security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/sock.h>
  55 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  56 #include <net/inet_connection_sock.h>
  57 #include <net/net_namespace.h>
  58 #include <net/netlabel.h>
  59 #include <linux/uaccess.h>
  60 #include <asm/ioctls.h>
  61 #include <linux/atomic.h>
  62 #include <linux/bitops.h>
  63 #include <linux/interrupt.h>
  64 #include <linux/netdevice.h>    /* for network interface checks */
  65 #include <net/netlink.h>
  66 #include <linux/tcp.h>
  67 #include <linux/udp.h>
  68 #include <linux/dccp.h>
  69 #include <linux/quota.h>
  70 #include <linux/un.h>           /* for Unix socket types */
  71 #include <net/af_unix.h>        /* for Unix socket types */
  72 #include <linux/parser.h>
  73 #include <linux/nfs_mount.h>
  74 #include <net/ipv6.h>
  75 #include <linux/hugetlb.h>
  76 #include <linux/personality.h>
  77 #include <linux/audit.h>
  78 #include <linux/string.h>
  79 #include <linux/selinux.h>
  80 #include <linux/mutex.h>
  81 #include <linux/posix-timers.h>
  82 #include <linux/syslog.h>
  83 #include <linux/user_namespace.h>
  84 #include <linux/export.h>
  85 #include <linux/msg.h>
  86 #include <linux/shm.h>
  87
  88 #include "avc.h"
  89 #include "objsec.h"
  90 #include "netif.h"
  91 #include "netnode.h"
  92 #include "netport.h"
  93 #include "xfrm.h"
  94 #include "netlabel.h"
  95 #include "audit.h"
  96 #include "avc_ss.h"
  97
  98 /* SECMARK reference count */
  99 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 100
 101 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 102 int selinux_enforcing;
 103
 104 static int __init enforcing_setup(char *str)
 105 {
 106         unsigned long enforcing;
 107         if (!kstrtoul(str, 0, &enforcing))
 108                 selinux_enforcing = enforcing ? 1 : 0;
 109         return 1;
 110 }
 111 __setup("enforcing=", enforcing_setup);
 112 #endif
 113
 114 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 115 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 116
 117 static int __init selinux_enabled_setup(char *str)
 118 {
 119         unsigned long enabled;
 120         if (!kstrtoul(str, 0, &enabled))
 121                 selinux_enabled = enabled ? 1 : 0;
 122         return 1;
 123 }
 124 __setup("selinux=", selinux_enabled_setup);
 125 #else
 126 int selinux_enabled = 1;
 127 #endif
 128
 129 static struct kmem_cache *sel_inode_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         spin_lock(&sbsec->isec_lock);
 259         if (!list_empty(&isec->list))
 260                 list_del_init(&isec->list);
 261         spin_unlock(&sbsec->isec_lock);
 262
 263         /*
 264          * The inode may still be referenced in a path walk and
 265          * a call to selinux_inode_permission() can be made
 266          * after inode_free_security() is called. Ideally, the VFS
 267          * wouldn't do this, but fixing that is a much harder
 268          * job. For now, simply free the i_security via RCU, and
 269          * leave the current inode->i_security pointer intact.
 270          * The inode will be freed after the RCU grace period too.
 271          */
 272         call_rcu(&isec->rcu, inode_free_rcu);
 273 }
 274
 275 static int file_alloc_security(struct file *file)
 276 {
 277         struct file_security_struct *fsec;
 278         u32 sid = current_sid();
 279
 280         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 281         if (!fsec)
 282                 return -ENOMEM;
 283
 284         fsec->sid = sid;
 285         fsec->fown_sid = sid;
 286         file->f_security = fsec;
 287
 288         return 0;
 289 }
 290
 291 static void file_free_security(struct file *file)
 292 {
 293         struct file_security_struct *fsec = file->f_security;
 294         file->f_security = NULL;
 295         kfree(fsec);
 296 }
 297
 298 static int superblock_alloc_security(struct super_block *sb)
 299 {
 300         struct superblock_security_struct *sbsec;
 301
 302         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 303         if (!sbsec)
 304                 return -ENOMEM;
 305
 306         mutex_init(&sbsec->lock);
 307         INIT_LIST_HEAD(&sbsec->isec_head);
 308         spin_lock_init(&sbsec->isec_lock);
 309         sbsec->sb = sb;
 310         sbsec->sid = SECINITSID_UNLABELED;
 311         sbsec->def_sid = SECINITSID_FILE;
 312         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 313         sb->s_security = sbsec;
 314
 315         return 0;
 316 }
 317
 318 static void superblock_free_security(struct super_block *sb)
 319 {
 320         struct superblock_security_struct *sbsec = sb->s_security;
 321         sb->s_security = NULL;
 322         kfree(sbsec);
 323 }
 324
 325 /* The file system's label must be initialized prior to use. */
 326
 327 static const char *labeling_behaviors[7] = {
 328         "uses xattr",
 329         "uses transition SIDs",
 330         "uses task SIDs",
 331         "uses genfs_contexts",
 332         "not configured for labeling",
 333         "uses mountpoint labeling",
 334         "uses native labeling",
 335 };
 336
 337 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 338
 339 static inline int inode_doinit(struct inode *inode)
 340 {
 341         return inode_doinit_with_dentry(inode, NULL);
 342 }
 343
 344 enum {
 345         Opt_error = -1,
 346         Opt_context = 1,
 347         Opt_fscontext = 2,
 348         Opt_defcontext = 3,
 349         Opt_rootcontext = 4,
 350         Opt_labelsupport = 5,
 351         Opt_nextmntopt = 6,
 352 };
 353
 354 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 355
 356 static const match_table_t tokens = {
 357         {Opt_context, CONTEXT_STR "%s"},
 358         {Opt_fscontext, FSCONTEXT_STR "%s"},
 359         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 360         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 361         {Opt_labelsupport, LABELSUPP_STR},
 362         {Opt_error, NULL},
 363 };
 364
 365 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 366
 367 static int may_context_mount_sb_relabel(u32 sid,
 368                         struct superblock_security_struct *sbsec,
 369                         const struct cred *cred)
 370 {
 371         const struct task_security_struct *tsec = cred->security;
 372         int rc;
 373
 374         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 375                           FILESYSTEM__RELABELFROM, NULL);
 376         if (rc)
 377                 return rc;
 378
 379         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 380                           FILESYSTEM__RELABELTO, NULL);
 381         return rc;
 382 }
 383
 384 static int may_context_mount_inode_relabel(u32 sid,
 385                         struct superblock_security_struct *sbsec,
 386                         const struct cred *cred)
 387 {
 388         const struct task_security_struct *tsec = cred->security;
 389         int rc;
 390         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELFROM, NULL);
 392         if (rc)
 393                 return rc;
 394
 395         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 396                           FILESYSTEM__ASSOCIATE, NULL);
 397         return rc;
 398 }
 399
 400 static int selinux_is_sblabel_mnt(struct super_block *sb)
 401 {
 402         struct superblock_security_struct *sbsec = sb->s_security;
 403
 404         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 405                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 406                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 407                 /* Special handling. Genfs but also in-core setxattr handler */
 408                 !strcmp(sb->s_type->name, "sysfs") ||
 409                 !strcmp(sb->s_type->name, "pstore") ||
 410                 !strcmp(sb->s_type->name, "debugfs") ||
 411                 !strcmp(sb->s_type->name, "rootfs");
 412 }
 413
 414 static int sb_finish_set_opts(struct super_block *sb)
 415 {
 416         struct superblock_security_struct *sbsec = sb->s_security;
 417         struct dentry *root = sb->s_root;
 418         struct inode *root_inode = root->d_inode;
 419         int rc = 0;
 420
 421         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 422                 /* Make sure that the xattr handler exists and that no
 423                    error other than -ENODATA is returned by getxattr on
 424                    the root directory.  -ENODATA is ok, as this may be
 425                    the first boot of the SELinux kernel before we have
 426                    assigned xattr values to the filesystem. */
 427                 if (!root_inode->i_op->getxattr) {
 428                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 429                                "xattr support\n", sb->s_id, sb->s_type->name);
 430                         rc = -EOPNOTSUPP;
 431                         goto out;
 432                 }
 433                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 434                 if (rc < 0 && rc != -ENODATA) {
 435                         if (rc == -EOPNOTSUPP)
 436                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 437                                        "%s) has no security xattr handler\n",
 438                                        sb->s_id, sb->s_type->name);
 439                         else
 440                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 441                                        "%s) getxattr errno %d\n", sb->s_id,
 442                                        sb->s_type->name, -rc);
 443                         goto out;
 444                 }
 445         }
 446
 447         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 448                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 449                        sb->s_id, sb->s_type->name);
 450
 451         sbsec->flags |= SE_SBINITIALIZED;
 452         if (selinux_is_sblabel_mnt(sb))
 453                 sbsec->flags |= SBLABEL_MNT;
 454
 455         /* Initialize the root inode. */
 456         rc = inode_doinit_with_dentry(root_inode, root);
 457
 458         /* Initialize any other inodes associated with the superblock, e.g.
 459            inodes created prior to initial policy load or inodes created
 460            during get_sb by a pseudo filesystem that directly
 461            populates itself. */
 462         spin_lock(&sbsec->isec_lock);
 463 next_inode:
 464         if (!list_empty(&sbsec->isec_head)) {
 465                 struct inode_security_struct *isec =
 466                                 list_entry(sbsec->isec_head.next,
 467                                            struct inode_security_struct, list);
 468                 struct inode *inode = isec->inode;
 469                 list_del_init(&isec->list);
 470                 spin_unlock(&sbsec->isec_lock);
 471                 inode = igrab(inode);
 472                 if (inode) {
 473                         if (!IS_PRIVATE(inode))
 474                                 inode_doinit(inode);
 475                         iput(inode);
 476                 }
 477                 spin_lock(&sbsec->isec_lock);
 478                 goto next_inode;
 479         }
 480         spin_unlock(&sbsec->isec_lock);
 481 out:
 482         return rc;
 483 }
 484
 485 /*
 486  * This function should allow an FS to ask what it's mount security
 487  * options were so it can use those later for submounts, displaying
 488  * mount options, or whatever.
 489  */
 490 static int selinux_get_mnt_opts(const struct super_block *sb,
 491                                 struct security_mnt_opts *opts)
 492 {
 493         int rc = 0, i;
 494         struct superblock_security_struct *sbsec = sb->s_security;
 495         char *context = NULL;
 496         u32 len;
 497         char tmp;
 498
 499         security_init_mnt_opts(opts);
 500
 501         if (!(sbsec->flags & SE_SBINITIALIZED))
 502                 return -EINVAL;
 503
 504         if (!ss_initialized)
 505                 return -EINVAL;
 506
 507         /* make sure we always check enough bits to cover the mask */
 508         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 509
 510         tmp = sbsec->flags & SE_MNTMASK;
 511         /* count the number of mount options for this sb */
 512         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 513                 if (tmp & 0x01)
 514                         opts->num_mnt_opts++;
 515                 tmp >>= 1;
 516         }
 517         /* Check if the Label support flag is set */
 518         if (sbsec->flags & SBLABEL_MNT)
 519                 opts->num_mnt_opts++;
 520
 521         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 522         if (!opts->mnt_opts) {
 523                 rc = -ENOMEM;
 524                 goto out_free;
 525         }
 526
 527         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 528         if (!opts->mnt_opts_flags) {
 529                 rc = -ENOMEM;
 530                 goto out_free;
 531         }
 532
 533         i = 0;
 534         if (sbsec->flags & FSCONTEXT_MNT) {
 535                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 536                 if (rc)
 537                         goto out_free;
 538                 opts->mnt_opts[i] = context;
 539                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 540         }
 541         if (sbsec->flags & CONTEXT_MNT) {
 542                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 543                 if (rc)
 544                         goto out_free;
 545                 opts->mnt_opts[i] = context;
 546                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 547         }
 548         if (sbsec->flags & DEFCONTEXT_MNT) {
 549                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 550                 if (rc)
 551                         goto out_free;
 552                 opts->mnt_opts[i] = context;
 553                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 554         }
 555         if (sbsec->flags & ROOTCONTEXT_MNT) {
 556                 struct inode *root = sbsec->sb->s_root->d_inode;
 557                 struct inode_security_struct *isec = root->i_security;
 558
 559                 rc = security_sid_to_context(isec->sid, &context, &len);
 560                 if (rc)
 561                         goto out_free;
 562                 opts->mnt_opts[i] = context;
 563                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 564         }
 565         if (sbsec->flags & SBLABEL_MNT) {
 566                 opts->mnt_opts[i] = NULL;
 567                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 568         }
 569
 570         BUG_ON(i != opts->num_mnt_opts);
 571
 572         return 0;
 573
 574 out_free:
 575         security_free_mnt_opts(opts);
 576         return rc;
 577 }
 578
 579 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 580                       u32 old_sid, u32 new_sid)
 581 {
 582         char mnt_flags = sbsec->flags & SE_MNTMASK;
 583
 584         /* check if the old mount command had the same options */
 585         if (sbsec->flags & SE_SBINITIALIZED)
 586                 if (!(sbsec->flags & flag) ||
 587                     (old_sid != new_sid))
 588                         return 1;
 589
 590         /* check if we were passed the same options twice,
 591          * aka someone passed context=a,context=b
 592          */
 593         if (!(sbsec->flags & SE_SBINITIALIZED))
 594                 if (mnt_flags & flag)
 595                         return 1;
 596         return 0;
 597 }
 598
 599 /*
 600  * Allow filesystems with binary mount data to explicitly set mount point
 601  * labeling information.
