};
4759         u8 secmark_active;
4760         u8 netlbl_active;
4761         u8 peerlbl_active;
4762
4763         if (!selinux_policycap_netpeer)
4764                 return NF_ACCEPT;
4765
4766         secmark_active = selinux_secmark_enabled();
4767         netlbl_active = netlbl_enabled();
4768         peerlbl_active = selinux_peerlbl_enabled();
4769         if (!secmark_active && !peerlbl_active)
4770                 return NF_ACCEPT;
4771
4772         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4773                 return NF_DROP;
4774
4775         ad.type = LSM_AUDIT_DATA_NET;
4776         ad.u.net = &net;
4777         ad.u.net->netif = indev->ifindex;
4778         ad.u.net->family = family;
4779         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4780                 return NF_DROP;
4781
4782         if (peerlbl_active) {
4783                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4784                                                addrp, family, peer_sid, &ad);
4785                 if (err) {
4786                         selinux_netlbl_err(skb, err, 1);
4787                         return NF_DROP;
4788                 }
4789         }
4790
4791         if (secmark_active)
4792                 if (avc_has_perm(peer_sid, skb->secmark,
4793                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4794                         return NF_DROP;
4795
4796         if (netlbl_active)
4797                 /* we do this in the FORWARD path and not the POST_ROUTING
4798                  * path because we want to make sure we apply the necessary
4799                  * labeling before IPsec is applied so we can leverage AH
4800                  * protection */
4801                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4802                         return NF_DROP;
4803
4804         return NF_ACCEPT;
4805 }
4806
4807 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4808                                          struct sk_buff *skb,
4809                                          const struct nf_hook_state *state)
4810 {
4811         return selinux_ip_forward(skb, state->in, PF_INET);
4812 }
4813
4814 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4815 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4816                                          struct sk_buff *skb,
4817                                          const struct nf_hook_state *state)
4818 {
4819         return selinux_ip_forward(skb, state->in, PF_INET6);
4820 }
4821 #endif  /* IPV6 */
4822
4823 static unsigned int selinux_ip_output(struct sk_buff *skb,
4824                                       u16 family)
4825 {
4826         struct sock *sk;
4827         u32 sid;
4828
4829         if (!netlbl_enabled())
4830                 return NF_ACCEPT;
4831
4832         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4833          * because we want to make sure we apply the necessary labeling
4834          * before IPsec is applied so we can leverage AH protection */
4835         sk = skb->sk;
4836         if (sk) {
4837                 struct sk_security_struct *sksec;
4838
4839                 if (sk->sk_state == TCP_LISTEN)
4840                         /* if the socket is the listening state then this
4841                          * packet is a SYN-ACK packet which means it needs to
4842                          * be labeled based on the connection/request_sock and
4843                          * not the parent socket.  unfortunately, we can't
4844                          * lookup the request_sock yet as it isn't queued on
4845                          * the parent socket until after the SYN-ACK is sent.
4846                          * the "solution" is to simply pass the packet as-is
4847                          * as any IP option based labeling should be copied
4848                          * from the initial connection request (in the IP
4849                          * layer).  it is far from ideal, but until we get a
4850                          * security label in the packet itself this is the
4851                          * best we can do. */
4852                         return NF_ACCEPT;
4853
4854                 /* standard practice, label using the parent socket */
4855                 sksec = sk->sk_security;
4856                 sid = sksec->sid;
4857         } else
4858                 sid = SECINITSID_KERNEL;
4859         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4860                 return NF_DROP;
4861
4862         return NF_ACCEPT;
4863 }
4864
4865 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4866                                         struct sk_buff *skb,
4867                                         const struct nf_hook_state *state)
4868 {
4869         return selinux_ip_output(skb, PF_INET);
4870 }
4871
4872 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4873                                                 int ifindex,
4874                                                 u16 family)
4875 {
4876         struct sock *sk = skb->sk;
4877         struct sk_security_struct *sksec;
4878         struct common_audit_data ad;
4879         struct lsm_network_audit net = {0,};
4880         char *addrp;
4881         u8 proto;
4882
4883         if (sk == NULL)
4884                 return NF_ACCEPT;
4885         sksec = sk->sk_security;
4886
4887         ad.type = LSM_AUDIT_DATA_NET;
4888         ad.u.net = &net;
4889         ad.u.net->netif = ifindex;
4890         ad.u.net->family = family;
4891         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4892                 return NF_DROP;
4893
4894         if (selinux_secmark_enabled())
4895                 if (avc_has_perm(sksec->sid, skb->secmark,
4896                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4897                         return NF_DROP_ERR(-ECONNREFUSED);
4898
4899         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4900                 return NF_DROP_ERR(-ECONNREFUSED);
4901
4902         return NF_ACCEPT;
4903 }
4904
4905 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4906                                          const struct net_device *outdev,
4907                                          u16 family)
4908 {
4909         u32 secmark_perm;
4910         u32 peer_sid;
4911         int ifindex = outdev->ifindex;
4912         struct sock *sk;
4913         struct common_audit_data ad;
4914         struct lsm_network_audit net = {0,};
4915         char *addrp;
4916         u8 secmark_active;
4917         u8 peerlbl_active;
4918
4919         /* If any sort of compatibility mode is enabled then handoff processing
4920          * to the selinux_ip_postroute_compat() function to deal with the
4921          * special handling.  We do this in an attempt to keep this function
4922          * as fast and as clean as possible. */
4923         if (!selinux_policycap_netpeer)
4924                 return selinux_ip_postroute_compat(skb, ifindex, family);
4925
4926         secmark_active = selinux_secmark_enabled();
4927         peerlbl_active = selinux_peerlbl_enabled();
4928         if (!secmark_active && !peerlbl_active)
4929                 return NF_ACCEPT;
4930
4931         sk = skb->sk;
4932
4933 #ifdef CONFIG_XFRM
4934         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4935          * packet transformation so allow the packet to pass without any checks
4936          * since we'll have another chance to perform access control checks
4937          * when the packet is on it's final way out.
