security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 /* Special handling. Genfs but also in-core setxattr handler */
 407                 !strcmp(sb->s_type->name, "sysfs") ||
 408                 !strcmp(sb->s_type->name, "pstore") ||
 409                 !strcmp(sb->s_type->name, "debugfs") ||
 410                 !strcmp(sb->s_type->name, "rootfs");
 411 }
 412
 413 static int sb_finish_set_opts(struct super_block *sb)
 414 {
 415         struct superblock_security_struct *sbsec = sb->s_security;
 416         struct dentry *root = sb->s_root;
 417         struct inode *root_inode = d_backing_inode(root);
 418         int rc = 0;
 419
 420         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 421                 /* Make sure that the xattr handler exists and that no
 422                    error other than -ENODATA is returned by getxattr on
 423                    the root directory.  -ENODATA is ok, as this may be
 424                    the first boot of the SELinux kernel before we have
 425                    assigned xattr values to the filesystem. */
 426                 if (!root_inode->i_op->getxattr) {
 427                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 428                                "xattr support\n", sb->s_id, sb->s_type->name);
 429                         rc = -EOPNOTSUPP;
 430                         goto out;
 431                 }
 432                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 433                 if (rc < 0 && rc != -ENODATA) {
 434                         if (rc == -EOPNOTSUPP)
 435                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 436                                        "%s) has no security xattr handler\n",
 437                                        sb->s_id, sb->s_type->name);
 438                         else
 439                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 440                                        "%s) getxattr errno %d\n", sb->s_id,
 441                                        sb->s_type->name, -rc);
 442                         goto out;
 443                 }
 444         }
 445
 446         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 447                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 448                        sb->s_id, sb->s_type->name);
 449
 450         sbsec->flags |= SE_SBINITIALIZED;
 451         if (selinux_is_sblabel_mnt(sb))
 452                 sbsec->flags |= SBLABEL_MNT;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 list_del_init(&isec->list);
 469                 spin_unlock(&sbsec->isec_lock);
 470                 inode = igrab(inode);
 471                 if (inode) {
 472                         if (!IS_PRIVATE(inode))
 473                                 inode_doinit(inode);
 474                         iput(inode);
 475                 }
 476                 spin_lock(&sbsec->isec_lock);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         /* make sure we always check enough bits to cover the mask */
 507         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 508
 509         tmp = sbsec->flags & SE_MNTMASK;
 510         /* count the number of mount options for this sb */
 511         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 512                 if (tmp & 0x01)
 513                         opts->num_mnt_opts++;
 514                 tmp >>= 1;
 515         }
 516         /* Check if the Label support flag is set */
 517         if (sbsec->flags & SBLABEL_MNT)
 518                 opts->num_mnt_opts++;
 519
 520         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 521         if (!opts->mnt_opts) {
 522                 rc = -ENOMEM;
 523                 goto out_free;
 524         }
 525
 526         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 527         if (!opts->mnt_opts_flags) {
 528                 rc = -ENOMEM;
 529                 goto out_free;
 530         }
 531
 532         i = 0;
 533         if (sbsec->flags & FSCONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 539         }
 540         if (sbsec->flags & CONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 546         }
 547         if (sbsec->flags & DEFCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & ROOTCONTEXT_MNT) {
 555                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 556                 struct inode_security_struct *isec = root->i_security;
 557
 558                 rc = security_sid_to_context(isec->sid, &context, &len);
 559                 if (rc)
 560                         goto out_free;
 561                 opts->mnt_opts[i] = context;
 562                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 563         }
 564         if (sbsec->flags & SBLABEL_MNT) {
 565                 opts->mnt_opts[i] = NULL;
 566                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 567         }
 568
 569         BUG_ON(i != opts->num_mnt_opts);
 570
 571         return 0;
 572
 573 out_free:
 574         security_free_mnt_opts(opts);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 struct security_mnt_opts *opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         int rc = 0, i;
 609         struct superblock_security_struct *sbsec = sb->s_security;
 610         const char *name = sb->s_type->name;
 611         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 612         struct inode_security_struct *root_isec = inode->i_security;
 613         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 614         u32 defcontext_sid = 0;
 615         char **mount_options = opts->mnt_opts;
 616         int *flags = opts->mnt_opts_flags;
 617         int num_opts = opts->num_mnt_opts;
 618
 619         mutex_lock(&sbsec->lock);
 620
 621         if (!ss_initialized) {
 622                 if (!num_opts) {
 623                         /* Defer initialization until selinux_complete_init,
 624                            after the initial policy is loaded and the security
 625                            server is ready to handle calls. */
 626                         goto out;
 627                 }
 628                 rc = -EINVAL;
 629                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 630                         "before the security server is initialized\n");
 631                 goto out;
 632         }
 633         if (kern_flags && !set_kern_flags) {
 634                 /* Specifying internal flags without providing a place to
 635                  * place the results is not allowed */
 636                 rc = -EINVAL;
 637                 goto out;
 638         }
 639
 640         /*
 641          * Binary mount data FS will come through this function twice.  Once
 642          * from an explicit call and once from the generic calls from the vfs.
 643          * Since the generic VFS calls will not contain any security mount data
 644          * we need to skip the double mount verification.
 645          *
 646          * This does open a hole in which we will not notice if the first
 647          * mount using this sb set explict options and a second mount using
 648          * this sb does not set any security options.  (The first options
 649          * will be used for both mounts)
 650          */
 651         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 652             && (num_opts == 0))
 653                 goto out;
 654
 655         /*
 656          * parse the mount options, check if they are valid sids.
 657          * also check if someone is trying to mount the same sb more
 658          * than once with different security options.
 659          */
 660         for (i = 0; i < num_opts; i++) {
 661                 u32 sid;
 662
 663                 if (flags[i] == SBLABEL_MNT)
 664                         continue;
 665                 rc = security_context_to_sid(mount_options[i],
 666                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 667                 if (rc) {
 668                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 669                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 670                                mount_options[i], sb->s_id, name, rc);
 671                         goto out;
 672                 }
 673                 switch (flags[i]) {
 674                 case FSCONTEXT_MNT:
 675                         fscontext_sid = sid;
 676
 677                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 678                                         fscontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= FSCONTEXT_MNT;
 682                         break;
 683                 case CONTEXT_MNT:
 684                         context_sid = sid;
 685
 686                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 687                                         context_sid))
 688                                 goto out_double_mount;
 689
 690                         sbsec->flags |= CONTEXT_MNT;
 691                         break;
 692                 case ROOTCONTEXT_MNT:
 693                         rootcontext_sid = sid;
 694
 695                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 696                                         rootcontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= ROOTCONTEXT_MNT;
 700
 701                         break;
 702                 case DEFCONTEXT_MNT:
 703                         defcontext_sid = sid;
 704
 705                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 706                                         defcontext_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= DEFCONTEXT_MNT;
 710
 711                         break;
 712                 default:
 713                         rc = -EINVAL;
 714                         goto out;
 715                 }
 716         }
 717
 718         if (sbsec->flags & SE_SBINITIALIZED) {
 719                 /* previously mounted with options, but not on this attempt? */
 720                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 721                         goto out_double_mount;
 722                 rc = 0;
 723                 goto out;
 724         }
 725
 726         if (strcmp(sb->s_type->name, "proc") == 0)
 727                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 728
 729         if (strcmp(sb->s_type->name, "debugfs") == 0)
 730                 sbsec->flags |= SE_SBGENFS;
 731
 732         if (!sbsec->behavior) {
 733                 /*
 734                  * Determine the labeling behavior to use for this
 735                  * filesystem type.
 736                  */
 737                 rc = security_fs_use(sb);
 738                 if (rc) {
 739                         printk(KERN_WARNING
 740                                 "%s: security_fs_use(%s) returned %d\n",
 741                                         __func__, sb->s_type->name, rc);
 742                         goto out;
 743                 }
 744         }
 745         /* sets the context of the superblock for the fs being mounted. */
 746         if (fscontext_sid) {
 747                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 748                 if (rc)
 749                         goto out;
 750
 751                 sbsec->sid = fscontext_sid;
 752         }
 753
 754         /*
 755          * Switch to using mount point labeling behavior.
 756          * sets the label used on all file below the mountpoint, and will set
 757          * the superblock context if not already set.
 758          */
 759         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 760                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 761                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 762         }
 763
 764         if (context_sid) {
 765                 if (!fscontext_sid) {
 766                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 767                                                           cred);
 768                         if (rc)
 769                                 goto out;
 770                         sbsec->sid = context_sid;
 771                 } else {
 772                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 773                                                              cred);
 774                         if (rc)
 775                                 goto out;
 776                 }
 777                 if (!rootcontext_sid)
 778                         rootcontext_sid = context_sid;
 779
 780                 sbsec->mntpoint_sid = context_sid;
 781                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 782         }
 783
 784         if (rootcontext_sid) {
 785                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 786                                                      cred);
 787                 if (rc)
 788                         goto out;
 789
 790                 root_isec->sid = rootcontext_sid;
 791                 root_isec->initialized = 1;
 792         }
 793
 794         if (defcontext_sid) {
 795                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 796                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 797                         rc = -EINVAL;
 798                         printk(KERN_WARNING "SELinux: defcontext option is "
 799                                "invalid for this filesystem type\n");
 800                         goto out;
 801                 }
 802
 803                 if (defcontext_sid != sbsec->def_sid) {
 804                         rc = may_context_mount_inode_relabel(defcontext_sid,
 805                                                              sbsec, cred);
 806                         if (rc)
 807                                 goto out;
 808                 }
 809
 810                 sbsec->def_sid = defcontext_sid;
 811         }
 812
 813         rc = sb_finish_set_opts(sb);
 814 out:
 815         mutex_unlock(&sbsec->lock);
 816         return rc;
 817 out_double_mount:
 818         rc = -EINVAL;
 819         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 820                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 821         goto out;
 822 }
 823
 824 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 825                                     const struct super_block *newsb)
 826 {
 827         struct superblock_security_struct *old = oldsb->s_security;
 828         struct superblock_security_struct *new = newsb->s_security;
 829         char oldflags = old->flags & SE_MNTMASK;
 830         char newflags = new->flags & SE_MNTMASK;
 831
 832         if (oldflags != newflags)
 833                 goto mismatch;
 834         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 835                 goto mismatch;
 836         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 837                 goto mismatch;
 838         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 839                 goto mismatch;
 840         if (oldflags & ROOTCONTEXT_MNT) {
 841                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 842                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 843                 if (oldroot->sid != newroot->sid)
 844                         goto mismatch;
 845         }
 846         return 0;
 847 mismatch:
 848         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 849                             "different security settings for (dev %s, "
 850                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 851         return -EBUSY;
 852 }
 853
 854 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 855                                         struct super_block *newsb)
 856 {
 857         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 858         struct superblock_security_struct *newsbsec = newsb->s_security;
 859
 860         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 861         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 862         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 863
 864         /*
 865          * if the parent was able to be mounted it clearly had no special lsm
 866          * mount options.  thus we can safely deal with this superblock later
 867          */
 868         if (!ss_initialized)
 869                 return 0;
 870
 871         /* how can we clone if the old one wasn't set up?? */
 872         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 873
 874         /* if fs is reusing a sb, make sure that the contexts match */
 875         if (newsbsec->flags & SE_SBINITIALIZED)
 876                 return selinux_cmp_sb_context(oldsb, newsb);
 877
 878         mutex_lock(&newsbsec->lock);
 879
 880         newsbsec->flags = oldsbsec->flags;
 881
 882         newsbsec->sid = oldsbsec->sid;
 883         newsbsec->def_sid = oldsbsec->def_sid;
 884         newsbsec->behavior = oldsbsec->behavior;
 885
 886         if (set_context) {
 887                 u32 sid = oldsbsec->mntpoint_sid;
 888
 889                 if (!set_fscontext)
 890                         newsbsec->sid = sid;
 891                 if (!set_rootcontext) {
 892                         struct inode *newinode = d_backing_inode(newsb->s_root);
 893                         struct inode_security_struct *newisec = newinode->i_security;
 894                         newisec->sid = sid;
 895                 }
 896                 newsbsec->mntpoint_sid = sid;
 897         }
 898         if (set_rootcontext) {
 899                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 900                 const struct inode_security_struct *oldisec = oldinode->i_security;
 901                 struct inode *newinode = d_backing_inode(newsb->s_root);
 902                 struct inode_security_struct *newisec = newinode->i_security;
 903
 904                 newisec->sid = oldisec->sid;
 905         }
 906
 907         sb_finish_set_opts(newsb);
 908         mutex_unlock(&newsbsec->lock);
 909         return 0;
 910 }
 911
 912 static int selinux_parse_opts_str(char *options,
 913                                   struct security_mnt_opts *opts)
 914 {
 915         char *p;
 916         char *context = NULL, *defcontext = NULL;
 917         char *fscontext = NULL, *rootcontext = NULL;
 918         int rc, num_mnt_opts = 0;
 919
 920         opts->num_mnt_opts = 0;
 921
 922         /* Standard string-based options. */
 923         while ((p = strsep(&options, "|")) != NULL) {
 924                 int token;
 925                 substring_t args[MAX_OPT_ARGS];
 926
 927                 if (!*p)
 928                         continue;
 929
 930                 token = match_token(p, tokens, args);
 931
 932                 switch (token) {
 933                 case Opt_context:
 934                         if (context || defcontext) {
 935                                 rc = -EINVAL;
 936                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 937                                 goto out_err;
 938                         }
 939                         context = match_strdup(&args[0]);
 940                         if (!context) {
 941                                 rc = -ENOMEM;
 942                                 goto out_err;
 943                         }
 944                         break;
 945
 946                 case Opt_fscontext:
 947                         if (fscontext) {
 948                                 rc = -EINVAL;
 949                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 950                                 goto out_err;
 951                         }
 952                         fscontext = match_strdup(&args[0]);
 953                         if (!fscontext) {
 954                                 rc = -ENOMEM;
 955                                 goto out_err;
 956                         }
 957                         break;
 958
 959                 case Opt_rootcontext:
 960                         if (rootcontext) {
 961                                 rc = -EINVAL;
 962                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 963                                 goto out_err;
 964                         }
 965                         rootcontext = match_strdup(&args[0]);
 966                         if (!rootcontext) {
 967                                 rc = -ENOMEM;
 968                                 goto out_err;
 969                         }
 970                         break;
 971
 972                 case Opt_defcontext:
 973                         if (context || defcontext) {
 974                                 rc = -EINVAL;
 975                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 976                                 goto out_err;
 977                         }
 978                         defcontext = match_strdup(&args[0]);
 979                         if (!defcontext) {
 980                                 rc = -ENOMEM;
 981                                 goto out_err;
 982                         }
 983                         break;
 984                 case Opt_labelsupport:
 985                         break;
 986                 default:
 987                         rc = -EINVAL;
 988                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 989                         goto out_err;
 990
 991                 }
 992         }
 993
 994         rc = -ENOMEM;
 995         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 996         if (!opts->mnt_opts)
 997                 goto out_err;
 998
 999         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1000         if (!opts->mnt_opts_flags) {
1001                 kfree(opts->mnt_opts);
1002                 goto out_err;
1003         }
1004
1005         if (fscontext) {
1006                 opts->mnt_opts[num_mnt_opts] = fscontext;
1007                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1008         }
1009         if (context) {
1010                 opts->mnt_opts[num_mnt_opts] = context;
1011                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1012         }
1013         if (rootcontext) {
1014                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1015                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1016         }
1017         if (defcontext) {
1018                 opts->mnt_opts[num_mnt_opts] = defcontext;
1019                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1020         }
1021
1022         opts->num_mnt_opts = num_mnt_opts;
1023         return 0;
1024
1025 out_err:
1026         kfree(context);
1027         kfree(defcontext);
1028         kfree(fscontext);
1029         kfree(rootcontext);
1030         return rc;
1031 }
1032 /*
1033  * string mount options parsing and call set the sbsec
1034  */
1035 static int superblock_doinit(struct super_block *sb, void *data)
1036 {
1037         int rc = 0;
1038         char *options = data;
1039         struct security_mnt_opts opts;
1040
1041         security_init_mnt_opts(&opts);
1042
1043         if (!data)
1044                 goto out;
1045
1046         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1047
1048         rc = selinux_parse_opts_str(options, &opts);
1049         if (rc)
1050                 goto out_err;
1051
1052 out:
1053         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1054
1055 out_err:
1056         security_free_mnt_opts(&opts);
1057         return rc;
1058 }
1059
1060 static void selinux_write_opts(struct seq_file *m,
1061                                struct security_mnt_opts *opts)
1062 {
1063         int i;
1064         char *prefix;
1065
1066         for (i = 0; i < opts->num_mnt_opts; i++) {
1067                 char *has_comma;
1068
1069                 if (opts->mnt_opts[i])
1070                         has_comma = strchr(opts->mnt_opts[i], ',');
1071                 else
1072                         has_comma = NULL;
1073
1074                 switch (opts->mnt_opts_flags[i]) {
1075                 case CONTEXT_MNT:
1076                         prefix = CONTEXT_STR;
1077                         break;
1078                 case FSCONTEXT_MNT:
1079                         prefix = FSCONTEXT_STR;
1080                         break;
1081                 case ROOTCONTEXT_MNT:
1082                         prefix = ROOTCONTEXT_STR;
1083                         break;
1084                 case DEFCONTEXT_MNT:
1085                         prefix = DEFCONTEXT_STR;
1086                         break;
1087                 case SBLABEL_MNT:
1088                         seq_putc(m, ',');
1089                         seq_puts(m, LABELSUPP_STR);
1090                         continue;
1091                 default:
1092                         BUG();
1093                         return;
1094                 };
1095                 /* we need a comma before each option */
1096                 seq_putc(m, ',');
1097                 seq_puts(m, prefix);
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100                 seq_puts(m, opts->mnt_opts[i]);
1101                 if (has_comma)
1102                         seq_putc(m, '\"');
1103         }
1104 }
1105
1106 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1107 {
1108         struct security_mnt_opts opts;
1109         int rc;
1110
1111         rc = selinux_get_mnt_opts(sb, &opts);
1112         if (rc) {
1113                 /* before policy load we may get EINVAL, don't show anything */
1114                 if (rc == -EINVAL)
1115                         rc = 0;
1116                 return rc;
1117         }
1118
1119         selinux_write_opts(m, &opts);
1120
1121         security_free_mnt_opts(&opts);
1122
1123         return rc;
1124 }
1125
1126 static inline u16 inode_mode_to_security_class(umode_t mode)
1127 {
1128         switch (mode & S_IFMT) {
1129         case S_IFSOCK:
1130                 return SECCLASS_SOCK_FILE;
1131         case S_IFLNK:
1132                 return SECCLASS_LNK_FILE;
1133         case S_IFREG:
1134                 return SECCLASS_FILE;
1135         case S_IFBLK:
1136                 return SECCLASS_BLK_FILE;
1137         case S_IFDIR:
1138                 return SECCLASS_DIR;
1139         case S_IFCHR:
1140                 return SECCLASS_CHR_FILE;
1141         case S_IFIFO:
1142                 return SECCLASS_FIFO_FILE;
1143
1144         }
1145
1146         return SECCLASS_FILE;
1147 }
1148
1149 static inline int default_protocol_stream(int protocol)
1150 {
1151         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1152 }
1153
1154 static inline int default_protocol_dgram(int protocol)
1155 {
1156         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1157 }
1158
1159 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1160 {
1161         switch (family) {
1162         case PF_UNIX:
1163                 switch (type) {
1164                 case SOCK_STREAM:
1165                 case SOCK_SEQPACKET:
1166                         return SECCLASS_UNIX_STREAM_SOCKET;
1167                 case SOCK_DGRAM:
1168                         return SECCLASS_UNIX_DGRAM_SOCKET;
1169                 }
1170                 break;
1171         case PF_INET:
1172         case PF_INET6:
1173                 switch (type) {
1174                 case SOCK_STREAM:
1175                         if (default_protocol_stream(protocol))
1176                                 return SECCLASS_TCP_SOCKET;
1177                         else
1178                                 return SECCLASS_RAWIP_SOCKET;
1179                 case SOCK_DGRAM:
1180                         if (default_protocol_dgram(protocol))
1181                                 return SECCLASS_UDP_SOCKET;
1182                         else
1183                                 return SECCLASS_RAWIP_SOCKET;
1184                 case SOCK_DCCP:
1185                         return SECCLASS_DCCP_SOCKET;
1186                 default:
1187                         return SECCLASS_RAWIP_SOCKET;
1188                 }
1189                 break;
1190         case PF_NETLINK:
1191                 switch (protocol) {
1192                 case NETLINK_ROUTE:
1193                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1194                 case NETLINK_SOCK_DIAG:
1195                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1196                 case NETLINK_NFLOG:
1197                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1198                 case NETLINK_XFRM:
1199                         return SECCLASS_NETLINK_XFRM_SOCKET;
1200                 case NETLINK_SELINUX:
1201                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1202                 case NETLINK_ISCSI:
1203                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1204                 case NETLINK_AUDIT:
1205                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1206                 case NETLINK_FIB_LOOKUP:
1207                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1208                 case NETLINK_CONNECTOR:
1209                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1210                 case NETLINK_NETFILTER:
1211                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1212                 case NETLINK_DNRTMSG:
1213                         return SECCLASS_NETLINK_DNRT_SOCKET;
1214                 case NETLINK_KOBJECT_UEVENT:
1215                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1216                 case NETLINK_GENERIC:
1217                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1218                 case NETLINK_SCSITRANSPORT:
1219                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1220                 case NETLINK_RDMA:
1221                         return SECCLASS_NETLINK_RDMA_SOCKET;
1222                 case NETLINK_CRYPTO:
1223                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1224                 default:
1225                         return SECCLASS_NETLINK_SOCKET;
1226                 }
1227         case PF_PACKET:
1228                 return SECCLASS_PACKET_SOCKET;
1229         case PF_KEY:
1230                 return SECCLASS_KEY_SOCKET;
1231         case PF_APPLETALK:
1232                 return SECCLASS_APPLETALK_SOCKET;
1233         }
1234
1235         return SECCLASS_SOCKET;
1236 }
1237
1238 static int selinux_genfs_get_sid(struct dentry *dentry,
1239                                  u16 tclass,
1240                                  u16 flags,
1241                                  u32 *sid)
1242 {
1243         int rc;
1244         struct super_block *sb = dentry->d_inode->i_sb;
1245         char *buffer, *path;
1246
1247         buffer = (char *)__get_free_page(GFP_KERNEL);
1248         if (!buffer)
1249                 return -ENOMEM;
1250
1251         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1252         if (IS_ERR(path))
1253                 rc = PTR_ERR(path);
1254         else {
1255                 if (flags & SE_SBPROC) {
1256                         /* each process gets a /proc/PID/ entry. Strip off the
1257                          * PID part to get a valid selinux labeling.
