security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/security.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 #define SB_TYPE_FMT "%s%s%s"
  99 #define SB_SUBTYPE(sb) (sb->s_subtype && sb->s_subtype[0])
 100 #define SB_TYPE_ARGS(sb) sb->s_type->name, SB_SUBTYPE(sb) ? "." : "", SB_SUBTYPE(sb) ? sb->s_subtype : ""
 101
 102 extern struct security_operations *security_ops;
 103
 104 /* SECMARK reference count */
 105 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 106
 107 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 108 int selinux_enforcing;
 109
 110 static int __init enforcing_setup(char *str)
 111 {
 112         unsigned long enforcing;
 113         if (!strict_strtoul(str, 0, &enforcing))
 114                 selinux_enforcing = enforcing ? 1 : 0;
 115         return 1;
 116 }
 117 __setup("enforcing=", enforcing_setup);
 118 #endif
 119
 120 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 121 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 122
 123 static int __init selinux_enabled_setup(char *str)
 124 {
 125         unsigned long enabled;
 126         if (!strict_strtoul(str, 0, &enabled))
 127                 selinux_enabled = enabled ? 1 : 0;
 128         return 1;
 129 }
 130 __setup("selinux=", selinux_enabled_setup);
 131 #else
 132 int selinux_enabled = 1;
 133 #endif
 134
 135 static struct kmem_cache *sel_inode_cache;
 136
 137 /**
 138  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 139  *
 140  * Description:
 141  * This function checks the SECMARK reference counter to see if any SECMARK
 142  * targets are currently configured, if the reference counter is greater than
 143  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 144  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 145  * policy capability is enabled, SECMARK is always considered enabled.
 146  *
 147  */
 148 static int selinux_secmark_enabled(void)
 149 {
 150         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 151 }
 152
 153 /**
 154  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 155  *
 156  * Description:
 157  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 158  * (1) if any are enabled or false (0) if neither are enabled.  If the
 159  * always_check_network policy capability is enabled, peer labeling
 160  * is always considered enabled.
 161  *
 162  */
 163 static int selinux_peerlbl_enabled(void)
 164 {
 165         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 166 }
 167
 168 /*
 169  * initialise the security for the init task
 170  */
 171 static void cred_init_security(void)
 172 {
 173         struct cred *cred = (struct cred *) current->real_cred;
 174         struct task_security_struct *tsec;
 175
 176         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 177         if (!tsec)
 178                 panic("SELinux:  Failed to initialize initial task.\n");
 179
 180         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 181         cred->security = tsec;
 182 }
 183
 184 /*
 185  * get the security ID of a set of credentials
 186  */
 187 static inline u32 cred_sid(const struct cred *cred)
 188 {
 189         const struct task_security_struct *tsec;
 190
 191         tsec = cred->security;
 192         return tsec->sid;
 193 }
 194
 195 /*
 196  * get the objective security ID of a task
 197  */
 198 static inline u32 task_sid(const struct task_struct *task)
 199 {
 200         u32 sid;
 201
 202         rcu_read_lock();
 203         sid = cred_sid(__task_cred(task));
 204         rcu_read_unlock();
 205         return sid;
 206 }
 207
 208 /*
 209  * get the subjective security ID of the current task
 210  */
 211 static inline u32 current_sid(void)
 212 {
 213         const struct task_security_struct *tsec = current_security();
 214
 215         return tsec->sid;
 216 }
 217
 218 /* Allocate and free functions for each kind of security blob. */
 219
 220 static int inode_alloc_security(struct inode *inode)
 221 {
 222         struct inode_security_struct *isec;
 223         u32 sid = current_sid();
 224
 225         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 226         if (!isec)
 227                 return -ENOMEM;
 228
 229         mutex_init(&isec->lock);
 230         INIT_LIST_HEAD(&isec->list);
 231         isec->inode = inode;
 232         isec->sid = SECINITSID_UNLABELED;
 233         isec->sclass = SECCLASS_FILE;
 234         isec->task_sid = sid;
 235         inode->i_security = isec;
 236
 237         return 0;
 238 }
 239
 240 static void inode_free_security(struct inode *inode)
 241 {
 242         struct inode_security_struct *isec = inode->i_security;
 243         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 244
 245         spin_lock(&sbsec->isec_lock);
 246         if (!list_empty(&isec->list))
 247                 list_del_init(&isec->list);
 248         spin_unlock(&sbsec->isec_lock);
 249
 250         inode->i_security = NULL;
 251         kmem_cache_free(sel_inode_cache, isec);
 252 }
 253
 254 static int file_alloc_security(struct file *file)
 255 {
 256         struct file_security_struct *fsec;
 257         u32 sid = current_sid();
 258
 259         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 260         if (!fsec)
 261                 return -ENOMEM;
 262
 263         fsec->sid = sid;
 264         fsec->fown_sid = sid;
 265         file->f_security = fsec;
 266
 267         return 0;
 268 }
 269
 270 static void file_free_security(struct file *file)
 271 {
 272         struct file_security_struct *fsec = file->f_security;
 273         file->f_security = NULL;
 274         kfree(fsec);
 275 }
 276
 277 static int superblock_alloc_security(struct super_block *sb)
 278 {
 279         struct superblock_security_struct *sbsec;
 280
 281         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 282         if (!sbsec)
 283                 return -ENOMEM;
 284
 285         mutex_init(&sbsec->lock);
 286         INIT_LIST_HEAD(&sbsec->isec_head);
 287         spin_lock_init(&sbsec->isec_lock);
 288         sbsec->sb = sb;
 289         sbsec->sid = SECINITSID_UNLABELED;
 290         sbsec->def_sid = SECINITSID_FILE;
 291         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 292         sb->s_security = sbsec;
 293
 294         return 0;
 295 }
 296
 297 static void superblock_free_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec = sb->s_security;
 300         sb->s_security = NULL;
 301         kfree(sbsec);
 302 }
 303
 304 /* The file system's label must be initialized prior to use. */
 305
 306 static const char *labeling_behaviors[7] = {
 307         "uses xattr",
 308         "uses transition SIDs",
 309         "uses task SIDs",
 310         "uses genfs_contexts",
 311         "not configured for labeling",
 312         "uses mountpoint labeling",
 313         "uses native labeling",
 314 };
 315
 316 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 317
 318 static inline int inode_doinit(struct inode *inode)
 319 {
 320         return inode_doinit_with_dentry(inode, NULL);
 321 }
 322
 323 enum {
 324         Opt_error = -1,
 325         Opt_context = 1,
 326         Opt_fscontext = 2,
 327         Opt_defcontext = 3,
 328         Opt_rootcontext = 4,
 329         Opt_labelsupport = 5,
 330         Opt_nextmntopt = 6,
 331 };
 332
 333 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 334
 335 static const match_table_t tokens = {
 336         {Opt_context, CONTEXT_STR "%s"},
 337         {Opt_fscontext, FSCONTEXT_STR "%s"},
 338         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 339         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 340         {Opt_labelsupport, LABELSUPP_STR},
 341         {Opt_error, NULL},
 342 };
 343
 344 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 345
 346 static int may_context_mount_sb_relabel(u32 sid,
 347                         struct superblock_security_struct *sbsec,
 348                         const struct cred *cred)
 349 {
 350         const struct task_security_struct *tsec = cred->security;
 351         int rc;
 352
 353         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 354                           FILESYSTEM__RELABELFROM, NULL);
 355         if (rc)
 356                 return rc;
 357
 358         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 359                           FILESYSTEM__RELABELTO, NULL);
 360         return rc;
 361 }
 362
 363 static int may_context_mount_inode_relabel(u32 sid,
 364                         struct superblock_security_struct *sbsec,
 365                         const struct cred *cred)
 366 {
 367         const struct task_security_struct *tsec = cred->security;
 368         int rc;
 369         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 370                           FILESYSTEM__RELABELFROM, NULL);
 371         if (rc)
 372                 return rc;
 373
 374         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 375                           FILESYSTEM__ASSOCIATE, NULL);
 376         return rc;
 377 }
 378
 379 static int selinux_is_sblabel_mnt(struct super_block *sb)
 380 {
 381         struct superblock_security_struct *sbsec = sb->s_security;
 382
 383         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 384             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 385             sbsec->behavior == SECURITY_FS_USE_TASK)
 386                 return 1;
 387
 388         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 389         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 390                 return 1;
 391
 392         /*
 393          * Special handling for rootfs. Is genfs but supports
 394          * setting SELinux context on in-core inodes.
 395          */
 396         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 397                 return 1;
 398
 399         return 0;
 400 }
 401
 402 static int sb_finish_set_opts(struct super_block *sb)
 403 {
 404         struct superblock_security_struct *sbsec = sb->s_security;
 405         struct dentry *root = sb->s_root;
 406         struct inode *root_inode = root->d_inode;
 407         int rc = 0;
 408
 409         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 410                 /* Make sure that the xattr handler exists and that no
 411                    error other than -ENODATA is returned by getxattr on
 412                    the root directory.  -ENODATA is ok, as this may be
 413                    the first boot of the SELinux kernel before we have
 414                    assigned xattr values to the filesystem. */
 415                 if (!root_inode->i_op->getxattr) {
 416                         printk(KERN_WARNING "SELinux: (dev %s, type "SB_TYPE_FMT") has no "
 417                                "xattr support\n", sb->s_id, SB_TYPE_ARGS(sb));
 418                         rc = -EOPNOTSUPP;
 419                         goto out;
 420                 }
 421                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 422                 if (rc < 0 && rc != -ENODATA) {
 423                         if (rc == -EOPNOTSUPP)
 424                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 425                                        SB_TYPE_FMT") has no security xattr handler\n",
 426                                        sb->s_id, SB_TYPE_ARGS(sb));
 427                         else
 428                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 429                                        SB_TYPE_FMT") getxattr errno %d\n", sb->s_id,
 430                                        SB_TYPE_ARGS(sb), -rc);
 431                         goto out;
 432                 }
 433         }
 434
 435         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 436                 printk(KERN_ERR "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), unknown behavior\n",
 437                        sb->s_id, SB_TYPE_ARGS(sb));
 438         else
 439                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type "SB_TYPE_FMT"), %s\n",
 440                        sb->s_id, SB_TYPE_ARGS(sb),
 441                        labeling_behaviors[sbsec->behavior-1]);
 442
 443         sbsec->flags |= SE_SBINITIALIZED;
 444         if (selinux_is_sblabel_mnt(sb))
 445                 sbsec->flags |= SBLABEL_MNT;
 446
 447         /* Initialize the root inode. */
 448         rc = inode_doinit_with_dentry(root_inode, root);
 449
 450         /* Initialize any other inodes associated with the superblock, e.g.
 451            inodes created prior to initial policy load or inodes created
 452            during get_sb by a pseudo filesystem that directly
 453            populates itself. */
 454         spin_lock(&sbsec->isec_lock);
 455 next_inode:
 456         if (!list_empty(&sbsec->isec_head)) {
 457                 struct inode_security_struct *isec =
 458                                 list_entry(sbsec->isec_head.next,
 459                                            struct inode_security_struct, list);
 460                 struct inode *inode = isec->inode;
 461                 spin_unlock(&sbsec->isec_lock);
 462                 inode = igrab(inode);
 463                 if (inode) {
 464                         if (!IS_PRIVATE(inode))
 465                                 inode_doinit(inode);
 466                         iput(inode);
 467                 }
 468                 spin_lock(&sbsec->isec_lock);
 469                 list_del_init(&isec->list);
 470                 goto next_inode;
 471         }
 472         spin_unlock(&sbsec->isec_lock);
 473 out:
 474         return rc;
 475 }
 476
 477 /*
 478  * This function should allow an FS to ask what it's mount security
 479  * options were so it can use those later for submounts, displaying
 480  * mount options, or whatever.
 481  */
 482 static int selinux_get_mnt_opts(const struct super_block *sb,
 483                                 struct security_mnt_opts *opts)
 484 {
 485         int rc = 0, i;
 486         struct superblock_security_struct *sbsec = sb->s_security;
 487         char *context = NULL;
 488         u32 len;
 489         char tmp;
 490
 491         security_init_mnt_opts(opts);
 492
 493         if (!(sbsec->flags & SE_SBINITIALIZED))
 494                 return -EINVAL;
 495
 496         if (!ss_initialized)
 497                 return -EINVAL;
 498
 499         /* make sure we always check enough bits to cover the mask */
 500         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 501
 502         tmp = sbsec->flags & SE_MNTMASK;
 503         /* count the number of mount options for this sb */
 504         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 505                 if (tmp & 0x01)
 506                         opts->num_mnt_opts++;
 507                 tmp >>= 1;
 508         }
 509         /* Check if the Label support flag is set */
 510         if (sbsec->flags & SBLABEL_MNT)
 511                 opts->num_mnt_opts++;
 512
 513         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 514         if (!opts->mnt_opts) {
 515                 rc = -ENOMEM;
 516                 goto out_free;
 517         }
 518
 519         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 520         if (!opts->mnt_opts_flags) {
 521                 rc = -ENOMEM;
 522                 goto out_free;
 523         }
 524
 525         i = 0;
 526         if (sbsec->flags & FSCONTEXT_MNT) {
 527                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 528                 if (rc)
 529                         goto out_free;
 530                 opts->mnt_opts[i] = context;
 531                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 532         }
 533         if (sbsec->flags & CONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 539         }
 540         if (sbsec->flags & DEFCONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 546         }
 547         if (sbsec->flags & ROOTCONTEXT_MNT) {
 548                 struct inode *root = sbsec->sb->s_root->d_inode;
 549                 struct inode_security_struct *isec = root->i_security;
 550
 551                 rc = security_sid_to_context(isec->sid, &context, &len);
 552                 if (rc)
 553                         goto out_free;
 554                 opts->mnt_opts[i] = context;
 555                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 556         }
 557         if (sbsec->flags & SBLABEL_MNT) {
 558                 opts->mnt_opts[i] = NULL;
 559                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 560         }
 561
 562         BUG_ON(i != opts->num_mnt_opts);
 563
 564         return 0;
 565
 566 out_free:
 567         security_free_mnt_opts(opts);
 568         return rc;
 569 }
 570
 571 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 572                       u32 old_sid, u32 new_sid)
 573 {
 574         char mnt_flags = sbsec->flags & SE_MNTMASK;
 575
 576         /* check if the old mount command had the same options */
 577         if (sbsec->flags & SE_SBINITIALIZED)
 578                 if (!(sbsec->flags & flag) ||
 579                     (old_sid != new_sid))
 580                         return 1;
 581
 582         /* check if we were passed the same options twice,
 583          * aka someone passed context=a,context=b
 584          */
 585         if (!(sbsec->flags & SE_SBINITIALIZED))
 586                 if (mnt_flags & flag)
 587                         return 1;
 588         return 0;
 589 }
 590
 591 /*
 592  * Allow filesystems with binary mount data to explicitly set mount point
 593  * labeling information.
 594  */
 595 static int selinux_set_mnt_opts(struct super_block *sb,
 596                                 struct security_mnt_opts *opts,
 597                                 unsigned long kern_flags,
 598                                 unsigned long *set_kern_flags)
 599 {
 600         const struct cred *cred = current_cred();
 601         int rc = 0, i;
 602         struct superblock_security_struct *sbsec = sb->s_security;
 603         struct inode *inode = sbsec->sb->s_root->d_inode;
 604         struct inode_security_struct *root_isec = inode->i_security;
 605         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 606         u32 defcontext_sid = 0;
 607         char **mount_options = opts->mnt_opts;
 608         int *flags = opts->mnt_opts_flags;
 609         int num_opts = opts->num_mnt_opts;
 610
 611         mutex_lock(&sbsec->lock);
 612
 613         if (!ss_initialized) {
 614                 if (!num_opts) {
 615                         /* Defer initialization until selinux_complete_init,
 616                            after the initial policy is loaded and the security
 617                            server is ready to handle calls. */
 618                         goto out;
 619                 }
 620                 rc = -EINVAL;
 621                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 622                         "before the security server is initialized\n");
 623                 goto out;
 624         }
 625         if (kern_flags && !set_kern_flags) {
 626                 /* Specifying internal flags without providing a place to
 627                  * place the results is not allowed */
 628                 rc = -EINVAL;
 629                 goto out;
 630         }
 631
 632         /*
 633          * Binary mount data FS will come through this function twice.  Once
 634          * from an explicit call and once from the generic calls from the vfs.
 635          * Since the generic VFS calls will not contain any security mount data
 636          * we need to skip the double mount verification.
 637          *
 638          * This does open a hole in which we will not notice if the first
 639          * mount using this sb set explict options and a second mount using
 640          * this sb does not set any security options.  (The first options
 641          * will be used for both mounts)
 642          */
 643         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 644             && (num_opts == 0))
 645                 goto out;
 646
 647         /*
 648          * parse the mount options, check if they are valid sids.
 649          * also check if someone is trying to mount the same sb more
 650          * than once with different security options.
 651          */
 652         for (i = 0; i < num_opts; i++) {
 653                 u32 sid;
 654
 655                 if (flags[i] == SBLABEL_MNT)
 656                         continue;
 657                 rc = security_context_to_sid(mount_options[i],
 658                                              strlen(mount_options[i]), &sid);
 659                 if (rc) {
 660                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 661                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
 662                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
 663                         goto out;
 664                 }
 665                 switch (flags[i]) {
 666                 case FSCONTEXT_MNT:
 667                         fscontext_sid = sid;
 668
 669                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 670                                         fscontext_sid))
 671                                 goto out_double_mount;
 672
 673                         sbsec->flags |= FSCONTEXT_MNT;
 674                         break;
 675                 case CONTEXT_MNT:
 676                         context_sid = sid;
 677
 678                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 679                                         context_sid))
 680                                 goto out_double_mount;
 681
 682                         sbsec->flags |= CONTEXT_MNT;
 683                         break;
 684                 case ROOTCONTEXT_MNT:
 685                         rootcontext_sid = sid;
 686
 687                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 688                                         rootcontext_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= ROOTCONTEXT_MNT;
 692
 693                         break;
 694                 case DEFCONTEXT_MNT:
 695                         defcontext_sid = sid;
 696
 697                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 698                                         defcontext_sid))
 699                                 goto out_double_mount;
 700
 701                         sbsec->flags |= DEFCONTEXT_MNT;
 702
 703                         break;
 704                 default:
 705                         rc = -EINVAL;
 706                         goto out;
 707                 }
 708         }
 709
 710         if (sbsec->flags & SE_SBINITIALIZED) {
 711                 /* previously mounted with options, but not on this attempt? */
 712                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 713                         goto out_double_mount;
 714                 rc = 0;
 715                 goto out;
 716         }
 717
 718         if (strcmp(sb->s_type->name, "proc") == 0)
 719                 sbsec->flags |= SE_SBPROC;
 720
 721         if (!sbsec->behavior) {
 722                 /*
 723                  * Determine the labeling behavior to use for this
 724                  * filesystem type.
 725                  */
 726                 rc = security_fs_use(sb);
 727                 if (rc) {
 728                         printk(KERN_WARNING
 729                                 "%s: security_fs_use(%s) returned %d\n",
 730                                         __func__, sb->s_type->name, rc);
 731                         goto out;
 732                 }
 733         }
 734         /* sets the context of the superblock for the fs being mounted. */
 735         if (fscontext_sid) {
 736                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 737                 if (rc)
 738                         goto out;
 739
 740                 sbsec->sid = fscontext_sid;
 741         }
 742
 743         /*
 744          * Switch to using mount point labeling behavior.
 745          * sets the label used on all file below the mountpoint, and will set
 746          * the superblock context if not already set.