4938          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4939          *       is NULL, in this case go ahead and apply access control.
4940          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4941          *       TCP listening state we cannot wait until the XFRM processing
4942          *       is done as we will miss out on the SA label if we do;
4943          *       unfortunately, this means more work, but it is only once per
4944          *       connection. */
4945         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4946             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4947                 return NF_ACCEPT;
4948 #endif
4949
4950         if (sk == NULL) {
4951                 /* Without an associated socket the packet is either coming
4952                  * from the kernel or it is being forwarded; check the packet
4953                  * to determine which and if the packet is being forwarded
4954                  * query the packet directly to determine the security label. */
4955                 if (skb->skb_iif) {
4956                         secmark_perm = PACKET__FORWARD_OUT;
4957                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4958                                 return NF_DROP;
4959                 } else {
4960                         secmark_perm = PACKET__SEND;
4961                         peer_sid = SECINITSID_KERNEL;
4962                 }
4963         } else if (sk->sk_state == TCP_LISTEN) {
4964                 /* Locally generated packet but the associated socket is in the
4965                  * listening state which means this is a SYN-ACK packet.  In
4966                  * this particular case the correct security label is assigned
4967                  * to the connection/request_sock but unfortunately we can't
4968                  * query the request_sock as it isn't queued on the parent
4969                  * socket until after the SYN-ACK packet is sent; the only
4970                  * viable choice is to regenerate the label like we do in
4971                  * selinux_inet_conn_request().  See also selinux_ip_output()
4972                  * for similar problems. */
4973                 u32 skb_sid;
4974                 struct sk_security_struct *sksec = sk->sk_security;
4975                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4976                         return NF_DROP;
4977                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4978                  * and the packet has been through at least one XFRM
4979                  * transformation then we must be dealing with the "final"
4980                  * form of labeled IPsec packet; since we've already applied
4981                  * all of our access controls on this packet we can safely
4982                  * pass the packet. */
4983                 if (skb_sid == SECSID_NULL) {
4984                         switch (family) {
4985                         case PF_INET:
4986                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4987                                         return NF_ACCEPT;
4988                                 break;
4989                         case PF_INET6:
4990                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4991                                         return NF_ACCEPT;
4992                                 break;
4993                         default:
4994                                 return NF_DROP_ERR(-ECONNREFUSED);
4995                         }
4996                 }
4997                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4998                         return NF_DROP;
4999                 secmark_perm = PACKET__SEND;
5000         } else {
5001                 /* Locally generated packet, fetch the security label from the
5002                  * associated socket. */
5003                 struct sk_security_struct *sksec = sk->sk_security;
5004                 peer_sid = sksec->sid;
5005                 secmark_perm = PACKET__SEND;
5006         }
5007
5008         ad.type = LSM_AUDIT_DATA_NET;
5009         ad.u.net = &net;
5010         ad.u.net->netif = ifindex;
5011         ad.u.net->family = family;
5012         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5013                 return NF_DROP;
5014
5015         if (secmark_active)
5016                 if (avc_has_perm(peer_sid, skb->secmark,
5017                                  SECCLASS_PACKET, secmark_perm, &ad))
5018                         return NF_DROP_ERR(-ECONNREFUSED);
5019
5020         if (peerlbl_active) {
5021                 u32 if_sid;
5022                 u32 node_sid;
5023
5024                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5025                         return NF_DROP;
5026                 if (avc_has_perm(peer_sid, if_sid,
5027                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5028                         return NF_DROP_ERR(-ECONNREFUSED);
5029
5030                 if (sel_netnode_sid(addrp, family, &node_sid))
5031                         return NF_DROP;
5032                 if (avc_has_perm(peer_sid, node_sid,
5033                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5034                         return NF_DROP_ERR(-ECONNREFUSED);
5035         }
5036
5037         return NF_ACCEPT;
5038 }
5039
5040 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5041                                            struct sk_buff *skb,