 602  */
 603 static int selinux_set_mnt_opts(struct super_block *sb,
 604                                 struct security_mnt_opts *opts,
 605                                 unsigned long kern_flags,
 606                                 unsigned long *set_kern_flags)
 607 {
 608         const struct cred *cred = current_cred();
 609         int rc = 0, i;
 610         struct superblock_security_struct *sbsec = sb->s_security;
 611         const char *name = sb->s_type->name;
 612         struct inode *inode = sbsec->sb->s_root->d_inode;
 613         struct inode_security_struct *root_isec = inode->i_security;
 614         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 615         u32 defcontext_sid = 0;
 616         char **mount_options = opts->mnt_opts;
 617         int *flags = opts->mnt_opts_flags;
 618         int num_opts = opts->num_mnt_opts;
 619
 620         mutex_lock(&sbsec->lock);
 621
 622         if (!ss_initialized) {
 623                 if (!num_opts) {
 624                         /* Defer initialization until selinux_complete_init,
 625                            after the initial policy is loaded and the security
 626                            server is ready to handle calls. */
 627                         goto out;
 628                 }
 629                 rc = -EINVAL;
 630                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 631                         "before the security server is initialized\n");
 632                 goto out;
 633         }
 634         if (kern_flags && !set_kern_flags) {
 635                 /* Specifying internal flags without providing a place to
 636                  * place the results is not allowed */
 637                 rc = -EINVAL;
 638                 goto out;
 639         }
 640
 641         /*
 642          * Binary mount data FS will come through this function twice.  Once
 643          * from an explicit call and once from the generic calls from the vfs.
 644          * Since the generic VFS calls will not contain any security mount data
 645          * we need to skip the double mount verification.
 646          *
 647          * This does open a hole in which we will not notice if the first
 648          * mount using this sb set explict options and a second mount using
 649          * this sb does not set any security options.  (The first options
 650          * will be used for both mounts)
 651          */
 652         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 653             && (num_opts == 0))
 654                 goto out;
 655
 656         /*
 657          * parse the mount options, check if they are valid sids.
 658          * also check if someone is trying to mount the same sb more
 659          * than once with different security options.
 660          */
 661         for (i = 0; i < num_opts; i++) {
 662                 u32 sid;
 663
 664                 if (flags[i] == SBLABEL_MNT)
 665                         continue;
 666                 rc = security_context_to_sid(mount_options[i],
 667                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 668                 if (rc) {
 669                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 670                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 671                                mount_options[i], sb->s_id, name, rc);
 672                         goto out;
 673                 }
 674                 switch (flags[i]) {
 675                 case FSCONTEXT_MNT:
 676                         fscontext_sid = sid;
 677
 678                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 679                                         fscontext_sid))
 680                                 goto out_double_mount;
 681
 682                         sbsec->flags |= FSCONTEXT_MNT;
 683                         break;
 684                 case CONTEXT_MNT:
 685                         context_sid = sid;
 686
 687                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 688                                         context_sid))
 689                                 goto out_double_mount;
 690
 691                         sbsec->flags |= CONTEXT_MNT;
 692                         break;
 693                 case ROOTCONTEXT_MNT:
 694                         rootcontext_sid = sid;
 695
 696                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 697                                         rootcontext_sid))
 698                                 goto out_double_mount;
 699
 700                         sbsec->flags |= ROOTCONTEXT_MNT;
 701
 702                         break;
 703                 case DEFCONTEXT_MNT:
 704                         defcontext_sid = sid;
 705
 706                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 707                                         defcontext_sid))
 708                                 goto out_double_mount;
 709
 710                         sbsec->flags |= DEFCONTEXT_MNT;
 711
 712                         break;
 713                 default:
 714                         rc = -EINVAL;
 715                         goto out;
 716                 }
 717         }
 718
 719         if (sbsec->flags & SE_SBINITIALIZED) {
 720                 /* previously mounted with options, but not on this attempt? */
 721                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 722                         goto out_double_mount;
 723                 rc = 0;
 724                 goto out;
 725         }
 726
 727         if (strcmp(sb->s_type->name, "proc") == 0)
 728                 sbsec->flags |= SE_SBPROC;
 729
 730         if (!sbsec->behavior) {
 731                 /*
 732                  * Determine the labeling behavior to use for this
 733                  * filesystem type.
 734                  */
 735                 rc = security_fs_use(sb);
 736                 if (rc) {
 737                         printk(KERN_WARNING
 738                                 "%s: security_fs_use(%s) returned %d\n",
 739                                         __func__, sb->s_type->name, rc);
 740                         goto out;
 741                 }
 742         }
 743         /* sets the context of the superblock for the fs being mounted. */
 744         if (fscontext_sid) {
 745                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 746                 if (rc)
 747                         goto out;
 748
 749                 sbsec->sid = fscontext_sid;
 750         }
 751
 752         /*
 753          * Switch to using mount point labeling behavior.
 754          * sets the label used on all file below the mountpoint, and will set
 755          * the superblock context if not already set.
 756          */
 757         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 758                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 759                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 760         }
 761
 762         if (context_sid) {
 763                 if (!fscontext_sid) {
 764                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 765                                                           cred);
 766                         if (rc)
 767                                 goto out;
 768                         sbsec->sid = context_sid;
 769                 } else {
 770                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 771                                                              cred);
 772                         if (rc)
 773                                 goto out;
 774                 }
 775                 if (!rootcontext_sid)
 776                         rootcontext_sid = context_sid;
 777
 778                 sbsec->mntpoint_sid = context_sid;
 779                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 780         }
 781
 782         if (rootcontext_sid) {
 783                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 784                                                      cred);
 785                 if (rc)
 786                         goto out;
 787
 788                 root_isec->sid = rootcontext_sid;
 789                 root_isec->initialized = 1;
 790         }
 791
 792         if (defcontext_sid) {
 793                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 794                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 795                         rc = -EINVAL;
 796                         printk(KERN_WARNING "SELinux: defcontext option is "
 797                                "invalid for this filesystem type\n");
 798                         goto out;
 799                 }
 800
 801                 if (defcontext_sid != sbsec->def_sid) {
 802                         rc = may_context_mount_inode_relabel(defcontext_sid,
 803                                                              sbsec, cred);
 804                         if (rc)
 805                                 goto out;
 806                 }
 807
 808                 sbsec->def_sid = defcontext_sid;
 809         }
 810
 811         rc = sb_finish_set_opts(sb);
 812 out:
 813         mutex_unlock(&sbsec->lock);
 814         return rc;
 815 out_double_mount:
 816         rc = -EINVAL;
 817         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 818                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 819         goto out;
 820 }
 821
 822 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 823                                     const struct super_block *newsb)
 824 {
 825         struct superblock_security_struct *old = oldsb->s_security;
 826         struct superblock_security_struct *new = newsb->s_security;
 827         char oldflags = old->flags & SE_MNTMASK;
 828         char newflags = new->flags & SE_MNTMASK;
 829
 830         if (oldflags != newflags)
 831                 goto mismatch;
 832         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 833                 goto mismatch;
 834         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 835                 goto mismatch;
 836         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 837                 goto mismatch;
 838         if (oldflags & ROOTCONTEXT_MNT) {
 839                 struct inode_security_struct *oldroot = oldsb->s_root->d_inode->i_security;
 840                 struct inode_security_struct *newroot = newsb->s_root->d_inode->i_security;
 841                 if (oldroot->sid != newroot->sid)
 842                         goto mismatch;
 843         }
 844         return 0;
 845 mismatch:
 846         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 847                             "different security settings for (dev %s, "
 848                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 849         return -EBUSY;
 850 }
 851
 852 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 853                                         struct super_block *newsb)
 854 {
 855         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 856         struct superblock_security_struct *newsbsec = newsb->s_security;
 857
 858         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 859         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 860         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 861
 862         /*
 863          * if the parent was able to be mounted it clearly had no special lsm
 864          * mount options.  thus we can safely deal with this superblock later
 865          */
 866         if (!ss_initialized)
 867                 return 0;
 868
 869         /* how can we clone if the old one wasn't set up?? */
 870         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 871
 872         /* if fs is reusing a sb, make sure that the contexts match */
 873         if (newsbsec->flags & SE_SBINITIALIZED)
 874                 return selinux_cmp_sb_context(oldsb, newsb);
 875
 876         mutex_lock(&newsbsec->lock);
 877
 878         newsbsec->flags = oldsbsec->flags;
 879
 880         newsbsec->sid = oldsbsec->sid;
 881         newsbsec->def_sid = oldsbsec->def_sid;
 882         newsbsec->behavior = oldsbsec->behavior;
 883
 884         if (set_context) {
 885                 u32 sid = oldsbsec->mntpoint_sid;
 886
 887                 if (!set_fscontext)
 888                         newsbsec->sid = sid;
 889                 if (!set_rootcontext) {
 890                         struct inode *newinode = newsb->s_root->d_inode;
 891                         struct inode_security_struct *newisec = newinode->i_security;
 892                         newisec->sid = sid;
 893                 }
 894                 newsbsec->mntpoint_sid = sid;
 895         }
 896         if (set_rootcontext) {
 897                 const struct inode *oldinode = oldsb->s_root->d_inode;
 898                 const struct inode_security_struct *oldisec = oldinode->i_security;
 899                 struct inode *newinode = newsb->s_root->d_inode;
 900                 struct inode_security_struct *newisec = newinode->i_security;
 901
 902                 newisec->sid = oldisec->sid;
 903         }
 904
 905         sb_finish_set_opts(newsb);
 906         mutex_unlock(&newsbsec->lock);
 907         return 0;
 908 }
 909
 910 static int selinux_parse_opts_str(char *options,
 911                                   struct security_mnt_opts *opts)
 912 {
 913         char *p;
 914         char *context = NULL, *defcontext = NULL;
 915         char *fscontext = NULL, *rootcontext = NULL;
 916         int rc, num_mnt_opts = 0;
 917
 918         opts->num_mnt_opts = 0;
 919
 920         /* Standard string-based options. */
 921         while ((p = strsep(&options, "|")) != NULL) {
 922                 int token;
 923                 substring_t args[MAX_OPT_ARGS];
 924
 925                 if (!*p)
 926                         continue;
 927
 928                 token = match_token(p, tokens, args);
 929
 930                 switch (token) {
 931                 case Opt_context:
 932                         if (context || defcontext) {
 933                                 rc = -EINVAL;
 934                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 935                                 goto out_err;
 936                         }
 937                         context = match_strdup(&args[0]);
 938                         if (!context) {
 939                                 rc = -ENOMEM;
 940                                 goto out_err;
 941                         }
 942                         break;
 943
 944                 case Opt_fscontext:
 945                         if (fscontext) {
 946                                 rc = -EINVAL;
 947                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 948                                 goto out_err;
 949                         }
 950                         fscontext = match_strdup(&args[0]);
 951                         if (!fscontext) {
 952                                 rc = -ENOMEM;
 953                                 goto out_err;
 954                         }
 955                         break;
 956
 957                 case Opt_rootcontext:
 958                         if (rootcontext) {
 959                                 rc = -EINVAL;
 960                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 961                                 goto out_err;
 962                         }
 963                         rootcontext = match_strdup(&args[0]);
 964                         if (!rootcontext) {
 965                                 rc = -ENOMEM;
 966                                 goto out_err;
 967                         }
 968                         break;
 969
 970                 case Opt_defcontext:
 971                         if (context || defcontext) {
 972                                 rc = -EINVAL;
 973                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 974                                 goto out_err;
 975                         }
 976                         defcontext = match_strdup(&args[0]);
 977                         if (!defcontext) {
 978                                 rc = -ENOMEM;
 979                                 goto out_err;
 980                         }
 981                         break;
 982                 case Opt_labelsupport:
 983                         break;
 984                 default:
 985                         rc = -EINVAL;
 986                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 987                         goto out_err;
 988
 989                 }
 990         }
 991
 992         rc = -ENOMEM;
 993         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 994         if (!opts->mnt_opts)
 995                 goto out_err;
 996
 997         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 998         if (!opts->mnt_opts_flags) {
 999                 kfree(opts->mnt_opts);
1000                 goto out_err;
1001         }
1002
1003         if (fscontext) {
1004                 opts->mnt_opts[num_mnt_opts] = fscontext;
1005                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1006         }
1007         if (context) {
1008                 opts->mnt_opts[num_mnt_opts] = context;
1009                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1010         }
1011         if (rootcontext) {
1012                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1013                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1014         }
