security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         spin_lock(&sbsec->isec_lock);
 259         if (!list_empty(&isec->list))
 260                 list_del_init(&isec->list);
 261         spin_unlock(&sbsec->isec_lock);
 262
 263         /*
 264          * The inode may still be referenced in a path walk and
 265          * a call to selinux_inode_permission() can be made
 266          * after inode_free_security() is called. Ideally, the VFS
 267          * wouldn't do this, but fixing that is a much harder
 268          * job. For now, simply free the i_security via RCU, and
 269          * leave the current inode->i_security pointer intact.
 270          * The inode will be freed after the RCU grace period too.
 271          */
 272         call_rcu(&isec->rcu, inode_free_rcu);
 273 }
 274
 275 static int file_alloc_security(struct file *file)
 276 {
 277         struct file_security_struct *fsec;
 278         u32 sid = current_sid();
 279
 280         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 281         if (!fsec)
 282                 return -ENOMEM;
 283
 284         fsec->sid = sid;
 285         fsec->fown_sid = sid;
 286         file->f_security = fsec;
 287
 288         return 0;
 289 }
 290
 291 static void file_free_security(struct file *file)
 292 {
 293         struct file_security_struct *fsec = file->f_security;
 294         file->f_security = NULL;
 295         kfree(fsec);
 296 }
 297
 298 static int superblock_alloc_security(struct super_block *sb)
 299 {
 300         struct superblock_security_struct *sbsec;
 301
 302         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 303         if (!sbsec)
 304                 return -ENOMEM;
 305
 306         mutex_init(&sbsec->lock);
 307         INIT_LIST_HEAD(&sbsec->isec_head);
 308         spin_lock_init(&sbsec->isec_lock);
 309         sbsec->sb = sb;
 310         sbsec->sid = SECINITSID_UNLABELED;
 311         sbsec->def_sid = SECINITSID_FILE;
 312         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 313         sb->s_security = sbsec;
 314
 315         return 0;
 316 }
 317
 318 static void superblock_free_security(struct super_block *sb)
 319 {
 320         struct superblock_security_struct *sbsec = sb->s_security;
 321         sb->s_security = NULL;
 322         kfree(sbsec);
 323 }
 324
 325 /* The file system's label must be initialized prior to use. */
 326
 327 static const char *labeling_behaviors[7] = {
 328         "uses xattr",
 329         "uses transition SIDs",
 330         "uses task SIDs",
 331         "uses genfs_contexts",
 332         "not configured for labeling",
 333         "uses mountpoint labeling",
 334         "uses native labeling",
 335 };
 336
 337 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 338
 339 static inline int inode_doinit(struct inode *inode)
 340 {
 341         return inode_doinit_with_dentry(inode, NULL);
 342 }
 343
 344 enum {
 345         Opt_error = -1,
 346         Opt_context = 1,
 347         Opt_fscontext = 2,
 348         Opt_defcontext = 3,
 349         Opt_rootcontext = 4,
 350         Opt_labelsupport = 5,
 351         Opt_nextmntopt = 6,
 352 };
 353
 354 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 355
 356 static const match_table_t tokens = {
 357         {Opt_context, CONTEXT_STR "%s"},
 358         {Opt_fscontext, FSCONTEXT_STR "%s"},
 359         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 360         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 361         {Opt_labelsupport, LABELSUPP_STR},
 362         {Opt_error, NULL},
 363 };
 364
 365 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 366
 367 static int may_context_mount_sb_relabel(u32 sid,
 368                         struct superblock_security_struct *sbsec,
 369                         const struct cred *cred)
 370 {
 371         const struct task_security_struct *tsec = cred->security;
 372         int rc;
 373
 374         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 375                           FILESYSTEM__RELABELFROM, NULL);
 376         if (rc)
 377                 return rc;
 378
 379         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 380                           FILESYSTEM__RELABELTO, NULL);
 381         return rc;
 382 }
 383
 384 static int may_context_mount_inode_relabel(u32 sid,
 385                         struct superblock_security_struct *sbsec,
 386                         const struct cred *cred)
 387 {
 388         const struct task_security_struct *tsec = cred->security;
 389         int rc;
 390         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELFROM, NULL);
 392         if (rc)
 393                 return rc;
 394
 395         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 396                           FILESYSTEM__ASSOCIATE, NULL);
 397         return rc;
 398 }
 399
 400 static int selinux_is_sblabel_mnt(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403
 404         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 405                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 406                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 407                 /* Special handling. Genfs but also in-core setxattr handler */
 408                 !strcmp(sb->s_type->name, "sysfs") ||
 409                 !strcmp(sb->s_type->name, "pstore") ||
 410                 !strcmp(sb->s_type->name, "debugfs") ||
 411                 !strcmp(sb->s_type->name, "rootfs");
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = root->d_inode;
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450
 451         sbsec->flags |= SE_SBINITIALIZED;
 452         if (selinux_is_sblabel_mnt(sb))
 453                 sbsec->flags |= SBLABEL_MNT;
 454
 455         /* Initialize the root inode. */
 456         rc = inode_doinit_with_dentry(root_inode, root);
 457
 458         /* Initialize any other inodes associated with the superblock, e.g.
 459            inodes created prior to initial policy load or inodes created
 460            during get_sb by a pseudo filesystem that directly
 461            populates itself. */
 462         spin_lock(&sbsec->isec_lock);
 463 next_inode:
 464         if (!list_empty(&sbsec->isec_head)) {
 465                 struct inode_security_struct *isec =
 466                                 list_entry(sbsec->isec_head.next,
 467                                            struct inode_security_struct, list);
 468                 struct inode *inode = isec->inode;
 469                 list_del_init(&isec->list);
 470                 spin_unlock(&sbsec->isec_lock);
 471                 inode = igrab(inode);
 472                 if (inode) {
 473                         if (!IS_PRIVATE(inode))
 474                                 inode_doinit(inode);
 475                         iput(inode);
 476                 }
 477                 spin_lock(&sbsec->isec_lock);
 478                 goto next_inode;
 479         }
 480         spin_unlock(&sbsec->isec_lock);
 481 out:
 482         return rc;
 483 }
 484
 485 /*
 486  * This function should allow an FS to ask what it's mount security
 487  * options were so it can use those later for submounts, displaying
 488  * mount options, or whatever.
 489  */
 490 static int selinux_get_mnt_opts(const struct super_block *sb,
 491                                 struct security_mnt_opts *opts)
 492 {
 493         int rc = 0, i;
 494         struct superblock_security_struct *sbsec = sb->s_security;
 495         char *context = NULL;
 496         u32 len;
 497         char tmp;
 498
 499         security_init_mnt_opts(opts);
 500
 501         if (!(sbsec->flags & SE_SBINITIALIZED))
 502                 return -EINVAL;
 503
 504         if (!ss_initialized)
 505                 return -EINVAL;
 506
 507         /* make sure we always check enough bits to cover the mask */
 508         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 509
 510         tmp = sbsec->flags & SE_MNTMASK;
 511         /* count the number of mount options for this sb */
 512         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 513                 if (tmp & 0x01)
 514                         opts->num_mnt_opts++;
 515                 tmp >>= 1;
 516         }
 517         /* Check if the Label support flag is set */
 518         if (sbsec->flags & SBLABEL_MNT)
 519                 opts->num_mnt_opts++;
 520
 521         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 522         if (!opts->mnt_opts) {
 523                 rc = -ENOMEM;
 524                 goto out_free;
 525         }
 526
 527         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 528         if (!opts->mnt_opts_flags) {
 529                 rc = -ENOMEM;
 530                 goto out_free;
 531         }
 532
 533         i = 0;
 534         if (sbsec->flags & FSCONTEXT_MNT) {
 535                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 536                 if (rc)
 537                         goto out_free;
 538                 opts->mnt_opts[i] = context;
 539                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 540         }
 541         if (sbsec->flags & CONTEXT_MNT) {
 542                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 543                 if (rc)
 544                         goto out_free;
 545                 opts->mnt_opts[i] = context;
 546                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 547         }
 548         if (sbsec->flags & DEFCONTEXT_MNT) {
 549                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 550                 if (rc)
 551                         goto out_free;
 552                 opts->mnt_opts[i] = context;
 553                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 554         }
 555         if (sbsec->flags & ROOTCONTEXT_MNT) {
 556                 struct inode *root = sbsec->sb->s_root->d_inode;
 557                 struct inode_security_struct *isec = root->i_security;
 558
 559                 rc = security_sid_to_context(isec->sid, &context, &len);
 560                 if (rc)
 561                         goto out_free;
 562                 opts->mnt_opts[i] = context;
 563                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 564         }
 565         if (sbsec->flags & SBLABEL_MNT) {
 566                 opts->mnt_opts[i] = NULL;
 567                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 568         }
 569
 570         BUG_ON(i != opts->num_mnt_opts);
 571
 572         return 0;
 573
 574 out_free:
 575         security_free_mnt_opts(opts);
 576         return rc;
 577 }
 578
 579 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 580                       u32 old_sid, u32 new_sid)
 581 {
 582         char mnt_flags = sbsec->flags & SE_MNTMASK;
 583
 584         /* check if the old mount command had the same options */
 585         if (sbsec->flags & SE_SBINITIALIZED)
 586                 if (!(sbsec->flags & flag) ||
 587                     (old_sid != new_sid))
 588                         return 1;
 589
 590         /* check if we were passed the same options twice,
 591          * aka someone passed context=a,context=b
 592          */
 593         if (!(sbsec->flags & SE_SBINITIALIZED))
 594                 if (mnt_flags & flag)
 595                         return 1;
 596         return 0;
 597 }
 598
 599 /*
 600  * Allow filesystems with binary mount data to explicitly set mount point
 601  * labeling information.
 602  */
 603 static int selinux_set_mnt_opts(struct super_block *sb,
 604                                 struct security_mnt_opts *opts,
 605                                 unsigned long kern_flags,
 606                                 unsigned long *set_kern_flags)
 607 {
 608         const struct cred *cred = current_cred();
 609         int rc = 0, i;
 610         struct superblock_security_struct *sbsec = sb->s_security;
 611         const char *name = sb->s_type->name;
 612         struct inode *inode = sbsec->sb->s_root->d_inode;
 613         struct inode_security_struct *root_isec = inode->i_security;
 614         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 615         u32 defcontext_sid = 0;
 616         char **mount_options = opts->mnt_opts;
 617         int *flags = opts->mnt_opts_flags;
 618         int num_opts = opts->num_mnt_opts;
 619
 620         mutex_lock(&sbsec->lock);
 621
 622         if (!ss_initialized) {
 623                 if (!num_opts) {
 624                         /* Defer initialization until selinux_complete_init,
 625                            after the initial policy is loaded and the security
 626                            server is ready to handle calls. */
 627                         goto out;
 628                 }
 629                 rc = -EINVAL;
 630                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 631                         "before the security server is initialized\n");
 632                 goto out;
 633         }
 634         if (kern_flags && !set_kern_flags) {
 635                 /* Specifying internal flags without providing a place to
 636                  * place the results is not allowed */
 637                 rc = -EINVAL;
 638                 goto out;
 639         }
 640
 641         /*
 642          * Binary mount data FS will come through this function twice.  Once
 643          * from an explicit call and once from the generic calls from the vfs.
 644          * Since the generic VFS calls will not contain any security mount data
 645          * we need to skip the double mount verification.
 646          *
 647          * This does open a hole in which we will not notice if the first
 648          * mount using this sb set explict options and a second mount using
 649          * this sb does not set any security options.  (The first options
 650          * will be used for both mounts)
 651          */
 652         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 653             && (num_opts == 0))
 654                 goto out;
 655
 656         /*
 657          * parse the mount options, check if they are valid sids.
 658          * also check if someone is trying to mount the same sb more
 659          * than once with different security options.
 660          */
 661         for (i = 0; i < num_opts; i++) {
 662                 u32 sid;
 663
 664                 if (flags[i] == SBLABEL_MNT)
 665                         continue;
 666                 rc = security_context_to_sid(mount_options[i],
 667                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 668                 if (rc) {
 669                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 670                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 671                                mount_options[i], sb->s_id, name, rc);
 672                         goto out;
 673                 }
 674                 switch (flags[i]) {
 675                 case FSCONTEXT_MNT:
 676                         fscontext_sid = sid;
 677
 678                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 679                                         fscontext_sid))
 680                                 goto out_double_mount;
 681
 682                         sbsec->flags |= FSCONTEXT_MNT;
 683                         break;
 684                 case CONTEXT_MNT:
 685                         context_sid = sid;
 686
 687                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 688                                         context_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= CONTEXT_MNT;
 692                         break;
 693                 case ROOTCONTEXT_MNT:
 694                         rootcontext_sid = sid;
 695
 696                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 697                                         rootcontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= ROOTCONTEXT_MNT;
 701
 702                         break;
 703                 case DEFCONTEXT_MNT:
 704                         defcontext_sid = sid;
 705
 706                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 707                                         defcontext_sid))
 708                                 goto out_double_mount;
 709
 710                         sbsec->flags |= DEFCONTEXT_MNT;
 711
 712                         break;
 713                 default:
 714                         rc = -EINVAL;
 715                         goto out;
 716                 }
 717         }
 718
 719         if (sbsec->flags & SE_SBINITIALIZED) {
 720                 /* previously mounted with options, but not on this attempt? */
 721                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 722                         goto out_double_mount;
 723                 rc = 0;
 724                 goto out;
 725         }
 726
 727         if (strcmp(sb->s_type->name, "proc") == 0)
 728                 sbsec->flags |= SE_SBPROC;
 729
 730         if (!sbsec->behavior) {
 731                 /*
 732                  * Determine the labeling behavior to use for this
 733                  * filesystem type.
 734                  */
 735                 rc = security_fs_use(sb);
 736                 if (rc) {
 737                         printk(KERN_WARNING
 738                                 "%s: security_fs_use(%s) returned %d\n",
 739                                         __func__, sb->s_type->name, rc);
 740                         goto out;
 741                 }
 742         }
 743         /* sets the context of the superblock for the fs being mounted. */
 744         if (fscontext_sid) {
 745                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 746                 if (rc)
 747                         goto out;
 748
 749                 sbsec->sid = fscontext_sid;
 750         }
 751
 752         /*
 753          * Switch to using mount point labeling behavior.
 754          * sets the label used on all file below the mountpoint, and will set
 755          * the superblock context if not already set.
 756          */
 757         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 758                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 759                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 760         }
 761
 762         if (context_sid) {
 763                 if (!fscontext_sid) {
 764                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 765                                                           cred);
 766                         if (rc)
 767                                 goto out;
 768                         sbsec->sid = context_sid;
 769                 } else {
 770                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 771                                                              cred);
 772                         if (rc)
 773                                 goto out;
 774                 }
 775                 if (!rootcontext_sid)
 776                         rootcontext_sid = context_sid;
 777
 778                 sbsec->mntpoint_sid = context_sid;
 779                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 780         }
 781
 782         if (rootcontext_sid) {
 783                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 784                                                      cred);
 785                 if (rc)
 786                         goto out;
 787
 788                 root_isec->sid = rootcontext_sid;
 789                 root_isec->initialized = 1;
 790         }
 791
 792         if (defcontext_sid) {
 793                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 794                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 795                         rc = -EINVAL;
 796                         printk(KERN_WARNING "SELinux: defcontext option is "
 797                                "invalid for this filesystem type\n");
 798                         goto out;
 799                 }
 800
 801                 if (defcontext_sid != sbsec->def_sid) {
 802                         rc = may_context_mount_inode_relabel(defcontext_sid,
 803                                                              sbsec, cred);
 804                         if (rc)
 805                                 goto out;
 806                 }
 807
 808                 sbsec->def_sid = defcontext_sid;
 809         }
 810
 811         rc = sb_finish_set_opts(sb);
 812 out:
 813         mutex_unlock(&sbsec->lock);
 814         return rc;
 815 out_double_mount:
 816         rc = -EINVAL;
 817         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 818                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 819         goto out;
 820 }
 821
 822 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 823                                     const struct super_block *newsb)
 824 {
 825         struct superblock_security_struct *old = oldsb->s_security;
 826         struct superblock_security_struct *new = newsb->s_security;
 827         char oldflags = old->flags & SE_MNTMASK;
 828         char newflags = new->flags & SE_MNTMASK;
 829
 830         if (oldflags != newflags)
 831                 goto mismatch;
 832         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 833                 goto mismatch;
 834         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 835                 goto mismatch;
 836         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 837                 goto mismatch;
 838         if (oldflags & ROOTCONTEXT_MNT) {
 839                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 840                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 841                 if (oldroot->sid != newroot->sid)
 842                         goto mismatch;
 843         }
 844         return 0;
 845 mismatch:
 846         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 847                             "different security settings for (dev %s, "
 848                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 849         return -EBUSY;
 850 }
 851
 852 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 853                                         struct super_block *newsb)
 854 {
 855         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 856         struct superblock_security_struct *newsbsec = newsb->s_security;
 857
 858         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 859         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 860         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 861
 862         /*
 863          * if the parent was able to be mounted it clearly had no special lsm
 864          * mount options.  thus we can safely deal with this superblock later
 865          */
 866         if (!ss_initialized)
 867                 return 0;
 868
 869         /* how can we clone if the old one wasn't set up?? */
 870         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 871
 872         /* if fs is reusing a sb, make sure that the contexts match */
 873         if (newsbsec->flags & SE_SBINITIALIZED)
 874                 return selinux_cmp_sb_context(oldsb, newsb);
 875
 876         mutex_lock(&newsbsec->lock);
 877
 878         newsbsec->flags = oldsbsec->flags;
 879
 880         newsbsec->sid = oldsbsec->sid;
 881         newsbsec->def_sid = oldsbsec->def_sid;
 882         newsbsec->behavior = oldsbsec->behavior;
 883
 884         if (set_context) {
 885                 u32 sid = oldsbsec->mntpoint_sid;
 886
 887                 if (!set_fscontext)
 888                         newsbsec->sid = sid;
 889                 if (!set_rootcontext) {
 890                         struct inode *newinode = newsb->s_root->d_inode;
 891                         struct inode_security_struct *newisec = newinode->i_security;
 892                         newisec->sid = sid;
 893                 }
 894                 newsbsec->mntpoint_sid = sid;
 895         }
 896         if (set_rootcontext) {
 897                 const struct inode *oldinode = oldsb->s_root->d_inode;
 898                 const struct inode_security_struct *oldisec = oldinode->i_security;
 899                 struct inode *newinode = newsb->s_root->d_inode;
 900                 struct inode_security_struct *newisec = newinode->i_security;
 901
 902                 newisec->sid = oldisec->sid;
 903         }
 904
 905         sb_finish_set_opts(newsb);
 906         mutex_unlock(&newsbsec->lock);
 907         return 0;
 908 }
 909
 910 static int selinux_parse_opts_str(char *options,
 911                                   struct security_mnt_opts *opts)
 912 {
 913         char *p;
 914         char *context = NULL, *defcontext = NULL;
 915         char *fscontext = NULL, *rootcontext = NULL;
 916         int rc, num_mnt_opts = 0;
 917
 918         opts->num_mnt_opts = 0;
 919
 920         /* Standard string-based options. */
 921         while ((p = strsep(&options, "|")) != NULL) {
 922                 int token;
 923                 substring_t args[MAX_OPT_ARGS];
 924
 925                 if (!*p)
 926                         continue;
 927
 928                 token = match_token(p, tokens, args);
 929
 930                 switch (token) {
 931                 case Opt_context:
 932                         if (context || defcontext) {
 933                                 rc = -EINVAL;
 934                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 935                                 goto out_err;
 936                         }
 937                         context = match_strdup(&args[0]);
 938                         if (!context) {
 939                                 rc = -ENOMEM;
 940                                 goto out_err;
 941                         }
 942                         break;
 943
 944                 case Opt_fscontext:
 945                         if (fscontext) {
 946                                 rc = -EINVAL;
 947                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 948                                 goto out_err;
 949                         }
 950                         fscontext = match_strdup(&args[0]);
 951                         if (!fscontext) {
 952                                 rc = -ENOMEM;
 953                                 goto out_err;
 954                         }
 955                         break;
 956
 957                 case Opt_rootcontext:
 958                         if (rootcontext) {
 959                                 rc = -EINVAL;
 960                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 961                                 goto out_err;
 962                         }
 963                         rootcontext = match_strdup(&args[0]);
 964                         if (!rootcontext) {
 965                                 rc = -ENOMEM;
 966                                 goto out_err;
 967                         }