5042                                            const struct nf_hook_state *state)
5043 {
5044         return selinux_ip_postroute(skb, state->out, PF_INET);
5045 }
5046
5047 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5048 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5049                                            struct sk_buff *skb,
5050                                            const struct nf_hook_state *state)
5051 {
5052         return selinux_ip_postroute(skb, state->out, PF_INET6);
5053 }
5054 #endif  /* IPV6 */
5055
5056 #endif  /* CONFIG_NETFILTER */
5057
5058 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5059 {
5060         return selinux_nlmsg_perm(sk, skb);
5061 }
5062
5063 static int ipc_alloc_security(struct task_struct *task,
5064                               struct kern_ipc_perm *perm,
5065                               u16 sclass)
5066 {
5067         struct ipc_security_struct *isec;
5068         u32 sid;
5069
5070         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5071         if (!isec)
5072                 return -ENOMEM;
5073
5074         sid = task_sid(task);
5075         isec->sclass = sclass;
5076         isec->sid = sid;
5077         perm->security = isec;
5078
5079         return 0;
5080 }
5081
5082 static void ipc_free_security(struct kern_ipc_perm *perm)
5083 {
5084         struct ipc_security_struct *isec = perm->security;
5085         perm->security = NULL;
5086         kfree(isec);
5087 }
5088
5089 static int msg_msg_alloc_security(struct msg_msg *msg)
5090 {
5091         struct msg_security_struct *msec;
5092
5093         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5094         if (!msec)
5095                 return -ENOMEM;
5096
5097         msec->sid = SECINITSID_UNLABELED;
5098         msg->security = msec;
5099
5100         return 0;
5101 }
5102
5103 static void msg_msg_free_security(struct msg_msg *msg)
5104 {
5105         struct msg_security_struct *msec = msg->security;
5106
5107         msg->security = NULL;
5108         kfree(msec);
5109 }
5110
5111 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5112                         u32 perms)
5113 {
5114         struct ipc_security_struct *isec;
5115         struct common_audit_data ad;
5116         u32 sid = current_sid();
5117
5118         isec = ipc_perms->security;
5119
5120         ad.type = LSM_AUDIT_DATA_IPC;
5121         ad.u.ipc_id = ipc_perms->key;
5122
5123         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5124 }
5125
5126 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5127 {
5128         return msg_msg_alloc_security(msg);
5129 }
5130
5131 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5132 {
5133         msg_msg_free_security(msg);
5134 }
5135
5136 /* message queue security operations */
5137 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5138 {
5139         struct ipc_security_struct *isec;
5140         struct common_audit_data ad;
5141         u32 sid = current_sid();
5142         int rc;
5143
5144         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5145         if (rc)
5146                 return rc;
5147
5148         isec = msq->q_perm.security;
5149
5150         ad.type = LSM_AUDIT_DATA_IPC;
5151         ad.u.ipc_id = msq->q_perm.key;
5152
5153         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5154                           MSGQ__CREATE, &ad);
5155         if (rc) {
5156                 ipc_free_security(&msq->q_perm);
5157                 return rc;
5158         }
5159         return 0;
5160 }
5161
5162 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5163 {
5164         ipc_free_security(&msq->q_perm);
5165 }
5166
5167 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5168 {
5169         struct ipc_security_struct *isec;
5170         struct common_audit_data ad;
5171         u32 sid = current_sid();
5172
5173         isec = msq->q_perm.security;
5174
5175         ad.type = LSM_AUDIT_DATA_IPC;
5176         ad.u.ipc_id = msq->q_perm.key;
5177
5178         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5179                             MSGQ__ASSOCIATE, &ad);
5180 }
5181
5182 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5183 {
5184         int err;
5185         int perms;
5186
5187         switch (cmd) {
5188         case IPC_INFO:
5189         case MSG_INFO:
5190                 /* No specific object, just general system-wide information. */
5191                 return task_has_system(current, SYSTEM__IPC_INFO);
5192         case IPC_STAT:
5193         case MSG_STAT:
5194                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5195                 break;
5196         case IPC_SET:
5197                 perms = MSGQ__SETATTR;
5198                 break;
5199         case IPC_RMID:
5200                 perms = MSGQ__DESTROY;
5201                 break;
5202         default:
5203                 return 0;
5204         }
5205
5206         err = ipc_has_perm(&msq->q_perm, perms);
5207         return err;
5208 }
5209
5210 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5211 {
5212         struct ipc_security_struct *isec;
5213         struct msg_security_struct *msec;
5214         struct common_audit_data ad;
5215         u32 sid = current_sid();
5216         int rc;
5217
5218         isec = msq->q_perm.security;
5219         msec = msg->security;
5220
5221         /*
5222          * First time through, need to assign label to the message