1258                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1259                         while (path[1] >= '0' && path[1] <= '9') {
1260                                 path[1] = '/';
1261                                 path++;
1262                         }
1263                 }
1264                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1265         }
1266         free_page((unsigned long)buffer);
1267         return rc;
1268 }
1269
1270 /* The inode's security attributes must be initialized before first use. */
1271 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1272 {
1273         struct superblock_security_struct *sbsec = NULL;
1274         struct inode_security_struct *isec = inode->i_security;
1275         u32 sid;
1276         struct dentry *dentry;
1277 #define INITCONTEXTLEN 255
1278         char *context = NULL;
1279         unsigned len = 0;
1280         int rc = 0;
1281
1282         if (isec->initialized)
1283                 goto out;
1284
1285         mutex_lock(&isec->lock);
1286         if (isec->initialized)
1287                 goto out_unlock;
1288
1289         sbsec = inode->i_sb->s_security;
1290         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1291                 /* Defer initialization until selinux_complete_init,
1292                    after the initial policy is loaded and the security
1293                    server is ready to handle calls. */
1294                 spin_lock(&sbsec->isec_lock);
1295                 if (list_empty(&isec->list))
1296                         list_add(&isec->list, &sbsec->isec_head);
1297                 spin_unlock(&sbsec->isec_lock);
1298                 goto out_unlock;
1299         }
1300
1301         switch (sbsec->behavior) {
1302         case SECURITY_FS_USE_NATIVE:
1303                 break;
1304         case SECURITY_FS_USE_XATTR:
1305                 if (!inode->i_op->getxattr) {
1306                         isec->sid = sbsec->def_sid;
1307                         break;
1308                 }
1309
1310                 /* Need a dentry, since the xattr API requires one.
1311                    Life would be simpler if we could just pass the inode. */
1312                 if (opt_dentry) {
1313                         /* Called from d_instantiate or d_splice_alias. */
1314                         dentry = dget(opt_dentry);
1315                 } else {
1316                         /* Called from selinux_complete_init, try to find a dentry. */
1317                         dentry = d_find_alias(inode);
1318                 }
1319                 if (!dentry) {
1320                         /*
1321                          * this is can be hit on boot when a file is accessed
1322                          * before the policy is loaded.  When we load policy we
1323                          * may find inodes that have no dentry on the
1324                          * sbsec->isec_head list.  No reason to complain as these
1325                          * will get fixed up the next time we go through
1326                          * inode_doinit with a dentry, before these inodes could
1327                          * be used again by userspace.
1328                          */
1329                         goto out_unlock;
1330                 }
1331
1332                 len = INITCONTEXTLEN;
1333                 context = kmalloc(len+1, GFP_NOFS);
1334                 if (!context) {
1335                         rc = -ENOMEM;
1336                         dput(dentry);
1337                         goto out_unlock;
1338                 }
1339                 context[len] = '\0';
1340                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1341                                            context, len);
1342                 if (rc == -ERANGE) {
1343                         kfree(context);
1344
1345                         /* Need a larger buffer.  Query for the right size. */
1346                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1347                                                    NULL, 0);
1348                         if (rc < 0) {
1349                                 dput(dentry);
1350                                 goto out_unlock;
1351                         }
1352                         len = rc;
1353                         context = kmalloc(len+1, GFP_NOFS);
1354                         if (!context) {
1355                                 rc = -ENOMEM;
1356                                 dput(dentry);
1357                                 goto out_unlock;
1358                         }
1359                         context[len] = '\0';
1360                         rc = inode->i_op->getxattr(dentry,
1361                                                    XATTR_NAME_SELINUX,
1362                                                    context, len);
1363                 }
1364                 dput(dentry);
1365                 if (rc < 0) {
1366                         if (rc != -ENODATA) {
1367                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1368                                        "%d for dev=%s ino=%ld\n", __func__,
1369                                        -rc, inode->i_sb->s_id, inode->i_ino);
1370                                 kfree(context);
1371                                 goto out_unlock;
1372                         }
1373                         /* Map ENODATA to the default file SID */
1374                         sid = sbsec->def_sid;
1375                         rc = 0;
1376                 } else {
1377                         rc = security_context_to_sid_default(context, rc, &sid,
1378                                                              sbsec->def_sid,
1379                                                              GFP_NOFS);
1380                         if (rc) {
1381                                 char *dev = inode->i_sb->s_id;
1382                                 unsigned long ino = inode->i_ino;
1383
1384                                 if (rc == -EINVAL) {
1385                                         if (printk_ratelimit())
1386                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1387                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1388                                                         "filesystem in question.\n", ino, dev, context);
1389                                 } else {
1390                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1391                                                "returned %d for dev=%s ino=%ld\n",
1392                                                __func__, context, -rc, dev, ino);
1393                                 }
1394                                 kfree(context);
1395                                 /* Leave with the unlabeled SID */
1396                                 rc = 0;
1397                                 break;
1398                         }
1399                 }
1400                 kfree(context);
1401                 isec->sid = sid;
1402                 break;
1403         case SECURITY_FS_USE_TASK:
1404                 isec->sid = isec->task_sid;
1405                 break;
1406         case SECURITY_FS_USE_TRANS:
1407                 /* Default to the fs SID. */
1408                 isec->sid = sbsec->sid;
1409
1410                 /* Try to obtain a transition SID. */
1411                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1412                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1413                                              isec->sclass, NULL, &sid);
1414                 if (rc)
1415                         goto out_unlock;
1416                 isec->sid = sid;
1417                 break;
1418         case SECURITY_FS_USE_MNTPOINT:
1419                 isec->sid = sbsec->mntpoint_sid;
1420                 break;
1421         default:
1422                 /* Default to the fs superblock SID. */
1423                 isec->sid = sbsec->sid;
1424
1425                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1426                         /* We must have a dentry to determine the label on
1427                          * procfs inodes */
1428                         if (opt_dentry)
1429                                 /* Called from d_instantiate or
1430                                  * d_splice_alias. */
1431                                 dentry = dget(opt_dentry);
1432                         else
1433                                 /* Called from selinux_complete_init, try to
1434                                  * find a dentry. */
1435                                 dentry = d_find_alias(inode);
1436                         /*
1437                          * This can be hit on boot when a file is accessed
1438                          * before the policy is loaded.  When we load policy we
1439                          * may find inodes that have no dentry on the
1440                          * sbsec->isec_head list.  No reason to complain as
1441                          * these will get fixed up the next time we go through
1442                          * inode_doinit() with a dentry, before these inodes
1443                          * could be used again by userspace.
1444                          */
1445                         if (!dentry)
1446                                 goto out_unlock;
1447                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1448                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1449                                                    sbsec->flags, &sid);
1450                         dput(dentry);
1451                         if (rc)
1452                                 goto out_unlock;
1453                         isec->sid = sid;
1454                 }
1455                 break;
1456         }
1457
1458         isec->initialized = 1;
1459
1460 out_unlock:
1461         mutex_unlock(&isec->lock);
1462 out:
1463         if (isec->sclass == SECCLASS_FILE)
1464                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1465         return rc;
1466 }
1467
1468 /* Convert a Linux signal to an access vector. */
1469 static inline u32 signal_to_av(int sig)
1470 {
1471         u32 perm = 0;
1472
1473         switch (sig) {
1474         case SIGCHLD:
1475                 /* Commonly granted from child to parent. */
1476                 perm = PROCESS__SIGCHLD;
1477                 break;
1478         case SIGKILL:
1479                 /* Cannot be caught or ignored */
1480                 perm = PROCESS__SIGKILL;
1481                 break;
1482         case SIGSTOP:
1483                 /* Cannot be caught or ignored */
1484                 perm = PROCESS__SIGSTOP;
1485                 break;
1486         default:
1487                 /* All other signals. */
1488                 perm = PROCESS__SIGNAL;
1489                 break;
1490         }
1491
1492         return perm;
1493 }
1494
1495 /*
1496  * Check permission between a pair of credentials
1497  * fork check, ptrace check, etc.
1498  */
1499 static int cred_has_perm(const struct cred *actor,
1500                          const struct cred *target,
1501                          u32 perms)
1502 {
1503         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1504
1505         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1506 }
1507
1508 /*
1509  * Check permission between a pair of tasks, e.g. signal checks,
1510  * fork check, ptrace check, etc.
1511  * tsk1 is the actor and tsk2 is the target
1512  * - this uses the default subjective creds of tsk1
1513  */
1514 static int task_has_perm(const struct task_struct *tsk1,
1515                          const struct task_struct *tsk2,
1516                          u32 perms)
1517 {
1518         const struct task_security_struct *__tsec1, *__tsec2;
1519         u32 sid1, sid2;
1520
1521         rcu_read_lock();
1522         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1523         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1524         rcu_read_unlock();
1525         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1526 }
1527
1528 /*
1529  * Check permission between current and another task, e.g. signal checks,
1530  * fork check, ptrace check, etc.
1531  * current is the actor and tsk2 is the target
1532  * - this uses current's subjective creds
1533  */
1534 static int current_has_perm(const struct task_struct *tsk,
1535                             u32 perms)
1536 {
1537         u32 sid, tsid;
1538
1539         sid = current_sid();
1540         tsid = task_sid(tsk);
1541         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1542 }
1543
1544 #if CAP_LAST_CAP > 63
1545 #error Fix SELinux to handle capabilities > 63.
1546 #endif
1547
1548 /* Check whether a task is allowed to use a capability. */
1549 static int cred_has_capability(const struct cred *cred,
1550                                int cap, int audit)
1551 {
1552         struct common_audit_data ad;
1553         struct av_decision avd;
1554         u16 sclass;
1555         u32 sid = cred_sid(cred);
1556         u32 av = CAP_TO_MASK(cap);
1557         int rc;
1558
1559         ad.type = LSM_AUDIT_DATA_CAP;
1560         ad.u.cap = cap;
1561
1562         switch (CAP_TO_INDEX(cap)) {
1563         case 0:
1564                 sclass = SECCLASS_CAPABILITY;
1565                 break;
1566         case 1:
1567                 sclass = SECCLASS_CAPABILITY2;
1568                 break;
1569         default:
1570                 printk(KERN_ERR
1571                        "SELinux:  out of range capability %d\n", cap);
1572                 BUG();
1573                 return -EINVAL;
1574         }
1575
1576         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1577         if (audit == SECURITY_CAP_AUDIT) {
1578                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1579                 if (rc2)
1580                         return rc2;
1581         }
1582         return rc;
1583 }
1584
1585 /* Check whether a task is allowed to use a system operation. */
1586 static int task_has_system(struct task_struct *tsk,
1587                            u32 perms)
1588 {
1589         u32 sid = task_sid(tsk);
1590
1591         return avc_has_perm(sid, SECINITSID_KERNEL,
1592                             SECCLASS_SYSTEM, perms, NULL);
1593 }
1594
1595 /* Check whether a task has a particular permission to an inode.
1596    The 'adp' parameter is optional and allows other audit
1597    data to be passed (e.g. the dentry). */
1598 static int inode_has_perm(const struct cred *cred,
1599                           struct inode *inode,
1600                           u32 perms,
1601                           struct common_audit_data *adp)
1602 {
1603         struct inode_security_struct *isec;
1604         u32 sid;
1605
1606         validate_creds(cred);
1607
1608         if (unlikely(IS_PRIVATE(inode)))
1609                 return 0;
1610
1611         sid = cred_sid(cred);
1612         isec = inode->i_security;
1613
1614         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1615 }
1616
1617 /* Same as inode_has_perm, but pass explicit audit data containing
1618    the dentry to help the auditing code to more easily generate the
1619    pathname if needed. */
1620 static inline int dentry_has_perm(const struct cred *cred,
1621                                   struct dentry *dentry,
1622                                   u32 av)
1623 {
1624         struct inode *inode = d_backing_inode(dentry);
1625         struct common_audit_data ad;
1626
1627         ad.type = LSM_AUDIT_DATA_DENTRY;
1628         ad.u.dentry = dentry;
1629         return inode_has_perm(cred, inode, av, &ad);
1630 }
1631
1632 /* Same as inode_has_perm, but pass explicit audit data containing
1633    the path to help the auditing code to more easily generate the
1634    pathname if needed. */
1635 static inline int path_has_perm(const struct cred *cred,
1636                                 const struct path *path,
1637                                 u32 av)
1638 {
1639         struct inode *inode = d_backing_inode(path->dentry);
1640         struct common_audit_data ad;
1641
1642         ad.type = LSM_AUDIT_DATA_PATH;
1643         ad.u.path = *path;
1644         return inode_has_perm(cred, inode, av, &ad);
1645 }
1646
1647 /* Same as path_has_perm, but uses the inode from the file struct. */
1648 static inline int file_path_has_perm(const struct cred *cred,
1649                                      struct file *file,
1650                                      u32 av)
1651 {
1652         struct common_audit_data ad;
1653
1654         ad.type = LSM_AUDIT_DATA_PATH;
1655         ad.u.path = file->f_path;
1656         return inode_has_perm(cred, file_inode(file), av, &ad);
1657 }
1658
1659 /* Check whether a task can use an open file descriptor to
1660    access an inode in a given way.  Check access to the
1661    descriptor itself, and then use dentry_has_perm to
1662    check a particular permission to the file.
1663    Access to the descriptor is implicitly granted if it
1664    has the same SID as the process.  If av is zero, then
1665    access to the file is not checked, e.g. for cases
1666    where only the descriptor is affected like seek. */
1667 static int file_has_perm(const struct cred *cred,
1668                          struct file *file,
1669                          u32 av)
1670 {
1671         struct file_security_struct *fsec = file->f_security;
1672         struct inode *inode = file_inode(file);
1673         struct common_audit_data ad;
1674         u32 sid = cred_sid(cred);
1675         int rc;
1676
1677         ad.type = LSM_AUDIT_DATA_PATH;
1678         ad.u.path = file->f_path;
1679
1680         if (sid != fsec->sid) {
1681                 rc = avc_has_perm(sid, fsec->sid,
1682                                   SECCLASS_FD,
1683                                   FD__USE,
1684                                   &ad);
1685                 if (rc)
1686                         goto out;
1687         }
1688
1689         /* av is zero if only checking access to the descriptor. */
1690         rc = 0;
1691         if (av)
1692                 rc = inode_has_perm(cred, inode, av, &ad);
1693
1694 out:
1695         return rc;
1696 }
1697
1698 /* Check whether a task can create a file. */
1699 static int may_create(struct inode *dir,
1700                       struct dentry *dentry,
1701                       u16 tclass)
1702 {
1703         const struct task_security_struct *tsec = current_security();
1704         struct inode_security_struct *dsec;
1705         struct superblock_security_struct *sbsec;
1706         u32 sid, newsid;
1707         struct common_audit_data ad;
1708         int rc;
1709
1710         dsec = dir->i_security;
1711         sbsec = dir->i_sb->s_security;
1712
1713         sid = tsec->sid;
1714         newsid = tsec->create_sid;
1715
1716         ad.type = LSM_AUDIT_DATA_DENTRY;
1717         ad.u.dentry = dentry;
1718
1719         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1720                           DIR__ADD_NAME | DIR__SEARCH,
1721                           &ad);
1722         if (rc)
1723                 return rc;
1724
1725         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1726                 rc = security_transition_sid(sid, dsec->sid, tclass,
1727                                              &dentry->d_name, &newsid);
1728                 if (rc)
1729                         return rc;
1730         }
1731
1732         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1733         if (rc)
1734                 return rc;
1735
1736         return avc_has_perm(newsid, sbsec->sid,
1737                             SECCLASS_FILESYSTEM,
1738                             FILESYSTEM__ASSOCIATE, &ad);
1739 }
1740
1741 /* Check whether a task can create a key. */
1742 static int may_create_key(u32 ksid,
1743                           struct task_struct *ctx)
1744 {
1745         u32 sid = task_sid(ctx);
1746
1747         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1748 }
1749
1750 #define MAY_LINK        0
1751 #define MAY_UNLINK      1
1752 #define MAY_RMDIR       2
1753
1754 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1755 static int may_link(struct inode *dir,
1756                     struct dentry *dentry,
1757                     int kind)
1758
1759 {
1760         struct inode_security_struct *dsec, *isec;
1761         struct common_audit_data ad;
1762         u32 sid = current_sid();
1763         u32 av;
1764         int rc;
1765
1766         dsec = dir->i_security;
1767         isec = d_backing_inode(dentry)->i_security;
1768
1769         ad.type = LSM_AUDIT_DATA_DENTRY;
1770         ad.u.dentry = dentry;
1771
1772         av = DIR__SEARCH;
1773         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1774         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1775         if (rc)
1776                 return rc;
1777
1778         switch (kind) {
1779         case MAY_LINK:
1780                 av = FILE__LINK;
1781                 break;
1782         case MAY_UNLINK:
1783                 av = FILE__UNLINK;
1784                 break;
1785         case MAY_RMDIR:
1786                 av = DIR__RMDIR;
1787                 break;
1788         default:
1789                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1790                         __func__, kind);
1791                 return 0;
1792         }
1793
1794         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1795         return rc;
1796 }
1797
1798 static inline int may_rename(struct inode *old_dir,
1799                              struct dentry *old_dentry,
1800                              struct inode *new_dir,
1801                              struct dentry *new_dentry)
1802 {
1803         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1804         struct common_audit_data ad;
1805         u32 sid = current_sid();
1806         u32 av;
1807         int old_is_dir, new_is_dir;
1808         int rc;
1809
1810         old_dsec = old_dir->i_security;
1811         old_isec = d_backing_inode(old_dentry)->i_security;
1812         old_is_dir = d_is_dir(old_dentry);
1813         new_dsec = new_dir->i_security;
1814
1815         ad.type = LSM_AUDIT_DATA_DENTRY;
1816
1817         ad.u.dentry = old_dentry;
1818         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1819                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1820         if (rc)
1821                 return rc;
1822         rc = avc_has_perm(sid, old_isec->sid,
1823                           old_isec->sclass, FILE__RENAME, &ad);
1824         if (rc)
1825                 return rc;
1826         if (old_is_dir && new_dir != old_dir) {
1827                 rc = avc_has_perm(sid, old_isec->sid,
1828                                   old_isec->sclass, DIR__REPARENT, &ad);
1829                 if (rc)
1830                         return rc;
1831         }
1832
1833         ad.u.dentry = new_dentry;
1834         av = DIR__ADD_NAME | DIR__SEARCH;
1835         if (d_is_positive(new_dentry))
1836                 av |= DIR__REMOVE_NAME;
1837         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1838         if (rc)
1839                 return rc;
1840         if (d_is_positive(new_dentry)) {
1841                 new_isec = d_backing_inode(new_dentry)->i_security;
1842                 new_is_dir = d_is_dir(new_dentry);
1843                 rc = avc_has_perm(sid, new_isec->sid,
1844                                   new_isec->sclass,
1845                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1846                 if (rc)
1847                         return rc;
1848         }
1849
1850         return 0;
1851 }
1852
1853 /* Check whether a task can perform a filesystem operation. */
1854 static int superblock_has_perm(const struct cred *cred,
1855                                struct super_block *sb,
1856                                u32 perms,
1857                                struct common_audit_data *ad)
1858 {
1859         struct superblock_security_struct *sbsec;
1860         u32 sid = cred_sid(cred);
1861
1862         sbsec = sb->s_security;
1863         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1864 }
1865
1866 /* Convert a Linux mode and permission mask to an access vector. */
1867 static inline u32 file_mask_to_av(int mode, int mask)
1868 {
1869         u32 av = 0;
1870
1871         if (!S_ISDIR(mode)) {
1872                 if (mask & MAY_EXEC)
1873                         av |= FILE__EXECUTE;
1874                 if (mask & MAY_READ)
1875                         av |= FILE__READ;
1876
1877                 if (mask & MAY_APPEND)
1878                         av |= FILE__APPEND;
1879                 else if (mask & MAY_WRITE)
1880                         av |= FILE__WRITE;
1881
1882         } else {
1883                 if (mask & MAY_EXEC)
1884                         av |= DIR__SEARCH;
1885                 if (mask & MAY_WRITE)
1886                         av |= DIR__WRITE;
1887                 if (mask & MAY_READ)
1888                         av |= DIR__READ;
1889         }
1890
1891         return av;
1892 }
1893
1894 /* Convert a Linux file to an access vector. */
1895 static inline u32 file_to_av(struct file *file)
1896 {
1897         u32 av = 0;
1898
1899         if (file->f_mode & FMODE_READ)
1900                 av |= FILE__READ;
1901         if (file->f_mode & FMODE_WRITE) {
1902                 if (file->f_flags & O_APPEND)
1903                         av |= FILE__APPEND;
1904                 else
1905                         av |= FILE__WRITE;
1906         }
1907         if (!av) {
1908                 /*
1909                  * Special file opened with flags 3 for ioctl-only use.