1015         if (defcontext) {
1016                 opts->mnt_opts[num_mnt_opts] = defcontext;
1017                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1018         }
1019
1020         opts->num_mnt_opts = num_mnt_opts;
1021         return 0;
1022
1023 out_err:
1024         kfree(context);
1025         kfree(defcontext);
1026         kfree(fscontext);
1027         kfree(rootcontext);
1028         return rc;
1029 }
1030 /*
1031  * string mount options parsing and call set the sbsec
1032  */
1033 static int superblock_doinit(struct super_block *sb, void *data)
1034 {
1035         int rc = 0;
1036         char *options = data;
1037         struct security_mnt_opts opts;
1038
1039         security_init_mnt_opts(&opts);
1040
1041         if (!data)
1042                 goto out;
1043
1044         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1045
1046         rc = selinux_parse_opts_str(options, &opts);
1047         if (rc)
1048                 goto out_err;
1049
1050 out:
1051         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1052
1053 out_err:
1054         security_free_mnt_opts(&opts);
1055         return rc;
1056 }
1057
1058 static void selinux_write_opts(struct seq_file *m,
1059                                struct security_mnt_opts *opts)
1060 {
1061         int i;
1062         char *prefix;
1063
1064         for (i = 0; i < opts->num_mnt_opts; i++) {
1065                 char *has_comma;
1066
1067                 if (opts->mnt_opts[i])
1068                         has_comma = strchr(opts->mnt_opts[i], ',');
1069                 else
1070                         has_comma = NULL;
1071
1072                 switch (opts->mnt_opts_flags[i]) {
1073                 case CONTEXT_MNT:
1074                         prefix = CONTEXT_STR;
1075                         break;
1076                 case FSCONTEXT_MNT:
1077                         prefix = FSCONTEXT_STR;
1078                         break;
1079                 case ROOTCONTEXT_MNT:
1080                         prefix = ROOTCONTEXT_STR;
1081                         break;
1082                 case DEFCONTEXT_MNT:
1083                         prefix = DEFCONTEXT_STR;
1084                         break;
1085                 case SBLABEL_MNT:
1086                         seq_putc(m, ',');
1087                         seq_puts(m, LABELSUPP_STR);
1088                         continue;
1089                 default:
1090                         BUG();
1091                         return;
1092                 };
1093                 /* we need a comma before each option */
1094                 seq_putc(m, ',');
1095                 seq_puts(m, prefix);
1096                 if (has_comma)
1097                         seq_putc(m, '\"');
1098                 seq_puts(m, opts->mnt_opts[i]);
1099                 if (has_comma)
1100                         seq_putc(m, '\"');
1101         }
1102 }
1103
1104 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1105 {
1106         struct security_mnt_opts opts;
1107         int rc;
1108
1109         rc = selinux_get_mnt_opts(sb, &opts);
1110         if (rc) {
1111                 /* before policy load we may get EINVAL, don't show anything */
1112                 if (rc == -EINVAL)
1113                         rc = 0;
1114                 return rc;
1115         }
1116
1117         selinux_write_opts(m, &opts);
1118
1119         security_free_mnt_opts(&opts);
1120
1121         return rc;
1122 }
1123
1124 static inline u16 inode_mode_to_security_class(umode_t mode)
1125 {
1126         switch (mode & S_IFMT) {
1127         case S_IFSOCK:
1128                 return SECCLASS_SOCK_FILE;
1129         case S_IFLNK:
1130                 return SECCLASS_LNK_FILE;
1131         case S_IFREG:
1132                 return SECCLASS_FILE;
1133         case S_IFBLK:
1134                 return SECCLASS_BLK_FILE;
1135         case S_IFDIR:
1136                 return SECCLASS_DIR;
1137         case S_IFCHR:
1138                 return SECCLASS_CHR_FILE;
1139         case S_IFIFO:
1140                 return SECCLASS_FIFO_FILE;
1141
1142         }
1143
1144         return SECCLASS_FILE;
1145 }
1146
1147 static inline int default_protocol_stream(int protocol)
1148 {
1149         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1150 }
1151
1152 static inline int default_protocol_dgram(int protocol)
1153 {
1154         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1155 }
1156
1157 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1158 {
1159         switch (family) {
1160         case PF_UNIX:
1161                 switch (type) {
1162                 case SOCK_STREAM:
1163                 case SOCK_SEQPACKET:
1164                         return SECCLASS_UNIX_STREAM_SOCKET;
1165                 case SOCK_DGRAM:
1166                         return SECCLASS_UNIX_DGRAM_SOCKET;
1167                 }
1168                 break;
1169         case PF_INET:
1170         case PF_INET6:
1171                 switch (type) {
1172                 case SOCK_STREAM:
1173                         if (default_protocol_stream(protocol))
1174                                 return SECCLASS_TCP_SOCKET;
1175                         else
1176                                 return SECCLASS_RAWIP_SOCKET;
1177                 case SOCK_DGRAM:
1178                         if (default_protocol_dgram(protocol))
1179                                 return SECCLASS_UDP_SOCKET;
1180                         else
1181                                 return SECCLASS_RAWIP_SOCKET;
1182                 case SOCK_DCCP:
1183                         return SECCLASS_DCCP_SOCKET;
1184                 default:
1185                         return SECCLASS_RAWIP_SOCKET;
1186                 }
1187                 break;
1188         case PF_NETLINK:
1189                 switch (protocol) {
1190                 case NETLINK_ROUTE:
1191                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1192                 case NETLINK_FIREWALL:
1193                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1194                 case NETLINK_SOCK_DIAG:
1195                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1196                 case NETLINK_NFLOG:
1197                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1198                 case NETLINK_XFRM:
1199                         return SECCLASS_NETLINK_XFRM_SOCKET;
1200                 case NETLINK_SELINUX:
1201                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1202                 case NETLINK_AUDIT:
1203                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1204                 case NETLINK_IP6_FW:
1205                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1206                 case NETLINK_DNRTMSG:
1207                         return SECCLASS_NETLINK_DNRT_SOCKET;
1208                 case NETLINK_KOBJECT_UEVENT:
1209                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1210                 default:
1211                         return SECCLASS_NETLINK_SOCKET;
1212                 }
1213         case PF_PACKET:
1214                 return SECCLASS_PACKET_SOCKET;
1215         case PF_KEY:
1216                 return SECCLASS_KEY_SOCKET;
1217         case PF_APPLETALK:
1218                 return SECCLASS_APPLETALK_SOCKET;
1219         }
1220
1221         return SECCLASS_SOCKET;
1222 }
1223
1224 #ifdef CONFIG_PROC_FS
1225 static int selinux_proc_get_sid(struct dentry *dentry,
1226                                 u16 tclass,
1227                                 u32 *sid)
1228 {
1229         int rc;
1230         char *buffer, *path;
1231
1232         buffer = (char *)__get_free_page(GFP_KERNEL);
1233         if (!buffer)
1234                 return -ENOMEM;
1235
1236         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1237         if (IS_ERR(path))
1238                 rc = PTR_ERR(path);
1239         else {
1240                 /* each process gets a /proc/PID/ entry. Strip off the
1241                  * PID part to get a valid selinux labeling.
1242                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1243                 while (path[1] >= '0' && path[1] <= '9') {
1244                         path[1] = '/';
1245                         path++;
1246                 }
1247                 rc = security_genfs_sid("proc", path, tclass, sid);
1248         }
1249         free_page((unsigned long)buffer);
1250         return rc;
1251 }
1252 #else
1253 static int selinux_proc_get_sid(struct dentry *dentry,
1254                                 u16 tclass,
1255                                 u32 *sid)
1256 {
1257         return -EINVAL;
1258 }
1259 #endif
1260
1261 /* The inode's security attributes must be initialized before first use. */
1262 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1263 {
1264         struct superblock_security_struct *sbsec = NULL;
1265         struct inode_security_struct *isec = inode->i_security;
1266         u32 sid;
1267         struct dentry *dentry;
1268 #define INITCONTEXTLEN 255
1269         char *context = NULL;
1270         unsigned len = 0;
1271         int rc = 0;
1272
1273         if (isec->initialized)
1274                 goto out;
1275
1276         mutex_lock(&isec->lock);
1277         if (isec->initialized)
1278                 goto out_unlock;
1279
1280         sbsec = inode->i_sb->s_security;
1281         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1282                 /* Defer initialization until selinux_complete_init,
1283                    after the initial policy is loaded and the security
1284                    server is ready to handle calls. */
1285                 spin_lock(&sbsec->isec_lock);
1286                 if (list_empty(&isec->list))
1287                         list_add(&isec->list, &sbsec->isec_head);
1288                 spin_unlock(&sbsec->isec_lock);
1289                 goto out_unlock;
1290         }
1291
1292         switch (sbsec->behavior) {
1293         case SECURITY_FS_USE_NATIVE:
1294                 break;
1295         case SECURITY_FS_USE_XATTR:
1296                 if (!inode->i_op->getxattr) {
1297                         isec->sid = sbsec->def_sid;
1298                         break;
1299                 }
1300
1301                 /* Need a dentry, since the xattr API requires one.
1302                    Life would be simpler if we could just pass the inode. */
1303                 if (opt_dentry) {
1304                         /* Called from d_instantiate or d_splice_alias. */
1305                         dentry = dget(opt_dentry);
1306                 } else {
1307                         /* Called from selinux_complete_init, try to find a dentry. */
1308                         dentry = d_find_alias(inode);
1309                 }
1310                 if (!dentry) {
1311                         /*
1312                          * this is can be hit on boot when a file is accessed
1313                          * before the policy is loaded.  When we load policy we
1314                          * may find inodes that have no dentry on the
1315                          * sbsec->isec_head list.  No reason to complain as these
1316                          * will get fixed up the next time we go through
1317                          * inode_doinit with a dentry, before these inodes could
1318                          * be used again by userspace.
1319                          */
1320                         goto out_unlock;
1321                 }
1322
1323                 len = INITCONTEXTLEN;
1324                 context = kmalloc(len+1, GFP_NOFS);
1325                 if (!context) {
1326                         rc = -ENOMEM;
1327                         dput(dentry);
1328                         goto out_unlock;
1329                 }
1330                 context[len] = '\0';
1331                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1332                                            context, len);
1333                 if (rc == -ERANGE) {
1334                         kfree(context);
1335
1336                         /* Need a larger buffer.  Query for the right size. */
1337                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1338                                                    NULL, 0);
1339                         if (rc < 0) {
1340                                 dput(dentry);
1341                                 goto out_unlock;
1342                         }
1343                         len = rc;
1344                         context = kmalloc(len+1, GFP_NOFS);
1345                         if (!context) {
1346                                 rc = -ENOMEM;
1347                                 dput(dentry);
1348                                 goto out_unlock;
1349                         }
1350                         context[len] = '\0';
1351                         rc = inode->i_op->getxattr(dentry,
1352                                                    XATTR_NAME_SELINUX,
1353                                                    context, len);
1354                 }
1355                 dput(dentry);
1356                 if (rc < 0) {
1357                         if (rc != -ENODATA) {
1358                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1359                                        "%d for dev=%s ino=%ld\n", __func__,
1360                                        -rc, inode->i_sb->s_id, inode->i_ino);
1361                                 kfree(context);
1362                                 goto out_unlock;
1363                         }
1364                         /* Map ENODATA to the default file SID */
1365                         sid = sbsec->def_sid;
1366                         rc = 0;
1367                 } else {
1368                         rc = security_context_to_sid_default(context, rc, &sid,
1369                                                              sbsec->def_sid,
1370                                                              GFP_NOFS);
1371                         if (rc) {
1372                                 char *dev = inode->i_sb->s_id;
1373                                 unsigned long ino = inode->i_ino;
1374
1375                                 if (rc == -EINVAL) {
1376                                         if (printk_ratelimit())
1377                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1378                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1379                                                         "filesystem in question.\n", ino, dev, context);
1380                                 } else {
1381                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1382                                                "returned %d for dev=%s ino=%ld\n",
1383                                                __func__, context, -rc, dev, ino);
1384                                 }
1385                                 kfree(context);
1386                                 /* Leave with the unlabeled SID */
1387                                 rc = 0;
1388                                 break;
1389                         }
1390                 }
1391                 kfree(context);
1392                 isec->sid = sid;
1393                 break;
1394         case SECURITY_FS_USE_TASK:
1395                 isec->sid = isec->task_sid;
1396                 break;
1397         case SECURITY_FS_USE_TRANS:
1398                 /* Default to the fs SID. */
1399                 isec->sid = sbsec->sid;
1400
1401                 /* Try to obtain a transition SID. */
1402                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1403                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1404                                              isec->sclass, NULL, &sid);
1405                 if (rc)
1406                         goto out_unlock;
1407                 isec->sid = sid;
1408                 break;
1409         case SECURITY_FS_USE_MNTPOINT:
1410                 isec->sid = sbsec->mntpoint_sid;
1411                 break;
1412         default:
1413                 /* Default to the fs superblock SID. */
1414                 isec->sid = sbsec->sid;
1415
1416                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1417                         /* We must have a dentry to determine the label on
1418                          * procfs inodes */
1419                         if (opt_dentry)
1420                                 /* Called from d_instantiate or
1421                                  * d_splice_alias. */
1422                                 dentry = dget(opt_dentry);
1423                         else
1424                                 /* Called from selinux_complete_init, try to
1425                                  * find a dentry. */
1426                                 dentry = d_find_alias(inode);
1427                         /*
1428                          * This can be hit on boot when a file is accessed
1429                          * before the policy is loaded.  When we load policy we
1430                          * may find inodes that have no dentry on the
1431                          * sbsec->isec_head list.  No reason to complain as
1432                          * these will get fixed up the next time we go through
1433                          * inode_doinit() with a dentry, before these inodes
1434                          * could be used again by userspace.