5223          */
5224         if (msec->sid == SECINITSID_UNLABELED) {
5225                 /*
5226                  * Compute new sid based on current process and
5227                  * message queue this message will be stored in
5228                  */
5229                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5230                                              NULL, &msec->sid);
5231                 if (rc)
5232                         return rc;
5233         }
5234
5235         ad.type = LSM_AUDIT_DATA_IPC;
5236         ad.u.ipc_id = msq->q_perm.key;
5237
5238         /* Can this process write to the queue? */
5239         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5240                           MSGQ__WRITE, &ad);
5241         if (!rc)
5242                 /* Can this process send the message */
5243                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5244                                   MSG__SEND, &ad);
5245         if (!rc)
5246                 /* Can the message be put in the queue? */
5247                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5248                                   MSGQ__ENQUEUE, &ad);
5249
5250         return rc;
5251 }
5252
5253 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5254                                     struct task_struct *target,
5255                                     long type, int mode)
5256 {
5257         struct ipc_security_struct *isec;
5258         struct msg_security_struct *msec;
5259         struct common_audit_data ad;
5260         u32 sid = task_sid(target);
5261         int rc;
5262
5263         isec = msq->q_perm.security;
5264         msec = msg->security;
5265
5266         ad.type = LSM_AUDIT_DATA_IPC;
5267         ad.u.ipc_id = msq->q_perm.key;
5268
5269         rc = avc_has_perm(sid, isec->sid,
5270                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5271         if (!rc)
5272                 rc = avc_has_perm(sid, msec->sid,
5273                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5274         return rc;
5275 }
5276
5277 /* Shared Memory security operations */
5278 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5279 {
5280         struct ipc_security_struct *isec;
5281         struct common_audit_data ad;
5282         u32 sid = current_sid();
5283         int rc;
5284
5285         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5286         if (rc)
5287                 return rc;
5288
5289         isec = shp->shm_perm.security;
5290
5291         ad.type = LSM_AUDIT_DATA_IPC;
5292         ad.u.ipc_id = shp->shm_perm.key;
5293
5294         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5295                           SHM__CREATE, &ad);
5296         if (rc) {
5297                 ipc_free_security(&shp->shm_perm);
5298                 return rc;
5299         }
5300         return 0;
5301 }
5302
5303 static void selinux_shm_free_security(struct shmid_kernel *shp)
5304 {
5305         ipc_free_security(&shp->shm_perm);
5306 }
5307
5308 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5309 {
5310         struct ipc_security_struct *isec;
5311         struct common_audit_data ad;
5312         u32 sid = current_sid();
5313
5314         isec = shp->shm_perm.security;
5315
5316         ad.type = LSM_AUDIT_DATA_IPC;
5317         ad.u.ipc_id = shp->shm_perm.key;
5318
5319         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5320                             SHM__ASSOCIATE, &ad);
5321 }
5322
5323 /* Note, at this point, shp is locked down */
5324 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5325 {
5326         int perms;
5327         int err;
5328
5329         switch (cmd) {
5330         case IPC_INFO:
5331         case SHM_INFO:
5332                 /* No specific object, just general system-wide information. */
5333                 return task_has_system(current, SYSTEM__IPC_INFO);
5334         case IPC_STAT:
5335         case SHM_STAT:
5336                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5337                 break;
5338         case IPC_SET:
5339                 perms = SHM__SETATTR;
5340                 break;
5341         case SHM_LOCK:
5342         case SHM_UNLOCK:
5343                 perms = SHM__LOCK;
5344                 break;
5345         case IPC_RMID:
5346                 perms = SHM__DESTROY;
5347                 break;
5348         default:
5349                 return 0;
5350         }
5351
5352         err = ipc_has_perm(&shp->shm_perm, perms);
5353         return err;
5354 }
5355
5356 static int selinux_shm_shmat(struct shmid_kernel *shp,
5357                              char __user *shmaddr, int shmflg)
5358 {
5359         u32 perms;
5360
5361         if (shmflg & SHM_RDONLY)
5362                 perms = SHM__READ;
5363         else
5364                 perms = SHM__READ | SHM__WRITE;
5365
5366         return ipc_has_perm(&shp->shm_perm, perms);
5367 }
5368
5369 /* Semaphore security operations */
5370 static int selinux_sem_alloc_security(struct sem_array *sma)
5371 {
5372         struct ipc_security_struct *isec;
5373         struct common_audit_data ad;
5374         u32 sid = current_sid();
5375         int rc;
5376
5377         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5378         if (rc)
5379                 return rc;
5380
5381         isec = sma->sem_perm.security;
5382
5383         ad.type = LSM_AUDIT_DATA_IPC;
5384         ad.u.ipc_id = sma->sem_perm.key;