 968                         break;
 969
 970                 case Opt_defcontext:
 971                         if (context || defcontext) {
 972                                 rc = -EINVAL;
 973                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 974                                 goto out_err;
 975                         }
 976                         defcontext = match_strdup(&args[0]);
 977                         if (!defcontext) {
 978                                 rc = -ENOMEM;
 979                                 goto out_err;
 980                         }
 981                         break;
 982                 case Opt_labelsupport:
 983                         break;
 984                 default:
 985                         rc = -EINVAL;
 986                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 987                         goto out_err;
 988
 989                 }
 990         }
 991
 992         rc = -ENOMEM;
 993         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 994         if (!opts->mnt_opts)
 995                 goto out_err;
 996
 997         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 998         if (!opts->mnt_opts_flags) {
 999                 kfree(opts->mnt_opts);
1000                 goto out_err;
1001         }
1002
1003         if (fscontext) {
1004                 opts->mnt_opts[num_mnt_opts] = fscontext;
1005                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1006         }
1007         if (context) {
1008                 opts->mnt_opts[num_mnt_opts] = context;
1009                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1010         }
1011         if (rootcontext) {
1012                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1013                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1014         }
1015         if (defcontext) {
1016                 opts->mnt_opts[num_mnt_opts] = defcontext;
1017                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1018         }
1019
1020         opts->num_mnt_opts = num_mnt_opts;
1021         return 0;
1022
1023 out_err:
1024         kfree(context);
1025         kfree(defcontext);
1026         kfree(fscontext);
1027         kfree(rootcontext);
1028         return rc;
1029 }
1030 /*
1031  * string mount options parsing and call set the sbsec
1032  */
1033 static int superblock_doinit(struct super_block *sb, void *data)
1034 {
1035         int rc = 0;
1036         char *options = data;
1037         struct security_mnt_opts opts;
1038
1039         security_init_mnt_opts(&opts);
1040
1041         if (!data)
1042                 goto out;
1043
1044         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1045
1046         rc = selinux_parse_opts_str(options, &opts);
1047         if (rc)
1048                 goto out_err;
1049
1050 out:
1051         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1052
1053 out_err:
1054         security_free_mnt_opts(&opts);
1055         return rc;
1056 }
1057
1058 static void selinux_write_opts(struct seq_file *m,
1059                                struct security_mnt_opts *opts)
1060 {
1061         int i;
1062         char *prefix;
1063
1064         for (i = 0; i < opts->num_mnt_opts; i++) {
1065                 char *has_comma;
1066
1067                 if (opts->mnt_opts[i])
1068                         has_comma = strchr(opts->mnt_opts[i], ',');
1069                 else
1070                         has_comma = NULL;
1071
1072                 switch (opts->mnt_opts_flags[i]) {
1073                 case CONTEXT_MNT:
1074                         prefix = CONTEXT_STR;
1075                         break;
1076                 case FSCONTEXT_MNT:
1077                         prefix = FSCONTEXT_STR;
1078                         break;
1079                 case ROOTCONTEXT_MNT:
1080                         prefix = ROOTCONTEXT_STR;
1081                         break;
1082                 case DEFCONTEXT_MNT:
1083                         prefix = DEFCONTEXT_STR;
1084                         break;
1085                 case SBLABEL_MNT:
1086                         seq_putc(m, ',');
1087                         seq_puts(m, LABELSUPP_STR);
1088                         continue;
1089                 default:
1090                         BUG();
1091                         return;
1092                 };
1093                 /* we need a comma before each option */
1094                 seq_putc(m, ',');
1095                 seq_puts(m, prefix);
1096                 if (has_comma)
1097                         seq_putc(m, '\"');
1098                 seq_puts(m, opts->mnt_opts[i]);
1099                 if (has_comma)
1100                         seq_putc(m, '\"');
1101         }
1102 }
1103
1104 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1105 {
1106         struct security_mnt_opts opts;
1107         int rc;
1108
1109         rc = selinux_get_mnt_opts(sb, &opts);
1110         if (rc) {
1111                 /* before policy load we may get EINVAL, don't show anything */
1112                 if (rc == -EINVAL)
1113                         rc = 0;
1114                 return rc;
1115         }
1116
1117         selinux_write_opts(m, &opts);
1118
1119         security_free_mnt_opts(&opts);
1120
1121         return rc;
1122 }
1123
1124 static inline u16 inode_mode_to_security_class(umode_t mode)
1125 {
1126         switch (mode & S_IFMT) {
1127         case S_IFSOCK:
1128                 return SECCLASS_SOCK_FILE;
1129         case S_IFLNK:
1130                 return SECCLASS_LNK_FILE;
1131         case S_IFREG:
1132                 return SECCLASS_FILE;
1133         case S_IFBLK:
1134                 return SECCLASS_BLK_FILE;
1135         case S_IFDIR:
1136                 return SECCLASS_DIR;
1137         case S_IFCHR:
1138                 return SECCLASS_CHR_FILE;
1139         case S_IFIFO:
1140                 return SECCLASS_FIFO_FILE;
1141
1142         }
1143
1144         return SECCLASS_FILE;
1145 }
1146
1147 static inline int default_protocol_stream(int protocol)
1148 {
1149         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1150 }
1151
1152 static inline int default_protocol_dgram(int protocol)
1153 {
1154         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1155 }
1156
1157 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1158 {
1159         switch (family) {
1160         case PF_UNIX:
1161                 switch (type) {
1162                 case SOCK_STREAM:
1163                 case SOCK_SEQPACKET:
1164                         return SECCLASS_UNIX_STREAM_SOCKET;
1165                 case SOCK_DGRAM:
1166                         return SECCLASS_UNIX_DGRAM_SOCKET;
1167                 }
1168                 break;
1169         case PF_INET:
1170         case PF_INET6:
1171                 switch (type) {
1172                 case SOCK_STREAM:
1173                         if (default_protocol_stream(protocol))
1174                                 return SECCLASS_TCP_SOCKET;
1175                         else
1176                                 return SECCLASS_RAWIP_SOCKET;
1177                 case SOCK_DGRAM:
1178                         if (default_protocol_dgram(protocol))
1179                                 return SECCLASS_UDP_SOCKET;
1180                         else
1181                                 return SECCLASS_RAWIP_SOCKET;
1182                 case SOCK_DCCP:
1183                         return SECCLASS_DCCP_SOCKET;
1184                 default:
1185                         return SECCLASS_RAWIP_SOCKET;
1186                 }
1187                 break;
1188         case PF_NETLINK:
1189                 switch (protocol) {
1190                 case NETLINK_ROUTE:
1191                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1192                 case NETLINK_FIREWALL:
1193                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1194                 case NETLINK_SOCK_DIAG:
1195                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1196                 case NETLINK_NFLOG:
1197                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1198                 case NETLINK_XFRM:
1199                         return SECCLASS_NETLINK_XFRM_SOCKET;
1200                 case NETLINK_SELINUX:
1201                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1202                 case NETLINK_AUDIT:
1203                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1204                 case NETLINK_IP6_FW:
1205                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1206                 case NETLINK_DNRTMSG:
1207                         return SECCLASS_NETLINK_DNRT_SOCKET;
1208                 case NETLINK_KOBJECT_UEVENT:
1209                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1210                 default:
1211                         return SECCLASS_NETLINK_SOCKET;
1212                 }
1213         case PF_PACKET:
1214                 return SECCLASS_PACKET_SOCKET;
1215         case PF_KEY:
1216                 return SECCLASS_KEY_SOCKET;
1217         case PF_APPLETALK:
1218                 return SECCLASS_APPLETALK_SOCKET;
1219         }
1220
1221         return SECCLASS_SOCKET;
1222 }
1223
1224 #ifdef CONFIG_PROC_FS
1225 static int selinux_proc_get_sid(struct dentry *dentry,
1226                                 u16 tclass,
1227                                 u32 *sid)
1228 {
1229         int rc;
1230         char *buffer, *path;
1231
1232         buffer = (char *)__get_free_page(GFP_KERNEL);
1233         if (!buffer)
1234                 return -ENOMEM;
1235
1236         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1237         if (IS_ERR(path))
1238                 rc = PTR_ERR(path);
1239         else {
1240                 /* each process gets a /proc/PID/ entry. Strip off the
1241                  * PID part to get a valid selinux labeling.
1242                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1243                 while (path[1] >= '0' && path[1] <= '9') {
1244                         path[1] = '/';
1245                         path++;
1246                 }
1247                 rc = security_genfs_sid("proc", path, tclass, sid);
1248         }
1249         free_page((unsigned long)buffer);
1250         return rc;
1251 }
1252 #else
1253 static int selinux_proc_get_sid(struct dentry *dentry,
1254                                 u16 tclass,
1255                                 u32 *sid)
1256 {
1257         return -EINVAL;
1258 }
1259 #endif
1260
1261 /* The inode's security attributes must be initialized before first use. */
1262 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1263 {
1264         struct superblock_security_struct *sbsec = NULL;
1265         struct inode_security_struct *isec = inode->i_security;
1266         u32 sid;
1267         struct dentry *dentry;
1268 #define INITCONTEXTLEN 255
1269         char *context = NULL;
1270         unsigned len = 0;
1271         int rc = 0;
1272
1273         if (isec->initialized)
1274                 goto out;
1275
1276         mutex_lock(&isec->lock);
1277         if (isec->initialized)
1278                 goto out_unlock;
1279
1280         sbsec = inode->i_sb->s_security;
1281         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1282                 /* Defer initialization until selinux_complete_init,
1283                    after the initial policy is loaded and the security
1284                    server is ready to handle calls. */
1285                 spin_lock(&sbsec->isec_lock);
1286                 if (list_empty(&isec->list))
1287                         list_add(&isec->list, &sbsec->isec_head);
1288                 spin_unlock(&sbsec->isec_lock);
1289                 goto out_unlock;
1290         }
1291
1292         switch (sbsec->behavior) {
1293         case SECURITY_FS_USE_NATIVE:
1294                 break;
1295         case SECURITY_FS_USE_XATTR:
1296                 if (!inode->i_op->getxattr) {
1297                         isec->sid = sbsec->def_sid;
1298                         break;
1299                 }
1300
1301                 /* Need a dentry, since the xattr API requires one.
1302                    Life would be simpler if we could just pass the inode. */
1303                 if (opt_dentry) {
1304                         /* Called from d_instantiate or d_splice_alias. */
1305                         dentry = dget(opt_dentry);
1306                 } else {
1307                         /* Called from selinux_complete_init, try to find a dentry. */
1308                         dentry = d_find_alias(inode);
1309                 }
1310                 if (!dentry) {
1311                         /*
1312                          * this is can be hit on boot when a file is accessed
1313                          * before the policy is loaded.  When we load policy we
1314                          * may find inodes that have no dentry on the
1315                          * sbsec->isec_head list.  No reason to complain as these
1316                          * will get fixed up the next time we go through
1317                          * inode_doinit with a dentry, before these inodes could
1318                          * be used again by userspace.
1319                          */
1320                         goto out_unlock;
1321                 }
1322
1323                 len = INITCONTEXTLEN;
1324                 context = kmalloc(len+1, GFP_NOFS);
1325                 if (!context) {
1326                         rc = -ENOMEM;
1327                         dput(dentry);
1328                         goto out_unlock;
1329                 }
1330                 context[len] = '\0';
1331                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1332                                            context, len);
1333                 if (rc == -ERANGE) {
1334                         kfree(context);
1335
1336                         /* Need a larger buffer.  Query for the right size. */
1337                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1338                                                    NULL, 0);
1339                         if (rc < 0) {
1340                                 dput(dentry);
1341                                 goto out_unlock;
1342                         }
1343                         len = rc;
1344                         context = kmalloc(len+1, GFP_NOFS);
1345                         if (!context) {
1346                                 rc = -ENOMEM;
1347                                 dput(dentry);
1348                                 goto out_unlock;
1349                         }
1350                         context[len] = '\0';
1351                         rc = inode->i_op->getxattr(dentry,
1352                                                    XATTR_NAME_SELINUX,
1353                                                    context, len);
1354                 }
1355                 dput(dentry);
1356                 if (rc < 0) {
1357                         if (rc != -ENODATA) {
1358                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1359                                        "%d for dev=%s ino=%ld\n", __func__,
1360                                        -rc, inode->i_sb->s_id, inode->i_ino);
1361                                 kfree(context);
1362                                 goto out_unlock;
1363                         }
1364                         /* Map ENODATA to the default file SID */
1365                         sid = sbsec->def_sid;
1366                         rc = 0;
1367                 } else {
1368                         rc = security_context_to_sid_default(context, rc, &sid,
1369                                                              sbsec->def_sid,
1370                                                              GFP_NOFS);
1371                         if (rc) {
1372                                 char *dev = inode->i_sb->s_id;
1373                                 unsigned long ino = inode->i_ino;
1374
1375                                 if (rc == -EINVAL) {
1376                                         if (printk_ratelimit())
1377                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1378                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1379                                                         "filesystem in question.\n", ino, dev, context);
1380                                 } else {
1381                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1382                                                "returned %d for dev=%s ino=%ld\n",
1383                                                __func__, context, -rc, dev, ino);
1384                                 }
1385                                 kfree(context);
1386                                 /* Leave with the unlabeled SID */
1387                                 rc = 0;
1388                                 break;
1389                         }
1390                 }
1391                 kfree(context);
1392                 isec->sid = sid;
1393                 break;
1394         case SECURITY_FS_USE_TASK:
1395                 isec->sid = isec->task_sid;
1396                 break;
1397         case SECURITY_FS_USE_TRANS:
1398                 /* Default to the fs SID. */
1399                 isec->sid = sbsec->sid;
1400
1401                 /* Try to obtain a transition SID. */
1402                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1403                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1404                                              isec->sclass, NULL, &sid);
1405                 if (rc)
1406                         goto out_unlock;
1407                 isec->sid = sid;
1408                 break;
1409         case SECURITY_FS_USE_MNTPOINT:
1410                 isec->sid = sbsec->mntpoint_sid;
1411                 break;
1412         default:
1413                 /* Default to the fs superblock SID. */
1414                 isec->sid = sbsec->sid;
1415
1416                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1417                         /* We must have a dentry to determine the label on
1418                          * procfs inodes */
1419                         if (opt_dentry)
1420                                 /* Called from d_instantiate or
1421                                  * d_splice_alias. */
1422                                 dentry = dget(opt_dentry);
1423                         else
1424                                 /* Called from selinux_complete_init, try to
1425                                  * find a dentry. */
1426                                 dentry = d_find_alias(inode);
1427                         /*
1428                          * This can be hit on boot when a file is accessed
1429                          * before the policy is loaded.  When we load policy we
1430                          * may find inodes that have no dentry on the
1431                          * sbsec->isec_head list.  No reason to complain as
1432                          * these will get fixed up the next time we go through
1433                          * inode_doinit() with a dentry, before these inodes
1434                          * could be used again by userspace.
1435                          */
1436                         if (!dentry)
1437                                 goto out_unlock;
1438                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1439                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1440                         dput(dentry);
1441                         if (rc)
1442                                 goto out_unlock;
1443                         isec->sid = sid;
1444                 }
1445                 break;
1446         }
1447
1448         isec->initialized = 1;
1449
1450 out_unlock:
1451         mutex_unlock(&isec->lock);
1452 out:
1453         if (isec->sclass == SECCLASS_FILE)
1454                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1455         return rc;
1456 }
1457
1458 /* Convert a Linux signal to an access vector. */
1459 static inline u32 signal_to_av(int sig)
1460 {
1461         u32 perm = 0;
1462
1463         switch (sig) {
1464         case SIGCHLD:
1465                 /* Commonly granted from child to parent. */
1466                 perm = PROCESS__SIGCHLD;
1467                 break;
1468         case SIGKILL:
1469                 /* Cannot be caught or ignored */
1470                 perm = PROCESS__SIGKILL;
1471                 break;
1472         case SIGSTOP:
1473                 /* Cannot be caught or ignored */
1474                 perm = PROCESS__SIGSTOP;
1475                 break;
1476         default:
1477                 /* All other signals. */
1478                 perm = PROCESS__SIGNAL;
1479                 break;
1480         }
1481
1482         return perm;
1483 }
1484
1485 /*
1486  * Check permission between a pair of credentials
1487  * fork check, ptrace check, etc.
1488  */
1489 static int cred_has_perm(const struct cred *actor,
1490                          const struct cred *target,
1491                          u32 perms)
1492 {
1493         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1494
1495         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1496 }
1497
1498 /*
1499  * Check permission between a pair of tasks, e.g. signal checks,
1500  * fork check, ptrace check, etc.
1501  * tsk1 is the actor and tsk2 is the target
1502  * - this uses the default subjective creds of tsk1
1503  */
1504 static int task_has_perm(const struct task_struct *tsk1,
1505                          const struct task_struct *tsk2,
1506                          u32 perms)
1507 {
1508         const struct task_security_struct *__tsec1, *__tsec2;
1509         u32 sid1, sid2;
1510
1511         rcu_read_lock();
1512         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1513         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1514         rcu_read_unlock();
1515         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1516 }
1517
1518 /*
1519  * Check permission between current and another task, e.g. signal checks,
1520  * fork check, ptrace check, etc.
1521  * current is the actor and tsk2 is the target
1522  * - this uses current's subjective creds
1523  */
1524 static int current_has_perm(const struct task_struct *tsk,
1525                             u32 perms)
1526 {
1527         u32 sid, tsid;
1528
1529         sid = current_sid();
1530         tsid = task_sid(tsk);
1531         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1532 }
1533
1534 #if CAP_LAST_CAP > 63
1535 #error Fix SELinux to handle capabilities > 63.
1536 #endif
1537
1538 /* Check whether a task is allowed to use a capability. */
1539 static int cred_has_capability(const struct cred *cred,
1540                                int cap, int audit)
1541 {
1542         struct common_audit_data ad;
1543         struct av_decision avd;
1544         u16 sclass;
1545         u32 sid = cred_sid(cred);
1546         u32 av = CAP_TO_MASK(cap);
1547         int rc;
1548
1549         ad.type = LSM_AUDIT_DATA_CAP;
1550         ad.u.cap = cap;
1551
1552         switch (CAP_TO_INDEX(cap)) {
1553         case 0:
1554                 sclass = SECCLASS_CAPABILITY;
1555                 break;
1556         case 1:
1557                 sclass = SECCLASS_CAPABILITY2;
1558                 break;
1559         default:
1560                 printk(KERN_ERR
1561                        "SELinux:  out of range capability %d\n", cap);
1562                 BUG();
1563                 return -EINVAL;
1564         }
1565
1566         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1567         if (audit == SECURITY_CAP_AUDIT) {
1568                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1569                 if (rc2)
1570                         return rc2;
1571         }
1572         return rc;
1573 }
1574
1575 /* Check whether a task is allowed to use a system operation. */
1576 static int task_has_system(struct task_struct *tsk,
1577                            u32 perms)
1578 {
1579         u32 sid = task_sid(tsk);
1580
1581         return avc_has_perm(sid, SECINITSID_KERNEL,
1582                             SECCLASS_SYSTEM, perms, NULL);
1583 }
1584
1585 /* Check whether a task has a particular permission to an inode.
1586    The 'adp' parameter is optional and allows other audit
1587    data to be passed (e.g. the dentry). */
1588 static int inode_has_perm(const struct cred *cred,
1589                           struct inode *inode,
1590                           u32 perms,
1591                           struct common_audit_data *adp)
1592 {
1593         struct inode_security_struct *isec;
1594         u32 sid;
1595
1596         validate_creds(cred);
1597
1598         if (unlikely(IS_PRIVATE(inode)))
1599                 return 0;
1600
1601         sid = cred_sid(cred);
1602         isec = inode->i_security;
1603
1604         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1605 }
1606
1607 /* Same as inode_has_perm, but pass explicit audit data containing
1608    the dentry to help the auditing code to more easily generate the
1609    pathname if needed. */
1610 static inline int dentry_has_perm(const struct cred *cred,
1611                                   struct dentry *dentry,
1612                                   u32 av)
1613 {
1614         struct inode *inode = dentry->d_inode;
1615         struct common_audit_data ad;
1616
1617         ad.type = LSM_AUDIT_DATA_DENTRY;
1618         ad.u.dentry = dentry;
1619         return inode_has_perm(cred, inode, av, &ad);
1620 }
1621
1622 /* Same as inode_has_perm, but pass explicit audit data containing
1623    the path to help the auditing code to more easily generate the
1624    pathname if needed. */
1625 static inline int path_has_perm(const struct cred *cred,
1626                                 struct path *path,
1627                                 u32 av)
1628 {
1629         struct inode *inode = path->dentry->d_inode;
1630         struct common_audit_data ad;
1631
1632         ad.type = LSM_AUDIT_DATA_PATH;
1633         ad.u.path = *path;
1634         return inode_has_perm(cred, inode, av, &ad);
1635 }
1636
1637 /* Same as path_has_perm, but uses the inode from the file struct. */
1638 static inline int file_path_has_perm(const struct cred *cred,
1639                                      struct file *file,
1640                                      u32 av)
1641 {
1642         struct common_audit_data ad;
1643
1644         ad.type = LSM_AUDIT_DATA_PATH;
1645         ad.u.path = file->f_path;
1646         return inode_has_perm(cred, file_inode(file), av, &ad);
1647 }
1648
1649 /* Check whether a task can use an open file descriptor to
1650    access an inode in a given way.  Check access to the
1651    descriptor itself, and then use dentry_has_perm to
1652    check a particular permission to the file.