1435                          */
1436                         if (!dentry)
1437                                 goto out_unlock;
1438                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1439                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1440                         dput(dentry);
1441                         if (rc)
1442                                 goto out_unlock;
1443                         isec->sid = sid;
1444                 }
1445                 break;
1446         }
1447
1448         isec->initialized = 1;
1449
1450 out_unlock:
1451         mutex_unlock(&isec->lock);
1452 out:
1453         if (isec->sclass == SECCLASS_FILE)
1454                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1455         return rc;
1456 }
1457
1458 /* Convert a Linux signal to an access vector. */
1459 static inline u32 signal_to_av(int sig)
1460 {
1461         u32 perm = 0;
1462
1463         switch (sig) {
1464         case SIGCHLD:
1465                 /* Commonly granted from child to parent. */
1466                 perm = PROCESS__SIGCHLD;
1467                 break;
1468         case SIGKILL:
1469                 /* Cannot be caught or ignored */
1470                 perm = PROCESS__SIGKILL;
1471                 break;
1472         case SIGSTOP:
1473                 /* Cannot be caught or ignored */
1474                 perm = PROCESS__SIGSTOP;
1475                 break;
1476         default:
1477                 /* All other signals. */
1478                 perm = PROCESS__SIGNAL;
1479                 break;
1480         }
1481
1482         return perm;
1483 }
1484
1485 /*
1486  * Check permission between a pair of credentials
1487  * fork check, ptrace check, etc.
1488  */
1489 static int cred_has_perm(const struct cred *actor,
1490                          const struct cred *target,
1491                          u32 perms)
1492 {
1493         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1494
1495         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1496 }
1497
1498 /*
1499  * Check permission between a pair of tasks, e.g. signal checks,
1500  * fork check, ptrace check, etc.
1501  * tsk1 is the actor and tsk2 is the target
1502  * - this uses the default subjective creds of tsk1
1503  */
1504 static int task_has_perm(const struct task_struct *tsk1,
1505                          const struct task_struct *tsk2,
1506                          u32 perms)
1507 {
1508         const struct task_security_struct *__tsec1, *__tsec2;
1509         u32 sid1, sid2;
1510
1511         rcu_read_lock();
1512         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1513         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1514         rcu_read_unlock();
1515         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1516 }
1517
1518 /*
1519  * Check permission between current and another task, e.g. signal checks,
1520  * fork check, ptrace check, etc.
1521  * current is the actor and tsk2 is the target
1522  * - this uses current's subjective creds
1523  */
1524 static int current_has_perm(const struct task_struct *tsk,
1525                             u32 perms)
1526 {
1527         u32 sid, tsid;
1528
1529         sid = current_sid();
1530         tsid = task_sid(tsk);
1531         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1532 }
1533
1534 #if CAP_LAST_CAP > 63
1535 #error Fix SELinux to handle capabilities > 63.
1536 #endif
1537
1538 /* Check whether a task is allowed to use a capability. */
1539 static int cred_has_capability(const struct cred *cred,
1540                                int cap, int audit)
1541 {
1542         struct common_audit_data ad;
1543         struct av_decision avd;
1544         u16 sclass;
1545         u32 sid = cred_sid(cred);
1546         u32 av = CAP_TO_MASK(cap);
1547         int rc;
1548
1549         ad.type = LSM_AUDIT_DATA_CAP;
1550         ad.u.cap = cap;
1551
1552         switch (CAP_TO_INDEX(cap)) {
1553         case 0:
1554                 sclass = SECCLASS_CAPABILITY;
1555                 break;
1556         case 1:
1557                 sclass = SECCLASS_CAPABILITY2;
1558                 break;
1559         default:
1560                 printk(KERN_ERR
1561                        "SELinux:  out of range capability %d\n", cap);
1562                 BUG();
1563                 return -EINVAL;
1564         }
1565
1566         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1567         if (audit == SECURITY_CAP_AUDIT) {
1568                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad);
1569                 if (rc2)
1570                         return rc2;
1571         }
1572         return rc;
1573 }
1574
1575 /* Check whether a task is allowed to use a system operation. */
1576 static int task_has_system(struct task_struct *tsk,
1577                            u32 perms)
1578 {
1579         u32 sid = task_sid(tsk);
1580
1581         return avc_has_perm(sid, SECINITSID_KERNEL,
1582                             SECCLASS_SYSTEM, perms, NULL);
1583 }
1584
1585 /* Check whether a task has a particular permission to an inode.
1586    The 'adp' parameter is optional and allows other audit
1587    data to be passed (e.g. the dentry). */
1588 static int inode_has_perm(const struct cred *cred,
1589                           struct inode *inode,
1590                           u32 perms,
1591                           struct common_audit_data *adp)
1592 {
1593         struct inode_security_struct *isec;
1594         u32 sid;
1595
1596         validate_creds(cred);
1597
1598         if (unlikely(IS_PRIVATE(inode)))
1599                 return 0;
1600
1601         sid = cred_sid(cred);
1602         isec = inode->i_security;
1603
1604         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1605 }
1606
1607 /* Same as inode_has_perm, but pass explicit audit data containing
1608    the dentry to help the auditing code to more easily generate the
1609    pathname if needed. */
1610 static inline int dentry_has_perm(const struct cred *cred,
1611                                   struct dentry *dentry,
1612                                   u32 av)
1613 {
1614         struct inode *inode = dentry->d_inode;
1615         struct common_audit_data ad;
1616
1617         ad.type = LSM_AUDIT_DATA_DENTRY;
1618         ad.u.dentry = dentry;
1619         return inode_has_perm(cred, inode, av, &ad);
1620 }
1621
1622 /* Same as inode_has_perm, but pass explicit audit data containing
1623    the path to help the auditing code to more easily generate the
1624    pathname if needed. */
1625 static inline int path_has_perm(const struct cred *cred,
1626                                 struct path *path,
1627                                 u32 av)
1628 {
1629         struct inode *inode = path->dentry->d_inode;
1630         struct common_audit_data ad;
1631
1632         ad.type = LSM_AUDIT_DATA_PATH;
1633         ad.u.path = *path;
1634         return inode_has_perm(cred, inode, av, &ad);
1635 }
1636
1637 /* Same as path_has_perm, but uses the inode from the file struct. */
1638 static inline int file_path_has_perm(const struct cred *cred,
1639                                      struct file *file,
1640                                      u32 av)
1641 {
1642         struct common_audit_data ad;
1643
1644         ad.type = LSM_AUDIT_DATA_PATH;
1645         ad.u.path = file->f_path;
1646         return inode_has_perm(cred, file_inode(file), av, &ad);
1647 }
1648
1649 /* Check whether a task can use an open file descriptor to
1650    access an inode in a given way.  Check access to the
1651    descriptor itself, and then use dentry_has_perm to
1652    check a particular permission to the file.
1653    Access to the descriptor is implicitly granted if it
1654    has the same SID as the process.  If av is zero, then
1655    access to the file is not checked, e.g. for cases
1656    where only the descriptor is affected like seek. */
1657 static int file_has_perm(const struct cred *cred,
1658                          struct file *file,
1659                          u32 av)
1660 {
1661         struct file_security_struct *fsec = file->f_security;
1662         struct inode *inode = file_inode(file);
1663         struct common_audit_data ad;
1664         u32 sid = cred_sid(cred);
1665         int rc;
1666
1667         ad.type = LSM_AUDIT_DATA_PATH;
1668         ad.u.path = file->f_path;
1669
1670         if (sid != fsec->sid) {
1671                 rc = avc_has_perm(sid, fsec->sid,
1672                                   SECCLASS_FD,
1673                                   FD__USE,
1674                                   &ad);
1675                 if (rc)
1676                         goto out;
1677         }
1678
1679         /* av is zero if only checking access to the descriptor. */
1680         rc = 0;
1681         if (av)
1682                 rc = inode_has_perm(cred, inode, av, &ad);
1683
1684 out:
1685         return rc;
1686 }
1687
1688 /* Check whether a task can create a file. */
1689 static int may_create(struct inode *dir,
1690                       struct dentry *dentry,
1691                       u16 tclass)
1692 {
1693         const struct task_security_struct *tsec = current_security();
1694         struct inode_security_struct *dsec;
1695         struct superblock_security_struct *sbsec;
1696         u32 sid, newsid;
1697         struct common_audit_data ad;
1698         int rc;
1699
1700         dsec = dir->i_security;
1701         sbsec = dir->i_sb->s_security;
1702
1703         sid = tsec->sid;
1704         newsid = tsec->create_sid;
1705
1706         ad.type = LSM_AUDIT_DATA_DENTRY;
1707         ad.u.dentry = dentry;
1708
1709         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1710                           DIR__ADD_NAME | DIR__SEARCH,
1711                           &ad);
1712         if (rc)
1713                 return rc;
1714
1715         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1716                 rc = security_transition_sid(sid, dsec->sid, tclass,
1717                                              &dentry->d_name, &newsid);
1718                 if (rc)
1719                         return rc;
1720         }
1721
1722         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1723         if (rc)
1724                 return rc;
1725
1726         return avc_has_perm(newsid, sbsec->sid,
1727                             SECCLASS_FILESYSTEM,
1728                             FILESYSTEM__ASSOCIATE, &ad);
1729 }
1730
1731 /* Check whether a task can create a key. */
1732 static int may_create_key(u32 ksid,
1733                           struct task_struct *ctx)
1734 {
1735         u32 sid = task_sid(ctx);
1736
1737         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1738 }
1739
1740 #define MAY_LINK        0
1741 #define MAY_UNLINK      1
1742 #define MAY_RMDIR       2
1743
1744 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1745 static int may_link(struct inode *dir,
1746                     struct dentry *dentry,
1747                     int kind)
1748
1749 {
1750         struct inode_security_struct *dsec, *isec;
1751         struct common_audit_data ad;
1752         u32 sid = current_sid();
1753         u32 av;
1754         int rc;
1755
1756         dsec = dir->i_security;
1757         isec = dentry->d_inode->i_security;
1758
1759         ad.type = LSM_AUDIT_DATA_DENTRY;
1760         ad.u.dentry = dentry;
1761
1762         av = DIR__SEARCH;
1763         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1764         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1765         if (rc)
1766                 return rc;
1767
1768         switch (kind) {
1769         case MAY_LINK:
1770                 av = FILE__LINK;
1771                 break;
1772         case MAY_UNLINK:
1773                 av = FILE__UNLINK;
1774                 break;
1775         case MAY_RMDIR:
1776                 av = DIR__RMDIR;
1777                 break;
1778         default:
1779                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1780                         __func__, kind);
1781                 return 0;
1782         }
1783
1784         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1785         return rc;
1786 }
1787
1788 static inline int may_rename(struct inode *old_dir,
1789                              struct dentry *old_dentry,
1790                              struct inode *new_dir,
1791                              struct dentry *new_dentry)
1792 {
1793         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1794         struct common_audit_data ad;
1795         u32 sid = current_sid();
1796         u32 av;
1797         int old_is_dir, new_is_dir;
1798         int rc;
1799
1800         old_dsec = old_dir->i_security;
1801         old_isec = old_dentry->d_inode->i_security;
1802         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1803         new_dsec = new_dir->i_security;
1804
1805         ad.type = LSM_AUDIT_DATA_DENTRY;
1806
1807         ad.u.dentry = old_dentry;
1808         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1809                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1810         if (rc)
1811                 return rc;
1812         rc = avc_has_perm(sid, old_isec->sid,
1813                           old_isec->sclass, FILE__RENAME, &ad);
1814         if (rc)
1815                 return rc;
1816         if (old_is_dir && new_dir != old_dir) {
1817                 rc = avc_has_perm(sid, old_isec->sid,
1818                                   old_isec->sclass, DIR__REPARENT, &ad);
1819                 if (rc)
1820                         return rc;
1821         }
1822
1823         ad.u.dentry = new_dentry;
1824         av = DIR__ADD_NAME | DIR__SEARCH;
1825         if (d_is_positive(new_dentry))
1826                 av |= DIR__REMOVE_NAME;
1827         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1828         if (rc)
1829                 return rc;
1830         if (d_is_positive(new_dentry)) {
1831                 new_isec = new_dentry->d_inode->i_security;
1832                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1833                 rc = avc_has_perm(sid, new_isec->sid,
1834                                   new_isec->sclass,
1835                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1836                 if (rc)
1837                         return rc;
1838         }
1839
1840         return 0;
1841 }
1842
1843 /* Check whether a task can perform a filesystem operation. */
1844 static int superblock_has_perm(const struct cred *cred,
1845                                struct super_block *sb,
1846                                u32 perms,
1847                                struct common_audit_data *ad)
1848 {
1849         struct superblock_security_struct *sbsec;
1850         u32 sid = cred_sid(cred);
1851
1852         sbsec = sb->s_security;
1853         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1854 }
1855
1856 /* Convert a Linux mode and permission mask to an access vector. */
1857 static inline u32 file_mask_to_av(int mode, int mask)
1858 {
1859         u32 av = 0;
1860
1861         if (!S_ISDIR(mode)) {
1862                 if (mask & MAY_EXEC)
1863                         av |= FILE__EXECUTE;
1864                 if (mask & MAY_READ)
1865                         av |= FILE__READ;
1866
1867                 if (mask & MAY_APPEND)
1868                         av |= FILE__APPEND;
1869                 else if (mask & MAY_WRITE)
1870                         av |= FILE__WRITE;
1871
1872         } else {
1873                 if (mask & MAY_EXEC)
1874                         av |= DIR__SEARCH;
1875                 if (mask & MAY_WRITE)
1876                         av |= DIR__WRITE;
1877                 if (mask & MAY_READ)
1878                         av |= DIR__READ;
1879         }
1880
1881         return av;
1882 }
1883
1884 /* Convert a Linux file to an access vector. */
1885 static inline u32 file_to_av(struct file *file)
1886 {
1887         u32 av = 0;
1888
1889         if (file->f_mode & FMODE_READ)
1890                 av |= FILE__READ;
1891         if (file->f_mode & FMODE_WRITE) {
1892                 if (file->f_flags & O_APPEND)
1893                         av |= FILE__APPEND;
1894                 else
1895                         av |= FILE__WRITE;
1896         }
1897         if (!av) {
1898                 /*
1899                  * Special file opened with flags 3 for ioctl-only use.
