security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         spin_lock(&sbsec->isec_lock);
 259         if (!list_empty(&isec->list))
 260                 list_del_init(&isec->list);
 261         spin_unlock(&sbsec->isec_lock);
 262
 263         /*
 264          * The inode may still be referenced in a path walk and
 265          * a call to selinux_inode_permission() can be made
 266          * after inode_free_security() is called. Ideally, the VFS
 267          * wouldn't do this, but fixing that is a much harder
 268          * job. For now, simply free the i_security via RCU, and
 269          * leave the current inode->i_security pointer intact.
 270          * The inode will be freed after the RCU grace period too.
 271          */
 272         call_rcu(&isec->rcu, inode_free_rcu);
 273 }
 274
 275 static int file_alloc_security(struct file *file)
 276 {
 277         struct file_security_struct *fsec;
 278         u32 sid = current_sid();
 279
 280         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 281         if (!fsec)
 282                 return -ENOMEM;
 283
 284         fsec->sid = sid;
 285         fsec->fown_sid = sid;
 286         file->f_security = fsec;
 287
 288         return 0;
 289 }
 290
 291 static void file_free_security(struct file *file)
 292 {
 293         struct file_security_struct *fsec = file->f_security;
 294         file->f_security = NULL;
 295         kfree(fsec);
 296 }
 297
 298 static int superblock_alloc_security(struct super_block *sb)
 299 {
 300         struct superblock_security_struct *sbsec;
 301
 302         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 303         if (!sbsec)
 304                 return -ENOMEM;
 305
 306         mutex_init(&sbsec->lock);
 307         INIT_LIST_HEAD(&sbsec->isec_head);
 308         spin_lock_init(&sbsec->isec_lock);
 309         sbsec->sb = sb;
 310         sbsec->sid = SECINITSID_UNLABELED;
 311         sbsec->def_sid = SECINITSID_FILE;
 312         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 313         sb->s_security = sbsec;
 314
 315         return 0;
 316 }
 317
 318 static void superblock_free_security(struct super_block *sb)
 319 {
 320         struct superblock_security_struct *sbsec = sb->s_security;
 321         sb->s_security = NULL;
 322         kfree(sbsec);
 323 }
 324
 325 /* The file system's label must be initialized prior to use. */
 326
 327 static const char *labeling_behaviors[7] = {
 328         "uses xattr",
 329         "uses transition SIDs",
 330         "uses task SIDs",
 331         "uses genfs_contexts",
 332         "not configured for labeling",
 333         "uses mountpoint labeling",
 334         "uses native labeling",
 335 };
 336
 337 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 338
 339 static inline int inode_doinit(struct inode *inode)
 340 {
 341         return inode_doinit_with_dentry(inode, NULL);
 342 }
 343
 344 enum {
 345         Opt_error = -1,
 346         Opt_context = 1,
 347         Opt_fscontext = 2,
 348         Opt_defcontext = 3,
 349         Opt_rootcontext = 4,
 350         Opt_labelsupport = 5,
 351         Opt_nextmntopt = 6,
 352 };
 353
 354 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 355
 356 static const match_table_t tokens = {
 357         {Opt_context, CONTEXT_STR "%s"},
 358         {Opt_fscontext, FSCONTEXT_STR "%s"},
 359         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 360         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 361         {Opt_labelsupport, LABELSUPP_STR},
 362         {Opt_error, NULL},
 363 };
 364
 365 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 366
 367 static int may_context_mount_sb_relabel(u32 sid,
 368                         struct superblock_security_struct *sbsec,
 369                         const struct cred *cred)
 370 {
 371         const struct task_security_struct *tsec = cred->security;
 372         int rc;
 373
 374         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 375                           FILESYSTEM__RELABELFROM, NULL);
 376         if (rc)
 377                 return rc;
 378
 379         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 380                           FILESYSTEM__RELABELTO, NULL);
 381         return rc;
 382 }
 383
 384 static int may_context_mount_inode_relabel(u32 sid,
 385                         struct superblock_security_struct *sbsec,
 386                         const struct cred *cred)
 387 {
 388         const struct task_security_struct *tsec = cred->security;
 389         int rc;
 390         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELFROM, NULL);
 392         if (rc)
 393                 return rc;
 394
 395         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 396                           FILESYSTEM__ASSOCIATE, NULL);
 397         return rc;
 398 }
 399
 400 static int selinux_is_sblabel_mnt(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403
 404         if (sbsec->behavior == SECURITY_FS_USE_XATTR ||
 405             sbsec->behavior == SECURITY_FS_USE_TRANS ||
 406             sbsec->behavior == SECURITY_FS_USE_TASK)
 407                 return 1;
 408
 409         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 410         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 411                 return 1;
 412
 413         /*
 414          * Special handling for rootfs. Is genfs but supports
 415          * setting SELinux context on in-core inodes.
 416          */
 417         if (strncmp(sb->s_type->name, "rootfs", sizeof("rootfs")) == 0)
 418                 return 1;
 419
 420         return 0;
 421 }
 422
 423 static int sb_finish_set_opts(struct super_block *sb)
 424 {
 425         struct superblock_security_struct *sbsec = sb->s_security;
 426         struct dentry *root = sb->s_root;
 427         struct inode *root_inode = root->d_inode;
 428         int rc = 0;
 429
 430         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 431                 /* Make sure that the xattr handler exists and that no
 432                    error other than -ENODATA is returned by getxattr on
 433                    the root directory.  -ENODATA is ok, as this may be
 434                    the first boot of the SELinux kernel before we have
 435                    assigned xattr values to the filesystem. */
 436                 if (!root_inode->i_op->getxattr) {
 437                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 438                                "xattr support\n", sb->s_id, sb->s_type->name);
 439                         rc = -EOPNOTSUPP;
 440                         goto out;
 441                 }
 442                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 443                 if (rc < 0 && rc != -ENODATA) {
 444                         if (rc == -EOPNOTSUPP)
 445                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 446                                        "%s) has no security xattr handler\n",
 447                                        sb->s_id, sb->s_type->name);
 448                         else
 449                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 450                                        "%s) getxattr errno %d\n", sb->s_id,
 451                                        sb->s_type->name, -rc);
 452                         goto out;
 453                 }
 454         }
 455
 456         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 457                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 458                        sb->s_id, sb->s_type->name);
 459         else
 460                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 461                        sb->s_id, sb->s_type->name,
 462                        labeling_behaviors[sbsec->behavior-1]);
 463
 464         sbsec->flags |= SE_SBINITIALIZED;
 465         if (selinux_is_sblabel_mnt(sb))
 466                 sbsec->flags |= SBLABEL_MNT;
 467
 468         /* Initialize the root inode. */
 469         rc = inode_doinit_with_dentry(root_inode, root);
 470
 471         /* Initialize any other inodes associated with the superblock, e.g.
 472            inodes created prior to initial policy load or inodes created
 473            during get_sb by a pseudo filesystem that directly
 474            populates itself. */
 475         spin_lock(&sbsec->isec_lock);
 476 next_inode:
 477         if (!list_empty(&sbsec->isec_head)) {
 478                 struct inode_security_struct *isec =
 479                                 list_entry(sbsec->isec_head.next,
 480                                            struct inode_security_struct, list);
 481                 struct inode *inode = isec->inode;
 482                 list_del_init(&isec->list);
 483                 spin_unlock(&sbsec->isec_lock);
 484                 inode = igrab(inode);
 485                 if (inode) {
 486                         if (!IS_PRIVATE(inode))
 487                                 inode_doinit(inode);
 488                         iput(inode);
 489                 }
 490                 spin_lock(&sbsec->isec_lock);
 491                 goto next_inode;
 492         }
 493         spin_unlock(&sbsec->isec_lock);
 494 out:
 495         return rc;
 496 }
 497
 498 /*
 499  * This function should allow an FS to ask what it's mount security
 500  * options were so it can use those later for submounts, displaying
 501  * mount options, or whatever.
 502  */
 503 static int selinux_get_mnt_opts(const struct super_block *sb,
 504                                 struct security_mnt_opts *opts)
 505 {
 506         int rc = 0, i;
 507         struct superblock_security_struct *sbsec = sb->s_security;
 508         char *context = NULL;
 509         u32 len;
 510         char tmp;
 511
 512         security_init_mnt_opts(opts);
 513
 514         if (!(sbsec->flags & SE_SBINITIALIZED))
 515                 return -EINVAL;
 516
 517         if (!ss_initialized)
 518                 return -EINVAL;
 519
 520         /* make sure we always check enough bits to cover the mask */
 521         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 522
 523         tmp = sbsec->flags & SE_MNTMASK;
 524         /* count the number of mount options for this sb */
 525         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 526                 if (tmp & 0x01)
 527                         opts->num_mnt_opts++;
 528                 tmp >>= 1;
 529         }
 530         /* Check if the Label support flag is set */
 531         if (sbsec->flags & SBLABEL_MNT)
 532                 opts->num_mnt_opts++;
 533
 534         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 535         if (!opts->mnt_opts) {
 536                 rc = -ENOMEM;
 537                 goto out_free;
 538         }
 539
 540         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 541         if (!opts->mnt_opts_flags) {
 542                 rc = -ENOMEM;
 543                 goto out_free;
 544         }
 545
 546         i = 0;
 547         if (sbsec->flags & FSCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & CONTEXT_MNT) {
 555                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 556                 if (rc)
 557                         goto out_free;
 558                 opts->mnt_opts[i] = context;
 559                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 560         }
 561         if (sbsec->flags & DEFCONTEXT_MNT) {
 562                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 563                 if (rc)
 564                         goto out_free;
 565                 opts->mnt_opts[i] = context;
 566                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 567         }
 568         if (sbsec->flags & ROOTCONTEXT_MNT) {
 569                 struct inode *root = sbsec->sb->s_root->d_inode;
 570                 struct inode_security_struct *isec = root->i_security;
 571
 572                 rc = security_sid_to_context(isec->sid, &context, &len);
 573                 if (rc)
 574                         goto out_free;
 575                 opts->mnt_opts[i] = context;
 576                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 577         }
 578         if (sbsec->flags & SBLABEL_MNT) {
 579                 opts->mnt_opts[i] = NULL;
 580                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 581         }
 582
 583         BUG_ON(i != opts->num_mnt_opts);
 584
 585         return 0;
 586
 587 out_free:
 588         security_free_mnt_opts(opts);
 589         return rc;
 590 }
 591
 592 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 593                       u32 old_sid, u32 new_sid)
 594 {
 595         char mnt_flags = sbsec->flags & SE_MNTMASK;
 596
 597         /* check if the old mount command had the same options */
 598         if (sbsec->flags & SE_SBINITIALIZED)
 599                 if (!(sbsec->flags & flag) ||
 600                     (old_sid != new_sid))
 601                         return 1;
 602
 603         /* check if we were passed the same options twice,
 604          * aka someone passed context=a,context=b
 605          */
 606         if (!(sbsec->flags & SE_SBINITIALIZED))
 607                 if (mnt_flags & flag)
 608                         return 1;
 609         return 0;
 610 }
 611
 612 /*
 613  * Allow filesystems with binary mount data to explicitly set mount point
 614  * labeling information.
 615  */
 616 static int selinux_set_mnt_opts(struct super_block *sb,
 617                                 struct security_mnt_opts *opts,
 618                                 unsigned long kern_flags,
 619                                 unsigned long *set_kern_flags)
 620 {
 621         const struct cred *cred = current_cred();
 622         int rc = 0, i;
 623         struct superblock_security_struct *sbsec = sb->s_security;
 624         const char *name = sb->s_type->name;
 625         struct inode *inode = sbsec->sb->s_root->d_inode;
 626         struct inode_security_struct *root_isec = inode->i_security;
 627         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 628         u32 defcontext_sid = 0;
 629         char **mount_options = opts->mnt_opts;
 630         int *flags = opts->mnt_opts_flags;
 631         int num_opts = opts->num_mnt_opts;
 632
 633         mutex_lock(&sbsec->lock);
 634
 635         if (!ss_initialized) {
 636                 if (!num_opts) {
 637                         /* Defer initialization until selinux_complete_init,
 638                            after the initial policy is loaded and the security
 639                            server is ready to handle calls. */
 640                         goto out;
 641                 }
 642                 rc = -EINVAL;
 643                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 644                         "before the security server is initialized\n");
 645                 goto out;
 646         }
 647         if (kern_flags && !set_kern_flags) {
 648                 /* Specifying internal flags without providing a place to
 649                  * place the results is not allowed */
 650                 rc = -EINVAL;
 651                 goto out;
 652         }
 653
 654         /*
 655          * Binary mount data FS will come through this function twice.  Once
 656          * from an explicit call and once from the generic calls from the vfs.
 657          * Since the generic VFS calls will not contain any security mount data
 658          * we need to skip the double mount verification.
 659          *
 660          * This does open a hole in which we will not notice if the first
 661          * mount using this sb set explict options and a second mount using
 662          * this sb does not set any security options.  (The first options
 663          * will be used for both mounts)
 664          */
 665         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 666             && (num_opts == 0))
 667                 goto out;
 668
 669         /*
 670          * parse the mount options, check if they are valid sids.
 671          * also check if someone is trying to mount the same sb more
 672          * than once with different security options.
 673          */
 674         for (i = 0; i < num_opts; i++) {
 675                 u32 sid;
 676
 677                 if (flags[i] == SBLABEL_MNT)
 678                         continue;
 679                 rc = security_context_to_sid(mount_options[i],
 680                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 681                 if (rc) {
 682                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 683                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 684                                mount_options[i], sb->s_id, name, rc);
 685                         goto out;
 686                 }
 687                 switch (flags[i]) {
 688                 case FSCONTEXT_MNT:
 689                         fscontext_sid = sid;
 690
 691                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 692                                         fscontext_sid))
 693                                 goto out_double_mount;
 694
 695                         sbsec->flags |= FSCONTEXT_MNT;
 696                         break;
 697                 case CONTEXT_MNT:
 698                         context_sid = sid;
 699
 700                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 701                                         context_sid))
 702                                 goto out_double_mount;
 703
 704                         sbsec->flags |= CONTEXT_MNT;
 705                         break;
 706                 case ROOTCONTEXT_MNT:
 707                         rootcontext_sid = sid;
 708
 709                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 710                                         rootcontext_sid))
 711                                 goto out_double_mount;
 712
 713                         sbsec->flags |= ROOTCONTEXT_MNT;
 714
 715                         break;
 716                 case DEFCONTEXT_MNT:
 717                         defcontext_sid = sid;
 718
 719                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 720                                         defcontext_sid))
 721                                 goto out_double_mount;
 722
 723                         sbsec->flags |= DEFCONTEXT_MNT;
 724
 725                         break;
 726                 default:
 727                         rc = -EINVAL;
 728                         goto out;
 729                 }
 730         }
 731
 732         if (sbsec->flags & SE_SBINITIALIZED) {
 733                 /* previously mounted with options, but not on this attempt? */
 734                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 735                         goto out_double_mount;
 736                 rc = 0;
 737                 goto out;
 738         }
 739
 740         if (strcmp(sb->s_type->name, "proc") == 0)
 741                 sbsec->flags |= SE_SBPROC;
 742
 743         if (!sbsec->behavior) {
 744                 /*
 745                  * Determine the labeling behavior to use for this
 746                  * filesystem type.
 747                  */
 748                 rc = security_fs_use(sb);
 749                 if (rc) {
 750                         printk(KERN_WARNING
 751                                 "%s: security_fs_use(%s) returned %d\n",
 752                                         __func__, sb->s_type->name, rc);
 753                         goto out;
 754                 }
 755         }
 756         /* sets the context of the superblock for the fs being mounted. */
 757         if (fscontext_sid) {
 758                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 759                 if (rc)
 760                         goto out;
 761
 762                 sbsec->sid = fscontext_sid;
 763         }
 764
 765         /*
 766          * Switch to using mount point labeling behavior.
 767          * sets the label used on all file below the mountpoint, and will set
 768          * the superblock context if not already set.