 747          */
 748         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 749                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 750                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 751         }
 752
 753         if (context_sid) {
 754                 if (!fscontext_sid) {
 755                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 756                                                           cred);
 757                         if (rc)
 758                                 goto out;
 759                         sbsec->sid = context_sid;
 760                 } else {
 761                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 762                                                              cred);
 763                         if (rc)
 764                                 goto out;
 765                 }
 766                 if (!rootcontext_sid)
 767                         rootcontext_sid = context_sid;
 768
 769                 sbsec->mntpoint_sid = context_sid;
 770                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 771         }
 772
 773         if (rootcontext_sid) {
 774                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 775                                                      cred);
 776                 if (rc)
 777                         goto out;
 778
 779                 root_isec->sid = rootcontext_sid;
 780                 root_isec->initialized = 1;
 781         }
 782
 783         if (defcontext_sid) {
 784                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 785                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 786                         rc = -EINVAL;
 787                         printk(KERN_WARNING "SELinux: defcontext option is "
 788                                "invalid for this filesystem type\n");
 789                         goto out;
 790                 }
 791
 792                 if (defcontext_sid != sbsec->def_sid) {
 793                         rc = may_context_mount_inode_relabel(defcontext_sid,
 794                                                              sbsec, cred);
 795                         if (rc)
 796                                 goto out;
 797                 }
 798
 799                 sbsec->def_sid = defcontext_sid;
 800         }
 801
 802         rc = sb_finish_set_opts(sb);
 803 out:
 804         mutex_unlock(&sbsec->lock);
 805         return rc;
 806 out_double_mount:
 807         rc = -EINVAL;
 808         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 809                "security settings for (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
 810                SB_TYPE_ARGS(sb));
 811         goto out;
 812 }
 813
 814 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 815                                     const struct super_block *newsb)
 816 {
 817         struct superblock_security_struct *old = oldsb->s_security;
 818         struct superblock_security_struct *new = newsb->s_security;
 819         char oldflags = old->flags & SE_MNTMASK;
 820         char newflags = new->flags & SE_MNTMASK;
 821
 822         if (oldflags != newflags)
 823                 goto mismatch;
 824         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 825                 goto mismatch;
 826         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 827                 goto mismatch;
 828         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 829                 goto mismatch;
 830         if (oldflags & ROOTCONTEXT_MNT) {
 831                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 832                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 833                 if (oldroot->sid != newroot->sid)
 834                         goto mismatch;
 835         }
 836         return 0;
 837 mismatch:
 838         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 839                             "different security settings for (dev %s, "
 840                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 841         return -EBUSY;
 842 }
 843
 844 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 845                                         struct super_block *newsb)
 846 {
 847         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 848         struct superblock_security_struct *newsbsec = newsb->s_security;
 849
 850         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 851         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 852         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 853
 854         /*
 855          * if the parent was able to be mounted it clearly had no special lsm
 856          * mount options.  thus we can safely deal with this superblock later
 857          */
 858         if (!ss_initialized)
 859                 return 0;
 860
 861         /* how can we clone if the old one wasn't set up?? */
 862         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 863
 864         /* if fs is reusing a sb, make sure that the contexts match */
 865         if (newsbsec->flags & SE_SBINITIALIZED)
 866                 return selinux_cmp_sb_context(oldsb, newsb);
 867
 868         mutex_lock(&newsbsec->lock);
 869
 870         newsbsec->flags = oldsbsec->flags;
 871
 872         newsbsec->sid = oldsbsec->sid;
 873         newsbsec->def_sid = oldsbsec->def_sid;
 874         newsbsec->behavior = oldsbsec->behavior;
 875
 876         if (set_context) {
 877                 u32 sid = oldsbsec->mntpoint_sid;
 878
 879                 if (!set_fscontext)
 880                         newsbsec->sid = sid;
 881                 if (!set_rootcontext) {
 882                         struct inode *newinode = newsb->s_root->d_inode;
 883                         struct inode_security_struct *newisec = newinode->i_security;
 884                         newisec->sid = sid;
 885                 }
 886                 newsbsec->mntpoint_sid = sid;
 887         }
 888         if (set_rootcontext) {
 889                 const struct inode *oldinode = oldsb->s_root->d_inode;
 890                 const struct inode_security_struct *oldisec = oldinode->i_security;
 891                 struct inode *newinode = newsb->s_root->d_inode;
 892                 struct inode_security_struct *newisec = newinode->i_security;
 893
 894                 newisec->sid = oldisec->sid;
 895         }
 896
 897         sb_finish_set_opts(newsb);
 898         mutex_unlock(&newsbsec->lock);
 899         return 0;
 900 }
 901
 902 static int selinux_parse_opts_str(char *options,
 903                                   struct security_mnt_opts *opts)
 904 {
 905         char *p;
 906         char *context = NULL, *defcontext = NULL;
 907         char *fscontext = NULL, *rootcontext = NULL;
 908         int rc, num_mnt_opts = 0;
 909
 910         opts->num_mnt_opts = 0;
 911
 912         /* Standard string-based options. */
 913         while ((p = strsep(&options, "|")) != NULL) {
 914                 int token;
 915                 substring_t args[MAX_OPT_ARGS];
 916
 917                 if (!*p)
 918                         continue;
 919
 920                 token = match_token(p, tokens, args);
 921
 922                 switch (token) {
 923                 case Opt_context:
 924                         if (context || defcontext) {
 925                                 rc = -EINVAL;
 926                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 927                                 goto out_err;
 928                         }
 929                         context = match_strdup(&args[0]);
 930                         if (!context) {
 931                                 rc = -ENOMEM;
 932                                 goto out_err;
 933                         }
 934                         break;
 935
 936                 case Opt_fscontext:
 937                         if (fscontext) {
 938                                 rc = -EINVAL;
 939                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 940                                 goto out_err;
 941                         }
 942                         fscontext = match_strdup(&args[0]);
 943                         if (!fscontext) {
 944                                 rc = -ENOMEM;
 945                                 goto out_err;
 946                         }
 947                         break;
 948
 949                 case Opt_rootcontext:
 950                         if (rootcontext) {
 951                                 rc = -EINVAL;
 952                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 953                                 goto out_err;
 954                         }
 955                         rootcontext = match_strdup(&args[0]);
 956                         if (!rootcontext) {
 957                                 rc = -ENOMEM;
 958                                 goto out_err;
 959                         }
 960                         break;
 961
 962                 case Opt_defcontext:
 963                         if (context || defcontext) {
 964                                 rc = -EINVAL;
 965                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 966                                 goto out_err;
 967                         }
 968                         defcontext = match_strdup(&args[0]);
 969                         if (!defcontext) {
 970                                 rc = -ENOMEM;
 971                                 goto out_err;
 972                         }
 973                         break;
 974                 case Opt_labelsupport:
 975                         break;
 976                 default:
 977                         rc = -EINVAL;
 978                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 979                         goto out_err;
 980
 981                 }
 982         }
 983
 984         rc = -ENOMEM;
 985         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 986         if (!opts->mnt_opts)
 987                 goto out_err;
 988
 989         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 990         if (!opts->mnt_opts_flags) {
 991                 kfree(opts->mnt_opts);
 992                 goto out_err;
 993         }
 994
 995         if (fscontext) {
 996                 opts->mnt_opts[num_mnt_opts] = fscontext;
 997                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 998         }
 999         if (context) {
1000                 opts->mnt_opts[num_mnt_opts] = context;
1001                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1002         }
1003         if (rootcontext) {
1004                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1005                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1006         }
1007         if (defcontext) {
1008                 opts->mnt_opts[num_mnt_opts] = defcontext;
1009                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1010         }
1011
1012         opts->num_mnt_opts = num_mnt_opts;
1013         return 0;
1014
1015 out_err:
1016         kfree(context);
1017         kfree(defcontext);
1018         kfree(fscontext);
1019         kfree(rootcontext);
1020         return rc;
1021 }
1022 /*
1023  * string mount options parsing and call set the sbsec
1024  */
1025 static int superblock_doinit(struct super_block *sb, void *data)
1026 {
1027         int rc = 0;
1028         char *options = data;
1029         struct security_mnt_opts opts;
1030
1031         security_init_mnt_opts(&opts);
1032
1033         if (!data)
1034                 goto out;
1035
1036         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1037
1038         rc = selinux_parse_opts_str(options, &opts);
1039         if (rc)
1040                 goto out_err;
1041
1042 out:
1043         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1044
1045 out_err:
1046         security_free_mnt_opts(&opts);
1047         return rc;
1048 }
1049
1050 static void selinux_write_opts(struct seq_file *m,
1051                                struct security_mnt_opts *opts)
1052 {
1053         int i;
1054         char *prefix;
1055
1056         for (i = 0; i < opts->num_mnt_opts; i++) {
1057                 char *has_comma;
1058
1059                 if (opts->mnt_opts[i])
1060                         has_comma = strchr(opts->mnt_opts[i], ',');
1061                 else
1062                         has_comma = NULL;
1063
1064                 switch (opts->mnt_opts_flags[i]) {
1065                 case CONTEXT_MNT:
1066                         prefix = CONTEXT_STR;
1067                         break;
1068                 case FSCONTEXT_MNT:
1069                         prefix = FSCONTEXT_STR;
1070                         break;
1071                 case ROOTCONTEXT_MNT:
1072                         prefix = ROOTCONTEXT_STR;
1073                         break;
1074                 case DEFCONTEXT_MNT:
1075                         prefix = DEFCONTEXT_STR;
1076                         break;
1077                 case SBLABEL_MNT:
1078                         seq_putc(m, ',');
1079                         seq_puts(m, LABELSUPP_STR);
1080                         continue;
1081                 default:
1082                         BUG();
1083                         return;
1084                 };
1085                 /* we need a comma before each option */
1086                 seq_putc(m, ',');
1087                 seq_puts(m, prefix);
1088                 if (has_comma)
1089                         seq_putc(m, '\"');
1090                 seq_puts(m, opts->mnt_opts[i]);
1091                 if (has_comma)
1092                         seq_putc(m, '\"');
1093         }
1094 }
1095
1096 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1097 {
1098         struct security_mnt_opts opts;
1099         int rc;
1100
1101         rc = selinux_get_mnt_opts(sb, &opts);
1102         if (rc) {
1103                 /* before policy load we may get EINVAL, don't show anything */
1104                 if (rc == -EINVAL)
1105                         rc = 0;
1106                 return rc;
1107         }
1108
1109         selinux_write_opts(m, &opts);
1110
1111         security_free_mnt_opts(&opts);
1112
1113         return rc;
1114 }
1115
1116 static inline u16 inode_mode_to_security_class(umode_t mode)
1117 {
1118         switch (mode & S_IFMT) {
1119         case S_IFSOCK:
1120                 return SECCLASS_SOCK_FILE;
1121         case S_IFLNK:
1122                 return SECCLASS_LNK_FILE;
1123         case S_IFREG:
1124                 return SECCLASS_FILE;
1125         case S_IFBLK:
1126                 return SECCLASS_BLK_FILE;
1127         case S_IFDIR:
1128                 return SECCLASS_DIR;
1129         case S_IFCHR:
1130                 return SECCLASS_CHR_FILE;
1131         case S_IFIFO:
1132                 return SECCLASS_FIFO_FILE;
1133
1134         }
1135
1136         return SECCLASS_FILE;
1137 }
1138
1139 static inline int default_protocol_stream(int protocol)
1140 {
1141         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1142 }
1143
1144 static inline int default_protocol_dgram(int protocol)
1145 {
1146         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1147 }
1148
1149 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1150 {
1151         switch (family) {
1152         case PF_UNIX:
1153                 switch (type) {
1154                 case SOCK_STREAM:
1155                 case SOCK_SEQPACKET:
1156                         return SECCLASS_UNIX_STREAM_SOCKET;
1157                 case SOCK_DGRAM:
1158                         return SECCLASS_UNIX_DGRAM_SOCKET;
1159                 }
1160                 break;
1161         case PF_INET:
1162         case PF_INET6:
1163                 switch (type) {
1164                 case SOCK_STREAM:
1165                         if (default_protocol_stream(protocol))
1166                                 return SECCLASS_TCP_SOCKET;
1167                         else
1168                                 return SECCLASS_RAWIP_SOCKET;
1169                 case SOCK_DGRAM:
1170                         if (default_protocol_dgram(protocol))
1171                                 return SECCLASS_UDP_SOCKET;
1172                         else
1173                                 return SECCLASS_RAWIP_SOCKET;
1174                 case SOCK_DCCP:
1175                         return SECCLASS_DCCP_SOCKET;
1176                 default:
1177                         return SECCLASS_RAWIP_SOCKET;
1178                 }
1179                 break;
1180         case PF_NETLINK:
1181                 switch (protocol) {
1182                 case NETLINK_ROUTE:
1183                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1184                 case NETLINK_FIREWALL:
1185                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1186                 case NETLINK_SOCK_DIAG:
1187                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1188                 case NETLINK_NFLOG:
1189                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1190                 case NETLINK_XFRM:
1191                         return SECCLASS_NETLINK_XFRM_SOCKET;
1192                 case NETLINK_SELINUX:
1193                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1194                 case NETLINK_AUDIT:
1195                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1196                 case NETLINK_IP6_FW:
1197                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1198                 case NETLINK_DNRTMSG:
1199                         return SECCLASS_NETLINK_DNRT_SOCKET;
1200                 case NETLINK_KOBJECT_UEVENT:
1201                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1202                 default:
1203                         return SECCLASS_NETLINK_SOCKET;
1204                 }
1205         case PF_PACKET:
1206                 return SECCLASS_PACKET_SOCKET;
1207         case PF_KEY:
1208                 return SECCLASS_KEY_SOCKET;
1209         case PF_APPLETALK:
1210                 return SECCLASS_APPLETALK_SOCKET;
1211         }
1212
1213         return SECCLASS_SOCKET;
1214 }
1215
1216 #ifdef CONFIG_PROC_FS
1217 static int selinux_proc_get_sid(struct dentry *dentry,
1218                                 u16 tclass,
1219                                 u32 *sid)
1220 {
1221         int rc;
1222         char *buffer, *path;
1223
1224         buffer = (char *)__get_free_page(GFP_KERNEL);
1225         if (!buffer)
1226                 return -ENOMEM;
1227
1228         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1229         if (IS_ERR(path))
1230                 rc = PTR_ERR(path);
1231         else {
1232                 /* each process gets a /proc/PID/ entry. Strip off the
1233                  * PID part to get a valid selinux labeling.
1234                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1235                 while (path[1] >= '0' && path[1] <= '9') {
1236                         path[1] = '/';
1237                         path++;
1238                 }
1239                 rc = security_genfs_sid("proc", path, tclass, sid);
1240         }
1241         free_page((unsigned long)buffer);
1242         return rc;
1243 }
1244 #else
1245 static int selinux_proc_get_sid(struct dentry *dentry,
1246                                 u16 tclass,
1247                                 u32 *sid)
1248 {
1249         return -EINVAL;
1250 }
1251 #endif
1252
1253 /* The inode's security attributes must be initialized before first use. */
1254 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1255 {
1256         struct superblock_security_struct *sbsec = NULL;
1257         struct inode_security_struct *isec = inode->i_security;
1258         u32 sid;
1259         struct dentry *dentry;
1260 #define INITCONTEXTLEN 255
1261         char *context = NULL;
1262         unsigned len = 0;
1263         int rc = 0;
1264
1265         if (isec->initialized)
1266                 goto out;
1267
1268         mutex_lock(&isec->lock);
1269         if (isec->initialized)
1270                 goto out_unlock;
1271
1272         sbsec = inode->i_sb->s_security;
1273         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1274                 /* Defer initialization until selinux_complete_init,
1275                    after the initial policy is loaded and the security
1276                    server is ready to handle calls. */
1277                 spin_lock(&sbsec->isec_lock);
1278                 if (list_empty(&isec->list))
1279                         list_add(&isec->list, &sbsec->isec_head);
1280                 spin_unlock(&sbsec->isec_lock);
1281                 goto out_unlock;
1282         }
1283
1284         switch (sbsec->behavior) {
1285         case SECURITY_FS_USE_NATIVE:
1286                 break;
1287         case SECURITY_FS_USE_XATTR:
1288                 if (!inode->i_op->getxattr) {
1289                         isec->sid = sbsec->def_sid;
1290                         break;
1291                 }
1292
1293                 /* Need a dentry, since the xattr API requires one.
1294                    Life would be simpler if we could just pass the inode. */
1295                 if (opt_dentry) {
1296                         /* Called from d_instantiate or d_splice_alias. */
1297                         dentry = dget(opt_dentry);
1298                 } else {
1299                         /* Called from selinux_complete_init, try to find a dentry. */
1300                         dentry = d_find_alias(inode);
1301                 }
1302                 if (!dentry) {
1303                         /*
1304                          * this is can be hit on boot when a file is accessed
1305                          * before the policy is loaded.  When we load policy we
1306                          * may find inodes that have no dentry on the
1307                          * sbsec->isec_head list.  No reason to complain as these
1308                          * will get fixed up the next time we go through
1309                          * inode_doinit with a dentry, before these inodes could
1310                          * be used again by userspace.
1311                          */
1312                         goto out_unlock;
1313                 }
1314
1315                 len = INITCONTEXTLEN;
1316                 context = kmalloc(len+1, GFP_NOFS);
1317                 if (!context) {
1318                         rc = -ENOMEM;
1319                         dput(dentry);
1320                         goto out_unlock;
1321                 }
1322                 context[len] = '\0';
1323                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1324                                            context, len);
1325                 if (rc == -ERANGE) {
1326                         kfree(context);
1327
1328                         /* Need a larger buffer.  Query for the right size. */
1329                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1330                                                    NULL, 0);
1331                         if (rc < 0) {
1332                                 dput(dentry);
1333                                 goto out_unlock;
1334                         }
1335                         len = rc;
1336                         context = kmalloc(len+1, GFP_NOFS);
1337                         if (!context) {
1338                                 rc = -ENOMEM;
1339                                 dput(dentry);
1340                                 goto out_unlock;
1341                         }
1342                         context[len] = '\0';
1343                         rc = inode->i_op->getxattr(dentry,
1344                                                    XATTR_NAME_SELINUX,
1345                                                    context, len);
1346                 }
1347                 dput(dentry);
1348                 if (rc < 0) {
1349                         if (rc != -ENODATA) {
1350                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1351                                        "%d for dev=%s ino=%ld\n", __func__,
1352                                        -rc, inode->i_sb->s_id, inode->i_ino);
1353                                 kfree(context);
1354                                 goto out_unlock;
1355                         }
1356                         /* Map ENODATA to the default file SID */
1357                         sid = sbsec->def_sid;
1358                         rc = 0;
1359                 } else {
1360                         rc = security_context_to_sid_default(context, rc, &sid,
1361                                                              sbsec->def_sid,
1362                                                              GFP_NOFS);
1363                         if (rc) {
1364                                 char *dev = inode->i_sb->s_id;
1365                                 unsigned long ino = inode->i_ino;
1366
1367                                 if (rc == -EINVAL) {
1368                                         if (printk_ratelimit())
1369                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1370                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1371                                                         "filesystem in question.\n", ino, dev, context);
1372                                 } else {
1373                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1374                                                "returned %d for dev=%s ino=%ld\n",
1375                                                __func__, context, -rc, dev, ino);
1376                                 }
1377                                 kfree(context);
1378                                 /* Leave with the unlabeled SID */
1379                                 rc = 0;
1380                                 break;
1381                         }
1382                 }
1383                 kfree(context);
1384                 isec->sid = sid;
1385                 break;
1386         case SECURITY_FS_USE_TASK:
1387                 isec->sid = isec->task_sid;
1388                 break;
1389         case SECURITY_FS_USE_TRANS:
1390                 /* Default to the fs SID. */
1391                 isec->sid = sbsec->sid;
1392
1393                 /* Try to obtain a transition SID. */
1394                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1395                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1396                                              isec->sclass, NULL, &sid);
1397                 if (rc)
1398                         goto out_unlock;
1399                 isec->sid = sid;
1400                 break;
1401         case SECURITY_FS_USE_MNTPOINT:
1402                 isec->sid = sbsec->mntpoint_sid;
1403                 break;
1404         default:
1405                 /* Default to the fs superblock SID. */
1406                 isec->sid = sbsec->sid;
1407
1408                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1409                         if (opt_dentry) {
1410                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1411                                 rc = selinux_proc_get_sid(opt_dentry,
1412                                                           isec->sclass,
1413                                                           &sid);
1414                                 if (rc)
1415                                         goto out_unlock;
1416                                 isec->sid = sid;
1417                         }
1418                 }
1419                 break;
1420         }
1421
1422         isec->initialized = 1;
1423
1424 out_unlock:
1425         mutex_unlock(&isec->lock);
1426 out:
1427         if (isec->sclass == SECCLASS_FILE)
1428                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1429         return rc;
1430 }
1431
1432 /* Convert a Linux signal to an access vector. */
1433 static inline u32 signal_to_av(int sig)
1434 {
1435         u32 perm = 0;
1436
1437         switch (sig) {
1438         case SIGCHLD:
1439                 /* Commonly granted from child to parent. */
1440                 perm = PROCESS__SIGCHLD;
1441                 break;
1442         case SIGKILL:
1443                 /* Cannot be caught or ignored */
1444                 perm = PROCESS__SIGKILL;
1445                 break;
1446         case SIGSTOP:
1447                 /* Cannot be caught or ignored */
1448                 perm = PROCESS__SIGSTOP;
1449                 break;
1450         default:
1451                 /* All other signals. */
1452                 perm = PROCESS__SIGNAL;
1453                 break;
1454         }
1455
1456         return perm;
1457 }
1458
1459 /*
1460  * Check permission between a pair of credentials
1461  * fork check, ptrace check, etc.
1462  */
1463 static int cred_has_perm(const struct cred *actor,
1464                          const struct cred *target,
1465                          u32 perms)
1466 {
1467         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1468
1469         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1470 }
1471
1472 /*
1473  * Check permission between a pair of tasks, e.g. signal checks,
1474  * fork check, ptrace check, etc.
1475  * tsk1 is the actor and tsk2 is the target
1476  * - this uses the default subjective creds of tsk1
1477  */
1478 static int task_has_perm(const struct task_struct *tsk1,
1479                          const struct task_struct *tsk2,
1480                          u32 perms)
1481 {
1482         const struct task_security_struct *__tsec1, *__tsec2;
1483         u32 sid1, sid2;
1484
1485         rcu_read_lock();
1486         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1487         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1488         rcu_read_unlock();
1489         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1490 }
1491
1492 /*
1493  * Check permission between current and another task, e.g. signal checks,
1494  * fork check, ptrace check, etc.
1495  * current is the actor and tsk2 is the target
1496  * - this uses current's subjective creds
1497  */
1498 static int current_has_perm(const struct task_struct *tsk,
1499                             u32 perms)
1500 {
1501         u32 sid, tsid;
1502
1503         sid = current_sid();
1504         tsid = task_sid(tsk);
1505         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1506 }
1507
1508 #if CAP_LAST_CAP > 63
1509 #error Fix SELinux to handle capabilities > 63.
1510 #endif
1511
1512 /* Check whether a task is allowed to use a capability. */
1513 static int cred_has_capability(const struct cred *cred,
1514                                int cap, int audit)
1515 {
1516         struct common_audit_data ad;
1517         struct av_decision avd;
1518         u16 sclass;
1519         u32 sid = cred_sid(cred);
1520         u32 av = CAP_TO_MASK(cap);
1521         int rc;
1522
1523         ad.type = LSM_AUDIT_DATA_CAP;
1524         ad.u.cap = cap;
1525
1526         switch (CAP_TO_INDEX(cap)) {
1527         case 0:
1528                 sclass = SECCLASS_CAPABILITY;
1529                 break;
1530         case 1:
1531                 sclass = SECCLASS_CAPABILITY2;
1532                 break;
1533         default:
1534                 printk(KERN_ERR
1535                        "SELinux:  out of range capability %d\n", cap);
1536                 BUG();
1537                 return -EINVAL;
1538         }
1539
1540         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1541         if (audit == SECURITY_CAP_AUDIT) {
1542                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1543                 if (rc2)
1544                         return rc2;
1545         }
1546         return rc;
1547 }
1548
1549 /* Check whether a task is allowed to use a system operation. */
1550 static int task_has_system(struct task_struct *tsk,
1551                            u32 perms)
1552 {
1553         u32 sid = task_sid(tsk);
1554
1555         return avc_has_perm(sid, SECINITSID_KERNEL,
1556                             SECCLASS_SYSTEM, perms, NULL);
1557 }
1558
1559 /* Check whether a task has a particular permission to an inode.