1900                  */
1901                 av = FILE__IOCTL;
1902         }
1903
1904         return av;
1905 }
1906
1907 /*
1908  * Convert a file to an access vector and include the correct open
1909  * open permission.
1910  */
1911 static inline u32 open_file_to_av(struct file *file)
1912 {
1913         u32 av = file_to_av(file);
1914
1915         if (selinux_policycap_openperm)
1916                 av |= FILE__OPEN;
1917
1918         return av;
1919 }
1920
1921 /* Hook functions begin here. */
1922
1923 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1924 {
1925         u32 mysid = current_sid();
1926         u32 mgrsid = task_sid(mgr);
1927
1928         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1929                             BINDER__SET_CONTEXT_MGR, NULL);
1930 }
1931
1932 static int selinux_binder_transaction(struct task_struct *from,
1933                                       struct task_struct *to)
1934 {
1935         u32 mysid = current_sid();
1936         u32 fromsid = task_sid(from);
1937         u32 tosid = task_sid(to);
1938         int rc;
1939
1940         if (mysid != fromsid) {
1941                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1942                                   BINDER__IMPERSONATE, NULL);
1943                 if (rc)
1944                         return rc;
1945         }
1946
1947         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1948                             NULL);
1949 }
1950
1951 static int selinux_binder_transfer_binder(struct task_struct *from,
1952                                           struct task_struct *to)
1953 {
1954         u32 fromsid = task_sid(from);
1955         u32 tosid = task_sid(to);
1956
1957         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1958                             NULL);
1959 }
1960
1961 static int selinux_binder_transfer_file(struct task_struct *from,
1962                                         struct task_struct *to,
1963                                         struct file *file)
1964 {
1965         u32 sid = task_sid(to);
1966         struct file_security_struct *fsec = file->f_security;
1967         struct inode *inode = file->f_path.dentry->d_inode;
1968         struct inode_security_struct *isec = inode->i_security;
1969         struct common_audit_data ad;
1970         int rc;
1971
1972         ad.type = LSM_AUDIT_DATA_PATH;
1973         ad.u.path = file->f_path;
1974
1975         if (sid != fsec->sid) {
1976                 rc = avc_has_perm(sid, fsec->sid,
1977                                   SECCLASS_FD,
1978                                   FD__USE,
1979                                   &ad);
1980                 if (rc)
1981                         return rc;
1982         }
1983
1984         if (unlikely(IS_PRIVATE(inode)))
1985                 return 0;
1986
1987         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1988                             &ad);
1989 }
1990
1991 static int selinux_ptrace_access_check(struct task_struct *child,
1992                                      unsigned int mode)
1993 {
1994         int rc;
1995
1996         rc = cap_ptrace_access_check(child, mode);
1997         if (rc)
1998                 return rc;
1999
2000         if (mode & PTRACE_MODE_READ) {
2001                 u32 sid = current_sid();
2002                 u32 csid = task_sid(child);
2003                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2004         }
2005
2006         return current_has_perm(child, PROCESS__PTRACE);
2007 }
2008
2009 static int selinux_ptrace_traceme(struct task_struct *parent)
2010 {
2011         int rc;
2012
2013         rc = cap_ptrace_traceme(parent);
2014         if (rc)
2015                 return rc;
2016
2017         return task_has_perm(parent, current, PROCESS__PTRACE);
2018 }
2019
2020 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2021                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2022 {
2023         int error;
2024
2025         error = current_has_perm(target, PROCESS__GETCAP);
2026         if (error)
2027                 return error;
2028
2029         return cap_capget(target, effective, inheritable, permitted);
2030 }
2031
2032 static int selinux_capset(struct cred *new, const struct cred *old,
2033                           const kernel_cap_t *effective,
2034                           const kernel_cap_t *inheritable,
2035                           const kernel_cap_t *permitted)
2036 {
2037         int error;
2038
2039         error = cap_capset(new, old,
2040                                       effective, inheritable, permitted);
2041         if (error)
2042                 return error;
2043
2044         return cred_has_perm(old, new, PROCESS__SETCAP);
2045 }
2046
2047 /*
2048  * (This comment used to live with the selinux_task_setuid hook,
2049  * which was removed).
2050  *
2051  * Since setuid only affects the current process, and since the SELinux
2052  * controls are not based on the Linux identity attributes, SELinux does not
2053  * need to control this operation.  However, SELinux does control the use of
2054  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2055  */
2056
2057 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2058                            int cap, int audit)
2059 {
2060         int rc;
2061
2062         rc = cap_capable(cred, ns, cap, audit);
2063         if (rc)
2064                 return rc;
2065
2066         return cred_has_capability(cred, cap, audit);
2067 }
2068
2069 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2070 {
2071         const struct cred *cred = current_cred();
2072         int rc = 0;
2073
2074         if (!sb)
2075                 return 0;
2076
2077         switch (cmds) {
2078         case Q_SYNC:
2079         case Q_QUOTAON:
2080         case Q_QUOTAOFF:
2081         case Q_SETINFO:
2082         case Q_SETQUOTA:
2083                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2084                 break;
2085         case Q_GETFMT:
2086         case Q_GETINFO:
2087         case Q_GETQUOTA:
2088                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2089                 break;
2090         default:
2091                 rc = 0;  /* let the kernel handle invalid cmds */
2092                 break;
2093         }
2094         return rc;
2095 }
2096
2097 static int selinux_quota_on(struct dentry *dentry)
2098 {
2099         const struct cred *cred = current_cred();
2100
2101         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2102 }
2103
2104 static int selinux_syslog(int type)
2105 {
2106         int rc;
2107
2108         switch (type) {
2109         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2110         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2111                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2112                 break;
2113         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2114         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2115         /* Set level of messages printed to console */
2116         case SYSLOG_ACTION_CONSOLE_LEVEL:
2117                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2118                 break;
2119         case SYSLOG_ACTION_CLOSE:       /* Close log */
2120         case SYSLOG_ACTION_OPEN:        /* Open log */
2121         case SYSLOG_ACTION_READ:        /* Read from log */
2122         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2123         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2124         default:
2125                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2126                 break;
2127         }
2128         return rc;
2129 }
2130
2131 /*
2132  * Check that a process has enough memory to allocate a new virtual
2133  * mapping. 0 means there is enough memory for the allocation to
2134  * succeed and -ENOMEM implies there is not.
2135  *
2136  * Do not audit the selinux permission check, as this is applied to all
2137  * processes that allocate mappings.
2138  */
2139 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2140 {
2141         int rc, cap_sys_admin = 0;
2142
2143         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2144                              SECURITY_CAP_NOAUDIT);
2145         if (rc == 0)
2146                 cap_sys_admin = 1;
2147
2148         return __vm_enough_memory(mm, pages, cap_sys_admin);
2149 }
2150
2151 /* binprm security operations */
2152
2153 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2154                             const struct task_security_struct *old_tsec,
2155                             const struct task_security_struct *new_tsec)
2156 {
2157         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2158         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2159         int rc;
2160
2161         if (!nnp && !nosuid)
2162                 return 0; /* neither NNP nor nosuid */
2163
2164         if (new_tsec->sid == old_tsec->sid)
2165                 return 0; /* No change in credentials */
2166
2167         /*
2168          * The only transitions we permit under NNP or nosuid
2169          * are transitions to bounded SIDs, i.e. SIDs that are
2170          * guaranteed to only be allowed a subset of the permissions
2171          * of the current SID.
2172          */
2173         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2174         if (rc) {
2175                 /*
2176                  * On failure, preserve the errno values for NNP vs nosuid.
2177                  * NNP:  Operation not permitted for caller.
2178                  * nosuid:  Permission denied to file.
2179                  */
2180                 if (nnp)
2181                         return -EPERM;
2182                 else
2183                         return -EACCES;
2184         }
2185         return 0;
2186 }
2187
2188 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2189 {
2190         const struct task_security_struct *old_tsec;
2191         struct task_security_struct *new_tsec;
2192         struct inode_security_struct *isec;
2193         struct common_audit_data ad;
2194         struct inode *inode = file_inode(bprm->file);
2195         int rc;
2196
2197         rc = cap_bprm_set_creds(bprm);
2198         if (rc)
2199                 return rc;
2200
2201         /* SELinux context only depends on initial program or script and not
2202          * the script interpreter */
2203         if (bprm->cred_prepared)
2204                 return 0;
2205
2206         old_tsec = current_security();
2207         new_tsec = bprm->cred->security;
2208         isec = inode->i_security;
2209
2210         /* Default to the current task SID. */
2211         new_tsec->sid = old_tsec->sid;
2212         new_tsec->osid = old_tsec->sid;
2213
2214         /* Reset fs, key, and sock SIDs on execve. */
2215         new_tsec->create_sid = 0;
2216         new_tsec->keycreate_sid = 0;
2217         new_tsec->sockcreate_sid = 0;
2218
2219         if (old_tsec->exec_sid) {
2220                 new_tsec->sid = old_tsec->exec_sid;
2221                 /* Reset exec SID on execve. */
2222                 new_tsec->exec_sid = 0;
2223
2224                 /* Fail on NNP or nosuid if not an allowed transition. */
2225                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2226                 if (rc)
2227                         return rc;
2228         } else {
2229                 /* Check for a default transition on this program. */
2230                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2231                                              SECCLASS_PROCESS, NULL,
2232                                              &new_tsec->sid);
2233                 if (rc)
2234                         return rc;
2235
2236                 /*
2237                  * Fallback to old SID on NNP or nosuid if not an allowed
2238                  * transition.