1910                  */
1911                 av = FILE__IOCTL;
1912         }
1913
1914         return av;
1915 }
1916
1917 /*
1918  * Convert a file to an access vector and include the correct open
1919  * open permission.
1920  */
1921 static inline u32 open_file_to_av(struct file *file)
1922 {
1923         u32 av = file_to_av(file);
1924
1925         if (selinux_policycap_openperm)
1926                 av |= FILE__OPEN;
1927
1928         return av;
1929 }
1930
1931 /* Hook functions begin here. */
1932
1933 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1934 {
1935         u32 mysid = current_sid();
1936         u32 mgrsid = task_sid(mgr);
1937
1938         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1939                             BINDER__SET_CONTEXT_MGR, NULL);
1940 }
1941
1942 static int selinux_binder_transaction(struct task_struct *from,
1943                                       struct task_struct *to)
1944 {
1945         u32 mysid = current_sid();
1946         u32 fromsid = task_sid(from);
1947         u32 tosid = task_sid(to);
1948         int rc;
1949
1950         if (mysid != fromsid) {
1951                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1952                                   BINDER__IMPERSONATE, NULL);
1953                 if (rc)
1954                         return rc;
1955         }
1956
1957         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1958                             NULL);
1959 }
1960
1961 static int selinux_binder_transfer_binder(struct task_struct *from,
1962                                           struct task_struct *to)
1963 {
1964         u32 fromsid = task_sid(from);
1965         u32 tosid = task_sid(to);
1966
1967         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1968                             NULL);
1969 }
1970
1971 static int selinux_binder_transfer_file(struct task_struct *from,
1972                                         struct task_struct *to,
1973                                         struct file *file)
1974 {
1975         u32 sid = task_sid(to);
1976         struct file_security_struct *fsec = file->f_security;
1977         struct inode *inode = d_backing_inode(file->f_path.dentry);
1978         struct inode_security_struct *isec = inode->i_security;
1979         struct common_audit_data ad;
1980         int rc;
1981
1982         ad.type = LSM_AUDIT_DATA_PATH;
1983         ad.u.path = file->f_path;
1984
1985         if (sid != fsec->sid) {
1986                 rc = avc_has_perm(sid, fsec->sid,
1987                                   SECCLASS_FD,
1988                                   FD__USE,
1989                                   &ad);
1990                 if (rc)
1991                         return rc;
1992         }
1993
1994         if (unlikely(IS_PRIVATE(inode)))
1995                 return 0;
1996
1997         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1998                             &ad);
1999 }
2000
2001 static int selinux_ptrace_access_check(struct task_struct *child,
2002                                      unsigned int mode)
2003 {
2004         if (mode & PTRACE_MODE_READ) {
2005                 u32 sid = current_sid();
2006                 u32 csid = task_sid(child);
2007                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2008         }
2009
2010         return current_has_perm(child, PROCESS__PTRACE);
2011 }
2012
2013 static int selinux_ptrace_traceme(struct task_struct *parent)
2014 {
2015         return task_has_perm(parent, current, PROCESS__PTRACE);
2016 }
2017
2018 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2019                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2020 {
2021         return current_has_perm(target, PROCESS__GETCAP);
2022 }
2023
2024 static int selinux_capset(struct cred *new, const struct cred *old,
2025                           const kernel_cap_t *effective,
2026                           const kernel_cap_t *inheritable,
2027                           const kernel_cap_t *permitted)
2028 {
2029         return cred_has_perm(old, new, PROCESS__SETCAP);
2030 }
2031
2032 /*
2033  * (This comment used to live with the selinux_task_setuid hook,
2034  * which was removed).
2035  *
2036  * Since setuid only affects the current process, and since the SELinux
2037  * controls are not based on the Linux identity attributes, SELinux does not
2038  * need to control this operation.  However, SELinux does control the use of
2039  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2040  */
2041
2042 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2043                            int cap, int audit)
2044 {
2045         return cred_has_capability(cred, cap, audit);
2046 }
2047
2048 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2049 {
2050         const struct cred *cred = current_cred();
2051         int rc = 0;
2052
2053         if (!sb)
2054                 return 0;
2055
2056         switch (cmds) {
2057         case Q_SYNC:
2058         case Q_QUOTAON:
2059         case Q_QUOTAOFF:
2060         case Q_SETINFO:
2061         case Q_SETQUOTA:
2062                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2063                 break;
2064         case Q_GETFMT:
2065         case Q_GETINFO:
2066         case Q_GETQUOTA:
2067                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2068                 break;
2069         default:
2070                 rc = 0;  /* let the kernel handle invalid cmds */
2071                 break;
2072         }
2073         return rc;
2074 }
2075
2076 static int selinux_quota_on(struct dentry *dentry)
2077 {
2078         const struct cred *cred = current_cred();
2079
2080         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2081 }
2082
2083 static int selinux_syslog(int type)
2084 {
2085         int rc;
2086
2087         switch (type) {
2088         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2089         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2090                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2091                 break;
2092         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2093         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2094         /* Set level of messages printed to console */
2095         case SYSLOG_ACTION_CONSOLE_LEVEL:
2096                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2097                 break;
2098         case SYSLOG_ACTION_CLOSE:       /* Close log */
2099         case SYSLOG_ACTION_OPEN:        /* Open log */
2100         case SYSLOG_ACTION_READ:        /* Read from log */
2101         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2102         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2103         default:
2104                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2105                 break;
2106         }
2107         return rc;
2108 }
2109
2110 /*
2111  * Check that a process has enough memory to allocate a new virtual
2112  * mapping. 0 means there is enough memory for the allocation to
2113  * succeed and -ENOMEM implies there is not.
2114  *
2115  * Do not audit the selinux permission check, as this is applied to all
2116  * processes that allocate mappings.
2117  */
2118 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2119 {
2120         int rc, cap_sys_admin = 0;
2121
2122         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2123                                         SECURITY_CAP_NOAUDIT);
2124         if (rc == 0)
2125                 cap_sys_admin = 1;
2126
2127         return cap_sys_admin;
2128 }
2129
2130 /* binprm security operations */
2131
2132 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2133                             const struct task_security_struct *old_tsec,
2134                             const struct task_security_struct *new_tsec)
2135 {
2136         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2137         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2138         int rc;
2139
2140         if (!nnp && !nosuid)
2141                 return 0; /* neither NNP nor nosuid */
2142
2143         if (new_tsec->sid == old_tsec->sid)
2144                 return 0; /* No change in credentials */
2145
2146         /*
2147          * The only transitions we permit under NNP or nosuid
2148          * are transitions to bounded SIDs, i.e. SIDs that are
2149          * guaranteed to only be allowed a subset of the permissions
2150          * of the current SID.
2151          */
2152         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2153         if (rc) {
2154                 /*
2155                  * On failure, preserve the errno values for NNP vs nosuid.
2156                  * NNP:  Operation not permitted for caller.
2157                  * nosuid:  Permission denied to file.
2158                  */
2159                 if (nnp)
2160                         return -EPERM;
2161                 else
2162                         return -EACCES;
2163         }
2164         return 0;
2165 }
2166
2167 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2168 {
2169         const struct task_security_struct *old_tsec;
2170         struct task_security_struct *new_tsec;
2171         struct inode_security_struct *isec;
2172         struct common_audit_data ad;
2173         struct inode *inode = file_inode(bprm->file);
2174         int rc;
2175
2176         /* SELinux context only depends on initial program or script and not
2177          * the script interpreter */
2178         if (bprm->cred_prepared)
2179                 return 0;
2180
2181         old_tsec = current_security();
2182         new_tsec = bprm->cred->security;
2183         isec = inode->i_security;
2184
2185         /* Default to the current task SID. */
2186         new_tsec->sid = old_tsec->sid;
2187         new_tsec->osid = old_tsec->sid;
2188
2189         /* Reset fs, key, and sock SIDs on execve. */
2190         new_tsec->create_sid = 0;
2191         new_tsec->keycreate_sid = 0;
2192         new_tsec->sockcreate_sid = 0;
2193
2194         if (old_tsec->exec_sid) {
2195                 new_tsec->sid = old_tsec->exec_sid;
2196                 /* Reset exec SID on execve. */
2197                 new_tsec->exec_sid = 0;
2198
2199                 /* Fail on NNP or nosuid if not an allowed transition. */
2200                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2201                 if (rc)
2202                         return rc;
2203         } else {
2204                 /* Check for a default transition on this program. */
2205                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2206                                              SECCLASS_PROCESS, NULL,
2207                                              &new_tsec->sid);
2208                 if (rc)
2209                         return rc;
2210
2211                 /*
2212                  * Fallback to old SID on NNP or nosuid if not an allowed
2213                  * transition.
2214                  */
2215                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2216                 if (rc)
2217                         new_tsec->sid = old_tsec->sid;
2218         }
2219
2220         ad.type = LSM_AUDIT_DATA_PATH;
2221         ad.u.path = bprm->file->f_path;
2222
2223         if (new_tsec->sid == old_tsec->sid) {
2224                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2225                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2226                 if (rc)
2227                         return rc;
2228         } else {
2229                 /* Check permissions for the transition. */
2230                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2231                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2232                 if (rc)
2233                         return rc;
2234
2235                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2236                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2237                 if (rc)
2238                         return rc;
2239
2240                 /* Check for shared state */
2241                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2242                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2243                                           SECCLASS_PROCESS, PROCESS__SHARE,
2244                                           NULL);
2245                         if (rc)
2246                                 return -EPERM;
2247                 }
2248
2249                 /* Make sure that anyone attempting to ptrace over a task that
2250                  * changes its SID has the appropriate permit */
2251                 if (bprm->unsafe &
2252                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2253                         struct task_struct *tracer;
2254                         struct task_security_struct *sec;
2255                         u32 ptsid = 0;
2256
2257                         rcu_read_lock();
2258                         tracer = ptrace_parent(current);
2259                         if (likely(tracer != NULL)) {
2260                                 sec = __task_cred(tracer)->security;
2261                                 ptsid = sec->sid;
2262                         }
2263                         rcu_read_unlock();
2264
2265                         if (ptsid != 0) {
2266                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2267                                                   SECCLASS_PROCESS,
2268                                                   PROCESS__PTRACE, NULL);
2269                                 if (rc)
2270                                         return -EPERM;
2271                         }
2272                 }
2273
2274                 /* Clear any possibly unsafe personality bits on exec: */
2275                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2276         }
2277
2278         return 0;
2279 }
2280
2281 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2282 {
2283         const struct task_security_struct *tsec = current_security();
2284         u32 sid, osid;
2285         int atsecure = 0;
2286
2287         sid = tsec->sid;
2288         osid = tsec->osid;
2289
2290         if (osid != sid) {
2291                 /* Enable secure mode for SIDs transitions unless
2292                    the noatsecure permission is granted between
2293                    the two SIDs, i.e. ahp returns 0. */
2294                 atsecure = avc_has_perm(osid, sid,
2295                                         SECCLASS_PROCESS,
2296                                         PROCESS__NOATSECURE, NULL);
2297         }
2298
2299         return !!atsecure;
2300 }
2301
2302 static int match_file(const void *p, struct file *file, unsigned fd)
2303 {
2304         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2305 }
2306
2307 /* Derived from fs/exec.c:flush_old_files. */
2308 static inline void flush_unauthorized_files(const struct cred *cred,
2309                                             struct files_struct *files)
2310 {
2311         struct file *file, *devnull = NULL;
2312         struct tty_struct *tty;
2313         int drop_tty = 0;
2314         unsigned n;
2315
2316         tty = get_current_tty();
2317         if (tty) {
2318                 spin_lock(&tty_files_lock);
2319                 if (!list_empty(&tty->tty_files)) {
2320                         struct tty_file_private *file_priv;
2321
2322                         /* Revalidate access to controlling tty.
2323                            Use file_path_has_perm on the tty path directly
2324                            rather than using file_has_perm, as this particular
2325                            open file may belong to another process and we are
2326                            only interested in the inode-based check here. */
2327                         file_priv = list_first_entry(&tty->tty_files,
2328                                                 struct tty_file_private, list);
2329                         file = file_priv->file;
2330                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2331                                 drop_tty = 1;
2332                 }
2333                 spin_unlock(&tty_files_lock);
2334                 tty_kref_put(tty);
2335         }
2336         /* Reset controlling tty. */
2337         if (drop_tty)
2338                 no_tty();
2339
2340         /* Revalidate access to inherited open files. */
2341         n = iterate_fd(files, 0, match_file, cred);
2342         if (!n) /* none found? */
2343                 return;
2344
2345         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2346         if (IS_ERR(devnull))
2347                 devnull = NULL;
2348         /* replace all the matching ones with this */
2349         do {
2350                 replace_fd(n - 1, devnull, 0);
2351         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2352         if (devnull)
2353                 fput(devnull);
2354 }
2355
2356 /*
2357  * Prepare a process for imminent new credential changes due to exec
2358  */
2359 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2360 {
2361         struct task_security_struct *new_tsec;
2362         struct rlimit *rlim, *initrlim;
2363         int rc, i;
2364
2365         new_tsec = bprm->cred->security;
2366         if (new_tsec->sid == new_tsec->osid)
2367                 return;
2368
2369         /* Close files for which the new task SID is not authorized. */
2370         flush_unauthorized_files(bprm->cred, current->files);
2371
2372         /* Always clear parent death signal on SID transitions. */
2373         current->pdeath_signal = 0;
2374
2375         /* Check whether the new SID can inherit resource limits from the old
2376          * SID.  If not, reset all soft limits to the lower of the current
2377          * task's hard limit and the init task's soft limit.
2378          *
2379          * Note that the setting of hard limits (even to lower them) can be
2380          * controlled by the setrlimit check.  The inclusion of the init task's
2381          * soft limit into the computation is to avoid resetting soft limits
2382          * higher than the default soft limit for cases where the default is
2383          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2384          */
2385         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2386                           PROCESS__RLIMITINH, NULL);
2387         if (rc) {
2388                 /* protect against do_prlimit() */
2389                 task_lock(current);
2390                 for (i = 0; i < RLIM_NLIMITS; i++) {
2391                         rlim = current->signal->rlim + i;
2392                         initrlim = init_task.signal->rlim + i;
2393                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2394                 }
2395                 task_unlock(current);
2396                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2397         }
2398 }
2399
2400 /*
2401  * Clean up the process immediately after the installation of new credentials
2402  * due to exec
2403  */
2404 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2405 {
2406         const struct task_security_struct *tsec = current_security();
2407         struct itimerval itimer;
2408         u32 osid, sid;
2409         int rc, i;
2410
2411         osid = tsec->osid;
2412         sid = tsec->sid;
2413
2414         if (sid == osid)
2415                 return;
2416
2417         /* Check whether the new SID can inherit signal state from the old SID.
2418          * If not, clear itimers to avoid subsequent signal generation and
2419          * flush and unblock signals.
2420          *
2421          * This must occur _after_ the task SID has been updated so that any
2422          * kill done after the flush will be checked against the new SID.