1560    The 'adp' parameter is optional and allows other audit
1561    data to be passed (e.g. the dentry). */
1562 static int inode_has_perm(const struct cred *cred,
1563                           struct inode *inode,
1564                           u32 perms,
1565                           struct common_audit_data *adp)
1566 {
1567         struct inode_security_struct *isec;
1568         u32 sid;
1569
1570         validate_creds(cred);
1571
1572         if (unlikely(IS_PRIVATE(inode)))
1573                 return 0;
1574
1575         sid = cred_sid(cred);
1576         isec = inode->i_security;
1577
1578         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1579 }
1580
1581 /* Same as inode_has_perm, but pass explicit audit data containing
1582    the dentry to help the auditing code to more easily generate the
1583    pathname if needed. */
1584 static inline int dentry_has_perm(const struct cred *cred,
1585                                   struct dentry *dentry,
1586                                   u32 av)
1587 {
1588         struct inode *inode = dentry->d_inode;
1589         struct common_audit_data ad;
1590
1591         ad.type = LSM_AUDIT_DATA_DENTRY;
1592         ad.u.dentry = dentry;
1593         return inode_has_perm(cred, inode, av, &ad);
1594 }
1595
1596 /* Same as inode_has_perm, but pass explicit audit data containing
1597    the path to help the auditing code to more easily generate the
1598    pathname if needed. */
1599 static inline int path_has_perm(const struct cred *cred,
1600                                 struct path *path,
1601                                 u32 av)
1602 {
1603         struct inode *inode = path->dentry->d_inode;
1604         struct common_audit_data ad;
1605
1606         ad.type = LSM_AUDIT_DATA_PATH;
1607         ad.u.path = *path;
1608         return inode_has_perm(cred, inode, av, &ad);
1609 }
1610
1611 /* Same as path_has_perm, but uses the inode from the file struct. */
1612 static inline int file_path_has_perm(const struct cred *cred,
1613                                      struct file *file,
1614                                      u32 av)
1615 {
1616         struct common_audit_data ad;
1617
1618         ad.type = LSM_AUDIT_DATA_PATH;
1619         ad.u.path = file->f_path;
1620         return inode_has_perm(cred, file_inode(file), av, &ad);
1621 }
1622
1623 /* Check whether a task can use an open file descriptor to
1624    access an inode in a given way.  Check access to the
1625    descriptor itself, and then use dentry_has_perm to
1626    check a particular permission to the file.
1627    Access to the descriptor is implicitly granted if it
1628    has the same SID as the process.  If av is zero, then
1629    access to the file is not checked, e.g. for cases
1630    where only the descriptor is affected like seek. */
1631 static int file_has_perm(const struct cred *cred,
1632                          struct file *file,
1633                          u32 av)
1634 {
1635         struct file_security_struct *fsec = file->f_security;
1636         struct inode *inode = file_inode(file);
1637         struct common_audit_data ad;
1638         u32 sid = cred_sid(cred);
1639         int rc;
1640
1641         ad.type = LSM_AUDIT_DATA_PATH;
1642         ad.u.path = file->f_path;
1643
1644         if (sid != fsec->sid) {
1645                 rc = avc_has_perm(sid, fsec->sid,
1646                                   SECCLASS_FD,
1647                                   FD__USE,
1648                                   &ad);
1649                 if (rc)
1650                         goto out;
1651         }
1652
1653         /* av is zero if only checking access to the descriptor. */
1654         rc = 0;
1655         if (av)
1656                 rc = inode_has_perm(cred, inode, av, &ad);
1657
1658 out:
1659         return rc;
1660 }
1661
1662 /* Check whether a task can create a file. */
1663 static int may_create(struct inode *dir,
1664                       struct dentry *dentry,
1665                       u16 tclass)
1666 {
1667         const struct task_security_struct *tsec = current_security();
1668         struct inode_security_struct *dsec;
1669         struct superblock_security_struct *sbsec;
1670         u32 sid, newsid;
1671         struct common_audit_data ad;
1672         int rc;
1673
1674         dsec = dir->i_security;
1675         sbsec = dir->i_sb->s_security;
1676
1677         sid = tsec->sid;
1678         newsid = tsec->create_sid;
1679
1680         ad.type = LSM_AUDIT_DATA_DENTRY;
1681         ad.u.dentry = dentry;
1682
1683         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1684                           DIR__ADD_NAME | DIR__SEARCH,
1685                           &ad);
1686         if (rc)
1687                 return rc;
1688
1689         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1690                 rc = security_transition_sid(sid, dsec->sid, tclass,
1691                                              &dentry->d_name, &newsid);
1692                 if (rc)
1693                         return rc;
1694         }
1695
1696         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1697         if (rc)
1698                 return rc;
1699
1700         return avc_has_perm(newsid, sbsec->sid,
1701                             SECCLASS_FILESYSTEM,
1702                             FILESYSTEM__ASSOCIATE, &ad);
1703 }
1704
1705 /* Check whether a task can create a key. */
1706 static int may_create_key(u32 ksid,
1707                           struct task_struct *ctx)
1708 {
1709         u32 sid = task_sid(ctx);
1710
1711         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1712 }
1713
1714 #define MAY_LINK        0
1715 #define MAY_UNLINK      1
1716 #define MAY_RMDIR       2
1717
1718 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1719 static int may_link(struct inode *dir,
1720                     struct dentry *dentry,
1721                     int kind)
1722
1723 {
1724         struct inode_security_struct *dsec, *isec;
1725         struct common_audit_data ad;
1726         u32 sid = current_sid();
1727         u32 av;
1728         int rc;
1729
1730         dsec = dir->i_security;
1731         isec = dentry->d_inode->i_security;
1732
1733         ad.type = LSM_AUDIT_DATA_DENTRY;
1734         ad.u.dentry = dentry;
1735
1736         av = DIR__SEARCH;
1737         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1738         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1739         if (rc)
1740                 return rc;
1741
1742         switch (kind) {
1743         case MAY_LINK:
1744                 av = FILE__LINK;
1745                 break;
1746         case MAY_UNLINK:
1747                 av = FILE__UNLINK;
1748                 break;
1749         case MAY_RMDIR:
1750                 av = DIR__RMDIR;
1751                 break;
1752         default:
1753                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1754                         __func__, kind);
1755                 return 0;
1756         }
1757
1758         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1759         return rc;
1760 }
1761
1762 static inline int may_rename(struct inode *old_dir,
1763                              struct dentry *old_dentry,
1764                              struct inode *new_dir,
1765                              struct dentry *new_dentry)
1766 {
1767         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1768         struct common_audit_data ad;
1769         u32 sid = current_sid();
1770         u32 av;
1771         int old_is_dir, new_is_dir;
1772         int rc;
1773
1774         old_dsec = old_dir->i_security;
1775         old_isec = old_dentry->d_inode->i_security;
1776         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1777         new_dsec = new_dir->i_security;
1778
1779         ad.type = LSM_AUDIT_DATA_DENTRY;
1780
1781         ad.u.dentry = old_dentry;
1782         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1783                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1784         if (rc)
1785                 return rc;
1786         rc = avc_has_perm(sid, old_isec->sid,
1787                           old_isec->sclass, FILE__RENAME, &ad);
1788         if (rc)
1789                 return rc;
1790         if (old_is_dir && new_dir != old_dir) {
1791                 rc = avc_has_perm(sid, old_isec->sid,
1792                                   old_isec->sclass, DIR__REPARENT, &ad);
1793                 if (rc)
1794                         return rc;
1795         }
1796
1797         ad.u.dentry = new_dentry;
1798         av = DIR__ADD_NAME | DIR__SEARCH;
1799         if (new_dentry->d_inode)
1800                 av |= DIR__REMOVE_NAME;
1801         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1802         if (rc)
1803                 return rc;
1804         if (new_dentry->d_inode) {
1805                 new_isec = new_dentry->d_inode->i_security;
1806                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1807                 rc = avc_has_perm(sid, new_isec->sid,
1808                                   new_isec->sclass,
1809                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1810                 if (rc)
1811                         return rc;
1812         }
1813
1814         return 0;
1815 }
1816
1817 /* Check whether a task can perform a filesystem operation. */
1818 static int superblock_has_perm(const struct cred *cred,
1819                                struct super_block *sb,
1820                                u32 perms,
1821                                struct common_audit_data *ad)
1822 {
1823         struct superblock_security_struct *sbsec;
1824         u32 sid = cred_sid(cred);
1825
1826         sbsec = sb->s_security;
1827         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1828 }
1829
1830 /* Convert a Linux mode and permission mask to an access vector. */
1831 static inline u32 file_mask_to_av(int mode, int mask)
1832 {
1833         u32 av = 0;
1834
1835         if (!S_ISDIR(mode)) {
1836                 if (mask & MAY_EXEC)
1837                         av |= FILE__EXECUTE;
1838                 if (mask & MAY_READ)
1839                         av |= FILE__READ;
1840
1841                 if (mask & MAY_APPEND)
1842                         av |= FILE__APPEND;
1843                 else if (mask & MAY_WRITE)
1844                         av |= FILE__WRITE;
1845
1846         } else {
1847                 if (mask & MAY_EXEC)
1848                         av |= DIR__SEARCH;
1849                 if (mask & MAY_WRITE)
1850                         av |= DIR__WRITE;
1851                 if (mask & MAY_READ)
1852                         av |= DIR__READ;
1853         }
1854
1855         return av;
1856 }
1857
1858 /* Convert a Linux file to an access vector. */
1859 static inline u32 file_to_av(struct file *file)
1860 {
1861         u32 av = 0;
1862
1863         if (file->f_mode & FMODE_READ)
1864                 av |= FILE__READ;
1865         if (file->f_mode & FMODE_WRITE) {
1866                 if (file->f_flags & O_APPEND)
1867                         av |= FILE__APPEND;
1868                 else
1869                         av |= FILE__WRITE;
1870         }
1871         if (!av) {
1872                 /*
1873                  * Special file opened with flags 3 for ioctl-only use.
1874                  */
1875                 av = FILE__IOCTL;
1876         }
1877
1878         return av;
1879 }
1880
1881 /*
1882  * Convert a file to an access vector and include the correct open
1883  * open permission.
1884  */
1885 static inline u32 open_file_to_av(struct file *file)
1886 {
1887         u32 av = file_to_av(file);
1888
1889         if (selinux_policycap_openperm)
1890                 av |= FILE__OPEN;
1891
1892         return av;
1893 }
1894
1895 /* Hook functions begin here. */
1896
1897 static int selinux_ptrace_access_check(struct task_struct *child,
1898                                      unsigned int mode)
1899 {
1900         int rc;
1901
1902         rc = cap_ptrace_access_check(child, mode);
1903         if (rc)
1904                 return rc;
1905
1906         if (mode & PTRACE_MODE_READ) {
1907                 u32 sid = current_sid();
1908                 u32 csid = task_sid(child);
1909                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1910         }
1911
1912         return current_has_perm(child, PROCESS__PTRACE);
1913 }
1914
1915 static int selinux_ptrace_traceme(struct task_struct *parent)
1916 {
1917         int rc;
1918
1919         rc = cap_ptrace_traceme(parent);
1920         if (rc)
1921                 return rc;
1922
1923         return task_has_perm(parent, current, PROCESS__PTRACE);
1924 }
1925
1926 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1927                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1928 {
1929         int error;
1930
1931         error = current_has_perm(target, PROCESS__GETCAP);
1932         if (error)
1933                 return error;
1934
1935         return cap_capget(target, effective, inheritable, permitted);
1936 }
1937
1938 static int selinux_capset(struct cred *new, const struct cred *old,
1939                           const kernel_cap_t *effective,
1940                           const kernel_cap_t *inheritable,
1941                           const kernel_cap_t *permitted)
1942 {
1943         int error;
1944
1945         error = cap_capset(new, old,
1946                                       effective, inheritable, permitted);
1947         if (error)
1948                 return error;
1949
1950         return cred_has_perm(old, new, PROCESS__SETCAP);
1951 }
1952
1953 /*
1954  * (This comment used to live with the selinux_task_setuid hook,
1955  * which was removed).
1956  *
1957  * Since setuid only affects the current process, and since the SELinux
1958  * controls are not based on the Linux identity attributes, SELinux does not
1959  * need to control this operation.  However, SELinux does control the use of
1960  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1961  */
1962
1963 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1964                            int cap, int audit)
1965 {
1966         int rc;
1967
1968         rc = cap_capable(cred, ns, cap, audit);
1969         if (rc)
1970                 return rc;
1971
1972         return cred_has_capability(cred, cap, audit);
1973 }
1974
1975 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1976 {
1977         const struct cred *cred = current_cred();
1978         int rc = 0;
1979
1980         if (!sb)
1981                 return 0;
1982
1983         switch (cmds) {
1984         case Q_SYNC:
1985         case Q_QUOTAON:
1986         case Q_QUOTAOFF:
1987         case Q_SETINFO:
1988         case Q_SETQUOTA:
1989                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1990                 break;
1991         case Q_GETFMT:
1992         case Q_GETINFO:
1993         case Q_GETQUOTA:
1994                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1995                 break;
1996         default:
1997                 rc = 0;  /* let the kernel handle invalid cmds */
1998                 break;
1999         }
2000         return rc;
2001 }
2002
2003 static int selinux_quota_on(struct dentry *dentry)
2004 {
2005         const struct cred *cred = current_cred();
2006
2007         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2008 }
2009
2010 static int selinux_syslog(int type)
2011 {
2012         int rc;
2013
2014         switch (type) {
2015         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2016         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2017                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2018                 break;
2019         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2020         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2021         /* Set level of messages printed to console */
2022         case SYSLOG_ACTION_CONSOLE_LEVEL:
2023                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2024                 break;
2025         case SYSLOG_ACTION_CLOSE:       /* Close log */
2026         case SYSLOG_ACTION_OPEN:        /* Open log */
2027         case SYSLOG_ACTION_READ:        /* Read from log */
2028         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2029         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2030         default:
2031                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2032                 break;
2033         }
2034         return rc;
2035 }
2036
2037 /*
2038  * Check that a process has enough memory to allocate a new virtual
2039  * mapping. 0 means there is enough memory for the allocation to
2040  * succeed and -ENOMEM implies there is not.
2041  *
2042  * Do not audit the selinux permission check, as this is applied to all
2043  * processes that allocate mappings.
2044  */
2045 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2046 {
2047         int rc, cap_sys_admin = 0;
2048
2049         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2050                              SECURITY_CAP_NOAUDIT);
2051         if (rc == 0)
2052                 cap_sys_admin = 1;
2053
2054         return __vm_enough_memory(mm, pages, cap_sys_admin);
2055 }
2056
2057 /* binprm security operations */
2058
2059 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2060 {
2061         const struct task_security_struct *old_tsec;
2062         struct task_security_struct *new_tsec;
2063         struct inode_security_struct *isec;
2064         struct common_audit_data ad;
2065         struct inode *inode = file_inode(bprm->file);
2066         int rc;
2067
2068         rc = cap_bprm_set_creds(bprm);
2069         if (rc)
2070                 return rc;
2071
2072         /* SELinux context only depends on initial program or script and not
2073          * the script interpreter */
2074         if (bprm->cred_prepared)
2075                 return 0;
2076
2077         old_tsec = current_security();
2078         new_tsec = bprm->cred->security;
2079         isec = inode->i_security;
2080
2081         /* Default to the current task SID. */
2082         new_tsec->sid = old_tsec->sid;
2083         new_tsec->osid = old_tsec->sid;
2084
2085         /* Reset fs, key, and sock SIDs on execve. */
2086         new_tsec->create_sid = 0;
2087         new_tsec->keycreate_sid = 0;
2088         new_tsec->sockcreate_sid = 0;
2089
2090         if (old_tsec->exec_sid) {
2091                 new_tsec->sid = old_tsec->exec_sid;
2092                 /* Reset exec SID on execve. */
2093                 new_tsec->exec_sid = 0;
2094
2095                 /*
2096                  * Minimize confusion: if no_new_privs and a transition is
2097                  * explicitly requested, then fail the exec.
2098                  */
2099                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
2100                         return -EPERM;
2101         } else {
2102                 /* Check for a default transition on this program. */
2103                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2104                                              SECCLASS_PROCESS, NULL,
2105                                              &new_tsec->sid);
2106                 if (rc)
2107                         return rc;
2108         }
2109
2110         ad.type = LSM_AUDIT_DATA_PATH;
2111         ad.u.path = bprm->file->f_path;
2112
2113         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2114             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2115                 new_tsec->sid = old_tsec->sid;
2116
2117         if (new_tsec->sid == old_tsec->sid) {
2118                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2119                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2120                 if (rc)
2121                         return rc;
2122         } else {
2123                 /* Check permissions for the transition. */
2124                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2125                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2126                 if (rc)
2127                         return rc;
2128
2129                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2130                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2131                 if (rc)
2132                         return rc;
2133
2134                 /* Check for shared state */
2135                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2136                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2137                                           SECCLASS_PROCESS, PROCESS__SHARE,
2138                                           NULL);
2139                         if (rc)
2140                                 return -EPERM;
2141                 }
2142
2143                 /* Make sure that anyone attempting to ptrace over a task that
2144                  * changes its SID has the appropriate permit */
2145                 if (bprm->unsafe &
2146                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2147                         struct task_struct *tracer;
2148                         struct task_security_struct *sec;
2149                         u32 ptsid = 0;
2150
2151                         rcu_read_lock();
2152                         tracer = ptrace_parent(current);
2153                         if (likely(tracer != NULL)) {
2154                                 sec = __task_cred(tracer)->security;
2155                                 ptsid = sec->sid;
2156                         }
2157                         rcu_read_unlock();
2158
2159                         if (ptsid != 0) {
2160                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2161                                                   SECCLASS_PROCESS,
2162                                                   PROCESS__PTRACE, NULL);
2163                                 if (rc)
2164                                         return -EPERM;
2165                         }
2166                 }
2167
2168                 /* Clear any possibly unsafe personality bits on exec: */
2169                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2170         }
2171
2172         return 0;
2173 }
2174
2175 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2176 {
2177         const struct task_security_struct *tsec = current_security();
2178         u32 sid, osid;
2179         int atsecure = 0;
2180
2181         sid = tsec->sid;
2182         osid = tsec->osid;
2183
2184         if (osid != sid) {
2185                 /* Enable secure mode for SIDs transitions unless
2186                    the noatsecure permission is granted between
2187                    the two SIDs, i.e. ahp returns 0. */
2188                 atsecure = avc_has_perm(osid, sid,
2189                                         SECCLASS_PROCESS,
2190                                         PROCESS__NOATSECURE, NULL);
2191         }
2192
2193         return (atsecure || cap_bprm_secureexec(bprm));
2194 }
2195
2196 static int match_file(const void *p, struct file *file, unsigned fd)
2197 {
2198         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2199 }
2200
2201 /* Derived from fs/exec.c:flush_old_files. */
2202 static inline void flush_unauthorized_files(const struct cred *cred,
2203                                             struct files_struct *files)
2204 {
2205         struct file *file, *devnull = NULL;
2206         struct tty_struct *tty;
2207         int drop_tty = 0;
2208         unsigned n;
2209
2210         tty = get_current_tty();
2211         if (tty) {
2212                 spin_lock(&tty_files_lock);
2213                 if (!list_empty(&tty->tty_files)) {
2214                         struct tty_file_private *file_priv;
2215
2216                         /* Revalidate access to controlling tty.
2217                            Use file_path_has_perm on the tty path directly
2218                            rather than using file_has_perm, as this particular
2219                            open file may belong to another process and we are
2220                            only interested in the inode-based check here. */
2221                         file_priv = list_first_entry(&tty->tty_files,
2222                                                 struct tty_file_private, list);
2223                         file = file_priv->file;
2224                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2225                                 drop_tty = 1;
2226                 }
2227                 spin_unlock(&tty_files_lock);
2228                 tty_kref_put(tty);
2229         }
2230         /* Reset controlling tty. */
2231         if (drop_tty)
2232                 no_tty();
2233
2234         /* Revalidate access to inherited open files. */
2235         n = iterate_fd(files, 0, match_file, cred);
2236         if (!n) /* none found? */
2237                 return;
2238
2239         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2240         if (IS_ERR(devnull))
2241                 devnull = NULL;
2242         /* replace all the matching ones with this */
2243         do {
2244                 replace_fd(n - 1, devnull, 0);
2245         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2246         if (devnull)
2247                 fput(devnull);
2248 }
2249
2250 /*
2251  * Prepare a process for imminent new credential changes due to exec
2252  */
2253 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2254 {
2255         struct task_security_struct *new_tsec;
2256         struct rlimit *rlim, *initrlim;
2257         int rc, i;
2258
2259         new_tsec = bprm->cred->security;
2260         if (new_tsec->sid == new_tsec->osid)
2261                 return;
2262
2263         /* Close files for which the new task SID is not authorized. */
2264         flush_unauthorized_files(bprm->cred, current->files);
2265
2266         /* Always clear parent death signal on SID transitions. */
2267         current->pdeath_signal = 0;
2268
2269         /* Check whether the new SID can inherit resource limits from the old
2270          * SID.  If not, reset all soft limits to the lower of the current
2271          * task's hard limit and the init task's soft limit.