 769          */
 770         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 771                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 772                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 773         }
 774
 775         if (context_sid) {
 776                 if (!fscontext_sid) {
 777                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 778                                                           cred);
 779                         if (rc)
 780                                 goto out;
 781                         sbsec->sid = context_sid;
 782                 } else {
 783                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 784                                                              cred);
 785                         if (rc)
 786                                 goto out;
 787                 }
 788                 if (!rootcontext_sid)
 789                         rootcontext_sid = context_sid;
 790
 791                 sbsec->mntpoint_sid = context_sid;
 792                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 793         }
 794
 795         if (rootcontext_sid) {
 796                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 797                                                      cred);
 798                 if (rc)
 799                         goto out;
 800
 801                 root_isec->sid = rootcontext_sid;
 802                 root_isec->initialized = 1;
 803         }
 804
 805         if (defcontext_sid) {
 806                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 807                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 808                         rc = -EINVAL;
 809                         printk(KERN_WARNING "SELinux: defcontext option is "
 810                                "invalid for this filesystem type\n");
 811                         goto out;
 812                 }
 813
 814                 if (defcontext_sid != sbsec->def_sid) {
 815                         rc = may_context_mount_inode_relabel(defcontext_sid,
 816                                                              sbsec, cred);
 817                         if (rc)
 818                                 goto out;
 819                 }
 820
 821                 sbsec->def_sid = defcontext_sid;
 822         }
 823
 824         rc = sb_finish_set_opts(sb);
 825 out:
 826         mutex_unlock(&sbsec->lock);
 827         return rc;
 828 out_double_mount:
 829         rc = -EINVAL;
 830         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 831                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 832         goto out;
 833 }
 834
 835 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 836                                     const struct super_block *newsb)
 837 {
 838         struct superblock_security_struct *old = oldsb->s_security;
 839         struct superblock_security_struct *new = newsb->s_security;
 840         char oldflags = old->flags & SE_MNTMASK;
 841         char newflags = new->flags & SE_MNTMASK;
 842
 843         if (oldflags != newflags)
 844                 goto mismatch;
 845         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 846                 goto mismatch;
 847         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 848                 goto mismatch;
 849         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 850                 goto mismatch;
 851         if (oldflags & ROOTCONTEXT_MNT) {
 852                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 853                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 854                 if (oldroot->sid != newroot->sid)
 855                         goto mismatch;
 856         }
 857         return 0;
 858 mismatch:
 859         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 860                             "different security settings for (dev %s, "
 861                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 862         return -EBUSY;
 863 }
 864
 865 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 866                                         struct super_block *newsb)
 867 {
 868         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 869         struct superblock_security_struct *newsbsec = newsb->s_security;
 870
 871         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 872         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 873         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 874
 875         /*
 876          * if the parent was able to be mounted it clearly had no special lsm
 877          * mount options.  thus we can safely deal with this superblock later
 878          */
 879         if (!ss_initialized)
 880                 return 0;
 881
 882         /* how can we clone if the old one wasn't set up?? */
 883         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 884
 885         /* if fs is reusing a sb, make sure that the contexts match */
 886         if (newsbsec->flags & SE_SBINITIALIZED)
 887                 return selinux_cmp_sb_context(oldsb, newsb);
 888
 889         mutex_lock(&newsbsec->lock);
 890
 891         newsbsec->flags = oldsbsec->flags;
 892
 893         newsbsec->sid = oldsbsec->sid;
 894         newsbsec->def_sid = oldsbsec->def_sid;
 895         newsbsec->behavior = oldsbsec->behavior;
 896
 897         if (set_context) {
 898                 u32 sid = oldsbsec->mntpoint_sid;
 899
 900                 if (!set_fscontext)
 901                         newsbsec->sid = sid;
 902                 if (!set_rootcontext) {
 903                         struct inode *newinode = newsb->s_root->d_inode;
 904                         struct inode_security_struct *newisec = newinode->i_security;
 905                         newisec->sid = sid;
 906                 }
 907                 newsbsec->mntpoint_sid = sid;
 908         }
 909         if (set_rootcontext) {
 910                 const struct inode *oldinode = oldsb->s_root->d_inode;
 911                 const struct inode_security_struct *oldisec = oldinode->i_security;
 912                 struct inode *newinode = newsb->s_root->d_inode;
 913                 struct inode_security_struct *newisec = newinode->i_security;
 914
 915                 newisec->sid = oldisec->sid;
 916         }
 917
 918         sb_finish_set_opts(newsb);
 919         mutex_unlock(&newsbsec->lock);
 920         return 0;
 921 }
 922
 923 static int selinux_parse_opts_str(char *options,
 924                                   struct security_mnt_opts *opts)
 925 {
 926         char *p;
 927         char *context = NULL, *defcontext = NULL;
 928         char *fscontext = NULL, *rootcontext = NULL;
 929         int rc, num_mnt_opts = 0;
 930
 931         opts->num_mnt_opts = 0;
 932
 933         /* Standard string-based options. */
 934         while ((p = strsep(&options, "|")) != NULL) {
 935                 int token;
 936                 substring_t args[MAX_OPT_ARGS];
 937
 938                 if (!*p)
 939                         continue;
 940
 941                 token = match_token(p, tokens, args);
 942
 943                 switch (token) {
 944                 case Opt_context:
 945                         if (context || defcontext) {
 946                                 rc = -EINVAL;
 947                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 948                                 goto out_err;
 949                         }
 950                         context = match_strdup(&args[0]);
 951                         if (!context) {
 952                                 rc = -ENOMEM;
 953                                 goto out_err;
 954                         }
 955                         break;
 956
 957                 case Opt_fscontext:
 958                         if (fscontext) {
 959                                 rc = -EINVAL;
 960                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 961                                 goto out_err;
 962                         }
 963                         fscontext = match_strdup(&args[0]);
 964                         if (!fscontext) {
 965                                 rc = -ENOMEM;
 966                                 goto out_err;
 967                         }
 968                         break;
 969
 970                 case Opt_rootcontext:
 971                         if (rootcontext) {
 972                                 rc = -EINVAL;
 973                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 974                                 goto out_err;
 975                         }
 976                         rootcontext = match_strdup(&args[0]);
 977                         if (!rootcontext) {
 978                                 rc = -ENOMEM;
 979                                 goto out_err;
 980                         }
 981                         break;
 982
 983                 case Opt_defcontext:
 984                         if (context || defcontext) {
 985                                 rc = -EINVAL;
 986                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 987                                 goto out_err;
 988                         }
 989                         defcontext = match_strdup(&args[0]);
 990                         if (!defcontext) {
 991                                 rc = -ENOMEM;
 992                                 goto out_err;
 993                         }
 994                         break;
 995                 case Opt_labelsupport:
 996                         break;
 997                 default:
 998                         rc = -EINVAL;
 999                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1000                         goto out_err;
1001
1002                 }
1003         }
1004
1005         rc = -ENOMEM;
1006         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1007         if (!opts->mnt_opts)
1008                 goto out_err;
1009
1010         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1011         if (!opts->mnt_opts_flags) {
1012                 kfree(opts->mnt_opts);
1013                 goto out_err;
1014         }
1015
1016         if (fscontext) {
1017                 opts->mnt_opts[num_mnt_opts] = fscontext;
1018                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1019         }
1020         if (context) {
1021                 opts->mnt_opts[num_mnt_opts] = context;
1022                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1023         }
1024         if (rootcontext) {
1025                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1026                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1027         }
1028         if (defcontext) {
1029                 opts->mnt_opts[num_mnt_opts] = defcontext;
1030                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1031         }
1032
1033         opts->num_mnt_opts = num_mnt_opts;
1034         return 0;
1035
1036 out_err:
1037         kfree(context);
1038         kfree(defcontext);
1039         kfree(fscontext);
1040         kfree(rootcontext);
1041         return rc;
1042 }
1043 /*
1044  * string mount options parsing and call set the sbsec
1045  */
1046 static int superblock_doinit(struct super_block *sb, void *data)
1047 {
1048         int rc = 0;
1049         char *options = data;
1050         struct security_mnt_opts opts;
1051
1052         security_init_mnt_opts(&opts);
1053
1054         if (!data)
1055                 goto out;
1056
1057         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1058
1059         rc = selinux_parse_opts_str(options, &opts);
1060         if (rc)
1061                 goto out_err;
1062
1063 out:
1064         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1065
1066 out_err:
1067         security_free_mnt_opts(&opts);
1068         return rc;
1069 }
1070
1071 static void selinux_write_opts(struct seq_file *m,
1072                                struct security_mnt_opts *opts)
1073 {
1074         int i;
1075         char *prefix;
1076
1077         for (i = 0; i < opts->num_mnt_opts; i++) {
1078                 char *has_comma;
1079
1080                 if (opts->mnt_opts[i])
1081                         has_comma = strchr(opts->mnt_opts[i], ',');
1082                 else
1083                         has_comma = NULL;
1084
1085                 switch (opts->mnt_opts_flags[i]) {
1086                 case CONTEXT_MNT:
1087                         prefix = CONTEXT_STR;
1088                         break;
1089                 case FSCONTEXT_MNT:
1090                         prefix = FSCONTEXT_STR;
1091                         break;
1092                 case ROOTCONTEXT_MNT:
1093                         prefix = ROOTCONTEXT_STR;
1094                         break;
1095                 case DEFCONTEXT_MNT:
1096                         prefix = DEFCONTEXT_STR;
1097                         break;
1098                 case SBLABEL_MNT:
1099                         seq_putc(m, ',');
1100                         seq_puts(m, LABELSUPP_STR);
1101                         continue;
1102                 default:
1103                         BUG();
1104                         return;
1105                 };
1106                 /* we need a comma before each option */
1107                 seq_putc(m, ',');
1108                 seq_puts(m, prefix);
1109                 if (has_comma)
1110                         seq_putc(m, '\"');
1111                 seq_puts(m, opts->mnt_opts[i]);
1112                 if (has_comma)
1113                         seq_putc(m, '\"');
1114         }
1115 }
1116
1117 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1118 {
1119         struct security_mnt_opts opts;
1120         int rc;
1121
1122         rc = selinux_get_mnt_opts(sb, &opts);
1123         if (rc) {
1124                 /* before policy load we may get EINVAL, don't show anything */
1125                 if (rc == -EINVAL)
1126                         rc = 0;
1127                 return rc;
1128         }
1129
1130         selinux_write_opts(m, &opts);
1131
1132         security_free_mnt_opts(&opts);
1133
1134         return rc;
1135 }
1136
1137 static inline u16 inode_mode_to_security_class(umode_t mode)
1138 {
1139         switch (mode & S_IFMT) {
1140         case S_IFSOCK:
1141                 return SECCLASS_SOCK_FILE;
1142         case S_IFLNK:
1143                 return SECCLASS_LNK_FILE;
1144         case S_IFREG:
1145                 return SECCLASS_FILE;
1146         case S_IFBLK:
1147                 return SECCLASS_BLK_FILE;
1148         case S_IFDIR:
1149                 return SECCLASS_DIR;
1150         case S_IFCHR:
1151                 return SECCLASS_CHR_FILE;
1152         case S_IFIFO:
1153                 return SECCLASS_FIFO_FILE;
1154
1155         }
1156
1157         return SECCLASS_FILE;
1158 }
1159
1160 static inline int default_protocol_stream(int protocol)
1161 {
1162         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1163 }
1164
1165 static inline int default_protocol_dgram(int protocol)
1166 {
1167         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1168 }
1169
1170 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1171 {
1172         switch (family) {
1173         case PF_UNIX:
1174                 switch (type) {
1175                 case SOCK_STREAM:
1176                 case SOCK_SEQPACKET:
1177                         return SECCLASS_UNIX_STREAM_SOCKET;
1178                 case SOCK_DGRAM:
1179                         return SECCLASS_UNIX_DGRAM_SOCKET;
1180                 }
1181                 break;
1182         case PF_INET:
1183         case PF_INET6:
1184                 switch (type) {
1185                 case SOCK_STREAM:
1186                         if (default_protocol_stream(protocol))
1187                                 return SECCLASS_TCP_SOCKET;
1188                         else
1189                                 return SECCLASS_RAWIP_SOCKET;
1190                 case SOCK_DGRAM:
1191                         if (default_protocol_dgram(protocol))
1192                                 return SECCLASS_UDP_SOCKET;
1193                         else
1194                                 return SECCLASS_RAWIP_SOCKET;
1195                 case SOCK_DCCP:
1196                         return SECCLASS_DCCP_SOCKET;
1197                 default:
1198                         return SECCLASS_RAWIP_SOCKET;
1199                 }
1200                 break;
1201         case PF_NETLINK:
1202                 switch (protocol) {
1203                 case NETLINK_ROUTE:
1204                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1205                 case NETLINK_FIREWALL:
1206                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1207                 case NETLINK_SOCK_DIAG:
1208                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1209                 case NETLINK_NFLOG:
1210                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1211                 case NETLINK_XFRM:
1212                         return SECCLASS_NETLINK_XFRM_SOCKET;
1213                 case NETLINK_SELINUX:
1214                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1215                 case NETLINK_AUDIT:
1216                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1217                 case NETLINK_IP6_FW:
1218                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1219                 case NETLINK_DNRTMSG:
1220                         return SECCLASS_NETLINK_DNRT_SOCKET;
1221                 case NETLINK_KOBJECT_UEVENT:
1222                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1223                 default:
1224                         return SECCLASS_NETLINK_SOCKET;
1225                 }
1226         case PF_PACKET:
1227                 return SECCLASS_PACKET_SOCKET;
1228         case PF_KEY:
1229                 return SECCLASS_KEY_SOCKET;
1230         case PF_APPLETALK:
1231                 return SECCLASS_APPLETALK_SOCKET;
1232         }
1233
1234         return SECCLASS_SOCKET;
1235 }
1236
1237 #ifdef CONFIG_PROC_FS
1238 static int selinux_proc_get_sid(struct dentry *dentry,
1239                                 u16 tclass,
1240                                 u32 *sid)
1241 {
1242         int rc;
1243         char *buffer, *path;
1244
1245         buffer = (char *)__get_free_page(GFP_KERNEL);
1246         if (!buffer)
1247                 return -ENOMEM;
1248
1249         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1250         if (IS_ERR(path))
1251                 rc = PTR_ERR(path);
1252         else {
1253                 /* each process gets a /proc/PID/ entry. Strip off the
1254                  * PID part to get a valid selinux labeling.
1255                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1256                 while (path[1] >= '0' && path[1] <= '9') {
1257                         path[1] = '/';
1258                         path++;
1259                 }
1260                 rc = security_genfs_sid("proc", path, tclass, sid);
1261         }
1262         free_page((unsigned long)buffer);
1263         return rc;
1264 }
1265 #else
1266 static int selinux_proc_get_sid(struct dentry *dentry,
1267                                 u16 tclass,
1268                                 u32 *sid)
1269 {
1270         return -EINVAL;
1271 }
1272 #endif
1273
1274 /* The inode's security attributes must be initialized before first use. */
1275 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1276 {
1277         struct superblock_security_struct *sbsec = NULL;
1278         struct inode_security_struct *isec = inode->i_security;
1279         u32 sid;
1280         struct dentry *dentry;
1281 #define INITCONTEXTLEN 255
1282         char *context = NULL;
1283         unsigned len = 0;
1284         int rc = 0;
1285
1286         if (isec->initialized)
1287                 goto out;
1288
1289         mutex_lock(&isec->lock);
1290         if (isec->initialized)
1291                 goto out_unlock;
1292
1293         sbsec = inode->i_sb->s_security;
1294         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1295                 /* Defer initialization until selinux_complete_init,
1296                    after the initial policy is loaded and the security
1297                    server is ready to handle calls. */
1298                 spin_lock(&sbsec->isec_lock);
1299                 if (list_empty(&isec->list))
1300                         list_add(&isec->list, &sbsec->isec_head);
1301                 spin_unlock(&sbsec->isec_lock);
1302                 goto out_unlock;
1303         }
1304
1305         switch (sbsec->behavior) {
1306         case SECURITY_FS_USE_NATIVE:
1307                 break;
1308         case SECURITY_FS_USE_XATTR:
1309                 if (!inode->i_op->getxattr) {
1310                         isec->sid = sbsec->def_sid;
1311                         break;
1312                 }
1313
1314                 /* Need a dentry, since the xattr API requires one.
1315                    Life would be simpler if we could just pass the inode. */
1316                 if (opt_dentry) {
1317                         /* Called from d_instantiate or d_splice_alias. */
1318                         dentry = dget(opt_dentry);
1319                 } else {
1320                         /* Called from selinux_complete_init, try to find a dentry. */
1321                         dentry = d_find_alias(inode);
1322                 }
1323                 if (!dentry) {
1324                         /*
1325                          * this is can be hit on boot when a file is accessed
1326                          * before the policy is loaded.  When we load policy we
1327                          * may find inodes that have no dentry on the
1328                          * sbsec->isec_head list.  No reason to complain as these
1329                          * will get fixed up the next time we go through
1330                          * inode_doinit with a dentry, before these inodes could
1331                          * be used again by userspace.
1332                          */
1333                         goto out_unlock;
1334                 }
1335
1336                 len = INITCONTEXTLEN;
1337                 context = kmalloc(len+1, GFP_NOFS);
1338                 if (!context) {
1339                         rc = -ENOMEM;
1340                         dput(dentry);
1341                         goto out_unlock;
1342                 }
1343                 context[len] = '\0';
1344                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1345                                            context, len);
1346                 if (rc == -ERANGE) {
1347                         kfree(context);
1348
1349                         /* Need a larger buffer.  Query for the right size. */
1350                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1351                                                    NULL, 0);
1352                         if (rc < 0) {
1353                                 dput(dentry);
1354                                 goto out_unlock;
1355                         }
1356                         len = rc;
1357                         context = kmalloc(len+1, GFP_NOFS);
1358                         if (!context) {
1359                                 rc = -ENOMEM;
1360                                 dput(dentry);
1361                                 goto out_unlock;
1362                         }
1363                         context[len] = '\0';
1364                         rc = inode->i_op->getxattr(dentry,
1365                                                    XATTR_NAME_SELINUX,
1366                                                    context, len);
1367                 }
1368                 dput(dentry);
1369                 if (rc < 0) {
1370                         if (rc != -ENODATA) {
1371                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1372                                        "%d for dev=%s ino=%ld\n", __func__,
1373                                        -rc, inode->i_sb->s_id, inode->i_ino);
1374                                 kfree(context);
1375                                 goto out_unlock;
1376                         }
1377                         /* Map ENODATA to the default file SID */
1378                         sid = sbsec->def_sid;
1379                         rc = 0;
1380                 } else {
1381                         rc = security_context_to_sid_default(context, rc, &sid,
1382                                                              sbsec->def_sid,
1383                                                              GFP_NOFS);
1384                         if (rc) {
1385                                 char *dev = inode->i_sb->s_id;
1386                                 unsigned long ino = inode->i_ino;
1387
1388                                 if (rc == -EINVAL) {
1389                                         if (printk_ratelimit())
1390                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1391                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1392                                                         "filesystem in question.\n", ino, dev, context);
1393                                 } else {
1394                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1395                                                "returned %d for dev=%s ino=%ld\n",
1396                                                __func__, context, -rc, dev, ino);
1397                                 }
1398                                 kfree(context);
1399                                 /* Leave with the unlabeled SID */
1400                                 rc = 0;
1401                                 break;
1402                         }
1403                 }
1404                 kfree(context);
1405                 isec->sid = sid;
1406                 break;
1407         case SECURITY_FS_USE_TASK:
1408                 isec->sid = isec->task_sid;
1409                 break;
1410         case SECURITY_FS_USE_TRANS:
1411                 /* Default to the fs SID. */
1412                 isec->sid = sbsec->sid;
1413
1414                 /* Try to obtain a transition SID. */
1415                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1416                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1417                                              isec->sclass, NULL, &sid);
1418                 if (rc)
1419                         goto out_unlock;
1420                 isec->sid = sid;
1421                 break;
1422         case SECURITY_FS_USE_MNTPOINT:
1423                 isec->sid = sbsec->mntpoint_sid;
1424                 break;
1425         default:
1426                 /* Default to the fs superblock SID. */
1427                 isec->sid = sbsec->sid;
1428
1429                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1430                         /* We must have a dentry to determine the label on
1431                          * procfs inodes */
1432                         if (opt_dentry)
1433                                 /* Called from d_instantiate or
1434                                  * d_splice_alias. */
1435                                 dentry = dget(opt_dentry);
1436                         else
1437                                 /* Called from selinux_complete_init, try to
1438                                  * find a dentry. */
1439                                 dentry = d_find_alias(inode);
1440                         /*
1441                          * This can be hit on boot when a file is accessed
1442                          * before the policy is loaded.  When we load policy we
1443                          * may find inodes that have no dentry on the
1444                          * sbsec->isec_head list.  No reason to complain as
1445                          * these will get fixed up the next time we go through
1446                          * inode_doinit() with a dentry, before these inodes
1447                          * could be used again by userspace.
1448                          */
1449                         if (!dentry)
1450                                 goto out_unlock;
1451                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1452                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1453                         dput(dentry);
1454                         if (rc)
1455                                 goto out_unlock;
1456                         isec->sid = sid;
1457                 }
1458                 break;
1459         }
1460
1461         isec->initialized = 1;
1462
1463 out_unlock:
1464         mutex_unlock(&isec->lock);
1465 out:
1466         if (isec->sclass == SECCLASS_FILE)
1467                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1468         return rc;
1469 }
1470
1471 /* Convert a Linux signal to an access vector. */
1472 static inline u32 signal_to_av(int sig)
1473 {
1474         u32 perm = 0;
1475
1476         switch (sig) {
1477         case SIGCHLD:
1478                 /* Commonly granted from child to parent. */
1479                 perm = PROCESS__SIGCHLD;
1480                 break;
1481         case SIGKILL:
1482                 /* Cannot be caught or ignored */
1483                 perm = PROCESS__SIGKILL;
1484                 break;
1485         case SIGSTOP:
1486                 /* Cannot be caught or ignored */
1487                 perm = PROCESS__SIGSTOP;
1488                 break;
1489         default:
1490                 /* All other signals. */
1491                 perm = PROCESS__SIGNAL;
1492                 break;
1493         }
1494
1495         return perm;
1496 }
1497
1498 /*
1499  * Check permission between a pair of credentials
1500  * fork check, ptrace check, etc.
1501  */
1502 static int cred_has_perm(const struct cred *actor,
1503                          const struct cred *target,
1504                          u32 perms)
1505 {
1506         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1507
1508         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1509 }
1510
1511 /*
1512  * Check permission between a pair of tasks, e.g. signal checks,
1513  * fork check, ptrace check, etc.
1514  * tsk1 is the actor and tsk2 is the target
1515  * - this uses the default subjective creds of tsk1
1516  */
1517 static int task_has_perm(const struct task_struct *tsk1,
1518                          const struct task_struct *tsk2,
1519                          u32 perms)
1520 {
1521         const struct task_security_struct *__tsec1, *__tsec2;
1522         u32 sid1, sid2;
1523
1524         rcu_read_lock();
1525         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1526         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1527         rcu_read_unlock();
1528         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1529 }
1530
1531 /*
1532  * Check permission between current and another task, e.g. signal checks,
1533  * fork check, ptrace check, etc.
1534  * current is the actor and tsk2 is the target
1535  * - this uses current's subjective creds
1536  */
1537 static int current_has_perm(const struct task_struct *tsk,
1538                             u32 perms)
1539 {
1540         u32 sid, tsid;
1541
1542         sid = current_sid();
1543         tsid = task_sid(tsk);
1544         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1545 }
1546
1547 #if CAP_LAST_CAP > 63
1548 #error Fix SELinux to handle capabilities > 63.
1549 #endif
1550
1551 /* Check whether a task is allowed to use a capability. */
1552 static int cred_has_capability(const struct cred *cred,
1553                                int cap, int audit)
1554 {
1555         struct common_audit_data ad;
1556         struct av_decision avd;
1557         u16 sclass;
1558         u32 sid = cred_sid(cred);
1559         u32 av = CAP_TO_MASK(cap);
1560         int rc;
1561
1562         ad.type = LSM_AUDIT_DATA_CAP;
1563         ad.u.cap = cap;
1564
1565         switch (CAP_TO_INDEX(cap)) {
1566         case 0:
1567                 sclass = SECCLASS_CAPABILITY;
1568                 break;
1569         case 1:
1570                 sclass = SECCLASS_CAPABILITY2;
1571                 break;
1572         default:
1573                 printk(KERN_ERR
1574                        "SELinux:  out of range capability %d\n", cap);
1575                 BUG();
1576                 return -EINVAL;
1577         }
1578
1579         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1580         if (audit == SECURITY_CAP_AUDIT) {
1581                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1582                 if (rc2)
1583                         return rc2;
1584         }
1585         return rc;
1586 }
1587
1588 /* Check whether a task is allowed to use a system operation. */
1589 static int task_has_system(struct task_struct *tsk,
1590                            u32 perms)
1591 {
1592         u32 sid = task_sid(tsk);
1593
1594         return avc_has_perm(sid, SECINITSID_KERNEL,
1595                             SECCLASS_SYSTEM, perms, NULL);
1596 }
1597
1598 /* Check whether a task has a particular permission to an inode.
1599    The 'adp' parameter is optional and allows other audit
1600    data to be passed (e.g. the dentry). */
1601 static int inode_has_perm(const struct cred *cred,
1602                           struct inode *inode,
1603                           u32 perms,
1604                           struct common_audit_data *adp)
1605 {
1606         struct inode_security_struct *isec;
1607         u32 sid;
1608
1609         validate_creds(cred);
1610
1611         if (unlikely(IS_PRIVATE(inode)))
1612                 return 0;
1613
1614         sid = cred_sid(cred);
1615         isec = inode->i_security;
1616
1617         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1618 }
1619
1620 /* Same as inode_has_perm, but pass explicit audit data containing
1621    the dentry to help the auditing code to more easily generate the
1622    pathname if needed. */
1623 static inline int dentry_has_perm(const struct cred *cred,
1624                                   struct dentry *dentry,
1625                                   u32 av)
1626 {
1627         struct inode *inode = dentry->d_inode;
1628         struct common_audit_data ad;
1629
1630         ad.type = LSM_AUDIT_DATA_DENTRY;
1631         ad.u.dentry = dentry;
1632         return inode_has_perm(cred, inode, av, &ad);
1633 }
1634
1635 /* Same as inode_has_perm, but pass explicit audit data containing
1636    the path to help the auditing code to more easily generate the
1637    pathname if needed. */
1638 static inline int path_has_perm(const struct cred *cred,
1639                                 struct path *path,
1640                                 u32 av)
1641 {
1642         struct inode *inode = path->dentry->d_inode;
1643         struct common_audit_data ad;
1644
1645         ad.type = LSM_AUDIT_DATA_PATH;
1646         ad.u.path = *path;
1647         return inode_has_perm(cred, inode, av, &ad);
1648 }
1649
1650 /* Same as path_has_perm, but uses the inode from the file struct. */
1651 static inline int file_path_has_perm(const struct cred *cred,
1652                                      struct file *file,
1653                                      u32 av)
1654 {
1655         struct common_audit_data ad;
1656
1657         ad.type = LSM_AUDIT_DATA_PATH;
1658         ad.u.path = file->f_path;
1659         return inode_has_perm(cred, file_inode(file), av, &ad);
1660 }
1661
1662 /* Check whether a task can use an open file descriptor to
1663    access an inode in a given way.  Check access to the
1664    descriptor itself, and then use dentry_has_perm to
1665    check a particular permission to the file.