2423          */
2424         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2425         if (rc) {
2426                 memset(&itimer, 0, sizeof itimer);
2427                 for (i = 0; i < 3; i++)
2428                         do_setitimer(i, &itimer, NULL);
2429                 spin_lock_irq(&current->sighand->siglock);
2430                 if (!fatal_signal_pending(current)) {
2431                         flush_sigqueue(&current->pending);
2432                         flush_sigqueue(&current->signal->shared_pending);
2433                         flush_signal_handlers(current, 1);
2434                         sigemptyset(&current->blocked);
2435                         recalc_sigpending();
2436                 }
2437                 spin_unlock_irq(&current->sighand->siglock);
2438         }
2439
2440         /* Wake up the parent if it is waiting so that it can recheck
2441          * wait permission to the new task SID. */
2442         read_lock(&tasklist_lock);
2443         __wake_up_parent(current, current->real_parent);
2444         read_unlock(&tasklist_lock);
2445 }
2446
2447 /* superblock security operations */
2448
2449 static int selinux_sb_alloc_security(struct super_block *sb)
2450 {
2451         return superblock_alloc_security(sb);
2452 }
2453
2454 static void selinux_sb_free_security(struct super_block *sb)
2455 {
2456         superblock_free_security(sb);
2457 }
2458
2459 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2460 {
2461         if (plen > olen)
2462                 return 0;
2463
2464         return !memcmp(prefix, option, plen);
2465 }
2466
2467 static inline int selinux_option(char *option, int len)
2468 {
2469         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2470                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2471                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2472                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2473                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2474 }
2475
2476 static inline void take_option(char **to, char *from, int *first, int len)
2477 {
2478         if (!*first) {
2479                 **to = ',';
2480                 *to += 1;
2481         } else
2482                 *first = 0;
2483         memcpy(*to, from, len);
2484         *to += len;
2485 }
2486
2487 static inline void take_selinux_option(char **to, char *from, int *first,
2488                                        int len)
2489 {
2490         int current_size = 0;
2491
2492         if (!*first) {
2493                 **to = '|';
2494                 *to += 1;
2495         } else
2496                 *first = 0;
2497
2498         while (current_size < len) {
2499                 if (*from != '"') {
2500                         **to = *from;
2501                         *to += 1;
2502                 }
2503                 from += 1;
2504                 current_size += 1;
2505         }
2506 }
2507
2508 static int selinux_sb_copy_data(char *orig, char *copy)
2509 {
2510         int fnosec, fsec, rc = 0;
2511         char *in_save, *in_curr, *in_end;
2512         char *sec_curr, *nosec_save, *nosec;
2513         int open_quote = 0;
2514
2515         in_curr = orig;
2516         sec_curr = copy;
2517
2518         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2519         if (!nosec) {
2520                 rc = -ENOMEM;
2521                 goto out;
2522         }
2523
2524         nosec_save = nosec;
2525         fnosec = fsec = 1;
2526         in_save = in_end = orig;
2527
2528         do {
2529                 if (*in_end == '"')
2530                         open_quote = !open_quote;
2531                 if ((*in_end == ',' && open_quote == 0) ||
2532                                 *in_end == '\0') {
2533                         int len = in_end - in_curr;
2534
2535                         if (selinux_option(in_curr, len))
2536                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2537                         else
2538                                 take_option(&nosec, in_curr, &fnosec, len);
2539
2540                         in_curr = in_end + 1;
2541                 }
2542         } while (*in_end++);
2543
2544         strcpy(in_save, nosec_save);
2545         free_page((unsigned long)nosec_save);
2546 out:
2547         return rc;
2548 }
2549
2550 static int selinux_sb_remount(struct super_block *sb, void *data)
2551 {
2552         int rc, i, *flags;
2553         struct security_mnt_opts opts;
2554         char *secdata, **mount_options;
2555         struct superblock_security_struct *sbsec = sb->s_security;
2556
2557         if (!(sbsec->flags & SE_SBINITIALIZED))
2558                 return 0;
2559
2560         if (!data)
2561                 return 0;
2562
2563         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2564                 return 0;
2565
2566         security_init_mnt_opts(&opts);
2567         secdata = alloc_secdata();
2568         if (!secdata)
2569                 return -ENOMEM;
2570         rc = selinux_sb_copy_data(data, secdata);
2571         if (rc)
2572                 goto out_free_secdata;
2573
2574         rc = selinux_parse_opts_str(secdata, &opts);
2575         if (rc)
2576                 goto out_free_secdata;
2577
2578         mount_options = opts.mnt_opts;
2579         flags = opts.mnt_opts_flags;
2580
2581         for (i = 0; i < opts.num_mnt_opts; i++) {
2582                 u32 sid;
2583                 size_t len;
2584
2585                 if (flags[i] == SBLABEL_MNT)
2586                         continue;
2587                 len = strlen(mount_options[i]);
2588                 rc = security_context_to_sid(mount_options[i], len, &sid,
2589                                              GFP_KERNEL);
2590                 if (rc) {
2591                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2592                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2593                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2594                         goto out_free_opts;
2595                 }
2596                 rc = -EINVAL;
2597                 switch (flags[i]) {
2598                 case FSCONTEXT_MNT:
2599                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2600                                 goto out_bad_option;
2601                         break;
2602                 case CONTEXT_MNT:
2603                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2604                                 goto out_bad_option;
2605                         break;
2606                 case ROOTCONTEXT_MNT: {
2607                         struct inode_security_struct *root_isec;
2608                         root_isec = d_backing_inode(sb->s_root)->i_security;
2609
2610                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2611                                 goto out_bad_option;
2612                         break;
2613                 }
2614                 case DEFCONTEXT_MNT:
2615                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2616                                 goto out_bad_option;
2617                         break;
2618                 default:
2619                         goto out_free_opts;
2620                 }
2621         }
2622
2623         rc = 0;
2624 out_free_opts:
2625         security_free_mnt_opts(&opts);
2626 out_free_secdata:
2627         free_secdata(secdata);
2628         return rc;
2629 out_bad_option:
2630         printk(KERN_WARNING "SELinux: unable to change security options "
2631                "during remount (dev %s, type=%s)\n", sb->s_id,
2632                sb->s_type->name);
2633         goto out_free_opts;
2634 }
2635
2636 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2637 {
2638         const struct cred *cred = current_cred();
2639         struct common_audit_data ad;
2640         int rc;
2641
2642         rc = superblock_doinit(sb, data);
2643         if (rc)
2644                 return rc;
2645
2646         /* Allow all mounts performed by the kernel */
2647         if (flags & MS_KERNMOUNT)
2648                 return 0;
2649
2650         ad.type = LSM_AUDIT_DATA_DENTRY;
2651         ad.u.dentry = sb->s_root;
2652         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2653 }
2654
2655 static int selinux_sb_statfs(struct dentry *dentry)
2656 {
2657         const struct cred *cred = current_cred();
2658         struct common_audit_data ad;
2659
2660         ad.type = LSM_AUDIT_DATA_DENTRY;
2661         ad.u.dentry = dentry->d_sb->s_root;
2662         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2663 }
2664
2665 static int selinux_mount(const char *dev_name,
2666                          struct path *path,
2667                          const char *type,
2668                          unsigned long flags,
2669                          void *data)
2670 {
2671         const struct cred *cred = current_cred();
2672
2673         if (flags & MS_REMOUNT)
2674                 return superblock_has_perm(cred, path->dentry->d_sb,
2675                                            FILESYSTEM__REMOUNT, NULL);
2676         else
2677                 return path_has_perm(cred, path, FILE__MOUNTON);
2678 }
2679
2680 static int selinux_umount(struct vfsmount *mnt, int flags)
2681 {
2682         const struct cred *cred = current_cred();
2683
2684         return superblock_has_perm(cred, mnt->mnt_sb,
2685                                    FILESYSTEM__UNMOUNT, NULL);
2686 }
2687
2688 /* inode security operations */
2689
2690 static int selinux_inode_alloc_security(struct inode *inode)
2691 {
2692         return inode_alloc_security(inode);
2693 }
2694
2695 static void selinux_inode_free_security(struct inode *inode)
2696 {
2697         inode_free_security(inode);
2698 }
2699
2700 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2701                                         struct qstr *name, void **ctx,
2702                                         u32 *ctxlen)
2703 {
2704         const struct cred *cred = current_cred();
2705         struct task_security_struct *tsec;
2706         struct inode_security_struct *dsec;
2707         struct superblock_security_struct *sbsec;
2708         struct inode *dir = d_backing_inode(dentry->d_parent);
2709         u32 newsid;
2710         int rc;
2711
2712         tsec = cred->security;
2713         dsec = dir->i_security;
2714         sbsec = dir->i_sb->s_security;
2715
2716         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2717                 newsid = tsec->create_sid;
2718         } else {
2719                 rc = security_transition_sid(tsec->sid, dsec->sid,
2720                                              inode_mode_to_security_class(mode),
2721                                              name,
2722                                              &newsid);
2723                 if (rc) {
2724                         printk(KERN_WARNING
2725                                 "%s: security_transition_sid failed, rc=%d\n",
2726                                __func__, -rc);
2727                         return rc;
2728                 }
2729         }
2730
2731         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2732 }
2733
2734 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2735                                        const struct qstr *qstr,
2736                                        const char **name,
2737                                        void **value, size_t *len)
2738 {
2739         const struct task_security_struct *tsec = current_security();
2740         struct inode_security_struct *dsec;
2741         struct superblock_security_struct *sbsec;
2742         u32 sid, newsid, clen;
2743         int rc;
2744         char *context;
2745
2746         dsec = dir->i_security;
2747         sbsec = dir->i_sb->s_security;
2748
2749         sid = tsec->sid;
2750         newsid = tsec->create_sid;
2751
2752         if ((sbsec->flags & SE_SBINITIALIZED) &&
2753             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2754                 newsid = sbsec->mntpoint_sid;
2755         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2756                 rc = security_transition_sid(sid, dsec->sid,
2757                                              inode_mode_to_security_class(inode->i_mode),
2758                                              qstr, &newsid);
2759                 if (rc) {
2760                         printk(KERN_WARNING "%s:  "
2761                                "security_transition_sid failed, rc=%d (dev=%s "
2762                                "ino=%ld)\n",
2763                                __func__,
2764                                -rc, inode->i_sb->s_id, inode->i_ino);
2765                         return rc;
2766                 }
2767         }
2768
2769         /* Possibly defer initialization to selinux_complete_init. */
2770         if (sbsec->flags & SE_SBINITIALIZED) {
2771                 struct inode_security_struct *isec = inode->i_security;
2772                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2773                 isec->sid = newsid;
2774                 isec->initialized = 1;
2775         }
2776
2777         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2778                 return -EOPNOTSUPP;
2779
2780         if (name)
2781                 *name = XATTR_SELINUX_SUFFIX;
2782
2783         if (value && len) {
2784                 rc = security_sid_to_context_force(newsid, &context, &clen);
2785                 if (rc)
2786                         return rc;
2787                 *value = context;
2788                 *len = clen;
2789         }
2790
2791         return 0;
2792 }
2793
2794 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2795 {
2796         return may_create(dir, dentry, SECCLASS_FILE);
2797 }
2798
2799 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2800 {
2801         return may_link(dir, old_dentry, MAY_LINK);
2802 }
2803
2804 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2805 {
2806         return may_link(dir, dentry, MAY_UNLINK);
2807 }
2808
2809 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2810 {
2811         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2812 }
2813
2814 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2815 {
2816         return may_create(dir, dentry, SECCLASS_DIR);
2817 }
2818
2819 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2820 {
2821         return may_link(dir, dentry, MAY_RMDIR);
2822 }
2823
2824 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2825 {
2826         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2827 }
2828
2829 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2830                                 struct inode *new_inode, struct dentry *new_dentry)
2831 {
2832         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2833 }
2834
2835 static int selinux_inode_readlink(struct dentry *dentry)
2836 {
2837         const struct cred *cred = current_cred();
2838
2839         return dentry_has_perm(cred, dentry, FILE__READ);
2840 }
2841
2842 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2843 {
2844         const struct cred *cred = current_cred();
2845
2846         return dentry_has_perm(cred, dentry, FILE__READ);
2847 }
2848
2849 static noinline int audit_inode_permission(struct inode *inode,
2850                                            u32 perms, u32 audited, u32 denied,
2851                                            int result,
2852                                            unsigned flags)
2853 {
2854         struct common_audit_data ad;
2855         struct inode_security_struct *isec = inode->i_security;
2856         int rc;
2857
2858         ad.type = LSM_AUDIT_DATA_INODE;
2859         ad.u.inode = inode;
2860
2861         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2862                             audited, denied, result, &ad, flags);
2863         if (rc)
2864                 return rc;
2865         return 0;
2866 }
2867
2868 static int selinux_inode_permission(struct inode *inode, int mask)
2869 {
2870         const struct cred *cred = current_cred();
2871         u32 perms;
2872         bool from_access;
2873         unsigned flags = mask & MAY_NOT_BLOCK;
2874         struct inode_security_struct *isec;
2875         u32 sid;
2876         struct av_decision avd;
2877         int rc, rc2;
2878         u32 audited, denied;
2879
2880         from_access = mask & MAY_ACCESS;
2881         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2882
2883         /* No permission to check.  Existence test. */
2884         if (!mask)
2885                 return 0;
2886
2887         validate_creds(cred);
2888
2889         if (unlikely(IS_PRIVATE(inode)))
2890                 return 0;
2891
2892         perms = file_mask_to_av(inode->i_mode, mask);
2893
2894         sid = cred_sid(cred);
2895         isec = inode->i_security;
2896
2897         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2898         audited = avc_audit_required(perms, &avd, rc,
2899                                      from_access ? FILE__AUDIT_ACCESS : 0,
2900                                      &denied);
2901         if (likely(!audited))
2902                 return rc;
2903
2904         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2905         if (rc2)
2906                 return rc2;
2907         return rc;
2908 }
2909
2910 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2911 {
2912         const struct cred *cred = current_cred();
2913         unsigned int ia_valid = iattr->ia_valid;
2914         __u32 av = FILE__WRITE;
2915
2916         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2917         if (ia_valid & ATTR_FORCE) {
2918                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2919                               ATTR_FORCE);
2920                 if (!ia_valid)
2921                         return 0;
2922         }
2923
2924         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2925                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2926                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2927
2928         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2929                 av |= FILE__OPEN;
2930
2931         return dentry_has_perm(cred, dentry, av);
2932 }
2933
2934 static int selinux_inode_getattr(const struct path *path)
2935 {
2936         return path_has_perm(current_cred(), path, FILE__GETATTR);
2937 }
2938
2939 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2940 {
2941         const struct cred *cred = current_cred();
2942
2943         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2944                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2945                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2946                         if (!capable(CAP_SETFCAP))
2947                                 return -EPERM;
2948                 } else if (!capable(CAP_SYS_ADMIN)) {
2949                         /* A different attribute in the security namespace.
2950                            Restrict to administrator. */
2951                         return -EPERM;
2952                 }
2953         }
2954
2955         /* Not an attribute we recognize, so just check the
2956            ordinary setattr permission. */
2957         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2958 }
2959
2960 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2961                                   const void *value, size_t size, int flags)
2962 {
2963         struct inode *inode = d_backing_inode(dentry);
2964         struct inode_security_struct *isec = inode->i_security;
2965         struct superblock_security_struct *sbsec;
2966         struct common_audit_data ad;
2967         u32 newsid, sid = current_sid();
2968         int rc = 0;
2969
2970         if (strcmp(name, XATTR_NAME_SELINUX))
2971                 return selinux_inode_setotherxattr(dentry, name);
2972
2973         sbsec = inode->i_sb->s_security;
2974         if (!(sbsec->flags & SBLABEL_MNT))
2975                 return -EOPNOTSUPP;
2976
2977         if (!inode_owner_or_capable(inode))
2978                 return -EPERM;
2979
2980         ad.type = LSM_AUDIT_DATA_DENTRY;
2981         ad.u.dentry = dentry;
2982
2983         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2984                           FILE__RELABELFROM, &ad);
2985         if (rc)
2986                 return rc;
2987
2988         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2989         if (rc == -EINVAL) {
2990                 if (!capable(CAP_MAC_ADMIN)) {
2991                         struct audit_buffer *ab;
2992                         size_t audit_size;
2993                         const char *str;
2994
2995                         /* We strip a nul only if it is at the end, otherwise the
2996                          * context contains a nul and we should audit that */
2997                         if (value) {
2998                                 str = value;
2999                                 if (str[size - 1] == '\0')
3000                                         audit_size = size - 1;
3001                                 else
3002                                         audit_size = size;
3003                         } else {
3004                                 str = "";
3005                                 audit_size = 0;
3006                         }
3007                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3008                         audit_log_format(ab, "op=setxattr invalid_context=");
3009                         audit_log_n_untrustedstring(ab, value, audit_size);
3010                         audit_log_end(ab);
3011
3012                         return rc;
3013                 }
3014                 rc = security_context_to_sid_force(value, size, &newsid);
3015         }
3016         if (rc)
3017                 return rc;
3018
3019         rc = avc_has_perm(sid, newsid, isec->sclass,
3020                           FILE__RELABELTO, &ad);
3021         if (rc)
3022                 return rc;
3023
3024         rc = security_validate_transition(isec->sid, newsid, sid,
3025                                           isec->sclass);
3026         if (rc)
3027                 return rc;
3028
3029         return avc_has_perm(newsid,
3030                             sbsec->sid,
3031                             SECCLASS_FILESYSTEM,
3032                             FILESYSTEM__ASSOCIATE,
3033                             &ad);
3034 }
3035
3036 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3037                                         const void *value, size_t size,
3038                                         int flags)
3039 {
3040         struct inode *inode = d_backing_inode(dentry);
3041         struct inode_security_struct *isec = inode->i_security;
3042         u32 newsid;
3043         int rc;
3044
3045         if (strcmp(name, XATTR_NAME_SELINUX)) {
3046                 /* Not an attribute we recognize, so nothing to do. */
3047                 return;
3048         }
3049
3050         rc = security_context_to_sid_force(value, size, &newsid);
3051         if (rc) {
3052                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3053                        "for (%s, %lu), rc=%d\n",
3054                        inode->i_sb->s_id, inode->i_ino, -rc);
3055                 return;
3056         }
3057
3058         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3059         isec->sid = newsid;
3060         isec->initialized = 1;
3061
3062         return;
3063 }
3064
3065 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3066 {
3067         const struct cred *cred = current_cred();
3068
3069         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3070 }
3071
3072 static int selinux_inode_listxattr(struct dentry *dentry)
3073 {
3074         const struct cred *cred = current_cred();
3075
3076         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3077 }
3078
3079 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3080 {
3081         if (strcmp(name, XATTR_NAME_SELINUX))
3082                 return selinux_inode_setotherxattr(dentry, name);
3083
3084         /* No one is allowed to remove a SELinux security label.
3085            You can change the label, but all data must be labeled. */
3086         return -EACCES;
3087 }
3088
3089 /*
3090  * Copy the inode security context value to the user.
3091  *
3092  * Permission check is handled by selinux_inode_getxattr hook.
3093  */
3094 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3095 {
3096         u32 size;
3097         int error;
3098         char *context = NULL;
3099         struct inode_security_struct *isec = inode->i_security;
3100
3101         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3102                 return -EOPNOTSUPP;
3103
3104         /*
3105          * If the caller has CAP_MAC_ADMIN, then get the raw context
3106          * value even if it is not defined by current policy; otherwise,
3107          * use the in-core value under current policy.
3108          * Use the non-auditing forms of the permission checks since
3109          * getxattr may be called by unprivileged processes commonly
3110          * and lack of permission just means that we fall back to the
3111          * in-core context value, not a denial.
3112          */
3113         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3114                             SECURITY_CAP_NOAUDIT);
3115         if (!error)
3116                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3117                                             SECURITY_CAP_NOAUDIT);
3118         if (!error)
3119                 error = security_sid_to_context_force(isec->sid, &context,
3120                                                       &size);
3121         else
3122                 error = security_sid_to_context(isec->sid, &context, &size);
3123         if (error)
3124                 return error;
3125         error = size;
3126         if (alloc) {
3127                 *buffer = context;
3128                 goto out_nofree;
3129         }
3130         kfree(context);
3131 out_nofree:
3132         return error;
3133 }
3134
3135 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3136                                      const void *value, size_t size, int flags)
3137 {
3138         struct inode_security_struct *isec = inode->i_security;
3139         u32 newsid;
3140         int rc;
3141
3142         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3143                 return -EOPNOTSUPP;
3144
3145         if (!value || !size)
3146                 return -EACCES;
3147
3148         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3149         if (rc)
3150                 return rc;
3151
3152         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3153         isec->sid = newsid;
3154         isec->initialized = 1;
3155         return 0;
3156 }
3157
3158 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3159 {
3160         const int len = sizeof(XATTR_NAME_SELINUX);
3161         if (buffer && len <= buffer_size)
3162                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3163         return len;
3164 }
3165
3166 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3167 {
3168         struct inode_security_struct *isec = inode->i_security;
3169         *secid = isec->sid;
3170 }
3171
3172 /* file security operations */
3173
3174 static int selinux_revalidate_file_permission(struct file *file, int mask)
3175 {
3176         const struct cred *cred = current_cred();
3177         struct inode *inode = file_inode(file);
3178
3179         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3180         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3181                 mask |= MAY_APPEND;
3182
3183         return file_has_perm(cred, file,
3184                              file_mask_to_av(inode->i_mode, mask));
3185 }
3186
3187 static int selinux_file_permission(struct file *file, int mask)
3188 {
3189         struct inode *inode = file_inode(file);
3190         struct file_security_struct *fsec = file->f_security;
3191         struct inode_security_struct *isec = inode->i_security;
3192         u32 sid = current_sid();
3193
3194         if (!mask)
3195                 /* No permission to check.  Existence test. */
3196                 return 0;
3197
3198         if (sid == fsec->sid && fsec->isid == isec->sid &&
3199             fsec->pseqno == avc_policy_seqno())
3200                 /* No change since file_open check. */
3201                 return 0;
3202
3203         return selinux_revalidate_file_permission(file, mask);
3204 }
3205
3206 static int selinux_file_alloc_security(struct file *file)
3207 {
3208         return file_alloc_security(file);
3209 }
3210
3211 static void selinux_file_free_security(struct file *file)
3212 {
3213         file_free_security(file);
3214 }
3215
3216 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3217                               unsigned long arg)
3218 {
3219         const struct cred *cred = current_cred();
3220         int error = 0;
3221
3222         switch (cmd) {
3223         case FIONREAD:
3224         /* fall through */
3225         case FIBMAP:
3226         /* fall through */
3227         case FIGETBSZ:
3228         /* fall through */
3229         case FS_IOC_GETFLAGS:
3230         /* fall through */
3231         case FS_IOC_GETVERSION:
3232                 error = file_has_perm(cred, file, FILE__GETATTR);
3233                 break;
3234
3235         case FS_IOC_SETFLAGS:
3236         /* fall through */
3237         case FS_IOC_SETVERSION:
3238                 error = file_has_perm(cred, file, FILE__SETATTR);
3239                 break;
3240
3241         /* sys_ioctl() checks */
3242         case FIONBIO:
3243         /* fall through */
3244         case FIOASYNC:
3245                 error = file_has_perm(cred, file, 0);
3246                 break;
3247
3248         case KDSKBENT:
3249         case KDSKBSENT:
3250                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3251                                             SECURITY_CAP_AUDIT);
3252                 break;
3253
3254         /* default case assumes that the command will go
3255          * to the file's ioctl() function.