2272          *
2273          * Note that the setting of hard limits (even to lower them) can be
2274          * controlled by the setrlimit check.  The inclusion of the init task's
2275          * soft limit into the computation is to avoid resetting soft limits
2276          * higher than the default soft limit for cases where the default is
2277          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2278          */
2279         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2280                           PROCESS__RLIMITINH, NULL);
2281         if (rc) {
2282                 /* protect against do_prlimit() */
2283                 task_lock(current);
2284                 for (i = 0; i < RLIM_NLIMITS; i++) {
2285                         rlim = current->signal->rlim + i;
2286                         initrlim = init_task.signal->rlim + i;
2287                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2288                 }
2289                 task_unlock(current);
2290                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2291         }
2292 }
2293
2294 /*
2295  * Clean up the process immediately after the installation of new credentials
2296  * due to exec
2297  */
2298 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2299 {
2300         const struct task_security_struct *tsec = current_security();
2301         struct itimerval itimer;
2302         u32 osid, sid;
2303         int rc, i;
2304
2305         osid = tsec->osid;
2306         sid = tsec->sid;
2307
2308         if (sid == osid)
2309                 return;
2310
2311         /* Check whether the new SID can inherit signal state from the old SID.
2312          * If not, clear itimers to avoid subsequent signal generation and
2313          * flush and unblock signals.
2314          *
2315          * This must occur _after_ the task SID has been updated so that any
2316          * kill done after the flush will be checked against the new SID.
2317          */
2318         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2319         if (rc) {
2320                 memset(&itimer, 0, sizeof itimer);
2321                 for (i = 0; i < 3; i++)
2322                         do_setitimer(i, &itimer, NULL);
2323                 spin_lock_irq(&current->sighand->siglock);
2324                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2325                         __flush_signals(current);
2326                         flush_signal_handlers(current, 1);
2327                         sigemptyset(&current->blocked);
2328                 }
2329                 spin_unlock_irq(&current->sighand->siglock);
2330         }
2331
2332         /* Wake up the parent if it is waiting so that it can recheck
2333          * wait permission to the new task SID. */
2334         read_lock(&tasklist_lock);
2335         __wake_up_parent(current, current->real_parent);
2336         read_unlock(&tasklist_lock);
2337 }
2338
2339 /* superblock security operations */
2340
2341 static int selinux_sb_alloc_security(struct super_block *sb)
2342 {
2343         return superblock_alloc_security(sb);
2344 }
2345
2346 static void selinux_sb_free_security(struct super_block *sb)
2347 {
2348         superblock_free_security(sb);
2349 }
2350
2351 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2352 {
2353         if (plen > olen)
2354                 return 0;
2355
2356         return !memcmp(prefix, option, plen);
2357 }
2358
2359 static inline int selinux_option(char *option, int len)
2360 {
2361         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2362                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2363                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2364                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2365                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2366 }
2367
2368 static inline void take_option(char **to, char *from, int *first, int len)
2369 {
2370         if (!*first) {
2371                 **to = ',';
2372                 *to += 1;
2373         } else
2374                 *first = 0;
2375         memcpy(*to, from, len);
2376         *to += len;
2377 }
2378
2379 static inline void take_selinux_option(char **to, char *from, int *first,
2380                                        int len)
2381 {
2382         int current_size = 0;
2383
2384         if (!*first) {
2385                 **to = '|';
2386                 *to += 1;
2387         } else
2388                 *first = 0;
2389
2390         while (current_size < len) {
2391                 if (*from != '"') {
2392                         **to = *from;
2393                         *to += 1;
2394                 }
2395                 from += 1;
2396                 current_size += 1;
2397         }
2398 }
2399
2400 static int selinux_sb_copy_data(char *orig, char *copy)
2401 {
2402         int fnosec, fsec, rc = 0;
2403         char *in_save, *in_curr, *in_end;
2404         char *sec_curr, *nosec_save, *nosec;
2405         int open_quote = 0;
2406
2407         in_curr = orig;
2408         sec_curr = copy;
2409
2410         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2411         if (!nosec) {
2412                 rc = -ENOMEM;
2413                 goto out;
2414         }
2415
2416         nosec_save = nosec;
2417         fnosec = fsec = 1;
2418         in_save = in_end = orig;
2419
2420         do {
2421                 if (*in_end == '"')
2422                         open_quote = !open_quote;
2423                 if ((*in_end == ',' && open_quote == 0) ||
2424                                 *in_end == '\0') {
2425                         int len = in_end - in_curr;
2426
2427                         if (selinux_option(in_curr, len))
2428                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2429                         else
2430                                 take_option(&nosec, in_curr, &fnosec, len);
2431
2432                         in_curr = in_end + 1;
2433                 }
2434         } while (*in_end++);
2435
2436         strcpy(in_save, nosec_save);
2437         free_page((unsigned long)nosec_save);
2438 out:
2439         return rc;
2440 }
2441
2442 static int selinux_sb_remount(struct super_block *sb, void *data)
2443 {
2444         int rc, i, *flags;
2445         struct security_mnt_opts opts;
2446         char *secdata, **mount_options;
2447         struct superblock_security_struct *sbsec = sb->s_security;
2448
2449         if (!(sbsec->flags & SE_SBINITIALIZED))
2450                 return 0;
2451
2452         if (!data)
2453                 return 0;
2454
2455         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2456                 return 0;
2457
2458         security_init_mnt_opts(&opts);
2459         secdata = alloc_secdata();
2460         if (!secdata)
2461                 return -ENOMEM;
2462         rc = selinux_sb_copy_data(data, secdata);
2463         if (rc)
2464                 goto out_free_secdata;
2465
2466         rc = selinux_parse_opts_str(secdata, &opts);
2467         if (rc)
2468                 goto out_free_secdata;
2469
2470         mount_options = opts.mnt_opts;
2471         flags = opts.mnt_opts_flags;
2472
2473         for (i = 0; i < opts.num_mnt_opts; i++) {
2474                 u32 sid;
2475                 size_t len;
2476
2477                 if (flags[i] == SBLABEL_MNT)
2478                         continue;
2479                 len = strlen(mount_options[i]);
2480                 rc = security_context_to_sid(mount_options[i], len, &sid);
2481                 if (rc) {
2482                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2483                                "(%s) failed for (dev %s, type "SB_TYPE_FMT") errno=%d\n",
2484                                mount_options[i], sb->s_id, SB_TYPE_ARGS(sb), rc);
2485                         goto out_free_opts;
2486                 }
2487                 rc = -EINVAL;
2488                 switch (flags[i]) {
2489                 case FSCONTEXT_MNT:
2490                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2491                                 goto out_bad_option;
2492                         break;
2493                 case CONTEXT_MNT:
2494                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2495                                 goto out_bad_option;
2496                         break;
2497                 case ROOTCONTEXT_MNT: {
2498                         struct inode_security_struct *root_isec;
2499                         root_isec = sb->s_root->d_inode->i_security;
2500
2501                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2502                                 goto out_bad_option;
2503                         break;
2504                 }
2505                 case DEFCONTEXT_MNT:
2506                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2507                                 goto out_bad_option;
2508                         break;
2509                 default:
2510                         goto out_free_opts;
2511                 }
2512         }
2513
2514         rc = 0;
2515 out_free_opts:
2516         security_free_mnt_opts(&opts);
2517 out_free_secdata:
2518         free_secdata(secdata);
2519         return rc;
2520 out_bad_option:
2521         printk(KERN_WARNING "SELinux: unable to change security options "
2522                "during remount (dev %s, type "SB_TYPE_FMT")\n", sb->s_id,
2523                SB_TYPE_ARGS(sb));
2524         goto out_free_opts;
2525 }
2526
2527 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2528 {
2529         const struct cred *cred = current_cred();
2530         struct common_audit_data ad;
2531         int rc;
2532
2533         rc = superblock_doinit(sb, data);
2534         if (rc)
2535                 return rc;
2536
2537         /* Allow all mounts performed by the kernel */
2538         if (flags & MS_KERNMOUNT)
2539                 return 0;
2540
2541         ad.type = LSM_AUDIT_DATA_DENTRY;
2542         ad.u.dentry = sb->s_root;
2543         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2544 }
2545
2546 static int selinux_sb_statfs(struct dentry *dentry)
2547 {
2548         const struct cred *cred = current_cred();
2549         struct common_audit_data ad;
2550
2551         ad.type = LSM_AUDIT_DATA_DENTRY;
2552         ad.u.dentry = dentry->d_sb->s_root;
2553         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2554 }
2555
2556 static int selinux_mount(const char *dev_name,
2557                          struct path *path,
2558                          const char *type,
2559                          unsigned long flags,
2560                          void *data)
2561 {
2562         const struct cred *cred = current_cred();
2563
2564         if (flags & MS_REMOUNT)
2565                 return superblock_has_perm(cred, path->dentry->d_sb,
2566                                            FILESYSTEM__REMOUNT, NULL);
2567         else
2568                 return path_has_perm(cred, path, FILE__MOUNTON);
2569 }
2570
2571 static int selinux_umount(struct vfsmount *mnt, int flags)
2572 {
2573         const struct cred *cred = current_cred();
2574
2575         return superblock_has_perm(cred, mnt->mnt_sb,
2576                                    FILESYSTEM__UNMOUNT, NULL);
2577 }
2578
2579 /* inode security operations */
2580
2581 static int selinux_inode_alloc_security(struct inode *inode)
2582 {
2583         return inode_alloc_security(inode);
2584 }
2585
2586 static void selinux_inode_free_security(struct inode *inode)
2587 {
2588         inode_free_security(inode);
2589 }
2590
2591 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2592                                         struct qstr *name, void **ctx,
2593                                         u32 *ctxlen)
2594 {
2595         const struct cred *cred = current_cred();
2596         struct task_security_struct *tsec;
2597         struct inode_security_struct *dsec;
2598         struct superblock_security_struct *sbsec;
2599         struct inode *dir = dentry->d_parent->d_inode;
2600         u32 newsid;
2601         int rc;
2602
2603         tsec = cred->security;
2604         dsec = dir->i_security;
2605         sbsec = dir->i_sb->s_security;
2606
2607         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2608                 newsid = tsec->create_sid;
2609         } else {
2610                 rc = security_transition_sid(tsec->sid, dsec->sid,
2611                                              inode_mode_to_security_class(mode),
2612                                              name,
2613                                              &newsid);
2614                 if (rc) {
2615                         printk(KERN_WARNING
2616                                 "%s: security_transition_sid failed, rc=%d\n",
2617                                __func__, -rc);
2618                         return rc;
2619                 }
2620         }
2621
2622         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2623 }
2624
2625 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2626                                        const struct qstr *qstr,
2627                                        const char **name,
2628                                        void **value, size_t *len)
2629 {
2630         const struct task_security_struct *tsec = current_security();
2631         struct inode_security_struct *dsec;
2632         struct superblock_security_struct *sbsec;
2633         u32 sid, newsid, clen;
2634         int rc;
2635         char *context;
2636
2637         dsec = dir->i_security;
2638         sbsec = dir->i_sb->s_security;
2639
2640         sid = tsec->sid;
2641         newsid = tsec->create_sid;
2642
2643         if ((sbsec->flags & SE_SBINITIALIZED) &&
2644             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2645                 newsid = sbsec->mntpoint_sid;
2646         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2647                 rc = security_transition_sid(sid, dsec->sid,
2648                                              inode_mode_to_security_class(inode->i_mode),
2649                                              qstr, &newsid);
2650                 if (rc) {
2651                         printk(KERN_WARNING "%s:  "
2652                                "security_transition_sid failed, rc=%d (dev=%s "
2653                                "ino=%ld)\n",
2654                                __func__,
2655                                -rc, inode->i_sb->s_id, inode->i_ino);
2656                         return rc;
2657                 }
2658         }
2659
2660         /* Possibly defer initialization to selinux_complete_init. */
2661         if (sbsec->flags & SE_SBINITIALIZED) {
2662                 struct inode_security_struct *isec = inode->i_security;
2663                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2664                 isec->sid = newsid;
2665                 isec->initialized = 1;
2666         }
2667
2668         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2669                 return -EOPNOTSUPP;
2670
2671         if (name)
2672                 *name = XATTR_SELINUX_SUFFIX;
2673
2674         if (value && len) {
2675                 rc = security_sid_to_context_force(newsid, &context, &clen);
2676                 if (rc)
2677                         return rc;
2678                 *value = context;
2679                 *len = clen;
2680         }
2681
2682         return 0;
2683 }
2684
2685 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2686 {
2687         return may_create(dir, dentry, SECCLASS_FILE);
2688 }
2689
2690 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2691 {
2692         return may_link(dir, old_dentry, MAY_LINK);
2693 }
2694
2695 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2696 {
2697         return may_link(dir, dentry, MAY_UNLINK);
2698 }
2699
2700 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2701 {
2702         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2703 }
2704
2705 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2706 {
2707         return may_create(dir, dentry, SECCLASS_DIR);
2708 }
2709
2710 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2711 {
2712         return may_link(dir, dentry, MAY_RMDIR);
2713 }
2714
2715 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2716 {
2717         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2718 }
2719
2720 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2721                                 struct inode *new_inode, struct dentry *new_dentry)
2722 {
2723         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2724 }
2725
2726 static int selinux_inode_readlink(struct dentry *dentry)
2727 {
2728         const struct cred *cred = current_cred();
2729
2730         return dentry_has_perm(cred, dentry, FILE__READ);
2731 }
2732
2733 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2734 {
2735         const struct cred *cred = current_cred();
2736
2737         return dentry_has_perm(cred, dentry, FILE__READ);
2738 }
2739
2740 static noinline int audit_inode_permission(struct inode *inode,
2741                                            u32 perms, u32 audited, u32 denied,
2742                                            unsigned flags)
2743 {
2744         struct common_audit_data ad;
2745         struct inode_security_struct *isec = inode->i_security;
2746         int rc;
2747
2748         ad.type = LSM_AUDIT_DATA_INODE;
2749         ad.u.inode = inode;
2750
2751         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2752                             audited, denied, &ad, flags);
2753         if (rc)
2754                 return rc;
2755         return 0;
2756 }
2757
2758 static int selinux_inode_permission(struct inode *inode, int mask)
2759 {
2760         const struct cred *cred = current_cred();
2761         u32 perms;
2762         bool from_access;
2763         unsigned flags = mask & MAY_NOT_BLOCK;
2764         struct inode_security_struct *isec;
2765         u32 sid;
2766         struct av_decision avd;
2767         int rc, rc2;
2768         u32 audited, denied;
2769
2770         from_access = mask & MAY_ACCESS;
2771         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2772
2773         /* No permission to check.  Existence test. */
2774         if (!mask)
2775                 return 0;
2776
2777         validate_creds(cred);
2778
2779         if (unlikely(IS_PRIVATE(inode)))
2780                 return 0;
2781
2782         perms = file_mask_to_av(inode->i_mode, mask);
2783
2784         sid = cred_sid(cred);
2785         isec = inode->i_security;
2786
2787         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2788         audited = avc_audit_required(perms, &avd, rc,
2789                                      from_access ? FILE__AUDIT_ACCESS : 0,
2790                                      &denied);
2791         if (likely(!audited))
2792                 return rc;
2793
2794         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2795         if (rc2)
2796                 return rc2;
2797         return rc;
2798 }
2799
2800 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2801 {
2802         const struct cred *cred = current_cred();
2803         unsigned int ia_valid = iattr->ia_valid;
2804         __u32 av = FILE__WRITE;
2805
2806         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2807         if (ia_valid & ATTR_FORCE) {
2808                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2809                               ATTR_FORCE);
2810                 if (!ia_valid)
2811                         return 0;
2812         }
2813
2814         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2815                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2816                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2817
2818         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2819                 av |= FILE__OPEN;
2820
2821         return dentry_has_perm(cred, dentry, av);
2822 }
2823
2824 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2825 {
2826         const struct cred *cred = current_cred();
2827         struct path path;
2828
2829         path.dentry = dentry;
2830         path.mnt = mnt;
2831
2832         return path_has_perm(cred, &path, FILE__GETATTR);
2833 }
2834
2835 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2836 {
2837         const struct cred *cred = current_cred();
2838
2839         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2840                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2841                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2842                         if (!capable(CAP_SETFCAP))
2843                                 return -EPERM;
2844                 } else if (!capable(CAP_SYS_ADMIN)) {
2845                         /* A different attribute in the security namespace.
2846                            Restrict to administrator. */
2847                         return -EPERM;
2848                 }
2849         }
2850
2851         /* Not an attribute we recognize, so just check the
2852            ordinary setattr permission. */
2853         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2854 }
2855
2856 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2857                                   const void *value, size_t size, int flags)
2858 {
2859         struct inode *inode = dentry->d_inode;
2860         struct inode_security_struct *isec = inode->i_security;
2861         struct superblock_security_struct *sbsec;
2862         struct common_audit_data ad;
2863         u32 newsid, sid = current_sid();
2864         int rc = 0;
2865
2866         if (strcmp(name, XATTR_NAME_SELINUX))
2867                 return selinux_inode_setotherxattr(dentry, name);
2868
2869         sbsec = inode->i_sb->s_security;
2870         if (!(sbsec->flags & SBLABEL_MNT))
2871                 return -EOPNOTSUPP;
2872
2873         if (!inode_owner_or_capable(inode))
2874                 return -EPERM;
2875
2876         ad.type = LSM_AUDIT_DATA_DENTRY;
2877         ad.u.dentry = dentry;
2878
2879         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2880                           FILE__RELABELFROM, &ad);
2881         if (rc)
2882                 return rc;
2883
2884         rc = security_context_to_sid(value, size, &newsid);
2885         if (rc == -EINVAL) {
2886                 if (!capable(CAP_MAC_ADMIN)) {
2887                         struct audit_buffer *ab;
2888                         size_t audit_size;
2889                         const char *str;
2890
2891                         /* We strip a nul only if it is at the end, otherwise the
2892                          * context contains a nul and we should audit that */
2893                         if (value) {
2894                                 str = value;
2895                                 if (str[size - 1] == '\0')
2896                                         audit_size = size - 1;
2897                                 else
2898                                         audit_size = size;
2899                         } else {
2900                                 str = "";
2901                                 audit_size = 0;
2902                         }
2903                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2904                         audit_log_format(ab, "op=setxattr invalid_context=");
2905                         audit_log_n_untrustedstring(ab, value, audit_size);
2906                         audit_log_end(ab);
2907
2908                         return rc;
2909                 }
2910                 rc = security_context_to_sid_force(value, size, &newsid);
2911         }
2912         if (rc)
2913                 return rc;
2914
2915         rc = avc_has_perm(sid, newsid, isec->sclass,
2916                           FILE__RELABELTO, &ad);
2917         if (rc)
2918                 return rc;
2919
2920         rc = security_validate_transition(isec->sid, newsid, sid,
2921                                           isec->sclass);
2922         if (rc)
2923                 return rc;
2924
2925         return avc_has_perm(newsid,
2926                             sbsec->sid,
2927                             SECCLASS_FILESYSTEM,
2928                             FILESYSTEM__ASSOCIATE,
2929                             &ad);
2930 }
2931
2932 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2933                                         const void *value, size_t size,
2934                                         int flags)
2935 {
2936         struct inode *inode = dentry->d_inode;
2937         struct inode_security_struct *isec = inode->i_security;
2938         u32 newsid;
2939         int rc;
2940
2941         if (strcmp(name, XATTR_NAME_SELINUX)) {
2942                 /* Not an attribute we recognize, so nothing to do. */
2943                 return;
2944         }
2945
2946         rc = security_context_to_sid_force(value, size, &newsid);
2947         if (rc) {
2948                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2949                        "for (%s, %lu), rc=%d\n",
2950                        inode->i_sb->s_id, inode->i_ino, -rc);
2951                 return;
2952         }
2953
2954         isec->sclass = inode_mode_to_security_class(inode->i_mode);
2955         isec->sid = newsid;
2956         isec->initialized = 1;
2957
2958         return;
2959 }
2960
2961 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2962 {
2963         const struct cred *cred = current_cred();
2964
2965         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2966 }
2967
2968 static int selinux_inode_listxattr(struct dentry *dentry)
2969 {
2970         const struct cred *cred = current_cred();
2971
2972         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2973 }
2974
2975 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2976 {
2977         if (strcmp(name, XATTR_NAME_SELINUX))
2978                 return selinux_inode_setotherxattr(dentry, name);
2979
2980         /* No one is allowed to remove a SELinux security label.
2981            You can change the label, but all data must be labeled. */
2982         return -EACCES;
2983 }
2984
2985 /*
2986  * Copy the inode security context value to the user.
2987  *
2988  * Permission check is handled by selinux_inode_getxattr hook.
2989  */
2990 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2991 {
2992         u32 size;
2993         int error;
2994         char *context = NULL;
2995         struct inode_security_struct *isec = inode->i_security;
2996
2997         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2998                 return -EOPNOTSUPP;
2999
3000         /*
3001          * If the caller has CAP_MAC_ADMIN, then get the raw context
3002          * value even if it is not defined by current policy; otherwise,
3003          * use the in-core value under current policy.
3004          * Use the non-auditing forms of the permission checks since
3005          * getxattr may be called by unprivileged processes commonly
3006          * and lack of permission just means that we fall back to the
3007          * in-core context value, not a denial.