1666    Access to the descriptor is implicitly granted if it
1667    has the same SID as the process.  If av is zero, then
1668    access to the file is not checked, e.g. for cases
1669    where only the descriptor is affected like seek. */
1670 static int file_has_perm(const struct cred *cred,
1671                          struct file *file,
1672                          u32 av)
1673 {
1674         struct file_security_struct *fsec = file->f_security;
1675         struct inode *inode = file_inode(file);
1676         struct common_audit_data ad;
1677         u32 sid = cred_sid(cred);
1678         int rc;
1679
1680         ad.type = LSM_AUDIT_DATA_PATH;
1681         ad.u.path = file->f_path;
1682
1683         if (sid != fsec->sid) {
1684                 rc = avc_has_perm(sid, fsec->sid,
1685                                   SECCLASS_FD,
1686                                   FD__USE,
1687                                   &ad);
1688                 if (rc)
1689                         goto out;
1690         }
1691
1692         /* av is zero if only checking access to the descriptor. */
1693         rc = 0;
1694         if (av)
1695                 rc = inode_has_perm(cred, inode, av, &ad);
1696
1697 out:
1698         return rc;
1699 }
1700
1701 /* Check whether a task can create a file. */
1702 static int may_create(struct inode *dir,
1703                       struct dentry *dentry,
1704                       u16 tclass)
1705 {
1706         const struct task_security_struct *tsec = current_security();
1707         struct inode_security_struct *dsec;
1708         struct superblock_security_struct *sbsec;
1709         u32 sid, newsid;
1710         struct common_audit_data ad;
1711         int rc;
1712
1713         dsec = dir->i_security;
1714         sbsec = dir->i_sb->s_security;
1715
1716         sid = tsec->sid;
1717         newsid = tsec->create_sid;
1718
1719         ad.type = LSM_AUDIT_DATA_DENTRY;
1720         ad.u.dentry = dentry;
1721
1722         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1723                           DIR__ADD_NAME | DIR__SEARCH,
1724                           &ad);
1725         if (rc)
1726                 return rc;
1727
1728         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1729                 rc = security_transition_sid(sid, dsec->sid, tclass,
1730                                              &dentry->d_name, &newsid);
1731                 if (rc)
1732                         return rc;
1733         }
1734
1735         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1736         if (rc)
1737                 return rc;
1738
1739         return avc_has_perm(newsid, sbsec->sid,
1740                             SECCLASS_FILESYSTEM,
1741                             FILESYSTEM__ASSOCIATE, &ad);
1742 }
1743
1744 /* Check whether a task can create a key. */
1745 static int may_create_key(u32 ksid,
1746                           struct task_struct *ctx)
1747 {
1748         u32 sid = task_sid(ctx);
1749
1750         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1751 }
1752
1753 #define MAY_LINK        0
1754 #define MAY_UNLINK      1
1755 #define MAY_RMDIR       2
1756
1757 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1758 static int may_link(struct inode *dir,
1759                     struct dentry *dentry,
1760                     int kind)
1761
1762 {
1763         struct inode_security_struct *dsec, *isec;
1764         struct common_audit_data ad;
1765         u32 sid = current_sid();
1766         u32 av;
1767         int rc;
1768
1769         dsec = dir->i_security;
1770         isec = dentry->d_inode->i_security;
1771
1772         ad.type = LSM_AUDIT_DATA_DENTRY;
1773         ad.u.dentry = dentry;
1774
1775         av = DIR__SEARCH;
1776         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1777         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1778         if (rc)
1779                 return rc;
1780
1781         switch (kind) {
1782         case MAY_LINK:
1783                 av = FILE__LINK;
1784                 break;
1785         case MAY_UNLINK:
1786                 av = FILE__UNLINK;
1787                 break;
1788         case MAY_RMDIR:
1789                 av = DIR__RMDIR;
1790                 break;
1791         default:
1792                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1793                         __func__, kind);
1794                 return 0;
1795         }
1796
1797         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1798         return rc;
1799 }
1800
1801 static inline int may_rename(struct inode *old_dir,
1802                              struct dentry *old_dentry,
1803                              struct inode *new_dir,
1804                              struct dentry *new_dentry)
1805 {
1806         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1807         struct common_audit_data ad;
1808         u32 sid = current_sid();
1809         u32 av;
1810         int old_is_dir, new_is_dir;
1811         int rc;
1812
1813         old_dsec = old_dir->i_security;
1814         old_isec = old_dentry->d_inode->i_security;
1815         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1816         new_dsec = new_dir->i_security;
1817
1818         ad.type = LSM_AUDIT_DATA_DENTRY;
1819
1820         ad.u.dentry = old_dentry;
1821         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1822                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1823         if (rc)
1824                 return rc;
1825         rc = avc_has_perm(sid, old_isec->sid,
1826                           old_isec->sclass, FILE__RENAME, &ad);
1827         if (rc)
1828                 return rc;
1829         if (old_is_dir && new_dir != old_dir) {
1830                 rc = avc_has_perm(sid, old_isec->sid,
1831                                   old_isec->sclass, DIR__REPARENT, &ad);
1832                 if (rc)
1833                         return rc;
1834         }
1835
1836         ad.u.dentry = new_dentry;
1837         av = DIR__ADD_NAME | DIR__SEARCH;
1838         if (new_dentry->d_inode)
1839                 av |= DIR__REMOVE_NAME;
1840         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1841         if (rc)
1842                 return rc;
1843         if (new_dentry->d_inode) {
1844                 new_isec = new_dentry->d_inode->i_security;
1845                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1846                 rc = avc_has_perm(sid, new_isec->sid,
1847                                   new_isec->sclass,
1848                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1849                 if (rc)
1850                         return rc;
1851         }
1852
1853         return 0;
1854 }
1855
1856 /* Check whether a task can perform a filesystem operation. */
1857 static int superblock_has_perm(const struct cred *cred,
1858                                struct super_block *sb,
1859                                u32 perms,
1860                                struct common_audit_data *ad)
1861 {
1862         struct superblock_security_struct *sbsec;
1863         u32 sid = cred_sid(cred);
1864
1865         sbsec = sb->s_security;
1866         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1867 }
1868
1869 /* Convert a Linux mode and permission mask to an access vector. */
1870 static inline u32 file_mask_to_av(int mode, int mask)
1871 {
1872         u32 av = 0;
1873
1874         if (!S_ISDIR(mode)) {
1875                 if (mask & MAY_EXEC)
1876                         av |= FILE__EXECUTE;
1877                 if (mask & MAY_READ)
1878                         av |= FILE__READ;
1879
1880                 if (mask & MAY_APPEND)
1881                         av |= FILE__APPEND;
1882                 else if (mask & MAY_WRITE)
1883                         av |= FILE__WRITE;
1884
1885         } else {
1886                 if (mask & MAY_EXEC)
1887                         av |= DIR__SEARCH;
1888                 if (mask & MAY_WRITE)
1889                         av |= DIR__WRITE;
1890                 if (mask & MAY_READ)
1891                         av |= DIR__READ;
1892         }
1893
1894         return av;
1895 }
1896
1897 /* Convert a Linux file to an access vector. */
1898 static inline u32 file_to_av(struct file *file)
1899 {
1900         u32 av = 0;
1901
1902         if (file->f_mode & FMODE_READ)
1903                 av |= FILE__READ;
1904         if (file->f_mode & FMODE_WRITE) {
1905                 if (file->f_flags & O_APPEND)
1906                         av |= FILE__APPEND;
1907                 else
1908                         av |= FILE__WRITE;
1909         }
1910         if (!av) {
1911                 /*
1912                  * Special file opened with flags 3 for ioctl-only use.
1913                  */
1914                 av = FILE__IOCTL;
1915         }
1916
1917         return av;
1918 }
1919
1920 /*
1921  * Convert a file to an access vector and include the correct open
1922  * open permission.
1923  */
1924 static inline u32 open_file_to_av(struct file *file)
1925 {
1926         u32 av = file_to_av(file);
1927
1928         if (selinux_policycap_openperm)
1929                 av |= FILE__OPEN;
1930
1931         return av;
1932 }
1933
1934 /* Hook functions begin here. */
1935
1936 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1937 {
1938         u32 mysid = current_sid();
1939         u32 mgrsid = task_sid(mgr);
1940
1941         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1942                             BINDER__SET_CONTEXT_MGR, NULL);
1943 }
1944
1945 static int selinux_binder_transaction(struct task_struct *from,
1946                                       struct task_struct *to)
1947 {
1948         u32 mysid = current_sid();
1949         u32 fromsid = task_sid(from);
1950         u32 tosid = task_sid(to);
1951         int rc;
1952
1953         if (mysid != fromsid) {
1954                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1955                                   BINDER__IMPERSONATE, NULL);
1956                 if (rc)
1957                         return rc;
1958         }
1959
1960         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1961                             NULL);
1962 }
1963
1964 static int selinux_binder_transfer_binder(struct task_struct *from,
1965                                           struct task_struct *to)
1966 {
1967         u32 fromsid = task_sid(from);
1968         u32 tosid = task_sid(to);
1969
1970         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1971                             NULL);
1972 }
1973
1974 static int selinux_binder_transfer_file(struct task_struct *from,
1975                                         struct task_struct *to,
1976                                         struct file *file)
1977 {
1978         u32 sid = task_sid(to);
1979         struct file_security_struct *fsec = file->f_security;
1980         struct inode *inode = file->f_path.dentry->d_inode;
1981         struct inode_security_struct *isec = inode->i_security;
1982         struct common_audit_data ad;
1983         int rc;
1984
1985         ad.type = LSM_AUDIT_DATA_PATH;
1986         ad.u.path = file->f_path;
1987
1988         if (sid != fsec->sid) {
1989                 rc = avc_has_perm(sid, fsec->sid,
1990                                   SECCLASS_FD,
1991                                   FD__USE,
1992                                   &ad);
1993                 if (rc)
1994                         return rc;
1995         }
1996
1997         if (unlikely(IS_PRIVATE(inode)))
1998                 return 0;
1999
2000         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2001                             &ad);
2002 }
2003
2004 static int selinux_ptrace_access_check(struct task_struct *child,
2005                                      unsigned int mode)
2006 {
2007         int rc;
2008
2009         rc = cap_ptrace_access_check(child, mode);
2010         if (rc)
2011                 return rc;
2012
2013         if (mode & PTRACE_MODE_READ) {
2014                 u32 sid = current_sid();
2015                 u32 csid = task_sid(child);
2016                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2017         }
2018
2019         return current_has_perm(child, PROCESS__PTRACE);
2020 }
2021
2022 static int selinux_ptrace_traceme(struct task_struct *parent)
2023 {
2024         int rc;
2025
2026         rc = cap_ptrace_traceme(parent);
2027         if (rc)
2028                 return rc;
2029
2030         return task_has_perm(parent, current, PROCESS__PTRACE);
2031 }
2032
2033 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2034                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2035 {
2036         int error;
2037
2038         error = current_has_perm(target, PROCESS__GETCAP);
2039         if (error)
2040                 return error;
2041
2042         return cap_capget(target, effective, inheritable, permitted);
2043 }
2044
2045 static int selinux_capset(struct cred *new, const struct cred *old,
2046                           const kernel_cap_t *effective,
2047                           const kernel_cap_t *inheritable,
2048                           const kernel_cap_t *permitted)
2049 {
2050         int error;
2051
2052         error = cap_capset(new, old,
2053                                       effective, inheritable, permitted);
2054         if (error)
2055                 return error;
2056
2057         return cred_has_perm(old, new, PROCESS__SETCAP);
2058 }
2059
2060 /*
2061  * (This comment used to live with the selinux_task_setuid hook,
2062  * which was removed).
2063  *
2064  * Since setuid only affects the current process, and since the SELinux
2065  * controls are not based on the Linux identity attributes, SELinux does not
2066  * need to control this operation.  However, SELinux does control the use of
2067  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2068  */
2069
2070 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2071                            int cap, int audit)
2072 {
2073         int rc;
2074
2075         rc = cap_capable(cred, ns, cap, audit);
2076         if (rc)
2077                 return rc;
2078
2079         return cred_has_capability(cred, cap, audit);
2080 }
2081
2082 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2083 {
2084         const struct cred *cred = current_cred();
2085         int rc = 0;
2086
2087         if (!sb)
2088                 return 0;
2089
2090         switch (cmds) {
2091         case Q_SYNC:
2092         case Q_QUOTAON:
2093         case Q_QUOTAOFF:
2094         case Q_SETINFO:
2095         case Q_SETQUOTA:
2096                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2097                 break;
2098         case Q_GETFMT:
2099         case Q_GETINFO:
2100         case Q_GETQUOTA:
2101                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2102                 break;
2103         default:
2104                 rc = 0;  /* let the kernel handle invalid cmds */
2105                 break;
2106         }
2107         return rc;
2108 }
2109
2110 static int selinux_quota_on(struct dentry *dentry)
2111 {
2112         const struct cred *cred = current_cred();
2113
2114         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2115 }
2116
2117 static int selinux_syslog(int type)
2118 {
2119         int rc;
2120
2121         switch (type) {
2122         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2123         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2124                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2125                 break;
2126         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2127         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2128         /* Set level of messages printed to console */
2129         case SYSLOG_ACTION_CONSOLE_LEVEL:
2130                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2131                 break;
2132         case SYSLOG_ACTION_CLOSE:       /* Close log */
2133         case SYSLOG_ACTION_OPEN:        /* Open log */
2134         case SYSLOG_ACTION_READ:        /* Read from log */
2135         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2136         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2137         default:
2138                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2139                 break;
2140         }
2141         return rc;
2142 }
2143
2144 /*
2145  * Check that a process has enough memory to allocate a new virtual
2146  * mapping. 0 means there is enough memory for the allocation to
2147  * succeed and -ENOMEM implies there is not.
2148  *
2149  * Do not audit the selinux permission check, as this is applied to all
2150  * processes that allocate mappings.
2151  */
2152 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2153 {
2154         int rc, cap_sys_admin = 0;
2155
2156         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2157                              SECURITY_CAP_NOAUDIT);
2158         if (rc == 0)
2159                 cap_sys_admin = 1;
2160
2161         return __vm_enough_memory(mm, pages, cap_sys_admin);
2162 }
2163
2164 /* binprm security operations */
2165
2166 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2167                             const struct task_security_struct *old_tsec,
2168                             const struct task_security_struct *new_tsec)
2169 {
2170         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2171         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2172         int rc;
2173
2174         if (!nnp && !nosuid)
2175                 return 0; /* neither NNP nor nosuid */
2176
2177         if (new_tsec->sid == old_tsec->sid)
2178                 return 0; /* No change in credentials */
2179
2180         /*
2181          * The only transitions we permit under NNP or nosuid
2182          * are transitions to bounded SIDs, i.e. SIDs that are
2183          * guaranteed to only be allowed a subset of the permissions
2184          * of the current SID.
2185          */
2186         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2187         if (rc) {
2188                 /*
2189                  * On failure, preserve the errno values for NNP vs nosuid.
2190                  * NNP:  Operation not permitted for caller.
2191                  * nosuid:  Permission denied to file.
2192                  */
2193                 if (nnp)
2194                         return -EPERM;
2195                 else
2196                         return -EACCES;
2197         }
2198         return 0;
2199 }
2200
2201 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2202 {
2203         const struct task_security_struct *old_tsec;
2204         struct task_security_struct *new_tsec;
2205         struct inode_security_struct *isec;
2206         struct common_audit_data ad;
2207         struct inode *inode = file_inode(bprm->file);
2208         int rc;
2209
2210         rc = cap_bprm_set_creds(bprm);
2211         if (rc)
2212                 return rc;
2213
2214         /* SELinux context only depends on initial program or script and not
2215          * the script interpreter */
2216         if (bprm->cred_prepared)
2217                 return 0;
2218
2219         old_tsec = current_security();
2220         new_tsec = bprm->cred->security;
2221         isec = inode->i_security;
2222
2223         /* Default to the current task SID. */
2224         new_tsec->sid = old_tsec->sid;
2225         new_tsec->osid = old_tsec->sid;
2226
2227         /* Reset fs, key, and sock SIDs on execve. */
2228         new_tsec->create_sid = 0;
2229         new_tsec->keycreate_sid = 0;
2230         new_tsec->sockcreate_sid = 0;
2231
2232         if (old_tsec->exec_sid) {
2233                 new_tsec->sid = old_tsec->exec_sid;
2234                 /* Reset exec SID on execve. */
2235                 new_tsec->exec_sid = 0;
2236
2237                 /* Fail on NNP or nosuid if not an allowed transition. */
2238                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2239                 if (rc)
2240                         return rc;
2241         } else {
2242                 /* Check for a default transition on this program. */
2243                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2244                                              SECCLASS_PROCESS, NULL,
2245                                              &new_tsec->sid);
2246                 if (rc)
2247                         return rc;
2248
2249                 /*
2250                  * Fallback to old SID on NNP or nosuid if not an allowed
2251                  * transition.
2252                  */
2253                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2254                 if (rc)
2255                         new_tsec->sid = old_tsec->sid;
2256         }
2257
2258         ad.type = LSM_AUDIT_DATA_PATH;
2259         ad.u.path = bprm->file->f_path;
2260
2261         if (new_tsec->sid == old_tsec->sid) {
2262                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2263                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2264                 if (rc)
2265                         return rc;
2266         } else {
2267                 /* Check permissions for the transition. */
2268                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2269                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2270                 if (rc)
2271                         return rc;
2272
2273                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2274                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2275                 if (rc)
2276                         return rc;
2277
2278                 /* Check for shared state */
2279                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2280                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2281                                           SECCLASS_PROCESS, PROCESS__SHARE,
2282                                           NULL);
2283                         if (rc)
2284                                 return -EPERM;
2285                 }
2286
2287                 /* Make sure that anyone attempting to ptrace over a task that
2288                  * changes its SID has the appropriate permit */
2289                 if (bprm->unsafe &
2290                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2291                         struct task_struct *tracer;
2292                         struct task_security_struct *sec;
2293                         u32 ptsid = 0;
2294
2295                         rcu_read_lock();
2296                         tracer = ptrace_parent(current);
2297                         if (likely(tracer != NULL)) {
2298                                 sec = __task_cred(tracer)->security;
2299                                 ptsid = sec->sid;
2300                         }
2301                         rcu_read_unlock();
2302
2303                         if (ptsid != 0) {
2304                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2305                                                   SECCLASS_PROCESS,
2306                                                   PROCESS__PTRACE, NULL);
2307                                 if (rc)
2308                                         return -EPERM;
2309                         }
2310                 }
2311
2312                 /* Clear any possibly unsafe personality bits on exec: */
2313                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2314         }
2315
2316         return 0;
2317 }
2318
2319 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2320 {
2321         const struct task_security_struct *tsec = current_security();
2322         u32 sid, osid;
2323         int atsecure = 0;
2324
2325         sid = tsec->sid;
2326         osid = tsec->osid;
2327
2328         if (osid != sid) {
2329                 /* Enable secure mode for SIDs transitions unless
2330                    the noatsecure permission is granted between
2331                    the two SIDs, i.e. ahp returns 0. */
2332                 atsecure = avc_has_perm(osid, sid,
2333                                         SECCLASS_PROCESS,
2334                                         PROCESS__NOATSECURE, NULL);
2335         }
2336
2337         return (atsecure || cap_bprm_secureexec(bprm));
2338 }
2339
2340 static int match_file(const void *p, struct file *file, unsigned fd)
2341 {
2342         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2343 }
2344
2345 /* Derived from fs/exec.c:flush_old_files. */
2346 static inline void flush_unauthorized_files(const struct cred *cred,
2347                                             struct files_struct *files)
2348 {
2349         struct file *file, *devnull = NULL;
2350         struct tty_struct *tty;
2351         int drop_tty = 0;
2352         unsigned n;
2353
2354         tty = get_current_tty();
2355         if (tty) {
2356                 spin_lock(&tty_files_lock);
2357                 if (!list_empty(&tty->tty_files)) {
2358                         struct tty_file_private *file_priv;
2359
2360                         /* Revalidate access to controlling tty.
2361                            Use file_path_has_perm on the tty path directly
2362                            rather than using file_has_perm, as this particular
2363                            open file may belong to another process and we are
2364                            only interested in the inode-based check here. */
2365                         file_priv = list_first_entry(&tty->tty_files,
2366                                                 struct tty_file_private, list);
2367                         file = file_priv->file;
2368                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2369                                 drop_tty = 1;
2370                 }
2371                 spin_unlock(&tty_files_lock);
2372                 tty_kref_put(tty);
2373         }
2374         /* Reset controlling tty. */
2375         if (drop_tty)
2376                 no_tty();
2377
2378         /* Revalidate access to inherited open files. */
2379         n = iterate_fd(files, 0, match_file, cred);
2380         if (!n) /* none found? */
2381                 return;
2382
2383         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2384         if (IS_ERR(devnull))
2385                 devnull = NULL;
2386         /* replace all the matching ones with this */
2387         do {
2388                 replace_fd(n - 1, devnull, 0);
2389         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2390         if (devnull)
2391                 fput(devnull);
2392 }
2393
2394 /*
2395  * Prepare a process for imminent new credential changes due to exec
2396  */
2397 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2398 {
2399         struct task_security_struct *new_tsec;
2400         struct rlimit *rlim, *initrlim;
2401         int rc, i;
2402
2403         new_tsec = bprm->cred->security;
2404         if (new_tsec->sid == new_tsec->osid)
2405                 return;
2406
2407         /* Close files for which the new task SID is not authorized. */
2408         flush_unauthorized_files(bprm->cred, current->files);
2409
2410         /* Always clear parent death signal on SID transitions. */
2411         current->pdeath_signal = 0;
2412
2413         /* Check whether the new SID can inherit resource limits from the old
2414          * SID.  If not, reset all soft limits to the lower of the current
2415          * task's hard limit and the init task's soft limit.
2416          *
2417          * Note that the setting of hard limits (even to lower them) can be
2418          * controlled by the setrlimit check.  The inclusion of the init task's
2419          * soft limit into the computation is to avoid resetting soft limits
2420          * higher than the default soft limit for cases where the default is
2421          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2422          */
2423         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2424                           PROCESS__RLIMITINH, NULL);
2425         if (rc) {
2426                 /* protect against do_prlimit() */
2427                 task_lock(current);
2428                 for (i = 0; i < RLIM_NLIMITS; i++) {
2429                         rlim = current->signal->rlim + i;
2430                         initrlim = init_task.signal->rlim + i;
2431                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2432                 }
2433                 task_unlock(current);
2434                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2435         }
2436 }
2437
2438 /*
2439  * Clean up the process immediately after the installation of new credentials
2440  * due to exec
2441  */
2442 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2443 {
2444         const struct task_security_struct *tsec = current_security();
2445         struct itimerval itimer;
2446         u32 osid, sid;
2447         int rc, i;
2448
2449         osid = tsec->osid;
2450         sid = tsec->sid;
2451
2452         if (sid == osid)
2453                 return;
2454
2455         /* Check whether the new SID can inherit signal state from the old SID.