3256          */
3257         default:
3258                 error = file_has_perm(cred, file, FILE__IOCTL);
3259         }
3260         return error;
3261 }
3262
3263 static int default_noexec;
3264
3265 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3266 {
3267         const struct cred *cred = current_cred();
3268         int rc = 0;
3269
3270         if (default_noexec &&
3271             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3272                 /*
3273                  * We are making executable an anonymous mapping or a
3274                  * private file mapping that will also be writable.
3275                  * This has an additional check.
3276                  */
3277                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3278                 if (rc)
3279                         goto error;
3280         }
3281
3282         if (file) {
3283                 /* read access is always possible with a mapping */
3284                 u32 av = FILE__READ;
3285
3286                 /* write access only matters if the mapping is shared */
3287                 if (shared && (prot & PROT_WRITE))
3288                         av |= FILE__WRITE;
3289
3290                 if (prot & PROT_EXEC)
3291                         av |= FILE__EXECUTE;
3292
3293                 return file_has_perm(cred, file, av);
3294         }
3295
3296 error:
3297         return rc;
3298 }
3299
3300 static int selinux_mmap_addr(unsigned long addr)
3301 {
3302         int rc = 0;
3303
3304         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3305                 u32 sid = current_sid();
3306                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3307                                   MEMPROTECT__MMAP_ZERO, NULL);
3308         }
3309
3310         return rc;
3311 }
3312
3313 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3314                              unsigned long prot, unsigned long flags)
3315 {
3316         if (selinux_checkreqprot)
3317                 prot = reqprot;
3318
3319         return file_map_prot_check(file, prot,
3320                                    (flags & MAP_TYPE) == MAP_SHARED);
3321 }
3322
3323 static int selinux_file_mprotect(struct vm_area_struct *vma,
3324                                  unsigned long reqprot,
3325                                  unsigned long prot)
3326 {
3327         const struct cred *cred = current_cred();
3328
3329         if (selinux_checkreqprot)
3330                 prot = reqprot;
3331
3332         if (default_noexec &&
3333             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3334                 int rc = 0;
3335                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3336                     vma->vm_end <= vma->vm_mm->brk) {
3337                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3338                 } else if (!vma->vm_file &&
3339                            vma->vm_start <= vma->vm_mm->start_stack &&
3340                            vma->vm_end >= vma->vm_mm->start_stack) {
3341                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3342                 } else if (vma->vm_file && vma->anon_vma) {
3343                         /*
3344                          * We are making executable a file mapping that has
3345                          * had some COW done. Since pages might have been
3346                          * written, check ability to execute the possibly
3347                          * modified content.  This typically should only
3348                          * occur for text relocations.
3349                          */
3350                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3351                 }
3352                 if (rc)
3353                         return rc;
3354         }
3355
3356         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3357 }
3358
3359 static int selinux_file_lock(struct file *file, unsigned int cmd)
3360 {
3361         const struct cred *cred = current_cred();
3362
3363         return file_has_perm(cred, file, FILE__LOCK);
3364 }
3365
3366 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3367                               unsigned long arg)
3368 {
3369         const struct cred *cred = current_cred();
3370         int err = 0;
3371
3372         switch (cmd) {
3373         case F_SETFL:
3374                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3375                         err = file_has_perm(cred, file, FILE__WRITE);
3376                         break;
3377                 }
3378                 /* fall through */
3379         case F_SETOWN:
3380         case F_SETSIG:
3381         case F_GETFL:
3382         case F_GETOWN:
3383         case F_GETSIG:
3384         case F_GETOWNER_UIDS:
3385                 /* Just check FD__USE permission */
3386                 err = file_has_perm(cred, file, 0);
3387                 break;
3388         case F_GETLK:
3389         case F_SETLK:
3390         case F_SETLKW:
3391         case F_OFD_GETLK:
3392         case F_OFD_SETLK:
3393         case F_OFD_SETLKW:
3394 #if BITS_PER_LONG == 32
3395         case F_GETLK64:
3396         case F_SETLK64:
3397         case F_SETLKW64:
3398 #endif
3399                 err = file_has_perm(cred, file, FILE__LOCK);
3400                 break;
3401         }
3402
3403         return err;
3404 }
3405
3406 static void selinux_file_set_fowner(struct file *file)
3407 {
3408         struct file_security_struct *fsec;
3409
3410         fsec = file->f_security;
3411         fsec->fown_sid = current_sid();
3412 }
3413
3414 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3415                                        struct fown_struct *fown, int signum)
3416 {
3417         struct file *file;
3418         u32 sid = task_sid(tsk);
3419         u32 perm;
3420         struct file_security_struct *fsec;
3421
3422         /* struct fown_struct is never outside the context of a struct file */
3423         file = container_of(fown, struct file, f_owner);
3424
3425         fsec = file->f_security;
3426
3427         if (!signum)
3428                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3429         else
3430                 perm = signal_to_av(signum);
3431
3432         return avc_has_perm(fsec->fown_sid, sid,
3433                             SECCLASS_PROCESS, perm, NULL);
3434 }
3435
3436 static int selinux_file_receive(struct file *file)
3437 {
3438         const struct cred *cred = current_cred();
3439
3440         return file_has_perm(cred, file, file_to_av(file));
3441 }
3442
3443 static int selinux_file_open(struct file *file, const struct cred *cred)
3444 {
3445         struct file_security_struct *fsec;
3446         struct inode_security_struct *isec;
3447
3448         fsec = file->f_security;
3449         isec = file_inode(file)->i_security;
3450         /*
3451          * Save inode label and policy sequence number
3452          * at open-time so that selinux_file_permission
3453          * can determine whether revalidation is necessary.
3454          * Task label is already saved in the file security
3455          * struct as its SID.
3456          */
3457         fsec->isid = isec->sid;
3458         fsec->pseqno = avc_policy_seqno();
3459         /*
3460          * Since the inode label or policy seqno may have changed
3461          * between the selinux_inode_permission check and the saving
3462          * of state above, recheck that access is still permitted.
3463          * Otherwise, access might never be revalidated against the
3464          * new inode label or new policy.
3465          * This check is not redundant - do not remove.
3466          */
3467         return file_path_has_perm(cred, file, open_file_to_av(file));
3468 }
3469
3470 /* task security operations */
3471
3472 static int selinux_task_create(unsigned long clone_flags)
3473 {
3474         return current_has_perm(current, PROCESS__FORK);
3475 }
3476
3477 /*
3478  * allocate the SELinux part of blank credentials
3479  */
3480 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3481 {
3482         struct task_security_struct *tsec;
3483
3484         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3485         if (!tsec)
3486                 return -ENOMEM;
3487
3488         cred->security = tsec;
3489         return 0;
3490 }
3491
3492 /*
3493  * detach and free the LSM part of a set of credentials
3494  */
3495 static void selinux_cred_free(struct cred *cred)
3496 {
3497         struct task_security_struct *tsec = cred->security;
3498
3499         /*
3500          * cred->security == NULL if security_cred_alloc_blank() or
3501          * security_prepare_creds() returned an error.
3502          */
3503         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3504         cred->security = (void *) 0x7UL;
3505         kfree(tsec);
3506 }
3507
3508 /*
3509  * prepare a new set of credentials for modification
3510  */
3511 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3512                                 gfp_t gfp)
3513 {
3514         const struct task_security_struct *old_tsec;
3515         struct task_security_struct *tsec;
3516
3517         old_tsec = old->security;
3518
3519         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3520         if (!tsec)
3521                 return -ENOMEM;
3522
3523         new->security = tsec;
3524         return 0;
3525 }
3526
3527 /*
3528  * transfer the SELinux data to a blank set of creds
3529  */
3530 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3531 {
3532         const struct task_security_struct *old_tsec = old->security;
3533         struct task_security_struct *tsec = new->security;
3534
3535         *tsec = *old_tsec;
3536 }
3537
3538 /*
3539  * set the security data for a kernel service
3540  * - all the creation contexts are set to unlabelled
3541  */
3542 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3543 {
3544         struct task_security_struct *tsec = new->security;
3545         u32 sid = current_sid();
3546         int ret;
3547
3548         ret = avc_has_perm(sid, secid,
3549                            SECCLASS_KERNEL_SERVICE,
3550                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3551                            NULL);
3552         if (ret == 0) {
3553                 tsec->sid = secid;
3554                 tsec->create_sid = 0;
3555                 tsec->keycreate_sid = 0;
3556                 tsec->sockcreate_sid = 0;
3557         }
3558         return ret;
3559 }
3560
3561 /*
3562  * set the file creation context in a security record to the same as the
3563  * objective context of the specified inode
3564  */
3565 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3566 {
3567         struct inode_security_struct *isec = inode->i_security;
3568         struct task_security_struct *tsec = new->security;
3569         u32 sid = current_sid();
3570         int ret;
3571
3572         ret = avc_has_perm(sid, isec->sid,
3573                            SECCLASS_KERNEL_SERVICE,
3574                            KERNEL_SERVICE__CREATE_FILES_AS,
3575                            NULL);
3576
3577         if (ret == 0)
3578                 tsec->create_sid = isec->sid;
3579         return ret;
3580 }
3581
3582 static int selinux_kernel_module_request(char *kmod_name)
3583 {
3584         u32 sid;
3585         struct common_audit_data ad;
3586
3587         sid = task_sid(current);
3588
3589         ad.type = LSM_AUDIT_DATA_KMOD;
3590         ad.u.kmod_name = kmod_name;
3591
3592         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3593                             SYSTEM__MODULE_REQUEST, &ad);
3594 }
3595
3596 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3597 {
3598         return current_has_perm(p, PROCESS__SETPGID);
3599 }
3600
3601 static int selinux_task_getpgid(struct task_struct *p)
3602 {
3603         return current_has_perm(p, PROCESS__GETPGID);
3604 }
3605
3606 static int selinux_task_getsid(struct task_struct *p)
3607 {
3608         return current_has_perm(p, PROCESS__GETSESSION);
3609 }
3610
3611 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3612 {
3613         *secid = task_sid(p);
3614 }
3615
3616 static int selinux_task_setnice(struct task_struct *p, int nice)
3617 {
3618         return current_has_perm(p, PROCESS__SETSCHED);
3619 }
3620
3621 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3622 {
3623         return current_has_perm(p, PROCESS__SETSCHED);
3624 }
3625
3626 static int selinux_task_getioprio(struct task_struct *p)
3627 {
3628         return current_has_perm(p, PROCESS__GETSCHED);
3629 }
3630
3631 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3632                 struct rlimit *new_rlim)
3633 {
3634         struct rlimit *old_rlim = p->signal->rlim + resource;
3635
3636         /* Control the ability to change the hard limit (whether
3637            lowering or raising it), so that the hard limit can
3638            later be used as a safe reset point for the soft limit
3639            upon context transitions.  See selinux_bprm_committing_creds. */
3640         if (old_rlim->rlim_max != new_rlim->rlim_max)
3641                 return current_has_perm(p, PROCESS__SETRLIMIT);
3642
3643         return 0;
3644 }
3645
3646 static int selinux_task_setscheduler(struct task_struct *p)
3647 {
3648         return current_has_perm(p, PROCESS__SETSCHED);
3649 }
3650
3651 static int selinux_task_getscheduler(struct task_struct *p)
3652 {
3653         return current_has_perm(p, PROCESS__GETSCHED);
3654 }
3655
3656 static int selinux_task_movememory(struct task_struct *p)
3657 {
3658         return current_has_perm(p, PROCESS__SETSCHED);
3659 }
3660
3661 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3662                                 int sig, u32 secid)
3663 {
3664         u32 perm;
3665         int rc;
3666
3667         if (!sig)
3668                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3669         else
3670                 perm = signal_to_av(sig);
3671         if (secid)
3672                 rc = avc_has_perm(secid, task_sid(p),
3673                                   SECCLASS_PROCESS, perm, NULL);
3674         else
3675                 rc = current_has_perm(p, perm);
3676         return rc;
3677 }
3678
3679 static int selinux_task_wait(struct task_struct *p)
3680 {
3681         return task_has_perm(p, current, PROCESS__SIGCHLD);
3682 }
3683
3684 static void selinux_task_to_inode(struct task_struct *p,
3685                                   struct inode *inode)
3686 {
3687         struct inode_security_struct *isec = inode->i_security;
3688         u32 sid = task_sid(p);
3689
3690         isec->sid = sid;
3691         isec->initialized = 1;
3692 }
3693
3694 /* Returns error only if unable to parse addresses */
3695 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3696                         struct common_audit_data *ad, u8 *proto)
3697 {
3698         int offset, ihlen, ret = -EINVAL;
3699         struct iphdr _iph, *ih;
3700
3701         offset = skb_network_offset(skb);
3702         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3703         if (ih == NULL)
3704                 goto out;
3705
3706         ihlen = ih->ihl * 4;
3707         if (ihlen < sizeof(_iph))
3708                 goto out;
3709
3710         ad->u.net->v4info.saddr = ih->saddr;
3711         ad->u.net->v4info.daddr = ih->daddr;
3712         ret = 0;
3713
3714         if (proto)
3715                 *proto = ih->protocol;
3716
3717         switch (ih->protocol) {
3718         case IPPROTO_TCP: {
3719                 struct tcphdr _tcph, *th;
3720
3721                 if (ntohs(ih->frag_off) & IP_OFFSET)
3722                         break;
3723
3724                 offset += ihlen;
3725                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3726                 if (th == NULL)
3727                         break;
3728
3729                 ad->u.net->sport = th->source;
3730                 ad->u.net->dport = th->dest;
3731                 break;
3732         }
3733
3734         case IPPROTO_UDP: {
3735                 struct udphdr _udph, *uh;
3736
3737                 if (ntohs(ih->frag_off) & IP_OFFSET)
3738                         break;
3739
3740                 offset += ihlen;
3741                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3742                 if (uh == NULL)
3743                         break;
3744
3745                 ad->u.net->sport = uh->source;
3746                 ad->u.net->dport = uh->dest;
3747                 break;
3748         }
3749
3750         case IPPROTO_DCCP: {
3751                 struct dccp_hdr _dccph, *dh;
3752
3753                 if (ntohs(ih->frag_off) & IP_OFFSET)
3754                         break;
3755
3756                 offset += ihlen;
3757                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3758                 if (dh == NULL)
3759                         break;
3760
3761                 ad->u.net->sport = dh->dccph_sport;
3762                 ad->u.net->dport = dh->dccph_dport;
3763                 break;
3764         }
3765
3766         default:
3767                 break;
3768         }
3769 out:
3770         return ret;
3771 }
3772
3773 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3774
3775 /* Returns error only if unable to parse addresses */
3776 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3777                         struct common_audit_data *ad, u8 *proto)
3778 {
3779         u8 nexthdr;
3780         int ret = -EINVAL, offset;
3781         struct ipv6hdr _ipv6h, *ip6;
3782         __be16 frag_off;
3783
3784         offset = skb_network_offset(skb);
3785         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3786         if (ip6 == NULL)
3787                 goto out;
3788
3789         ad->u.net->v6info.saddr = ip6->saddr;
3790         ad->u.net->v6info.daddr = ip6->daddr;
3791         ret = 0;
3792
3793         nexthdr = ip6->nexthdr;
3794         offset += sizeof(_ipv6h);
3795         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3796         if (offset < 0)
3797                 goto out;
3798
3799         if (proto)
3800                 *proto = nexthdr;
3801
3802         switch (nexthdr) {
3803         case IPPROTO_TCP: {
3804                 struct tcphdr _tcph, *th;
3805
3806                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3807                 if (th == NULL)
3808                         break;
3809
3810                 ad->u.net->sport = th->source;
3811                 ad->u.net->dport = th->dest;
3812                 break;
3813         }
3814
3815         case IPPROTO_UDP: {
3816                 struct udphdr _udph, *uh;
3817
3818                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3819                 if (uh == NULL)
3820                         break;
3821
3822                 ad->u.net->sport = uh->source;
3823                 ad->u.net->dport = uh->dest;
3824                 break;
3825         }
3826
3827         case IPPROTO_DCCP: {
3828                 struct dccp_hdr _dccph, *dh;
3829
3830                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3831                 if (dh == NULL)
3832                         break;
3833
3834                 ad->u.net->sport = dh->dccph_sport;
3835                 ad->u.net->dport = dh->dccph_dport;
3836                 break;
3837         }
3838
3839         /* includes fragments */
3840         default:
3841                 break;
3842         }
3843 out:
3844         return ret;
3845 }
3846
3847 #endif /* IPV6 */
3848
3849 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3850                              char **_addrp, int src, u8 *proto)
3851 {
3852         char *addrp;
3853         int ret;
3854
3855         switch (ad->u.net->family) {
3856         case PF_INET:
3857                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3858                 if (ret)
3859                         goto parse_error;
3860                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3861                                        &ad->u.net->v4info.daddr);
3862                 goto okay;
3863
3864 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3865         case PF_INET6:
3866                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3867                 if (ret)
3868                         goto parse_error;
3869                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3870                                        &ad->u.net->v6info.daddr);
3871                 goto okay;
3872 #endif  /* IPV6 */
3873         default:
3874                 addrp = NULL;
3875                 goto okay;
3876         }
3877
3878 parse_error:
3879         printk(KERN_WARNING
3880                "SELinux: failure in selinux_parse_skb(),"
3881                " unable to parse packet\n");
3882         return ret;
3883
3884 okay:
3885         if (_addrp)
3886                 *_addrp = addrp;
3887         return 0;
3888 }
3889
3890 /**
3891  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3892  * @skb: the packet
3893  * @family: protocol family
3894  * @sid: the packet's peer label SID
3895  *
3896  * Description:
3897  * Check the various different forms of network peer labeling and determine
3898  * the peer label/SID for the packet; most of the magic actually occurs in
3899  * the security server function security_net_peersid_cmp().  The function
3900  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3901  * or -EACCES if @sid is invalid due to inconsistencies with the different
3902  * peer labels.
3903  *
3904  */
3905 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3906 {
3907         int err;
3908         u32 xfrm_sid;
3909         u32 nlbl_sid;
3910         u32 nlbl_type;
3911
3912         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3913         if (unlikely(err))
3914                 return -EACCES;
3915         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3916         if (unlikely(err))
3917                 return -EACCES;
3918
3919         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3920         if (unlikely(err)) {
3921                 printk(KERN_WARNING
3922                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3923                        " unable to determine packet's peer label\n");
3924                 return -EACCES;
3925         }
3926
3927         return 0;
3928 }
3929
3930 /**
3931  * selinux_conn_sid - Determine the child socket label for a connection
3932  * @sk_sid: the parent socket's SID
3933  * @skb_sid: the packet's SID
3934  * @conn_sid: the resulting connection SID
3935  *
3936  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3937  * combined with the MLS information from @skb_sid in order to create
3938  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3939  * of @sk_sid.  Returns zero on success, negative values on failure.