3008          */
3009         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3010                                 SECURITY_CAP_NOAUDIT);
3011         if (!error)
3012                 error = security_sid_to_context_force(isec->sid, &context,
3013                                                       &size);
3014         else
3015                 error = security_sid_to_context(isec->sid, &context, &size);
3016         if (error)
3017                 return error;
3018         error = size;
3019         if (alloc) {
3020                 *buffer = context;
3021                 goto out_nofree;
3022         }
3023         kfree(context);
3024 out_nofree:
3025         return error;
3026 }
3027
3028 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3029                                      const void *value, size_t size, int flags)
3030 {
3031         struct inode_security_struct *isec = inode->i_security;
3032         u32 newsid;
3033         int rc;
3034
3035         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3036                 return -EOPNOTSUPP;
3037
3038         if (!value || !size)
3039                 return -EACCES;
3040
3041         rc = security_context_to_sid((void *)value, size, &newsid);
3042         if (rc)
3043                 return rc;
3044
3045         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3046         isec->sid = newsid;
3047         isec->initialized = 1;
3048         return 0;
3049 }
3050
3051 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3052 {
3053         const int len = sizeof(XATTR_NAME_SELINUX);
3054         if (buffer && len <= buffer_size)
3055                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3056         return len;
3057 }
3058
3059 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3060 {
3061         struct inode_security_struct *isec = inode->i_security;
3062         *secid = isec->sid;
3063 }
3064
3065 /* file security operations */
3066
3067 static int selinux_revalidate_file_permission(struct file *file, int mask)
3068 {
3069         const struct cred *cred = current_cred();
3070         struct inode *inode = file_inode(file);
3071
3072         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3073         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3074                 mask |= MAY_APPEND;
3075
3076         return file_has_perm(cred, file,
3077                              file_mask_to_av(inode->i_mode, mask));
3078 }
3079
3080 static int selinux_file_permission(struct file *file, int mask)
3081 {
3082         struct inode *inode = file_inode(file);
3083         struct file_security_struct *fsec = file->f_security;
3084         struct inode_security_struct *isec = inode->i_security;
3085         u32 sid = current_sid();
3086
3087         if (!mask)
3088                 /* No permission to check.  Existence test. */
3089                 return 0;
3090
3091         if (sid == fsec->sid && fsec->isid == isec->sid &&
3092             fsec->pseqno == avc_policy_seqno())
3093                 /* No change since file_open check. */
3094                 return 0;
3095
3096         return selinux_revalidate_file_permission(file, mask);
3097 }
3098
3099 static int selinux_file_alloc_security(struct file *file)
3100 {
3101         return file_alloc_security(file);
3102 }
3103
3104 static void selinux_file_free_security(struct file *file)
3105 {
3106         file_free_security(file);
3107 }
3108
3109 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3110                               unsigned long arg)
3111 {
3112         const struct cred *cred = current_cred();
3113         int error = 0;
3114
3115         switch (cmd) {
3116         case FIONREAD:
3117         /* fall through */
3118         case FIBMAP:
3119         /* fall through */
3120         case FIGETBSZ:
3121         /* fall through */
3122         case FS_IOC_GETFLAGS:
3123         /* fall through */
3124         case FS_IOC_GETVERSION:
3125                 error = file_has_perm(cred, file, FILE__GETATTR);
3126                 break;
3127
3128         case FS_IOC_SETFLAGS:
3129         /* fall through */
3130         case FS_IOC_SETVERSION:
3131                 error = file_has_perm(cred, file, FILE__SETATTR);
3132                 break;
3133
3134         /* sys_ioctl() checks */
3135         case FIONBIO:
3136         /* fall through */
3137         case FIOASYNC:
3138                 error = file_has_perm(cred, file, 0);
3139                 break;
3140
3141         case KDSKBENT:
3142         case KDSKBSENT:
3143                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3144                                             SECURITY_CAP_AUDIT);
3145                 break;
3146
3147         /* default case assumes that the command will go
3148          * to the file's ioctl() function.
3149          */
3150         default:
3151                 error = file_has_perm(cred, file, FILE__IOCTL);
3152         }
3153         return error;
3154 }
3155
3156 static int default_noexec;
3157
3158 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3159 {
3160         const struct cred *cred = current_cred();
3161         int rc = 0;
3162
3163         if (default_noexec &&
3164             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3165                 /*
3166                  * We are making executable an anonymous mapping or a
3167                  * private file mapping that will also be writable.
3168                  * This has an additional check.
3169                  */
3170                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3171                 if (rc)
3172                         goto error;
3173         }
3174
3175         if (file) {
3176                 /* read access is always possible with a mapping */
3177                 u32 av = FILE__READ;
3178
3179                 /* write access only matters if the mapping is shared */
3180                 if (shared && (prot & PROT_WRITE))
3181                         av |= FILE__WRITE;
3182
3183                 if (prot & PROT_EXEC)
3184                         av |= FILE__EXECUTE;
3185
3186                 return file_has_perm(cred, file, av);
3187         }
3188
3189 error:
3190         return rc;
3191 }
3192
3193 static int selinux_mmap_addr(unsigned long addr)
3194 {
3195         int rc = 0;
3196         u32 sid = current_sid();
3197
3198         /*
3199          * notice that we are intentionally putting the SELinux check before
3200          * the secondary cap_file_mmap check.  This is such a likely attempt
3201          * at bad behaviour/exploit that we always want to get the AVC, even
3202          * if DAC would have also denied the operation.
3203          */
3204         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3205                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3206                                   MEMPROTECT__MMAP_ZERO, NULL);
3207                 if (rc)
3208                         return rc;
3209         }
3210
3211         /* do DAC check on address space usage */
3212         return cap_mmap_addr(addr);
3213 }
3214
3215 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3216                              unsigned long prot, unsigned long flags)
3217 {
3218         if (selinux_checkreqprot)
3219                 prot = reqprot;
3220
3221         return file_map_prot_check(file, prot,
3222                                    (flags & MAP_TYPE) == MAP_SHARED);
3223 }
3224
3225 static int selinux_file_mprotect(struct vm_area_struct *vma,
3226                                  unsigned long reqprot,
3227                                  unsigned long prot)
3228 {
3229         const struct cred *cred = current_cred();
3230
3231         if (selinux_checkreqprot)
3232                 prot = reqprot;
3233
3234         if (default_noexec &&
3235             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3236                 int rc = 0;
3237                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3238                     vma->vm_end <= vma->vm_mm->brk) {
3239                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3240                 } else if (!vma->vm_file &&
3241                            vma->vm_start <= vma->vm_mm->start_stack &&
3242                            vma->vm_end >= vma->vm_mm->start_stack) {
3243                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3244                 } else if (vma->vm_file && vma->anon_vma) {
3245                         /*
3246                          * We are making executable a file mapping that has
3247                          * had some COW done. Since pages might have been
3248                          * written, check ability to execute the possibly
3249                          * modified content.  This typically should only
3250                          * occur for text relocations.
3251                          */
3252                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3253                 }
3254                 if (rc)
3255                         return rc;
3256         }
3257
3258         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3259 }
3260
3261 static int selinux_file_lock(struct file *file, unsigned int cmd)
3262 {
3263         const struct cred *cred = current_cred();
3264
3265         return file_has_perm(cred, file, FILE__LOCK);
3266 }
3267
3268 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3269                               unsigned long arg)
3270 {
3271         const struct cred *cred = current_cred();
3272         int err = 0;
3273
3274         switch (cmd) {
3275         case F_SETFL:
3276                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3277                         err = file_has_perm(cred, file, FILE__WRITE);
3278                         break;
3279                 }
3280                 /* fall through */
3281         case F_SETOWN:
3282         case F_SETSIG:
3283         case F_GETFL:
3284         case F_GETOWN:
3285         case F_GETSIG:
3286         case F_GETOWNER_UIDS:
3287                 /* Just check FD__USE permission */
3288                 err = file_has_perm(cred, file, 0);
3289                 break;
3290         case F_GETLK:
3291         case F_SETLK:
3292         case F_SETLKW:
3293 #if BITS_PER_LONG == 32
3294         case F_GETLK64:
3295         case F_SETLK64:
3296         case F_SETLKW64:
3297 #endif
3298                 err = file_has_perm(cred, file, FILE__LOCK);
3299                 break;
3300         }
3301
3302         return err;
3303 }
3304
3305 static int selinux_file_set_fowner(struct file *file)
3306 {
3307         struct file_security_struct *fsec;
3308
3309         fsec = file->f_security;
3310         fsec->fown_sid = current_sid();
3311
3312         return 0;
3313 }
3314
3315 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3316                                        struct fown_struct *fown, int signum)
3317 {
3318         struct file *file;
3319         u32 sid = task_sid(tsk);
3320         u32 perm;
3321         struct file_security_struct *fsec;
3322
3323         /* struct fown_struct is never outside the context of a struct file */
3324         file = container_of(fown, struct file, f_owner);
3325
3326         fsec = file->f_security;
3327
3328         if (!signum)
3329                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3330         else
3331                 perm = signal_to_av(signum);
3332
3333         return avc_has_perm(fsec->fown_sid, sid,
3334                             SECCLASS_PROCESS, perm, NULL);
3335 }
3336
3337 static int selinux_file_receive(struct file *file)
3338 {
3339         const struct cred *cred = current_cred();
3340
3341         return file_has_perm(cred, file, file_to_av(file));
3342 }
3343
3344 static int selinux_file_open(struct file *file, const struct cred *cred)
3345 {
3346         struct file_security_struct *fsec;
3347         struct inode_security_struct *isec;
3348
3349         fsec = file->f_security;
3350         isec = file_inode(file)->i_security;
3351         /*
3352          * Save inode label and policy sequence number
3353          * at open-time so that selinux_file_permission
3354          * can determine whether revalidation is necessary.
3355          * Task label is already saved in the file security
3356          * struct as its SID.
3357          */
3358         fsec->isid = isec->sid;
3359         fsec->pseqno = avc_policy_seqno();
3360         /*
3361          * Since the inode label or policy seqno may have changed
3362          * between the selinux_inode_permission check and the saving
3363          * of state above, recheck that access is still permitted.
3364          * Otherwise, access might never be revalidated against the
3365          * new inode label or new policy.
3366          * This check is not redundant - do not remove.
3367          */
3368         return file_path_has_perm(cred, file, open_file_to_av(file));
3369 }
3370
3371 /* task security operations */
3372
3373 static int selinux_task_create(unsigned long clone_flags)
3374 {
3375         return current_has_perm(current, PROCESS__FORK);
3376 }
3377
3378 /*
3379  * allocate the SELinux part of blank credentials
3380  */
3381 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3382 {
3383         struct task_security_struct *tsec;
3384
3385         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3386         if (!tsec)
3387                 return -ENOMEM;
3388
3389         cred->security = tsec;
3390         return 0;
3391 }
3392
3393 /*
3394  * detach and free the LSM part of a set of credentials
3395  */
3396 static void selinux_cred_free(struct cred *cred)
3397 {
3398         struct task_security_struct *tsec = cred->security;
3399
3400         /*
3401          * cred->security == NULL if security_cred_alloc_blank() or
3402          * security_prepare_creds() returned an error.
3403          */
3404         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3405         cred->security = (void *) 0x7UL;
3406         kfree(tsec);
3407 }
3408
3409 /*
3410  * prepare a new set of credentials for modification
3411  */
3412 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3413                                 gfp_t gfp)
3414 {
3415         const struct task_security_struct *old_tsec;
3416         struct task_security_struct *tsec;
3417
3418         old_tsec = old->security;
3419
3420         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3421         if (!tsec)
3422                 return -ENOMEM;
3423
3424         new->security = tsec;
3425         return 0;
3426 }
3427
3428 /*
3429  * transfer the SELinux data to a blank set of creds
3430  */
3431 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3432 {
3433         const struct task_security_struct *old_tsec = old->security;
3434         struct task_security_struct *tsec = new->security;
3435
3436         *tsec = *old_tsec;
3437 }
3438
3439 /*
3440  * set the security data for a kernel service
3441  * - all the creation contexts are set to unlabelled
3442  */
3443 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3444 {
3445         struct task_security_struct *tsec = new->security;
3446         u32 sid = current_sid();
3447         int ret;
3448
3449         ret = avc_has_perm(sid, secid,
3450                            SECCLASS_KERNEL_SERVICE,
3451                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3452                            NULL);
3453         if (ret == 0) {
3454                 tsec->sid = secid;
3455                 tsec->create_sid = 0;
3456                 tsec->keycreate_sid = 0;
3457                 tsec->sockcreate_sid = 0;
3458         }
3459         return ret;
3460 }
3461
3462 /*
3463  * set the file creation context in a security record to the same as the
3464  * objective context of the specified inode
3465  */
3466 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3467 {
3468         struct inode_security_struct *isec = inode->i_security;
3469         struct task_security_struct *tsec = new->security;
3470         u32 sid = current_sid();
3471         int ret;
3472
3473         ret = avc_has_perm(sid, isec->sid,
3474                            SECCLASS_KERNEL_SERVICE,
3475                            KERNEL_SERVICE__CREATE_FILES_AS,
3476                            NULL);
3477
3478         if (ret == 0)
3479                 tsec->create_sid = isec->sid;
3480         return ret;
3481 }
3482
3483 static int selinux_kernel_module_request(char *kmod_name)
3484 {
3485         u32 sid;
3486         struct common_audit_data ad;
3487
3488         sid = task_sid(current);
3489
3490         ad.type = LSM_AUDIT_DATA_KMOD;
3491         ad.u.kmod_name = kmod_name;
3492
3493         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3494                             SYSTEM__MODULE_REQUEST, &ad);
3495 }
3496
3497 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3498 {
3499         return current_has_perm(p, PROCESS__SETPGID);
3500 }
3501
3502 static int selinux_task_getpgid(struct task_struct *p)
3503 {
3504         return current_has_perm(p, PROCESS__GETPGID);
3505 }
3506
3507 static int selinux_task_getsid(struct task_struct *p)
3508 {
3509         return current_has_perm(p, PROCESS__GETSESSION);
3510 }
3511
3512 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3513 {
3514         *secid = task_sid(p);
3515 }
3516
3517 static int selinux_task_setnice(struct task_struct *p, int nice)
3518 {
3519         int rc;
3520
3521         rc = cap_task_setnice(p, nice);
3522         if (rc)
3523                 return rc;
3524
3525         return current_has_perm(p, PROCESS__SETSCHED);
3526 }
3527
3528 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3529 {
3530         int rc;
3531
3532         rc = cap_task_setioprio(p, ioprio);
3533         if (rc)
3534                 return rc;
3535
3536         return current_has_perm(p, PROCESS__SETSCHED);
3537 }
3538
3539 static int selinux_task_getioprio(struct task_struct *p)
3540 {
3541         return current_has_perm(p, PROCESS__GETSCHED);
3542 }
3543
3544 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3545                 struct rlimit *new_rlim)
3546 {
3547         struct rlimit *old_rlim = p->signal->rlim + resource;
3548
3549         /* Control the ability to change the hard limit (whether
3550            lowering or raising it), so that the hard limit can
3551            later be used as a safe reset point for the soft limit
3552            upon context transitions.  See selinux_bprm_committing_creds. */
3553         if (old_rlim->rlim_max != new_rlim->rlim_max)
3554                 return current_has_perm(p, PROCESS__SETRLIMIT);
3555
3556         return 0;
3557 }
3558
3559 static int selinux_task_setscheduler(struct task_struct *p)
3560 {
3561         int rc;
3562
3563         rc = cap_task_setscheduler(p);
3564         if (rc)
3565                 return rc;
3566
3567         return current_has_perm(p, PROCESS__SETSCHED);
3568 }
3569
3570 static int selinux_task_getscheduler(struct task_struct *p)
3571 {
3572         return current_has_perm(p, PROCESS__GETSCHED);
3573 }
3574
3575 static int selinux_task_movememory(struct task_struct *p)
3576 {
3577         return current_has_perm(p, PROCESS__SETSCHED);
3578 }
3579
3580 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3581                                 int sig, u32 secid)
3582 {
3583         u32 perm;
3584         int rc;
3585
3586         if (!sig)
3587                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3588         else
3589                 perm = signal_to_av(sig);
3590         if (secid)
3591                 rc = avc_has_perm(secid, task_sid(p),
3592                                   SECCLASS_PROCESS, perm, NULL);
3593         else
3594                 rc = current_has_perm(p, perm);
3595         return rc;
3596 }
3597
3598 static int selinux_task_wait(struct task_struct *p)
3599 {
3600         return task_has_perm(p, current, PROCESS__SIGCHLD);
3601 }
3602
3603 static void selinux_task_to_inode(struct task_struct *p,
3604                                   struct inode *inode)
3605 {
3606         struct inode_security_struct *isec = inode->i_security;
3607         u32 sid = task_sid(p);
3608
3609         isec->sid = sid;
3610         isec->initialized = 1;
3611 }
3612
3613 /* Returns error only if unable to parse addresses */
3614 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3615                         struct common_audit_data *ad, u8 *proto)
3616 {
3617         int offset, ihlen, ret = -EINVAL;
3618         struct iphdr _iph, *ih;
3619
3620         offset = skb_network_offset(skb);
3621         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3622         if (ih == NULL)
3623                 goto out;
3624
3625         ihlen = ih->ihl * 4;
3626         if (ihlen < sizeof(_iph))
3627                 goto out;
3628
3629         ad->u.net->v4info.saddr = ih->saddr;
3630         ad->u.net->v4info.daddr = ih->daddr;
3631         ret = 0;
3632
3633         if (proto)
3634                 *proto = ih->protocol;
3635
3636         switch (ih->protocol) {
3637         case IPPROTO_TCP: {
3638                 struct tcphdr _tcph, *th;
3639
3640                 if (ntohs(ih->frag_off) & IP_OFFSET)
3641                         break;
3642
3643                 offset += ihlen;
3644                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3645                 if (th == NULL)
3646                         break;
3647
3648                 ad->u.net->sport = th->source;
3649                 ad->u.net->dport = th->dest;
3650                 break;
3651         }
3652
3653         case IPPROTO_UDP: {
3654                 struct udphdr _udph, *uh;
3655
3656                 if (ntohs(ih->frag_off) & IP_OFFSET)
3657                         break;
3658
3659                 offset += ihlen;
3660                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3661                 if (uh == NULL)
3662                         break;
3663
3664                 ad->u.net->sport = uh->source;
3665                 ad->u.net->dport = uh->dest;
3666                 break;
3667         }
3668
3669         case IPPROTO_DCCP: {
3670                 struct dccp_hdr _dccph, *dh;
3671
3672                 if (ntohs(ih->frag_off) & IP_OFFSET)
3673                         break;
3674
3675                 offset += ihlen;
3676                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3677                 if (dh == NULL)
3678                         break;
3679
3680                 ad->u.net->sport = dh->dccph_sport;
3681                 ad->u.net->dport = dh->dccph_dport;
3682                 break;
3683         }
3684
3685         default:
3686                 break;
3687         }
3688 out:
3689         return ret;
3690 }
3691
3692 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3693
3694 /* Returns error only if unable to parse addresses */
3695 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3696                         struct common_audit_data *ad, u8 *proto)
3697 {
3698         u8 nexthdr;
3699         int ret = -EINVAL, offset;
3700         struct ipv6hdr _ipv6h, *ip6;
3701         __be16 frag_off;
3702
3703         offset = skb_network_offset(skb);
3704         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3705         if (ip6 == NULL)
3706                 goto out;
3707
3708         ad->u.net->v6info.saddr = ip6->saddr;
3709         ad->u.net->v6info.daddr = ip6->daddr;
3710         ret = 0;
3711
3712         nexthdr = ip6->nexthdr;
3713         offset += sizeof(_ipv6h);
3714         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3715         if (offset < 0)
3716                 goto out;
3717
3718         if (proto)
3719                 *proto = nexthdr;
3720
3721         switch (nexthdr) {
3722         case IPPROTO_TCP: {
3723                 struct tcphdr _tcph, *th;
3724
3725                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3726                 if (th == NULL)
3727                         break;
3728
3729                 ad->u.net->sport = th->source;
3730                 ad->u.net->dport = th->dest;
3731                 break;
3732         }
3733
3734         case IPPROTO_UDP: {
3735                 struct udphdr _udph, *uh;
3736
3737                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3738                 if (uh == NULL)
3739                         break;
3740
3741                 ad->u.net->sport = uh->source;
3742                 ad->u.net->dport = uh->dest;
3743                 break;
3744         }
3745
3746         case IPPROTO_DCCP: {
3747                 struct dccp_hdr _dccph, *dh;
3748
3749                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3750                 if (dh == NULL)
3751                         break;
3752
3753                 ad->u.net->sport = dh->dccph_sport;
3754                 ad->u.net->dport = dh->dccph_dport;
3755                 break;
3756         }
3757
3758         /* includes fragments */
3759         default:
3760                 break;
3761         }
3762 out:
3763         return ret;
3764 }
3765
3766 #endif /* IPV6 */
3767
3768 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3769                              char **_addrp, int src, u8 *proto)
3770 {
3771         char *addrp;
3772         int ret;
3773
3774         switch (ad->u.net->family) {
3775         case PF_INET:
3776                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3777                 if (ret)
3778                         goto parse_error;
3779                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3780                                        &ad->u.net->v4info.daddr);
3781                 goto okay;
3782
3783 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3784         case PF_INET6:
3785                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3786                 if (ret)
3787                         goto parse_error;
3788                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3789                                        &ad->u.net->v6info.daddr);
3790                 goto okay;
3791 #endif  /* IPV6 */
3792         default:
3793                 addrp = NULL;
3794                 goto okay;
3795         }
3796
3797 parse_error:
3798         printk(KERN_WARNING
3799                "SELinux: failure in selinux_parse_skb(),"
3800                " unable to parse packet\n");
3801         return ret;
3802
3803 okay:
3804         if (_addrp)
3805                 *_addrp = addrp;
3806         return 0;
3807 }
3808
3809 /**
3810  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3811  * @skb: the packet
3812  * @family: protocol family
3813  * @sid: the packet's peer label SID
3814  *
3815  * Description:
3816  * Check the various different forms of network peer labeling and determine
3817  * the peer label/SID for the packet; most of the magic actually occurs in
3818  * the security server function security_net_peersid_cmp().  The function
3819  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3820  * or -EACCES if @sid is invalid due to inconsistencies with the different
3821  * peer labels.