2456          * If not, clear itimers to avoid subsequent signal generation and
2457          * flush and unblock signals.
2458          *
2459          * This must occur _after_ the task SID has been updated so that any
2460          * kill done after the flush will be checked against the new SID.
2461          */
2462         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2463         if (rc) {
2464                 memset(&itimer, 0, sizeof itimer);
2465                 for (i = 0; i < 3; i++)
2466                         do_setitimer(i, &itimer, NULL);
2467                 spin_lock_irq(&current->sighand->siglock);
2468                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2469                         __flush_signals(current);
2470                         flush_signal_handlers(current, 1);
2471                         sigemptyset(&current->blocked);
2472                 }
2473                 spin_unlock_irq(&current->sighand->siglock);
2474         }
2475
2476         /* Wake up the parent if it is waiting so that it can recheck
2477          * wait permission to the new task SID. */
2478         read_lock(&tasklist_lock);
2479         __wake_up_parent(current, current->real_parent);
2480         read_unlock(&tasklist_lock);
2481 }
2482
2483 /* superblock security operations */
2484
2485 static int selinux_sb_alloc_security(struct super_block *sb)
2486 {
2487         return superblock_alloc_security(sb);
2488 }
2489
2490 static void selinux_sb_free_security(struct super_block *sb)
2491 {
2492         superblock_free_security(sb);
2493 }
2494
2495 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2496 {
2497         if (plen > olen)
2498                 return 0;
2499
2500         return !memcmp(prefix, option, plen);
2501 }
2502
2503 static inline int selinux_option(char *option, int len)
2504 {
2505         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2506                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2507                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2508                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2510 }
2511
2512 static inline void take_option(char **to, char *from, int *first, int len)
2513 {
2514         if (!*first) {
2515                 **to = ',';
2516                 *to += 1;
2517         } else
2518                 *first = 0;
2519         memcpy(*to, from, len);
2520         *to += len;
2521 }
2522
2523 static inline void take_selinux_option(char **to, char *from, int *first,
2524                                        int len)
2525 {
2526         int current_size = 0;
2527
2528         if (!*first) {
2529                 **to = '|';
2530                 *to += 1;
2531         } else
2532                 *first = 0;
2533
2534         while (current_size < len) {
2535                 if (*from != '"') {
2536                         **to = *from;
2537                         *to += 1;
2538                 }
2539                 from += 1;
2540                 current_size += 1;
2541         }
2542 }
2543
2544 static int selinux_sb_copy_data(char *orig, char *copy)
2545 {
2546         int fnosec, fsec, rc = 0;
2547         char *in_save, *in_curr, *in_end;
2548         char *sec_curr, *nosec_save, *nosec;
2549         int open_quote = 0;
2550
2551         in_curr = orig;
2552         sec_curr = copy;
2553
2554         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2555         if (!nosec) {
2556                 rc = -ENOMEM;
2557                 goto out;
2558         }
2559
2560         nosec_save = nosec;
2561         fnosec = fsec = 1;
2562         in_save = in_end = orig;
2563
2564         do {
2565                 if (*in_end == '"')
2566                         open_quote = !open_quote;
2567                 if ((*in_end == ',' && open_quote == 0) ||
2568                                 *in_end == '\0') {
2569                         int len = in_end - in_curr;
2570
2571                         if (selinux_option(in_curr, len))
2572                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2573                         else
2574                                 take_option(&nosec, in_curr, &fnosec, len);
2575
2576                         in_curr = in_end + 1;
2577                 }
2578         } while (*in_end++);
2579
2580         strcpy(in_save, nosec_save);
2581         free_page((unsigned long)nosec_save);
2582 out:
2583         return rc;
2584 }
2585
2586 static int selinux_sb_remount(struct super_block *sb, void *data)
2587 {
2588         int rc, i, *flags;
2589         struct security_mnt_opts opts;
2590         char *secdata, **mount_options;
2591         struct superblock_security_struct *sbsec = sb->s_security;
2592
2593         if (!(sbsec->flags & SE_SBINITIALIZED))
2594                 return 0;
2595
2596         if (!data)
2597                 return 0;
2598
2599         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2600                 return 0;
2601
2602         security_init_mnt_opts(&opts);
2603         secdata = alloc_secdata();
2604         if (!secdata)
2605                 return -ENOMEM;
2606         rc = selinux_sb_copy_data(data, secdata);
2607         if (rc)
2608                 goto out_free_secdata;
2609
2610         rc = selinux_parse_opts_str(secdata, &opts);
2611         if (rc)
2612                 goto out_free_secdata;
2613
2614         mount_options = opts.mnt_opts;
2615         flags = opts.mnt_opts_flags;
2616
2617         for (i = 0; i < opts.num_mnt_opts; i++) {
2618                 u32 sid;
2619                 size_t len;
2620
2621                 if (flags[i] == SBLABEL_MNT)
2622                         continue;
2623                 len = strlen(mount_options[i]);
2624                 rc = security_context_to_sid(mount_options[i], len, &sid,
2625                                              GFP_KERNEL);
2626                 if (rc) {
2627                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2628                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2629                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2630                         goto out_free_opts;
2631                 }
2632                 rc = -EINVAL;
2633                 switch (flags[i]) {
2634                 case FSCONTEXT_MNT:
2635                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2636                                 goto out_bad_option;
2637                         break;
2638                 case CONTEXT_MNT:
2639                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2640                                 goto out_bad_option;
2641                         break;
2642                 case ROOTCONTEXT_MNT: {
2643                         struct inode_security_struct *root_isec;
2644                         root_isec = sb->s_root->d_inode->i_security;
2645
2646                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2647                                 goto out_bad_option;
2648                         break;
2649                 }
2650                 case DEFCONTEXT_MNT:
2651                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2652                                 goto out_bad_option;
2653                         break;
2654                 default:
2655                         goto out_free_opts;
2656                 }
2657         }
2658
2659         rc = 0;
2660 out_free_opts:
2661         security_free_mnt_opts(&opts);
2662 out_free_secdata:
2663         free_secdata(secdata);
2664         return rc;
2665 out_bad_option:
2666         printk(KERN_WARNING "SELinux: unable to change security options "
2667                "during remount (dev %s, type=%s)\n", sb->s_id,
2668                sb->s_type->name);
2669         goto out_free_opts;
2670 }
2671
2672 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2673 {
2674         const struct cred *cred = current_cred();
2675         struct common_audit_data ad;
2676         int rc;
2677
2678         rc = superblock_doinit(sb, data);
2679         if (rc)
2680                 return rc;
2681
2682         /* Allow all mounts performed by the kernel */
2683         if (flags & MS_KERNMOUNT)
2684                 return 0;
2685
2686         ad.type = LSM_AUDIT_DATA_DENTRY;
2687         ad.u.dentry = sb->s_root;
2688         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2689 }
2690
2691 static int selinux_sb_statfs(struct dentry *dentry)
2692 {
2693         const struct cred *cred = current_cred();
2694         struct common_audit_data ad;
2695
2696         ad.type = LSM_AUDIT_DATA_DENTRY;
2697         ad.u.dentry = dentry->d_sb->s_root;
2698         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2699 }
2700
2701 static int selinux_mount(const char *dev_name,
2702                          struct path *path,
2703                          const char *type,
2704                          unsigned long flags,
2705                          void *data)
2706 {
2707         const struct cred *cred = current_cred();
2708
2709         if (flags & MS_REMOUNT)
2710                 return superblock_has_perm(cred, path->dentry->d_sb,
2711                                            FILESYSTEM__REMOUNT, NULL);
2712         else
2713                 return path_has_perm(cred, path, FILE__MOUNTON);
2714 }
2715
2716 static int selinux_umount(struct vfsmount *mnt, int flags)
2717 {
2718         const struct cred *cred = current_cred();
2719
2720         return superblock_has_perm(cred, mnt->mnt_sb,
2721                                    FILESYSTEM__UNMOUNT, NULL);
2722 }
2723
2724 /* inode security operations */
2725
2726 static int selinux_inode_alloc_security(struct inode *inode)
2727 {
2728         return inode_alloc_security(inode);
2729 }
2730
2731 static void selinux_inode_free_security(struct inode *inode)
2732 {
2733         inode_free_security(inode);
2734 }
2735
2736 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2737                                         struct qstr *name, void **ctx,
2738                                         u32 *ctxlen)
2739 {
2740         const struct cred *cred = current_cred();
2741         struct task_security_struct *tsec;
2742         struct inode_security_struct *dsec;
2743         struct superblock_security_struct *sbsec;
2744         struct inode *dir = dentry->d_parent->d_inode;
2745         u32 newsid;
2746         int rc;
2747
2748         tsec = cred->security;
2749         dsec = dir->i_security;
2750         sbsec = dir->i_sb->s_security;
2751
2752         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2753                 newsid = tsec->create_sid;
2754         } else {
2755                 rc = security_transition_sid(tsec->sid, dsec->sid,
2756                                              inode_mode_to_security_class(mode),
2757                                              name,
2758                                              &newsid);
2759                 if (rc) {
2760                         printk(KERN_WARNING
2761                                 "%s: security_transition_sid failed, rc=%d\n",
2762                                __func__, -rc);
2763                         return rc;
2764                 }
2765         }
2766
2767         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2768 }
2769
2770 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2771                                        const struct qstr *qstr,
2772                                        const char **name,
2773                                        void **value, size_t *len)
2774 {
2775         const struct task_security_struct *tsec = current_security();
2776         struct inode_security_struct *dsec;
2777         struct superblock_security_struct *sbsec;
2778         u32 sid, newsid, clen;
2779         int rc;
2780         char *context;
2781
2782         dsec = dir->i_security;
2783         sbsec = dir->i_sb->s_security;
2784
2785         sid = tsec->sid;
2786         newsid = tsec->create_sid;
2787
2788         if ((sbsec->flags & SE_SBINITIALIZED) &&
2789             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2790                 newsid = sbsec->mntpoint_sid;
2791         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2792                 rc = security_transition_sid(sid, dsec->sid,
2793                                              inode_mode_to_security_class(inode->i_mode),
2794                                              qstr, &newsid);
2795                 if (rc) {
2796                         printk(KERN_WARNING "%s:  "
2797                                "security_transition_sid failed, rc=%d (dev=%s "
2798                                "ino=%ld)\n",
2799                                __func__,
2800                                -rc, inode->i_sb->s_id, inode->i_ino);
2801                         return rc;
2802                 }
2803         }
2804
2805         /* Possibly defer initialization to selinux_complete_init. */
2806         if (sbsec->flags & SE_SBINITIALIZED) {
2807                 struct inode_security_struct *isec = inode->i_security;
2808                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2809                 isec->sid = newsid;
2810                 isec->initialized = 1;
2811         }
2812
2813         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2814                 return -EOPNOTSUPP;
2815
2816         if (name)
2817                 *name = XATTR_SELINUX_SUFFIX;
2818
2819         if (value && len) {
2820                 rc = security_sid_to_context_force(newsid, &context, &clen);
2821                 if (rc)
2822                         return rc;
2823                 *value = context;
2824                 *len = clen;
2825         }
2826
2827         return 0;
2828 }
2829
2830 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2831 {
2832         return may_create(dir, dentry, SECCLASS_FILE);
2833 }
2834
2835 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2836 {
2837         return may_link(dir, old_dentry, MAY_LINK);
2838 }
2839
2840 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2841 {
2842         return may_link(dir, dentry, MAY_UNLINK);
2843 }
2844
2845 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2846 {
2847         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2848 }
2849
2850 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2851 {
2852         return may_create(dir, dentry, SECCLASS_DIR);
2853 }
2854
2855 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2856 {
2857         return may_link(dir, dentry, MAY_RMDIR);
2858 }
2859
2860 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2861 {
2862         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2863 }
2864
2865 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2866                                 struct inode *new_inode, struct dentry *new_dentry)
2867 {
2868         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2869 }
2870
2871 static int selinux_inode_readlink(struct dentry *dentry)
2872 {
2873         const struct cred *cred = current_cred();
2874
2875         return dentry_has_perm(cred, dentry, FILE__READ);
2876 }
2877
2878 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2879 {
2880         const struct cred *cred = current_cred();
2881
2882         return dentry_has_perm(cred, dentry, FILE__READ);
2883 }
2884
2885 static noinline int audit_inode_permission(struct inode *inode,
2886                                            u32 perms, u32 audited, u32 denied,
2887                                            int result,
2888                                            unsigned flags)
2889 {
2890         struct common_audit_data ad;
2891         struct inode_security_struct *isec = inode->i_security;
2892         int rc;
2893
2894         ad.type = LSM_AUDIT_DATA_INODE;
2895         ad.u.inode = inode;
2896
2897         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2898                             audited, denied, result, &ad, flags);
2899         if (rc)
2900                 return rc;
2901         return 0;
2902 }
2903
2904 static int selinux_inode_permission(struct inode *inode, int mask)
2905 {
2906         const struct cred *cred = current_cred();
2907         u32 perms;
2908         bool from_access;
2909         unsigned flags = mask & MAY_NOT_BLOCK;
2910         struct inode_security_struct *isec;
2911         u32 sid;
2912         struct av_decision avd;
2913         int rc, rc2;
2914         u32 audited, denied;
2915
2916         from_access = mask & MAY_ACCESS;
2917         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2918
2919         /* No permission to check.  Existence test. */
2920         if (!mask)
2921                 return 0;
2922
2923         validate_creds(cred);
2924
2925         if (unlikely(IS_PRIVATE(inode)))
2926                 return 0;
2927
2928         perms = file_mask_to_av(inode->i_mode, mask);
2929
2930         sid = cred_sid(cred);
2931         isec = inode->i_security;
2932
2933         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2934         audited = avc_audit_required(perms, &avd, rc,
2935                                      from_access ? FILE__AUDIT_ACCESS : 0,
2936                                      &denied);
2937         if (likely(!audited))
2938                 return rc;
2939
2940         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2941         if (rc2)
2942                 return rc2;
2943         return rc;
2944 }
2945
2946 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2947 {
2948         const struct cred *cred = current_cred();
2949         unsigned int ia_valid = iattr->ia_valid;
2950         __u32 av = FILE__WRITE;
2951
2952         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2953         if (ia_valid & ATTR_FORCE) {
2954                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2955                               ATTR_FORCE);
2956                 if (!ia_valid)
2957                         return 0;
2958         }
2959
2960         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2961                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2962                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2963
2964         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2965                 av |= FILE__OPEN;
2966
2967         return dentry_has_perm(cred, dentry, av);
2968 }
2969
2970 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2971 {
2972         const struct cred *cred = current_cred();
2973         struct path path;
2974
2975         path.dentry = dentry;
2976         path.mnt = mnt;
2977
2978         return path_has_perm(cred, &path, FILE__GETATTR);
2979 }
2980
2981 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2982 {
2983         const struct cred *cred = current_cred();
2984
2985         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2986                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2987                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2988                         if (!capable(CAP_SETFCAP))
2989                                 return -EPERM;
2990                 } else if (!capable(CAP_SYS_ADMIN)) {
2991                         /* A different attribute in the security namespace.
2992                            Restrict to administrator. */
2993                         return -EPERM;
2994                 }
2995         }
2996
2997         /* Not an attribute we recognize, so just check the
2998            ordinary setattr permission. */
2999         return dentry_has_perm(cred, dentry, FILE__SETATTR);
3000 }
3001
3002 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
3003                                   const void *value, size_t size, int flags)
3004 {
3005         struct inode *inode = dentry->d_inode;
3006         struct inode_security_struct *isec = inode->i_security;
3007         struct superblock_security_struct *sbsec;
3008         struct common_audit_data ad;
3009         u32 newsid, sid = current_sid();
3010         int rc = 0;
3011
3012         if (strcmp(name, XATTR_NAME_SELINUX))
3013                 return selinux_inode_setotherxattr(dentry, name);
3014
3015         sbsec = inode->i_sb->s_security;
3016         if (!(sbsec->flags & SBLABEL_MNT))
3017                 return -EOPNOTSUPP;
3018
3019         if (!inode_owner_or_capable(inode))
3020                 return -EPERM;
3021
3022         ad.type = LSM_AUDIT_DATA_DENTRY;
3023         ad.u.dentry = dentry;
3024
3025         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3026                           FILE__RELABELFROM, &ad);
3027         if (rc)
3028                 return rc;
3029
3030         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3031         if (rc == -EINVAL) {
3032                 if (!capable(CAP_MAC_ADMIN)) {
3033                         struct audit_buffer *ab;
3034                         size_t audit_size;
3035                         const char *str;
3036
3037                         /* We strip a nul only if it is at the end, otherwise the
3038                          * context contains a nul and we should audit that */
3039                         if (value) {
3040                                 str = value;
3041                                 if (str[size - 1] == '\0')
3042                                         audit_size = size - 1;
3043                                 else
3044                                         audit_size = size;
3045                         } else {
3046                                 str = "";
3047                                 audit_size = 0;
3048                         }
3049                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3050                         audit_log_format(ab, "op=setxattr invalid_context=");
3051                         audit_log_n_untrustedstring(ab, value, audit_size);
3052                         audit_log_end(ab);
3053
3054                         return rc;
3055                 }
3056                 rc = security_context_to_sid_force(value, size, &newsid);
3057         }
3058         if (rc)
3059                 return rc;
3060
3061         rc = avc_has_perm(sid, newsid, isec->sclass,
3062                           FILE__RELABELTO, &ad);
3063         if (rc)
3064                 return rc;
3065
3066         rc = security_validate_transition(isec->sid, newsid, sid,
3067                                           isec->sclass);
3068         if (rc)
3069                 return rc;
3070
3071         return avc_has_perm(newsid,
3072                             sbsec->sid,
3073                             SECCLASS_FILESYSTEM,
3074                             FILESYSTEM__ASSOCIATE,
3075                             &ad);
3076 }
3077
3078 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3079                                         const void *value, size_t size,
3080                                         int flags)
3081 {
3082         struct inode *inode = dentry->d_inode;
3083         struct inode_security_struct *isec = inode->i_security;
3084         u32 newsid;
3085         int rc;
3086
3087         if (strcmp(name, XATTR_NAME_SELINUX)) {
3088                 /* Not an attribute we recognize, so nothing to do. */
3089                 return;
3090         }
3091
3092         rc = security_context_to_sid_force(value, size, &newsid);
3093         if (rc) {
3094                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3095                        "for (%s, %lu), rc=%d\n",
3096                        inode->i_sb->s_id, inode->i_ino, -rc);
3097                 return;
3098         }
3099
3100         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3101         isec->sid = newsid;
3102         isec->initialized = 1;
3103
3104         return;
3105 }
3106
3107 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3108 {
3109         const struct cred *cred = current_cred();
3110
3111         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3112 }
3113
3114 static int selinux_inode_listxattr(struct dentry *dentry)
3115 {
3116         const struct cred *cred = current_cred();
3117
3118         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3119 }
3120
3121 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3122 {
3123         if (strcmp(name, XATTR_NAME_SELINUX))
3124                 return selinux_inode_setotherxattr(dentry, name);
3125
3126         /* No one is allowed to remove a SELinux security label.
3127            You can change the label, but all data must be labeled. */
3128         return -EACCES;
3129 }
3130
3131 /*
3132  * Copy the inode security context value to the user.
3133  *
3134  * Permission check is handled by selinux_inode_getxattr hook.
3135  */
3136 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3137 {
3138         u32 size;
3139         int error;
3140         char *context = NULL;
3141         struct inode_security_struct *isec = inode->i_security;
3142
3143         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3144                 return -EOPNOTSUPP;
3145
3146         /*
3147          * If the caller has CAP_MAC_ADMIN, then get the raw context
3148          * value even if it is not defined by current policy; otherwise,
3149          * use the in-core value under current policy.
3150          * Use the non-auditing forms of the permission checks since
3151          * getxattr may be called by unprivileged processes commonly
3152          * and lack of permission just means that we fall back to the
3153          * in-core context value, not a denial.
3154          */
3155         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3156                                 SECURITY_CAP_NOAUDIT);
3157         if (!error)
3158                 error = security_sid_to_context_force(isec->sid, &context,
3159                                                       &size);
3160         else
3161                 error = security_sid_to_context(isec->sid, &context, &size);
3162         if (error)
3163                 return error;
3164         error = size;
3165         if (alloc) {
3166                 *buffer = context;
3167                 goto out_nofree;
3168         }
3169         kfree(context);
3170 out_nofree:
3171         return error;
3172 }
3173
3174 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3175                                      const void *value, size_t size, int flags)
3176 {
3177         struct inode_security_struct *isec = inode->i_security;
3178         u32 newsid;
3179         int rc;
3180
3181         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3182                 return -EOPNOTSUPP;
3183
3184         if (!value || !size)
3185                 return -EACCES;
3186
3187         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3188         if (rc)
3189                 return rc;
3190
3191         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3192         isec->sid = newsid;
3193         isec->initialized = 1;
3194         return 0;
3195 }
3196
3197 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3198 {
3199         const int len = sizeof(XATTR_NAME_SELINUX);
3200         if (buffer && len <= buffer_size)
3201                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3202         return len;
3203 }
3204
3205 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3206 {
3207         struct inode_security_struct *isec = inode->i_security;
3208         *secid = isec->sid;
3209 }
3210
3211 /* file security operations */
3212
3213 static int selinux_revalidate_file_permission(struct file *file, int mask)
3214 {
3215         const struct cred *cred = current_cred();
3216         struct inode *inode = file_inode(file);
3217
3218         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3219         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3220                 mask |= MAY_APPEND;
3221
3222         return file_has_perm(cred, file,
3223                              file_mask_to_av(inode->i_mode, mask));
3224 }
3225
3226 static int selinux_file_permission(struct file *file, int mask)
3227 {
3228         struct inode *inode = file_inode(file);
3229         struct file_security_struct *fsec = file->f_security;
3230         struct inode_security_struct *isec = inode->i_security;
3231         u32 sid = current_sid();
3232
3233         if (!mask)
3234                 /* No permission to check.  Existence test. */
3235                 return 0;
3236
3237         if (sid == fsec->sid && fsec->isid == isec->sid &&
3238             fsec->pseqno == avc_policy_seqno())
3239                 /* No change since file_open check. */
3240                 return 0;
3241
3242         return selinux_revalidate_file_permission(file, mask);
3243 }
3244
3245 static int selinux_file_alloc_security(struct file *file)
3246 {
3247         return file_alloc_security(file);
3248 }
3249
3250 static void selinux_file_free_security(struct file *file)
3251 {
3252         file_free_security(file);
3253 }
3254
3255 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3256                               unsigned long arg)
3257 {
3258         const struct cred *cred = current_cred();
3259         int error = 0;
3260
3261         switch (cmd) {
3262         case FIONREAD:
3263         /* fall through */
3264         case FIBMAP:
3265         /* fall through */
3266         case FIGETBSZ:
3267         /* fall through */
3268         case FS_IOC_GETFLAGS:
3269         /* fall through */
3270         case FS_IOC_GETVERSION:
3271                 error = file_has_perm(cred, file, FILE__GETATTR);
3272                 break;
3273
3274         case FS_IOC_SETFLAGS:
3275         /* fall through */
3276         case FS_IOC_SETVERSION:
3277                 error = file_has_perm(cred, file, FILE__SETATTR);
3278                 break;
3279
3280         /* sys_ioctl() checks */
3281         case FIONBIO:
3282         /* fall through */
3283         case FIOASYNC:
3284                 error = file_has_perm(cred, file, 0);
3285                 break;
3286
3287         case KDSKBENT:
3288         case KDSKBSENT:
3289                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3290                                             SECURITY_CAP_AUDIT);
3291                 break;
3292
3293         /* default case assumes that the command will go
3294          * to the file's ioctl() function.