3940  *
3941  */
3942 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3943 {
3944         int err = 0;
3945
3946         if (skb_sid != SECSID_NULL)
3947                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3948         else
3949                 *conn_sid = sk_sid;
3950
3951         return err;
3952 }
3953
3954 /* socket security operations */
3955
3956 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3957                                  u16 secclass, u32 *socksid)
3958 {
3959         if (tsec->sockcreate_sid > SECSID_NULL) {
3960                 *socksid = tsec->sockcreate_sid;
3961                 return 0;
3962         }
3963
3964         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3965                                        socksid);
3966 }
3967
3968 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3969 {
3970         struct sk_security_struct *sksec = sk->sk_security;
3971         struct common_audit_data ad;
3972         struct lsm_network_audit net = {0,};
3973         u32 tsid = task_sid(task);
3974
3975         if (sksec->sid == SECINITSID_KERNEL)
3976                 return 0;
3977
3978         ad.type = LSM_AUDIT_DATA_NET;
3979         ad.u.net = &net;
3980         ad.u.net->sk = sk;
3981
3982         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3983 }
3984
3985 static int selinux_socket_create(int family, int type,
3986                                  int protocol, int kern)
3987 {
3988         const struct task_security_struct *tsec = current_security();
3989         u32 newsid;
3990         u16 secclass;
3991         int rc;
3992
3993         if (kern)
3994                 return 0;
3995
3996         secclass = socket_type_to_security_class(family, type, protocol);
3997         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3998         if (rc)
3999                 return rc;
4000
4001         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4002 }
4003
4004 static int selinux_socket_post_create(struct socket *sock, int family,
4005                                       int type, int protocol, int kern)
4006 {
4007         const struct task_security_struct *tsec = current_security();
4008         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4009         struct sk_security_struct *sksec;
4010         int err = 0;
4011
4012         isec->sclass = socket_type_to_security_class(family, type, protocol);
4013
4014         if (kern)
4015                 isec->sid = SECINITSID_KERNEL;
4016         else {
4017                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4018                 if (err)
4019                         return err;
4020         }
4021
4022         isec->initialized = 1;
4023
4024         if (sock->sk) {
4025                 sksec = sock->sk->sk_security;
4026                 sksec->sid = isec->sid;
4027                 sksec->sclass = isec->sclass;
4028                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4029         }
4030
4031         return err;
4032 }
4033
4034 /* Range of port numbers used to automatically bind.
4035    Need to determine whether we should perform a name_bind
4036    permission check between the socket and the port number. */
4037
4038 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4039 {
4040         struct sock *sk = sock->sk;
4041         u16 family;
4042         int err;
4043
4044         err = sock_has_perm(current, sk, SOCKET__BIND);
4045         if (err)
4046                 goto out;
4047
4048         /*
4049          * If PF_INET or PF_INET6, check name_bind permission for the port.
4050          * Multiple address binding for SCTP is not supported yet: we just
4051          * check the first address now.
4052          */
4053         family = sk->sk_family;
4054         if (family == PF_INET || family == PF_INET6) {
4055                 char *addrp;
4056                 struct sk_security_struct *sksec = sk->sk_security;
4057                 struct common_audit_data ad;
4058                 struct lsm_network_audit net = {0,};
4059                 struct sockaddr_in *addr4 = NULL;
4060                 struct sockaddr_in6 *addr6 = NULL;
4061                 unsigned short snum;
4062                 u32 sid, node_perm;
4063
4064                 if (family == PF_INET) {
4065                         addr4 = (struct sockaddr_in *)address;
4066                         snum = ntohs(addr4->sin_port);
4067                         addrp = (char *)&addr4->sin_addr.s_addr;
4068                 } else {
4069                         addr6 = (struct sockaddr_in6 *)address;
4070                         snum = ntohs(addr6->sin6_port);
4071                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4072                 }
4073
4074                 if (snum) {
4075                         int low, high;
4076
4077                         inet_get_local_port_range(sock_net(sk), &low, &high);
4078
4079                         if (snum < max(PROT_SOCK, low) || snum > high) {
4080                                 err = sel_netport_sid(sk->sk_protocol,
4081                                                       snum, &sid);
4082                                 if (err)
4083                                         goto out;
4084                                 ad.type = LSM_AUDIT_DATA_NET;
4085                                 ad.u.net = &net;
4086                                 ad.u.net->sport = htons(snum);
4087                                 ad.u.net->family = family;
4088                                 err = avc_has_perm(sksec->sid, sid,
4089                                                    sksec->sclass,
4090                                                    SOCKET__NAME_BIND, &ad);
4091                                 if (err)
4092                                         goto out;
4093                         }
4094                 }
4095
4096                 switch (sksec->sclass) {
4097                 case SECCLASS_TCP_SOCKET:
4098                         node_perm = TCP_SOCKET__NODE_BIND;
4099                         break;
4100
4101                 case SECCLASS_UDP_SOCKET:
4102                         node_perm = UDP_SOCKET__NODE_BIND;
4103                         break;
4104
4105                 case SECCLASS_DCCP_SOCKET:
4106                         node_perm = DCCP_SOCKET__NODE_BIND;
4107                         break;
4108
4109                 default:
4110                         node_perm = RAWIP_SOCKET__NODE_BIND;
4111                         break;
4112                 }
4113
4114                 err = sel_netnode_sid(addrp, family, &sid);
4115                 if (err)
4116                         goto out;
4117
4118                 ad.type = LSM_AUDIT_DATA_NET;
4119                 ad.u.net = &net;
4120                 ad.u.net->sport = htons(snum);
4121                 ad.u.net->family = family;
4122
4123                 if (family == PF_INET)
4124                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4125                 else
4126                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4127
4128                 err = avc_has_perm(sksec->sid, sid,
4129                                    sksec->sclass, node_perm, &ad);
4130                 if (err)
4131                         goto out;
4132         }
4133 out:
4134         return err;
4135 }
4136
4137 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4138 {
4139         struct sock *sk = sock->sk;
4140         struct sk_security_struct *sksec = sk->sk_security;
4141         int err;
4142
4143         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4144         if (err)
4145                 return err;
4146
4147         /*
4148          * If a TCP or DCCP socket, check name_connect permission for the port.
4149          */
4150         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4151             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4152                 struct common_audit_data ad;
4153                 struct lsm_network_audit net = {0,};
4154                 struct sockaddr_in *addr4 = NULL;
4155                 struct sockaddr_in6 *addr6 = NULL;
4156                 unsigned short snum;
4157                 u32 sid, perm;
4158
4159                 if (sk->sk_family == PF_INET) {
4160                         addr4 = (struct sockaddr_in *)address;
4161                         if (addrlen < sizeof(struct sockaddr_in))
4162                                 return -EINVAL;
4163                         snum = ntohs(addr4->sin_port);
4164                 } else {
4165                         addr6 = (struct sockaddr_in6 *)address;
4166                         if (addrlen < SIN6_LEN_RFC2133)
4167                                 return -EINVAL;
4168                         snum = ntohs(addr6->sin6_port);
4169                 }
4170
4171                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4172                 if (err)
4173                         goto out;
4174
4175                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4176                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4177
4178                 ad.type = LSM_AUDIT_DATA_NET;
4179                 ad.u.net = &net;
4180                 ad.u.net->dport = htons(snum);
4181                 ad.u.net->family = sk->sk_family;
4182                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4183                 if (err)
4184                         goto out;
4185         }
4186
4187         err = selinux_netlbl_socket_connect(sk, address);
4188
4189 out:
4190         return err;
4191 }
4192
4193 static int selinux_socket_listen(struct socket *sock, int backlog)
4194 {
4195         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4196 }
4197
4198 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4199 {
4200         int err;
4201         struct inode_security_struct *isec;
4202         struct inode_security_struct *newisec;
4203
4204         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4205         if (err)
4206                 return err;
4207
4208         newisec = SOCK_INODE(newsock)->i_security;
4209
4210         isec = SOCK_INODE(sock)->i_security;
4211         newisec->sclass = isec->sclass;
4212         newisec->sid = isec->sid;
4213         newisec->initialized = 1;
4214
4215         return 0;
4216 }
4217
4218 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4219                                   int size)
4220 {
4221         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4222 }
4223
4224 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4225                                   int size, int flags)
4226 {
4227         return sock_has_perm(current, sock->sk, SOCKET__READ);
4228 }
4229
4230 static int selinux_socket_getsockname(struct socket *sock)
4231 {
4232         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4233 }
4234
4235 static int selinux_socket_getpeername(struct socket *sock)
4236 {
4237         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4238 }
4239
4240 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4241 {
4242         int err;
4243
4244         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4245         if (err)
4246                 return err;
4247
4248         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4249 }
4250
4251 static int selinux_socket_getsockopt(struct socket *sock, int level,
4252                                      int optname)
4253 {
4254         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4255 }
4256
4257 static int selinux_socket_shutdown(struct socket *sock, int how)
4258 {
4259         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4260 }
4261
4262 static int selinux_socket_unix_stream_connect(struct sock *sock,
4263                                               struct sock *other,
4264                                               struct sock *newsk)
4265 {
4266         struct sk_security_struct *sksec_sock = sock->sk_security;
4267         struct sk_security_struct *sksec_other = other->sk_security;
4268         struct sk_security_struct *sksec_new = newsk->sk_security;
4269         struct common_audit_data ad;
4270         struct lsm_network_audit net = {0,};
4271         int err;
4272
4273         ad.type = LSM_AUDIT_DATA_NET;
4274         ad.u.net = &net;
4275         ad.u.net->sk = other;
4276
4277         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4278                            sksec_other->sclass,
4279                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4280         if (err)
4281                 return err;
4282
4283         /* server child socket */
4284         sksec_new->peer_sid = sksec_sock->sid;
4285         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4286                                     &sksec_new->sid);
4287         if (err)
4288                 return err;
4289
4290         /* connecting socket */
4291         sksec_sock->peer_sid = sksec_new->sid;
4292
4293         return 0;
4294 }
4295
4296 static int selinux_socket_unix_may_send(struct socket *sock,
4297                                         struct socket *other)
4298 {
4299         struct sk_security_struct *ssec = sock->sk->sk_security;
4300         struct sk_security_struct *osec = other->sk->sk_security;
4301         struct common_audit_data ad;
4302         struct lsm_network_audit net = {0,};
4303
4304         ad.type = LSM_AUDIT_DATA_NET;
4305         ad.u.net = &net;
4306         ad.u.net->sk = other->sk;
4307
4308         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4309                             &ad);
4310 }
4311
4312 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4313                                     char *addrp, u16 family, u32 peer_sid,
4314                                     struct common_audit_data *ad)
4315 {
4316         int err;
4317         u32 if_sid;
4318         u32 node_sid;
4319
4320         err = sel_netif_sid(ns, ifindex, &if_sid);
4321         if (err)
4322                 return err;
4323         err = avc_has_perm(peer_sid, if_sid,
4324                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4325         if (err)
4326                 return err;
4327
4328         err = sel_netnode_sid(addrp, family, &node_sid);
4329         if (err)
4330                 return err;
4331         return avc_has_perm(peer_sid, node_sid,
4332                             SECCLASS_NODE, NODE__RECVFROM, ad);
4333 }
4334
4335 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4336                                        u16 family)
4337 {
4338         int err = 0;
4339         struct sk_security_struct *sksec = sk->sk_security;
4340         u32 sk_sid = sksec->sid;
4341         struct common_audit_data ad;
4342         struct lsm_network_audit net = {0,};
4343         char *addrp;
4344
4345         ad.type = LSM_AUDIT_DATA_NET;
4346         ad.u.net = &net;
4347         ad.u.net->netif = skb->skb_iif;
4348         ad.u.net->family = family;
4349         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4350         if (err)
4351                 return err;
4352
4353         if (selinux_secmark_enabled()) {
4354                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4355                                    PACKET__RECV, &ad);
4356                 if (err)
4357                         return err;
4358         }
4359
4360         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4361         if (err)
4362                 return err;
4363         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4364
4365         return err;
4366 }
4367
4368 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4369 {
4370         int err;
4371         struct sk_security_struct *sksec = sk->sk_security;
4372         u16 family = sk->sk_family;
4373         u32 sk_sid = sksec->sid;
4374         struct common_audit_data ad;
4375         struct lsm_network_audit net = {0,};
4376         char *addrp;
4377         u8 secmark_active;
4378         u8 peerlbl_active;
4379
4380         if (family != PF_INET && family != PF_INET6)
4381                 return 0;
4382
4383         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4384         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4385                 family = PF_INET;
4386
4387         /* If any sort of compatibility mode is enabled then handoff processing
4388          * to the selinux_sock_rcv_skb_compat() function to deal with the
4389          * special handling.  We do this in an attempt to keep this function
4390          * as fast and as clean as possible. */
4391         if (!selinux_policycap_netpeer)
4392                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4393
4394         secmark_active = selinux_secmark_enabled();
4395         peerlbl_active = selinux_peerlbl_enabled();
4396         if (!secmark_active && !peerlbl_active)
4397                 return 0;
4398
4399         ad.type = LSM_AUDIT_DATA_NET;
4400         ad.u.net = &net;
4401         ad.u.net->netif = skb->skb_iif;
4402         ad.u.net->family = family;
4403         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4404         if (err)
4405                 return err;
4406
4407         if (peerlbl_active) {
4408                 u32 peer_sid;
4409
4410                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4411                 if (err)
4412                         return err;
4413                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4414                                                addrp, family, peer_sid, &ad);
4415                 if (err) {
4416                         selinux_netlbl_err(skb, err, 0);
4417                         return err;
4418                 }
4419                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4420                                    PEER__RECV, &ad);
4421                 if (err) {
4422                         selinux_netlbl_err(skb, err, 0);
4423                         return err;
4424                 }
4425         }
4426
4427         if (secmark_active) {
4428                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4429                                    PACKET__RECV, &ad);
4430                 if (err)
4431                         return err;
4432         }
4433
4434         return err;
4435 }
4436
4437 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4438                                             int __user *optlen, unsigned len)
4439 {
4440         int err = 0;
4441         char *scontext;
4442         u32 scontext_len;
4443         struct sk_security_struct *sksec = sock->sk->sk_security;
4444         u32 peer_sid = SECSID_NULL;
4445
4446         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4447             sksec->sclass == SECCLASS_TCP_SOCKET)
4448                 peer_sid = sksec->peer_sid;
4449         if (peer_sid == SECSID_NULL)
4450                 return -ENOPROTOOPT;
4451
4452         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4453         if (err)
4454                 return err;
4455
4456         if (scontext_len > len) {
4457                 err = -ERANGE;
4458                 goto out_len;
4459         }
4460
4461         if (copy_to_user(optval, scontext, scontext_len))
4462                 err = -EFAULT;
4463
4464 out_len:
4465         if (put_user(scontext_len, optlen))
4466                 err = -EFAULT;
4467         kfree(scontext);
4468         return err;
4469 }
4470
4471 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4472 {
4473         u32 peer_secid = SECSID_NULL;
4474         u16 family;
4475
4476         if (skb && skb->protocol == htons(ETH_P_IP))
4477                 family = PF_INET;
4478         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4479                 family = PF_INET6;
4480         else if (sock)
4481                 family = sock->sk->sk_family;
4482         else
4483                 goto out;
4484
4485         if (sock && family == PF_UNIX)
4486                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4487         else if (skb)
4488                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4489
4490 out:
4491         *secid = peer_secid;
4492         if (peer_secid == SECSID_NULL)
4493                 return -EINVAL;
4494         return 0;
4495 }
4496
4497 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4498 {
4499         struct sk_security_struct *sksec;
4500
4501         sksec = kzalloc(sizeof(*sksec), priority);
4502         if (!sksec)
4503                 return -ENOMEM;
4504
4505         sksec->peer_sid = SECINITSID_UNLABELED;
4506         sksec->sid = SECINITSID_UNLABELED;
4507         selinux_netlbl_sk_security_reset(sksec);
4508         sk->sk_security = sksec;
4509
4510         return 0;
4511 }
4512
4513 static void selinux_sk_free_security(struct sock *sk)
4514 {
4515         struct sk_security_struct *sksec = sk->sk_security;
4516
4517         sk->sk_security = NULL;
4518         selinux_netlbl_sk_security_free(sksec);
4519         kfree(sksec);
4520 }
4521
4522 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4523 {
4524         struct sk_security_struct *sksec = sk->sk_security;
4525         struct sk_security_struct *newsksec = newsk->sk_security;
4526
4527         newsksec->sid = sksec->sid;
4528         newsksec->peer_sid = sksec->peer_sid;
4529         newsksec->sclass = sksec->sclass;
4530
4531         selinux_netlbl_sk_security_reset(newsksec);
4532 }
4533
4534 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4535 {
4536         if (!sk)
4537                 *secid = SECINITSID_ANY_SOCKET;
4538         else {
4539                 struct sk_security_struct *sksec = sk->sk_security;
4540
4541                 *secid = sksec->sid;
4542         }
4543 }
4544
4545 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4546 {
4547         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4548         struct sk_security_struct *sksec = sk->sk_security;
4549
4550         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4551             sk->sk_family == PF_UNIX)
4552                 isec->sid = sksec->sid;
4553         sksec->sclass = isec->sclass;
4554 }
4555
4556 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4557                                      struct request_sock *req)
4558 {
4559         struct sk_security_struct *sksec = sk->sk_security;
4560         int err;
4561         u16 family = req->rsk_ops->family;
4562         u32 connsid;
4563         u32 peersid;
4564
4565         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4566         if (err)
4567                 return err;
4568         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4569         if (err)
4570                 return err;
4571         req->secid = connsid;
4572         req->peer_secid = peersid;
4573
4574         return selinux_netlbl_inet_conn_request(req, family);
4575 }
4576
4577 static void selinux_inet_csk_clone(struct sock *newsk,
4578                                    const struct request_sock *req)
4579 {
4580         struct sk_security_struct *newsksec = newsk->sk_security;
4581
4582         newsksec->sid = req->secid;
4583         newsksec->peer_sid = req->peer_secid;
4584         /* NOTE: Ideally, we should also get the isec->sid for the
4585            new socket in sync, but we don't have the isec available yet.