5385
5386         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5387                           SEM__CREATE, &ad);
5388         if (rc) {
5389                 ipc_free_security(&sma->sem_perm);
5390                 return rc;
5391         }
5392         return 0;
5393 }
5394
5395 static void selinux_sem_free_security(struct sem_array *sma)
5396 {
5397         ipc_free_security(&sma->sem_perm);
5398 }
5399
5400 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5401 {
5402         struct ipc_security_struct *isec;
5403         struct common_audit_data ad;
5404         u32 sid = current_sid();
5405
5406         isec = sma->sem_perm.security;
5407
5408         ad.type = LSM_AUDIT_DATA_IPC;
5409         ad.u.ipc_id = sma->sem_perm.key;
5410
5411         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5412                             SEM__ASSOCIATE, &ad);
5413 }
5414
5415 /* Note, at this point, sma is locked down */
5416 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5417 {
5418         int err;
5419         u32 perms;
5420
5421         switch (cmd) {
5422         case IPC_INFO:
5423         case SEM_INFO:
5424                 /* No specific object, just general system-wide information. */
5425                 return task_has_system(current, SYSTEM__IPC_INFO);
5426         case GETPID:
5427         case GETNCNT:
5428         case GETZCNT:
5429                 perms = SEM__GETATTR;
5430                 break;
5431         case GETVAL:
5432         case GETALL:
5433                 perms = SEM__READ;
5434                 break;
5435         case SETVAL:
5436         case SETALL:
5437                 perms = SEM__WRITE;
5438                 break;
5439         case IPC_RMID:
5440                 perms = SEM__DESTROY;
5441                 break;
5442         case IPC_SET:
5443                 perms = SEM__SETATTR;
5444                 break;
5445         case IPC_STAT:
5446         case SEM_STAT:
5447                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5448                 break;
5449         default:
5450                 return 0;
5451         }
5452
5453         err = ipc_has_perm(&sma->sem_perm, perms);
5454         return err;
5455 }
5456
5457 static int selinux_sem_semop(struct sem_array *sma,
5458                              struct sembuf *sops, unsigned nsops, int alter)
5459 {
5460         u32 perms;
5461
5462         if (alter)
5463                 perms = SEM__READ | SEM__WRITE;
5464         else
5465                 perms = SEM__READ;
5466
5467         return ipc_has_perm(&sma->sem_perm, perms);
5468 }
5469
5470 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5471 {
5472         u32 av = 0;
5473
5474         av = 0;
5475         if (flag & S_IRUGO)
5476                 av |= IPC__UNIX_READ;
5477         if (flag & S_IWUGO)
5478                 av |= IPC__UNIX_WRITE;
5479
5480         if (av == 0)
5481                 return 0;
5482
5483         return ipc_has_perm(ipcp, av);
5484 }
5485
5486 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5487 {
5488         struct ipc_security_struct *isec = ipcp->security;
5489         *secid = isec->sid;
5490 }
5491
5492 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5493 {
5494         if (inode)
5495                 inode_doinit_with_dentry(inode, dentry);
5496 }
5497
5498 static int selinux_getprocattr(struct task_struct *p,
5499                                char *name, char **value)
5500 {
5501         const struct task_security_struct *__tsec;
5502         u32 sid;
5503         int error;
5504         unsigned len;
5505
5506         if (current != p) {
5507                 error = current_has_perm(p, PROCESS__GETATTR);
5508                 if (error)
5509                         return error;
5510         }
5511
5512         rcu_read_lock();
5513         __tsec = __task_cred(p)->security;
5514
5515         if (!strcmp(name, "current"))
5516                 sid = __tsec->sid;
5517         else if (!strcmp(name, "prev"))
5518                 sid = __tsec->osid;
5519         else if (!strcmp(name, "exec"))
5520                 sid = __tsec->exec_sid;
5521         else if (!strcmp(name, "fscreate"))
5522                 sid = __tsec->create_sid;
5523         else if (!strcmp(name, "keycreate"))
5524                 sid = __tsec->keycreate_sid;
5525         else if (!strcmp(name, "sockcreate"))
5526                 sid = __tsec->sockcreate_sid;
5527         else
5528                 goto invalid;
5529         rcu_read_unlock();
5530
5531         if (!sid)
5532                 return 0;
5533
5534         error = security_sid_to_context(sid, value, &len);
5535         if (error)
5536                 return error;
5537         return len;
5538
5539 invalid:
5540         rcu_read_unlock();
5541         return -EINVAL;
5542 }
5543
5544 static int selinux_setprocattr(struct task_struct *p,
5545                                char *name, void *value, size_t size)
5546 {
5547         struct task_security_struct *tsec;
5548         struct task_struct *tracer;
5549         struct cred *new;
5550         u32 sid = 0, ptsid;
5551         int error;
5552         char *str = value;
5553
5554         if (current != p) {
5555                 /* SELinux only allows a process to change its own
5556                    security attributes. */
5557                 return -EACCES;
5558         }
5559
5560         /*
5561          * Basic control over ability to set these attributes at all.