3295          */
3296         default:
3297                 error = file_has_perm(cred, file, FILE__IOCTL);
3298         }
3299         return error;
3300 }
3301
3302 static int default_noexec;
3303
3304 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3305 {
3306         const struct cred *cred = current_cred();
3307         int rc = 0;
3308
3309         if (default_noexec &&
3310             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3311                 /*
3312                  * We are making executable an anonymous mapping or a
3313                  * private file mapping that will also be writable.
3314                  * This has an additional check.
3315                  */
3316                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3317                 if (rc)
3318                         goto error;
3319         }
3320
3321         if (file) {
3322                 /* read access is always possible with a mapping */
3323                 u32 av = FILE__READ;
3324
3325                 /* write access only matters if the mapping is shared */
3326                 if (shared && (prot & PROT_WRITE))
3327                         av |= FILE__WRITE;
3328
3329                 if (prot & PROT_EXEC)
3330                         av |= FILE__EXECUTE;
3331
3332                 return file_has_perm(cred, file, av);
3333         }
3334
3335 error:
3336         return rc;
3337 }
3338
3339 static int selinux_mmap_addr(unsigned long addr)
3340 {
3341         int rc;
3342
3343         /* do DAC check on address space usage */
3344         rc = cap_mmap_addr(addr);
3345         if (rc)
3346                 return rc;
3347
3348         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3349                 u32 sid = current_sid();
3350                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3351                                   MEMPROTECT__MMAP_ZERO, NULL);
3352         }
3353
3354         return rc;
3355 }
3356
3357 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3358                              unsigned long prot, unsigned long flags)
3359 {
3360         if (selinux_checkreqprot)
3361                 prot = reqprot;
3362
3363         return file_map_prot_check(file, prot,
3364                                    (flags & MAP_TYPE) == MAP_SHARED);
3365 }
3366
3367 static int selinux_file_mprotect(struct vm_area_struct *vma,
3368                                  unsigned long reqprot,
3369                                  unsigned long prot)
3370 {
3371         const struct cred *cred = current_cred();
3372
3373         if (selinux_checkreqprot)
3374                 prot = reqprot;
3375
3376         if (default_noexec &&
3377             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3378                 int rc = 0;
3379                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3380                     vma->vm_end <= vma->vm_mm->brk) {
3381                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3382                 } else if (!vma->vm_file &&
3383                            vma->vm_start <= vma->vm_mm->start_stack &&
3384                            vma->vm_end >= vma->vm_mm->start_stack) {
3385                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3386                 } else if (vma->vm_file && vma->anon_vma) {
3387                         /*
3388                          * We are making executable a file mapping that has
3389                          * had some COW done. Since pages might have been
3390                          * written, check ability to execute the possibly
3391                          * modified content.  This typically should only
3392                          * occur for text relocations.
3393                          */
3394                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3395                 }
3396                 if (rc)
3397                         return rc;
3398         }
3399
3400         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3401 }
3402
3403 static int selinux_file_lock(struct file *file, unsigned int cmd)
3404 {
3405         const struct cred *cred = current_cred();
3406
3407         return file_has_perm(cred, file, FILE__LOCK);
3408 }
3409
3410 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3411                               unsigned long arg)
3412 {
3413         const struct cred *cred = current_cred();
3414         int err = 0;
3415
3416         switch (cmd) {
3417         case F_SETFL:
3418                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3419                         err = file_has_perm(cred, file, FILE__WRITE);
3420                         break;
3421                 }
3422                 /* fall through */
3423         case F_SETOWN:
3424         case F_SETSIG:
3425         case F_GETFL:
3426         case F_GETOWN:
3427         case F_GETSIG:
3428         case F_GETOWNER_UIDS:
3429                 /* Just check FD__USE permission */
3430                 err = file_has_perm(cred, file, 0);
3431                 break;
3432         case F_GETLK:
3433         case F_SETLK:
3434         case F_SETLKW:
3435         case F_OFD_GETLK:
3436         case F_OFD_SETLK:
3437         case F_OFD_SETLKW:
3438 #if BITS_PER_LONG == 32
3439         case F_GETLK64:
3440         case F_SETLK64:
3441         case F_SETLKW64:
3442 #endif
3443                 err = file_has_perm(cred, file, FILE__LOCK);
3444                 break;
3445         }
3446
3447         return err;
3448 }
3449
3450 static void selinux_file_set_fowner(struct file *file)
3451 {
3452         struct file_security_struct *fsec;
3453
3454         fsec = file->f_security;
3455         fsec->fown_sid = current_sid();
3456 }
3457
3458 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3459                                        struct fown_struct *fown, int signum)
3460 {
3461         struct file *file;
3462         u32 sid = task_sid(tsk);
3463         u32 perm;
3464         struct file_security_struct *fsec;
3465
3466         /* struct fown_struct is never outside the context of a struct file */
3467         file = container_of(fown, struct file, f_owner);
3468
3469         fsec = file->f_security;
3470
3471         if (!signum)
3472                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3473         else
3474                 perm = signal_to_av(signum);
3475
3476         return avc_has_perm(fsec->fown_sid, sid,
3477                             SECCLASS_PROCESS, perm, NULL);
3478 }
3479
3480 static int selinux_file_receive(struct file *file)
3481 {
3482         const struct cred *cred = current_cred();
3483
3484         return file_has_perm(cred, file, file_to_av(file));
3485 }
3486
3487 static int selinux_file_open(struct file *file, const struct cred *cred)
3488 {
3489         struct file_security_struct *fsec;
3490         struct inode_security_struct *isec;
3491
3492         fsec = file->f_security;
3493         isec = file_inode(file)->i_security;
3494         /*
3495          * Save inode label and policy sequence number
3496          * at open-time so that selinux_file_permission
3497          * can determine whether revalidation is necessary.
3498          * Task label is already saved in the file security
3499          * struct as its SID.
3500          */
3501         fsec->isid = isec->sid;
3502         fsec->pseqno = avc_policy_seqno();
3503         /*
3504          * Since the inode label or policy seqno may have changed
3505          * between the selinux_inode_permission check and the saving
3506          * of state above, recheck that access is still permitted.
3507          * Otherwise, access might never be revalidated against the
3508          * new inode label or new policy.
3509          * This check is not redundant - do not remove.
3510          */
3511         return file_path_has_perm(cred, file, open_file_to_av(file));
3512 }
3513
3514 /* task security operations */
3515
3516 static int selinux_task_create(unsigned long clone_flags)
3517 {
3518         return current_has_perm(current, PROCESS__FORK);
3519 }
3520
3521 /*
3522  * allocate the SELinux part of blank credentials
3523  */
3524 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3525 {
3526         struct task_security_struct *tsec;
3527
3528         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3529         if (!tsec)
3530                 return -ENOMEM;
3531
3532         cred->security = tsec;
3533         return 0;
3534 }
3535
3536 /*
3537  * detach and free the LSM part of a set of credentials
3538  */
3539 static void selinux_cred_free(struct cred *cred)
3540 {
3541         struct task_security_struct *tsec = cred->security;
3542
3543         /*
3544          * cred->security == NULL if security_cred_alloc_blank() or
3545          * security_prepare_creds() returned an error.
3546          */
3547         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3548         cred->security = (void *) 0x7UL;
3549         kfree(tsec);
3550 }
3551
3552 /*
3553  * prepare a new set of credentials for modification
3554  */
3555 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3556                                 gfp_t gfp)
3557 {
3558         const struct task_security_struct *old_tsec;
3559         struct task_security_struct *tsec;
3560
3561         old_tsec = old->security;
3562
3563         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3564         if (!tsec)
3565                 return -ENOMEM;
3566
3567         new->security = tsec;
3568         return 0;
3569 }
3570
3571 /*
3572  * transfer the SELinux data to a blank set of creds
3573  */
3574 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3575 {
3576         const struct task_security_struct *old_tsec = old->security;
3577         struct task_security_struct *tsec = new->security;
3578
3579         *tsec = *old_tsec;
3580 }
3581
3582 /*
3583  * set the security data for a kernel service
3584  * - all the creation contexts are set to unlabelled
3585  */
3586 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3587 {
3588         struct task_security_struct *tsec = new->security;
3589         u32 sid = current_sid();
3590         int ret;
3591
3592         ret = avc_has_perm(sid, secid,
3593                            SECCLASS_KERNEL_SERVICE,
3594                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3595                            NULL);
3596         if (ret == 0) {
3597                 tsec->sid = secid;
3598                 tsec->create_sid = 0;
3599                 tsec->keycreate_sid = 0;
3600                 tsec->sockcreate_sid = 0;
3601         }
3602         return ret;
3603 }
3604
3605 /*
3606  * set the file creation context in a security record to the same as the
3607  * objective context of the specified inode
3608  */
3609 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3610 {
3611         struct inode_security_struct *isec = inode->i_security;
3612         struct task_security_struct *tsec = new->security;
3613         u32 sid = current_sid();
3614         int ret;
3615
3616         ret = avc_has_perm(sid, isec->sid,
3617                            SECCLASS_KERNEL_SERVICE,
3618                            KERNEL_SERVICE__CREATE_FILES_AS,
3619                            NULL);
3620
3621         if (ret == 0)
3622                 tsec->create_sid = isec->sid;
3623         return ret;
3624 }
3625
3626 static int selinux_kernel_module_request(char *kmod_name)
3627 {
3628         u32 sid;
3629         struct common_audit_data ad;
3630
3631         sid = task_sid(current);
3632
3633         ad.type = LSM_AUDIT_DATA_KMOD;
3634         ad.u.kmod_name = kmod_name;
3635
3636         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3637                             SYSTEM__MODULE_REQUEST, &ad);
3638 }
3639
3640 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3641 {
3642         return current_has_perm(p, PROCESS__SETPGID);
3643 }
3644
3645 static int selinux_task_getpgid(struct task_struct *p)
3646 {
3647         return current_has_perm(p, PROCESS__GETPGID);
3648 }
3649
3650 static int selinux_task_getsid(struct task_struct *p)
3651 {
3652         return current_has_perm(p, PROCESS__GETSESSION);
3653 }
3654
3655 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3656 {
3657         *secid = task_sid(p);
3658 }
3659
3660 static int selinux_task_setnice(struct task_struct *p, int nice)
3661 {
3662         int rc;
3663
3664         rc = cap_task_setnice(p, nice);
3665         if (rc)
3666                 return rc;
3667
3668         return current_has_perm(p, PROCESS__SETSCHED);
3669 }
3670
3671 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3672 {
3673         int rc;
3674
3675         rc = cap_task_setioprio(p, ioprio);
3676         if (rc)
3677                 return rc;
3678
3679         return current_has_perm(p, PROCESS__SETSCHED);
3680 }
3681
3682 static int selinux_task_getioprio(struct task_struct *p)
3683 {
3684         return current_has_perm(p, PROCESS__GETSCHED);
3685 }
3686
3687 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3688                 struct rlimit *new_rlim)
3689 {
3690         struct rlimit *old_rlim = p->signal->rlim + resource;
3691
3692         /* Control the ability to change the hard limit (whether
3693            lowering or raising it), so that the hard limit can
3694            later be used as a safe reset point for the soft limit
3695            upon context transitions.  See selinux_bprm_committing_creds. */
3696         if (old_rlim->rlim_max != new_rlim->rlim_max)
3697                 return current_has_perm(p, PROCESS__SETRLIMIT);
3698
3699         return 0;
3700 }
3701
3702 static int selinux_task_setscheduler(struct task_struct *p)
3703 {
3704         int rc;
3705
3706         rc = cap_task_setscheduler(p);
3707         if (rc)
3708                 return rc;
3709
3710         return current_has_perm(p, PROCESS__SETSCHED);
3711 }
3712
3713 static int selinux_task_getscheduler(struct task_struct *p)
3714 {
3715         return current_has_perm(p, PROCESS__GETSCHED);
3716 }
3717
3718 static int selinux_task_movememory(struct task_struct *p)
3719 {
3720         return current_has_perm(p, PROCESS__SETSCHED);
3721 }
3722
3723 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3724                                 int sig, u32 secid)
3725 {
3726         u32 perm;
3727         int rc;
3728
3729         if (!sig)
3730                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3731         else
3732                 perm = signal_to_av(sig);
3733         if (secid)
3734                 rc = avc_has_perm(secid, task_sid(p),
3735                                   SECCLASS_PROCESS, perm, NULL);
3736         else
3737                 rc = current_has_perm(p, perm);
3738         return rc;
3739 }
3740
3741 static int selinux_task_wait(struct task_struct *p)
3742 {
3743         return task_has_perm(p, current, PROCESS__SIGCHLD);
3744 }
3745
3746 static void selinux_task_to_inode(struct task_struct *p,
3747                                   struct inode *inode)
3748 {
3749         struct inode_security_struct *isec = inode->i_security;
3750         u32 sid = task_sid(p);
3751
3752         isec->sid = sid;
3753         isec->initialized = 1;
3754 }
3755
3756 /* Returns error only if unable to parse addresses */
3757 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3758                         struct common_audit_data *ad, u8 *proto)
3759 {
3760         int offset, ihlen, ret = -EINVAL;
3761         struct iphdr _iph, *ih;
3762
3763         offset = skb_network_offset(skb);
3764         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3765         if (ih == NULL)
3766                 goto out;
3767
3768         ihlen = ih->ihl * 4;
3769         if (ihlen < sizeof(_iph))
3770                 goto out;
3771
3772         ad->u.net->v4info.saddr = ih->saddr;
3773         ad->u.net->v4info.daddr = ih->daddr;
3774         ret = 0;
3775
3776         if (proto)
3777                 *proto = ih->protocol;
3778
3779         switch (ih->protocol) {
3780         case IPPROTO_TCP: {
3781                 struct tcphdr _tcph, *th;
3782
3783                 if (ntohs(ih->frag_off) & IP_OFFSET)
3784                         break;
3785
3786                 offset += ihlen;
3787                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3788                 if (th == NULL)
3789                         break;
3790
3791                 ad->u.net->sport = th->source;
3792                 ad->u.net->dport = th->dest;
3793                 break;
3794         }
3795
3796         case IPPROTO_UDP: {
3797                 struct udphdr _udph, *uh;
3798
3799                 if (ntohs(ih->frag_off) & IP_OFFSET)
3800                         break;
3801
3802                 offset += ihlen;
3803                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3804                 if (uh == NULL)
3805                         break;
3806
3807                 ad->u.net->sport = uh->source;
3808                 ad->u.net->dport = uh->dest;
3809                 break;
3810         }
3811
3812         case IPPROTO_DCCP: {
3813                 struct dccp_hdr _dccph, *dh;
3814
3815                 if (ntohs(ih->frag_off) & IP_OFFSET)
3816                         break;
3817
3818                 offset += ihlen;
3819                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3820                 if (dh == NULL)
3821                         break;
3822
3823                 ad->u.net->sport = dh->dccph_sport;
3824                 ad->u.net->dport = dh->dccph_dport;
3825                 break;
3826         }
3827
3828         default:
3829                 break;
3830         }
3831 out:
3832         return ret;
3833 }
3834
3835 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3836
3837 /* Returns error only if unable to parse addresses */
3838 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3839                         struct common_audit_data *ad, u8 *proto)
3840 {
3841         u8 nexthdr;
3842         int ret = -EINVAL, offset;
3843         struct ipv6hdr _ipv6h, *ip6;
3844         __be16 frag_off;
3845
3846         offset = skb_network_offset(skb);
3847         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3848         if (ip6 == NULL)
3849                 goto out;
3850
3851         ad->u.net->v6info.saddr = ip6->saddr;
3852         ad->u.net->v6info.daddr = ip6->daddr;
3853         ret = 0;
3854
3855         nexthdr = ip6->nexthdr;
3856         offset += sizeof(_ipv6h);
3857         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3858         if (offset < 0)
3859                 goto out;
3860
3861         if (proto)
3862                 *proto = nexthdr;
3863
3864         switch (nexthdr) {
3865         case IPPROTO_TCP: {
3866                 struct tcphdr _tcph, *th;
3867
3868                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3869                 if (th == NULL)
3870                         break;
3871
3872                 ad->u.net->sport = th->source;
3873                 ad->u.net->dport = th->dest;
3874                 break;
3875         }
3876
3877         case IPPROTO_UDP: {
3878                 struct udphdr _udph, *uh;
3879
3880                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3881                 if (uh == NULL)
3882                         break;
3883
3884                 ad->u.net->sport = uh->source;
3885                 ad->u.net->dport = uh->dest;
3886                 break;
3887         }
3888
3889         case IPPROTO_DCCP: {
3890                 struct dccp_hdr _dccph, *dh;
3891
3892                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3893                 if (dh == NULL)
3894                         break;
3895
3896                 ad->u.net->sport = dh->dccph_sport;
3897                 ad->u.net->dport = dh->dccph_dport;
3898                 break;
3899         }
3900
3901         /* includes fragments */
3902         default:
3903                 break;
3904         }
3905 out:
3906         return ret;
3907 }
3908
3909 #endif /* IPV6 */
3910
3911 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3912                              char **_addrp, int src, u8 *proto)
3913 {
3914         char *addrp;
3915         int ret;
3916
3917         switch (ad->u.net->family) {
3918         case PF_INET:
3919                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3920                 if (ret)
3921                         goto parse_error;
3922                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3923                                        &ad->u.net->v4info.daddr);
3924                 goto okay;
3925
3926 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3927         case PF_INET6:
3928                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3929                 if (ret)
3930                         goto parse_error;
3931                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3932                                        &ad->u.net->v6info.daddr);
3933                 goto okay;
3934 #endif  /* IPV6 */
3935         default:
3936                 addrp = NULL;
3937                 goto okay;
3938         }
3939
3940 parse_error:
3941         printk(KERN_WARNING
3942                "SELinux: failure in selinux_parse_skb(),"
3943                " unable to parse packet\n");
3944         return ret;
3945
3946 okay:
3947         if (_addrp)
3948                 *_addrp = addrp;
3949         return 0;
3950 }
3951
3952 /**
3953  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3954  * @skb: the packet
3955  * @family: protocol family
3956  * @sid: the packet's peer label SID
3957  *
3958  * Description:
3959  * Check the various different forms of network peer labeling and determine
3960  * the peer label/SID for the packet; most of the magic actually occurs in
3961  * the security server function security_net_peersid_cmp().  The function
3962  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3963  * or -EACCES if @sid is invalid due to inconsistencies with the different
3964  * peer labels.
3965  *
3966  */
3967 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3968 {
3969         int err;
3970         u32 xfrm_sid;
3971         u32 nlbl_sid;
3972         u32 nlbl_type;
3973
3974         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3975         if (unlikely(err))
3976                 return -EACCES;
3977         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3978         if (unlikely(err))
3979                 return -EACCES;
3980
3981         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3982         if (unlikely(err)) {
3983                 printk(KERN_WARNING
3984                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3985                        " unable to determine packet's peer label\n");
3986                 return -EACCES;
3987         }
3988
3989         return 0;
3990 }
3991
3992 /**
3993  * selinux_conn_sid - Determine the child socket label for a connection
3994  * @sk_sid: the parent socket's SID
3995  * @skb_sid: the packet's SID
3996  * @conn_sid: the resulting connection SID
3997  *
3998  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3999  * combined with the MLS information from @skb_sid in order to create
4000  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
4001  * of @sk_sid.  Returns zero on success, negative values on failure.
4002  *
4003  */
4004 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4005 {
4006         int err = 0;
4007
4008         if (skb_sid != SECSID_NULL)
4009                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4010         else
4011                 *conn_sid = sk_sid;
4012
4013         return err;
4014 }
4015
4016 /* socket security operations */
4017
4018 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4019                                  u16 secclass, u32 *socksid)
4020 {
4021         if (tsec->sockcreate_sid > SECSID_NULL) {
4022                 *socksid = tsec->sockcreate_sid;
4023                 return 0;
4024         }
4025
4026         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4027                                        socksid);
4028 }
4029
4030 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4031 {
4032         struct sk_security_struct *sksec = sk->sk_security;
4033         struct common_audit_data ad;
4034         struct lsm_network_audit net = {0,};
4035         u32 tsid = task_sid(task);
4036
4037         if (sksec->sid == SECINITSID_KERNEL)
4038                 return 0;
4039
4040         ad.type = LSM_AUDIT_DATA_NET;
4041         ad.u.net = &net;
4042         ad.u.net->sk = sk;
4043
4044         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4045 }
4046
4047 static int selinux_socket_create(int family, int type,
4048                                  int protocol, int kern)
4049 {
4050         const struct task_security_struct *tsec = current_security();
4051         u32 newsid;
4052         u16 secclass;
4053         int rc;
4054
4055         if (kern)
4056                 return 0;
4057
4058         secclass = socket_type_to_security_class(family, type, protocol);
4059         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4060         if (rc)
4061                 return rc;
4062
4063         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4064 }
4065
4066 static int selinux_socket_post_create(struct socket *sock, int family,
4067                                       int type, int protocol, int kern)
4068 {
4069         const struct task_security_struct *tsec = current_security();
4070         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4071         struct sk_security_struct *sksec;
4072         int err = 0;
4073
4074         isec->sclass = socket_type_to_security_class(family, type, protocol);
4075
4076         if (kern)
4077                 isec->sid = SECINITSID_KERNEL;
4078         else {
4079                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4080                 if (err)
4081                         return err;
4082         }
4083
4084         isec->initialized = 1;
4085
4086         if (sock->sk) {
4087                 sksec = sock->sk->sk_security;
4088                 sksec->sid = isec->sid;
4089                 sksec->sclass = isec->sclass;
4090                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4091         }
4092
4093         return err;
4094 }
4095
4096 /* Range of port numbers used to automatically bind.