3822  *
3823  */
3824 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3825 {
3826         int err;
3827         u32 xfrm_sid;
3828         u32 nlbl_sid;
3829         u32 nlbl_type;
3830
3831         err = selinux_skb_xfrm_sid(skb, &xfrm_sid);
3832         if (unlikely(err))
3833                 return -EACCES;
3834         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3835         if (unlikely(err))
3836                 return -EACCES;
3837
3838         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3839         if (unlikely(err)) {
3840                 printk(KERN_WARNING
3841                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3842                        " unable to determine packet's peer label\n");
3843                 return -EACCES;
3844         }
3845
3846         return 0;
3847 }
3848
3849 /* socket security operations */
3850
3851 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3852                                  u16 secclass, u32 *socksid)
3853 {
3854         if (tsec->sockcreate_sid > SECSID_NULL) {
3855                 *socksid = tsec->sockcreate_sid;
3856                 return 0;
3857         }
3858
3859         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3860                                        socksid);
3861 }
3862
3863 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3864 {
3865         struct sk_security_struct *sksec = sk->sk_security;
3866         struct common_audit_data ad;
3867         struct lsm_network_audit net = {0,};
3868         u32 tsid = task_sid(task);
3869
3870         if (sksec->sid == SECINITSID_KERNEL)
3871                 return 0;
3872
3873         ad.type = LSM_AUDIT_DATA_NET;
3874         ad.u.net = &net;
3875         ad.u.net->sk = sk;
3876
3877         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3878 }
3879
3880 static int selinux_socket_create(int family, int type,
3881                                  int protocol, int kern)
3882 {
3883         const struct task_security_struct *tsec = current_security();
3884         u32 newsid;
3885         u16 secclass;
3886         int rc;
3887
3888         if (kern)
3889                 return 0;
3890
3891         secclass = socket_type_to_security_class(family, type, protocol);
3892         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3893         if (rc)
3894                 return rc;
3895
3896         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3897 }
3898
3899 static int selinux_socket_post_create(struct socket *sock, int family,
3900                                       int type, int protocol, int kern)
3901 {
3902         const struct task_security_struct *tsec = current_security();
3903         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3904         struct sk_security_struct *sksec;
3905         int err = 0;
3906
3907         isec->sclass = socket_type_to_security_class(family, type, protocol);
3908
3909         if (kern)
3910                 isec->sid = SECINITSID_KERNEL;
3911         else {
3912                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3913                 if (err)
3914                         return err;
3915         }
3916
3917         isec->initialized = 1;
3918
3919         if (sock->sk) {
3920                 sksec = sock->sk->sk_security;
3921                 sksec->sid = isec->sid;
3922                 sksec->sclass = isec->sclass;
3923                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3924         }
3925
3926         return err;
3927 }
3928
3929 /* Range of port numbers used to automatically bind.
3930    Need to determine whether we should perform a name_bind
3931    permission check between the socket and the port number. */
3932
3933 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3934 {
3935         struct sock *sk = sock->sk;
3936         u16 family;
3937         int err;
3938
3939         err = sock_has_perm(current, sk, SOCKET__BIND);
3940         if (err)
3941                 goto out;
3942
3943         /*
3944          * If PF_INET or PF_INET6, check name_bind permission for the port.
3945          * Multiple address binding for SCTP is not supported yet: we just
3946          * check the first address now.
3947          */
3948         family = sk->sk_family;
3949         if (family == PF_INET || family == PF_INET6) {
3950                 char *addrp;
3951                 struct sk_security_struct *sksec = sk->sk_security;
3952                 struct common_audit_data ad;
3953                 struct lsm_network_audit net = {0,};
3954                 struct sockaddr_in *addr4 = NULL;
3955                 struct sockaddr_in6 *addr6 = NULL;
3956                 unsigned short snum;
3957                 u32 sid, node_perm;
3958
3959                 if (family == PF_INET) {
3960                         addr4 = (struct sockaddr_in *)address;
3961                         snum = ntohs(addr4->sin_port);
3962                         addrp = (char *)&addr4->sin_addr.s_addr;
3963                 } else {
3964                         addr6 = (struct sockaddr_in6 *)address;
3965                         snum = ntohs(addr6->sin6_port);
3966                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3967                 }
3968
3969                 if (snum) {
3970                         int low, high;
3971
3972                         inet_get_local_port_range(sock_net(sk), &low, &high);
3973
3974                         if (snum < max(PROT_SOCK, low) || snum > high) {
3975                                 err = sel_netport_sid(sk->sk_protocol,
3976                                                       snum, &sid);
3977                                 if (err)
3978                                         goto out;
3979                                 ad.type = LSM_AUDIT_DATA_NET;
3980                                 ad.u.net = &net;
3981                                 ad.u.net->sport = htons(snum);
3982                                 ad.u.net->family = family;
3983                                 err = avc_has_perm(sksec->sid, sid,
3984                                                    sksec->sclass,
3985                                                    SOCKET__NAME_BIND, &ad);
3986                                 if (err)
3987                                         goto out;
3988                         }
3989                 }
3990
3991                 switch (sksec->sclass) {
3992                 case SECCLASS_TCP_SOCKET:
3993                         node_perm = TCP_SOCKET__NODE_BIND;
3994                         break;
3995
3996                 case SECCLASS_UDP_SOCKET:
3997                         node_perm = UDP_SOCKET__NODE_BIND;
3998                         break;
3999
4000                 case SECCLASS_DCCP_SOCKET:
4001                         node_perm = DCCP_SOCKET__NODE_BIND;
4002                         break;
4003
4004                 default:
4005                         node_perm = RAWIP_SOCKET__NODE_BIND;
4006                         break;
4007                 }
4008
4009                 err = sel_netnode_sid(addrp, family, &sid);
4010                 if (err)
4011                         goto out;
4012
4013                 ad.type = LSM_AUDIT_DATA_NET;
4014                 ad.u.net = &net;
4015                 ad.u.net->sport = htons(snum);
4016                 ad.u.net->family = family;
4017
4018                 if (family == PF_INET)
4019                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4020                 else
4021                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4022
4023                 err = avc_has_perm(sksec->sid, sid,
4024                                    sksec->sclass, node_perm, &ad);
4025                 if (err)
4026                         goto out;
4027         }
4028 out:
4029         return err;
4030 }
4031
4032 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4033 {
4034         struct sock *sk = sock->sk;
4035         struct sk_security_struct *sksec = sk->sk_security;
4036         int err;
4037
4038         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4039         if (err)
4040                 return err;
4041
4042         /*
4043          * If a TCP or DCCP socket, check name_connect permission for the port.
4044          */
4045         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4046             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4047                 struct common_audit_data ad;
4048                 struct lsm_network_audit net = {0,};
4049                 struct sockaddr_in *addr4 = NULL;
4050                 struct sockaddr_in6 *addr6 = NULL;
4051                 unsigned short snum;
4052                 u32 sid, perm;
4053
4054                 if (sk->sk_family == PF_INET) {
4055                         addr4 = (struct sockaddr_in *)address;
4056                         if (addrlen < sizeof(struct sockaddr_in))
4057                                 return -EINVAL;
4058                         snum = ntohs(addr4->sin_port);
4059                 } else {
4060                         addr6 = (struct sockaddr_in6 *)address;
4061                         if (addrlen < SIN6_LEN_RFC2133)
4062                                 return -EINVAL;
4063                         snum = ntohs(addr6->sin6_port);
4064                 }
4065
4066                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4067                 if (err)
4068                         goto out;
4069
4070                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4071                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4072
4073                 ad.type = LSM_AUDIT_DATA_NET;
4074                 ad.u.net = &net;
4075                 ad.u.net->dport = htons(snum);
4076                 ad.u.net->family = sk->sk_family;
4077                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4078                 if (err)
4079                         goto out;
4080         }
4081
4082         err = selinux_netlbl_socket_connect(sk, address);
4083
4084 out:
4085         return err;
4086 }
4087
4088 static int selinux_socket_listen(struct socket *sock, int backlog)
4089 {
4090         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4091 }
4092
4093 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4094 {
4095         int err;
4096         struct inode_security_struct *isec;
4097         struct inode_security_struct *newisec;
4098
4099         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4100         if (err)
4101                 return err;
4102
4103         newisec = SOCK_INODE(newsock)->i_security;
4104
4105         isec = SOCK_INODE(sock)->i_security;
4106         newisec->sclass = isec->sclass;
4107         newisec->sid = isec->sid;
4108         newisec->initialized = 1;
4109
4110         return 0;
4111 }
4112
4113 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4114                                   int size)
4115 {
4116         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4117 }
4118
4119 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4120                                   int size, int flags)
4121 {
4122         return sock_has_perm(current, sock->sk, SOCKET__READ);
4123 }
4124
4125 static int selinux_socket_getsockname(struct socket *sock)
4126 {
4127         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4128 }
4129
4130 static int selinux_socket_getpeername(struct socket *sock)
4131 {
4132         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4133 }
4134
4135 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4136 {
4137         int err;
4138
4139         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4140         if (err)
4141                 return err;
4142
4143         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4144 }
4145
4146 static int selinux_socket_getsockopt(struct socket *sock, int level,
4147                                      int optname)
4148 {
4149         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4150 }
4151
4152 static int selinux_socket_shutdown(struct socket *sock, int how)
4153 {
4154         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4155 }
4156
4157 static int selinux_socket_unix_stream_connect(struct sock *sock,
4158                                               struct sock *other,
4159                                               struct sock *newsk)
4160 {
4161         struct sk_security_struct *sksec_sock = sock->sk_security;
4162         struct sk_security_struct *sksec_other = other->sk_security;
4163         struct sk_security_struct *sksec_new = newsk->sk_security;
4164         struct common_audit_data ad;
4165         struct lsm_network_audit net = {0,};
4166         int err;
4167
4168         ad.type = LSM_AUDIT_DATA_NET;
4169         ad.u.net = &net;
4170         ad.u.net->sk = other;
4171
4172         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4173                            sksec_other->sclass,
4174                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4175         if (err)
4176                 return err;
4177
4178         /* server child socket */
4179         sksec_new->peer_sid = sksec_sock->sid;
4180         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4181                                     &sksec_new->sid);
4182         if (err)
4183                 return err;
4184
4185         /* connecting socket */
4186         sksec_sock->peer_sid = sksec_new->sid;
4187
4188         return 0;
4189 }
4190
4191 static int selinux_socket_unix_may_send(struct socket *sock,
4192                                         struct socket *other)
4193 {
4194         struct sk_security_struct *ssec = sock->sk->sk_security;
4195         struct sk_security_struct *osec = other->sk->sk_security;
4196         struct common_audit_data ad;
4197         struct lsm_network_audit net = {0,};
4198
4199         ad.type = LSM_AUDIT_DATA_NET;
4200         ad.u.net = &net;
4201         ad.u.net->sk = other->sk;
4202
4203         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4204                             &ad);
4205 }
4206
4207 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4208                                     u32 peer_sid,
4209                                     struct common_audit_data *ad)
4210 {
4211         int err;
4212         u32 if_sid;
4213         u32 node_sid;
4214
4215         err = sel_netif_sid(ifindex, &if_sid);
4216         if (err)
4217                 return err;
4218         err = avc_has_perm(peer_sid, if_sid,
4219                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4220         if (err)
4221                 return err;
4222
4223         err = sel_netnode_sid(addrp, family, &node_sid);
4224         if (err)
4225                 return err;
4226         return avc_has_perm(peer_sid, node_sid,
4227                             SECCLASS_NODE, NODE__RECVFROM, ad);
4228 }
4229
4230 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4231                                        u16 family)
4232 {
4233         int err = 0;
4234         struct sk_security_struct *sksec = sk->sk_security;
4235         u32 sk_sid = sksec->sid;
4236         struct common_audit_data ad;
4237         struct lsm_network_audit net = {0,};
4238         char *addrp;
4239
4240         ad.type = LSM_AUDIT_DATA_NET;
4241         ad.u.net = &net;
4242         ad.u.net->netif = skb->skb_iif;
4243         ad.u.net->family = family;
4244         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4245         if (err)
4246                 return err;
4247
4248         if (selinux_secmark_enabled()) {
4249                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4250                                    PACKET__RECV, &ad);
4251                 if (err)
4252                         return err;
4253         }
4254
4255         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4256         if (err)
4257                 return err;
4258         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4259
4260         return err;
4261 }
4262
4263 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4264 {
4265         int err;
4266         struct sk_security_struct *sksec = sk->sk_security;
4267         u16 family = sk->sk_family;
4268         u32 sk_sid = sksec->sid;
4269         struct common_audit_data ad;
4270         struct lsm_network_audit net = {0,};
4271         char *addrp;
4272         u8 secmark_active;
4273         u8 peerlbl_active;
4274
4275         if (family != PF_INET && family != PF_INET6)
4276                 return 0;
4277
4278         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4279         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4280                 family = PF_INET;
4281
4282         /* If any sort of compatibility mode is enabled then handoff processing
4283          * to the selinux_sock_rcv_skb_compat() function to deal with the
4284          * special handling.  We do this in an attempt to keep this function
4285          * as fast and as clean as possible. */
4286         if (!selinux_policycap_netpeer)
4287                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4288
4289         secmark_active = selinux_secmark_enabled();
4290         peerlbl_active = selinux_peerlbl_enabled();
4291         if (!secmark_active && !peerlbl_active)
4292                 return 0;
4293
4294         ad.type = LSM_AUDIT_DATA_NET;
4295         ad.u.net = &net;
4296         ad.u.net->netif = skb->skb_iif;
4297         ad.u.net->family = family;
4298         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4299         if (err)
4300                 return err;
4301
4302         if (peerlbl_active) {
4303                 u32 peer_sid;
4304
4305                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4306                 if (err)
4307                         return err;
4308                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4309                                                peer_sid, &ad);
4310                 if (err) {
4311                         selinux_netlbl_err(skb, err, 0);
4312                         return err;
4313                 }
4314                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4315                                    PEER__RECV, &ad);
4316                 if (err)
4317                         selinux_netlbl_err(skb, err, 0);
4318         }
4319
4320         if (secmark_active) {
4321                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4322                                    PACKET__RECV, &ad);
4323                 if (err)
4324                         return err;
4325         }
4326
4327         return err;
4328 }
4329
4330 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4331                                             int __user *optlen, unsigned len)
4332 {
4333         int err = 0;
4334         char *scontext;
4335         u32 scontext_len;
4336         struct sk_security_struct *sksec = sock->sk->sk_security;
4337         u32 peer_sid = SECSID_NULL;
4338
4339         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4340             sksec->sclass == SECCLASS_TCP_SOCKET)
4341                 peer_sid = sksec->peer_sid;
4342         if (peer_sid == SECSID_NULL)
4343                 return -ENOPROTOOPT;
4344
4345         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4346         if (err)
4347                 return err;
4348
4349         if (scontext_len > len) {
4350                 err = -ERANGE;
4351                 goto out_len;
4352         }
4353
4354         if (copy_to_user(optval, scontext, scontext_len))
4355                 err = -EFAULT;
4356
4357 out_len:
4358         if (put_user(scontext_len, optlen))
4359                 err = -EFAULT;
4360         kfree(scontext);
4361         return err;
4362 }
4363
4364 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4365 {
4366         u32 peer_secid = SECSID_NULL;
4367         u16 family;
4368
4369         if (skb && skb->protocol == htons(ETH_P_IP))
4370                 family = PF_INET;
4371         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4372                 family = PF_INET6;
4373         else if (sock)
4374                 family = sock->sk->sk_family;
4375         else
4376                 goto out;
4377
4378         if (sock && family == PF_UNIX)
4379                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4380         else if (skb)
4381                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4382
4383 out:
4384         *secid = peer_secid;
4385         if (peer_secid == SECSID_NULL)
4386                 return -EINVAL;
4387         return 0;
4388 }
4389
4390 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4391 {
4392         struct sk_security_struct *sksec;
4393
4394         sksec = kzalloc(sizeof(*sksec), priority);
4395         if (!sksec)
4396                 return -ENOMEM;
4397
4398         sksec->peer_sid = SECINITSID_UNLABELED;
4399         sksec->sid = SECINITSID_UNLABELED;
4400         selinux_netlbl_sk_security_reset(sksec);
4401         sk->sk_security = sksec;
4402
4403         return 0;
4404 }
4405
4406 static void selinux_sk_free_security(struct sock *sk)
4407 {
4408         struct sk_security_struct *sksec = sk->sk_security;
4409
4410         sk->sk_security = NULL;
4411         selinux_netlbl_sk_security_free(sksec);
4412         kfree(sksec);
4413 }
4414
4415 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4416 {
4417         struct sk_security_struct *sksec = sk->sk_security;
4418         struct sk_security_struct *newsksec = newsk->sk_security;
4419
4420         newsksec->sid = sksec->sid;
4421         newsksec->peer_sid = sksec->peer_sid;
4422         newsksec->sclass = sksec->sclass;
4423
4424         selinux_netlbl_sk_security_reset(newsksec);
4425 }
4426
4427 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4428 {
4429         if (!sk)
4430                 *secid = SECINITSID_ANY_SOCKET;
4431         else {
4432                 struct sk_security_struct *sksec = sk->sk_security;
4433
4434                 *secid = sksec->sid;
4435         }
4436 }
4437
4438 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4439 {
4440         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4441         struct sk_security_struct *sksec = sk->sk_security;
4442
4443         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4444             sk->sk_family == PF_UNIX)
4445                 isec->sid = sksec->sid;
4446         sksec->sclass = isec->sclass;
4447 }
4448
4449 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4450                                      struct request_sock *req)
4451 {
4452         struct sk_security_struct *sksec = sk->sk_security;
4453         int err;
4454         u16 family = sk->sk_family;
4455         u32 newsid;
4456         u32 peersid;
4457
4458         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4459         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4460                 family = PF_INET;
4461
4462         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4463         if (err)
4464                 return err;
4465         if (peersid == SECSID_NULL) {
4466                 req->secid = sksec->sid;
4467                 req->peer_secid = SECSID_NULL;
4468         } else {
4469                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4470                 if (err)
4471                         return err;
4472                 req->secid = newsid;
4473                 req->peer_secid = peersid;
4474         }
4475
4476         return selinux_netlbl_inet_conn_request(req, family);
4477 }
4478
4479 static void selinux_inet_csk_clone(struct sock *newsk,
4480                                    const struct request_sock *req)
4481 {
4482         struct sk_security_struct *newsksec = newsk->sk_security;
4483
4484         newsksec->sid = req->secid;
4485         newsksec->peer_sid = req->peer_secid;
4486         /* NOTE: Ideally, we should also get the isec->sid for the
4487            new socket in sync, but we don't have the isec available yet.