2239                  */
2240                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2241                 if (rc)
2242                         new_tsec->sid = old_tsec->sid;
2243         }
2244
2245         ad.type = LSM_AUDIT_DATA_PATH;
2246         ad.u.path = bprm->file->f_path;
2247
2248         if (new_tsec->sid == old_tsec->sid) {
2249                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2250                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2251                 if (rc)
2252                         return rc;
2253         } else {
2254                 /* Check permissions for the transition. */
2255                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2256                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2257                 if (rc)
2258                         return rc;
2259
2260                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2261                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2262                 if (rc)
2263                         return rc;
2264
2265                 /* Check for shared state */
2266                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2267                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268                                           SECCLASS_PROCESS, PROCESS__SHARE,
2269                                           NULL);
2270                         if (rc)
2271                                 return -EPERM;
2272                 }
2273
2274                 /* Make sure that anyone attempting to ptrace over a task that
2275                  * changes its SID has the appropriate permit */
2276                 if (bprm->unsafe &
2277                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2278                         struct task_struct *tracer;
2279                         struct task_security_struct *sec;
2280                         u32 ptsid = 0;
2281
2282                         rcu_read_lock();
2283                         tracer = ptrace_parent(current);
2284                         if (likely(tracer != NULL)) {
2285                                 sec = __task_cred(tracer)->security;
2286                                 ptsid = sec->sid;
2287                         }
2288                         rcu_read_unlock();
2289
2290                         if (ptsid != 0) {
2291                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2292                                                   SECCLASS_PROCESS,
2293                                                   PROCESS__PTRACE, NULL);
2294                                 if (rc)
2295                                         return -EPERM;
2296                         }
2297                 }
2298
2299                 /* Clear any possibly unsafe personality bits on exec: */
2300                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2301         }
2302
2303         return 0;
2304 }
2305
2306 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2307 {
2308         const struct task_security_struct *tsec = current_security();
2309         u32 sid, osid;
2310         int atsecure = 0;
2311
2312         sid = tsec->sid;
2313         osid = tsec->osid;
2314
2315         if (osid != sid) {
2316                 /* Enable secure mode for SIDs transitions unless
2317                    the noatsecure permission is granted between
2318                    the two SIDs, i.e. ahp returns 0. */
2319                 atsecure = avc_has_perm(osid, sid,
2320                                         SECCLASS_PROCESS,
2321                                         PROCESS__NOATSECURE, NULL);
2322         }
2323
2324         return (atsecure || cap_bprm_secureexec(bprm));
2325 }
2326
2327 static int match_file(const void *p, struct file *file, unsigned fd)
2328 {
2329         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2330 }
2331
2332 /* Derived from fs/exec.c:flush_old_files. */
2333 static inline void flush_unauthorized_files(const struct cred *cred,
2334                                             struct files_struct *files)
2335 {
2336         struct file *file, *devnull = NULL;
2337         struct tty_struct *tty;
2338         int drop_tty = 0;
2339         unsigned n;
2340
2341         tty = get_current_tty();
2342         if (tty) {
2343                 spin_lock(&tty_files_lock);
2344                 if (!list_empty(&tty->tty_files)) {
2345                         struct tty_file_private *file_priv;
2346
2347                         /* Revalidate access to controlling tty.
2348                            Use file_path_has_perm on the tty path directly
2349                            rather than using file_has_perm, as this particular
2350                            open file may belong to another process and we are
2351                            only interested in the inode-based check here. */
2352                         file_priv = list_first_entry(&tty->tty_files,
2353                                                 struct tty_file_private, list);
2354                         file = file_priv->file;
2355                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2356                                 drop_tty = 1;
2357                 }
2358                 spin_unlock(&tty_files_lock);
2359                 tty_kref_put(tty);
2360         }
2361         /* Reset controlling tty. */
2362         if (drop_tty)
2363                 no_tty();
2364
2365         /* Revalidate access to inherited open files. */
2366         n = iterate_fd(files, 0, match_file, cred);
2367         if (!n) /* none found? */
2368                 return;
2369
2370         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2371         if (IS_ERR(devnull))
2372                 devnull = NULL;
2373         /* replace all the matching ones with this */
2374         do {
2375                 replace_fd(n - 1, devnull, 0);
2376         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2377         if (devnull)
2378                 fput(devnull);
2379 }
2380
2381 /*
2382  * Prepare a process for imminent new credential changes due to exec
2383  */
2384 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2385 {
2386         struct task_security_struct *new_tsec;
2387         struct rlimit *rlim, *initrlim;
2388         int rc, i;
2389
2390         new_tsec = bprm->cred->security;
2391         if (new_tsec->sid == new_tsec->osid)
2392                 return;
2393
2394         /* Close files for which the new task SID is not authorized. */
2395         flush_unauthorized_files(bprm->cred, current->files);
2396
2397         /* Always clear parent death signal on SID transitions. */
2398         current->pdeath_signal = 0;
2399
2400         /* Check whether the new SID can inherit resource limits from the old
2401          * SID.  If not, reset all soft limits to the lower of the current
2402          * task's hard limit and the init task's soft limit.
2403          *
2404          * Note that the setting of hard limits (even to lower them) can be
2405          * controlled by the setrlimit check.  The inclusion of the init task's
2406          * soft limit into the computation is to avoid resetting soft limits
2407          * higher than the default soft limit for cases where the default is
2408          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2409          */
2410         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2411                           PROCESS__RLIMITINH, NULL);
2412         if (rc) {
2413                 /* protect against do_prlimit() */
2414                 task_lock(current);
2415                 for (i = 0; i < RLIM_NLIMITS; i++) {
2416                         rlim = current->signal->rlim + i;
2417                         initrlim = init_task.signal->rlim + i;
2418                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2419                 }
2420                 task_unlock(current);
2421                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2422         }
2423 }
2424
2425 /*
2426  * Clean up the process immediately after the installation of new credentials
2427  * due to exec
2428  */
2429 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2430 {
2431         const struct task_security_struct *tsec = current_security();
2432         struct itimerval itimer;
2433         u32 osid, sid;
2434         int rc, i;
2435
2436         osid = tsec->osid;
2437         sid = tsec->sid;
2438
2439         if (sid == osid)
2440                 return;
2441
2442         /* Check whether the new SID can inherit signal state from the old SID.
2443          * If not, clear itimers to avoid subsequent signal generation and
2444          * flush and unblock signals.
2445          *
2446          * This must occur _after_ the task SID has been updated so that any
2447          * kill done after the flush will be checked against the new SID.
2448          */
2449         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2450         if (rc) {
2451                 memset(&itimer, 0, sizeof itimer);
2452                 for (i = 0; i < 3; i++)
2453                         do_setitimer(i, &itimer, NULL);
2454                 spin_lock_irq(&current->sighand->siglock);
2455                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2456                         __flush_signals(current);
2457                         flush_signal_handlers(current, 1);
2458                         sigemptyset(&current->blocked);
2459                 }
2460                 spin_unlock_irq(&current->sighand->siglock);
2461         }
2462
2463         /* Wake up the parent if it is waiting so that it can recheck
2464          * wait permission to the new task SID. */
2465         read_lock(&tasklist_lock);
2466         __wake_up_parent(current, current->real_parent);
2467         read_unlock(&tasklist_lock);
2468 }
2469
2470 /* superblock security operations */
2471
2472 static int selinux_sb_alloc_security(struct super_block *sb)
2473 {
2474         return superblock_alloc_security(sb);
2475 }
2476
2477 static void selinux_sb_free_security(struct super_block *sb)
2478 {
2479         superblock_free_security(sb);
2480 }
2481
2482 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2483 {
2484         if (plen > olen)
2485                 return 0;
2486
2487         return !memcmp(prefix, option, plen);
2488 }
2489
2490 static inline int selinux_option(char *option, int len)
2491 {
2492         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2493                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2494                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2495                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2496                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2497 }
2498
2499 static inline void take_option(char **to, char *from, int *first, int len)
2500 {
2501         if (!*first) {
2502                 **to = ',';
2503                 *to += 1;
2504         } else
2505                 *first = 0;
2506         memcpy(*to, from, len);
2507         *to += len;
2508 }
2509
2510 static inline void take_selinux_option(char **to, char *from, int *first,
2511                                        int len)
2512 {
2513         int current_size = 0;
2514
2515         if (!*first) {
2516                 **to = '|';
2517                 *to += 1;
2518         } else
2519                 *first = 0;
2520
2521         while (current_size < len) {
2522                 if (*from != '"') {
2523                         **to = *from;
2524                         *to += 1;
2525                 }
2526                 from += 1;
2527                 current_size += 1;
2528         }
2529 }
2530
2531 static int selinux_sb_copy_data(char *orig, char *copy)
2532 {
2533         int fnosec, fsec, rc = 0;
2534         char *in_save, *in_curr, *in_end;
2535         char *sec_curr, *nosec_save, *nosec;
2536         int open_quote = 0;
2537
2538         in_curr = orig;
2539         sec_curr = copy;
2540
2541         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2542         if (!nosec) {
2543                 rc = -ENOMEM;
2544                 goto out;
2545         }
2546
2547         nosec_save = nosec;
2548         fnosec = fsec = 1;
2549         in_save = in_end = orig;
2550
2551         do {
2552                 if (*in_end == '"')
2553                         open_quote = !open_quote;
2554                 if ((*in_end == ',' && open_quote == 0) ||
2555                                 *in_end == '\0') {
2556                         int len = in_end - in_curr;
2557
2558                         if (selinux_option(in_curr, len))
2559                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2560                         else
2561                                 take_option(&nosec, in_curr, &fnosec, len);
2562
2563                         in_curr = in_end + 1;
2564                 }
2565         } while (*in_end++);
2566
2567         strcpy(in_save, nosec_save);
2568         free_page((unsigned long)nosec_save);
2569 out:
2570         return rc;
2571 }
2572
2573 static int selinux_sb_remount(struct super_block *sb, void *data)
2574 {
2575         int rc, i, *flags;
2576         struct security_mnt_opts opts;
2577         char *secdata, **mount_options;
2578         struct superblock_security_struct *sbsec = sb->s_security;
2579
2580         if (!(sbsec->flags & SE_SBINITIALIZED))
2581                 return 0;
2582
2583         if (!data)
2584                 return 0;
2585
2586         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2587                 return 0;
2588
2589         security_init_mnt_opts(&opts);
2590         secdata = alloc_secdata();
2591         if (!secdata)
2592                 return -ENOMEM;
2593         rc = selinux_sb_copy_data(data, secdata);
2594         if (rc)
2595                 goto out_free_secdata;
2596
2597         rc = selinux_parse_opts_str(secdata, &opts);
2598         if (rc)
2599                 goto out_free_secdata;
2600
2601         mount_options = opts.mnt_opts;
2602         flags = opts.mnt_opts_flags;
2603
2604         for (i = 0; i < opts.num_mnt_opts; i++) {
2605                 u32 sid;
2606                 size_t len;
2607
2608                 if (flags[i] == SBLABEL_MNT)
2609                         continue;
2610                 len = strlen(mount_options[i]);
2611                 rc = security_context_to_sid(mount_options[i], len, &sid,
2612                                              GFP_KERNEL);
2613                 if (rc) {
2614                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2615                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2616                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2617                         goto out_free_opts;
2618                 }
2619                 rc = -EINVAL;
2620                 switch (flags[i]) {
2621                 case FSCONTEXT_MNT:
2622                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2623                                 goto out_bad_option;
2624                         break;
2625                 case CONTEXT_MNT:
2626                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2627                                 goto out_bad_option;
2628                         break;
2629                 case ROOTCONTEXT_MNT: {
2630                         struct inode_security_struct *root_isec;
2631                         root_isec = sb->s_root->d_inode->i_security;
2632
2633                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2634                                 goto out_bad_option;
2635                         break;
2636                 }
2637                 case DEFCONTEXT_MNT:
2638                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2639                                 goto out_bad_option;
2640                         break;
2641                 default:
2642                         goto out_free_opts;
2643                 }
2644         }
2645
2646         rc = 0;
2647 out_free_opts:
2648         security_free_mnt_opts(&opts);
2649 out_free_secdata:
2650         free_secdata(secdata);
2651         return rc;
2652 out_bad_option:
2653         printk(KERN_WARNING "SELinux: unable to change security options "
2654                "during remount (dev %s, type=%s)\n", sb->s_id,
2655                sb->s_type->name);
2656         goto out_free_opts;
2657 }
2658
2659 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2660 {