4097    Need to determine whether we should perform a name_bind
4098    permission check between the socket and the port number. */
4099
4100 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4101 {
4102         struct sock *sk = sock->sk;
4103         u16 family;
4104         int err;
4105
4106         err = sock_has_perm(current, sk, SOCKET__BIND);
4107         if (err)
4108                 goto out;
4109
4110         /*
4111          * If PF_INET or PF_INET6, check name_bind permission for the port.
4112          * Multiple address binding for SCTP is not supported yet: we just
4113          * check the first address now.
4114          */
4115         family = sk->sk_family;
4116         if (family == PF_INET || family == PF_INET6) {
4117                 char *addrp;
4118                 struct sk_security_struct *sksec = sk->sk_security;
4119                 struct common_audit_data ad;
4120                 struct lsm_network_audit net = {0,};
4121                 struct sockaddr_in *addr4 = NULL;
4122                 struct sockaddr_in6 *addr6 = NULL;
4123                 unsigned short snum;
4124                 u32 sid, node_perm;
4125
4126                 if (family == PF_INET) {
4127                         addr4 = (struct sockaddr_in *)address;
4128                         snum = ntohs(addr4->sin_port);
4129                         addrp = (char *)&addr4->sin_addr.s_addr;
4130                 } else {
4131                         addr6 = (struct sockaddr_in6 *)address;
4132                         snum = ntohs(addr6->sin6_port);
4133                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4134                 }
4135
4136                 if (snum) {
4137                         int low, high;
4138
4139                         inet_get_local_port_range(sock_net(sk), &low, &high);
4140
4141                         if (snum < max(PROT_SOCK, low) || snum > high) {
4142                                 err = sel_netport_sid(sk->sk_protocol,
4143                                                       snum, &sid);
4144                                 if (err)
4145                                         goto out;
4146                                 ad.type = LSM_AUDIT_DATA_NET;
4147                                 ad.u.net = &net;
4148                                 ad.u.net->sport = htons(snum);
4149                                 ad.u.net->family = family;
4150                                 err = avc_has_perm(sksec->sid, sid,
4151                                                    sksec->sclass,
4152                                                    SOCKET__NAME_BIND, &ad);
4153                                 if (err)
4154                                         goto out;
4155                         }
4156                 }
4157
4158                 switch (sksec->sclass) {
4159                 case SECCLASS_TCP_SOCKET:
4160                         node_perm = TCP_SOCKET__NODE_BIND;
4161                         break;
4162
4163                 case SECCLASS_UDP_SOCKET:
4164                         node_perm = UDP_SOCKET__NODE_BIND;
4165                         break;
4166
4167                 case SECCLASS_DCCP_SOCKET:
4168                         node_perm = DCCP_SOCKET__NODE_BIND;
4169                         break;
4170
4171                 default:
4172                         node_perm = RAWIP_SOCKET__NODE_BIND;
4173                         break;
4174                 }
4175
4176                 err = sel_netnode_sid(addrp, family, &sid);
4177                 if (err)
4178                         goto out;
4179
4180                 ad.type = LSM_AUDIT_DATA_NET;
4181                 ad.u.net = &net;
4182                 ad.u.net->sport = htons(snum);
4183                 ad.u.net->family = family;
4184
4185                 if (family == PF_INET)
4186                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4187                 else
4188                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4189
4190                 err = avc_has_perm(sksec->sid, sid,
4191                                    sksec->sclass, node_perm, &ad);
4192                 if (err)
4193                         goto out;
4194         }
4195 out:
4196         return err;
4197 }
4198
4199 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4200 {
4201         struct sock *sk = sock->sk;
4202         struct sk_security_struct *sksec = sk->sk_security;
4203         int err;
4204
4205         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4206         if (err)
4207                 return err;
4208
4209         /*
4210          * If a TCP or DCCP socket, check name_connect permission for the port.
4211          */
4212         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4213             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4214                 struct common_audit_data ad;
4215                 struct lsm_network_audit net = {0,};
4216                 struct sockaddr_in *addr4 = NULL;
4217                 struct sockaddr_in6 *addr6 = NULL;
4218                 unsigned short snum;
4219                 u32 sid, perm;
4220
4221                 if (sk->sk_family == PF_INET) {
4222                         addr4 = (struct sockaddr_in *)address;
4223                         if (addrlen < sizeof(struct sockaddr_in))
4224                                 return -EINVAL;
4225                         snum = ntohs(addr4->sin_port);
4226                 } else {
4227                         addr6 = (struct sockaddr_in6 *)address;
4228                         if (addrlen < SIN6_LEN_RFC2133)
4229                                 return -EINVAL;
4230                         snum = ntohs(addr6->sin6_port);
4231                 }
4232
4233                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4234                 if (err)
4235                         goto out;
4236
4237                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4238                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4239
4240                 ad.type = LSM_AUDIT_DATA_NET;
4241                 ad.u.net = &net;
4242                 ad.u.net->dport = htons(snum);
4243                 ad.u.net->family = sk->sk_family;
4244                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4245                 if (err)
4246                         goto out;
4247         }
4248
4249         err = selinux_netlbl_socket_connect(sk, address);
4250
4251 out:
4252         return err;
4253 }
4254
4255 static int selinux_socket_listen(struct socket *sock, int backlog)
4256 {
4257         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4258 }
4259
4260 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4261 {
4262         int err;
4263         struct inode_security_struct *isec;
4264         struct inode_security_struct *newisec;
4265
4266         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4267         if (err)
4268                 return err;
4269
4270         newisec = SOCK_INODE(newsock)->i_security;
4271
4272         isec = SOCK_INODE(sock)->i_security;
4273         newisec->sclass = isec->sclass;
4274         newisec->sid = isec->sid;
4275         newisec->initialized = 1;
4276
4277         return 0;
4278 }
4279
4280 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4281                                   int size)
4282 {
4283         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4284 }
4285
4286 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4287                                   int size, int flags)
4288 {
4289         return sock_has_perm(current, sock->sk, SOCKET__READ);
4290 }
4291
4292 static int selinux_socket_getsockname(struct socket *sock)
4293 {
4294         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4295 }
4296
4297 static int selinux_socket_getpeername(struct socket *sock)
4298 {
4299         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4300 }
4301
4302 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4303 {
4304         int err;
4305
4306         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4307         if (err)
4308                 return err;
4309
4310         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4311 }
4312
4313 static int selinux_socket_getsockopt(struct socket *sock, int level,
4314                                      int optname)
4315 {
4316         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4317 }
4318
4319 static int selinux_socket_shutdown(struct socket *sock, int how)
4320 {
4321         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4322 }
4323
4324 static int selinux_socket_unix_stream_connect(struct sock *sock,
4325                                               struct sock *other,
4326                                               struct sock *newsk)
4327 {
4328         struct sk_security_struct *sksec_sock = sock->sk_security;
4329         struct sk_security_struct *sksec_other = other->sk_security;
4330         struct sk_security_struct *sksec_new = newsk->sk_security;
4331         struct common_audit_data ad;
4332         struct lsm_network_audit net = {0,};
4333         int err;
4334
4335         ad.type = LSM_AUDIT_DATA_NET;
4336         ad.u.net = &net;
4337         ad.u.net->sk = other;
4338
4339         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4340                            sksec_other->sclass,
4341                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4342         if (err)
4343                 return err;
4344
4345         /* server child socket */
4346         sksec_new->peer_sid = sksec_sock->sid;
4347         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4348                                     &sksec_new->sid);
4349         if (err)
4350                 return err;
4351
4352         /* connecting socket */
4353         sksec_sock->peer_sid = sksec_new->sid;
4354
4355         return 0;
4356 }
4357
4358 static int selinux_socket_unix_may_send(struct socket *sock,
4359                                         struct socket *other)
4360 {
4361         struct sk_security_struct *ssec = sock->sk->sk_security;
4362         struct sk_security_struct *osec = other->sk->sk_security;
4363         struct common_audit_data ad;
4364         struct lsm_network_audit net = {0,};
4365
4366         ad.type = LSM_AUDIT_DATA_NET;
4367         ad.u.net = &net;
4368         ad.u.net->sk = other->sk;
4369
4370         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4371                             &ad);
4372 }
4373
4374 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4375                                     char *addrp, u16 family, u32 peer_sid,
4376                                     struct common_audit_data *ad)
4377 {
4378         int err;
4379         u32 if_sid;
4380         u32 node_sid;
4381
4382         err = sel_netif_sid(ns, ifindex, &if_sid);
4383         if (err)
4384                 return err;
4385         err = avc_has_perm(peer_sid, if_sid,
4386                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4387         if (err)
4388                 return err;
4389
4390         err = sel_netnode_sid(addrp, family, &node_sid);
4391         if (err)
4392                 return err;
4393         return avc_has_perm(peer_sid, node_sid,
4394                             SECCLASS_NODE, NODE__RECVFROM, ad);
4395 }
4396
4397 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4398                                        u16 family)
4399 {
4400         int err = 0;
4401         struct sk_security_struct *sksec = sk->sk_security;
4402         u32 sk_sid = sksec->sid;
4403         struct common_audit_data ad;
4404         struct lsm_network_audit net = {0,};
4405         char *addrp;
4406
4407         ad.type = LSM_AUDIT_DATA_NET;
4408         ad.u.net = &net;
4409         ad.u.net->netif = skb->skb_iif;
4410         ad.u.net->family = family;
4411         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4412         if (err)
4413                 return err;
4414
4415         if (selinux_secmark_enabled()) {
4416                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4417                                    PACKET__RECV, &ad);
4418                 if (err)
4419                         return err;
4420         }
4421
4422         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4423         if (err)
4424                 return err;
4425         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4426
4427         return err;
4428 }
4429
4430 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4431 {
4432         int err;
4433         struct sk_security_struct *sksec = sk->sk_security;
4434         u16 family = sk->sk_family;
4435         u32 sk_sid = sksec->sid;
4436         struct common_audit_data ad;
4437         struct lsm_network_audit net = {0,};
4438         char *addrp;
4439         u8 secmark_active;
4440         u8 peerlbl_active;
4441
4442         if (family != PF_INET && family != PF_INET6)
4443                 return 0;
4444
4445         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4446         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4447                 family = PF_INET;
4448
4449         /* If any sort of compatibility mode is enabled then handoff processing
4450          * to the selinux_sock_rcv_skb_compat() function to deal with the
4451          * special handling.  We do this in an attempt to keep this function
4452          * as fast and as clean as possible. */
4453         if (!selinux_policycap_netpeer)
4454                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4455
4456         secmark_active = selinux_secmark_enabled();
4457         peerlbl_active = selinux_peerlbl_enabled();
4458         if (!secmark_active && !peerlbl_active)
4459                 return 0;
4460
4461         ad.type = LSM_AUDIT_DATA_NET;
4462         ad.u.net = &net;
4463         ad.u.net->netif = skb->skb_iif;
4464         ad.u.net->family = family;
4465         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4466         if (err)
4467                 return err;
4468
4469         if (peerlbl_active) {
4470                 u32 peer_sid;
4471
4472                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4473                 if (err)
4474                         return err;
4475                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4476                                                addrp, family, peer_sid, &ad);
4477                 if (err) {
4478                         selinux_netlbl_err(skb, err, 0);
4479                         return err;
4480                 }
4481                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4482                                    PEER__RECV, &ad);
4483                 if (err) {
4484                         selinux_netlbl_err(skb, err, 0);
4485                         return err;
4486                 }
4487         }
4488
4489         if (secmark_active) {
4490                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4491                                    PACKET__RECV, &ad);
4492                 if (err)
4493                         return err;
4494         }
4495
4496         return err;
4497 }
4498
4499 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4500                                             int __user *optlen, unsigned len)
4501 {
4502         int err = 0;
4503         char *scontext;
4504         u32 scontext_len;
4505         struct sk_security_struct *sksec = sock->sk->sk_security;
4506         u32 peer_sid = SECSID_NULL;
4507
4508         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4509             sksec->sclass == SECCLASS_TCP_SOCKET)
4510                 peer_sid = sksec->peer_sid;
4511         if (peer_sid == SECSID_NULL)
4512                 return -ENOPROTOOPT;
4513
4514         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4515         if (err)
4516                 return err;
4517
4518         if (scontext_len > len) {
4519                 err = -ERANGE;
4520                 goto out_len;
4521         }
4522
4523         if (copy_to_user(optval, scontext, scontext_len))
4524                 err = -EFAULT;
4525
4526 out_len:
4527         if (put_user(scontext_len, optlen))
4528                 err = -EFAULT;
4529         kfree(scontext);
4530         return err;
4531 }
4532
4533 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4534 {
4535         u32 peer_secid = SECSID_NULL;
4536         u16 family;
4537
4538         if (skb && skb->protocol == htons(ETH_P_IP))
4539                 family = PF_INET;
4540         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4541                 family = PF_INET6;
4542         else if (sock)
4543                 family = sock->sk->sk_family;
4544         else
4545                 goto out;
4546
4547         if (sock && family == PF_UNIX)
4548                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4549         else if (skb)
4550                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4551
4552 out:
4553         *secid = peer_secid;
4554         if (peer_secid == SECSID_NULL)
4555                 return -EINVAL;
4556         return 0;
4557 }
4558
4559 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4560 {
4561         struct sk_security_struct *sksec;
4562
4563         sksec = kzalloc(sizeof(*sksec), priority);
4564         if (!sksec)
4565                 return -ENOMEM;
4566
4567         sksec->peer_sid = SECINITSID_UNLABELED;
4568         sksec->sid = SECINITSID_UNLABELED;
4569         selinux_netlbl_sk_security_reset(sksec);
4570         sk->sk_security = sksec;
4571
4572         return 0;
4573 }
4574
4575 static void selinux_sk_free_security(struct sock *sk)
4576 {
4577         struct sk_security_struct *sksec = sk->sk_security;
4578
4579         sk->sk_security = NULL;
4580         selinux_netlbl_sk_security_free(sksec);
4581         kfree(sksec);
4582 }
4583
4584 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4585 {
4586         struct sk_security_struct *sksec = sk->sk_security;
4587         struct sk_security_struct *newsksec = newsk->sk_security;
4588
4589         newsksec->sid = sksec->sid;
4590         newsksec->peer_sid = sksec->peer_sid;
4591         newsksec->sclass = sksec->sclass;
4592
4593         selinux_netlbl_sk_security_reset(newsksec);
4594 }
4595
4596 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4597 {
4598         if (!sk)
4599                 *secid = SECINITSID_ANY_SOCKET;
4600         else {
4601                 struct sk_security_struct *sksec = sk->sk_security;
4602
4603                 *secid = sksec->sid;
4604         }
4605 }
4606
4607 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4608 {
4609         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4610         struct sk_security_struct *sksec = sk->sk_security;
4611
4612         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4613             sk->sk_family == PF_UNIX)
4614                 isec->sid = sksec->sid;
4615         sksec->sclass = isec->sclass;
4616 }
4617
4618 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4619                                      struct request_sock *req)
4620 {
4621         struct sk_security_struct *sksec = sk->sk_security;
4622         int err;
4623         u16 family = req->rsk_ops->family;
4624         u32 connsid;
4625         u32 peersid;
4626
4627         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4628         if (err)
4629                 return err;
4630         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4631         if (err)
4632                 return err;
4633         req->secid = connsid;
4634         req->peer_secid = peersid;
4635
4636         return selinux_netlbl_inet_conn_request(req, family);
4637 }
4638
4639 static void selinux_inet_csk_clone(struct sock *newsk,
4640                                    const struct request_sock *req)
4641 {
4642         struct sk_security_struct *newsksec = newsk->sk_security;
4643
4644         newsksec->sid = req->secid;
4645         newsksec->peer_sid = req->peer_secid;
4646         /* NOTE: Ideally, we should also get the isec->sid for the
4647            new socket in sync, but we don't have the isec available yet.
4648            So we will wait until sock_graft to do it, by which
4649            time it will have been created and available. */
4650
4651         /* We don't need to take any sort of lock here as we are the only
4652          * thread with access to newsksec */
4653         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4654 }
4655
4656 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4657 {
4658         u16 family = sk->sk_family;
4659         struct sk_security_struct *sksec = sk->sk_security;
4660
4661         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4662         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4663                 family = PF_INET;
4664
4665         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4666 }
4667
4668 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4669 {
4670         skb_set_owner_w(skb, sk);
4671 }
4672
4673 static int selinux_secmark_relabel_packet(u32 sid)
4674 {
4675         const struct task_security_struct *__tsec;
4676         u32 tsid;
4677
4678         __tsec = current_security();
4679         tsid = __tsec->sid;
4680
4681         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4682 }
4683
4684 static void selinux_secmark_refcount_inc(void)
4685 {
4686         atomic_inc(&selinux_secmark_refcount);
4687 }
4688
4689 static void selinux_secmark_refcount_dec(void)
4690 {
4691         atomic_dec(&selinux_secmark_refcount);
4692 }
4693
4694 static void selinux_req_classify_flow(const struct request_sock *req,
4695                                       struct flowi *fl)
4696 {
4697         fl->flowi_secid = req->secid;
4698 }
4699
4700 static int selinux_tun_dev_alloc_security(void **security)
4701 {
4702         struct tun_security_struct *tunsec;
4703
4704         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4705         if (!tunsec)
4706                 return -ENOMEM;
4707         tunsec->sid = current_sid();
4708
4709         *security = tunsec;
4710         return 0;
4711 }
4712
4713 static void selinux_tun_dev_free_security(void *security)
4714 {
4715         kfree(security);
4716 }
4717
4718 static int selinux_tun_dev_create(void)
4719 {
4720         u32 sid = current_sid();
4721
4722         /* we aren't taking into account the "sockcreate" SID since the socket
4723          * that is being created here is not a socket in the traditional sense,
4724          * instead it is a private sock, accessible only to the kernel, and
4725          * representing a wide range of network traffic spanning multiple
4726          * connections unlike traditional sockets - check the TUN driver to
4727          * get a better understanding of why this socket is special */
4728
4729         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4730                             NULL);
4731 }
4732
4733 static int selinux_tun_dev_attach_queue(void *security)
4734 {
4735         struct tun_security_struct *tunsec = security;
4736
4737         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4738                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4739 }
4740
4741 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4742 {
4743         struct tun_security_struct *tunsec = security;
4744         struct sk_security_struct *sksec = sk->sk_security;
4745
4746         /* we don't currently perform any NetLabel based labeling here and it
4747          * isn't clear that we would want to do so anyway; while we could apply
4748          * labeling without the support of the TUN user the resulting labeled
4749          * traffic from the other end of the connection would almost certainly
4750          * cause confusion to the TUN user that had no idea network labeling
4751          * protocols were being used */
4752
4753         sksec->sid = tunsec->sid;
4754         sksec->sclass = SECCLASS_TUN_SOCKET;
4755
4756         return 0;
4757 }
4758
4759 static int selinux_tun_dev_open(void *security)
4760 {
4761         struct tun_security_struct *tunsec = security;
4762         u32 sid = current_sid();
4763         int err;
4764
4765         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4766                            TUN_SOCKET__RELABELFROM, NULL);
4767         if (err)
4768                 return err;
4769         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4770                            TUN_SOCKET__RELABELTO, NULL);
4771         if (err)
4772                 return err;
4773         tunsec->sid = sid;
4774
4775         return 0;
4776 }
4777
4778 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4779 {
4780         int err = 0;
4781         u32 perm;
4782         struct nlmsghdr *nlh;
4783         struct sk_security_struct *sksec = sk->sk_security;
4784
4785         if (skb->len < NLMSG_HDRLEN) {
4786                 err = -EINVAL;
4787                 goto out;
4788         }
4789         nlh = nlmsg_hdr(skb);
4790
4791         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4792         if (err) {
4793                 if (err == -EINVAL) {
4794                         printk(KERN_WARNING
4795                                "SELinux: unrecognized netlink message:"
4796                                " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4797                                sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4798                         if (!selinux_enforcing || security_get_allow_unknown())
4799                                 err = 0;
4800                 }
4801
4802                 /* Ignore */
4803                 if (err == -ENOENT)
4804                         err = 0;
4805                 goto out;
4806         }
4807
4808         err = sock_has_perm(current, sk, perm);
4809 out:
4810         return err;
4811 }
4812
4813 #ifdef CONFIG_NETFILTER
4814
4815 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4816                                        const struct net_device *indev,
4817                                        u16 family)
4818 {
4819         int err;
4820         char *addrp;
4821         u32 peer_sid;
4822         struct common_audit_data ad;
4823         struct lsm_network_audit net = {0,};
4824         u8 secmark_active;
4825         u8 netlbl_active;
4826         u8 peerlbl_active;
4827
4828         if (!selinux_policycap_netpeer)
4829                 return NF_ACCEPT;
4830
4831         secmark_active = selinux_secmark_enabled();
4832         netlbl_active = netlbl_enabled();
4833         peerlbl_active = selinux_peerlbl_enabled();
4834         if (!secmark_active && !peerlbl_active)
4835                 return NF_ACCEPT;
4836
4837         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4838                 return NF_DROP;
4839
4840         ad.type = LSM_AUDIT_DATA_NET;
4841         ad.u.net = &net;
4842         ad.u.net->netif = indev->ifindex;
4843         ad.u.net->family = family;
4844         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4845                 return NF_DROP;
4846
4847         if (peerlbl_active) {
4848                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4849                                                addrp, family, peer_sid, &ad);
4850                 if (err) {
4851                         selinux_netlbl_err(skb, err, 1);
4852                         return NF_DROP;
4853                 }
4854         }
4855
4856         if (secmark_active)
4857                 if (avc_has_perm(peer_sid, skb->secmark,
4858                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4859                         return NF_DROP;
4860
4861         if (netlbl_active)
4862                 /* we do this in the FORWARD path and not the POST_ROUTING
4863                  * path because we want to make sure we apply the necessary
4864                  * labeling before IPsec is applied so we can leverage AH
4865                  * protection */
4866                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4867                         return NF_DROP;
4868
4869         return NF_ACCEPT;
4870 }
4871
4872 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4873                                          struct sk_buff *skb,
4874                                          const struct net_device *in,
4875                                          const struct net_device *out,
4876                                          int (*okfn)(struct sk_buff *))
4877 {
4878         return selinux_ip_forward(skb, in, PF_INET);
4879 }
4880
4881 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4882 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4883                                          struct sk_buff *skb,
4884                                          const struct net_device *in,
4885                                          const struct net_device *out,
4886                                          int (*okfn)(struct sk_buff *))
4887 {
4888         return selinux_ip_forward(skb, in, PF_INET6);
4889 }
4890 #endif  /* IPV6 */
4891
4892 static unsigned int selinux_ip_output(struct sk_buff *skb,
4893                                       u16 family)
4894 {
4895         struct sock *sk;
4896         u32 sid;
4897
4898         if (!netlbl_enabled())
4899                 return NF_ACCEPT;
4900
4901         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4902          * because we want to make sure we apply the necessary labeling
4903          * before IPsec is applied so we can leverage AH protection */
4904         sk = skb->sk;
4905         if (sk) {
4906                 struct sk_security_struct *sksec;
4907
4908                 if (sk->sk_state == TCP_LISTEN)
4909                         /* if the socket is the listening state then this
4910                          * packet is a SYN-ACK packet which means it needs to
4911                          * be labeled based on the connection/request_sock and
4912                          * not the parent socket.  unfortunately, we can't
4913                          * lookup the request_sock yet as it isn't queued on
4914                          * the parent socket until after the SYN-ACK is sent.