1653    Access to the descriptor is implicitly granted if it
1654    has the same SID as the process.  If av is zero, then
1655    access to the file is not checked, e.g. for cases
1656    where only the descriptor is affected like seek. */
1657 static int file_has_perm(const struct cred *cred,
1658                          struct file *file,
1659                          u32 av)
1660 {
1661         struct file_security_struct *fsec = file->f_security;
1662         struct inode *inode = file_inode(file);
1663         struct common_audit_data ad;
1664         u32 sid = cred_sid(cred);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_PATH;
1668         ad.u.path = file->f_path;
1669
1670         if (sid != fsec->sid) {
1671                 rc = avc_has_perm(sid, fsec->sid,
1672                                   SECCLASS_FD,
1673                                   FD__USE,
1674                                   &ad);
1675                 if (rc)
1676                         goto out;
1677         }
1678
1679         /* av is zero if only checking access to the descriptor. */
1680         rc = 0;
1681         if (av)
1682                 rc = inode_has_perm(cred, inode, av, &ad);
1683
1684 out:
1685         return rc;
1686 }
1687
1688 /* Check whether a task can create a file. */
1689 static int may_create(struct inode *dir,
1690                       struct dentry *dentry,
1691                       u16 tclass)
1692 {
1693         const struct task_security_struct *tsec = current_security();
1694         struct inode_security_struct *dsec;
1695         struct superblock_security_struct *sbsec;
1696         u32 sid, newsid;
1697         struct common_audit_data ad;
1698         int rc;
1699
1700         dsec = dir->i_security;
1701         sbsec = dir->i_sb->s_security;
1702
1703         sid = tsec->sid;
1704         newsid = tsec->create_sid;
1705
1706         ad.type = LSM_AUDIT_DATA_DENTRY;
1707         ad.u.dentry = dentry;
1708
1709         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1710                           DIR__ADD_NAME | DIR__SEARCH,
1711                           &ad);
1712         if (rc)
1713                 return rc;
1714
1715         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1716                 rc = security_transition_sid(sid, dsec->sid, tclass,
1717                                              &dentry->d_name, &newsid);
1718                 if (rc)
1719                         return rc;
1720         }
1721
1722         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1723         if (rc)
1724                 return rc;
1725
1726         return avc_has_perm(newsid, sbsec->sid,
1727                             SECCLASS_FILESYSTEM,
1728                             FILESYSTEM__ASSOCIATE, &ad);
1729 }
1730
1731 /* Check whether a task can create a key. */
1732 static int may_create_key(u32 ksid,
1733                           struct task_struct *ctx)
1734 {
1735         u32 sid = task_sid(ctx);
1736
1737         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1738 }
1739
1740 #define MAY_LINK        0
1741 #define MAY_UNLINK      1
1742 #define MAY_RMDIR       2
1743
1744 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1745 static int may_link(struct inode *dir,
1746                     struct dentry *dentry,
1747                     int kind)
1748
1749 {
1750         struct inode_security_struct *dsec, *isec;
1751         struct common_audit_data ad;
1752         u32 sid = current_sid();
1753         u32 av;
1754         int rc;
1755
1756         dsec = dir->i_security;
1757         isec = dentry->d_inode->i_security;
1758
1759         ad.type = LSM_AUDIT_DATA_DENTRY;
1760         ad.u.dentry = dentry;
1761
1762         av = DIR__SEARCH;
1763         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1764         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1765         if (rc)
1766                 return rc;
1767
1768         switch (kind) {
1769         case MAY_LINK:
1770                 av = FILE__LINK;
1771                 break;
1772         case MAY_UNLINK:
1773                 av = FILE__UNLINK;
1774                 break;
1775         case MAY_RMDIR:
1776                 av = DIR__RMDIR;
1777                 break;
1778         default:
1779                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1780                         __func__, kind);
1781                 return 0;
1782         }
1783
1784         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1785         return rc;
1786 }
1787
1788 static inline int may_rename(struct inode *old_dir,
1789                              struct dentry *old_dentry,
1790                              struct inode *new_dir,
1791                              struct dentry *new_dentry)
1792 {
1793         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1794         struct common_audit_data ad;
1795         u32 sid = current_sid();
1796         u32 av;
1797         int old_is_dir, new_is_dir;
1798         int rc;
1799
1800         old_dsec = old_dir->i_security;
1801         old_isec = old_dentry->d_inode->i_security;
1802         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1803         new_dsec = new_dir->i_security;
1804
1805         ad.type = LSM_AUDIT_DATA_DENTRY;
1806
1807         ad.u.dentry = old_dentry;
1808         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1809                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1810         if (rc)
1811                 return rc;
1812         rc = avc_has_perm(sid, old_isec->sid,
1813                           old_isec->sclass, FILE__RENAME, &ad);
1814         if (rc)
1815                 return rc;
1816         if (old_is_dir && new_dir != old_dir) {
1817                 rc = avc_has_perm(sid, old_isec->sid,
1818                                   old_isec->sclass, DIR__REPARENT, &ad);
1819                 if (rc)
1820                         return rc;
1821         }
1822
1823         ad.u.dentry = new_dentry;
1824         av = DIR__ADD_NAME | DIR__SEARCH;
1825         if (new_dentry->d_inode)
1826                 av |= DIR__REMOVE_NAME;
1827         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1828         if (rc)
1829                 return rc;
1830         if (new_dentry->d_inode) {
1831                 new_isec = new_dentry->d_inode->i_security;
1832                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1833                 rc = avc_has_perm(sid, new_isec->sid,
1834                                   new_isec->sclass,
1835                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1836                 if (rc)
1837                         return rc;
1838         }
1839
1840         return 0;
1841 }
1842
1843 /* Check whether a task can perform a filesystem operation. */
1844 static int superblock_has_perm(const struct cred *cred,
1845                                struct super_block *sb,
1846                                u32 perms,
1847                                struct common_audit_data *ad)
1848 {
1849         struct superblock_security_struct *sbsec;
1850         u32 sid = cred_sid(cred);
1851
1852         sbsec = sb->s_security;
1853         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1854 }
1855
1856 /* Convert a Linux mode and permission mask to an access vector. */
1857 static inline u32 file_mask_to_av(int mode, int mask)
1858 {
1859         u32 av = 0;
1860
1861         if (!S_ISDIR(mode)) {
1862                 if (mask & MAY_EXEC)
1863                         av |= FILE__EXECUTE;
1864                 if (mask & MAY_READ)
1865                         av |= FILE__READ;
1866
1867                 if (mask & MAY_APPEND)
1868                         av |= FILE__APPEND;
1869                 else if (mask & MAY_WRITE)
1870                         av |= FILE__WRITE;
1871
1872         } else {
1873                 if (mask & MAY_EXEC)
1874                         av |= DIR__SEARCH;
1875                 if (mask & MAY_WRITE)
1876                         av |= DIR__WRITE;
1877                 if (mask & MAY_READ)
1878                         av |= DIR__READ;
1879         }
1880
1881         return av;
1882 }
1883
1884 /* Convert a Linux file to an access vector. */
1885 static inline u32 file_to_av(struct file *file)
1886 {
1887         u32 av = 0;
1888
1889         if (file->f_mode & FMODE_READ)
1890                 av |= FILE__READ;
1891         if (file->f_mode & FMODE_WRITE) {
1892                 if (file->f_flags & O_APPEND)
1893                         av |= FILE__APPEND;
1894                 else
1895                         av |= FILE__WRITE;
1896         }
1897         if (!av) {
1898                 /*
1899                  * Special file opened with flags 3 for ioctl-only use.
1900                  */
1901                 av = FILE__IOCTL;
1902         }
1903
1904         return av;
1905 }
1906
1907 /*
1908  * Convert a file to an access vector and include the correct open
1909  * open permission.
1910  */
1911 static inline u32 open_file_to_av(struct file *file)
1912 {
1913         u32 av = file_to_av(file);
1914
1915         if (selinux_policycap_openperm)
1916                 av |= FILE__OPEN;
1917
1918         return av;
1919 }
1920
1921 /* Hook functions begin here. */
1922
1923 static int selinux_ptrace_access_check(struct task_struct *child,
1924                                      unsigned int mode)
1925 {
1926         int rc;
1927
1928         rc = cap_ptrace_access_check(child, mode);
1929         if (rc)
1930                 return rc;
1931
1932         if (mode & PTRACE_MODE_READ) {
1933                 u32 sid = current_sid();
1934                 u32 csid = task_sid(child);
1935                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1936         }
1937
1938         return current_has_perm(child, PROCESS__PTRACE);
1939 }
1940
1941 static int selinux_ptrace_traceme(struct task_struct *parent)
1942 {
1943         int rc;
1944
1945         rc = cap_ptrace_traceme(parent);
1946         if (rc)
1947                 return rc;
1948
1949         return task_has_perm(parent, current, PROCESS__PTRACE);
1950 }
1951
1952 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1953                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1954 {
1955         int error;
1956
1957         error = current_has_perm(target, PROCESS__GETCAP);
1958         if (error)
1959                 return error;
1960
1961         return cap_capget(target, effective, inheritable, permitted);
1962 }
1963
1964 static int selinux_capset(struct cred *new, const struct cred *old,
1965                           const kernel_cap_t *effective,
1966                           const kernel_cap_t *inheritable,
1967                           const kernel_cap_t *permitted)
1968 {
1969         int error;
1970
1971         error = cap_capset(new, old,
1972                                       effective, inheritable, permitted);
1973         if (error)
1974                 return error;
1975
1976         return cred_has_perm(old, new, PROCESS__SETCAP);
1977 }
1978
1979 /*
1980  * (This comment used to live with the selinux_task_setuid hook,
1981  * which was removed).
1982  *
1983  * Since setuid only affects the current process, and since the SELinux
1984  * controls are not based on the Linux identity attributes, SELinux does not
1985  * need to control this operation.  However, SELinux does control the use of
1986  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1987  */
1988
1989 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1990                            int cap, int audit)
1991 {
1992         int rc;
1993
1994         rc = cap_capable(cred, ns, cap, audit);
1995         if (rc)
1996                 return rc;
1997
1998         return cred_has_capability(cred, cap, audit);
1999 }
2000
2001 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2002 {
2003         const struct cred *cred = current_cred();
2004         int rc = 0;
2005
2006         if (!sb)
2007                 return 0;
2008
2009         switch (cmds) {
2010         case Q_SYNC:
2011         case Q_QUOTAON:
2012         case Q_QUOTAOFF:
2013         case Q_SETINFO:
2014         case Q_SETQUOTA:
2015                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2016                 break;
2017         case Q_GETFMT:
2018         case Q_GETINFO:
2019         case Q_GETQUOTA:
2020                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2021                 break;
2022         default:
2023                 rc = 0;  /* let the kernel handle invalid cmds */
2024                 break;
2025         }
2026         return rc;
2027 }
2028
2029 static int selinux_quota_on(struct dentry *dentry)
2030 {
2031         const struct cred *cred = current_cred();
2032
2033         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2034 }
2035
2036 static int selinux_syslog(int type)
2037 {
2038         int rc;
2039
2040         switch (type) {
2041         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2042         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2043                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2044                 break;
2045         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2046         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2047         /* Set level of messages printed to console */
2048         case SYSLOG_ACTION_CONSOLE_LEVEL:
2049                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2050                 break;
2051         case SYSLOG_ACTION_CLOSE:       /* Close log */
2052         case SYSLOG_ACTION_OPEN:        /* Open log */
2053         case SYSLOG_ACTION_READ:        /* Read from log */
2054         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2055         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2056         default:
2057                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2058                 break;
2059         }
2060         return rc;
2061 }
2062
2063 /*
2064  * Check that a process has enough memory to allocate a new virtual
2065  * mapping. 0 means there is enough memory for the allocation to
2066  * succeed and -ENOMEM implies there is not.
2067  *
2068  * Do not audit the selinux permission check, as this is applied to all
2069  * processes that allocate mappings.
2070  */
2071 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2072 {
2073         int rc, cap_sys_admin = 0;
2074
2075         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2076                              SECURITY_CAP_NOAUDIT);
2077         if (rc == 0)
2078                 cap_sys_admin = 1;
2079
2080         return __vm_enough_memory(mm, pages, cap_sys_admin);
2081 }
2082
2083 /* binprm security operations */
2084
2085 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2086                             const struct task_security_struct *old_tsec,
2087                             const struct task_security_struct *new_tsec)
2088 {
2089         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2090         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2091         int rc;
2092
2093         if (!nnp && !nosuid)
2094                 return 0; /* neither NNP nor nosuid */
2095
2096         if (new_tsec->sid == old_tsec->sid)
2097                 return 0; /* No change in credentials */
2098
2099         /*
2100          * The only transitions we permit under NNP or nosuid
2101          * are transitions to bounded SIDs, i.e. SIDs that are
2102          * guaranteed to only be allowed a subset of the permissions
2103          * of the current SID.
2104          */
2105         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2106         if (rc) {
2107                 /*
2108                  * On failure, preserve the errno values for NNP vs nosuid.
2109                  * NNP:  Operation not permitted for caller.
2110                  * nosuid:  Permission denied to file.
2111                  */
2112                 if (nnp)
2113                         return -EPERM;
2114                 else
2115                         return -EACCES;
2116         }
2117         return 0;
2118 }
2119
2120 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2121 {
2122         const struct task_security_struct *old_tsec;
2123         struct task_security_struct *new_tsec;
2124         struct inode_security_struct *isec;
2125         struct common_audit_data ad;
2126         struct inode *inode = file_inode(bprm->file);
2127         int rc;
2128
2129         rc = cap_bprm_set_creds(bprm);
2130         if (rc)
2131                 return rc;
2132
2133         /* SELinux context only depends on initial program or script and not
2134          * the script interpreter */
2135         if (bprm->cred_prepared)
2136                 return 0;
2137
2138         old_tsec = current_security();
2139         new_tsec = bprm->cred->security;
2140         isec = inode->i_security;
2141
2142         /* Default to the current task SID. */
2143         new_tsec->sid = old_tsec->sid;
2144         new_tsec->osid = old_tsec->sid;
2145
2146         /* Reset fs, key, and sock SIDs on execve. */
2147         new_tsec->create_sid = 0;
2148         new_tsec->keycreate_sid = 0;
2149         new_tsec->sockcreate_sid = 0;
2150
2151         if (old_tsec->exec_sid) {
2152                 new_tsec->sid = old_tsec->exec_sid;
2153                 /* Reset exec SID on execve. */
2154                 new_tsec->exec_sid = 0;
2155
2156                 /* Fail on NNP or nosuid if not an allowed transition. */
2157                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2158                 if (rc)
2159                         return rc;
2160         } else {
2161                 /* Check for a default transition on this program. */
2162                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2163                                              SECCLASS_PROCESS, NULL,
2164                                              &new_tsec->sid);
2165                 if (rc)
2166                         return rc;
2167
2168                 /*
2169                  * Fallback to old SID on NNP or nosuid if not an allowed
2170                  * transition.
2171                  */
2172                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2173                 if (rc)
2174                         new_tsec->sid = old_tsec->sid;
2175         }
2176
2177         ad.type = LSM_AUDIT_DATA_PATH;
2178         ad.u.path = bprm->file->f_path;
2179
2180         if (new_tsec->sid == old_tsec->sid) {
2181                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2182                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2183                 if (rc)
2184                         return rc;
2185         } else {
2186                 /* Check permissions for the transition. */
2187                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2188                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2189                 if (rc)
2190                         return rc;
2191
2192                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2193                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2194                 if (rc)
2195                         return rc;
2196
2197                 /* Check for shared state */
2198                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2199                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2200                                           SECCLASS_PROCESS, PROCESS__SHARE,
2201                                           NULL);
2202                         if (rc)
2203                                 return -EPERM;
2204                 }
2205
2206                 /* Make sure that anyone attempting to ptrace over a task that
2207                  * changes its SID has the appropriate permit */
2208                 if (bprm->unsafe &
2209                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2210                         struct task_struct *tracer;
2211                         struct task_security_struct *sec;
2212                         u32 ptsid = 0;
2213
2214                         rcu_read_lock();
2215                         tracer = ptrace_parent(current);
2216                         if (likely(tracer != NULL)) {
2217                                 sec = __task_cred(tracer)->security;
2218                                 ptsid = sec->sid;
2219                         }
2220                         rcu_read_unlock();
2221
2222                         if (ptsid != 0) {
2223                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2224                                                   SECCLASS_PROCESS,
2225                                                   PROCESS__PTRACE, NULL);
2226                                 if (rc)
2227                                         return -EPERM;
2228                         }
2229                 }
2230
2231                 /* Clear any possibly unsafe personality bits on exec: */
2232                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2233         }
2234
2235         return 0;
2236 }
2237
2238 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2239 {
2240         const struct task_security_struct *tsec = current_security();
2241         u32 sid, osid;
2242         int atsecure = 0;
2243
2244         sid = tsec->sid;
2245         osid = tsec->osid;
2246
2247         if (osid != sid) {
2248                 /* Enable secure mode for SIDs transitions unless
2249                    the noatsecure permission is granted between
2250                    the two SIDs, i.e. ahp returns 0. */
2251                 atsecure = avc_has_perm(osid, sid,
2252                                         SECCLASS_PROCESS,
2253                                         PROCESS__NOATSECURE, NULL);
2254         }
2255
2256         return (atsecure || cap_bprm_secureexec(bprm));
2257 }
2258
2259 static int match_file(const void *p, struct file *file, unsigned fd)
2260 {
2261         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2262 }
2263
2264 /* Derived from fs/exec.c:flush_old_files. */
2265 static inline void flush_unauthorized_files(const struct cred *cred,
2266                                             struct files_struct *files)
2267 {
2268         struct file *file, *devnull = NULL;
2269         struct tty_struct *tty;
2270         int drop_tty = 0;
2271         unsigned n;
2272
2273         tty = get_current_tty();
2274         if (tty) {
2275                 spin_lock(&tty_files_lock);
2276                 if (!list_empty(&tty->tty_files)) {
2277                         struct tty_file_private *file_priv;
2278
2279                         /* Revalidate access to controlling tty.
2280                            Use file_path_has_perm on the tty path directly
2281                            rather than using file_has_perm, as this particular
2282                            open file may belong to another process and we are
2283                            only interested in the inode-based check here. */
2284                         file_priv = list_first_entry(&tty->tty_files,
2285                                                 struct tty_file_private, list);
2286                         file = file_priv->file;
2287                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2288                                 drop_tty = 1;
2289                 }
2290                 spin_unlock(&tty_files_lock);
2291                 tty_kref_put(tty);
2292         }
2293         /* Reset controlling tty. */
2294         if (drop_tty)
2295                 no_tty();
2296
2297         /* Revalidate access to inherited open files. */
2298         n = iterate_fd(files, 0, match_file, cred);
2299         if (!n) /* none found? */
2300                 return;
2301
2302         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2303         if (IS_ERR(devnull))
2304                 devnull = NULL;
2305         /* replace all the matching ones with this */
2306         do {
2307                 replace_fd(n - 1, devnull, 0);
2308         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2309         if (devnull)
2310                 fput(devnull);
2311 }
2312
2313 /*
2314  * Prepare a process for imminent new credential changes due to exec
2315  */
2316 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2317 {
2318         struct task_security_struct *new_tsec;
2319         struct rlimit *rlim, *initrlim;
2320         int rc, i;
2321
2322         new_tsec = bprm->cred->security;
2323         if (new_tsec->sid == new_tsec->osid)
2324                 return;
2325
2326         /* Close files for which the new task SID is not authorized. */
2327         flush_unauthorized_files(bprm->cred, current->files);
2328
2329         /* Always clear parent death signal on SID transitions. */
2330         current->pdeath_signal = 0;
2331
2332         /* Check whether the new SID can inherit resource limits from the old
2333          * SID.  If not, reset all soft limits to the lower of the current
2334          * task's hard limit and the init task's soft limit.
2335          *
2336          * Note that the setting of hard limits (even to lower them) can be
2337          * controlled by the setrlimit check.  The inclusion of the init task's
2338          * soft limit into the computation is to avoid resetting soft limits
2339          * higher than the default soft limit for cases where the default is
2340          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2341          */
2342         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2343                           PROCESS__RLIMITINH, NULL);
2344         if (rc) {
2345                 /* protect against do_prlimit() */
2346                 task_lock(current);
2347                 for (i = 0; i < RLIM_NLIMITS; i++) {
2348                         rlim = current->signal->rlim + i;
2349                         initrlim = init_task.signal->rlim + i;
2350                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2351                 }
2352                 task_unlock(current);
2353                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2354         }
2355 }
2356
2357 /*
2358  * Clean up the process immediately after the installation of new credentials
2359  * due to exec
2360  */
2361 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2362 {
2363         const struct task_security_struct *tsec = current_security();
2364         struct itimerval itimer;
2365         u32 osid, sid;
2366         int rc, i;
2367
2368         osid = tsec->osid;
2369         sid = tsec->sid;
2370
2371         if (sid == osid)
2372                 return;
2373
2374         /* Check whether the new SID can inherit signal state from the old SID.
2375          * If not, clear itimers to avoid subsequent signal generation and
2376          * flush and unblock signals.
2377          *
2378          * This must occur _after_ the task SID has been updated so that any
2379          * kill done after the flush will be checked against the new SID.