4488            So we will wait until sock_graft to do it, by which
4489            time it will have been created and available. */
4490
4491         /* We don't need to take any sort of lock here as we are the only
4492          * thread with access to newsksec */
4493         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4494 }
4495
4496 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4497 {
4498         u16 family = sk->sk_family;
4499         struct sk_security_struct *sksec = sk->sk_security;
4500
4501         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4502         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4503                 family = PF_INET;
4504
4505         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4506 }
4507
4508 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4509 {
4510         skb_set_owner_w(skb, sk);
4511 }
4512
4513 static int selinux_secmark_relabel_packet(u32 sid)
4514 {
4515         const struct task_security_struct *__tsec;
4516         u32 tsid;
4517
4518         __tsec = current_security();
4519         tsid = __tsec->sid;
4520
4521         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4522 }
4523
4524 static void selinux_secmark_refcount_inc(void)
4525 {
4526         atomic_inc(&selinux_secmark_refcount);
4527 }
4528
4529 static void selinux_secmark_refcount_dec(void)
4530 {
4531         atomic_dec(&selinux_secmark_refcount);
4532 }
4533
4534 static void selinux_req_classify_flow(const struct request_sock *req,
4535                                       struct flowi *fl)
4536 {
4537         fl->flowi_secid = req->secid;
4538 }
4539
4540 static int selinux_tun_dev_alloc_security(void **security)
4541 {
4542         struct tun_security_struct *tunsec;
4543
4544         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4545         if (!tunsec)
4546                 return -ENOMEM;
4547         tunsec->sid = current_sid();
4548
4549         *security = tunsec;
4550         return 0;
4551 }
4552
4553 static void selinux_tun_dev_free_security(void *security)
4554 {
4555         kfree(security);
4556 }
4557
4558 static int selinux_tun_dev_create(void)
4559 {
4560         u32 sid = current_sid();
4561
4562         /* we aren't taking into account the "sockcreate" SID since the socket
4563          * that is being created here is not a socket in the traditional sense,
4564          * instead it is a private sock, accessible only to the kernel, and
4565          * representing a wide range of network traffic spanning multiple
4566          * connections unlike traditional sockets - check the TUN driver to
4567          * get a better understanding of why this socket is special */
4568
4569         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4570                             NULL);
4571 }
4572
4573 static int selinux_tun_dev_attach_queue(void *security)
4574 {
4575         struct tun_security_struct *tunsec = security;
4576
4577         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4578                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4579 }
4580
4581 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4582 {
4583         struct tun_security_struct *tunsec = security;
4584         struct sk_security_struct *sksec = sk->sk_security;
4585
4586         /* we don't currently perform any NetLabel based labeling here and it
4587          * isn't clear that we would want to do so anyway; while we could apply
4588          * labeling without the support of the TUN user the resulting labeled
4589          * traffic from the other end of the connection would almost certainly
4590          * cause confusion to the TUN user that had no idea network labeling
4591          * protocols were being used */
4592
4593         sksec->sid = tunsec->sid;
4594         sksec->sclass = SECCLASS_TUN_SOCKET;
4595
4596         return 0;
4597 }
4598
4599 static int selinux_tun_dev_open(void *security)
4600 {
4601         struct tun_security_struct *tunsec = security;
4602         u32 sid = current_sid();
4603         int err;
4604
4605         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4606                            TUN_SOCKET__RELABELFROM, NULL);
4607         if (err)
4608                 return err;
4609         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4610                            TUN_SOCKET__RELABELTO, NULL);
4611         if (err)
4612                 return err;
4613         tunsec->sid = sid;
4614
4615         return 0;
4616 }
4617
4618 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4619 {
4620         int err = 0;
4621         u32 perm;
4622         struct nlmsghdr *nlh;
4623         struct sk_security_struct *sksec = sk->sk_security;
4624
4625         if (skb->len < NLMSG_HDRLEN) {
4626                 err = -EINVAL;
4627                 goto out;
4628         }
4629         nlh = nlmsg_hdr(skb);
4630
4631         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4632         if (err) {
4633                 if (err == -EINVAL) {
4634                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4635                                   "SELinux:  unrecognized netlink message"
4636                                   " type=%hu for sclass=%hu\n",
4637                                   nlh->nlmsg_type, sksec->sclass);
4638                         if (!selinux_enforcing || security_get_allow_unknown())
4639                                 err = 0;
4640                 }
4641
4642                 /* Ignore */
4643                 if (err == -ENOENT)
4644                         err = 0;
4645                 goto out;
4646         }
4647
4648         err = sock_has_perm(current, sk, perm);
4649 out:
4650         return err;
4651 }
4652
4653 #ifdef CONFIG_NETFILTER
4654
4655 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4656                                        u16 family)
4657 {
4658         int err;
4659         char *addrp;
4660         u32 peer_sid;
4661         struct common_audit_data ad;
4662         struct lsm_network_audit net = {0,};
4663         u8 secmark_active;
4664         u8 netlbl_active;
4665         u8 peerlbl_active;
4666
4667         if (!selinux_policycap_netpeer)
4668                 return NF_ACCEPT;
4669
4670         secmark_active = selinux_secmark_enabled();
4671         netlbl_active = netlbl_enabled();
4672         peerlbl_active = selinux_peerlbl_enabled();
4673         if (!secmark_active && !peerlbl_active)
4674                 return NF_ACCEPT;
4675
4676         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4677                 return NF_DROP;
4678
4679         ad.type = LSM_AUDIT_DATA_NET;
4680         ad.u.net = &net;
4681         ad.u.net->netif = ifindex;
4682         ad.u.net->family = family;
4683         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4684                 return NF_DROP;
4685
4686         if (peerlbl_active) {
4687                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4688                                                peer_sid, &ad);
4689                 if (err) {
4690                         selinux_netlbl_err(skb, err, 1);
4691                         return NF_DROP;
4692                 }
4693         }
4694
4695         if (secmark_active)
4696                 if (avc_has_perm(peer_sid, skb->secmark,
4697                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4698                         return NF_DROP;
4699
4700         if (netlbl_active)
4701                 /* we do this in the FORWARD path and not the POST_ROUTING
4702                  * path because we want to make sure we apply the necessary
4703                  * labeling before IPsec is applied so we can leverage AH
4704                  * protection */
4705                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4706                         return NF_DROP;
4707
4708         return NF_ACCEPT;
4709 }
4710
4711 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4712                                          struct sk_buff *skb,
4713                                          const struct net_device *in,
4714                                          const struct net_device *out,
4715                                          int (*okfn)(struct sk_buff *))
4716 {
4717         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4718 }
4719
4720 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4721 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4722                                          struct sk_buff *skb,
4723                                          const struct net_device *in,
4724                                          const struct net_device *out,
4725                                          int (*okfn)(struct sk_buff *))
4726 {
4727         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4728 }
4729 #endif  /* IPV6 */
4730
4731 static unsigned int selinux_ip_output(struct sk_buff *skb,
4732                                       u16 family)
4733 {
4734         u32 sid;
4735
4736         if (!netlbl_enabled())
4737                 return NF_ACCEPT;
4738
4739         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4740          * because we want to make sure we apply the necessary labeling
4741          * before IPsec is applied so we can leverage AH protection */
4742         if (skb->sk) {
4743                 struct sk_security_struct *sksec = skb->sk->sk_security;
4744                 sid = sksec->sid;
4745         } else
4746                 sid = SECINITSID_KERNEL;
4747         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4748                 return NF_DROP;
4749
4750         return NF_ACCEPT;
4751 }
4752
4753 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4754                                         struct sk_buff *skb,
4755                                         const struct net_device *in,
4756                                         const struct net_device *out,
4757                                         int (*okfn)(struct sk_buff *))
4758 {
4759         return selinux_ip_output(skb, PF_INET);
4760 }
4761
4762 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4763                                                 int ifindex,
4764                                                 u16 family)
4765 {
4766         struct sock *sk = skb->sk;
4767         struct sk_security_struct *sksec;
4768         struct common_audit_data ad;
4769         struct lsm_network_audit net = {0,};
4770         char *addrp;
4771         u8 proto;
4772
4773         if (sk == NULL)
4774                 return NF_ACCEPT;
4775         sksec = sk->sk_security;
4776
4777         ad.type = LSM_AUDIT_DATA_NET;
4778         ad.u.net = &net;
4779         ad.u.net->netif = ifindex;
4780         ad.u.net->family = family;
4781         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4782                 return NF_DROP;
4783
4784         if (selinux_secmark_enabled())
4785                 if (avc_has_perm(sksec->sid, skb->secmark,
4786                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4787                         return NF_DROP_ERR(-ECONNREFUSED);
4788
4789         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4790                 return NF_DROP_ERR(-ECONNREFUSED);
4791
4792         return NF_ACCEPT;
4793 }
4794
4795 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4796                                          u16 family)
4797 {
4798         u32 secmark_perm;
4799         u32 peer_sid;
4800         struct sock *sk;
4801         struct common_audit_data ad;
4802         struct lsm_network_audit net = {0,};
4803         char *addrp;
4804         u8 secmark_active;
4805         u8 peerlbl_active;
4806
4807         /* If any sort of compatibility mode is enabled then handoff processing
4808          * to the selinux_ip_postroute_compat() function to deal with the
4809          * special handling.  We do this in an attempt to keep this function
4810          * as fast and as clean as possible. */
4811         if (!selinux_policycap_netpeer)
4812                 return selinux_ip_postroute_compat(skb, ifindex, family);
4813 #ifdef CONFIG_XFRM
4814         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4815          * packet transformation so allow the packet to pass without any checks
4816          * since we'll have another chance to perform access control checks
4817          * when the packet is on it's final way out.
4818          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4819          *       is NULL, in this case go ahead and apply access control. */
4820         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4821                 return NF_ACCEPT;
4822 #endif
4823         secmark_active = selinux_secmark_enabled();
4824         peerlbl_active = selinux_peerlbl_enabled();
4825         if (!secmark_active && !peerlbl_active)
4826                 return NF_ACCEPT;
4827
4828         /* if the packet is being forwarded then get the peer label from the
4829          * packet itself; otherwise check to see if it is from a local
4830          * application or the kernel, if from an application get the peer label
4831          * from the sending socket, otherwise use the kernel's sid */
4832         sk = skb->sk;
4833         if (sk == NULL) {
4834                 if (skb->skb_iif) {
4835                         secmark_perm = PACKET__FORWARD_OUT;
4836                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4837                                 return NF_DROP;
4838                 } else {
4839                         secmark_perm = PACKET__SEND;
4840                         peer_sid = SECINITSID_KERNEL;
4841                 }
4842         } else {
4843                 struct sk_security_struct *sksec = sk->sk_security;
4844                 peer_sid = sksec->sid;
4845                 secmark_perm = PACKET__SEND;
4846         }
4847
4848         ad.type = LSM_AUDIT_DATA_NET;
4849         ad.u.net = &net;
4850         ad.u.net->netif = ifindex;
4851         ad.u.net->family = family;
4852         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4853                 return NF_DROP;
4854
4855         if (secmark_active)
4856                 if (avc_has_perm(peer_sid, skb->secmark,
4857                                  SECCLASS_PACKET, secmark_perm, &ad))
4858                         return NF_DROP_ERR(-ECONNREFUSED);
4859
4860         if (peerlbl_active) {
4861                 u32 if_sid;
4862                 u32 node_sid;
4863
4864                 if (sel_netif_sid(ifindex, &if_sid))
4865                         return NF_DROP;
4866                 if (avc_has_perm(peer_sid, if_sid,
4867                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4868                         return NF_DROP_ERR(-ECONNREFUSED);
4869
4870                 if (sel_netnode_sid(addrp, family, &node_sid))
4871                         return NF_DROP;
4872                 if (avc_has_perm(peer_sid, node_sid,
4873                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4874                         return NF_DROP_ERR(-ECONNREFUSED);
4875         }
4876
4877         return NF_ACCEPT;
4878 }
4879
4880 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
4881                                            struct sk_buff *skb,
4882                                            const struct net_device *in,
4883                                            const struct net_device *out,
4884                                            int (*okfn)(struct sk_buff *))
4885 {
4886         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4887 }
4888
4889 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4890 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
4891                                            struct sk_buff *skb,
4892                                            const struct net_device *in,
4893                                            const struct net_device *out,
4894                                            int (*okfn)(struct sk_buff *))
4895 {
4896         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4897 }
4898 #endif  /* IPV6 */
4899
4900 #endif  /* CONFIG_NETFILTER */
4901
4902 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4903 {
4904         int err;
4905
4906         err = cap_netlink_send(sk, skb);
4907         if (err)
4908                 return err;
4909
4910         return selinux_nlmsg_perm(sk, skb);
4911 }
4912
4913 static int ipc_alloc_security(struct task_struct *task,
4914                               struct kern_ipc_perm *perm,
4915                               u16 sclass)
4916 {
4917         struct ipc_security_struct *isec;
4918         u32 sid;
4919
4920         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4921         if (!isec)
4922                 return -ENOMEM;
4923
4924         sid = task_sid(task);
4925         isec->sclass = sclass;
4926         isec->sid = sid;
4927         perm->security = isec;
4928
4929         return 0;
4930 }
4931
4932 static void ipc_free_security(struct kern_ipc_perm *perm)
4933 {
4934         struct ipc_security_struct *isec = perm->security;
4935         perm->security = NULL;
4936         kfree(isec);
4937 }
4938
4939 static int msg_msg_alloc_security(struct msg_msg *msg)
4940 {
4941         struct msg_security_struct *msec;
4942
4943         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4944         if (!msec)
4945                 return -ENOMEM;
4946
4947         msec->sid = SECINITSID_UNLABELED;
4948         msg->security = msec;
4949
4950         return 0;
4951 }
4952
4953 static void msg_msg_free_security(struct msg_msg *msg)
4954 {
4955         struct msg_security_struct *msec = msg->security;
4956
4957         msg->security = NULL;
4958         kfree(msec);
4959 }
4960
4961 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4962                         u32 perms)
4963 {
4964         struct ipc_security_struct *isec;
4965         struct common_audit_data ad;
4966         u32 sid = current_sid();
4967
4968         isec = ipc_perms->security;
4969
4970         ad.type = LSM_AUDIT_DATA_IPC;
4971         ad.u.ipc_id = ipc_perms->key;
4972
4973         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4974 }
4975
4976 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4977 {
4978         return msg_msg_alloc_security(msg);
4979 }
4980
4981 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4982 {
4983         msg_msg_free_security(msg);
4984 }
4985
4986 /* message queue security operations */
4987 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4988 {
4989         struct ipc_security_struct *isec;
4990         struct common_audit_data ad;
4991         u32 sid = current_sid();
4992         int rc;
4993
4994         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4995         if (rc)
4996                 return rc;
4997
4998         isec = msq->q_perm.security;
4999
5000         ad.type = LSM_AUDIT_DATA_IPC;
5001         ad.u.ipc_id = msq->q_perm.key;
5002
5003         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5004                           MSGQ__CREATE, &ad);
5005         if (rc) {
5006                 ipc_free_security(&msq->q_perm);
5007                 return rc;
5008         }
5009         return 0;
5010 }
5011
5012 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5013 {
5014         ipc_free_security(&msq->q_perm);
5015 }
5016
5017 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5018 {
5019         struct ipc_security_struct *isec;
5020         struct common_audit_data ad;
5021         u32 sid = current_sid();
5022
5023         isec = msq->q_perm.security;
5024
5025         ad.type = LSM_AUDIT_DATA_IPC;
5026         ad.u.ipc_id = msq->q_perm.key;
5027
5028         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5029                             MSGQ__ASSOCIATE, &ad);
5030 }
5031
5032 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5033 {
5034         int err;
5035         int perms;
5036
5037         switch (cmd) {
5038         case IPC_INFO:
5039         case MSG_INFO:
5040                 /* No specific object, just general system-wide information. */
5041                 return task_has_system(current, SYSTEM__IPC_INFO);
5042         case IPC_STAT:
5043         case MSG_STAT:
5044                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5045                 break;
5046         case IPC_SET:
5047                 perms = MSGQ__SETATTR;
5048                 break;
5049         case IPC_RMID:
5050                 perms = MSGQ__DESTROY;
5051                 break;
5052         default:
5053                 return 0;
5054         }
5055
5056         err = ipc_has_perm(&msq->q_perm, perms);
5057         return err;
5058 }
5059
5060 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5061 {
5062         struct ipc_security_struct *isec;
5063         struct msg_security_struct *msec;
5064         struct common_audit_data ad;
5065         u32 sid = current_sid();
5066         int rc;
5067
5068         isec = msq->q_perm.security;
5069         msec = msg->security;
5070
5071         /*
5072          * First time through, need to assign label to the message
5073          */
5074         if (msec->sid == SECINITSID_UNLABELED) {
5075                 /*
5076                  * Compute new sid based on current process and
5077                  * message queue this message will be stored in
5078                  */
5079                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5080                                              NULL, &msec->sid);
5081                 if (rc)
5082                         return rc;
5083         }
5084
5085         ad.type = LSM_AUDIT_DATA_IPC;
5086         ad.u.ipc_id = msq->q_perm.key;
5087
5088         /* Can this process write to the queue? */
5089         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5090                           MSGQ__WRITE, &ad);
5091         if (!rc)
5092                 /* Can this process send the message */
5093                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5094                                   MSG__SEND, &ad);
5095         if (!rc)
5096                 /* Can the message be put in the queue? */
5097                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5098                                   MSGQ__ENQUEUE, &ad);
5099
5100         return rc;
5101 }
5102
5103 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5104                                     struct task_struct *target,
5105                                     long type, int mode)
5106 {
5107         struct ipc_security_struct *isec;
5108         struct msg_security_struct *msec;
5109         struct common_audit_data ad;
5110         u32 sid = task_sid(target);
5111         int rc;
5112
5113         isec = msq->q_perm.security;
5114         msec = msg->security;
5115
5116         ad.type = LSM_AUDIT_DATA_IPC;
5117         ad.u.ipc_id = msq->q_perm.key;
5118
5119         rc = avc_has_perm(sid, isec->sid,
5120                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5121         if (!rc)
5122                 rc = avc_has_perm(sid, msec->sid,
5123                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5124         return rc;
5125 }
5126
5127 /* Shared Memory security operations */
5128 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5129 {
5130         struct ipc_security_struct *isec;
5131         struct common_audit_data ad;
5132         u32 sid = current_sid();
5133         int rc;
5134
5135         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5136         if (rc)
5137                 return rc;
5138
5139         isec = shp->shm_perm.security;
5140
5141         ad.type = LSM_AUDIT_DATA_IPC;
5142         ad.u.ipc_id = shp->shm_perm.key;
5143
5144         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5145                           SHM__CREATE, &ad);
5146         if (rc) {
5147                 ipc_free_security(&shp->shm_perm);
5148                 return rc;
5149         }
5150         return 0;
5151 }
5152
5153 static void selinux_shm_free_security(struct shmid_kernel *shp)
5154 {
5155         ipc_free_security(&shp->shm_perm);
5156 }
5157
5158 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5159 {
5160         struct ipc_security_struct *isec;
5161         struct common_audit_data ad;
5162         u32 sid = current_sid();
5163
5164         isec = shp->shm_perm.security;
5165
5166         ad.type = LSM_AUDIT_DATA_IPC;
5167         ad.u.ipc_id = shp->shm_perm.key;
5168
5169         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5170                             SHM__ASSOCIATE, &ad);
5171 }
5172
5173 /* Note, at this point, shp is locked down */
5174 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5175 {
5176         int perms;
5177         int err;
5178
5179         switch (cmd) {
5180         case IPC_INFO:
5181         case SHM_INFO:
5182                 /* No specific object, just general system-wide information. */
5183                 return task_has_system(current, SYSTEM__IPC_INFO);
5184         case IPC_STAT:
5185         case SHM_STAT:
5186                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5187                 break;
5188         case IPC_SET:
5189                 perms = SHM__SETATTR;
5190                 break;
5191         case SHM_LOCK:
5192         case SHM_UNLOCK:
5193                 perms = SHM__LOCK;
5194                 break;
5195         case IPC_RMID:
5196                 perms = SHM__DESTROY;
5197                 break;
5198         default:
5199                 return 0;
5200         }
5201
5202         err = ipc_has_perm(&shp->shm_perm, perms);
5203         return err;
5204 }
5205
5206 static int selinux_shm_shmat(struct shmid_kernel *shp,
5207                              char __user *shmaddr, int shmflg)
5208 {
5209         u32 perms;
5210
5211         if (shmflg & SHM_RDONLY)
5212                 perms = SHM__READ;
5213         else
5214                 perms = SHM__READ | SHM__WRITE;
5215
5216         return ipc_has_perm(&shp->shm_perm, perms);
5217 }
5218
5219 /* Semaphore security operations */
5220 static int selinux_sem_alloc_security(struct sem_array *sma)
5221 {
5222         struct ipc_security_struct *isec;
5223         struct common_audit_data ad;
5224         u32 sid = current_sid();
5225         int rc;
5226
5227         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5228         if (rc)
5229                 return rc;
5230
5231         isec = sma->sem_perm.security;
5232
5233         ad.type = LSM_AUDIT_DATA_IPC;
5234         ad.u.ipc_id = sma->sem_perm.key;
5235
5236         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5237                           SEM__CREATE, &ad);
5238         if (rc) {
5239                 ipc_free_security(&sma->sem_perm);
5240                 return rc;
5241         }
5242         return 0;
5243 }
5244
5245 static void selinux_sem_free_security(struct sem_array *sma)
5246 {
5247         ipc_free_security(&sma->sem_perm);
5248 }
5249
5250 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5251 {
5252         struct ipc_security_struct *isec;
5253         struct common_audit_data ad;
5254         u32 sid = current_sid();
5255
5256         isec = sma->sem_perm.security;
5257
5258         ad.type = LSM_AUDIT_DATA_IPC;
5259         ad.u.ipc_id = sma->sem_perm.key;
5260
5261         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5262                             SEM__ASSOCIATE, &ad);
5263 }
5264
5265 /* Note, at this point, sma is locked down */
5266 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5267 {
5268         int err;
5269         u32 perms;
5270
5271         switch (cmd) {
5272         case IPC_INFO:
5273         case SEM_INFO:
5274                 /* No specific object, just general system-wide information. */
5275                 return task_has_system(current, SYSTEM__IPC_INFO);
5276         case GETPID:
5277         case GETNCNT:
5278         case GETZCNT:
5279                 perms = SEM__GETATTR;
5280                 break;
5281         case GETVAL:
5282         case GETALL:
5283                 perms = SEM__READ;
5284                 break;
5285         case SETVAL:
5286         case SETALL:
5287                 perms = SEM__WRITE;
5288                 break;
5289         case IPC_RMID:
5290                 perms = SEM__DESTROY;
5291                 break;
5292         case IPC_SET:
5293                 perms = SEM__SETATTR;
5294                 break;
5295         case IPC_STAT:
5296         case SEM_STAT:
5297                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5298                 break;
5299         default:
5300                 return 0;
5301         }
5302
5303         err = ipc_has_perm(&sma->sem_perm, perms);
5304         return err;
5305 }
5306
5307 static int selinux_sem_semop(struct sem_array *sma,
5308                              struct sembuf *sops, unsigned nsops, int alter)
5309 {
5310         u32 perms;
5311
5312         if (alter)
5313                 perms = SEM__READ | SEM__WRITE;
5314         else
5315                 perms = SEM__READ;
5316
5317         return ipc_has_perm(&sma->sem_perm, perms);
5318 }
5319
5320 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5321 {
5322         u32 av = 0;
5323
5324         av = 0;
5325         if (flag & S_IRUGO)
5326                 av |= IPC__UNIX_READ;
5327         if (flag & S_IWUGO)
5328                 av |= IPC__UNIX_WRITE;
5329
5330         if (av == 0)
5331                 return 0;
5332
5333         return ipc_has_perm(ipcp, av);
5334 }
5335
5336 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5337 {
5338         struct ipc_security_struct *isec = ipcp->security;
5339         *secid = isec->sid;
5340 }
5341
5342 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5343 {
5344         if (inode)
5345                 inode_doinit_with_dentry(inode, dentry);
5346 }
5347
5348 static int selinux_getprocattr(struct task_struct *p,
5349                                char *name, char **value)
5350 {
5351         const struct task_security_struct *__tsec;
5352         u32 sid;
5353         int error;
5354         unsigned len;
5355
5356         if (current != p) {
5357                 error = current_has_perm(p, PROCESS__GETATTR);
5358                 if (error)
5359                         return error;
5360         }
5361
5362         rcu_read_lock();
5363         __tsec = __task_cred(p)->security;
5364
5365         if (!strcmp(name, "current"))
5366                 sid = __tsec->sid;
5367         else if (!strcmp(name, "prev"))
5368                 sid = __tsec->osid;
5369         else if (!strcmp(name, "exec"))
5370                 sid = __tsec->exec_sid;
5371         else if (!strcmp(name, "fscreate"))
5372                 sid = __tsec->create_sid;
5373         else if (!strcmp(name, "keycreate"))
5374                 sid = __tsec->keycreate_sid;
5375         else if (!strcmp(name, "sockcreate"))
5376                 sid = __tsec->sockcreate_sid;
5377         else
5378                 goto invalid;
5379         rcu_read_unlock();
5380
5381         if (!sid)
5382                 return 0;
5383
5384         error = security_sid_to_context(sid, value, &len);
5385         if (error)
5386                 return error;
5387         return len;
5388
5389 invalid:
5390         rcu_read_unlock();
5391         return -EINVAL;
5392 }
5393
5394 static int selinux_setprocattr(struct task_struct *p,
5395                                char *name, void *value, size_t size)
5396 {
5397         struct task_security_struct *tsec;
5398         struct task_struct *tracer;
5399         struct cred *new;
5400         u32 sid = 0, ptsid;
5401         int error;
5402         char *str = value;
5403
5404         if (current != p) {
5405                 /* SELinux only allows a process to change its own
5406                    security attributes. */
5407                 return -EACCES;
5408         }
5409
5410         /*
5411          * Basic control over ability to set these attributes at all.