2661         const struct cred *cred = current_cred();
2662         struct common_audit_data ad;
2663         int rc;
2664
2665         rc = superblock_doinit(sb, data);
2666         if (rc)
2667                 return rc;
2668
2669         /* Allow all mounts performed by the kernel */
2670         if (flags & MS_KERNMOUNT)
2671                 return 0;
2672
2673         ad.type = LSM_AUDIT_DATA_DENTRY;
2674         ad.u.dentry = sb->s_root;
2675         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2676 }
2677
2678 static int selinux_sb_statfs(struct dentry *dentry)
2679 {
2680         const struct cred *cred = current_cred();
2681         struct common_audit_data ad;
2682
2683         ad.type = LSM_AUDIT_DATA_DENTRY;
2684         ad.u.dentry = dentry->d_sb->s_root;
2685         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2686 }
2687
2688 static int selinux_mount(const char *dev_name,
2689                          struct path *path,
2690                          const char *type,
2691                          unsigned long flags,
2692                          void *data)
2693 {
2694         const struct cred *cred = current_cred();
2695
2696         if (flags & MS_REMOUNT)
2697                 return superblock_has_perm(cred, path->dentry->d_sb,
2698                                            FILESYSTEM__REMOUNT, NULL);
2699         else
2700                 return path_has_perm(cred, path, FILE__MOUNTON);
2701 }
2702
2703 static int selinux_umount(struct vfsmount *mnt, int flags)
2704 {
2705         const struct cred *cred = current_cred();
2706
2707         return superblock_has_perm(cred, mnt->mnt_sb,
2708                                    FILESYSTEM__UNMOUNT, NULL);
2709 }
2710
2711 /* inode security operations */
2712
2713 static int selinux_inode_alloc_security(struct inode *inode)
2714 {
2715         return inode_alloc_security(inode);
2716 }
2717
2718 static void selinux_inode_free_security(struct inode *inode)
2719 {
2720         inode_free_security(inode);
2721 }
2722
2723 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2724                                         struct qstr *name, void **ctx,
2725                                         u32 *ctxlen)
2726 {
2727         const struct cred *cred = current_cred();
2728         struct task_security_struct *tsec;
2729         struct inode_security_struct *dsec;
2730         struct superblock_security_struct *sbsec;
2731         struct inode *dir = dentry->d_parent->d_inode;
2732         u32 newsid;
2733         int rc;
2734
2735         tsec = cred->security;
2736         dsec = dir->i_security;
2737         sbsec = dir->i_sb->s_security;
2738
2739         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2740                 newsid = tsec->create_sid;
2741         } else {
2742                 rc = security_transition_sid(tsec->sid, dsec->sid,
2743                                              inode_mode_to_security_class(mode),
2744                                              name,
2745                                              &newsid);
2746                 if (rc) {
2747                         printk(KERN_WARNING
2748                                 "%s: security_transition_sid failed, rc=%d\n",
2749                                __func__, -rc);
2750                         return rc;
2751                 }
2752         }
2753
2754         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2755 }
2756
2757 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2758                                        const struct qstr *qstr,
2759                                        const char **name,
2760                                        void **value, size_t *len)
2761 {
2762         const struct task_security_struct *tsec = current_security();
2763         struct inode_security_struct *dsec;
2764         struct superblock_security_struct *sbsec;
2765         u32 sid, newsid, clen;
2766         int rc;
2767         char *context;
2768
2769         dsec = dir->i_security;
2770         sbsec = dir->i_sb->s_security;
2771
2772         sid = tsec->sid;
2773         newsid = tsec->create_sid;
2774
2775         if ((sbsec->flags & SE_SBINITIALIZED) &&
2776             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2777                 newsid = sbsec->mntpoint_sid;
2778         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2779                 rc = security_transition_sid(sid, dsec->sid,
2780                                              inode_mode_to_security_class(inode->i_mode),
2781                                              qstr, &newsid);
2782                 if (rc) {
2783                         printk(KERN_WARNING "%s:  "
2784                                "security_transition_sid failed, rc=%d (dev=%s "
2785                                "ino=%ld)\n",
2786                                __func__,
2787                                -rc, inode->i_sb->s_id, inode->i_ino);
2788                         return rc;
2789                 }
2790         }
2791
2792         /* Possibly defer initialization to selinux_complete_init. */
2793         if (sbsec->flags & SE_SBINITIALIZED) {
2794                 struct inode_security_struct *isec = inode->i_security;
2795                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2796                 isec->sid = newsid;
2797                 isec->initialized = 1;
2798         }
2799
2800         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2801                 return -EOPNOTSUPP;
2802
2803         if (name)
2804                 *name = XATTR_SELINUX_SUFFIX;
2805
2806         if (value && len) {
2807                 rc = security_sid_to_context_force(newsid, &context, &clen);
2808                 if (rc)
2809                         return rc;
2810                 *value = context;
2811                 *len = clen;
2812         }
2813
2814         return 0;
2815 }
2816
2817 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2818 {
2819         return may_create(dir, dentry, SECCLASS_FILE);
2820 }
2821
2822 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2823 {
2824         return may_link(dir, old_dentry, MAY_LINK);
2825 }
2826
2827 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2828 {
2829         return may_link(dir, dentry, MAY_UNLINK);
2830 }
2831
2832 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2833 {
2834         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2835 }
2836
2837 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2838 {
2839         return may_create(dir, dentry, SECCLASS_DIR);
2840 }
2841
2842 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2843 {
2844         return may_link(dir, dentry, MAY_RMDIR);
2845 }
2846
2847 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2848 {
2849         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2850 }
2851
2852 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2853                                 struct inode *new_inode, struct dentry *new_dentry)
2854 {
2855         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2856 }
2857
2858 static int selinux_inode_readlink(struct dentry *dentry)
2859 {
2860         const struct cred *cred = current_cred();
2861
2862         return dentry_has_perm(cred, dentry, FILE__READ);
2863 }
2864
2865 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2866 {
2867         const struct cred *cred = current_cred();
2868
2869         return dentry_has_perm(cred, dentry, FILE__READ);
2870 }
2871
2872 static noinline int audit_inode_permission(struct inode *inode,
2873                                            u32 perms, u32 audited, u32 denied,
2874                                            int result,
2875                                            unsigned flags)
2876 {
2877         struct common_audit_data ad;
2878         struct inode_security_struct *isec = inode->i_security;
2879         int rc;
2880
2881         ad.type = LSM_AUDIT_DATA_INODE;
2882         ad.u.inode = inode;
2883
2884         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2885                             audited, denied, result, &ad, flags);
2886         if (rc)
2887                 return rc;
2888         return 0;
2889 }
2890
2891 static int selinux_inode_permission(struct inode *inode, int mask)
2892 {
2893         const struct cred *cred = current_cred();
2894         u32 perms;
2895         bool from_access;
2896         unsigned flags = mask & MAY_NOT_BLOCK;
2897         struct inode_security_struct *isec;
2898         u32 sid;
2899         struct av_decision avd;
2900         int rc, rc2;
2901         u32 audited, denied;
2902
2903         from_access = mask & MAY_ACCESS;
2904         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2905
2906         /* No permission to check.  Existence test. */
2907         if (!mask)
2908                 return 0;
2909
2910         validate_creds(cred);
2911
2912         if (unlikely(IS_PRIVATE(inode)))
2913                 return 0;
2914
2915         perms = file_mask_to_av(inode->i_mode, mask);
2916
2917         sid = cred_sid(cred);
2918         isec = inode->i_security;
2919
2920         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2921         audited = avc_audit_required(perms, &avd, rc,
2922                                      from_access ? FILE__AUDIT_ACCESS : 0,
2923                                      &denied);
2924         if (likely(!audited))
2925                 return rc;
2926
2927         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2928         if (rc2)
2929                 return rc2;
2930         return rc;
2931 }
2932
2933 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2934 {
2935         const struct cred *cred = current_cred();
2936         unsigned int ia_valid = iattr->ia_valid;
2937         __u32 av = FILE__WRITE;
2938
2939         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2940         if (ia_valid & ATTR_FORCE) {
2941                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2942                               ATTR_FORCE);
2943                 if (!ia_valid)
2944                         return 0;
2945         }
2946
2947         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2948                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2949                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2950
2951         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2952                 av |= FILE__OPEN;
2953
2954         return dentry_has_perm(cred, dentry, av);
2955 }
2956
2957 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2958 {
2959         const struct cred *cred = current_cred();
2960         struct path path;
2961
2962         path.dentry = dentry;
2963         path.mnt = mnt;
2964
2965         return path_has_perm(cred, &path, FILE__GETATTR);
2966 }
2967
2968 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2969 {
2970         const struct cred *cred = current_cred();
2971
2972         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2973                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2974                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2975                         if (!capable(CAP_SETFCAP))
2976                                 return -EPERM;
2977                 } else if (!capable(CAP_SYS_ADMIN)) {
2978                         /* A different attribute in the security namespace.
2979                            Restrict to administrator. */
2980                         return -EPERM;
2981                 }
2982         }
2983
2984         /* Not an attribute we recognize, so just check the
2985            ordinary setattr permission. */
2986         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2987 }
2988
2989 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2990                                   const void *value, size_t size, int flags)
2991 {
2992         struct inode *inode = dentry->d_inode;
2993         struct inode_security_struct *isec = inode->i_security;
2994         struct superblock_security_struct *sbsec;
2995         struct common_audit_data ad;
2996         u32 newsid, sid = current_sid();
2997         int rc = 0;
2998
2999         if (strcmp(name, XATTR_NAME_SELINUX))
3000                 return selinux_inode_setotherxattr(dentry, name);
3001
3002         sbsec = inode->i_sb->s_security;
3003         if (!(sbsec->flags & SBLABEL_MNT))
3004                 return -EOPNOTSUPP;
3005
3006         if (!inode_owner_or_capable(inode))
3007                 return -EPERM;
3008
3009         ad.type = LSM_AUDIT_DATA_DENTRY;
3010         ad.u.dentry = dentry;
3011
3012         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3013                           FILE__RELABELFROM, &ad);
3014         if (rc)
3015                 return rc;
3016
3017         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3018         if (rc == -EINVAL) {
3019                 if (!capable(CAP_MAC_ADMIN)) {
3020                         struct audit_buffer *ab;
3021                         size_t audit_size;
3022                         const char *str;
3023
3024                         /* We strip a nul only if it is at the end, otherwise the
3025                          * context contains a nul and we should audit that */
3026                         if (value) {
3027                                 str = value;
3028                                 if (str[size - 1] == '\0')
3029                                         audit_size = size - 1;
3030                                 else
3031                                         audit_size = size;
3032                         } else {
3033                                 str = "";
3034                                 audit_size = 0;
3035                         }
3036                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3037                         audit_log_format(ab, "op=setxattr invalid_context=");
3038                         audit_log_n_untrustedstring(ab, value, audit_size);
3039                         audit_log_end(ab);
3040
3041                         return rc;
3042                 }
3043                 rc = security_context_to_sid_force(value, size, &newsid);
3044         }
3045         if (rc)
3046                 return rc;
3047
3048         rc = avc_has_perm(sid, newsid, isec->sclass,
3049                           FILE__RELABELTO, &ad);
3050         if (rc)
3051                 return rc;
3052
3053         rc = security_validate_transition(isec->sid, newsid, sid,
3054                                           isec->sclass);
3055         if (rc)
3056                 return rc;
3057
3058         return avc_has_perm(newsid,
3059                             sbsec->sid,
3060                             SECCLASS_FILESYSTEM,
3061                             FILESYSTEM__ASSOCIATE,
3062                             &ad);
3063 }
3064
3065 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3066                                         const void *value, size_t size,
3067                                         int flags)
3068 {
3069         struct inode *inode = dentry->d_inode;
3070         struct inode_security_struct *isec = inode->i_security;
3071         u32 newsid;
3072         int rc;
3073
3074         if (strcmp(name, XATTR_NAME_SELINUX)) {
3075                 /* Not an attribute we recognize, so nothing to do. */
3076                 return;
3077         }
3078
3079         rc = security_context_to_sid_force(value, size, &newsid);
3080         if (rc) {
3081                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3082                        "for (%s, %lu), rc=%d\n",
3083                        inode->i_sb->s_id, inode->i_ino, -rc);
3084                 return;
3085         }
3086
3087         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3088         isec->sid = newsid;
3089         isec->initialized = 1;
3090
3091         return;
3092 }
3093
3094 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3095 {
3096         const struct cred *cred = current_cred();
3097
3098         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3099 }
3100
3101 static int selinux_inode_listxattr(struct dentry *dentry)
3102 {
3103         const struct cred *cred = current_cred();
3104
3105         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3106 }
3107
3108 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3109 {
3110         if (strcmp(name, XATTR_NAME_SELINUX))
3111                 return selinux_inode_setotherxattr(dentry, name);
3112
3113         /* No one is allowed to remove a SELinux security label.