2380          */
2381         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2382         if (rc) {
2383                 memset(&itimer, 0, sizeof itimer);
2384                 for (i = 0; i < 3; i++)
2385                         do_setitimer(i, &itimer, NULL);
2386                 spin_lock_irq(&current->sighand->siglock);
2387                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2388                         __flush_signals(current);
2389                         flush_signal_handlers(current, 1);
2390                         sigemptyset(&current->blocked);
2391                 }
2392                 spin_unlock_irq(&current->sighand->siglock);
2393         }
2394
2395         /* Wake up the parent if it is waiting so that it can recheck
2396          * wait permission to the new task SID. */
2397         read_lock(&tasklist_lock);
2398         __wake_up_parent(current, current->real_parent);
2399         read_unlock(&tasklist_lock);
2400 }
2401
2402 /* superblock security operations */
2403
2404 static int selinux_sb_alloc_security(struct super_block *sb)
2405 {
2406         return superblock_alloc_security(sb);
2407 }
2408
2409 static void selinux_sb_free_security(struct super_block *sb)
2410 {
2411         superblock_free_security(sb);
2412 }
2413
2414 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2415 {
2416         if (plen > olen)
2417                 return 0;
2418
2419         return !memcmp(prefix, option, plen);
2420 }
2421
2422 static inline int selinux_option(char *option, int len)
2423 {
2424         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2425                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2426                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2427                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2428                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2429 }
2430
2431 static inline void take_option(char **to, char *from, int *first, int len)
2432 {
2433         if (!*first) {
2434                 **to = ',';
2435                 *to += 1;
2436         } else
2437                 *first = 0;
2438         memcpy(*to, from, len);
2439         *to += len;
2440 }
2441
2442 static inline void take_selinux_option(char **to, char *from, int *first,
2443                                        int len)
2444 {
2445         int current_size = 0;
2446
2447         if (!*first) {
2448                 **to = '|';
2449                 *to += 1;
2450         } else
2451                 *first = 0;
2452
2453         while (current_size < len) {
2454                 if (*from != '"') {
2455                         **to = *from;
2456                         *to += 1;
2457                 }
2458                 from += 1;
2459                 current_size += 1;
2460         }
2461 }
2462
2463 static int selinux_sb_copy_data(char *orig, char *copy)
2464 {
2465         int fnosec, fsec, rc = 0;
2466         char *in_save, *in_curr, *in_end;
2467         char *sec_curr, *nosec_save, *nosec;
2468         int open_quote = 0;
2469
2470         in_curr = orig;
2471         sec_curr = copy;
2472
2473         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2474         if (!nosec) {
2475                 rc = -ENOMEM;
2476                 goto out;
2477         }
2478
2479         nosec_save = nosec;
2480         fnosec = fsec = 1;
2481         in_save = in_end = orig;
2482
2483         do {
2484                 if (*in_end == '"')
2485                         open_quote = !open_quote;
2486                 if ((*in_end == ',' && open_quote == 0) ||
2487                                 *in_end == '\0') {
2488                         int len = in_end - in_curr;
2489
2490                         if (selinux_option(in_curr, len))
2491                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2492                         else
2493                                 take_option(&nosec, in_curr, &fnosec, len);
2494
2495                         in_curr = in_end + 1;
2496                 }
2497         } while (*in_end++);
2498
2499         strcpy(in_save, nosec_save);
2500         free_page((unsigned long)nosec_save);
2501 out:
2502         return rc;
2503 }
2504
2505 static int selinux_sb_remount(struct super_block *sb, void *data)
2506 {
2507         int rc, i, *flags;
2508         struct security_mnt_opts opts;
2509         char *secdata, **mount_options;
2510         struct superblock_security_struct *sbsec = sb->s_security;
2511
2512         if (!(sbsec->flags & SE_SBINITIALIZED))
2513                 return 0;
2514
2515         if (!data)
2516                 return 0;
2517
2518         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2519                 return 0;
2520
2521         security_init_mnt_opts(&opts);
2522         secdata = alloc_secdata();
2523         if (!secdata)
2524                 return -ENOMEM;
2525         rc = selinux_sb_copy_data(data, secdata);
2526         if (rc)
2527                 goto out_free_secdata;
2528
2529         rc = selinux_parse_opts_str(secdata, &opts);
2530         if (rc)
2531                 goto out_free_secdata;
2532
2533         mount_options = opts.mnt_opts;
2534         flags = opts.mnt_opts_flags;
2535
2536         for (i = 0; i < opts.num_mnt_opts; i++) {
2537                 u32 sid;
2538                 size_t len;
2539
2540                 if (flags[i] == SBLABEL_MNT)
2541                         continue;
2542                 len = strlen(mount_options[i]);
2543                 rc = security_context_to_sid(mount_options[i], len, &sid,
2544                                              GFP_KERNEL);
2545                 if (rc) {
2546                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2547                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2548                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2549                         goto out_free_opts;
2550                 }
2551                 rc = -EINVAL;
2552                 switch (flags[i]) {
2553                 case FSCONTEXT_MNT:
2554                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2555                                 goto out_bad_option;
2556                         break;
2557                 case CONTEXT_MNT:
2558                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2559                                 goto out_bad_option;
2560                         break;
2561                 case ROOTCONTEXT_MNT: {
2562                         struct inode_security_struct *root_isec;
2563                         root_isec = sb->s_root->d_inode->i_security;
2564
2565                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2566                                 goto out_bad_option;
2567                         break;
2568                 }
2569                 case DEFCONTEXT_MNT:
2570                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2571                                 goto out_bad_option;
2572                         break;
2573                 default:
2574                         goto out_free_opts;
2575                 }
2576         }
2577
2578         rc = 0;
2579 out_free_opts:
2580         security_free_mnt_opts(&opts);
2581 out_free_secdata:
2582         free_secdata(secdata);
2583         return rc;
2584 out_bad_option:
2585         printk(KERN_WARNING "SELinux: unable to change security options "
2586                "during remount (dev %s, type=%s)\n", sb->s_id,
2587                sb->s_type->name);
2588         goto out_free_opts;
2589 }
2590
2591 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2592 {
2593         const struct cred *cred = current_cred();
2594         struct common_audit_data ad;
2595         int rc;
2596
2597         rc = superblock_doinit(sb, data);
2598         if (rc)
2599                 return rc;
2600
2601         /* Allow all mounts performed by the kernel */
2602         if (flags & MS_KERNMOUNT)
2603                 return 0;
2604
2605         ad.type = LSM_AUDIT_DATA_DENTRY;
2606         ad.u.dentry = sb->s_root;
2607         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2608 }
2609
2610 static int selinux_sb_statfs(struct dentry *dentry)
2611 {
2612         const struct cred *cred = current_cred();
2613         struct common_audit_data ad;
2614
2615         ad.type = LSM_AUDIT_DATA_DENTRY;
2616         ad.u.dentry = dentry->d_sb->s_root;
2617         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2618 }
2619
2620 static int selinux_mount(const char *dev_name,
2621                          struct path *path,
2622                          const char *type,
2623                          unsigned long flags,
2624                          void *data)
2625 {
2626         const struct cred *cred = current_cred();
2627
2628         if (flags & MS_REMOUNT)
2629                 return superblock_has_perm(cred, path->dentry->d_sb,
2630                                            FILESYSTEM__REMOUNT, NULL);
2631         else
2632                 return path_has_perm(cred, path, FILE__MOUNTON);
2633 }
2634
2635 static int selinux_umount(struct vfsmount *mnt, int flags)
2636 {
2637         const struct cred *cred = current_cred();
2638
2639         return superblock_has_perm(cred, mnt->mnt_sb,
2640                                    FILESYSTEM__UNMOUNT, NULL);
2641 }
2642
2643 /* inode security operations */
2644
2645 static int selinux_inode_alloc_security(struct inode *inode)
2646 {
2647         return inode_alloc_security(inode);
2648 }
2649
2650 static void selinux_inode_free_security(struct inode *inode)
2651 {
2652         inode_free_security(inode);
2653 }
2654
2655 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2656                                         struct qstr *name, void **ctx,
2657                                         u32 *ctxlen)
2658 {
2659         const struct cred *cred = current_cred();
2660         struct task_security_struct *tsec;
2661         struct inode_security_struct *dsec;
2662         struct superblock_security_struct *sbsec;
2663         struct inode *dir = dentry->d_parent->d_inode;
2664         u32 newsid;
2665         int rc;
2666
2667         tsec = cred->security;
2668         dsec = dir->i_security;
2669         sbsec = dir->i_sb->s_security;
2670
2671         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2672                 newsid = tsec->create_sid;
2673         } else {
2674                 rc = security_transition_sid(tsec->sid, dsec->sid,
2675                                              inode_mode_to_security_class(mode),
2676                                              name,
2677                                              &newsid);
2678                 if (rc) {
2679                         printk(KERN_WARNING
2680                                 "%s: security_transition_sid failed, rc=%d\n",
2681                                __func__, -rc);
2682                         return rc;
2683                 }
2684         }
2685
2686         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2687 }
2688
2689 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2690                                        const struct qstr *qstr,
2691                                        const char **name,
2692                                        void **value, size_t *len)
2693 {
2694         const struct task_security_struct *tsec = current_security();
2695         struct inode_security_struct *dsec;
2696         struct superblock_security_struct *sbsec;
2697         u32 sid, newsid, clen;
2698         int rc;
2699         char *context;
2700
2701         dsec = dir->i_security;
2702         sbsec = dir->i_sb->s_security;
2703
2704         sid = tsec->sid;
2705         newsid = tsec->create_sid;
2706
2707         if ((sbsec->flags & SE_SBINITIALIZED) &&
2708             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2709                 newsid = sbsec->mntpoint_sid;
2710         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2711                 rc = security_transition_sid(sid, dsec->sid,
2712                                              inode_mode_to_security_class(inode->i_mode),
2713                                              qstr, &newsid);
2714                 if (rc) {
2715                         printk(KERN_WARNING "%s:  "
2716                                "security_transition_sid failed, rc=%d (dev=%s "
2717                                "ino=%ld)\n",
2718                                __func__,
2719                                -rc, inode->i_sb->s_id, inode->i_ino);
2720                         return rc;
2721                 }
2722         }
2723
2724         /* Possibly defer initialization to selinux_complete_init. */
2725         if (sbsec->flags & SE_SBINITIALIZED) {
2726                 struct inode_security_struct *isec = inode->i_security;
2727                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2728                 isec->sid = newsid;
2729                 isec->initialized = 1;
2730         }
2731
2732         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2733                 return -EOPNOTSUPP;
2734
2735         if (name)
2736                 *name = XATTR_SELINUX_SUFFIX;
2737
2738         if (value && len) {
2739                 rc = security_sid_to_context_force(newsid, &context, &clen);
2740                 if (rc)
2741                         return rc;
2742                 *value = context;
2743                 *len = clen;
2744         }
2745
2746         return 0;
2747 }
2748
2749 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2750 {
2751         return may_create(dir, dentry, SECCLASS_FILE);
2752 }
2753
2754 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2755 {
2756         return may_link(dir, old_dentry, MAY_LINK);
2757 }
2758
2759 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2760 {
2761         return may_link(dir, dentry, MAY_UNLINK);
2762 }
2763
2764 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2765 {
2766         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2767 }
2768
2769 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2770 {
2771         return may_create(dir, dentry, SECCLASS_DIR);
2772 }
2773
2774 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2775 {
2776         return may_link(dir, dentry, MAY_RMDIR);
2777 }
2778
2779 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2780 {
2781         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2782 }
2783
2784 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2785                                 struct inode *new_inode, struct dentry *new_dentry)
2786 {
2787         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2788 }
2789
2790 static int selinux_inode_readlink(struct dentry *dentry)
2791 {
2792         const struct cred *cred = current_cred();
2793
2794         return dentry_has_perm(cred, dentry, FILE__READ);
2795 }
2796
2797 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2798 {
2799         const struct cred *cred = current_cred();
2800
2801         return dentry_has_perm(cred, dentry, FILE__READ);
2802 }
2803
2804 static noinline int audit_inode_permission(struct inode *inode,
2805                                            u32 perms, u32 audited, u32 denied,
2806                                            int result,
2807                                            unsigned flags)
2808 {
2809         struct common_audit_data ad;
2810         struct inode_security_struct *isec = inode->i_security;
2811         int rc;
2812
2813         ad.type = LSM_AUDIT_DATA_INODE;
2814         ad.u.inode = inode;
2815
2816         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2817                             audited, denied, result, &ad, flags);
2818         if (rc)
2819                 return rc;
2820         return 0;
2821 }
2822
2823 static int selinux_inode_permission(struct inode *inode, int mask)
2824 {
2825         const struct cred *cred = current_cred();
2826         u32 perms;
2827         bool from_access;
2828         unsigned flags = mask & MAY_NOT_BLOCK;
2829         struct inode_security_struct *isec;
2830         u32 sid;
2831         struct av_decision avd;
2832         int rc, rc2;
2833         u32 audited, denied;
2834
2835         from_access = mask & MAY_ACCESS;
2836         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2837
2838         /* No permission to check.  Existence test. */
2839         if (!mask)
2840                 return 0;
2841
2842         validate_creds(cred);
2843
2844         if (unlikely(IS_PRIVATE(inode)))
2845                 return 0;
2846
2847         perms = file_mask_to_av(inode->i_mode, mask);
2848
2849         sid = cred_sid(cred);
2850         isec = inode->i_security;
2851
2852         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2853         audited = avc_audit_required(perms, &avd, rc,
2854                                      from_access ? FILE__AUDIT_ACCESS : 0,
2855                                      &denied);
2856         if (likely(!audited))
2857                 return rc;
2858
2859         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2860         if (rc2)
2861                 return rc2;
2862         return rc;
2863 }
2864
2865 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2866 {
2867         const struct cred *cred = current_cred();
2868         unsigned int ia_valid = iattr->ia_valid;
2869         __u32 av = FILE__WRITE;
2870
2871         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2872         if (ia_valid & ATTR_FORCE) {
2873                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2874                               ATTR_FORCE);
2875                 if (!ia_valid)
2876                         return 0;
2877         }
2878
2879         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2880                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2881                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2882
2883         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2884                 av |= FILE__OPEN;
2885
2886         return dentry_has_perm(cred, dentry, av);
2887 }
2888
2889 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2890 {
2891         const struct cred *cred = current_cred();
2892         struct path path;
2893
2894         path.dentry = dentry;
2895         path.mnt = mnt;
2896
2897         return path_has_perm(cred, &path, FILE__GETATTR);
2898 }
2899
2900 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2901 {
2902         const struct cred *cred = current_cred();
2903
2904         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2905                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2906                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2907                         if (!capable(CAP_SETFCAP))
2908                                 return -EPERM;
2909                 } else if (!capable(CAP_SYS_ADMIN)) {
2910                         /* A different attribute in the security namespace.
2911                            Restrict to administrator. */
2912                         return -EPERM;
2913                 }
2914         }
2915
2916         /* Not an attribute we recognize, so just check the
2917            ordinary setattr permission. */
2918         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2919 }
2920
2921 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2922                                   const void *value, size_t size, int flags)
2923 {
2924         struct inode *inode = dentry->d_inode;
2925         struct inode_security_struct *isec = inode->i_security;
2926         struct superblock_security_struct *sbsec;
2927         struct common_audit_data ad;
2928         u32 newsid, sid = current_sid();
2929         int rc = 0;
2930
2931         if (strcmp(name, XATTR_NAME_SELINUX))
2932                 return selinux_inode_setotherxattr(dentry, name);
2933
2934         sbsec = inode->i_sb->s_security;
2935         if (!(sbsec->flags & SBLABEL_MNT))
2936                 return -EOPNOTSUPP;
2937
2938         if (!inode_owner_or_capable(inode))
2939                 return -EPERM;
2940
2941         ad.type = LSM_AUDIT_DATA_DENTRY;
2942         ad.u.dentry = dentry;
2943
2944         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2945                           FILE__RELABELFROM, &ad);
2946         if (rc)
2947                 return rc;
2948
2949         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
2950         if (rc == -EINVAL) {
2951                 if (!capable(CAP_MAC_ADMIN)) {
2952                         struct audit_buffer *ab;
2953                         size_t audit_size;
2954                         const char *str;
2955
2956                         /* We strip a nul only if it is at the end, otherwise the
2957                          * context contains a nul and we should audit that */
2958                         if (value) {
2959                                 str = value;
2960                                 if (str[size - 1] == '\0')
2961                                         audit_size = size - 1;
2962                                 else
2963                                         audit_size = size;
2964                         } else {
2965                                 str = "";
2966                                 audit_size = 0;
2967                         }
2968                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2969                         audit_log_format(ab, "op=setxattr invalid_context=");
2970                         audit_log_n_untrustedstring(ab, value, audit_size);
2971                         audit_log_end(ab);
2972
2973                         return rc;
2974                 }
2975                 rc = security_context_to_sid_force(value, size, &newsid);
2976         }
2977         if (rc)
2978                 return rc;
2979
2980         rc = avc_has_perm(sid, newsid, isec->sclass,
2981                           FILE__RELABELTO, &ad);
2982         if (rc)
2983                 return rc;
2984
2985         rc = security_validate_transition(isec->sid, newsid, sid,
2986                                           isec->sclass);
2987         if (rc)
2988                 return rc;
2989
2990         return avc_has_perm(newsid,
2991                             sbsec->sid,
2992                             SECCLASS_FILESYSTEM,
2993                             FILESYSTEM__ASSOCIATE,
2994                             &ad);
2995 }
2996
2997 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2998                                         const void *value, size_t size,
2999                                         int flags)
3000 {
3001         struct inode *inode = dentry->d_inode;
3002         struct inode_security_struct *isec = inode->i_security;
3003         u32 newsid;
3004         int rc;
3005
3006         if (strcmp(name, XATTR_NAME_SELINUX)) {
3007                 /* Not an attribute we recognize, so nothing to do. */
3008                 return;
3009         }
3010
3011         rc = security_context_to_sid_force(value, size, &newsid);
3012         if (rc) {
3013                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3014                        "for (%s, %lu), rc=%d\n",
3015                        inode->i_sb->s_id, inode->i_ino, -rc);
3016                 return;
3017         }
3018
3019         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3020         isec->sid = newsid;
3021         isec->initialized = 1;
3022
3023         return;
3024 }
3025
3026 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3027 {
3028         const struct cred *cred = current_cred();
3029
3030         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3031 }
3032
3033 static int selinux_inode_listxattr(struct dentry *dentry)
3034 {
3035         const struct cred *cred = current_cred();
3036
3037         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3038 }
3039
3040 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3041 {
3042         if (strcmp(name, XATTR_NAME_SELINUX))
3043                 return selinux_inode_setotherxattr(dentry, name);
3044
3045         /* No one is allowed to remove a SELinux security label.
3046            You can change the label, but all data must be labeled. */
3047         return -EACCES;
3048 }
3049
3050 /*
3051  * Copy the inode security context value to the user.
3052  *
3053  * Permission check is handled by selinux_inode_getxattr hook.
3054  */
3055 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3056 {
3057         u32 size;
3058         int error;
3059         char *context = NULL;
3060         struct inode_security_struct *isec = inode->i_security;
3061
3062         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3063                 return -EOPNOTSUPP;
3064
3065         /*
3066          * If the caller has CAP_MAC_ADMIN, then get the raw context
3067          * value even if it is not defined by current policy; otherwise,
3068          * use the in-core value under current policy.
3069          * Use the non-auditing forms of the permission checks since
3070          * getxattr may be called by unprivileged processes commonly
3071          * and lack of permission just means that we fall back to the
3072          * in-core context value, not a denial.
3073          */
3074         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3075                                 SECURITY_CAP_NOAUDIT);
3076         if (!error)
3077                 error = security_sid_to_context_force(isec->sid, &context,
3078                                                       &size);
3079         else
3080                 error = security_sid_to_context(isec->sid, &context, &size);
3081         if (error)
3082                 return error;
3083         error = size;
3084         if (alloc) {
3085                 *buffer = context;
3086                 goto out_nofree;
3087         }
3088         kfree(context);
3089 out_nofree:
3090         return error;
3091 }
3092
3093 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3094                                      const void *value, size_t size, int flags)
3095 {
3096         struct inode_security_struct *isec = inode->i_security;
3097         u32 newsid;
3098         int rc;
3099
3100         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3101                 return -EOPNOTSUPP;
3102
3103         if (!value || !size)
3104                 return -EACCES;
3105
3106         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3107         if (rc)
3108                 return rc;
3109
3110         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3111         isec->sid = newsid;
3112         isec->initialized = 1;
3113         return 0;
3114 }
3115
3116 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3117 {
3118         const int len = sizeof(XATTR_NAME_SELINUX);
3119         if (buffer && len <= buffer_size)
3120                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3121         return len;
3122 }
3123
3124 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3125 {
3126         struct inode_security_struct *isec = inode->i_security;
3127         *secid = isec->sid;
3128 }
3129
3130 /* file security operations */
3131
3132 static int selinux_revalidate_file_permission(struct file *file, int mask)
3133 {
3134         const struct cred *cred = current_cred();
3135         struct inode *inode = file_inode(file);
3136
3137         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3138         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3139                 mask |= MAY_APPEND;
3140
3141         return file_has_perm(cred, file,
3142                              file_mask_to_av(inode->i_mode, mask));
3143 }
3144
3145 static int selinux_file_permission(struct file *file, int mask)
3146 {
3147         struct inode *inode = file_inode(file);
3148         struct file_security_struct *fsec = file->f_security;
3149         struct inode_security_struct *isec = inode->i_security;
3150         u32 sid = current_sid();
3151
3152         if (!mask)
3153                 /* No permission to check.  Existence test. */
3154                 return 0;
3155
3156         if (sid == fsec->sid && fsec->isid == isec->sid &&
3157             fsec->pseqno == avc_policy_seqno())
3158                 /* No change since file_open check. */
3159                 return 0;
3160
3161         return selinux_revalidate_file_permission(file, mask);
3162 }
3163
3164 static int selinux_file_alloc_security(struct file *file)
3165 {
3166         return file_alloc_security(file);
3167 }
3168
3169 static void selinux_file_free_security(struct file *file)
3170 {
3171         file_free_security(file);
3172 }
3173
3174 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3175                               unsigned long arg)
3176 {
3177         const struct cred *cred = current_cred();
3178         int error = 0;
3179
3180         switch (cmd) {
3181         case FIONREAD:
3182         /* fall through */
3183         case FIBMAP:
3184         /* fall through */
3185         case FIGETBSZ:
3186         /* fall through */
3187         case FS_IOC_GETFLAGS:
3188         /* fall through */
3189         case FS_IOC_GETVERSION:
3190                 error = file_has_perm(cred, file, FILE__GETATTR);
3191                 break;
3192
3193         case FS_IOC_SETFLAGS:
3194         /* fall through */
3195         case FS_IOC_SETVERSION:
3196                 error = file_has_perm(cred, file, FILE__SETATTR);
3197                 break;
3198
3199         /* sys_ioctl() checks */
3200         case FIONBIO:
3201         /* fall through */
3202         case FIOASYNC:
3203                 error = file_has_perm(cred, file, 0);
3204                 break;
3205
3206         case KDSKBENT:
3207         case KDSKBSENT:
3208                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3209                                             SECURITY_CAP_AUDIT);
3210                 break;
3211
3212         /* default case assumes that the command will go
3213          * to the file's ioctl() function.
3214          */
3215         default:
3216                 error = file_has_perm(cred, file, FILE__IOCTL);
3217         }
3218         return error;
3219 }
3220
3221 static int default_noexec;
3222
3223 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3224 {
3225         const struct cred *cred = current_cred();
3226         int rc = 0;
3227
3228         if (default_noexec &&
3229             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3230                 /*
3231                  * We are making executable an anonymous mapping or a
3232                  * private file mapping that will also be writable.