4586            So we will wait until sock_graft to do it, by which
4587            time it will have been created and available. */
4588
4589         /* We don't need to take any sort of lock here as we are the only
4590          * thread with access to newsksec */
4591         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4592 }
4593
4594 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4595 {
4596         u16 family = sk->sk_family;
4597         struct sk_security_struct *sksec = sk->sk_security;
4598
4599         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4600         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4601                 family = PF_INET;
4602
4603         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4604 }
4605
4606 static int selinux_secmark_relabel_packet(u32 sid)
4607 {
4608         const struct task_security_struct *__tsec;
4609         u32 tsid;
4610
4611         __tsec = current_security();
4612         tsid = __tsec->sid;
4613
4614         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4615 }
4616
4617 static void selinux_secmark_refcount_inc(void)
4618 {
4619         atomic_inc(&selinux_secmark_refcount);
4620 }
4621
4622 static void selinux_secmark_refcount_dec(void)
4623 {
4624         atomic_dec(&selinux_secmark_refcount);
4625 }
4626
4627 static void selinux_req_classify_flow(const struct request_sock *req,
4628                                       struct flowi *fl)
4629 {
4630         fl->flowi_secid = req->secid;
4631 }
4632
4633 static int selinux_tun_dev_alloc_security(void **security)
4634 {
4635         struct tun_security_struct *tunsec;
4636
4637         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4638         if (!tunsec)
4639                 return -ENOMEM;
4640         tunsec->sid = current_sid();
4641
4642         *security = tunsec;
4643         return 0;
4644 }
4645
4646 static void selinux_tun_dev_free_security(void *security)
4647 {
4648         kfree(security);
4649 }
4650
4651 static int selinux_tun_dev_create(void)
4652 {
4653         u32 sid = current_sid();
4654
4655         /* we aren't taking into account the "sockcreate" SID since the socket
4656          * that is being created here is not a socket in the traditional sense,
4657          * instead it is a private sock, accessible only to the kernel, and
4658          * representing a wide range of network traffic spanning multiple
4659          * connections unlike traditional sockets - check the TUN driver to
4660          * get a better understanding of why this socket is special */
4661
4662         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4663                             NULL);
4664 }
4665
4666 static int selinux_tun_dev_attach_queue(void *security)
4667 {
4668         struct tun_security_struct *tunsec = security;
4669
4670         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4671                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4672 }
4673
4674 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4675 {
4676         struct tun_security_struct *tunsec = security;
4677         struct sk_security_struct *sksec = sk->sk_security;
4678
4679         /* we don't currently perform any NetLabel based labeling here and it
4680          * isn't clear that we would want to do so anyway; while we could apply
4681          * labeling without the support of the TUN user the resulting labeled
4682          * traffic from the other end of the connection would almost certainly
4683          * cause confusion to the TUN user that had no idea network labeling
4684          * protocols were being used */
4685
4686         sksec->sid = tunsec->sid;
4687         sksec->sclass = SECCLASS_TUN_SOCKET;
4688
4689         return 0;
4690 }
4691
4692 static int selinux_tun_dev_open(void *security)
4693 {
4694         struct tun_security_struct *tunsec = security;
4695         u32 sid = current_sid();
4696         int err;
4697
4698         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4699                            TUN_SOCKET__RELABELFROM, NULL);
4700         if (err)
4701                 return err;
4702         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4703                            TUN_SOCKET__RELABELTO, NULL);
4704         if (err)
4705                 return err;
4706         tunsec->sid = sid;
4707
4708         return 0;
4709 }
4710
4711 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4712 {
4713         int err = 0;
4714         u32 perm;
4715         struct nlmsghdr *nlh;
4716         struct sk_security_struct *sksec = sk->sk_security;
4717
4718         if (skb->len < NLMSG_HDRLEN) {
4719                 err = -EINVAL;
4720                 goto out;
4721         }
4722         nlh = nlmsg_hdr(skb);
4723
4724         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4725         if (err) {
4726                 if (err == -EINVAL) {
4727                         printk(KERN_WARNING
4728                                "SELinux: unrecognized netlink message:"
4729                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4730                                sk->sk_protocol, nlh->nlmsg_type,
4731                                secclass_map[sksec->sclass - 1].name);
4732                         if (!selinux_enforcing || security_get_allow_unknown())
4733                                 err = 0;
4734                 }
4735
4736                 /* Ignore */
4737                 if (err == -ENOENT)
4738                         err = 0;
4739                 goto out;
4740         }
4741
4742         err = sock_has_perm(current, sk, perm);
4743 out:
4744         return err;
4745 }
4746
4747 #ifdef CONFIG_NETFILTER
4748
4749 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4750                                        const struct net_device *indev,
4751                                        u16 family)
4752 {
4753         int err;
4754         char *addrp;
4755         u32 peer_sid;
4756         struct common_audit_data ad;
4757         struct lsm_network_audit net = {0,};
4758         u8 secmark_active;
4759         u8 netlbl_active;
4760         u8 peerlbl_active;
4761
4762         if (!selinux_policycap_netpeer)
4763                 return NF_ACCEPT;
4764
4765         secmark_active = selinux_secmark_enabled();
4766         netlbl_active = netlbl_enabled();
4767         peerlbl_active = selinux_peerlbl_enabled();
4768         if (!secmark_active && !peerlbl_active)
4769                 return NF_ACCEPT;
4770
4771         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4772                 return NF_DROP;
4773
4774         ad.type = LSM_AUDIT_DATA_NET;
4775         ad.u.net = &net;
4776         ad.u.net->netif = indev->ifindex;
4777         ad.u.net->family = family;
4778         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4779                 return NF_DROP;
4780
4781         if (peerlbl_active) {
4782                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4783                                                addrp, family, peer_sid, &ad);
4784                 if (err) {
4785                         selinux_netlbl_err(skb, err, 1);
4786                         return NF_DROP;
4787                 }
4788         }
4789
4790         if (secmark_active)
4791                 if (avc_has_perm(peer_sid, skb->secmark,
4792                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4793                         return NF_DROP;
4794
4795         if (netlbl_active)
4796                 /* we do this in the FORWARD path and not the POST_ROUTING
4797                  * path because we want to make sure we apply the necessary
4798                  * labeling before IPsec is applied so we can leverage AH
4799                  * protection */
4800                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4801                         return NF_DROP;
4802
4803         return NF_ACCEPT;
4804 }
4805
4806 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4807                                          struct sk_buff *skb,
4808                                          const struct nf_hook_state *state)
4809 {
4810         return selinux_ip_forward(skb, state->in, PF_INET);
4811 }
4812
4813 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4814 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4815                                          struct sk_buff *skb,
4816                                          const struct nf_hook_state *state)
4817 {
4818         return selinux_ip_forward(skb, state->in, PF_INET6);
4819 }
4820 #endif  /* IPV6 */
4821
4822 static unsigned int selinux_ip_output(struct sk_buff *skb,
4823                                       u16 family)
4824 {
4825         struct sock *sk;
4826         u32 sid;
4827
4828         if (!netlbl_enabled())
4829                 return NF_ACCEPT;
4830
4831         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4832          * because we want to make sure we apply the necessary labeling
4833          * before IPsec is applied so we can leverage AH protection */
4834         sk = skb->sk;
4835         if (sk) {
4836                 struct sk_security_struct *sksec;
4837
4838                 if (sk->sk_state == TCP_LISTEN)
4839                         /* if the socket is the listening state then this
4840                          * packet is a SYN-ACK packet which means it needs to
4841                          * be labeled based on the connection/request_sock and
4842                          * not the parent socket.  unfortunately, we can't
4843                          * lookup the request_sock yet as it isn't queued on
4844                          * the parent socket until after the SYN-ACK is sent.
4845                          * the "solution" is to simply pass the packet as-is
4846                          * as any IP option based labeling should be copied
4847                          * from the initial connection request (in the IP
4848                          * layer).  it is far from ideal, but until we get a
4849                          * security label in the packet itself this is the
4850                          * best we can do. */
4851                         return NF_ACCEPT;
4852
4853                 /* standard practice, label using the parent socket */
4854                 sksec = sk->sk_security;
4855                 sid = sksec->sid;
4856         } else
4857                 sid = SECINITSID_KERNEL;
4858         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4859                 return NF_DROP;
4860
4861         return NF_ACCEPT;
4862 }
4863
4864 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4865                                         struct sk_buff *skb,
4866                                         const struct nf_hook_state *state)
4867 {
4868         return selinux_ip_output(skb, PF_INET);
4869 }
4870
4871 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4872                                                 int ifindex,
4873                                                 u16 family)
4874 {
4875         struct sock *sk = skb->sk;
4876         struct sk_security_struct *sksec;
4877         struct common_audit_data ad;
4878         struct lsm_network_audit net = {0,};
4879         char *addrp;
4880         u8 proto;
4881
4882         if (sk == NULL)
4883                 return NF_ACCEPT;
4884         sksec = sk->sk_security;
4885
4886         ad.type = LSM_AUDIT_DATA_NET;
4887         ad.u.net = &net;
4888         ad.u.net->netif = ifindex;
4889         ad.u.net->family = family;
4890         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4891                 return NF_DROP;
4892
4893         if (selinux_secmark_enabled())
4894                 if (avc_has_perm(sksec->sid, skb->secmark,
4895                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4896                         return NF_DROP_ERR(-ECONNREFUSED);
4897
4898         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4899                 return NF_DROP_ERR(-ECONNREFUSED);
4900
4901         return NF_ACCEPT;
4902 }
4903
4904 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4905                                          const struct net_device *outdev,
4906                                          u16 family)
4907 {
4908         u32 secmark_perm;
4909         u32 peer_sid;
4910         int ifindex = outdev->ifindex;
4911         struct sock *sk;
4912         struct common_audit_data ad;
4913         struct lsm_network_audit net = {0,};
4914         char *addrp;
4915         u8 secmark_active;
4916         u8 peerlbl_active;
4917
4918         /* If any sort of compatibility mode is enabled then handoff processing
4919          * to the selinux_ip_postroute_compat() function to deal with the
4920          * special handling.  We do this in an attempt to keep this function
4921          * as fast and as clean as possible. */
4922         if (!selinux_policycap_netpeer)
4923                 return selinux_ip_postroute_compat(skb, ifindex, family);
4924
4925         secmark_active = selinux_secmark_enabled();
4926         peerlbl_active = selinux_peerlbl_enabled();
4927         if (!secmark_active && !peerlbl_active)
4928                 return NF_ACCEPT;
4929
4930         sk = skb->sk;
4931
4932 #ifdef CONFIG_XFRM
4933         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4934          * packet transformation so allow the packet to pass without any checks
4935          * since we'll have another chance to perform access control checks
4936          * when the packet is on it's final way out.
4937          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4938          *       is NULL, in this case go ahead and apply access control.
4939          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4940          *       TCP listening state we cannot wait until the XFRM processing
4941          *       is done as we will miss out on the SA label if we do;
4942          *       unfortunately, this means more work, but it is only once per
4943          *       connection. */
4944         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4945             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4946                 return NF_ACCEPT;
4947 #endif
4948
4949         if (sk == NULL) {
4950                 /* Without an associated socket the packet is either coming
4951                  * from the kernel or it is being forwarded; check the packet
4952                  * to determine which and if the packet is being forwarded
4953                  * query the packet directly to determine the security label. */
4954                 if (skb->skb_iif) {
4955                         secmark_perm = PACKET__FORWARD_OUT;
4956                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4957                                 return NF_DROP;
4958                 } else {
4959                         secmark_perm = PACKET__SEND;
4960                         peer_sid = SECINITSID_KERNEL;
4961                 }
4962         } else if (sk->sk_state == TCP_LISTEN) {
4963                 /* Locally generated packet but the associated socket is in the
4964                  * listening state which means this is a SYN-ACK packet.  In
4965                  * this particular case the correct security label is assigned
4966                  * to the connection/request_sock but unfortunately we can't
4967                  * query the request_sock as it isn't queued on the parent
4968                  * socket until after the SYN-ACK packet is sent; the only
4969                  * viable choice is to regenerate the label like we do in
4970                  * selinux_inet_conn_request().  See also selinux_ip_output()
4971                  * for similar problems. */
4972                 u32 skb_sid;
4973                 struct sk_security_struct *sksec = sk->sk_security;
4974                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4975                         return NF_DROP;
4976                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4977                  * and the packet has been through at least one XFRM
4978                  * transformation then we must be dealing with the "final"
4979                  * form of labeled IPsec packet; since we've already applied
4980                  * all of our access controls on this packet we can safely
4981                  * pass the packet. */
4982                 if (skb_sid == SECSID_NULL) {
4983                         switch (family) {
4984                         case PF_INET:
4985                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4986                                         return NF_ACCEPT;
4987                                 break;
4988                         case PF_INET6:
4989                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4990                                         return NF_ACCEPT;
4991                                 break;
4992                         default:
4993                                 return NF_DROP_ERR(-ECONNREFUSED);
4994                         }
4995                 }
4996                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4997                         return NF_DROP;
4998                 secmark_perm = PACKET__SEND;
4999         } else {
5000                 /* Locally generated packet, fetch the security label from the
5001                  * associated socket. */
5002                 struct sk_security_struct *sksec = sk->sk_security;
5003                 peer_sid = sksec->sid;
5004                 secmark_perm = PACKET__SEND;
5005         }
5006
5007         ad.type = LSM_AUDIT_DATA_NET;
5008         ad.u.net = &net;
5009         ad.u.net->netif = ifindex;
5010         ad.u.net->family = family;
5011         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5012                 return NF_DROP;
5013
5014         if (secmark_active)
5015                 if (avc_has_perm(peer_sid, skb->secmark,
5016                                  SECCLASS_PACKET, secmark_perm, &ad))
5017                         return NF_DROP_ERR(-ECONNREFUSED);
5018
5019         if (peerlbl_active) {
5020                 u32 if_sid;
5021                 u32 node_sid;
5022
5023                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5024                         return NF_DROP;
5025                 if (avc_has_perm(peer_sid, if_sid,
5026                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5027                         return NF_DROP_ERR(-ECONNREFUSED);
5028
5029                 if (sel_netnode_sid(addrp, family, &node_sid))
5030                         return NF_DROP;
5031                 if (avc_has_perm(peer_sid, node_sid,
5032                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5033                         return NF_DROP_ERR(-ECONNREFUSED);
5034         }
5035
5036         return NF_ACCEPT;
5037 }
5038
5039 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5040                                            struct sk_buff *skb,
5041                                            const struct nf_hook_state *state)
5042 {
5043         return selinux_ip_postroute(skb, state->out, PF_INET);
5044 }
5045
5046 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5047 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5048                                            struct sk_buff *skb,
5049                                            const struct nf_hook_state *state)
5050 {
5051         return selinux_ip_postroute(skb, state->out, PF_INET6);
5052 }
5053 #endif  /* IPV6 */
5054
5055 #endif  /* CONFIG_NETFILTER */
5056
5057 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5058 {
5059         return selinux_nlmsg_perm(sk, skb);
5060 }
5061
5062 static int ipc_alloc_security(struct task_struct *task,
5063                               struct kern_ipc_perm *perm,
5064                               u16 sclass)
5065 {
5066         struct ipc_security_struct *isec;
5067         u32 sid;
5068
5069         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5070         if (!isec)
5071                 return -ENOMEM;
5072
5073         sid = task_sid(task);
5074         isec->sclass = sclass;
5075         isec->sid = sid;
5076         perm->security = isec;
5077
5078         return 0;
5079 }
5080
5081 static void ipc_free_security(struct kern_ipc_perm *perm)
5082 {
5083         struct ipc_security_struct *isec = perm->security;
5084         perm->security = NULL;
5085         kfree(isec);
5086 }
5087
5088 static int msg_msg_alloc_security(struct msg_msg *msg)
5089 {
5090         struct msg_security_struct *msec;
5091
5092         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5093         if (!msec)
5094                 return -ENOMEM;
5095
5096         msec->sid = SECINITSID_UNLABELED;
5097         msg->security = msec;
5098
5099         return 0;
5100 }
5101
5102 static void msg_msg_free_security(struct msg_msg *msg)
5103 {
5104         struct msg_security_struct *msec = msg->security;
5105
5106         msg->security = NULL;
5107         kfree(msec);
5108 }
5109
5110 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5111                         u32 perms)
5112 {
5113         struct ipc_security_struct *isec;
5114         struct common_audit_data ad;
5115         u32 sid = current_sid();
5116
5117         isec = ipc_perms->security;
5118
5119         ad.type = LSM_AUDIT_DATA_IPC;
5120         ad.u.ipc_id = ipc_perms->key;
5121
5122         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5123 }
5124
5125 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5126 {
5127         return msg_msg_alloc_security(msg);
5128 }
5129
5130 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5131 {
5132         msg_msg_free_security(msg);
5133 }
5134
5135 /* message queue security operations */
5136 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5137 {
5138         struct ipc_security_struct *isec;
5139         struct common_audit_data ad;
5140         u32 sid = current_sid();
5141         int rc;
5142
5143         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5144         if (rc)
5145                 return rc;
5146
5147         isec = msq->q_perm.security;
5148
5149         ad.type = LSM_AUDIT_DATA_IPC;
5150         ad.u.ipc_id = msq->q_perm.key;
5151
5152         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5153                           MSGQ__CREATE, &ad);
5154         if (rc) {
5155                 ipc_free_security(&msq->q_perm);
5156                 return rc;
5157         }
5158         return 0;
5159 }
5160
5161 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5162 {
5163         ipc_free_security(&msq->q_perm);
5164 }
5165
5166 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5167 {
5168         struct ipc_security_struct *isec;
5169         struct common_audit_data ad;
5170         u32 sid = current_sid();
5171
5172         isec = msq->q_perm.security;
5173
5174         ad.type = LSM_AUDIT_DATA_IPC;
5175         ad.u.ipc_id = msq->q_perm.key;
5176
5177         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5178                             MSGQ__ASSOCIATE, &ad);
5179 }
5180
5181 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5182 {
5183         int err;
5184         int perms;
5185
5186         switch (cmd) {
5187         case IPC_INFO:
5188         case MSG_INFO:
5189                 /* No specific object, just general system-wide information. */
5190                 return task_has_system(current, SYSTEM__IPC_INFO);
5191         case IPC_STAT:
5192         case MSG_STAT:
5193                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5194                 break;
5195         case IPC_SET:
5196                 perms = MSGQ__SETATTR;
5197                 break;
5198         case IPC_RMID:
5199                 perms = MSGQ__DESTROY;
5200                 break;
5201         default:
5202                 return 0;
5203         }
5204
5205         err = ipc_has_perm(&msq->q_perm, perms);
5206         return err;
5207 }
5208
5209 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5210 {
5211         struct ipc_security_struct *isec;
5212         struct msg_security_struct *msec;
5213         struct common_audit_data ad;
5214         u32 sid = current_sid();
5215         int rc;
5216
5217         isec = msq->q_perm.security;
5218         msec = msg->security;
5219
5220         /*
5221          * First time through, need to assign label to the message
5222          */
5223         if (msec->sid == SECINITSID_UNLABELED) {
5224                 /*
5225                  * Compute new sid based on current process and
5226                  * message queue this message will be stored in
5227                  */
5228                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5229                                              NULL, &msec->sid);
5230                 if (rc)
5231                         return rc;
5232         }
5233
5234         ad.type = LSM_AUDIT_DATA_IPC;
5235         ad.u.ipc_id = msq->q_perm.key;
5236
5237         /* Can this process write to the queue? */
5238         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5239                           MSGQ__WRITE, &ad);
5240         if (!rc)
5241                 /* Can this process send the message */
5242                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5243                                   MSG__SEND, &ad);
5244         if (!rc)
5245                 /* Can the message be put in the queue? */
5246                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5247                                   MSGQ__ENQUEUE, &ad);
5248
5249         return rc;
5250 }
5251
5252 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5253                                     struct task_struct *target,
5254                                     long type, int mode)
5255 {
5256         struct ipc_security_struct *isec;
5257         struct msg_security_struct *msec;
5258         struct common_audit_data ad;
5259         u32 sid = task_sid(target);
5260         int rc;
5261
5262         isec = msq->q_perm.security;
5263         msec = msg->security;
5264
5265         ad.type = LSM_AUDIT_DATA_IPC;
5266         ad.u.ipc_id = msq->q_perm.key;
5267
5268         rc = avc_has_perm(sid, isec->sid,
5269                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5270         if (!rc)
5271                 rc = avc_has_perm(sid, msec->sid,
5272                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5273         return rc;
5274 }
5275
5276 /* Shared Memory security operations */
5277 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5278 {
5279         struct ipc_security_struct *isec;
5280         struct common_audit_data ad;
5281         u32 sid = current_sid();
5282         int rc;
5283
5284         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5285         if (rc)
5286                 return rc;
5287
5288         isec = shp->shm_perm.security;
5289
5290         ad.type = LSM_AUDIT_DATA_IPC;
5291         ad.u.ipc_id = shp->shm_perm.key;
5292
5293         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5294                           SHM__CREATE, &ad);
5295         if (rc) {
5296                 ipc_free_security(&shp->shm_perm);
5297                 return rc;
5298         }
5299         return 0;
5300 }
5301
5302 static void selinux_shm_free_security(struct shmid_kernel *shp)
5303 {
5304         ipc_free_security(&shp->shm_perm);
5305 }
5306
5307 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5308 {
5309         struct ipc_security_struct *isec;
5310         struct common_audit_data ad;
5311         u32 sid = current_sid();
5312
5313         isec = shp->shm_perm.security;
5314
5315         ad.type = LSM_AUDIT_DATA_IPC;
5316         ad.u.ipc_id = shp->shm_perm.key;
5317
5318         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5319                             SHM__ASSOCIATE, &ad);
5320 }
5321
5322 /* Note, at this point, shp is locked down */
5323 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5324 {
5325         int perms;
5326         int err;
5327
5328         switch (cmd) {
5329         case IPC_INFO:
5330         case SHM_INFO:
5331                 /* No specific object, just general system-wide information. */
5332                 return task_has_system(current, SYSTEM__IPC_INFO);
5333         case IPC_STAT:
5334         case SHM_STAT:
5335                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5336                 break;
5337         case IPC_SET:
5338                 perms = SHM__SETATTR;
5339                 break;
5340         case SHM_LOCK:
5341         case SHM_UNLOCK:
5342                 perms = SHM__LOCK;
5343                 break;
5344         case IPC_RMID:
5345                 perms = SHM__DESTROY;
5346                 break;
5347         default:
5348                 return 0;
5349         }
5350
5351         err = ipc_has_perm(&shp->shm_perm, perms);
5352         return err;
5353 }
5354
5355 static int selinux_shm_shmat(struct shmid_kernel *shp,
5356                              char __user *shmaddr, int shmflg)
5357 {
5358         u32 perms;
5359
5360         if (shmflg & SHM_RDONLY)
5361                 perms = SHM__READ;
5362         else
5363                 perms = SHM__READ | SHM__WRITE;
5364
5365         return ipc_has_perm(&shp->shm_perm, perms);
5366 }
5367
5368 /* Semaphore security operations */
5369 static int selinux_sem_alloc_security(struct sem_array *sma)
5370 {
5371         struct ipc_security_struct *isec;
5372         struct common_audit_data ad;
5373         u32 sid = current_sid();
5374         int rc;
5375
5376         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5377         if (rc)
5378                 return rc;
5379
5380         isec = sma->sem_perm.security;
5381
5382         ad.type = LSM_AUDIT_DATA_IPC;
5383         ad.u.ipc_id = sma->sem_perm.key;
5384
5385         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5386                           SEM__CREATE, &ad);
5387         if (rc) {
5388                 ipc_free_security(&sma->sem_perm);
5389                 return rc;
5390         }
5391         return 0;
5392 }
5393
5394 static void selinux_sem_free_security(struct sem_array *sma)
5395 {
5396         ipc_free_security(&sma->sem_perm);
5397 }
5398
5399 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5400 {
5401         struct ipc_security_struct *isec;
5402         struct common_audit_data ad;
5403         u32 sid = current_sid();
5404
5405         isec = sma->sem_perm.security;
5406
5407         ad.type = LSM_AUDIT_DATA_IPC;
5408         ad.u.ipc_id = sma->sem_perm.key;
5409
5410         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5411                             SEM__ASSOCIATE, &ad);
5412 }
5413
5414 /* Note, at this point, sma is locked down */