5562          * current == p, but we'll pass them separately in case the
5563          * above restriction is ever removed.
5564          */
5565         if (!strcmp(name, "exec"))
5566                 error = current_has_perm(p, PROCESS__SETEXEC);
5567         else if (!strcmp(name, "fscreate"))
5568                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5569         else if (!strcmp(name, "keycreate"))
5570                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5571         else if (!strcmp(name, "sockcreate"))
5572                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5573         else if (!strcmp(name, "current"))
5574                 error = current_has_perm(p, PROCESS__SETCURRENT);
5575         else
5576                 error = -EINVAL;
5577         if (error)
5578                 return error;
5579
5580         /* Obtain a SID for the context, if one was specified. */
5581         if (size && str[1] && str[1] != '\n') {
5582                 if (str[size-1] == '\n') {
5583                         str[size-1] = 0;
5584                         size--;
5585                 }
5586                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5587                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5588                         if (!capable(CAP_MAC_ADMIN)) {
5589                                 struct audit_buffer *ab;
5590                                 size_t audit_size;
5591
5592                                 /* We strip a nul only if it is at the end, otherwise the
5593                                  * context contains a nul and we should audit that */
5594                                 if (str[size - 1] == '\0')
5595                                         audit_size = size - 1;
5596                                 else
5597                                         audit_size = size;
5598                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5599                                 audit_log_format(ab, "op=fscreate invalid_context=");
5600                                 audit_log_n_untrustedstring(ab, value, audit_size);
5601                                 audit_log_end(ab);
5602
5603                                 return error;
5604                         }
5605                         error = security_context_to_sid_force(value, size,
5606                                                               &sid);
5607                 }
5608                 if (error)
5609                         return error;
5610         }
5611
5612         new = prepare_creds();
5613         if (!new)
5614                 return -ENOMEM;
5615
5616         /* Permission checking based on the specified context is
5617            performed during the actual operation (execve,
5618            open/mkdir/...), when we know the full context of the
5619            operation.  See selinux_bprm_set_creds for the execve
5620            checks and may_create for the file creation checks. The
5621            operation will then fail if the context is not permitted. */
5622         tsec = new->security;
5623         if (!strcmp(name, "exec")) {
5624                 tsec->exec_sid = sid;
5625         } else if (!strcmp(name, "fscreate")) {
5626                 tsec->create_sid = sid;
5627         } else if (!strcmp(name, "keycreate")) {
5628                 error = may_create_key(sid, p);
5629                 if (error)
5630                         goto abort_change;
5631                 tsec->keycreate_sid = sid;
5632         } else if (!strcmp(name, "sockcreate")) {
5633                 tsec->sockcreate_sid = sid;
5634         } else if (!strcmp(name, "current")) {
5635                 error = -EINVAL;
5636                 if (sid == 0)
5637                         goto abort_change;
5638
5639                 /* Only allow single threaded processes to change context */
5640                 error = -EPERM;
5641                 if (!current_is_single_threaded()) {
5642                         error = security_bounded_transition(tsec->sid, sid);
5643                         if (error)
5644                                 goto abort_change;
5645                 }
5646
5647                 /* Check permissions for the transition. */
5648                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5649                                      PROCESS__DYNTRANSITION, NULL);
5650                 if (error)
5651                         goto abort_change;
5652
5653                 /* Check for ptracing, and update the task SID if ok.