3233                  * This has an additional check.
3234                  */
3235                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3236                 if (rc)
3237                         goto error;
3238         }
3239
3240         if (file) {
3241                 /* read access is always possible with a mapping */
3242                 u32 av = FILE__READ;
3243
3244                 /* write access only matters if the mapping is shared */
3245                 if (shared && (prot & PROT_WRITE))
3246                         av |= FILE__WRITE;
3247
3248                 if (prot & PROT_EXEC)
3249                         av |= FILE__EXECUTE;
3250
3251                 return file_has_perm(cred, file, av);
3252         }
3253
3254 error:
3255         return rc;
3256 }
3257
3258 static int selinux_mmap_addr(unsigned long addr)
3259 {
3260         int rc;
3261
3262         /* do DAC check on address space usage */
3263         rc = cap_mmap_addr(addr);
3264         if (rc)
3265                 return rc;
3266
3267         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3268                 u32 sid = current_sid();
3269                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3270                                   MEMPROTECT__MMAP_ZERO, NULL);
3271         }
3272
3273         return rc;
3274 }
3275
3276 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3277                              unsigned long prot, unsigned long flags)
3278 {
3279         if (selinux_checkreqprot)
3280                 prot = reqprot;
3281
3282         return file_map_prot_check(file, prot,
3283                                    (flags & MAP_TYPE) == MAP_SHARED);
3284 }
3285
3286 static int selinux_file_mprotect(struct vm_area_struct *vma,
3287                                  unsigned long reqprot,
3288                                  unsigned long prot)
3289 {
3290         const struct cred *cred = current_cred();
3291
3292         if (selinux_checkreqprot)
3293                 prot = reqprot;
3294
3295         if (default_noexec &&
3296             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3297                 int rc = 0;
3298                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3299                     vma->vm_end <= vma->vm_mm->brk) {
3300                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3301                 } else if (!vma->vm_file &&
3302                            vma->vm_start <= vma->vm_mm->start_stack &&
3303                            vma->vm_end >= vma->vm_mm->start_stack) {
3304                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3305                 } else if (vma->vm_file && vma->anon_vma) {
3306                         /*
3307                          * We are making executable a file mapping that has
3308                          * had some COW done. Since pages might have been
3309                          * written, check ability to execute the possibly
3310                          * modified content.  This typically should only
3311                          * occur for text relocations.
3312                          */
3313                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3314                 }
3315                 if (rc)
3316                         return rc;
3317         }
3318
3319         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3320 }
3321
3322 static int selinux_file_lock(struct file *file, unsigned int cmd)
3323 {
3324         const struct cred *cred = current_cred();
3325
3326         return file_has_perm(cred, file, FILE__LOCK);
3327 }
3328
3329 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3330                               unsigned long arg)
3331 {
3332         const struct cred *cred = current_cred();
3333         int err = 0;
3334
3335         switch (cmd) {
3336         case F_SETFL:
3337                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3338                         err = file_has_perm(cred, file, FILE__WRITE);
3339                         break;
3340                 }
3341                 /* fall through */
3342         case F_SETOWN:
3343         case F_SETSIG:
3344         case F_GETFL:
3345         case F_GETOWN:
3346         case F_GETSIG:
3347         case F_GETOWNER_UIDS:
3348                 /* Just check FD__USE permission */
3349                 err = file_has_perm(cred, file, 0);
3350                 break;
3351         case F_GETLK:
3352         case F_SETLK:
3353         case F_SETLKW:
3354         case F_OFD_GETLK:
3355         case F_OFD_SETLK:
3356         case F_OFD_SETLKW:
3357 #if BITS_PER_LONG == 32
3358         case F_GETLK64:
3359         case F_SETLK64:
3360         case F_SETLKW64:
3361 #endif
3362                 err = file_has_perm(cred, file, FILE__LOCK);
3363                 break;
3364         }
3365
3366         return err;
3367 }
3368
3369 static void selinux_file_set_fowner(struct file *file)
3370 {
3371         struct file_security_struct *fsec;
3372
3373         fsec = file->f_security;
3374         fsec->fown_sid = current_sid();
3375 }
3376
3377 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3378                                        struct fown_struct *fown, int signum)
3379 {
3380         struct file *file;
3381         u32 sid = task_sid(tsk);
3382         u32 perm;
3383         struct file_security_struct *fsec;
3384
3385         /* struct fown_struct is never outside the context of a struct file */
3386         file = container_of(fown, struct file, f_owner);
3387
3388         fsec = file->f_security;
3389
3390         if (!signum)
3391                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3392         else
3393                 perm = signal_to_av(signum);
3394
3395         return avc_has_perm(fsec->fown_sid, sid,
3396                             SECCLASS_PROCESS, perm, NULL);
3397 }
3398
3399 static int selinux_file_receive(struct file *file)
3400 {
3401         const struct cred *cred = current_cred();
3402
3403         return file_has_perm(cred, file, file_to_av(file));
3404 }
3405
3406 static int selinux_file_open(struct file *file, const struct cred *cred)
3407 {
3408         struct file_security_struct *fsec;
3409         struct inode_security_struct *isec;
3410
3411         fsec = file->f_security;
3412         isec = file_inode(file)->i_security;
3413         /*
3414          * Save inode label and policy sequence number
3415          * at open-time so that selinux_file_permission
3416          * can determine whether revalidation is necessary.
3417          * Task label is already saved in the file security
3418          * struct as its SID.
3419          */
3420         fsec->isid = isec->sid;
3421         fsec->pseqno = avc_policy_seqno();
3422         /*
3423          * Since the inode label or policy seqno may have changed
3424          * between the selinux_inode_permission check and the saving
3425          * of state above, recheck that access is still permitted.
3426          * Otherwise, access might never be revalidated against the
3427          * new inode label or new policy.
3428          * This check is not redundant - do not remove.
3429          */
3430         return file_path_has_perm(cred, file, open_file_to_av(file));
3431 }
3432
3433 /* task security operations */
3434
3435 static int selinux_task_create(unsigned long clone_flags)
3436 {
3437         return current_has_perm(current, PROCESS__FORK);
3438 }
3439
3440 /*
3441  * allocate the SELinux part of blank credentials
3442  */
3443 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3444 {
3445         struct task_security_struct *tsec;
3446
3447         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3448         if (!tsec)
3449                 return -ENOMEM;
3450
3451         cred->security = tsec;
3452         return 0;
3453 }
3454
3455 /*
3456  * detach and free the LSM part of a set of credentials
3457  */
3458 static void selinux_cred_free(struct cred *cred)
3459 {
3460         struct task_security_struct *tsec = cred->security;
3461
3462         /*
3463          * cred->security == NULL if security_cred_alloc_blank() or
3464          * security_prepare_creds() returned an error.
3465          */
3466         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3467         cred->security = (void *) 0x7UL;
3468         kfree(tsec);
3469 }
3470
3471 /*
3472  * prepare a new set of credentials for modification
3473  */
3474 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3475                                 gfp_t gfp)
3476 {
3477         const struct task_security_struct *old_tsec;
3478         struct task_security_struct *tsec;
3479
3480         old_tsec = old->security;
3481
3482         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3483         if (!tsec)
3484                 return -ENOMEM;
3485
3486         new->security = tsec;
3487         return 0;
3488 }
3489
3490 /*
3491  * transfer the SELinux data to a blank set of creds
3492  */
3493 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3494 {
3495         const struct task_security_struct *old_tsec = old->security;
3496         struct task_security_struct *tsec = new->security;
3497
3498         *tsec = *old_tsec;
3499 }
3500
3501 /*
3502  * set the security data for a kernel service
3503  * - all the creation contexts are set to unlabelled
3504  */
3505 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3506 {
3507         struct task_security_struct *tsec = new->security;
3508         u32 sid = current_sid();
3509         int ret;
3510
3511         ret = avc_has_perm(sid, secid,
3512                            SECCLASS_KERNEL_SERVICE,
3513                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3514                            NULL);
3515         if (ret == 0) {
3516                 tsec->sid = secid;
3517                 tsec->create_sid = 0;
3518                 tsec->keycreate_sid = 0;
3519                 tsec->sockcreate_sid = 0;
3520         }
3521         return ret;
3522 }
3523
3524 /*
3525  * set the file creation context in a security record to the same as the
3526  * objective context of the specified inode
3527  */
3528 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3529 {
3530         struct inode_security_struct *isec = inode->i_security;
3531         struct task_security_struct *tsec = new->security;
3532         u32 sid = current_sid();
3533         int ret;
3534
3535         ret = avc_has_perm(sid, isec->sid,
3536                            SECCLASS_KERNEL_SERVICE,
3537                            KERNEL_SERVICE__CREATE_FILES_AS,
3538                            NULL);
3539
3540         if (ret == 0)
3541                 tsec->create_sid = isec->sid;
3542         return ret;
3543 }
3544
3545 static int selinux_kernel_module_request(char *kmod_name)
3546 {
3547         u32 sid;
3548         struct common_audit_data ad;
3549
3550         sid = task_sid(current);
3551
3552         ad.type = LSM_AUDIT_DATA_KMOD;
3553         ad.u.kmod_name = kmod_name;
3554
3555         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3556                             SYSTEM__MODULE_REQUEST, &ad);
3557 }
3558
3559 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3560 {
3561         return current_has_perm(p, PROCESS__SETPGID);
3562 }
3563
3564 static int selinux_task_getpgid(struct task_struct *p)
3565 {
3566         return current_has_perm(p, PROCESS__GETPGID);
3567 }
3568
3569 static int selinux_task_getsid(struct task_struct *p)
3570 {
3571         return current_has_perm(p, PROCESS__GETSESSION);
3572 }
3573
3574 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3575 {
3576         *secid = task_sid(p);
3577 }
3578
3579 static int selinux_task_setnice(struct task_struct *p, int nice)
3580 {
3581         int rc;
3582
3583         rc = cap_task_setnice(p, nice);
3584         if (rc)
3585                 return rc;
3586
3587         return current_has_perm(p, PROCESS__SETSCHED);
3588 }
3589
3590 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3591 {
3592         int rc;
3593
3594         rc = cap_task_setioprio(p, ioprio);
3595         if (rc)
3596                 return rc;
3597
3598         return current_has_perm(p, PROCESS__SETSCHED);
3599 }
3600
3601 static int selinux_task_getioprio(struct task_struct *p)
3602 {
3603         return current_has_perm(p, PROCESS__GETSCHED);
3604 }
3605
3606 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3607                 struct rlimit *new_rlim)
3608 {
3609         struct rlimit *old_rlim = p->signal->rlim + resource;
3610
3611         /* Control the ability to change the hard limit (whether
3612            lowering or raising it), so that the hard limit can
3613            later be used as a safe reset point for the soft limit
3614            upon context transitions.  See selinux_bprm_committing_creds. */
3615         if (old_rlim->rlim_max != new_rlim->rlim_max)
3616                 return current_has_perm(p, PROCESS__SETRLIMIT);
3617
3618         return 0;
3619 }
3620
3621 static int selinux_task_setscheduler(struct task_struct *p)
3622 {
3623         int rc;
3624
3625         rc = cap_task_setscheduler(p);
3626         if (rc)
3627                 return rc;
3628
3629         return current_has_perm(p, PROCESS__SETSCHED);
3630 }
3631
3632 static int selinux_task_getscheduler(struct task_struct *p)
3633 {
3634         return current_has_perm(p, PROCESS__GETSCHED);
3635 }
3636
3637 static int selinux_task_movememory(struct task_struct *p)
3638 {
3639         return current_has_perm(p, PROCESS__SETSCHED);
3640 }
3641
3642 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3643                                 int sig, u32 secid)
3644 {
3645         u32 perm;
3646         int rc;
3647
3648         if (!sig)
3649                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3650         else
3651                 perm = signal_to_av(sig);
3652         if (secid)
3653                 rc = avc_has_perm(secid, task_sid(p),
3654                                   SECCLASS_PROCESS, perm, NULL);
3655         else
3656                 rc = current_has_perm(p, perm);
3657         return rc;
3658 }
3659
3660 static int selinux_task_wait(struct task_struct *p)
3661 {
3662         return task_has_perm(p, current, PROCESS__SIGCHLD);
3663 }
3664
3665 static void selinux_task_to_inode(struct task_struct *p,
3666                                   struct inode *inode)
3667 {
3668         struct inode_security_struct *isec = inode->i_security;
3669         u32 sid = task_sid(p);
3670
3671         isec->sid = sid;
3672         isec->initialized = 1;
3673 }
3674
3675 /* Returns error only if unable to parse addresses */
3676 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3677                         struct common_audit_data *ad, u8 *proto)
3678 {
3679         int offset, ihlen, ret = -EINVAL;
3680         struct iphdr _iph, *ih;
3681
3682         offset = skb_network_offset(skb);
3683         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3684         if (ih == NULL)
3685                 goto out;
3686
3687         ihlen = ih->ihl * 4;
3688         if (ihlen < sizeof(_iph))
3689                 goto out;
3690
3691         ad->u.net->v4info.saddr = ih->saddr;
3692         ad->u.net->v4info.daddr = ih->daddr;
3693         ret = 0;
3694
3695         if (proto)
3696                 *proto = ih->protocol;
3697
3698         switch (ih->protocol) {
3699         case IPPROTO_TCP: {
3700                 struct tcphdr _tcph, *th;
3701
3702                 if (ntohs(ih->frag_off) & IP_OFFSET)
3703                         break;
3704
3705                 offset += ihlen;
3706                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3707                 if (th == NULL)
3708                         break;
3709
3710                 ad->u.net->sport = th->source;
3711                 ad->u.net->dport = th->dest;
3712                 break;
3713         }
3714
3715         case IPPROTO_UDP: {
3716                 struct udphdr _udph, *uh;
3717
3718                 if (ntohs(ih->frag_off) & IP_OFFSET)
3719                         break;
3720
3721                 offset += ihlen;
3722                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3723                 if (uh == NULL)
3724                         break;
3725
3726                 ad->u.net->sport = uh->source;
3727                 ad->u.net->dport = uh->dest;
3728                 break;
3729         }
3730
3731         case IPPROTO_DCCP: {
3732                 struct dccp_hdr _dccph, *dh;
3733
3734                 if (ntohs(ih->frag_off) & IP_OFFSET)
3735                         break;
3736
3737                 offset += ihlen;
3738                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3739                 if (dh == NULL)
3740                         break;
3741
3742                 ad->u.net->sport = dh->dccph_sport;
3743                 ad->u.net->dport = dh->dccph_dport;
3744                 break;
3745         }
3746
3747         default:
3748                 break;
3749         }
3750 out:
3751         return ret;
3752 }
3753
3754 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3755
3756 /* Returns error only if unable to parse addresses */
3757 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3758                         struct common_audit_data *ad, u8 *proto)
3759 {
3760         u8 nexthdr;
3761         int ret = -EINVAL, offset;
3762         struct ipv6hdr _ipv6h, *ip6;
3763         __be16 frag_off;
3764
3765         offset = skb_network_offset(skb);
3766         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3767         if (ip6 == NULL)
3768                 goto out;
3769
3770         ad->u.net->v6info.saddr = ip6->saddr;
3771         ad->u.net->v6info.daddr = ip6->daddr;
3772         ret = 0;
3773
3774         nexthdr = ip6->nexthdr;
3775         offset += sizeof(_ipv6h);
3776         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3777         if (offset < 0)
3778                 goto out;
3779
3780         if (proto)
3781                 *proto = nexthdr;
3782
3783         switch (nexthdr) {
3784         case IPPROTO_TCP: {
3785                 struct tcphdr _tcph, *th;
3786
3787                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3788                 if (th == NULL)
3789                         break;
3790
3791                 ad->u.net->sport = th->source;
3792                 ad->u.net->dport = th->dest;
3793                 break;
3794         }
3795
3796         case IPPROTO_UDP: {
3797                 struct udphdr _udph, *uh;
3798
3799                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3800                 if (uh == NULL)
3801                         break;
3802
3803                 ad->u.net->sport = uh->source;
3804                 ad->u.net->dport = uh->dest;
3805                 break;
3806         }
3807
3808         case IPPROTO_DCCP: {
3809                 struct dccp_hdr _dccph, *dh;
3810
3811                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3812                 if (dh == NULL)
3813                         break;
3814
3815                 ad->u.net->sport = dh->dccph_sport;
3816                 ad->u.net->dport = dh->dccph_dport;
3817                 break;
3818         }
3819
3820         /* includes fragments */
3821         default:
3822                 break;
3823         }
3824 out:
3825         return ret;
3826 }
3827
3828 #endif /* IPV6 */
3829
3830 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3831                              char **_addrp, int src, u8 *proto)
3832 {
3833         char *addrp;
3834         int ret;
3835
3836         switch (ad->u.net->family) {
3837         case PF_INET:
3838                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3839                 if (ret)
3840                         goto parse_error;
3841                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3842                                        &ad->u.net->v4info.daddr);
3843                 goto okay;
3844
3845 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3846         case PF_INET6:
3847                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3848                 if (ret)
3849                         goto parse_error;
3850                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3851                                        &ad->u.net->v6info.daddr);
3852                 goto okay;
3853 #endif  /* IPV6 */
3854         default:
3855                 addrp = NULL;
3856                 goto okay;
3857         }
3858
3859 parse_error:
3860         printk(KERN_WARNING
3861                "SELinux: failure in selinux_parse_skb(),"
3862                " unable to parse packet\n");
3863         return ret;
3864
3865 okay:
3866         if (_addrp)
3867                 *_addrp = addrp;
3868         return 0;
3869 }
3870
3871 /**
3872  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3873  * @skb: the packet
3874  * @family: protocol family
3875  * @sid: the packet's peer label SID
3876  *
3877  * Description:
3878  * Check the various different forms of network peer labeling and determine
3879  * the peer label/SID for the packet; most of the magic actually occurs in
3880  * the security server function security_net_peersid_cmp().  The function
3881  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3882  * or -EACCES if @sid is invalid due to inconsistencies with the different
3883  * peer labels.
3884  *
3885  */
3886 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3887 {
3888         int err;
3889         u32 xfrm_sid;
3890         u32 nlbl_sid;
3891         u32 nlbl_type;
3892
3893         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3894         if (unlikely(err))
3895                 return -EACCES;
3896         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3897         if (unlikely(err))
3898                 return -EACCES;
3899
3900         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3901         if (unlikely(err)) {
3902                 printk(KERN_WARNING
3903                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3904                        " unable to determine packet's peer label\n");
3905                 return -EACCES;
3906         }
3907
3908         return 0;
3909 }
3910
3911 /**
3912  * selinux_conn_sid - Determine the child socket label for a connection
3913  * @sk_sid: the parent socket's SID
3914  * @skb_sid: the packet's SID
3915  * @conn_sid: the resulting connection SID
3916  *
3917  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3918  * combined with the MLS information from @skb_sid in order to create
3919  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3920  * of @sk_sid.  Returns zero on success, negative values on failure.
3921  *
3922  */
3923 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3924 {
3925         int err = 0;
3926
3927         if (skb_sid != SECSID_NULL)
3928                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3929         else
3930                 *conn_sid = sk_sid;
3931
3932         return err;
3933 }
3934
3935 /* socket security operations */
3936
3937 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3938                                  u16 secclass, u32 *socksid)
3939 {
3940         if (tsec->sockcreate_sid > SECSID_NULL) {
3941                 *socksid = tsec->sockcreate_sid;
3942                 return 0;
3943         }
3944
3945         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3946                                        socksid);
3947 }
3948
3949 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3950 {
3951         struct sk_security_struct *sksec = sk->sk_security;
3952         struct common_audit_data ad;
3953         struct lsm_network_audit net = {0,};
3954         u32 tsid = task_sid(task);
3955
3956         if (sksec->sid == SECINITSID_KERNEL)
3957                 return 0;
3958
3959         ad.type = LSM_AUDIT_DATA_NET;
3960         ad.u.net = &net;
3961         ad.u.net->sk = sk;
3962
3963         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3964 }
3965
3966 static int selinux_socket_create(int family, int type,
3967                                  int protocol, int kern)
3968 {
3969         const struct task_security_struct *tsec = current_security();
3970         u32 newsid;
3971         u16 secclass;
3972         int rc;
3973
3974         if (kern)
3975                 return 0;
3976
3977         secclass = socket_type_to_security_class(family, type, protocol);
3978         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3979         if (rc)
3980                 return rc;
3981
3982         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3983 }
3984
3985 static int selinux_socket_post_create(struct socket *sock, int family,
3986                                       int type, int protocol, int kern)
3987 {
3988         const struct task_security_struct *tsec = current_security();
3989         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3990         struct sk_security_struct *sksec;
3991         int err = 0;
3992
3993         isec->sclass = socket_type_to_security_class(family, type, protocol);
3994
3995         if (kern)
3996                 isec->sid = SECINITSID_KERNEL;
3997         else {
3998                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3999                 if (err)
4000                         return err;
4001         }
4002
4003         isec->initialized = 1;
4004
4005         if (sock->sk) {
4006                 sksec = sock->sk->sk_security;
4007                 sksec->sid = isec->sid;
4008                 sksec->sclass = isec->sclass;
4009                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4010         }
4011
4012         return err;
4013 }
4014
4015 /* Range of port numbers used to automatically bind.
4016    Need to determine whether we should perform a name_bind
4017    permission check between the socket and the port number. */
4018
4019 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4020 {
4021         struct sock *sk = sock->sk;
4022         u16 family;
4023         int err;
4024
4025         err = sock_has_perm(current, sk, SOCKET__BIND);
4026         if (err)
4027                 goto out;
4028
4029         /*
4030          * If PF_INET or PF_INET6, check name_bind permission for the port.