4915                          * the "solution" is to simply pass the packet as-is
4916                          * as any IP option based labeling should be copied
4917                          * from the initial connection request (in the IP
4918                          * layer).  it is far from ideal, but until we get a
4919                          * security label in the packet itself this is the
4920                          * best we can do. */
4921                         return NF_ACCEPT;
4922
4923                 /* standard practice, label using the parent socket */
4924                 sksec = sk->sk_security;
4925                 sid = sksec->sid;
4926         } else
4927                 sid = SECINITSID_KERNEL;
4928         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4929                 return NF_DROP;
4930
4931         return NF_ACCEPT;
4932 }
4933
4934 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4935                                         struct sk_buff *skb,
4936                                         const struct net_device *in,
4937                                         const struct net_device *out,
4938                                         int (*okfn)(struct sk_buff *))
4939 {
4940         return selinux_ip_output(skb, PF_INET);
4941 }
4942
4943 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4944                                                 int ifindex,
4945                                                 u16 family)
4946 {
4947         struct sock *sk = skb->sk;
4948         struct sk_security_struct *sksec;
4949         struct common_audit_data ad;
4950         struct lsm_network_audit net = {0,};
4951         char *addrp;
4952         u8 proto;
4953
4954         if (sk == NULL)
4955                 return NF_ACCEPT;
4956         sksec = sk->sk_security;
4957
4958         ad.type = LSM_AUDIT_DATA_NET;
4959         ad.u.net = &net;
4960         ad.u.net->netif = ifindex;
4961         ad.u.net->family = family;
4962         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4963                 return NF_DROP;
4964
4965         if (selinux_secmark_enabled())
4966                 if (avc_has_perm(sksec->sid, skb->secmark,
4967                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4968                         return NF_DROP_ERR(-ECONNREFUSED);
4969
4970         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4971                 return NF_DROP_ERR(-ECONNREFUSED);
4972
4973         return NF_ACCEPT;
4974 }
4975
4976 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4977                                          const struct net_device *outdev,
4978                                          u16 family)
4979 {
4980         u32 secmark_perm;
4981         u32 peer_sid;
4982         int ifindex = outdev->ifindex;
4983         struct sock *sk;
4984         struct common_audit_data ad;
4985         struct lsm_network_audit net = {0,};
4986         char *addrp;
4987         u8 secmark_active;
4988         u8 peerlbl_active;
4989
4990         /* If any sort of compatibility mode is enabled then handoff processing
4991          * to the selinux_ip_postroute_compat() function to deal with the
4992          * special handling.  We do this in an attempt to keep this function
4993          * as fast and as clean as possible. */
4994         if (!selinux_policycap_netpeer)
4995                 return selinux_ip_postroute_compat(skb, ifindex, family);
4996
4997         secmark_active = selinux_secmark_enabled();
4998         peerlbl_active = selinux_peerlbl_enabled();
4999         if (!secmark_active && !peerlbl_active)
5000                 return NF_ACCEPT;
5001
5002         sk = skb->sk;
5003
5004 #ifdef CONFIG_XFRM
5005         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
5006          * packet transformation so allow the packet to pass without any checks
5007          * since we'll have another chance to perform access control checks
5008          * when the packet is on it's final way out.
5009          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
5010          *       is NULL, in this case go ahead and apply access control.
5011          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5012          *       TCP listening state we cannot wait until the XFRM processing
5013          *       is done as we will miss out on the SA label if we do;
5014          *       unfortunately, this means more work, but it is only once per
5015          *       connection. */
5016         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5017             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5018                 return NF_ACCEPT;
5019 #endif
5020
5021         if (sk == NULL) {
5022                 /* Without an associated socket the packet is either coming
5023                  * from the kernel or it is being forwarded; check the packet
5024                  * to determine which and if the packet is being forwarded
5025                  * query the packet directly to determine the security label. */
5026                 if (skb->skb_iif) {
5027                         secmark_perm = PACKET__FORWARD_OUT;
5028                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5029                                 return NF_DROP;
5030                 } else {
5031                         secmark_perm = PACKET__SEND;
5032                         peer_sid = SECINITSID_KERNEL;
5033                 }
5034         } else if (sk->sk_state == TCP_LISTEN) {
5035                 /* Locally generated packet but the associated socket is in the
5036                  * listening state which means this is a SYN-ACK packet.  In
5037                  * this particular case the correct security label is assigned
5038                  * to the connection/request_sock but unfortunately we can't
5039                  * query the request_sock as it isn't queued on the parent
5040                  * socket until after the SYN-ACK packet is sent; the only
5041                  * viable choice is to regenerate the label like we do in
5042                  * selinux_inet_conn_request().  See also selinux_ip_output()
5043                  * for similar problems. */
5044                 u32 skb_sid;
5045                 struct sk_security_struct *sksec = sk->sk_security;
5046                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5047                         return NF_DROP;
5048                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5049                  * and the packet has been through at least one XFRM
5050                  * transformation then we must be dealing with the "final"
5051                  * form of labeled IPsec packet; since we've already applied
5052                  * all of our access controls on this packet we can safely
5053                  * pass the packet. */
5054                 if (skb_sid == SECSID_NULL) {
5055                         switch (family) {
5056                         case PF_INET:
5057                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5058                                         return NF_ACCEPT;
5059                                 break;
5060                         case PF_INET6:
5061                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5062                                         return NF_ACCEPT;
5063                                 break;
5064                         default:
5065                                 return NF_DROP_ERR(-ECONNREFUSED);
5066                         }
5067                 }
5068                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5069                         return NF_DROP;
5070                 secmark_perm = PACKET__SEND;
5071         } else {
5072                 /* Locally generated packet, fetch the security label from the
5073                  * associated socket. */
5074                 struct sk_security_struct *sksec = sk->sk_security;
5075                 peer_sid = sksec->sid;
5076                 secmark_perm = PACKET__SEND;
5077         }
5078
5079         ad.type = LSM_AUDIT_DATA_NET;
5080         ad.u.net = &net;
5081         ad.u.net->netif = ifindex;
5082         ad.u.net->family = family;
5083         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5084                 return NF_DROP;
5085
5086         if (secmark_active)
5087                 if (avc_has_perm(peer_sid, skb->secmark,
5088                                  SECCLASS_PACKET, secmark_perm, &ad))
5089                         return NF_DROP_ERR(-ECONNREFUSED);
5090
5091         if (peerlbl_active) {
5092                 u32 if_sid;
5093                 u32 node_sid;
5094
5095                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5096                         return NF_DROP;
5097                 if (avc_has_perm(peer_sid, if_sid,
5098                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5099                         return NF_DROP_ERR(-ECONNREFUSED);
5100
5101                 if (sel_netnode_sid(addrp, family, &node_sid))
5102                         return NF_DROP;
5103                 if (avc_has_perm(peer_sid, node_sid,
5104                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5105                         return NF_DROP_ERR(-ECONNREFUSED);
5106         }
5107
5108         return NF_ACCEPT;
5109 }
5110
5111 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5112                                            struct sk_buff *skb,
5113                                            const struct net_device *in,
5114                                            const struct net_device *out,
5115                                            int (*okfn)(struct sk_buff *))
5116 {
5117         return selinux_ip_postroute(skb, out, PF_INET);
5118 }
5119
5120 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5121 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5122                                            struct sk_buff *skb,
5123                                            const struct net_device *in,
5124                                            const struct net_device *out,
5125                                            int (*okfn)(struct sk_buff *))
5126 {
5127         return selinux_ip_postroute(skb, out, PF_INET6);
5128 }
5129 #endif  /* IPV6 */
5130
5131 #endif  /* CONFIG_NETFILTER */
5132
5133 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5134 {
5135         int err;
5136
5137         err = cap_netlink_send(sk, skb);
5138         if (err)
5139                 return err;
5140
5141         return selinux_nlmsg_perm(sk, skb);
5142 }
5143
5144 static int ipc_alloc_security(struct task_struct *task,
5145                               struct kern_ipc_perm *perm,
5146                               u16 sclass)
5147 {
5148         struct ipc_security_struct *isec;
5149         u32 sid;
5150
5151         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5152         if (!isec)
5153                 return -ENOMEM;
5154
5155         sid = task_sid(task);
5156         isec->sclass = sclass;
5157         isec->sid = sid;
5158         perm->security = isec;
5159
5160         return 0;
5161 }
5162
5163 static void ipc_free_security(struct kern_ipc_perm *perm)
5164 {
5165         struct ipc_security_struct *isec = perm->security;
5166         perm->security = NULL;
5167         kfree(isec);
5168 }
5169
5170 static int msg_msg_alloc_security(struct msg_msg *msg)
5171 {
5172         struct msg_security_struct *msec;
5173
5174         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5175         if (!msec)
5176                 return -ENOMEM;
5177
5178         msec->sid = SECINITSID_UNLABELED;
5179         msg->security = msec;
5180
5181         return 0;
5182 }
5183
5184 static void msg_msg_free_security(struct msg_msg *msg)
5185 {
5186         struct msg_security_struct *msec = msg->security;
5187
5188         msg->security = NULL;
5189         kfree(msec);
5190 }
5191
5192 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5193                         u32 perms)
5194 {
5195         struct ipc_security_struct *isec;
5196         struct common_audit_data ad;
5197         u32 sid = current_sid();
5198
5199         isec = ipc_perms->security;
5200
5201         ad.type = LSM_AUDIT_DATA_IPC;
5202         ad.u.ipc_id = ipc_perms->key;
5203
5204         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5205 }
5206
5207 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5208 {
5209         return msg_msg_alloc_security(msg);
5210 }
5211
5212 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5213 {
5214         msg_msg_free_security(msg);
5215 }
5216
5217 /* message queue security operations */
5218 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5219 {
5220         struct ipc_security_struct *isec;
5221         struct common_audit_data ad;
5222         u32 sid = current_sid();
5223         int rc;
5224
5225         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5226         if (rc)
5227                 return rc;
5228
5229         isec = msq->q_perm.security;
5230
5231         ad.type = LSM_AUDIT_DATA_IPC;
5232         ad.u.ipc_id = msq->q_perm.key;
5233
5234         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5235                           MSGQ__CREATE, &ad);
5236         if (rc) {
5237                 ipc_free_security(&msq->q_perm);
5238                 return rc;
5239         }
5240         return 0;
5241 }
5242
5243 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5244 {
5245         ipc_free_security(&msq->q_perm);
5246 }
5247
5248 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5249 {
5250         struct ipc_security_struct *isec;
5251         struct common_audit_data ad;
5252         u32 sid = current_sid();
5253
5254         isec = msq->q_perm.security;
5255
5256         ad.type = LSM_AUDIT_DATA_IPC;
5257         ad.u.ipc_id = msq->q_perm.key;
5258
5259         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5260                             MSGQ__ASSOCIATE, &ad);
5261 }
5262
5263 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5264 {
5265         int err;
5266         int perms;
5267
5268         switch (cmd) {
5269         case IPC_INFO:
5270         case MSG_INFO:
5271                 /* No specific object, just general system-wide information. */
5272                 return task_has_system(current, SYSTEM__IPC_INFO);
5273         case IPC_STAT:
5274         case MSG_STAT:
5275                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5276                 break;
5277         case IPC_SET:
5278                 perms = MSGQ__SETATTR;
5279                 break;
5280         case IPC_RMID:
5281                 perms = MSGQ__DESTROY;
5282                 break;
5283         default:
5284                 return 0;
5285         }
5286
5287         err = ipc_has_perm(&msq->q_perm, perms);
5288         return err;
5289 }
5290
5291 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5292 {
5293         struct ipc_security_struct *isec;
5294         struct msg_security_struct *msec;
5295         struct common_audit_data ad;
5296         u32 sid = current_sid();
5297         int rc;
5298
5299         isec = msq->q_perm.security;
5300         msec = msg->security;
5301
5302         /*
5303          * First time through, need to assign label to the message
5304          */
5305         if (msec->sid == SECINITSID_UNLABELED) {
5306                 /*
5307                  * Compute new sid based on current process and
5308                  * message queue this message will be stored in
5309                  */
5310                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5311                                              NULL, &msec->sid);
5312                 if (rc)
5313                         return rc;
5314         }
5315
5316         ad.type = LSM_AUDIT_DATA_IPC;
5317         ad.u.ipc_id = msq->q_perm.key;
5318
5319         /* Can this process write to the queue? */
5320         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5321                           MSGQ__WRITE, &ad);
5322         if (!rc)
5323                 /* Can this process send the message */
5324                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5325                                   MSG__SEND, &ad);
5326         if (!rc)
5327                 /* Can the message be put in the queue? */
5328                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5329                                   MSGQ__ENQUEUE, &ad);
5330
5331         return rc;
5332 }
5333
5334 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5335                                     struct task_struct *target,
5336                                     long type, int mode)
5337 {
5338         struct ipc_security_struct *isec;
5339         struct msg_security_struct *msec;
5340         struct common_audit_data ad;
5341         u32 sid = task_sid(target);
5342         int rc;
5343
5344         isec = msq->q_perm.security;
5345         msec = msg->security;
5346
5347         ad.type = LSM_AUDIT_DATA_IPC;
5348         ad.u.ipc_id = msq->q_perm.key;
5349
5350         rc = avc_has_perm(sid, isec->sid,
5351                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5352         if (!rc)
5353                 rc = avc_has_perm(sid, msec->sid,
5354                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5355         return rc;
5356 }
5357
5358 /* Shared Memory security operations */
5359 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5360 {
5361         struct ipc_security_struct *isec;
5362         struct common_audit_data ad;
5363         u32 sid = current_sid();
5364         int rc;
5365
5366         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5367         if (rc)
5368                 return rc;
5369
5370         isec = shp->shm_perm.security;
5371
5372         ad.type = LSM_AUDIT_DATA_IPC;
5373         ad.u.ipc_id = shp->shm_perm.key;
5374
5375         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5376                           SHM__CREATE, &ad);
5377         if (rc) {
5378                 ipc_free_security(&shp->shm_perm);
5379                 return rc;
5380         }
5381         return 0;
5382 }
5383
5384 static void selinux_shm_free_security(struct shmid_kernel *shp)
5385 {
5386         ipc_free_security(&shp->shm_perm);
5387 }
5388
5389 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5390 {
5391         struct ipc_security_struct *isec;
5392         struct common_audit_data ad;
5393         u32 sid = current_sid();
5394
5395         isec = shp->shm_perm.security;
5396
5397         ad.type = LSM_AUDIT_DATA_IPC;
5398         ad.u.ipc_id = shp->shm_perm.key;
5399
5400         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5401                             SHM__ASSOCIATE, &ad);
5402 }
5403
5404 /* Note, at this point, shp is locked down */
5405 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5406 {
5407         int perms;
5408         int err;
5409
5410         switch (cmd) {
5411         case IPC_INFO:
5412         case SHM_INFO:
5413                 /* No specific object, just general system-wide information. */
5414                 return task_has_system(current, SYSTEM__IPC_INFO);
5415         case IPC_STAT:
5416         case SHM_STAT:
5417                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5418                 break;
5419         case IPC_SET:
5420                 perms = SHM__SETATTR;
5421                 break;
5422         case SHM_LOCK:
5423         case SHM_UNLOCK:
5424                 perms = SHM__LOCK;
5425                 break;
5426         case IPC_RMID:
5427                 perms = SHM__DESTROY;
5428                 break;
5429         default:
5430                 return 0;
5431         }
5432
5433         err = ipc_has_perm(&shp->shm_perm, perms);
5434         return err;
5435 }
5436
5437 static int selinux_shm_shmat(struct shmid_kernel *shp,
5438                              char __user *shmaddr, int shmflg)
5439 {
5440         u32 perms;
5441
5442         if (shmflg & SHM_RDONLY)
5443                 perms = SHM__READ;
5444         else
5445                 perms = SHM__READ | SHM__WRITE;
5446
5447         return ipc_has_perm(&shp->shm_perm, perms);
5448 }
5449
5450 /* Semaphore security operations */
5451 static int selinux_sem_alloc_security(struct sem_array *sma)
5452 {
5453         struct ipc_security_struct *isec;
5454         struct common_audit_data ad;
5455         u32 sid = current_sid();
5456         int rc;
5457
5458         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5459         if (rc)
5460                 return rc;
5461
5462         isec = sma->sem_perm.security;
5463
5464         ad.type = LSM_AUDIT_DATA_IPC;
5465         ad.u.ipc_id = sma->sem_perm.key;
5466
5467         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5468                           SEM__CREATE, &ad);
5469         if (rc) {
5470                 ipc_free_security(&sma->sem_perm);
5471                 return rc;
5472         }
5473         return 0;
5474 }
5475
5476 static void selinux_sem_free_security(struct sem_array *sma)
5477 {
5478         ipc_free_security(&sma->sem_perm);
5479 }
5480
5481 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5482 {
5483         struct ipc_security_struct *isec;
5484         struct common_audit_data ad;
5485         u32 sid = current_sid();
5486
5487         isec = sma->sem_perm.security;
5488
5489         ad.type = LSM_AUDIT_DATA_IPC;
5490         ad.u.ipc_id = sma->sem_perm.key;
5491
5492         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5493                             SEM__ASSOCIATE, &ad);
5494 }
5495
5496 /* Note, at this point, sma is locked down */
5497 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5498 {
5499         int err;
5500         u32 perms;
5501
5502         switch (cmd) {
5503         case IPC_INFO:
5504         case SEM_INFO:
5505                 /* No specific object, just general system-wide information. */
5506                 return task_has_system(current, SYSTEM__IPC_INFO);
5507         case GETPID:
5508         case GETNCNT:
5509         case GETZCNT:
5510                 perms = SEM__GETATTR;
5511                 break;
5512         case GETVAL:
5513         case GETALL:
5514                 perms = SEM__READ;
5515                 break;
5516         case SETVAL:
5517         case SETALL:
5518                 perms = SEM__WRITE;
5519                 break;
5520         case IPC_RMID:
5521                 perms = SEM__DESTROY;
5522                 break;
5523         case IPC_SET:
5524                 perms = SEM__SETATTR;
5525                 break;
5526         case IPC_STAT:
5527         case SEM_STAT:
5528                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5529                 break;
5530         default:
5531                 return 0;
5532         }
5533
5534         err = ipc_has_perm(&sma->sem_perm, perms);
5535         return err;
5536 }
5537
5538 static int selinux_sem_semop(struct sem_array *sma,
5539                              struct sembuf *sops, unsigned nsops, int alter)
5540 {
5541         u32 perms;
5542
5543         if (alter)
5544                 perms = SEM__READ | SEM__WRITE;
5545         else
5546                 perms = SEM__READ;
5547
5548         return ipc_has_perm(&sma->sem_perm, perms);
5549 }
5550
5551 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5552 {
5553         u32 av = 0;
5554
5555         av = 0;
5556         if (flag & S_IRUGO)
5557                 av |= IPC__UNIX_READ;
5558         if (flag & S_IWUGO)
5559                 av |= IPC__UNIX_WRITE;
5560
5561         if (av == 0)
5562                 return 0;
5563
5564         return ipc_has_perm(ipcp, av);
5565 }
5566
5567 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5568 {
5569         struct ipc_security_struct *isec = ipcp->security;
5570         *secid = isec->sid;
5571 }
5572
5573 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5574 {
5575         if (inode)
5576                 inode_doinit_with_dentry(inode, dentry);
5577 }
5578
5579 static int selinux_getprocattr(struct task_struct *p,
5580                                char *name, char **value)
5581 {
5582         const struct task_security_struct *__tsec;
5583         u32 sid;
5584         int error;
5585         unsigned len;
5586
5587         if (current != p) {
5588                 error = current_has_perm(p, PROCESS__GETATTR);
5589                 if (error)
5590                         return error;
5591         }
5592
5593         rcu_read_lock();
5594         __tsec = __task_cred(p)->security;
5595
5596         if (!strcmp(name, "current"))
5597                 sid = __tsec->sid;
5598         else if (!strcmp(name, "prev"))
5599                 sid = __tsec->osid;
5600         else if (!strcmp(name, "exec"))
5601                 sid = __tsec->exec_sid;
5602         else if (!strcmp(name, "fscreate"))
5603                 sid = __tsec->create_sid;
5604         else if (!strcmp(name, "keycreate"))
5605                 sid = __tsec->keycreate_sid;
5606         else if (!strcmp(name, "sockcreate"))
5607                 sid = __tsec->sockcreate_sid;
5608         else
5609                 goto invalid;
5610         rcu_read_unlock();
5611
5612         if (!sid)
5613                 return 0;
5614
5615         error = security_sid_to_context(sid, value, &len);
5616         if (error)
5617                 return error;
5618         return len;
5619
5620 invalid:
5621         rcu_read_unlock();
5622         return -EINVAL;
5623 }
5624
5625 static int selinux_setprocattr(struct task_struct *p,
5626                                char *name, void *value, size_t size)
5627 {
5628         struct task_security_struct *tsec;
5629         struct task_struct *tracer;
5630         struct cred *new;
5631         u32 sid = 0, ptsid;
5632         int error;
5633         char *str = value;
5634
5635         if (current != p) {
5636                 /* SELinux only allows a process to change its own
5637                    security attributes. */
5638                 return -EACCES;
5639         }
5640
5641         /*
5642          * Basic control over ability to set these attributes at all.