5412          * current == p, but we'll pass them separately in case the
5413          * above restriction is ever removed.
5414          */
5415         if (!strcmp(name, "exec"))
5416                 error = current_has_perm(p, PROCESS__SETEXEC);
5417         else if (!strcmp(name, "fscreate"))
5418                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5419         else if (!strcmp(name, "keycreate"))
5420                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5421         else if (!strcmp(name, "sockcreate"))
5422                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5423         else if (!strcmp(name, "current"))
5424                 error = current_has_perm(p, PROCESS__SETCURRENT);
5425         else
5426                 error = -EINVAL;
5427         if (error)
5428                 return error;
5429
5430         /* Obtain a SID for the context, if one was specified. */
5431         if (size && str[1] && str[1] != '\n') {
5432                 if (str[size-1] == '\n') {
5433                         str[size-1] = 0;
5434                         size--;
5435                 }
5436                 error = security_context_to_sid(value, size, &sid);
5437                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5438                         if (!capable(CAP_MAC_ADMIN)) {
5439                                 struct audit_buffer *ab;
5440                                 size_t audit_size;
5441
5442                                 /* We strip a nul only if it is at the end, otherwise the
5443                                  * context contains a nul and we should audit that */
5444                                 if (str[size - 1] == '\0')
5445                                         audit_size = size - 1;
5446                                 else
5447                                         audit_size = size;
5448                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5449                                 audit_log_format(ab, "op=fscreate invalid_context=");
5450                                 audit_log_n_untrustedstring(ab, value, audit_size);
5451                                 audit_log_end(ab);
5452
5453                                 return error;
5454                         }
5455                         error = security_context_to_sid_force(value, size,
5456                                                               &sid);
5457                 }
5458                 if (error)
5459                         return error;
5460         }
5461
5462         new = prepare_creds();
5463         if (!new)
5464                 return -ENOMEM;
5465
5466         /* Permission checking based on the specified context is
5467            performed during the actual operation (execve,
5468            open/mkdir/...), when we know the full context of the
5469            operation.  See selinux_bprm_set_creds for the execve
5470            checks and may_create for the file creation checks. The
5471            operation will then fail if the context is not permitted. */
5472         tsec = new->security;
5473         if (!strcmp(name, "exec")) {
5474                 tsec->exec_sid = sid;
5475         } else if (!strcmp(name, "fscreate")) {
5476                 tsec->create_sid = sid;
5477         } else if (!strcmp(name, "keycreate")) {
5478                 error = may_create_key(sid, p);
5479                 if (error)
5480                         goto abort_change;
5481                 tsec->keycreate_sid = sid;
5482         } else if (!strcmp(name, "sockcreate")) {
5483                 tsec->sockcreate_sid = sid;
5484         } else if (!strcmp(name, "current")) {
5485                 error = -EINVAL;
5486                 if (sid == 0)
5487                         goto abort_change;
5488
5489                 /* Only allow single threaded processes to change context */
5490                 error = -EPERM;
5491                 if (!current_is_single_threaded()) {
5492                         error = security_bounded_transition(tsec->sid, sid);
5493                         if (error)
5494                                 goto abort_change;
5495                 }
5496
5497                 /* Check permissions for the transition. */
5498                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5499                                      PROCESS__DYNTRANSITION, NULL);
5500                 if (error)
5501                         goto abort_change;
5502
5503                 /* Check for ptracing, and update the task SID if ok.
5504                    Otherwise, leave SID unchanged and fail. */
5505                 ptsid = 0;
5506                 task_lock(p);
5507                 tracer = ptrace_parent(p);
5508                 if (tracer)
5509                         ptsid = task_sid(tracer);
5510                 task_unlock(p);
5511
5512                 if (tracer) {
5513                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5514                                              PROCESS__PTRACE, NULL);
5515                         if (error)
5516                                 goto abort_change;
5517                 }
5518
5519                 tsec->sid = sid;
5520         } else {
5521                 error = -EINVAL;
5522                 goto abort_change;
5523         }
5524
5525         commit_creds(new);
5526         return size;
5527
5528 abort_change:
5529         abort_creds(new);
5530         return error;
5531 }
5532
5533 static int selinux_ismaclabel(const char *name)
5534 {
5535         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5536 }
5537
5538 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5539 {
5540         return security_sid_to_context(secid, secdata, seclen);
5541 }
5542
5543 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5544 {
5545         return security_context_to_sid(secdata, seclen, secid);
5546 }
5547
5548 static void selinux_release_secctx(char *secdata, u32 seclen)
5549 {
5550         kfree(secdata);
5551 }
5552
5553 /*
5554  *      called with inode->i_mutex locked
5555  */
5556 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5557 {
5558         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5559 }
5560
5561 /*
5562  *      called with inode->i_mutex locked
5563  */
5564 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5565 {
5566         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5567 }
5568
5569 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5570 {
5571         int len = 0;
5572         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5573                                                 ctx, true);
5574         if (len < 0)
5575                 return len;
5576         *ctxlen = len;
5577         return 0;
5578 }
5579 #ifdef CONFIG_KEYS
5580
5581 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5582                              unsigned long flags)
5583 {
5584         const struct task_security_struct *tsec;
5585         struct key_security_struct *ksec;
5586
5587         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5588         if (!ksec)
5589                 return -ENOMEM;
5590
5591         tsec = cred->security;
5592         if (tsec->keycreate_sid)
5593                 ksec->sid = tsec->keycreate_sid;
5594         else
5595                 ksec->sid = tsec->sid;
5596
5597         k->security = ksec;
5598         return 0;
5599 }
5600
5601 static void selinux_key_free(struct key *k)
5602 {
5603         struct key_security_struct *ksec = k->security;
5604
5605         k->security = NULL;
5606         kfree(ksec);
5607 }
5608
5609 static int selinux_key_permission(key_ref_t key_ref,
5610                                   const struct cred *cred,
5611                                   key_perm_t perm)
5612 {
5613         struct key *key;
5614         struct key_security_struct *ksec;
5615         u32 sid;
5616
5617         /* if no specific permissions are requested, we skip the
5618            permission check. No serious, additional covert channels
5619            appear to be created. */
5620         if (perm == 0)
5621                 return 0;
5622
5623         sid = cred_sid(cred);
5624
5625         key = key_ref_to_ptr(key_ref);
5626         ksec = key->security;
5627
5628         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5629 }
5630
5631 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5632 {
5633         struct key_security_struct *ksec = key->security;
5634         char *context = NULL;
5635         unsigned len;
5636         int rc;
5637
5638         rc = security_sid_to_context(ksec->sid, &context, &len);
5639         if (!rc)
5640                 rc = len;
5641         *_buffer = context;
5642         return rc;
5643 }
5644
5645 #endif
5646
5647 static struct security_operations selinux_ops = {
5648         .name =                         "selinux",
5649
5650         .ptrace_access_check =          selinux_ptrace_access_check,
5651         .ptrace_traceme =               selinux_ptrace_traceme,
5652         .capget =                       selinux_capget,
5653         .capset =                       selinux_capset,
5654         .capable =                      selinux_capable,
5655         .quotactl =                     selinux_quotactl,
5656         .quota_on =                     selinux_quota_on,
5657         .syslog =                       selinux_syslog,
5658         .vm_enough_memory =             selinux_vm_enough_memory,
5659
5660         .netlink_send =                 selinux_netlink_send,
5661
5662         .bprm_set_creds =               selinux_bprm_set_creds,
5663         .bprm_committing_creds =        selinux_bprm_committing_creds,
5664         .bprm_committed_creds =         selinux_bprm_committed_creds,
5665         .bprm_secureexec =              selinux_bprm_secureexec,
5666
5667         .sb_alloc_security =            selinux_sb_alloc_security,
5668         .sb_free_security =             selinux_sb_free_security,
5669         .sb_copy_data =                 selinux_sb_copy_data,
5670         .sb_remount =                   selinux_sb_remount,
5671         .sb_kern_mount =                selinux_sb_kern_mount,
5672         .sb_show_options =              selinux_sb_show_options,
5673         .sb_statfs =                    selinux_sb_statfs,
5674         .sb_mount =                     selinux_mount,
5675         .sb_umount =                    selinux_umount,
5676         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5677         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5678         .sb_parse_opts_str =            selinux_parse_opts_str,
5679
5680         .dentry_init_security =         selinux_dentry_init_security,
5681
5682         .inode_alloc_security =         selinux_inode_alloc_security,
5683         .inode_free_security =          selinux_inode_free_security,
5684         .inode_init_security =          selinux_inode_init_security,
5685         .inode_create =                 selinux_inode_create,
5686         .inode_link =                   selinux_inode_link,
5687         .inode_unlink =                 selinux_inode_unlink,
5688         .inode_symlink =                selinux_inode_symlink,
5689         .inode_mkdir =                  selinux_inode_mkdir,
5690         .inode_rmdir =                  selinux_inode_rmdir,
5691         .inode_mknod =                  selinux_inode_mknod,
5692         .inode_rename =                 selinux_inode_rename,
5693         .inode_readlink =               selinux_inode_readlink,
5694         .inode_follow_link =            selinux_inode_follow_link,
5695         .inode_permission =             selinux_inode_permission,
5696         .inode_setattr =                selinux_inode_setattr,
5697         .inode_getattr =                selinux_inode_getattr,
5698         .inode_setxattr =               selinux_inode_setxattr,
5699         .inode_post_setxattr =          selinux_inode_post_setxattr,
5700         .inode_getxattr =               selinux_inode_getxattr,
5701         .inode_listxattr =              selinux_inode_listxattr,
5702         .inode_removexattr =            selinux_inode_removexattr,
5703         .inode_getsecurity =            selinux_inode_getsecurity,
5704         .inode_setsecurity =            selinux_inode_setsecurity,
5705         .inode_listsecurity =           selinux_inode_listsecurity,
5706         .inode_getsecid =               selinux_inode_getsecid,
5707
5708         .file_permission =              selinux_file_permission,
5709         .file_alloc_security =          selinux_file_alloc_security,
5710         .file_free_security =           selinux_file_free_security,
5711         .file_ioctl =                   selinux_file_ioctl,
5712         .mmap_file =                    selinux_mmap_file,
5713         .mmap_addr =                    selinux_mmap_addr,
5714         .file_mprotect =                selinux_file_mprotect,
5715         .file_lock =                    selinux_file_lock,
5716         .file_fcntl =                   selinux_file_fcntl,
5717         .file_set_fowner =              selinux_file_set_fowner,
5718         .file_send_sigiotask =          selinux_file_send_sigiotask,
5719         .file_receive =                 selinux_file_receive,
5720
5721         .file_open =                    selinux_file_open,
5722
5723         .task_create =                  selinux_task_create,
5724         .cred_alloc_blank =             selinux_cred_alloc_blank,
5725         .cred_free =                    selinux_cred_free,
5726         .cred_prepare =                 selinux_cred_prepare,
5727         .cred_transfer =                selinux_cred_transfer,
5728         .kernel_act_as =                selinux_kernel_act_as,
5729         .kernel_create_files_as =       selinux_kernel_create_files_as,
5730         .kernel_module_request =        selinux_kernel_module_request,
5731         .task_setpgid =                 selinux_task_setpgid,
5732         .task_getpgid =                 selinux_task_getpgid,
5733         .task_getsid =                  selinux_task_getsid,
5734         .task_getsecid =                selinux_task_getsecid,
5735         .task_setnice =                 selinux_task_setnice,
5736         .task_setioprio =               selinux_task_setioprio,
5737         .task_getioprio =               selinux_task_getioprio,
5738         .task_setrlimit =               selinux_task_setrlimit,
5739         .task_setscheduler =            selinux_task_setscheduler,
5740         .task_getscheduler =            selinux_task_getscheduler,
5741         .task_movememory =              selinux_task_movememory,
5742         .task_kill =                    selinux_task_kill,
5743         .task_wait =                    selinux_task_wait,
5744         .task_to_inode =                selinux_task_to_inode,
5745
5746         .ipc_permission =               selinux_ipc_permission,
5747         .ipc_getsecid =                 selinux_ipc_getsecid,
5748
5749         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5750         .msg_msg_free_security =        selinux_msg_msg_free_security,
5751
5752         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5753         .msg_queue_free_security =      selinux_msg_queue_free_security,
5754         .msg_queue_associate =          selinux_msg_queue_associate,
5755         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5756         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5757         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5758
5759         .shm_alloc_security =           selinux_shm_alloc_security,
5760         .shm_free_security =            selinux_shm_free_security,
5761         .shm_associate =                selinux_shm_associate,
5762         .shm_shmctl =                   selinux_shm_shmctl,
5763         .shm_shmat =                    selinux_shm_shmat,
5764
5765         .sem_alloc_security =           selinux_sem_alloc_security,
5766         .sem_free_security =            selinux_sem_free_security,
5767         .sem_associate =                selinux_sem_associate,
5768         .sem_semctl =                   selinux_sem_semctl,
5769         .sem_semop =                    selinux_sem_semop,
5770
5771         .d_instantiate =                selinux_d_instantiate,
5772
5773         .getprocattr =                  selinux_getprocattr,
5774         .setprocattr =                  selinux_setprocattr,
5775
5776         .ismaclabel =                   selinux_ismaclabel,
5777         .secid_to_secctx =              selinux_secid_to_secctx,
5778         .secctx_to_secid =              selinux_secctx_to_secid,
5779         .release_secctx =               selinux_release_secctx,
5780         .inode_notifysecctx =           selinux_inode_notifysecctx,
5781         .inode_setsecctx =              selinux_inode_setsecctx,
5782         .inode_getsecctx =              selinux_inode_getsecctx,
5783
5784         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5785         .unix_may_send =                selinux_socket_unix_may_send,
5786
5787         .socket_create =                selinux_socket_create,
5788         .socket_post_create =           selinux_socket_post_create,
5789         .socket_bind =                  selinux_socket_bind,
5790         .socket_connect =               selinux_socket_connect,
5791         .socket_listen =                selinux_socket_listen,
5792         .socket_accept =                selinux_socket_accept,
5793         .socket_sendmsg =               selinux_socket_sendmsg,
5794         .socket_recvmsg =               selinux_socket_recvmsg,
5795         .socket_getsockname =           selinux_socket_getsockname,
5796         .socket_getpeername =           selinux_socket_getpeername,
5797         .socket_getsockopt =            selinux_socket_getsockopt,
5798         .socket_setsockopt =            selinux_socket_setsockopt,
5799         .socket_shutdown =              selinux_socket_shutdown,
5800         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5801         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5802         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5803         .sk_alloc_security =            selinux_sk_alloc_security,
5804         .sk_free_security =             selinux_sk_free_security,
5805         .sk_clone_security =            selinux_sk_clone_security,
5806         .sk_getsecid =                  selinux_sk_getsecid,
5807         .sock_graft =                   selinux_sock_graft,
5808         .inet_conn_request =            selinux_inet_conn_request,
5809         .inet_csk_clone =               selinux_inet_csk_clone,
5810         .inet_conn_established =        selinux_inet_conn_established,
5811         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5812         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5813         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5814         .req_classify_flow =            selinux_req_classify_flow,
5815         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5816         .tun_dev_free_security =        selinux_tun_dev_free_security,
5817         .tun_dev_create =               selinux_tun_dev_create,
5818         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5819         .tun_dev_attach =               selinux_tun_dev_attach,
5820         .tun_dev_open =                 selinux_tun_dev_open,
5821         .skb_owned_by =                 selinux_skb_owned_by,
5822
5823 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5824         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5825         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5826         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5827         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5828         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5829         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5830         .xfrm_state_free_security =     selinux_xfrm_state_free,
5831         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5832         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5833         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5834         .xfrm_decode_session =          selinux_xfrm_decode_session,
5835 #endif
5836
5837 #ifdef CONFIG_KEYS
5838         .key_alloc =                    selinux_key_alloc,
5839         .key_free =                     selinux_key_free,
5840         .key_permission =               selinux_key_permission,
5841         .key_getsecurity =              selinux_key_getsecurity,
5842 #endif
5843
5844 #ifdef CONFIG_AUDIT
5845         .audit_rule_init =              selinux_audit_rule_init,
5846         .audit_rule_known =             selinux_audit_rule_known,
5847         .audit_rule_match =             selinux_audit_rule_match,
5848         .audit_rule_free =              selinux_audit_rule_free,
5849 #endif
5850 };
5851
5852 static __init int selinux_init(void)
5853 {
5854         if (!security_module_enable(&selinux_ops)) {
5855                 selinux_enabled = 0;
5856                 return 0;
5857         }
5858
5859         if (!selinux_enabled) {
5860                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5861                 return 0;
5862         }
5863
5864         printk(KERN_INFO "SELinux:  Initializing.\n");
5865
5866         /* Set the security state for the initial task. */
5867         cred_init_security();
5868
5869         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5870
5871         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5872                                             sizeof(struct inode_security_struct),
5873                                             0, SLAB_PANIC, NULL);
5874         avc_init();
5875
5876         if (register_security(&selinux_ops))
5877                 panic("SELinux: Unable to register with kernel.\n");
5878
5879         if (selinux_enforcing)
5880                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5881         else
5882                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5883
5884         return 0;
5885 }
5886
5887 static void delayed_superblock_init(struct super_block *sb, void *unused)
5888 {
5889         superblock_doinit(sb, NULL);
5890 }
5891
5892 void selinux_complete_init(void)
5893 {
5894         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5895
5896         /* Set up any superblocks initialized prior to the policy load. */
5897         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5898         iterate_supers(delayed_superblock_init, NULL);
5899 }
5900
5901 /* SELinux requires early initialization in order to label
5902    all processes and objects when they are created. */
5903 security_initcall(selinux_init);
5904
5905 #if defined(CONFIG_NETFILTER)
5906
5907 static struct nf_hook_ops selinux_ipv4_ops[] = {
5908         {
5909                 .hook =         selinux_ipv4_postroute,
5910                 .owner =        THIS_MODULE,
5911                 .pf =           NFPROTO_IPV4,
5912                 .hooknum =      NF_INET_POST_ROUTING,
5913                 .priority =     NF_IP_PRI_SELINUX_LAST,
5914         },
5915         {
5916                 .hook =         selinux_ipv4_forward,
5917                 .owner =        THIS_MODULE,
5918                 .pf =           NFPROTO_IPV4,
5919                 .hooknum =      NF_INET_FORWARD,
5920                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5921         },
5922         {
5923                 .hook =         selinux_ipv4_output,
5924                 .owner =        THIS_MODULE,
5925                 .pf =           NFPROTO_IPV4,
5926                 .hooknum =      NF_INET_LOCAL_OUT,
5927                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5928         }
5929 };
5930
5931 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5932
5933 static struct nf_hook_ops selinux_ipv6_ops[] = {
5934         {
5935                 .hook =         selinux_ipv6_postroute,
5936                 .owner =        THIS_MODULE,
5937                 .pf =           NFPROTO_IPV6,
5938                 .hooknum =      NF_INET_POST_ROUTING,
5939                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5940         },
5941         {
5942                 .hook =         selinux_ipv6_forward,
5943                 .owner =        THIS_MODULE,
5944                 .pf =           NFPROTO_IPV6,
5945                 .hooknum =      NF_INET_FORWARD,
5946                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5947         }
5948 };
5949
5950 #endif  /* IPV6 */
5951
5952 static int __init selinux_nf_ip_init(void)
5953 {
5954         int err = 0;
5955
5956         if (!selinux_enabled)
5957                 goto out;
5958
5959         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5960
5961         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5962         if (err)
5963                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5964
5965 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5966         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5967         if (err)
5968                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5969 #endif  /* IPV6 */
5970
5971 out:
5972         return err;
5973 }
5974
5975 __initcall(selinux_nf_ip_init);
5976
5977 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5978 static void selinux_nf_ip_exit(void)
5979 {
5980         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5981
5982         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5983 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5984         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5985 #endif  /* IPV6 */
5986 }
5987 #endif
5988
5989 #else /* CONFIG_NETFILTER */
5990
5991 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5992 #define selinux_nf_ip_exit()
5993 #endif
5994
5995 #endif /* CONFIG_NETFILTER */
5996
5997 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5998 static int selinux_disabled;
5999
6000 int selinux_disable(void)
6001 {
6002         if (ss_initialized) {
6003                 /* Not permitted after initial policy load. */
6004                 return -EINVAL;
6005         }
6006
6007         if (selinux_disabled) {
6008                 /* Only do this once. */
6009                 return -EINVAL;
6010         }
6011
6012         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6013
6014         selinux_disabled = 1;
6015         selinux_enabled = 0;
6016
6017         reset_security_ops();
6018
6019         /* Try to destroy the avc node cache */
6020         avc_disable();
6021
6022         /* Unregister netfilter hooks. */
6023         selinux_nf_ip_exit();
6024
6025         /* Unregister selinuxfs. */
6026         exit_sel_fs();
6027
6028         return 0;
6029 }
6030 #endif