4031          * Multiple address binding for SCTP is not supported yet: we just
4032          * check the first address now.
4033          */
4034         family = sk->sk_family;
4035         if (family == PF_INET || family == PF_INET6) {
4036                 char *addrp;
4037                 struct sk_security_struct *sksec = sk->sk_security;
4038                 struct common_audit_data ad;
4039                 struct lsm_network_audit net = {0,};
4040                 struct sockaddr_in *addr4 = NULL;
4041                 struct sockaddr_in6 *addr6 = NULL;
4042                 unsigned short snum;
4043                 u32 sid, node_perm;
4044
4045                 if (family == PF_INET) {
4046                         addr4 = (struct sockaddr_in *)address;
4047                         snum = ntohs(addr4->sin_port);
4048                         addrp = (char *)&addr4->sin_addr.s_addr;
4049                 } else {
4050                         addr6 = (struct sockaddr_in6 *)address;
4051                         snum = ntohs(addr6->sin6_port);
4052                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4053                 }
4054
4055                 if (snum) {
4056                         int low, high;
4057
4058                         inet_get_local_port_range(sock_net(sk), &low, &high);
4059
4060                         if (snum < max(PROT_SOCK, low) || snum > high) {
4061                                 err = sel_netport_sid(sk->sk_protocol,
4062                                                       snum, &sid);
4063                                 if (err)
4064                                         goto out;
4065                                 ad.type = LSM_AUDIT_DATA_NET;
4066                                 ad.u.net = &net;
4067                                 ad.u.net->sport = htons(snum);
4068                                 ad.u.net->family = family;
4069                                 err = avc_has_perm(sksec->sid, sid,
4070                                                    sksec->sclass,
4071                                                    SOCKET__NAME_BIND, &ad);
4072                                 if (err)
4073                                         goto out;
4074                         }
4075                 }
4076
4077                 switch (sksec->sclass) {
4078                 case SECCLASS_TCP_SOCKET:
4079                         node_perm = TCP_SOCKET__NODE_BIND;
4080                         break;
4081
4082                 case SECCLASS_UDP_SOCKET:
4083                         node_perm = UDP_SOCKET__NODE_BIND;
4084                         break;
4085
4086                 case SECCLASS_DCCP_SOCKET:
4087                         node_perm = DCCP_SOCKET__NODE_BIND;
4088                         break;
4089
4090                 default:
4091                         node_perm = RAWIP_SOCKET__NODE_BIND;
4092                         break;
4093                 }
4094
4095                 err = sel_netnode_sid(addrp, family, &sid);
4096                 if (err)
4097                         goto out;
4098
4099                 ad.type = LSM_AUDIT_DATA_NET;
4100                 ad.u.net = &net;
4101                 ad.u.net->sport = htons(snum);
4102                 ad.u.net->family = family;
4103
4104                 if (family == PF_INET)
4105                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4106                 else
4107                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4108
4109                 err = avc_has_perm(sksec->sid, sid,
4110                                    sksec->sclass, node_perm, &ad);
4111                 if (err)
4112                         goto out;
4113         }
4114 out:
4115         return err;
4116 }
4117
4118 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4119 {
4120         struct sock *sk = sock->sk;
4121         struct sk_security_struct *sksec = sk->sk_security;
4122         int err;
4123
4124         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4125         if (err)
4126                 return err;
4127
4128         /*
4129          * If a TCP or DCCP socket, check name_connect permission for the port.
4130          */
4131         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4132             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4133                 struct common_audit_data ad;
4134                 struct lsm_network_audit net = {0,};
4135                 struct sockaddr_in *addr4 = NULL;
4136                 struct sockaddr_in6 *addr6 = NULL;
4137                 unsigned short snum;
4138                 u32 sid, perm;
4139
4140                 if (sk->sk_family == PF_INET) {
4141                         addr4 = (struct sockaddr_in *)address;
4142                         if (addrlen < sizeof(struct sockaddr_in))
4143                                 return -EINVAL;
4144                         snum = ntohs(addr4->sin_port);
4145                 } else {
4146                         addr6 = (struct sockaddr_in6 *)address;
4147                         if (addrlen < SIN6_LEN_RFC2133)
4148                                 return -EINVAL;
4149                         snum = ntohs(addr6->sin6_port);
4150                 }
4151
4152                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4153                 if (err)
4154                         goto out;
4155
4156                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4157                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4158
4159                 ad.type = LSM_AUDIT_DATA_NET;
4160                 ad.u.net = &net;
4161                 ad.u.net->dport = htons(snum);
4162                 ad.u.net->family = sk->sk_family;
4163                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4164                 if (err)
4165                         goto out;
4166         }
4167
4168         err = selinux_netlbl_socket_connect(sk, address);
4169
4170 out:
4171         return err;
4172 }
4173
4174 static int selinux_socket_listen(struct socket *sock, int backlog)
4175 {
4176         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4177 }
4178
4179 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4180 {
4181         int err;
4182         struct inode_security_struct *isec;
4183         struct inode_security_struct *newisec;
4184
4185         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4186         if (err)
4187                 return err;
4188
4189         newisec = SOCK_INODE(newsock)->i_security;
4190
4191         isec = SOCK_INODE(sock)->i_security;
4192         newisec->sclass = isec->sclass;
4193         newisec->sid = isec->sid;
4194         newisec->initialized = 1;
4195
4196         return 0;
4197 }
4198
4199 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4200                                   int size)
4201 {
4202         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4203 }
4204
4205 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4206                                   int size, int flags)
4207 {
4208         return sock_has_perm(current, sock->sk, SOCKET__READ);
4209 }
4210
4211 static int selinux_socket_getsockname(struct socket *sock)
4212 {
4213         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4214 }
4215
4216 static int selinux_socket_getpeername(struct socket *sock)
4217 {
4218         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4219 }
4220
4221 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4222 {
4223         int err;
4224
4225         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4226         if (err)
4227                 return err;
4228
4229         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4230 }
4231
4232 static int selinux_socket_getsockopt(struct socket *sock, int level,
4233                                      int optname)
4234 {
4235         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4236 }
4237
4238 static int selinux_socket_shutdown(struct socket *sock, int how)
4239 {
4240         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4241 }
4242
4243 static int selinux_socket_unix_stream_connect(struct sock *sock,
4244                                               struct sock *other,
4245                                               struct sock *newsk)
4246 {
4247         struct sk_security_struct *sksec_sock = sock->sk_security;
4248         struct sk_security_struct *sksec_other = other->sk_security;
4249         struct sk_security_struct *sksec_new = newsk->sk_security;
4250         struct common_audit_data ad;
4251         struct lsm_network_audit net = {0,};
4252         int err;
4253
4254         ad.type = LSM_AUDIT_DATA_NET;
4255         ad.u.net = &net;
4256         ad.u.net->sk = other;
4257
4258         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4259                            sksec_other->sclass,
4260                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4261         if (err)
4262                 return err;
4263
4264         /* server child socket */
4265         sksec_new->peer_sid = sksec_sock->sid;
4266         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4267                                     &sksec_new->sid);
4268         if (err)
4269                 return err;
4270
4271         /* connecting socket */
4272         sksec_sock->peer_sid = sksec_new->sid;
4273
4274         return 0;
4275 }
4276
4277 static int selinux_socket_unix_may_send(struct socket *sock,
4278                                         struct socket *other)
4279 {
4280         struct sk_security_struct *ssec = sock->sk->sk_security;
4281         struct sk_security_struct *osec = other->sk->sk_security;
4282         struct common_audit_data ad;
4283         struct lsm_network_audit net = {0,};
4284
4285         ad.type = LSM_AUDIT_DATA_NET;
4286         ad.u.net = &net;
4287         ad.u.net->sk = other->sk;
4288
4289         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4290                             &ad);
4291 }
4292
4293 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4294                                     char *addrp, u16 family, u32 peer_sid,
4295                                     struct common_audit_data *ad)
4296 {
4297         int err;
4298         u32 if_sid;
4299         u32 node_sid;
4300
4301         err = sel_netif_sid(ns, ifindex, &if_sid);
4302         if (err)
4303                 return err;
4304         err = avc_has_perm(peer_sid, if_sid,
4305                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4306         if (err)
4307                 return err;
4308
4309         err = sel_netnode_sid(addrp, family, &node_sid);
4310         if (err)
4311                 return err;
4312         return avc_has_perm(peer_sid, node_sid,
4313                             SECCLASS_NODE, NODE__RECVFROM, ad);
4314 }
4315
4316 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4317                                        u16 family)
4318 {
4319         int err = 0;
4320         struct sk_security_struct *sksec = sk->sk_security;
4321         u32 sk_sid = sksec->sid;
4322         struct common_audit_data ad;
4323         struct lsm_network_audit net = {0,};
4324         char *addrp;
4325
4326         ad.type = LSM_AUDIT_DATA_NET;
4327         ad.u.net = &net;
4328         ad.u.net->netif = skb->skb_iif;
4329         ad.u.net->family = family;
4330         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4331         if (err)
4332                 return err;
4333
4334         if (selinux_secmark_enabled()) {
4335                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4336                                    PACKET__RECV, &ad);
4337                 if (err)
4338                         return err;
4339         }
4340
4341         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4342         if (err)
4343                 return err;
4344         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4345
4346         return err;
4347 }
4348
4349 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4350 {
4351         int err;
4352         struct sk_security_struct *sksec = sk->sk_security;
4353         u16 family = sk->sk_family;
4354         u32 sk_sid = sksec->sid;
4355         struct common_audit_data ad;
4356         struct lsm_network_audit net = {0,};
4357         char *addrp;
4358         u8 secmark_active;
4359         u8 peerlbl_active;
4360
4361         if (family != PF_INET && family != PF_INET6)
4362                 return 0;
4363
4364         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4365         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4366                 family = PF_INET;
4367
4368         /* If any sort of compatibility mode is enabled then handoff processing
4369          * to the selinux_sock_rcv_skb_compat() function to deal with the
4370          * special handling.  We do this in an attempt to keep this function
4371          * as fast and as clean as possible. */
4372         if (!selinux_policycap_netpeer)
4373                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4374
4375         secmark_active = selinux_secmark_enabled();
4376         peerlbl_active = selinux_peerlbl_enabled();
4377         if (!secmark_active && !peerlbl_active)
4378                 return 0;
4379
4380         ad.type = LSM_AUDIT_DATA_NET;
4381         ad.u.net = &net;
4382         ad.u.net->netif = skb->skb_iif;
4383         ad.u.net->family = family;
4384         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4385         if (err)
4386                 return err;
4387
4388         if (peerlbl_active) {
4389                 u32 peer_sid;
4390
4391                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4392                 if (err)
4393                         return err;
4394                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4395                                                addrp, family, peer_sid, &ad);
4396                 if (err) {
4397                         selinux_netlbl_err(skb, err, 0);
4398                         return err;
4399                 }
4400                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4401                                    PEER__RECV, &ad);
4402                 if (err) {
4403                         selinux_netlbl_err(skb, err, 0);
4404                         return err;
4405                 }
4406         }
4407
4408         if (secmark_active) {
4409                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4410                                    PACKET__RECV, &ad);
4411                 if (err)
4412                         return err;
4413         }
4414
4415         return err;
4416 }
4417
4418 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4419                                             int __user *optlen, unsigned len)
4420 {
4421         int err = 0;
4422         char *scontext;
4423         u32 scontext_len;
4424         struct sk_security_struct *sksec = sock->sk->sk_security;
4425         u32 peer_sid = SECSID_NULL;
4426
4427         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4428             sksec->sclass == SECCLASS_TCP_SOCKET)
4429                 peer_sid = sksec->peer_sid;
4430         if (peer_sid == SECSID_NULL)
4431                 return -ENOPROTOOPT;
4432
4433         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4434         if (err)
4435                 return err;
4436
4437         if (scontext_len > len) {
4438                 err = -ERANGE;
4439                 goto out_len;
4440         }
4441
4442         if (copy_to_user(optval, scontext, scontext_len))
4443                 err = -EFAULT;
4444
4445 out_len:
4446         if (put_user(scontext_len, optlen))
4447                 err = -EFAULT;
4448         kfree(scontext);
4449         return err;
4450 }
4451
4452 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4453 {
4454         u32 peer_secid = SECSID_NULL;
4455         u16 family;
4456
4457         if (skb && skb->protocol == htons(ETH_P_IP))
4458                 family = PF_INET;
4459         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4460                 family = PF_INET6;
4461         else if (sock)
4462                 family = sock->sk->sk_family;
4463         else
4464                 goto out;
4465
4466         if (sock && family == PF_UNIX)
4467                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4468         else if (skb)
4469                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4470
4471 out:
4472         *secid = peer_secid;
4473         if (peer_secid == SECSID_NULL)
4474                 return -EINVAL;
4475         return 0;
4476 }
4477
4478 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4479 {
4480         struct sk_security_struct *sksec;
4481
4482         sksec = kzalloc(sizeof(*sksec), priority);
4483         if (!sksec)
4484                 return -ENOMEM;
4485
4486         sksec->peer_sid = SECINITSID_UNLABELED;
4487         sksec->sid = SECINITSID_UNLABELED;
4488         selinux_netlbl_sk_security_reset(sksec);
4489         sk->sk_security = sksec;
4490
4491         return 0;
4492 }
4493
4494 static void selinux_sk_free_security(struct sock *sk)
4495 {
4496         struct sk_security_struct *sksec = sk->sk_security;
4497
4498         sk->sk_security = NULL;
4499         selinux_netlbl_sk_security_free(sksec);
4500         kfree(sksec);
4501 }
4502
4503 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4504 {
4505         struct sk_security_struct *sksec = sk->sk_security;
4506         struct sk_security_struct *newsksec = newsk->sk_security;
4507
4508         newsksec->sid = sksec->sid;
4509         newsksec->peer_sid = sksec->peer_sid;
4510         newsksec->sclass = sksec->sclass;
4511
4512         selinux_netlbl_sk_security_reset(newsksec);
4513 }
4514
4515 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4516 {
4517         if (!sk)
4518                 *secid = SECINITSID_ANY_SOCKET;
4519         else {
4520                 struct sk_security_struct *sksec = sk->sk_security;
4521
4522                 *secid = sksec->sid;
4523         }
4524 }
4525
4526 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4527 {
4528         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4529         struct sk_security_struct *sksec = sk->sk_security;
4530
4531         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4532             sk->sk_family == PF_UNIX)
4533                 isec->sid = sksec->sid;
4534         sksec->sclass = isec->sclass;
4535 }
4536
4537 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4538                                      struct request_sock *req)
4539 {
4540         struct sk_security_struct *sksec = sk->sk_security;
4541         int err;
4542         u16 family = req->rsk_ops->family;
4543         u32 connsid;
4544         u32 peersid;
4545
4546         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4547         if (err)
4548                 return err;
4549         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4550         if (err)
4551                 return err;
4552         req->secid = connsid;
4553         req->peer_secid = peersid;
4554
4555         return selinux_netlbl_inet_conn_request(req, family);
4556 }
4557
4558 static void selinux_inet_csk_clone(struct sock *newsk,
4559                                    const struct request_sock *req)
4560 {
4561         struct sk_security_struct *newsksec = newsk->sk_security;
4562
4563         newsksec->sid = req->secid;
4564         newsksec->peer_sid = req->peer_secid;
4565         /* NOTE: Ideally, we should also get the isec->sid for the
4566            new socket in sync, but we don't have the isec available yet.
4567            So we will wait until sock_graft to do it, by which
4568            time it will have been created and available. */
4569
4570         /* We don't need to take any sort of lock here as we are the only
4571          * thread with access to newsksec */
4572         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4573 }
4574
4575 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4576 {
4577         u16 family = sk->sk_family;
4578         struct sk_security_struct *sksec = sk->sk_security;
4579
4580         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4581         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4582                 family = PF_INET;
4583
4584         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4585 }
4586
4587 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4588 {
4589         skb_set_owner_w(skb, sk);
4590 }
4591
4592 static int selinux_secmark_relabel_packet(u32 sid)
4593 {
4594         const struct task_security_struct *__tsec;
4595         u32 tsid;
4596
4597         __tsec = current_security();
4598         tsid = __tsec->sid;
4599
4600         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4601 }
4602
4603 static void selinux_secmark_refcount_inc(void)
4604 {
4605         atomic_inc(&selinux_secmark_refcount);
4606 }
4607
4608 static void selinux_secmark_refcount_dec(void)
4609 {
4610         atomic_dec(&selinux_secmark_refcount);
4611 }
4612
4613 static void selinux_req_classify_flow(const struct request_sock *req,
4614                                       struct flowi *fl)
4615 {
4616         fl->flowi_secid = req->secid;
4617 }
4618
4619 static int selinux_tun_dev_alloc_security(void **security)
4620 {
4621         struct tun_security_struct *tunsec;
4622
4623         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4624         if (!tunsec)
4625                 return -ENOMEM;
4626         tunsec->sid = current_sid();
4627
4628         *security = tunsec;
4629         return 0;
4630 }
4631
4632 static void selinux_tun_dev_free_security(void *security)
4633 {
4634         kfree(security);
4635 }
4636
4637 static int selinux_tun_dev_create(void)
4638 {
4639         u32 sid = current_sid();
4640
4641         /* we aren't taking into account the "sockcreate" SID since the socket
4642          * that is being created here is not a socket in the traditional sense,
4643          * instead it is a private sock, accessible only to the kernel, and
4644          * representing a wide range of network traffic spanning multiple
4645          * connections unlike traditional sockets - check the TUN driver to
4646          * get a better understanding of why this socket is special */
4647
4648         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4649                             NULL);
4650 }
4651
4652 static int selinux_tun_dev_attach_queue(void *security)
4653 {
4654         struct tun_security_struct *tunsec = security;
4655
4656         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4657                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4658 }
4659
4660 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4661 {
4662         struct tun_security_struct *tunsec = security;
4663         struct sk_security_struct *sksec = sk->sk_security;
4664
4665         /* we don't currently perform any NetLabel based labeling here and it
4666          * isn't clear that we would want to do so anyway; while we could apply
4667          * labeling without the support of the TUN user the resulting labeled
4668          * traffic from the other end of the connection would almost certainly
4669          * cause confusion to the TUN user that had no idea network labeling
4670          * protocols were being used */
4671
4672         sksec->sid = tunsec->sid;
4673         sksec->sclass = SECCLASS_TUN_SOCKET;
4674
4675         return 0;
4676 }
4677
4678 static int selinux_tun_dev_open(void *security)
4679 {
4680         struct tun_security_struct *tunsec = security;
4681         u32 sid = current_sid();
4682         int err;
4683
4684         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4685                            TUN_SOCKET__RELABELFROM, NULL);
4686         if (err)
4687                 return err;
4688         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4689                            TUN_SOCKET__RELABELTO, NULL);
4690         if (err)
4691                 return err;
4692         tunsec->sid = sid;
4693
4694         return 0;
4695 }
4696
4697 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4698 {
4699         int err = 0;
4700         u32 perm;
4701         struct nlmsghdr *nlh;
4702         struct sk_security_struct *sksec = sk->sk_security;
4703
4704         if (skb->len < NLMSG_HDRLEN) {
4705                 err = -EINVAL;
4706                 goto out;
4707         }
4708         nlh = nlmsg_hdr(skb);
4709
4710         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4711         if (err) {
4712                 if (err == -EINVAL) {
4713                         printk(KERN_WARNING
4714                                "SELinux: unrecognized netlink message:"
4715                                " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4716                                sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4717                         if (!selinux_enforcing || security_get_allow_unknown())
4718                                 err = 0;
4719                 }
4720
4721                 /* Ignore */
4722                 if (err == -ENOENT)
4723                         err = 0;
4724                 goto out;
4725         }
4726
4727         err = sock_has_perm(current, sk, perm);
4728 out:
4729         return err;
4730 }
4731
4732 #ifdef CONFIG_NETFILTER
4733
4734 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4735                                        const struct net_device *indev,
4736                                        u16 family)
4737 {
4738         int err;
4739         char *addrp;
4740         u32 peer_sid;
4741         struct common_audit_data ad;
4742         struct lsm_network_audit net = {0,};
4743         u8 secmark_active;
4744         u8 netlbl_active;
4745         u8 peerlbl_active;
4746
4747         if (!selinux_policycap_netpeer)
4748                 return NF_ACCEPT;
4749
4750         secmark_active = selinux_secmark_enabled();
4751         netlbl_active = netlbl_enabled();
4752         peerlbl_active = selinux_peerlbl_enabled();
4753         if (!secmark_active && !peerlbl_active)
4754                 return NF_ACCEPT;
4755
4756         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4757                 return NF_DROP;
4758
4759         ad.type = LSM_AUDIT_DATA_NET;
4760         ad.u.net = &net;
4761         ad.u.net->netif = indev->ifindex;
4762         ad.u.net->family = family;
4763         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4764                 return NF_DROP;
4765
4766         if (peerlbl_active) {
4767                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4768                                                addrp, family, peer_sid, &ad);
4769                 if (err) {
4770                         selinux_netlbl_err(skb, err, 1);
4771                         return NF_DROP;
4772                 }
4773         }
4774
4775         if (secmark_active)
4776                 if (avc_has_perm(peer_sid, skb->secmark,
4777                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4778                         return NF_DROP;
4779
4780         if (netlbl_active)
4781                 /* we do this in the FORWARD path and not the POST_ROUTING
4782                  * path because we want to make sure we apply the necessary
4783                  * labeling before IPsec is applied so we can leverage AH
4784                  * protection */
4785                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4786                         return NF_DROP;
4787
4788         return NF_ACCEPT;
4789 }
4790
4791 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4792                                          struct sk_buff *skb,
4793                                          const struct net_device *in,
4794                                          const struct net_device *out,
4795                                          int (*okfn)(struct sk_buff *))
4796 {
4797         return selinux_ip_forward(skb, in, PF_INET);
4798 }
4799
4800 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4801 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4802                                          struct sk_buff *skb,
4803                                          const struct net_device *in,
4804                                          const struct net_device *out,
4805                                          int (*okfn)(struct sk_buff *))
4806 {
4807         return selinux_ip_forward(skb, in, PF_INET6);
4808 }
4809 #endif  /* IPV6 */
4810
4811 static unsigned int selinux_ip_output(struct sk_buff *skb,
4812                                       u16 family)
4813 {
4814         struct sock *sk;
4815         u32 sid;
4816
4817         if (!netlbl_enabled())
4818                 return NF_ACCEPT;
4819
4820         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4821          * because we want to make sure we apply the necessary labeling
4822          * before IPsec is applied so we can leverage AH protection */
4823         sk = skb->sk;
4824         if (sk) {
4825                 struct sk_security_struct *sksec;
4826
4827                 if (sk->sk_state == TCP_LISTEN)
4828                         /* if the socket is the listening state then this
4829                          * packet is a SYN-ACK packet which means it needs to
4830                          * be labeled based on the connection/request_sock and
4831                          * not the parent socket.  unfortunately, we can't
4832                          * lookup the request_sock yet as it isn't queued on
4833                          * the parent socket until after the SYN-ACK is sent.