5654                    Otherwise, leave SID unchanged and fail. */
5655                 ptsid = 0;
5656                 rcu_read_lock();
5657                 tracer = ptrace_parent(p);
5658                 if (tracer)
5659                         ptsid = task_sid(tracer);
5660                 rcu_read_unlock();
5661
5662                 if (tracer) {
5663                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5664                                              PROCESS__PTRACE, NULL);
5665                         if (error)
5666                                 goto abort_change;
5667                 }
5668
5669                 tsec->sid = sid;
5670         } else {
5671                 error = -EINVAL;
5672                 goto abort_change;
5673         }
5674
5675         commit_creds(new);
5676         return size;
5677
5678 abort_change:
5679         abort_creds(new);
5680         return error;
5681 }
5682
5683 static int selinux_ismaclabel(const char *name)
5684 {
5685         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5686 }
5687
5688 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5689 {
5690         return security_sid_to_context(secid, secdata, seclen);
5691 }
5692
5693 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5694 {
5695         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5696 }
5697
5698 static void selinux_release_secctx(char *secdata, u32 seclen)
5699 {
5700         kfree(secdata);
5701 }
5702
5703 /*
5704  *      called with inode->i_mutex locked
5705  */
5706 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5707 {
5708         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5709 }
5710
5711 /*
5712  *      called with inode->i_mutex locked
5713  */
5714 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5715 {
5716         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5717 }
5718
5719 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5720 {
5721         int len = 0;
5722         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5723                                                 ctx, true);
5724         if (len < 0)
5725                 return len;
5726         *ctxlen = len;
5727         return 0;
5728 }
5729 #ifdef CONFIG_KEYS
5730
5731 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5732                              unsigned long flags)
5733 {
5734         const struct task_security_struct *tsec;
5735         struct key_security_struct *ksec;
5736
5737         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5738         if (!ksec)
5739                 return -ENOMEM;
5740
5741         tsec = cred->security;
5742         if (tsec->keycreate_sid)
5743                 ksec->sid = tsec->keycreate_sid;
5744         else
5745                 ksec->sid = tsec->sid;
5746
5747         k->security = ksec;
5748         return 0;
5749 }
5750
5751 static void selinux_key_free(struct key *k)
5752 {
5753         struct key_security_struct *ksec = k->security;
5754
5755         k->security = NULL;
5756         kfree(ksec);
5757 }
5758
5759 static int selinux_key_permission(key_ref_t key_ref,
5760                                   const struct cred *cred,
5761                                   unsigned perm)
5762 {
5763         struct key *key;
5764         struct key_security_struct *ksec;
5765         u32 sid;
5766
5767         /* if no specific permissions are requested, we skip the
5768            permission check. No serious, additional covert channels
5769            appear to be created. */
5770         if (perm == 0)
5771                 return 0;
5772
5773         sid = cred_sid(cred);
5774
5775         key = key_ref_to_ptr(key_ref);
5776         ksec = key->security;
5777
5778         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5779 }
5780
5781 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5782 {
5783         struct key_security_struct *ksec = key->security;
5784         char *context = NULL;
5785         unsigned len;
5786         int rc;
5787
5788         rc = security_sid_to_context(ksec->sid, &context, &len);
5789         if (!rc)
5790                 rc = len;
5791         *_buffer = context;
5792         return rc;
5793 }
5794
5795 #endif
5796
5797 static struct security_hook_list selinux_hooks[] = {
5798         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5799         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5800         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5801         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5802
5803         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5804         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5805         LSM_HOOK_INIT(capget, selinux_capget),
5806         LSM_HOOK_INIT(capset, selinux_capset),
5807         LSM_HOOK_INIT(capable, selinux_capable),
5808         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5809         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5810         LSM_HOOK_INIT(syslog, selinux_syslog),
5811         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5812
5813         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5814
5815         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5816         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5817         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5818         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5819
5820         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5821         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5822         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5823         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5824         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5825         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5826         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5827         LSM_HOOK_INIT(sb_mount, selinux_mount),
5828         LSM_HOOK_INIT(sb_umount, selinux_umount),
5829         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5830         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5831         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5832
5833         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5834
5835         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5836         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5837         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5838         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5839         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5840         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5841         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5842         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5843         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5844         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5845         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5846         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5847         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5848         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5849         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5850         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5851         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5852         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5853         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5854         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5855         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5856         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5857         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5858         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5859         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5860
5861         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5862         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5863         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5864         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5865         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5866         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5867         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5868         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5869         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5870         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5871         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5872         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5873
5874         LSM_HOOK_INIT(file_open, selinux_file_open),
5875
5876         LSM_HOOK_INIT(task_create, selinux_task_create),
5877         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5878         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5879         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5880         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5881         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5882         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5883         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5884         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5885         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5886         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5887         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5888         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5889         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5890         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5891         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5892         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5893         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5894         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5895         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5896         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5897         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5898
5899         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5900         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5901
5902         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5903         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5904
5905         LSM_HOOK_INIT(msg_queue_alloc_security,
5906                         selinux_msg_queue_alloc_security),
5907         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5908         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5909         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5910         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5911         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5912