5415 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5416 {
5417         int err;
5418         u32 perms;
5419
5420         switch (cmd) {
5421         case IPC_INFO:
5422         case SEM_INFO:
5423                 /* No specific object, just general system-wide information. */
5424                 return task_has_system(current, SYSTEM__IPC_INFO);
5425         case GETPID:
5426         case GETNCNT:
5427         case GETZCNT:
5428                 perms = SEM__GETATTR;
5429                 break;
5430         case GETVAL:
5431         case GETALL:
5432                 perms = SEM__READ;
5433                 break;
5434         case SETVAL:
5435         case SETALL:
5436                 perms = SEM__WRITE;
5437                 break;
5438         case IPC_RMID:
5439                 perms = SEM__DESTROY;
5440                 break;
5441         case IPC_SET:
5442                 perms = SEM__SETATTR;
5443                 break;
5444         case IPC_STAT:
5445         case SEM_STAT:
5446                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5447                 break;
5448         default:
5449                 return 0;
5450         }
5451
5452         err = ipc_has_perm(&sma->sem_perm, perms);
5453         return err;
5454 }
5455
5456 static int selinux_sem_semop(struct sem_array *sma,
5457                              struct sembuf *sops, unsigned nsops, int alter)
5458 {
5459         u32 perms;
5460
5461         if (alter)
5462                 perms = SEM__READ | SEM__WRITE;
5463         else
5464                 perms = SEM__READ;
5465
5466         return ipc_has_perm(&sma->sem_perm, perms);
5467 }
5468
5469 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5470 {
5471         u32 av = 0;
5472
5473         av = 0;
5474         if (flag & S_IRUGO)
5475                 av |= IPC__UNIX_READ;
5476         if (flag & S_IWUGO)
5477                 av |= IPC__UNIX_WRITE;
5478
5479         if (av == 0)
5480                 return 0;
5481
5482         return ipc_has_perm(ipcp, av);
5483 }
5484
5485 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5486 {
5487         struct ipc_security_struct *isec = ipcp->security;
5488         *secid = isec->sid;
5489 }
5490
5491 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5492 {
5493         if (inode)
5494                 inode_doinit_with_dentry(inode, dentry);
5495 }
5496
5497 static int selinux_getprocattr(struct task_struct *p,
5498                                char *name, char **value)
5499 {
5500         const struct task_security_struct *__tsec;
5501         u32 sid;
5502         int error;
5503         unsigned len;
5504
5505         if (current != p) {
5506                 error = current_has_perm(p, PROCESS__GETATTR);
5507                 if (error)
5508                         return error;
5509         }
5510
5511         rcu_read_lock();
5512         __tsec = __task_cred(p)->security;
5513
5514         if (!strcmp(name, "current"))
5515                 sid = __tsec->sid;
5516         else if (!strcmp(name, "prev"))
5517                 sid = __tsec->osid;
5518         else if (!strcmp(name, "exec"))
5519                 sid = __tsec->exec_sid;
5520         else if (!strcmp(name, "fscreate"))
5521                 sid = __tsec->create_sid;
5522         else if (!strcmp(name, "keycreate"))
5523                 sid = __tsec->keycreate_sid;
5524         else if (!strcmp(name, "sockcreate"))
5525                 sid = __tsec->sockcreate_sid;
5526         else
5527                 goto invalid;
5528         rcu_read_unlock();
5529
5530         if (!sid)
5531                 return 0;
5532
5533         error = security_sid_to_context(sid, value, &len);
5534         if (error)
5535                 return error;
5536         return len;
5537
5538 invalid:
5539         rcu_read_unlock();
5540         return -EINVAL;
5541 }
5542
5543 static int selinux_setprocattr(struct task_struct *p,
5544                                char *name, void *value, size_t size)
5545 {
5546         struct task_security_struct *tsec;
5547         struct task_struct *tracer;
5548         struct cred *new;
5549         u32 sid = 0, ptsid;
5550         int error;
5551         char *str = value;
5552
5553         if (current != p) {
5554                 /* SELinux only allows a process to change its own
5555                    security attributes. */
5556                 return -EACCES;
5557         }
5558
5559         /*
5560          * Basic control over ability to set these attributes at all.
5561          * current == p, but we'll pass them separately in case the
5562          * above restriction is ever removed.
5563          */
5564         if (!strcmp(name, "exec"))
5565                 error = current_has_perm(p, PROCESS__SETEXEC);
5566         else if (!strcmp(name, "fscreate"))
5567                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5568         else if (!strcmp(name, "keycreate"))
5569                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5570         else if (!strcmp(name, "sockcreate"))
5571                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5572         else if (!strcmp(name, "current"))
5573                 error = current_has_perm(p, PROCESS__SETCURRENT);
5574         else
5575                 error = -EINVAL;
5576         if (error)
5577                 return error;
5578
5579         /* Obtain a SID for the context, if one was specified. */
5580         if (size && str[1] && str[1] != '\n') {
5581                 if (str[size-1] == '\n') {
5582                         str[size-1] = 0;
5583                         size--;
5584                 }
5585                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5586                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5587                         if (!capable(CAP_MAC_ADMIN)) {
5588                                 struct audit_buffer *ab;
5589                                 size_t audit_size;
5590
5591                                 /* We strip a nul only if it is at the end, otherwise the
5592                                  * context contains a nul and we should audit that */
5593                                 if (str[size - 1] == '\0')
5594                                         audit_size = size - 1;
5595                                 else
5596                                         audit_size = size;
5597                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5598                                 audit_log_format(ab, "op=fscreate invalid_context=");
5599                                 audit_log_n_untrustedstring(ab, value, audit_size);
5600                                 audit_log_end(ab);
5601
5602                                 return error;
5603                         }
5604                         error = security_context_to_sid_force(value, size,
5605                                                               &sid);
5606                 }
5607                 if (error)
5608                         return error;
5609         }
5610
5611         new = prepare_creds();
5612         if (!new)
5613                 return -ENOMEM;
5614
5615         /* Permission checking based on the specified context is
5616            performed during the actual operation (execve,
5617            open/mkdir/...), when we know the full context of the
5618            operation.  See selinux_bprm_set_creds for the execve
5619            checks and may_create for the file creation checks. The
5620            operation will then fail if the context is not permitted. */
5621         tsec = new->security;
5622         if (!strcmp(name, "exec")) {
5623                 tsec->exec_sid = sid;
5624         } else if (!strcmp(name, "fscreate")) {
5625                 tsec->create_sid = sid;
5626         } else if (!strcmp(name, "keycreate")) {
5627                 error = may_create_key(sid, p);
5628                 if (error)
5629                         goto abort_change;
5630                 tsec->keycreate_sid = sid;
5631         } else if (!strcmp(name, "sockcreate")) {
5632                 tsec->sockcreate_sid = sid;
5633         } else if (!strcmp(name, "current")) {
5634                 error = -EINVAL;
5635                 if (sid == 0)
5636                         goto abort_change;
5637
5638                 /* Only allow single threaded processes to change context */
5639                 error = -EPERM;
5640                 if (!current_is_single_threaded()) {
5641                         error = security_bounded_transition(tsec->sid, sid);
5642                         if (error)
5643                                 goto abort_change;
5644                 }
5645
5646                 /* Check permissions for the transition. */
5647                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5648                                      PROCESS__DYNTRANSITION, NULL);
5649                 if (error)
5650                         goto abort_change;
5651
5652                 /* Check for ptracing, and update the task SID if ok.
5653                    Otherwise, leave SID unchanged and fail. */
5654                 ptsid = 0;
5655                 rcu_read_lock();
5656                 tracer = ptrace_parent(p);
5657                 if (tracer)
5658                         ptsid = task_sid(tracer);
5659                 rcu_read_unlock();
5660
5661                 if (tracer) {
5662                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5663                                              PROCESS__PTRACE, NULL);
5664                         if (error)
5665                                 goto abort_change;
5666                 }
5667
5668                 tsec->sid = sid;
5669         } else {
5670                 error = -EINVAL;
5671                 goto abort_change;
5672         }
5673
5674         commit_creds(new);
5675         return size;
5676
5677 abort_change:
5678         abort_creds(new);
5679         return error;
5680 }
5681
5682 static int selinux_ismaclabel(const char *name)
5683 {
5684         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5685 }
5686
5687 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5688 {
5689         return security_sid_to_context(secid, secdata, seclen);
5690 }
5691
5692 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5693 {
5694         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5695 }
5696
5697 static void selinux_release_secctx(char *secdata, u32 seclen)
5698 {
5699         kfree(secdata);
5700 }
5701
5702 /*
5703  *      called with inode->i_mutex locked
5704  */
5705 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5706 {
5707         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5708 }
5709
5710 /*
5711  *      called with inode->i_mutex locked
5712  */
5713 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5714 {
5715         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5716 }
5717
5718 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5719 {
5720         int len = 0;
5721         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5722                                                 ctx, true);
5723         if (len < 0)
5724                 return len;
5725         *ctxlen = len;
5726         return 0;
5727 }
5728 #ifdef CONFIG_KEYS
5729
5730 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5731                              unsigned long flags)
5732 {
5733         const struct task_security_struct *tsec;
5734         struct key_security_struct *ksec;
5735
5736         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5737         if (!ksec)
5738                 return -ENOMEM;
5739
5740         tsec = cred->security;
5741         if (tsec->keycreate_sid)
5742                 ksec->sid = tsec->keycreate_sid;
5743         else
5744                 ksec->sid = tsec->sid;
5745
5746         k->security = ksec;
5747         return 0;
5748 }
5749
5750 static void selinux_key_free(struct key *k)
5751 {
5752         struct key_security_struct *ksec = k->security;
5753
5754         k->security = NULL;
5755         kfree(ksec);
5756 }
5757
5758 static int selinux_key_permission(key_ref_t key_ref,
5759                                   const struct cred *cred,
5760                                   unsigned perm)
5761 {
5762         struct key *key;
5763         struct key_security_struct *ksec;
5764         u32 sid;
5765
5766         /* if no specific permissions are requested, we skip the
5767            permission check. No serious, additional covert channels
5768            appear to be created. */
5769         if (perm == 0)
5770                 return 0;
5771
5772         sid = cred_sid(cred);
5773
5774         key = key_ref_to_ptr(key_ref);
5775         ksec = key->security;
5776
5777         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5778 }
5779
5780 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5781 {
5782         struct key_security_struct *ksec = key->security;
5783         char *context = NULL;
5784         unsigned len;
5785         int rc;
5786
5787         rc = security_sid_to_context(ksec->sid, &context, &len);
5788         if (!rc)
5789                 rc = len;
5790         *_buffer = context;
5791         return rc;
5792 }
5793
5794 #endif
5795
5796 static struct security_hook_list selinux_hooks[] = {
5797         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5798         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5799         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5800         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5801
5802         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5803         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5804         LSM_HOOK_INIT(capget, selinux_capget),
5805         LSM_HOOK_INIT(capset, selinux_capset),
5806         LSM_HOOK_INIT(capable, selinux_capable),
5807         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5808         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5809         LSM_HOOK_INIT(syslog, selinux_syslog),
5810         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5811
5812         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5813
5814         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5815         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5816         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5817         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5818
5819         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5820         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5821         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5822         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5823         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5824         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5825         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5826         LSM_HOOK_INIT(sb_mount, selinux_mount),
5827         LSM_HOOK_INIT(sb_umount, selinux_umount),
5828         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5829         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5830         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5831
5832         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5833
5834         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5835         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5836         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5837         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5838         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5839         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5840         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5841         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5842         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5843         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5844         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5845         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5846         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5847         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5848         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5849         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5850         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5851         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5852         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5853         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5854         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5855         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5856         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5857         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5858         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5859
5860         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5861         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5862         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5863         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5864         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5865         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5866         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5867         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5868         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5869         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5870         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5871         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5872
5873         LSM_HOOK_INIT(file_open, selinux_file_open),
5874
5875         LSM_HOOK_INIT(task_create, selinux_task_create),
5876         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5877         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5878         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5879         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5880         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5881         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5882         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5883         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5884         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5885         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5886         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5887         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5888         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5889         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5890         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5891         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5892         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5893         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5894         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5895         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5896         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5897
5898         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5899         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5900
5901         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5902         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5903
5904         LSM_HOOK_INIT(msg_queue_alloc_security,
5905                         selinux_msg_queue_alloc_security),
5906         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5907         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5908         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5909         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5910         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5911
5912         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5913         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5914         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5915         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5916         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5917
5918         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5919         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5920         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5921         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5922         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5923
5924         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5925
5926         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5927         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5928
5929         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5930         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5931         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5932         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5933         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5934         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
5935         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
5936
5937         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
5938         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
5939
5940         LSM_HOOK_INIT(socket_create, selinux_socket_create),
5941         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
5942         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
5943         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
5944         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
5945         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
5946         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
5947         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
5948         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
5949         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
5950         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
5951         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
5952         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
5953         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
5954         LSM_HOOK_INIT(socket_getpeersec_stream,
5955                         selinux_socket_getpeersec_stream),
5956         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
5957         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
5958         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
5959         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
5960         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
5961         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
5962         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
5963         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
5964         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
5965         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
5966         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
5967         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
5968         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
5969         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
5970         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
5971         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
5972         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
5973         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
5974         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
5975
5976 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5977         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
5978         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
5979         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
5980         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
5981         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
5982         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
5983                         selinux_xfrm_state_alloc_acquire),
5984         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
5985         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
5986         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
5987         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
5988                         selinux_xfrm_state_pol_flow_match),
5989         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
5990 #endif
5991
5992 #ifdef CONFIG_KEYS
5993         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
5994         LSM_HOOK_INIT(key_free, selinux_key_free),
5995         LSM_HOOK_INIT(key_permission, selinux_key_permission),
5996         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
5997 #endif
5998
5999 #ifdef CONFIG_AUDIT
6000         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6001         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6002         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6003         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6004 #endif
6005 };
6006
6007 static __init int selinux_init(void)
6008 {
6009         if (!security_module_enable("selinux")) {
6010                 selinux_enabled = 0;
6011                 return 0;
6012         }
6013
6014         if (!selinux_enabled) {
6015                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6016                 return 0;
6017         }
6018
6019         printk(KERN_INFO "SELinux:  Initializing.\n");
6020
6021         /* Set the security state for the initial task. */
6022         cred_init_security();
6023
6024         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6025
6026         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6027                                             sizeof(struct inode_security_struct),
6028                                             0, SLAB_PANIC, NULL);
6029         avc_init();
6030
6031         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6032
6033         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6034                 panic("SELinux: Unable to register AVC netcache callback\n");
6035
6036         if (selinux_enforcing)
6037                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6038         else
6039                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6040
6041         return 0;
6042 }
6043
6044 static void delayed_superblock_init(struct super_block *sb, void *unused)
6045 {
6046         superblock_doinit(sb, NULL);
6047 }
6048
6049 void selinux_complete_init(void)
6050 {
6051         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6052
6053         /* Set up any superblocks initialized prior to the policy load. */
6054         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6055         iterate_supers(delayed_superblock_init, NULL);
6056 }
6057
6058 /* SELinux requires early initialization in order to label
6059    all processes and objects when they are created. */
6060 security_initcall(selinux_init);
6061
6062 #if defined(CONFIG_NETFILTER)
6063
6064 static struct nf_hook_ops selinux_nf_ops[] = {
6065         {
6066                 .hook =         selinux_ipv4_postroute,
6067                 .owner =        THIS_MODULE,
6068                 .pf =           NFPROTO_IPV4,
6069                 .hooknum =      NF_INET_POST_ROUTING,
6070                 .priority =     NF_IP_PRI_SELINUX_LAST,
6071         },
6072         {
6073                 .hook =         selinux_ipv4_forward,
6074                 .owner =        THIS_MODULE,
6075                 .pf =           NFPROTO_IPV4,
6076                 .hooknum =      NF_INET_FORWARD,
6077                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6078         },
6079         {
6080                 .hook =         selinux_ipv4_output,
6081                 .owner =        THIS_MODULE,
6082                 .pf =           NFPROTO_IPV4,
6083                 .hooknum =      NF_INET_LOCAL_OUT,
6084                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6085         },
6086 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6087         {
6088                 .hook =         selinux_ipv6_postroute,
6089                 .owner =        THIS_MODULE,
6090                 .pf =           NFPROTO_IPV6,
6091                 .hooknum =      NF_INET_POST_ROUTING,
6092                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6093         },
6094         {
6095                 .hook =         selinux_ipv6_forward,
6096                 .owner =        THIS_MODULE,
6097                 .pf =           NFPROTO_IPV6,
6098                 .hooknum =      NF_INET_FORWARD,
6099                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6100         },
6101 #endif  /* IPV6 */
6102 };
6103
6104 static int __init selinux_nf_ip_init(void)
6105 {
6106         int err;
6107
6108         if (!selinux_enabled)
6109                 return 0;
6110
6111         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6112
6113         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6114         if (err)
6115                 panic("SELinux: nf_register_hooks: error %d\n", err);
6116
6117         return 0;
6118 }
6119
6120 __initcall(selinux_nf_ip_init);
6121
6122 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6123 static void selinux_nf_ip_exit(void)
6124 {
6125         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6126
6127         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6128 }
6129 #endif
6130
6131 #else /* CONFIG_NETFILTER */
6132
6133 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6134 #define selinux_nf_ip_exit()
6135 #endif
6136
6137 #endif /* CONFIG_NETFILTER */
6138
6139 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6140 static int selinux_disabled;
6141
6142 int selinux_disable(void)
6143 {
6144         if (ss_initialized) {
6145                 /* Not permitted after initial policy load. */
6146                 return -EINVAL;
6147         }
6148
6149         if (selinux_disabled) {
6150                 /* Only do this once. */
6151                 return -EINVAL;
6152         }
6153
6154         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6155
6156         selinux_disabled = 1;
6157         selinux_enabled = 0;
6158
6159         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6160
6161         /* Try to destroy the avc node cache */
6162         avc_disable();
6163
6164         /* Unregister netfilter hooks. */
6165         selinux_nf_ip_exit();
6166
6167         /* Unregister selinuxfs. */
6168         exit_sel_fs();
6169
6170         return 0;
6171 }
6172 #endif