4834                          * the "solution" is to simply pass the packet as-is
4835                          * as any IP option based labeling should be copied
4836                          * from the initial connection request (in the IP
4837                          * layer).  it is far from ideal, but until we get a
4838                          * security label in the packet itself this is the
4839                          * best we can do. */
4840                         return NF_ACCEPT;
4841
4842                 /* standard practice, label using the parent socket */
4843                 sksec = sk->sk_security;
4844                 sid = sksec->sid;
4845         } else
4846                 sid = SECINITSID_KERNEL;
4847         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4848                 return NF_DROP;
4849
4850         return NF_ACCEPT;
4851 }
4852
4853 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4854                                         struct sk_buff *skb,
4855                                         const struct net_device *in,
4856                                         const struct net_device *out,
4857                                         int (*okfn)(struct sk_buff *))
4858 {
4859         return selinux_ip_output(skb, PF_INET);
4860 }
4861
4862 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4863                                                 int ifindex,
4864                                                 u16 family)
4865 {
4866         struct sock *sk = skb->sk;
4867         struct sk_security_struct *sksec;
4868         struct common_audit_data ad;
4869         struct lsm_network_audit net = {0,};
4870         char *addrp;
4871         u8 proto;
4872
4873         if (sk == NULL)
4874                 return NF_ACCEPT;
4875         sksec = sk->sk_security;
4876
4877         ad.type = LSM_AUDIT_DATA_NET;
4878         ad.u.net = &net;
4879         ad.u.net->netif = ifindex;
4880         ad.u.net->family = family;
4881         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4882                 return NF_DROP;
4883
4884         if (selinux_secmark_enabled())
4885                 if (avc_has_perm(sksec->sid, skb->secmark,
4886                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4887                         return NF_DROP_ERR(-ECONNREFUSED);
4888
4889         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4890                 return NF_DROP_ERR(-ECONNREFUSED);
4891
4892         return NF_ACCEPT;
4893 }
4894
4895 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4896                                          const struct net_device *outdev,
4897                                          u16 family)
4898 {
4899         u32 secmark_perm;
4900         u32 peer_sid;
4901         int ifindex = outdev->ifindex;
4902         struct sock *sk;
4903         struct common_audit_data ad;
4904         struct lsm_network_audit net = {0,};
4905         char *addrp;
4906         u8 secmark_active;
4907         u8 peerlbl_active;
4908
4909         /* If any sort of compatibility mode is enabled then handoff processing
4910          * to the selinux_ip_postroute_compat() function to deal with the
4911          * special handling.  We do this in an attempt to keep this function
4912          * as fast and as clean as possible. */
4913         if (!selinux_policycap_netpeer)
4914                 return selinux_ip_postroute_compat(skb, ifindex, family);
4915
4916         secmark_active = selinux_secmark_enabled();
4917         peerlbl_active = selinux_peerlbl_enabled();
4918         if (!secmark_active && !peerlbl_active)
4919                 return NF_ACCEPT;
4920
4921         sk = skb->sk;
4922
4923 #ifdef CONFIG_XFRM
4924         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4925          * packet transformation so allow the packet to pass without any checks
4926          * since we'll have another chance to perform access control checks
4927          * when the packet is on it's final way out.
4928          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4929          *       is NULL, in this case go ahead and apply access control.
4930          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4931          *       TCP listening state we cannot wait until the XFRM processing
4932          *       is done as we will miss out on the SA label if we do;
4933          *       unfortunately, this means more work, but it is only once per
4934          *       connection. */
4935         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4936             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4937                 return NF_ACCEPT;
4938 #endif
4939
4940         if (sk == NULL) {
4941                 /* Without an associated socket the packet is either coming
4942                  * from the kernel or it is being forwarded; check the packet
4943                  * to determine which and if the packet is being forwarded
4944                  * query the packet directly to determine the security label. */
4945                 if (skb->skb_iif) {
4946                         secmark_perm = PACKET__FORWARD_OUT;
4947                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4948                                 return NF_DROP;
4949                 } else {
4950                         secmark_perm = PACKET__SEND;
4951                         peer_sid = SECINITSID_KERNEL;
4952                 }
4953         } else if (sk->sk_state == TCP_LISTEN) {
4954                 /* Locally generated packet but the associated socket is in the
4955                  * listening state which means this is a SYN-ACK packet.  In
4956                  * this particular case the correct security label is assigned
4957                  * to the connection/request_sock but unfortunately we can't
4958                  * query the request_sock as it isn't queued on the parent
4959                  * socket until after the SYN-ACK packet is sent; the only
4960                  * viable choice is to regenerate the label like we do in
4961                  * selinux_inet_conn_request().  See also selinux_ip_output()
4962                  * for similar problems. */
4963                 u32 skb_sid;
4964                 struct sk_security_struct *sksec = sk->sk_security;
4965                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
4966                         return NF_DROP;
4967                 /* At this point, if the returned skb peerlbl is SECSID_NULL
4968                  * and the packet has been through at least one XFRM
4969                  * transformation then we must be dealing with the "final"
4970                  * form of labeled IPsec packet; since we've already applied
4971                  * all of our access controls on this packet we can safely
4972                  * pass the packet. */
4973                 if (skb_sid == SECSID_NULL) {
4974                         switch (family) {
4975                         case PF_INET:
4976                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
4977                                         return NF_ACCEPT;
4978                                 break;
4979                         case PF_INET6:
4980                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
4981                                         return NF_ACCEPT;
4982                                 break;
4983                         default:
4984                                 return NF_DROP_ERR(-ECONNREFUSED);
4985                         }
4986                 }
4987                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
4988                         return NF_DROP;
4989                 secmark_perm = PACKET__SEND;
4990         } else {
4991                 /* Locally generated packet, fetch the security label from the
4992                  * associated socket. */
4993                 struct sk_security_struct *sksec = sk->sk_security;
4994                 peer_sid = sksec->sid;
4995                 secmark_perm = PACKET__SEND;
4996         }
4997
4998         ad.type = LSM_AUDIT_DATA_NET;
4999         ad.u.net = &net;
5000         ad.u.net->netif = ifindex;
5001         ad.u.net->family = family;
5002         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5003                 return NF_DROP;
5004
5005         if (secmark_active)
5006                 if (avc_has_perm(peer_sid, skb->secmark,
5007                                  SECCLASS_PACKET, secmark_perm, &ad))
5008                         return NF_DROP_ERR(-ECONNREFUSED);
5009
5010         if (peerlbl_active) {
5011                 u32 if_sid;
5012                 u32 node_sid;
5013
5014                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5015                         return NF_DROP;
5016                 if (avc_has_perm(peer_sid, if_sid,
5017                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5018                         return NF_DROP_ERR(-ECONNREFUSED);
5019
5020                 if (sel_netnode_sid(addrp, family, &node_sid))
5021                         return NF_DROP;
5022                 if (avc_has_perm(peer_sid, node_sid,
5023                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5024                         return NF_DROP_ERR(-ECONNREFUSED);
5025         }
5026
5027         return NF_ACCEPT;
5028 }
5029
5030 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5031                                            struct sk_buff *skb,
5032                                            const struct net_device *in,
5033                                            const struct net_device *out,
5034                                            int (*okfn)(struct sk_buff *))
5035 {
5036         return selinux_ip_postroute(skb, out, PF_INET);
5037 }
5038
5039 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5040 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5041                                            struct sk_buff *skb,
5042                                            const struct net_device *in,
5043                                            const struct net_device *out,
5044                                            int (*okfn)(struct sk_buff *))
5045 {
5046         return selinux_ip_postroute(skb, out, PF_INET6);
5047 }
5048 #endif  /* IPV6 */
5049
5050 #endif  /* CONFIG_NETFILTER */
5051
5052 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5053 {
5054         int err;
5055
5056         err = cap_netlink_send(sk, skb);
5057         if (err)
5058                 return err;
5059
5060         return selinux_nlmsg_perm(sk, skb);
5061 }
5062
5063 static int ipc_alloc_security(struct task_struct *task,
5064                               struct kern_ipc_perm *perm,
5065                               u16 sclass)
5066 {
5067         struct ipc_security_struct *isec;
5068         u32 sid;
5069
5070         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5071         if (!isec)
5072                 return -ENOMEM;
5073
5074         sid = task_sid(task);
5075         isec->sclass = sclass;
5076         isec->sid = sid;
5077         perm->security = isec;
5078
5079         return 0;
5080 }
5081
5082 static void ipc_free_security(struct kern_ipc_perm *perm)
5083 {
5084         struct ipc_security_struct *isec = perm->security;
5085         perm->security = NULL;
5086         kfree(isec);
5087 }
5088
5089 static int msg_msg_alloc_security(struct msg_msg *msg)
5090 {
5091         struct msg_security_struct *msec;
5092
5093         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5094         if (!msec)
5095                 return -ENOMEM;
5096
5097         msec->sid = SECINITSID_UNLABELED;
5098         msg->security = msec;
5099
5100         return 0;
5101 }
5102
5103 static void msg_msg_free_security(struct msg_msg *msg)
5104 {
5105         struct msg_security_struct *msec = msg->security;
5106
5107         msg->security = NULL;
5108         kfree(msec);
5109 }
5110
5111 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5112                         u32 perms)
5113 {
5114         struct ipc_security_struct *isec;
5115         struct common_audit_data ad;
5116         u32 sid = current_sid();
5117
5118         isec = ipc_perms->security;
5119
5120         ad.type = LSM_AUDIT_DATA_IPC;
5121         ad.u.ipc_id = ipc_perms->key;
5122
5123         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5124 }
5125
5126 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5127 {
5128         return msg_msg_alloc_security(msg);
5129 }
5130
5131 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5132 {
5133         msg_msg_free_security(msg);
5134 }
5135
5136 /* message queue security operations */
5137 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5138 {
5139         struct ipc_security_struct *isec;
5140         struct common_audit_data ad;
5141         u32 sid = current_sid();
5142         int rc;
5143
5144         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5145         if (rc)
5146                 return rc;
5147
5148         isec = msq->q_perm.security;
5149
5150         ad.type = LSM_AUDIT_DATA_IPC;
5151         ad.u.ipc_id = msq->q_perm.key;
5152
5153         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5154                           MSGQ__CREATE, &ad);
5155         if (rc) {
5156                 ipc_free_security(&msq->q_perm);
5157                 return rc;
5158         }
5159         return 0;
5160 }
5161
5162 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5163 {
5164         ipc_free_security(&msq->q_perm);
5165 }
5166
5167 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5168 {
5169         struct ipc_security_struct *isec;
5170         struct common_audit_data ad;
5171         u32 sid = current_sid();
5172
5173         isec = msq->q_perm.security;
5174
5175         ad.type = LSM_AUDIT_DATA_IPC;
5176         ad.u.ipc_id = msq->q_perm.key;
5177
5178         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5179                             MSGQ__ASSOCIATE, &ad);
5180 }
5181
5182 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5183 {
5184         int err;
5185         int perms;
5186
5187         switch (cmd) {
5188         case IPC_INFO:
5189         case MSG_INFO:
5190                 /* No specific object, just general system-wide information. */
5191                 return task_has_system(current, SYSTEM__IPC_INFO);
5192         case IPC_STAT:
5193         case MSG_STAT:
5194                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5195                 break;
5196         case IPC_SET:
5197                 perms = MSGQ__SETATTR;
5198                 break;
5199         case IPC_RMID:
5200                 perms = MSGQ__DESTROY;
5201                 break;
5202         default:
5203                 return 0;
5204         }
5205
5206         err = ipc_has_perm(&msq->q_perm, perms);
5207         return err;
5208 }
5209
5210 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5211 {
5212         struct ipc_security_struct *isec;
5213         struct msg_security_struct *msec;
5214         struct common_audit_data ad;
5215         u32 sid = current_sid();
5216         int rc;
5217
5218         isec = msq->q_perm.security;
5219         msec = msg->security;
5220
5221         /*
5222          * First time through, need to assign label to the message
5223          */
5224         if (msec->sid == SECINITSID_UNLABELED) {
5225                 /*
5226                  * Compute new sid based on current process and
5227                  * message queue this message will be stored in
5228                  */
5229                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5230                                              NULL, &msec->sid);
5231                 if (rc)
5232                         return rc;
5233         }
5234
5235         ad.type = LSM_AUDIT_DATA_IPC;
5236         ad.u.ipc_id = msq->q_perm.key;
5237
5238         /* Can this process write to the queue? */
5239         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5240                           MSGQ__WRITE, &ad);
5241         if (!rc)
5242                 /* Can this process send the message */
5243                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5244                                   MSG__SEND, &ad);
5245         if (!rc)
5246                 /* Can the message be put in the queue? */
5247                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5248                                   MSGQ__ENQUEUE, &ad);
5249
5250         return rc;
5251 }
5252
5253 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5254                                     struct task_struct *target,
5255                                     long type, int mode)
5256 {
5257         struct ipc_security_struct *isec;
5258         struct msg_security_struct *msec;
5259         struct common_audit_data ad;
5260         u32 sid = task_sid(target);
5261         int rc;
5262
5263         isec = msq->q_perm.security;
5264         msec = msg->security;
5265
5266         ad.type = LSM_AUDIT_DATA_IPC;
5267         ad.u.ipc_id = msq->q_perm.key;
5268
5269         rc = avc_has_perm(sid, isec->sid,
5270                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5271         if (!rc)
5272                 rc = avc_has_perm(sid, msec->sid,
5273                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5274         return rc;
5275 }
5276
5277 /* Shared Memory security operations */
5278 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5279 {
5280         struct ipc_security_struct *isec;
5281         struct common_audit_data ad;
5282         u32 sid = current_sid();
5283         int rc;
5284
5285         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5286         if (rc)
5287                 return rc;
5288
5289         isec = shp->shm_perm.security;
5290
5291         ad.type = LSM_AUDIT_DATA_IPC;
5292         ad.u.ipc_id = shp->shm_perm.key;
5293
5294         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5295                           SHM__CREATE, &ad);
5296         if (rc) {
5297                 ipc_free_security(&shp->shm_perm);
5298                 return rc;
5299         }
5300         return 0;
5301 }
5302
5303 static void selinux_shm_free_security(struct shmid_kernel *shp)
5304 {
5305         ipc_free_security(&shp->shm_perm);
5306 }
5307
5308 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5309 {
5310         struct ipc_security_struct *isec;
5311         struct common_audit_data ad;
5312         u32 sid = current_sid();
5313
5314         isec = shp->shm_perm.security;
5315
5316         ad.type = LSM_AUDIT_DATA_IPC;
5317         ad.u.ipc_id = shp->shm_perm.key;
5318
5319         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5320                             SHM__ASSOCIATE, &ad);
5321 }
5322
5323 /* Note, at this point, shp is locked down */
5324 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5325 {
5326         int perms;
5327         int err;
5328
5329         switch (cmd) {
5330         case IPC_INFO:
5331         case SHM_INFO:
5332                 /* No specific object, just general system-wide information. */
5333                 return task_has_system(current, SYSTEM__IPC_INFO);
5334         case IPC_STAT:
5335         case SHM_STAT:
5336                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5337                 break;
5338         case IPC_SET:
5339                 perms = SHM__SETATTR;
5340                 break;
5341         case SHM_LOCK:
5342         case SHM_UNLOCK:
5343                 perms = SHM__LOCK;
5344                 break;
5345         case IPC_RMID:
5346                 perms = SHM__DESTROY;
5347                 break;
5348         default:
5349                 return 0;
5350         }
5351
5352         err = ipc_has_perm(&shp->shm_perm, perms);
5353         return err;
5354 }
5355
5356 static int selinux_shm_shmat(struct shmid_kernel *shp,
5357                              char __user *shmaddr, int shmflg)
5358 {
5359         u32 perms;
5360
5361         if (shmflg & SHM_RDONLY)
5362                 perms = SHM__READ;
5363         else
5364                 perms = SHM__READ | SHM__WRITE;
5365
5366         return ipc_has_perm(&shp->shm_perm, perms);
5367 }
5368
5369 /* Semaphore security operations */
5370 static int selinux_sem_alloc_security(struct sem_array *sma)
5371 {
5372         struct ipc_security_struct *isec;
5373         struct common_audit_data ad;
5374         u32 sid = current_sid();
5375         int rc;
5376
5377         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5378         if (rc)
5379                 return rc;
5380
5381         isec = sma->sem_perm.security;
5382
5383         ad.type = LSM_AUDIT_DATA_IPC;
5384         ad.u.ipc_id = sma->sem_perm.key;
5385
5386         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5387                           SEM__CREATE, &ad);
5388         if (rc) {
5389                 ipc_free_security(&sma->sem_perm);
5390                 return rc;
5391         }
5392         return 0;
5393 }
5394
5395 static void selinux_sem_free_security(struct sem_array *sma)
5396 {
5397         ipc_free_security(&sma->sem_perm);
5398 }
5399
5400 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5401 {
5402         struct ipc_security_struct *isec;
5403         struct common_audit_data ad;
5404         u32 sid = current_sid();
5405
5406         isec = sma->sem_perm.security;
5407
5408         ad.type = LSM_AUDIT_DATA_IPC;
5409         ad.u.ipc_id = sma->sem_perm.key;
5410
5411         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5412                             SEM__ASSOCIATE, &ad);
5413 }
5414
5415 /* Note, at this point, sma is locked down */
5416 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5417 {
5418         int err;
5419         u32 perms;
5420
5421         switch (cmd) {
5422         case IPC_INFO:
5423         case SEM_INFO:
5424                 /* No specific object, just general system-wide information. */
5425                 return task_has_system(current, SYSTEM__IPC_INFO);
5426         case GETPID:
5427         case GETNCNT:
5428         case GETZCNT:
5429                 perms = SEM__GETATTR;
5430                 break;
5431         case GETVAL:
5432         case GETALL:
5433                 perms = SEM__READ;
5434                 break;
5435         case SETVAL:
5436         case SETALL:
5437                 perms = SEM__WRITE;
5438                 break;
5439         case IPC_RMID:
5440                 perms = SEM__DESTROY;
5441                 break;
5442         case IPC_SET:
5443                 perms = SEM__SETATTR;
5444                 break;
5445         case IPC_STAT:
5446         case SEM_STAT:
5447                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5448                 break;
5449         default:
5450                 return 0;
5451         }
5452
5453         err = ipc_has_perm(&sma->sem_perm, perms);
5454         return err;
5455 }
5456
5457 static int selinux_sem_semop(struct sem_array *sma,
5458                              struct sembuf *sops, unsigned nsops, int alter)
5459 {
5460         u32 perms;
5461
5462         if (alter)
5463                 perms = SEM__READ | SEM__WRITE;
5464         else
5465                 perms = SEM__READ;
5466
5467         return ipc_has_perm(&sma->sem_perm, perms);
5468 }
5469
5470 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5471 {
5472         u32 av = 0;
5473
5474         av = 0;
5475         if (flag & S_IRUGO)
5476                 av |= IPC__UNIX_READ;
5477         if (flag & S_IWUGO)
5478                 av |= IPC__UNIX_WRITE;
5479
5480         if (av == 0)
5481                 return 0;
5482
5483         return ipc_has_perm(ipcp, av);
5484 }
5485
5486 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5487 {
5488         struct ipc_security_struct *isec = ipcp->security;
5489         *secid = isec->sid;
5490 }
5491
5492 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5493 {
5494         if (inode)
5495                 inode_doinit_with_dentry(inode, dentry);
5496 }
5497
5498 static int selinux_getprocattr(struct task_struct *p,
5499                                char *name, char **value)
5500 {
5501         const struct task_security_struct *__tsec;
5502         u32 sid;
5503         int error;
5504         unsigned len;
5505
5506         if (current != p) {
5507                 error = current_has_perm(p, PROCESS__GETATTR);
5508                 if (error)
5509                         return error;
5510         }
5511
5512         rcu_read_lock();
5513         __tsec = __task_cred(p)->security;
5514
5515         if (!strcmp(name, "current"))
5516                 sid = __tsec->sid;
5517         else if (!strcmp(name, "prev"))
5518                 sid = __tsec->osid;
5519         else if (!strcmp(name, "exec"))
5520                 sid = __tsec->exec_sid;
5521         else if (!strcmp(name, "fscreate"))
5522                 sid = __tsec->create_sid;
5523         else if (!strcmp(name, "keycreate"))
5524                 sid = __tsec->keycreate_sid;
5525         else if (!strcmp(name, "sockcreate"))
5526                 sid = __tsec->sockcreate_sid;
5527         else
5528                 goto invalid;
5529         rcu_read_unlock();
5530
5531         if (!sid)
5532                 return 0;
5533
5534         error = security_sid_to_context(sid, value, &len);
5535         if (error)
5536                 return error;
5537         return len;
5538
5539 invalid:
5540         rcu_read_unlock();
5541         return -EINVAL;
5542 }
5543
5544 static int selinux_setprocattr(struct task_struct *p,
5545                                char *name, void *value, size_t size)
5546 {
5547         struct task_security_struct *tsec;
5548         struct task_struct *tracer;
5549         struct cred *new;
5550         u32 sid = 0, ptsid;
5551         int error;
5552         char *str = value;
5553
5554         if (current != p) {
5555                 /* SELinux only allows a process to change its own
5556                    security attributes. */
5557                 return -EACCES;
5558         }
5559
5560         /*
5561          * Basic control over ability to set these attributes at all.