5913         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5914         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5915         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5916         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5917         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5918
5919         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5920         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5921         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5922         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5923         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5924
5925         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5926
5927         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5928         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5929
5930         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5931         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5932         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5933         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5934         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5935         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5936         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5937
5938         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5939         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5940
5941         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5942         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5943         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5944         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
5945         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
5946         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
5947         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
5948         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
5949         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
5950         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
5951         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
5952         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
5953         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
5954         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
5955         LSM_HOOK_INIT(socket_getpeersec_stream,
5956                         selinux_socket_getpeersec_stream),
5957         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
5958         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
5959         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
5960         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
5961         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
5962         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
5963         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
5964         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
5965         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
5966         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
5967         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
5968         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
5969         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
5970         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
5971         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
5972         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
5973         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
5974         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
5975         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
5976
5977 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5978         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
5979         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
5980         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
5981         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
5982         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
5983         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
5984                         selinux_xfrm_state_alloc_acquire),
5985         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
5986         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
5987         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
5988         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
5989                         selinux_xfrm_state_pol_flow_match),
5990         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
5991 #endif
5992
5993 #ifdef CONFIG_KEYS
5994         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
5995         LSM_HOOK_INIT(key_free, selinux_key_free),
5996         LSM_HOOK_INIT(key_permission, selinux_key_permission),
5997         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
5998 #endif
5999
6000 #ifdef CONFIG_AUDIT
6001         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6002         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6003         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6004         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6005 #endif
6006 };
6007
6008 static __init int selinux_init(void)
6009 {
6010         if (!security_module_enable("selinux")) {
6011                 selinux_enabled = 0;
6012                 return 0;
6013         }
6014
6015         if (!selinux_enabled) {
6016                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6017                 return 0;
6018         }
6019
6020         printk(KERN_INFO "SELinux:  Initializing.\n");
6021
6022         /* Set the security state for the initial task. */
6023         cred_init_security();
6024
6025         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6026
6027         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6028                                             sizeof(struct inode_security_struct),
6029                                             0, SLAB_PANIC, NULL);
6030         avc_init();
6031
6032         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6033
6034         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6035                 panic("SELinux: Unable to register AVC netcache callback\n");
6036
6037         if (selinux_enforcing)
6038                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6039         else
6040                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6041
6042         return 0;
6043 }
6044
6045 static void delayed_superblock_init(struct super_block *sb, void *unused)
6046 {
6047         superblock_doinit(sb, NULL);
6048 }
6049
6050 void selinux_complete_init(void)
6051 {
6052         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6053
6054         /* Set up any superblocks initialized prior to the policy load. */
6055         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6056         iterate_supers(delayed_superblock_init, NULL);
6057 }
6058
6059 /* SELinux requires early initialization in order to label
6060    all processes and objects when they are created. */
6061 security_initcall(selinux_init);
6062
6063 #if defined(CONFIG_NETFILTER)
6064
6065 static struct nf_hook_ops selinux_nf_ops[] = {
6066         {
6067                 .hook =         selinux_ipv4_postroute,
6068                 .owner =        THIS_MODULE,
6069                 .pf =           NFPROTO_IPV4,
6070                 .hooknum =      NF_INET_POST_ROUTING,
6071                 .priority =     NF_IP_PRI_SELINUX_LAST,
6072         },
6073         {
6074                 .hook =         selinux_ipv4_forward,
6075                 .owner =        THIS_MODULE,
6076                 .pf =           NFPROTO_IPV4,
6077                 .hooknum =      NF_INET_FORWARD,
6078                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6079         },
6080         {
6081                 .hook =         selinux_ipv4_output,
6082                 .owner =        THIS_MODULE,
6083                 .pf =           NFPROTO_IPV4,
6084                 .hooknum =      NF_INET_LOCAL_OUT,
6085                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6086         },
6087 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6088         {
6089                 .hook =         selinux_ipv6_postroute,
6090                 .owner =        THIS_MODULE,
6091                 .pf =           NFPROTO_IPV6,
6092                 .hooknum =      NF_INET_POST_ROUTING,
6093                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6094         },
6095         {
6096                 .hook =         selinux_ipv6_forward,
6097                 .owner =        THIS_MODULE,
6098                 .pf =           NFPROTO_IPV6,
6099                 .hooknum =      NF_INET_FORWARD,
6100                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6101         },
6102 #endif  /* IPV6 */
6103 };
6104
6105 static int __init selinux_nf_ip_init(void)
6106 {
6107         int err;
6108
6109         if (!selinux_enabled)
6110                 return 0;
6111
6112         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6113
6114         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6115         if (err)
6116                 panic("SELinux: nf_register_hooks: error %d\n", err);
6117
6118         return 0;
6119 }
6120
6121 __initcall(selinux_nf_ip_init);
6122
6123 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6124 static void selinux_nf_ip_exit(void)
6125 {
6126         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6127
6128         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6129 }
6130 #endif
6131
6132 #else /* CONFIG_NETFILTER */
6133
6134 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6135 #define selinux_nf_ip_exit()
6136 #endif
6137
6138 #endif /* CONFIG_NETFILTER */
6139
6140 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6141 static int selinux_disabled;
6142
6143 int selinux_disable(void)
6144 {
6145         if (ss_initialized) {
6146                 /* Not permitted after initial policy load. */
6147                 return -EINVAL;
6148         }
6149
6150         if (selinux_disabled) {
6151                 /* Only do this once. */
6152                 return -EINVAL;
6153         }
6154
6155         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6156
6157         selinux_disabled = 1;
6158         selinux_enabled = 0;
6159
6160         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6161
6162         /* Try to destroy the avc node cache */
6163         avc_disable();
6164
6165         /* Unregister netfilter hooks. */
6166         selinux_nf_ip_exit();
6167
6168         /* Unregister selinuxfs. */
6169         exit_sel_fs();
6170
6171         return 0;
6172 }
6173 #endif