5643          * current == p, but we'll pass them separately in case the
5644          * above restriction is ever removed.
5645          */
5646         if (!strcmp(name, "exec"))
5647                 error = current_has_perm(p, PROCESS__SETEXEC);
5648         else if (!strcmp(name, "fscreate"))
5649                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5650         else if (!strcmp(name, "keycreate"))
5651                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5652         else if (!strcmp(name, "sockcreate"))
5653                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5654         else if (!strcmp(name, "current"))
5655                 error = current_has_perm(p, PROCESS__SETCURRENT);
5656         else
5657                 error = -EINVAL;
5658         if (error)
5659                 return error;
5660
5661         /* Obtain a SID for the context, if one was specified. */
5662         if (size && str[1] && str[1] != '\n') {
5663                 if (str[size-1] == '\n') {
5664                         str[size-1] = 0;
5665                         size--;
5666                 }
5667                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5668                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5669                         if (!capable(CAP_MAC_ADMIN)) {
5670                                 struct audit_buffer *ab;
5671                                 size_t audit_size;
5672
5673                                 /* We strip a nul only if it is at the end, otherwise the
5674                                  * context contains a nul and we should audit that */
5675                                 if (str[size - 1] == '\0')
5676                                         audit_size = size - 1;
5677                                 else
5678                                         audit_size = size;
5679                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5680                                 audit_log_format(ab, "op=fscreate invalid_context=");
5681                                 audit_log_n_untrustedstring(ab, value, audit_size);
5682                                 audit_log_end(ab);
5683
5684                                 return error;
5685                         }
5686                         error = security_context_to_sid_force(value, size,
5687                                                               &sid);
5688                 }
5689                 if (error)
5690                         return error;
5691         }
5692
5693         new = prepare_creds();
5694         if (!new)
5695                 return -ENOMEM;
5696
5697         /* Permission checking based on the specified context is
5698            performed during the actual operation (execve,
5699            open/mkdir/...), when we know the full context of the
5700            operation.  See selinux_bprm_set_creds for the execve
5701            checks and may_create for the file creation checks. The
5702            operation will then fail if the context is not permitted. */
5703         tsec = new->security;
5704         if (!strcmp(name, "exec")) {
5705                 tsec->exec_sid = sid;
5706         } else if (!strcmp(name, "fscreate")) {
5707                 tsec->create_sid = sid;
5708         } else if (!strcmp(name, "keycreate")) {
5709                 error = may_create_key(sid, p);
5710                 if (error)
5711                         goto abort_change;
5712                 tsec->keycreate_sid = sid;
5713         } else if (!strcmp(name, "sockcreate")) {
5714                 tsec->sockcreate_sid = sid;
5715         } else if (!strcmp(name, "current")) {
5716                 error = -EINVAL;
5717                 if (sid == 0)
5718                         goto abort_change;
5719
5720                 /* Only allow single threaded processes to change context */
5721                 error = -EPERM;
5722                 if (!current_is_single_threaded()) {
5723                         error = security_bounded_transition(tsec->sid, sid);
5724                         if (error)
5725                                 goto abort_change;
5726                 }
5727
5728                 /* Check permissions for the transition. */
5729                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5730                                      PROCESS__DYNTRANSITION, NULL);
5731                 if (error)
5732                         goto abort_change;
5733
5734                 /* Check for ptracing, and update the task SID if ok.
5735                    Otherwise, leave SID unchanged and fail. */
5736                 ptsid = 0;
5737                 rcu_read_lock();
5738                 tracer = ptrace_parent(p);
5739                 if (tracer)
5740                         ptsid = task_sid(tracer);
5741                 rcu_read_unlock();
5742
5743                 if (tracer) {
5744                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5745                                              PROCESS__PTRACE, NULL);
5746                         if (error)
5747                                 goto abort_change;
5748                 }
5749
5750                 tsec->sid = sid;
5751         } else {
5752                 error = -EINVAL;
5753                 goto abort_change;
5754         }
5755
5756         commit_creds(new);
5757         return size;
5758
5759 abort_change:
5760         abort_creds(new);
5761         return error;
5762 }
5763
5764 static int selinux_ismaclabel(const char *name)
5765 {
5766         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5767 }
5768
5769 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5770 {
5771         return security_sid_to_context(secid, secdata, seclen);
5772 }
5773
5774 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5775 {
5776         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5777 }
5778
5779 static void selinux_release_secctx(char *secdata, u32 seclen)
5780 {
5781         kfree(secdata);
5782 }
5783
5784 /*
5785  *      called with inode->i_mutex locked
5786  */
5787 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5788 {
5789         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5790 }
5791
5792 /*
5793  *      called with inode->i_mutex locked
5794  */
5795 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5796 {
5797         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5798 }
5799
5800 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5801 {
5802         int len = 0;
5803         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5804                                                 ctx, true);
5805         if (len < 0)
5806                 return len;
5807         *ctxlen = len;
5808         return 0;
5809 }
5810 #ifdef CONFIG_KEYS
5811
5812 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5813                              unsigned long flags)
5814 {
5815         const struct task_security_struct *tsec;
5816         struct key_security_struct *ksec;
5817
5818         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5819         if (!ksec)
5820                 return -ENOMEM;
5821
5822         tsec = cred->security;
5823         if (tsec->keycreate_sid)
5824                 ksec->sid = tsec->keycreate_sid;
5825         else
5826                 ksec->sid = tsec->sid;
5827
5828         k->security = ksec;
5829         return 0;
5830 }
5831
5832 static void selinux_key_free(struct key *k)
5833 {
5834         struct key_security_struct *ksec = k->security;
5835
5836         k->security = NULL;
5837         kfree(ksec);
5838 }
5839
5840 static int selinux_key_permission(key_ref_t key_ref,
5841                                   const struct cred *cred,
5842                                   unsigned perm)
5843 {
5844         struct key *key;
5845         struct key_security_struct *ksec;
5846         u32 sid;
5847
5848         /* if no specific permissions are requested, we skip the
5849            permission check. No serious, additional covert channels
5850            appear to be created. */
5851         if (perm == 0)
5852                 return 0;
5853
5854         sid = cred_sid(cred);
5855
5856         key = key_ref_to_ptr(key_ref);
5857         ksec = key->security;
5858
5859         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5860 }
5861
5862 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5863 {
5864         struct key_security_struct *ksec = key->security;
5865         char *context = NULL;
5866         unsigned len;
5867         int rc;
5868
5869         rc = security_sid_to_context(ksec->sid, &context, &len);
5870         if (!rc)
5871                 rc = len;
5872         *_buffer = context;
5873         return rc;
5874 }
5875
5876 #endif
5877
5878 static struct security_operations selinux_ops = {
5879         .name =                         "selinux",
5880
5881         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5882         .binder_transaction =           selinux_binder_transaction,
5883         .binder_transfer_binder =       selinux_binder_transfer_binder,
5884         .binder_transfer_file =         selinux_binder_transfer_file,
5885
5886         .ptrace_access_check =          selinux_ptrace_access_check,
5887         .ptrace_traceme =               selinux_ptrace_traceme,
5888         .capget =                       selinux_capget,
5889         .capset =                       selinux_capset,
5890         .capable =                      selinux_capable,
5891         .quotactl =                     selinux_quotactl,
5892         .quota_on =                     selinux_quota_on,
5893         .syslog =                       selinux_syslog,
5894         .vm_enough_memory =             selinux_vm_enough_memory,
5895
5896         .netlink_send =                 selinux_netlink_send,
5897
5898         .bprm_set_creds =               selinux_bprm_set_creds,
5899         .bprm_committing_creds =        selinux_bprm_committing_creds,
5900         .bprm_committed_creds =         selinux_bprm_committed_creds,
5901         .bprm_secureexec =              selinux_bprm_secureexec,
5902
5903         .sb_alloc_security =            selinux_sb_alloc_security,
5904         .sb_free_security =             selinux_sb_free_security,
5905         .sb_copy_data =                 selinux_sb_copy_data,
5906         .sb_remount =                   selinux_sb_remount,
5907         .sb_kern_mount =                selinux_sb_kern_mount,
5908         .sb_show_options =              selinux_sb_show_options,
5909         .sb_statfs =                    selinux_sb_statfs,
5910         .sb_mount =                     selinux_mount,
5911         .sb_umount =                    selinux_umount,
5912         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5913         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5914         .sb_parse_opts_str =            selinux_parse_opts_str,
5915
5916         .dentry_init_security =         selinux_dentry_init_security,
5917
5918         .inode_alloc_security =         selinux_inode_alloc_security,
5919         .inode_free_security =          selinux_inode_free_security,
5920         .inode_init_security =          selinux_inode_init_security,
5921         .inode_create =                 selinux_inode_create,
5922         .inode_link =                   selinux_inode_link,
5923         .inode_unlink =                 selinux_inode_unlink,
5924         .inode_symlink =                selinux_inode_symlink,
5925         .inode_mkdir =                  selinux_inode_mkdir,
5926         .inode_rmdir =                  selinux_inode_rmdir,
5927         .inode_mknod =                  selinux_inode_mknod,
5928         .inode_rename =                 selinux_inode_rename,
5929         .inode_readlink =               selinux_inode_readlink,
5930         .inode_follow_link =            selinux_inode_follow_link,
5931         .inode_permission =             selinux_inode_permission,
5932         .inode_setattr =                selinux_inode_setattr,
5933         .inode_getattr =                selinux_inode_getattr,
5934         .inode_setxattr =               selinux_inode_setxattr,
5935         .inode_post_setxattr =          selinux_inode_post_setxattr,
5936         .inode_getxattr =               selinux_inode_getxattr,
5937         .inode_listxattr =              selinux_inode_listxattr,
5938         .inode_removexattr =            selinux_inode_removexattr,
5939         .inode_getsecurity =            selinux_inode_getsecurity,
5940         .inode_setsecurity =            selinux_inode_setsecurity,
5941         .inode_listsecurity =           selinux_inode_listsecurity,
5942         .inode_getsecid =               selinux_inode_getsecid,
5943
5944         .file_permission =              selinux_file_permission,
5945         .file_alloc_security =          selinux_file_alloc_security,
5946         .file_free_security =           selinux_file_free_security,
5947         .file_ioctl =                   selinux_file_ioctl,
5948         .mmap_file =                    selinux_mmap_file,
5949         .mmap_addr =                    selinux_mmap_addr,
5950         .file_mprotect =                selinux_file_mprotect,
5951         .file_lock =                    selinux_file_lock,
5952         .file_fcntl =                   selinux_file_fcntl,
5953         .file_set_fowner =              selinux_file_set_fowner,
5954         .file_send_sigiotask =          selinux_file_send_sigiotask,
5955         .file_receive =                 selinux_file_receive,
5956
5957         .file_open =                    selinux_file_open,
5958
5959         .task_create =                  selinux_task_create,
5960         .cred_alloc_blank =             selinux_cred_alloc_blank,
5961         .cred_free =                    selinux_cred_free,
5962         .cred_prepare =                 selinux_cred_prepare,
5963         .cred_transfer =                selinux_cred_transfer,
5964         .kernel_act_as =                selinux_kernel_act_as,
5965         .kernel_create_files_as =       selinux_kernel_create_files_as,
5966         .kernel_module_request =        selinux_kernel_module_request,
5967         .task_setpgid =                 selinux_task_setpgid,
5968         .task_getpgid =                 selinux_task_getpgid,
5969         .task_getsid =                  selinux_task_getsid,
5970         .task_getsecid =                selinux_task_getsecid,
5971         .task_setnice =                 selinux_task_setnice,
5972         .task_setioprio =               selinux_task_setioprio,
5973         .task_getioprio =               selinux_task_getioprio,
5974         .task_setrlimit =               selinux_task_setrlimit,
5975         .task_setscheduler =            selinux_task_setscheduler,
5976         .task_getscheduler =            selinux_task_getscheduler,
5977         .task_movememory =              selinux_task_movememory,
5978         .task_kill =                    selinux_task_kill,
5979         .task_wait =                    selinux_task_wait,
5980         .task_to_inode =                selinux_task_to_inode,
5981
5982         .ipc_permission =               selinux_ipc_permission,
5983         .ipc_getsecid =                 selinux_ipc_getsecid,
5984
5985         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5986         .msg_msg_free_security =        selinux_msg_msg_free_security,
5987
5988         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5989         .msg_queue_free_security =      selinux_msg_queue_free_security,
5990         .msg_queue_associate =          selinux_msg_queue_associate,
5991         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5992         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5993         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5994
5995         .shm_alloc_security =           selinux_shm_alloc_security,
5996         .shm_free_security =            selinux_shm_free_security,
5997         .shm_associate =                selinux_shm_associate,
5998         .shm_shmctl =                   selinux_shm_shmctl,
5999         .shm_shmat =                    selinux_shm_shmat,
6000
6001         .sem_alloc_security =           selinux_sem_alloc_security,
6002         .sem_free_security =            selinux_sem_free_security,
6003         .sem_associate =                selinux_sem_associate,
6004         .sem_semctl =                   selinux_sem_semctl,
6005         .sem_semop =                    selinux_sem_semop,
6006
6007         .d_instantiate =                selinux_d_instantiate,
6008
6009         .getprocattr =                  selinux_getprocattr,
6010         .setprocattr =                  selinux_setprocattr,
6011
6012         .ismaclabel =                   selinux_ismaclabel,
6013         .secid_to_secctx =              selinux_secid_to_secctx,
6014         .secctx_to_secid =              selinux_secctx_to_secid,
6015         .release_secctx =               selinux_release_secctx,
6016         .inode_notifysecctx =           selinux_inode_notifysecctx,
6017         .inode_setsecctx =              selinux_inode_setsecctx,
6018         .inode_getsecctx =              selinux_inode_getsecctx,
6019
6020         .unix_stream_connect =          selinux_socket_unix_stream_connect,
6021         .unix_may_send =                selinux_socket_unix_may_send,
6022
6023         .socket_create =                selinux_socket_create,
6024         .socket_post_create =           selinux_socket_post_create,
6025         .socket_bind =                  selinux_socket_bind,
6026         .socket_connect =               selinux_socket_connect,
6027         .socket_listen =                selinux_socket_listen,
6028         .socket_accept =                selinux_socket_accept,
6029         .socket_sendmsg =               selinux_socket_sendmsg,
6030         .socket_recvmsg =               selinux_socket_recvmsg,
6031         .socket_getsockname =           selinux_socket_getsockname,
6032         .socket_getpeername =           selinux_socket_getpeername,
6033         .socket_getsockopt =            selinux_socket_getsockopt,
6034         .socket_setsockopt =            selinux_socket_setsockopt,
6035         .socket_shutdown =              selinux_socket_shutdown,
6036         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
6037         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
6038         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
6039         .sk_alloc_security =            selinux_sk_alloc_security,
6040         .sk_free_security =             selinux_sk_free_security,
6041         .sk_clone_security =            selinux_sk_clone_security,
6042         .sk_getsecid =                  selinux_sk_getsecid,
6043         .sock_graft =                   selinux_sock_graft,
6044         .inet_conn_request =            selinux_inet_conn_request,
6045         .inet_csk_clone =               selinux_inet_csk_clone,
6046         .inet_conn_established =        selinux_inet_conn_established,
6047         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
6048         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
6049         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
6050         .req_classify_flow =            selinux_req_classify_flow,
6051         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
6052         .tun_dev_free_security =        selinux_tun_dev_free_security,
6053         .tun_dev_create =               selinux_tun_dev_create,
6054         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
6055         .tun_dev_attach =               selinux_tun_dev_attach,
6056         .tun_dev_open =                 selinux_tun_dev_open,
6057         .skb_owned_by =                 selinux_skb_owned_by,
6058
6059 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6060         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
6061         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
6062         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
6063         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
6064         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
6065         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
6066         .xfrm_state_free_security =     selinux_xfrm_state_free,
6067         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
6068         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
6069         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
6070         .xfrm_decode_session =          selinux_xfrm_decode_session,
6071 #endif
6072
6073 #ifdef CONFIG_KEYS
6074         .key_alloc =                    selinux_key_alloc,
6075         .key_free =                     selinux_key_free,
6076         .key_permission =               selinux_key_permission,
6077         .key_getsecurity =              selinux_key_getsecurity,
6078 #endif
6079
6080 #ifdef CONFIG_AUDIT
6081         .audit_rule_init =              selinux_audit_rule_init,
6082         .audit_rule_known =             selinux_audit_rule_known,
6083         .audit_rule_match =             selinux_audit_rule_match,
6084         .audit_rule_free =              selinux_audit_rule_free,
6085 #endif
6086 };
6087
6088 static __init int selinux_init(void)
6089 {
6090         if (!security_module_enable(&selinux_ops)) {
6091                 selinux_enabled = 0;
6092                 return 0;
6093         }
6094
6095         if (!selinux_enabled) {
6096                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6097                 return 0;
6098         }
6099
6100         printk(KERN_INFO "SELinux:  Initializing.\n");
6101
6102         /* Set the security state for the initial task. */
6103         cred_init_security();
6104
6105         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6106
6107         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6108                                             sizeof(struct inode_security_struct),
6109                                             0, SLAB_PANIC, NULL);
6110         avc_init();
6111
6112         if (register_security(&selinux_ops))
6113                 panic("SELinux: Unable to register with kernel.\n");
6114
6115         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6116                 panic("SELinux: Unable to register AVC netcache callback\n");
6117
6118         if (selinux_enforcing)
6119                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6120         else
6121                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6122
6123         return 0;
6124 }
6125
6126 static void delayed_superblock_init(struct super_block *sb, void *unused)
6127 {
6128         superblock_doinit(sb, NULL);
6129 }
6130
6131 void selinux_complete_init(void)
6132 {
6133         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6134
6135         /* Set up any superblocks initialized prior to the policy load. */
6136         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6137         iterate_supers(delayed_superblock_init, NULL);
6138 }
6139
6140 /* SELinux requires early initialization in order to label
6141    all processes and objects when they are created. */
6142 security_initcall(selinux_init);
6143
6144 #if defined(CONFIG_NETFILTER)
6145
6146 static struct nf_hook_ops selinux_nf_ops[] = {
6147         {
6148                 .hook =         selinux_ipv4_postroute,
6149                 .owner =        THIS_MODULE,
6150                 .pf =           NFPROTO_IPV4,
6151                 .hooknum =      NF_INET_POST_ROUTING,
6152                 .priority =     NF_IP_PRI_SELINUX_LAST,
6153         },
6154         {
6155                 .hook =         selinux_ipv4_forward,
6156                 .owner =        THIS_MODULE,
6157                 .pf =           NFPROTO_IPV4,
6158                 .hooknum =      NF_INET_FORWARD,
6159                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6160         },
6161         {
6162                 .hook =         selinux_ipv4_output,
6163                 .owner =        THIS_MODULE,
6164                 .pf =           NFPROTO_IPV4,
6165                 .hooknum =      NF_INET_LOCAL_OUT,
6166                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6167         },
6168 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6169         {
6170                 .hook =         selinux_ipv6_postroute,
6171                 .owner =        THIS_MODULE,
6172                 .pf =           NFPROTO_IPV6,
6173                 .hooknum =      NF_INET_POST_ROUTING,
6174                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6175         },
6176         {
6177                 .hook =         selinux_ipv6_forward,
6178                 .owner =        THIS_MODULE,
6179                 .pf =           NFPROTO_IPV6,
6180                 .hooknum =      NF_INET_FORWARD,
6181                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6182         },
6183 #endif  /* IPV6 */
6184 };
6185
6186 static int __init selinux_nf_ip_init(void)
6187 {
6188         int err;
6189
6190         if (!selinux_enabled)
6191                 return 0;
6192
6193         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6194
6195         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6196         if (err)
6197                 panic("SELinux: nf_register_hooks: error %d\n", err);
6198
6199         return 0;
6200 }
6201
6202 __initcall(selinux_nf_ip_init);
6203
6204 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6205 static void selinux_nf_ip_exit(void)
6206 {
6207         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6208
6209         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6210 }
6211 #endif
6212
6213 #else /* CONFIG_NETFILTER */
6214
6215 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6216 #define selinux_nf_ip_exit()
6217 #endif
6218
6219 #endif /* CONFIG_NETFILTER */
6220
6221 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6222 static int selinux_disabled;
6223
6224 int selinux_disable(void)
6225 {
6226         if (ss_initialized) {
6227                 /* Not permitted after initial policy load. */
6228                 return -EINVAL;
6229         }
6230
6231         if (selinux_disabled) {
6232                 /* Only do this once. */
6233                 return -EINVAL;
6234         }
6235
6236         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6237
6238         selinux_disabled = 1;
6239         selinux_enabled = 0;
6240
6241         reset_security_ops();
6242
6243         /* Try to destroy the avc node cache */
6244         avc_disable();
6245
6246         /* Unregister netfilter hooks. */
6247         selinux_nf_ip_exit();
6248
6249         /* Unregister selinuxfs. */
6250         exit_sel_fs();
6251
6252         return 0;
6253 }
6254 #endif