5562          * current == p, but we'll pass them separately in case the
5563          * above restriction is ever removed.
5564          */
5565         if (!strcmp(name, "exec"))
5566                 error = current_has_perm(p, PROCESS__SETEXEC);
5567         else if (!strcmp(name, "fscreate"))
5568                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5569         else if (!strcmp(name, "keycreate"))
5570                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5571         else if (!strcmp(name, "sockcreate"))
5572                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5573         else if (!strcmp(name, "current"))
5574                 error = current_has_perm(p, PROCESS__SETCURRENT);
5575         else
5576                 error = -EINVAL;
5577         if (error)
5578                 return error;
5579
5580         /* Obtain a SID for the context, if one was specified. */
5581         if (size && str[1] && str[1] != '\n') {
5582                 if (str[size-1] == '\n') {
5583                         str[size-1] = 0;
5584                         size--;
5585                 }
5586                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5587                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5588                         if (!capable(CAP_MAC_ADMIN)) {
5589                                 struct audit_buffer *ab;
5590                                 size_t audit_size;
5591
5592                                 /* We strip a nul only if it is at the end, otherwise the
5593                                  * context contains a nul and we should audit that */
5594                                 if (str[size - 1] == '\0')
5595                                         audit_size = size - 1;
5596                                 else
5597                                         audit_size = size;
5598                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5599                                 audit_log_format(ab, "op=fscreate invalid_context=");
5600                                 audit_log_n_untrustedstring(ab, value, audit_size);
5601                                 audit_log_end(ab);
5602
5603                                 return error;
5604                         }
5605                         error = security_context_to_sid_force(value, size,
5606                                                               &sid);
5607                 }
5608                 if (error)
5609                         return error;
5610         }
5611
5612         new = prepare_creds();
5613         if (!new)
5614                 return -ENOMEM;
5615
5616         /* Permission checking based on the specified context is
5617            performed during the actual operation (execve,
5618            open/mkdir/...), when we know the full context of the
5619            operation.  See selinux_bprm_set_creds for the execve
5620            checks and may_create for the file creation checks. The
5621            operation will then fail if the context is not permitted. */
5622         tsec = new->security;
5623         if (!strcmp(name, "exec")) {
5624                 tsec->exec_sid = sid;
5625         } else if (!strcmp(name, "fscreate")) {
5626                 tsec->create_sid = sid;
5627         } else if (!strcmp(name, "keycreate")) {
5628                 error = may_create_key(sid, p);
5629                 if (error)
5630                         goto abort_change;
5631                 tsec->keycreate_sid = sid;
5632         } else if (!strcmp(name, "sockcreate")) {
5633                 tsec->sockcreate_sid = sid;
5634         } else if (!strcmp(name, "current")) {
5635                 error = -EINVAL;
5636                 if (sid == 0)
5637                         goto abort_change;
5638
5639                 /* Only allow single threaded processes to change context */
5640                 error = -EPERM;
5641                 if (!current_is_single_threaded()) {
5642                         error = security_bounded_transition(tsec->sid, sid);
5643                         if (error)
5644                                 goto abort_change;
5645                 }
5646
5647                 /* Check permissions for the transition. */
5648                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5649                                      PROCESS__DYNTRANSITION, NULL);
5650                 if (error)
5651                         goto abort_change;
5652
5653                 /* Check for ptracing, and update the task SID if ok.
5654                    Otherwise, leave SID unchanged and fail. */
5655                 ptsid = 0;
5656                 rcu_read_lock();
5657                 tracer = ptrace_parent(p);
5658                 if (tracer)
5659                         ptsid = task_sid(tracer);
5660                 rcu_read_unlock();
5661
5662                 if (tracer) {
5663                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5664                                              PROCESS__PTRACE, NULL);
5665                         if (error)
5666                                 goto abort_change;
5667                 }
5668
5669                 tsec->sid = sid;
5670         } else {
5671                 error = -EINVAL;
5672                 goto abort_change;
5673         }
5674
5675         commit_creds(new);
5676         return size;
5677
5678 abort_change:
5679         abort_creds(new);
5680         return error;
5681 }
5682
5683 static int selinux_ismaclabel(const char *name)
5684 {
5685         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5686 }
5687
5688 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5689 {
5690         return security_sid_to_context(secid, secdata, seclen);
5691 }
5692
5693 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5694 {
5695         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5696 }
5697
5698 static void selinux_release_secctx(char *secdata, u32 seclen)
5699 {
5700         kfree(secdata);
5701 }
5702
5703 /*
5704  *      called with inode->i_mutex locked
5705  */
5706 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5707 {
5708         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5709 }
5710
5711 /*
5712  *      called with inode->i_mutex locked
5713  */
5714 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5715 {
5716         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5717 }
5718
5719 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5720 {
5721         int len = 0;
5722         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5723                                                 ctx, true);
5724         if (len < 0)
5725                 return len;
5726         *ctxlen = len;
5727         return 0;
5728 }
5729 #ifdef CONFIG_KEYS
5730
5731 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5732                              unsigned long flags)
5733 {
5734         const struct task_security_struct *tsec;
5735         struct key_security_struct *ksec;
5736
5737         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5738         if (!ksec)
5739                 return -ENOMEM;
5740
5741         tsec = cred->security;
5742         if (tsec->keycreate_sid)
5743                 ksec->sid = tsec->keycreate_sid;
5744         else
5745                 ksec->sid = tsec->sid;
5746
5747         k->security = ksec;
5748         return 0;
5749 }
5750
5751 static void selinux_key_free(struct key *k)
5752 {
5753         struct key_security_struct *ksec = k->security;
5754
5755         k->security = NULL;
5756         kfree(ksec);
5757 }
5758
5759 static int selinux_key_permission(key_ref_t key_ref,
5760                                   const struct cred *cred,
5761                                   unsigned perm)
5762 {
5763         struct key *key;
5764         struct key_security_struct *ksec;
5765         u32 sid;
5766
5767         /* if no specific permissions are requested, we skip the
5768            permission check. No serious, additional covert channels
5769            appear to be created. */
5770         if (perm == 0)
5771                 return 0;
5772
5773         sid = cred_sid(cred);
5774
5775         key = key_ref_to_ptr(key_ref);
5776         ksec = key->security;
5777
5778         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5779 }
5780
5781 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5782 {
5783         struct key_security_struct *ksec = key->security;
5784         char *context = NULL;
5785         unsigned len;
5786         int rc;
5787
5788         rc = security_sid_to_context(ksec->sid, &context, &len);
5789         if (!rc)
5790                 rc = len;
5791         *_buffer = context;
5792         return rc;
5793 }
5794
5795 #endif
5796
5797 static struct security_operations selinux_ops = {
5798         .name =                         "selinux",
5799
5800         .ptrace_access_check =          selinux_ptrace_access_check,
5801         .ptrace_traceme =               selinux_ptrace_traceme,
5802         .capget =                       selinux_capget,
5803         .capset =                       selinux_capset,
5804         .capable =                      selinux_capable,
5805         .quotactl =                     selinux_quotactl,
5806         .quota_on =                     selinux_quota_on,
5807         .syslog =                       selinux_syslog,
5808         .vm_enough_memory =             selinux_vm_enough_memory,
5809
5810         .netlink_send =                 selinux_netlink_send,
5811
5812         .bprm_set_creds =               selinux_bprm_set_creds,
5813         .bprm_committing_creds =        selinux_bprm_committing_creds,
5814         .bprm_committed_creds =         selinux_bprm_committed_creds,
5815         .bprm_secureexec =              selinux_bprm_secureexec,
5816
5817         .sb_alloc_security =            selinux_sb_alloc_security,
5818         .sb_free_security =             selinux_sb_free_security,
5819         .sb_copy_data =                 selinux_sb_copy_data,
5820         .sb_remount =                   selinux_sb_remount,
5821         .sb_kern_mount =                selinux_sb_kern_mount,
5822         .sb_show_options =              selinux_sb_show_options,
5823         .sb_statfs =                    selinux_sb_statfs,
5824         .sb_mount =                     selinux_mount,
5825         .sb_umount =                    selinux_umount,
5826         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5827         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5828         .sb_parse_opts_str =            selinux_parse_opts_str,
5829
5830         .dentry_init_security =         selinux_dentry_init_security,
5831
5832         .inode_alloc_security =         selinux_inode_alloc_security,
5833         .inode_free_security =          selinux_inode_free_security,
5834         .inode_init_security =          selinux_inode_init_security,
5835         .inode_create =                 selinux_inode_create,
5836         .inode_link =                   selinux_inode_link,
5837         .inode_unlink =                 selinux_inode_unlink,
5838         .inode_symlink =                selinux_inode_symlink,
5839         .inode_mkdir =                  selinux_inode_mkdir,
5840         .inode_rmdir =                  selinux_inode_rmdir,
5841         .inode_mknod =                  selinux_inode_mknod,
5842         .inode_rename =                 selinux_inode_rename,
5843         .inode_readlink =               selinux_inode_readlink,
5844         .inode_follow_link =            selinux_inode_follow_link,
5845         .inode_permission =             selinux_inode_permission,
5846         .inode_setattr =                selinux_inode_setattr,
5847         .inode_getattr =                selinux_inode_getattr,
5848         .inode_setxattr =               selinux_inode_setxattr,
5849         .inode_post_setxattr =          selinux_inode_post_setxattr,
5850         .inode_getxattr =               selinux_inode_getxattr,
5851         .inode_listxattr =              selinux_inode_listxattr,
5852         .inode_removexattr =            selinux_inode_removexattr,
5853         .inode_getsecurity =            selinux_inode_getsecurity,
5854         .inode_setsecurity =            selinux_inode_setsecurity,
5855         .inode_listsecurity =           selinux_inode_listsecurity,
5856         .inode_getsecid =               selinux_inode_getsecid,
5857
5858         .file_permission =              selinux_file_permission,
5859         .file_alloc_security =          selinux_file_alloc_security,
5860         .file_free_security =           selinux_file_free_security,
5861         .file_ioctl =                   selinux_file_ioctl,
5862         .mmap_file =                    selinux_mmap_file,
5863         .mmap_addr =                    selinux_mmap_addr,
5864         .file_mprotect =                selinux_file_mprotect,
5865         .file_lock =                    selinux_file_lock,
5866         .file_fcntl =                   selinux_file_fcntl,
5867         .file_set_fowner =              selinux_file_set_fowner,
5868         .file_send_sigiotask =          selinux_file_send_sigiotask,
5869         .file_receive =                 selinux_file_receive,
5870
5871         .file_open =                    selinux_file_open,
5872
5873         .task_create =                  selinux_task_create,
5874         .cred_alloc_blank =             selinux_cred_alloc_blank,
5875         .cred_free =                    selinux_cred_free,
5876         .cred_prepare =                 selinux_cred_prepare,
5877         .cred_transfer =                selinux_cred_transfer,
5878         .kernel_act_as =                selinux_kernel_act_as,
5879         .kernel_create_files_as =       selinux_kernel_create_files_as,
5880         .kernel_module_request =        selinux_kernel_module_request,
5881         .task_setpgid =                 selinux_task_setpgid,
5882         .task_getpgid =                 selinux_task_getpgid,
5883         .task_getsid =                  selinux_task_getsid,
5884         .task_getsecid =                selinux_task_getsecid,
5885         .task_setnice =                 selinux_task_setnice,
5886         .task_setioprio =               selinux_task_setioprio,
5887         .task_getioprio =               selinux_task_getioprio,
5888         .task_setrlimit =               selinux_task_setrlimit,
5889         .task_setscheduler =            selinux_task_setscheduler,
5890         .task_getscheduler =            selinux_task_getscheduler,
5891         .task_movememory =              selinux_task_movememory,
5892         .task_kill =                    selinux_task_kill,
5893         .task_wait =                    selinux_task_wait,
5894         .task_to_inode =                selinux_task_to_inode,
5895
5896         .ipc_permission =               selinux_ipc_permission,
5897         .ipc_getsecid =                 selinux_ipc_getsecid,
5898
5899         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5900         .msg_msg_free_security =        selinux_msg_msg_free_security,
5901
5902         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5903         .msg_queue_free_security =      selinux_msg_queue_free_security,
5904         .msg_queue_associate =          selinux_msg_queue_associate,
5905         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5906         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5907         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5908
5909         .shm_alloc_security =           selinux_shm_alloc_security,
5910         .shm_free_security =            selinux_shm_free_security,
5911         .shm_associate =                selinux_shm_associate,
5912         .shm_shmctl =                   selinux_shm_shmctl,
5913         .shm_shmat =                    selinux_shm_shmat,
5914
5915         .sem_alloc_security =           selinux_sem_alloc_security,
5916         .sem_free_security =            selinux_sem_free_security,
5917         .sem_associate =                selinux_sem_associate,
5918         .sem_semctl =                   selinux_sem_semctl,
5919         .sem_semop =                    selinux_sem_semop,
5920
5921         .d_instantiate =                selinux_d_instantiate,
5922
5923         .getprocattr =                  selinux_getprocattr,
5924         .setprocattr =                  selinux_setprocattr,
5925
5926         .ismaclabel =                   selinux_ismaclabel,
5927         .secid_to_secctx =              selinux_secid_to_secctx,
5928         .secctx_to_secid =              selinux_secctx_to_secid,
5929         .release_secctx =               selinux_release_secctx,
5930         .inode_notifysecctx =           selinux_inode_notifysecctx,
5931         .inode_setsecctx =              selinux_inode_setsecctx,
5932         .inode_getsecctx =              selinux_inode_getsecctx,
5933
5934         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5935         .unix_may_send =                selinux_socket_unix_may_send,
5936
5937         .socket_create =                selinux_socket_create,
5938         .socket_post_create =           selinux_socket_post_create,
5939         .socket_bind =                  selinux_socket_bind,
5940         .socket_connect =               selinux_socket_connect,
5941         .socket_listen =                selinux_socket_listen,
5942         .socket_accept =                selinux_socket_accept,
5943         .socket_sendmsg =               selinux_socket_sendmsg,
5944         .socket_recvmsg =               selinux_socket_recvmsg,
5945         .socket_getsockname =           selinux_socket_getsockname,
5946         .socket_getpeername =           selinux_socket_getpeername,
5947         .socket_getsockopt =            selinux_socket_getsockopt,
5948         .socket_setsockopt =            selinux_socket_setsockopt,
5949         .socket_shutdown =              selinux_socket_shutdown,
5950         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5951         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5952         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5953         .sk_alloc_security =            selinux_sk_alloc_security,
5954         .sk_free_security =             selinux_sk_free_security,
5955         .sk_clone_security =            selinux_sk_clone_security,
5956         .sk_getsecid =                  selinux_sk_getsecid,
5957         .sock_graft =                   selinux_sock_graft,
5958         .inet_conn_request =            selinux_inet_conn_request,
5959         .inet_csk_clone =               selinux_inet_csk_clone,
5960         .inet_conn_established =        selinux_inet_conn_established,
5961         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5962         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5963         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5964         .req_classify_flow =            selinux_req_classify_flow,
5965         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
5966         .tun_dev_free_security =        selinux_tun_dev_free_security,
5967         .tun_dev_create =               selinux_tun_dev_create,
5968         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
5969         .tun_dev_attach =               selinux_tun_dev_attach,
5970         .tun_dev_open =                 selinux_tun_dev_open,
5971         .skb_owned_by =                 selinux_skb_owned_by,
5972
5973 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5974         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5975         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5976         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5977         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5978         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
5979         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
5980         .xfrm_state_free_security =     selinux_xfrm_state_free,
5981         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5982         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5983         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5984         .xfrm_decode_session =          selinux_xfrm_decode_session,
5985 #endif
5986
5987 #ifdef CONFIG_KEYS
5988         .key_alloc =                    selinux_key_alloc,
5989         .key_free =                     selinux_key_free,
5990         .key_permission =               selinux_key_permission,
5991         .key_getsecurity =              selinux_key_getsecurity,
5992 #endif
5993
5994 #ifdef CONFIG_AUDIT
5995         .audit_rule_init =              selinux_audit_rule_init,
5996         .audit_rule_known =             selinux_audit_rule_known,
5997         .audit_rule_match =             selinux_audit_rule_match,
5998         .audit_rule_free =              selinux_audit_rule_free,
5999 #endif
6000 };
6001
6002 static __init int selinux_init(void)
6003 {
6004         if (!security_module_enable(&selinux_ops)) {
6005                 selinux_enabled = 0;
6006                 return 0;
6007         }
6008
6009         if (!selinux_enabled) {
6010                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6011                 return 0;
6012         }
6013
6014         printk(KERN_INFO "SELinux:  Initializing.\n");
6015
6016         /* Set the security state for the initial task. */
6017         cred_init_security();
6018
6019         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6020
6021         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6022                                             sizeof(struct inode_security_struct),
6023                                             0, SLAB_PANIC, NULL);
6024         avc_init();
6025
6026         if (register_security(&selinux_ops))
6027                 panic("SELinux: Unable to register with kernel.\n");
6028
6029         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6030                 panic("SELinux: Unable to register AVC netcache callback\n");
6031
6032         if (selinux_enforcing)
6033                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6034         else
6035                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6036
6037         return 0;
6038 }
6039
6040 static void delayed_superblock_init(struct super_block *sb, void *unused)
6041 {
6042         superblock_doinit(sb, NULL);
6043 }
6044
6045 void selinux_complete_init(void)
6046 {
6047         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6048
6049         /* Set up any superblocks initialized prior to the policy load. */
6050         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6051         iterate_supers(delayed_superblock_init, NULL);
6052 }
6053
6054 /* SELinux requires early initialization in order to label
6055    all processes and objects when they are created. */
6056 security_initcall(selinux_init);
6057
6058 #if defined(CONFIG_NETFILTER)
6059
6060 static struct nf_hook_ops selinux_nf_ops[] = {
6061         {
6062                 .hook =         selinux_ipv4_postroute,
6063                 .owner =        THIS_MODULE,
6064                 .pf =           NFPROTO_IPV4,
6065                 .hooknum =      NF_INET_POST_ROUTING,
6066                 .priority =     NF_IP_PRI_SELINUX_LAST,
6067         },
6068         {
6069                 .hook =         selinux_ipv4_forward,
6070                 .owner =        THIS_MODULE,
6071                 .pf =           NFPROTO_IPV4,
6072                 .hooknum =      NF_INET_FORWARD,
6073                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6074         },
6075         {
6076                 .hook =         selinux_ipv4_output,
6077                 .owner =        THIS_MODULE,
6078                 .pf =           NFPROTO_IPV4,
6079                 .hooknum =      NF_INET_LOCAL_OUT,
6080                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6081         },
6082 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6083         {
6084                 .hook =         selinux_ipv6_postroute,
6085                 .owner =        THIS_MODULE,
6086                 .pf =           NFPROTO_IPV6,
6087                 .hooknum =      NF_INET_POST_ROUTING,
6088                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6089         },
6090         {
6091                 .hook =         selinux_ipv6_forward,
6092                 .owner =        THIS_MODULE,
6093                 .pf =           NFPROTO_IPV6,
6094                 .hooknum =      NF_INET_FORWARD,
6095                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6096         },
6097 #endif  /* IPV6 */
6098 };
6099
6100 static int __init selinux_nf_ip_init(void)
6101 {
6102         int err;
6103
6104         if (!selinux_enabled)
6105                 return 0;
6106
6107         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6108
6109         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6110         if (err)
6111                 panic("SELinux: nf_register_hooks: error %d\n", err);
6112
6113         return 0;
6114 }
6115
6116 __initcall(selinux_nf_ip_init);
6117
6118 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6119 static void selinux_nf_ip_exit(void)
6120 {
6121         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6122
6123         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6124 }
6125 #endif
6126
6127 #else /* CONFIG_NETFILTER */
6128
6129 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6130 #define selinux_nf_ip_exit()
6131 #endif
6132
6133 #endif /* CONFIG_NETFILTER */
6134
6135 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6136 static int selinux_disabled;
6137
6138 int selinux_disable(void)
6139 {
6140         if (ss_initialized) {
6141                 /* Not permitted after initial policy load. */
6142                 return -EINVAL;
6143         }
6144
6145         if (selinux_disabled) {
6146                 /* Only do this once. */
6147                 return -EINVAL;
6148         }
6149
6150         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6151
6152         selinux_disabled = 1;
6153         selinux_enabled = 0;
6154
6155         reset_security_ops();
6156
6157         /* Try to destroy the avc node cache */
6158         avc_disable();
6159
6160         /* Unregister netfilter hooks. */
6161         selinux_nf_ip_exit();
6162
6163         /* Unregister selinuxfs. */
6164         exit_sel_fs();
6165
6166         return 0;
6167 }
6168 #endif