3114            You can change the label, but all data must be labeled. */
3115         return -EACCES;
3116 }
3117
3118 /*
3119  * Copy the inode security context value to the user.
3120  *
3121  * Permission check is handled by selinux_inode_getxattr hook.
3122  */
3123 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3124 {
3125         u32 size;
3126         int error;
3127         char *context = NULL;
3128         struct inode_security_struct *isec = inode->i_security;
3129
3130         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3131                 return -EOPNOTSUPP;
3132
3133         /*
3134          * If the caller has CAP_MAC_ADMIN, then get the raw context
3135          * value even if it is not defined by current policy; otherwise,
3136          * use the in-core value under current policy.
3137          * Use the non-auditing forms of the permission checks since
3138          * getxattr may be called by unprivileged processes commonly
3139          * and lack of permission just means that we fall back to the
3140          * in-core context value, not a denial.
3141          */
3142         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3143                                 SECURITY_CAP_NOAUDIT);
3144         if (!error)
3145                 error = security_sid_to_context_force(isec->sid, &context,
3146                                                       &size);
3147         else
3148                 error = security_sid_to_context(isec->sid, &context, &size);
3149         if (error)
3150                 return error;
3151         error = size;
3152         if (alloc) {
3153                 *buffer = context;
3154                 goto out_nofree;
3155         }
3156         kfree(context);
3157 out_nofree:
3158         return error;
3159 }
3160
3161 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3162                                      const void *value, size_t size, int flags)
3163 {
3164         struct inode_security_struct *isec = inode->i_security;
3165         u32 newsid;
3166         int rc;
3167
3168         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3169                 return -EOPNOTSUPP;
3170
3171         if (!value || !size)
3172                 return -EACCES;
3173
3174         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3175         if (rc)
3176                 return rc;
3177
3178         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3179         isec->sid = newsid;
3180         isec->initialized = 1;
3181         return 0;
3182 }
3183
3184 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3185 {
3186         const int len = sizeof(XATTR_NAME_SELINUX);
3187         if (buffer && len <= buffer_size)
3188                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3189         return len;
3190 }
3191
3192 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3193 {
3194         struct inode_security_struct *isec = inode->i_security;
3195         *secid = isec->sid;
3196 }
3197
3198 /* file security operations */
3199
3200 static int selinux_revalidate_file_permission(struct file *file, int mask)
3201 {
3202         const struct cred *cred = current_cred();
3203         struct inode *inode = file_inode(file);
3204
3205         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3206         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3207                 mask |= MAY_APPEND;
3208
3209         return file_has_perm(cred, file,
3210                              file_mask_to_av(inode->i_mode, mask));
3211 }
3212
3213 static int selinux_file_permission(struct file *file, int mask)
3214 {
3215         struct inode *inode = file_inode(file);
3216         struct file_security_struct *fsec = file->f_security;
3217         struct inode_security_struct *isec = inode->i_security;
3218         u32 sid = current_sid();
3219
3220         if (!mask)
3221                 /* No permission to check.  Existence test. */
3222                 return 0;
3223
3224         if (sid == fsec->sid && fsec->isid == isec->sid &&
3225             fsec->pseqno == avc_policy_seqno())
3226                 /* No change since file_open check. */
3227                 return 0;
3228
3229         return selinux_revalidate_file_permission(file, mask);
3230 }
3231
3232 static int selinux_file_alloc_security(struct file *file)
3233 {
3234         return file_alloc_security(file);
3235 }
3236
3237 static void selinux_file_free_security(struct file *file)
3238 {
3239         file_free_security(file);
3240 }
3241
3242 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3243                               unsigned long arg)
3244 {
3245         const struct cred *cred = current_cred();
3246         int error = 0;
3247
3248         switch (cmd) {
3249         case FIONREAD:
3250         /* fall through */
3251         case FIBMAP:
3252         /* fall through */
3253         case FIGETBSZ:
3254         /* fall through */
3255         case FS_IOC_GETFLAGS:
3256         /* fall through */
3257         case FS_IOC_GETVERSION:
3258                 error = file_has_perm(cred, file, FILE__GETATTR);
3259                 break;
3260
3261         case FS_IOC_SETFLAGS:
3262         /* fall through */
3263         case FS_IOC_SETVERSION:
3264                 error = file_has_perm(cred, file, FILE__SETATTR);
3265                 break;
3266
3267         /* sys_ioctl() checks */
3268         case FIONBIO:
3269         /* fall through */
3270         case FIOASYNC:
3271                 error = file_has_perm(cred, file, 0);
3272                 break;
3273
3274         case KDSKBENT:
3275         case KDSKBSENT:
3276                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3277                                             SECURITY_CAP_AUDIT);
3278                 break;
3279
3280         /* default case assumes that the command will go
3281          * to the file's ioctl() function.
3282          */
3283         default:
3284                 error = file_has_perm(cred, file, FILE__IOCTL);
3285         }
3286         return error;
3287 }
3288
3289 static int default_noexec;
3290
3291 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3292 {
3293         const struct cred *cred = current_cred();
3294         int rc = 0;
3295
3296         if (default_noexec &&
3297             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3298                 /*
3299                  * We are making executable an anonymous mapping or a
3300                  * private file mapping that will also be writable.
3301                  * This has an additional check.
3302                  */
3303                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3304                 if (rc)
3305                         goto error;
3306         }
3307
3308         if (file) {
3309                 /* read access is always possible with a mapping */
3310                 u32 av = FILE__READ;
3311
3312                 /* write access only matters if the mapping is shared */
3313                 if (shared && (prot & PROT_WRITE))
3314                         av |= FILE__WRITE;
3315
3316                 if (prot & PROT_EXEC)
3317                         av |= FILE__EXECUTE;
3318
3319                 return file_has_perm(cred, file, av);
3320         }
3321
3322 error:
3323         return rc;
3324 }
3325
3326 static int selinux_mmap_addr(unsigned long addr)
3327 {
3328         int rc;
3329
3330         /* do DAC check on address space usage */
3331         rc = cap_mmap_addr(addr);
3332         if (rc)
3333                 return rc;
3334
3335         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3336                 u32 sid = current_sid();
3337                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3338                                   MEMPROTECT__MMAP_ZERO, NULL);
3339         }
3340
3341         return rc;
3342 }
3343
3344 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3345                              unsigned long prot, unsigned long flags)
3346 {
3347         if (selinux_checkreqprot)
3348                 prot = reqprot;
3349
3350         return file_map_prot_check(file, prot,
3351                                    (flags & MAP_TYPE) == MAP_SHARED);
3352 }
3353
3354 static int selinux_file_mprotect(struct vm_area_struct *vma,
3355                                  unsigned long reqprot,
3356                                  unsigned long prot)
3357 {
3358         const struct cred *cred = current_cred();
3359
3360         if (selinux_checkreqprot)
3361                 prot = reqprot;
3362
3363         if (default_noexec &&
3364             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3365                 int rc = 0;
3366                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3367                     vma->vm_end <= vma->vm_mm->brk) {
3368                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3369                 } else if (!vma->vm_file &&
3370                            vma->vm_start <= vma->vm_mm->start_stack &&
3371                            vma->vm_end >= vma->vm_mm->start_stack) {
3372                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3373                 } else if (vma->vm_file && vma->anon_vma) {
3374                         /*
3375                          * We are making executable a file mapping that has
3376                          * had some COW done. Since pages might have been
3377                          * written, check ability to execute the possibly
3378                          * modified content.  This typically should only
3379                          * occur for text relocations.
3380                          */
3381                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3382                 }
3383                 if (rc)
3384                         return rc;
3385         }
3386
3387         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3388 }
3389
3390 static int selinux_file_lock(struct file *file, unsigned int cmd)
3391 {
3392         const struct cred *cred = current_cred();
3393
3394         return file_has_perm(cred, file, FILE__LOCK);
3395 }
3396
3397 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3398                               unsigned long arg)
3399 {
3400         const struct cred *cred = current_cred();
3401         int err = 0;
3402
3403         switch (cmd) {
3404         case F_SETFL:
3405                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3406                         err = file_has_perm(cred, file, FILE__WRITE);
3407                         break;
3408                 }
3409                 /* fall through */
3410         case F_SETOWN:
3411         case F_SETSIG:
3412         case F_GETFL:
3413         case F_GETOWN:
3414         case F_GETSIG:
3415         case F_GETOWNER_UIDS:
3416                 /* Just check FD__USE permission */
3417                 err = file_has_perm(cred, file, 0);
3418                 break;
3419         case F_GETLK:
3420         case F_SETLK:
3421         case F_SETLKW:
3422         case F_OFD_GETLK:
3423         case F_OFD_SETLK:
3424         case F_OFD_SETLKW:
3425 #if BITS_PER_LONG == 32
3426         case F_GETLK64:
3427         case F_SETLK64:
3428         case F_SETLKW64:
3429 #endif
3430                 err = file_has_perm(cred, file, FILE__LOCK);
3431                 break;
3432         }
3433
3434         return err;
3435 }
3436
3437 static void selinux_file_set_fowner(struct file *file)
3438 {
3439         struct file_security_struct *fsec;
3440
3441         fsec = file->f_security;
3442         fsec->fown_sid = current_sid();
3443 }
3444
3445 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3446                                        struct fown_struct *fown, int signum)
3447 {
3448         struct file *file;
3449         u32 sid = task_sid(tsk);
3450         u32 perm;
3451         struct file_security_struct *fsec;
3452
3453         /* struct fown_struct is never outside the context of a struct file */
3454         file = container_of(fown, struct file, f_owner);
3455
3456         fsec = file->f_security;
3457
3458         if (!signum)
3459                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3460         else
3461                 perm = signal_to_av(signum);
3462
3463         return avc_has_perm(fsec->fown_sid, sid,
3464                             SECCLASS_PROCESS, perm, NULL);
3465 }
3466
3467 static int selinux_file_receive(struct file *file)
3468 {
3469         const struct cred *cred = current_cred();
3470
3471         return file_has_perm(cred, file, file_to_av(file));
3472 }
3473
3474 static int selinux_file_open(struct file *file, const struct cred *cred)
3475 {
3476         struct file_security_struct *fsec;
3477         struct inode_security_struct *isec;
3478
3479         fsec = file->f_security;
3480         isec = file_inode(file)->i_security;
3481         /*
3482          * Save inode label and policy sequence number
3483          * at open-time so that selinux_file_permission
3484          * can determine whether revalidation is necessary.
3485          * Task label is already saved in the file security
3486          * struct as its SID.
3487          */
3488         fsec->isid = isec->sid;
3489         fsec->pseqno = avc_policy_seqno();
3490         /*
3491          * Since the inode label or policy seqno may have changed
3492          * between the selinux_inode_permission check and the saving
3493          * of state above, recheck that access is still permitted.
3494          * Otherwise, access might never be revalidated against the
3495          * new inode label or new policy.
3496          * This check is not redundant - do not remove.
3497          */
3498         return file_path_has_perm(cred, file, open_file_to_av(file));
3499 }
3500
3501 /* task security operations */
3502
3503 static int selinux_task_create(unsigned long clone_flags)
3504 {
3505         return current_has_perm(current, PROCESS__FORK);
3506 }
3507
3508 /*
3509  * allocate the SELinux part of blank credentials
3510  */
3511 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3512 {
3513         struct task_security_struct *tsec;
3514
3515         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3516         if (!tsec)
3517                 return -ENOMEM;
3518
3519         cred->security = tsec;
3520         return 0;
3521 }
3522
3523 /*
3524  * detach and free the LSM part of a set of credentials
3525  */
3526 static void selinux_cred_free(struct cred *cred)
3527 {
3528         struct task_security_struct *tsec = cred->security;
3529
3530         /*
3531          * cred->security == NULL if security_cred_alloc_blank() or
3532          * security_prepare_creds() returned an error.
3533          */
3534         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3535         cred->security = (void *) 0x7UL;
3536         kfree(tsec);
3537 }
3538
3539 /*
3540  * prepare a new set of credentials for modification
3541  */
3542 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3543                                 gfp_t gfp)
3544 {
3545         const struct task_security_struct *old_tsec;
3546         struct task_security_struct *tsec;
3547
3548         old_tsec = old->security;
3549
3550         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3551         if (!tsec)
3552                 return -ENOMEM;
3553
3554         new->security = tsec;
3555         return 0;
3556 }
3557
3558 /*
3559  * transfer the SELinux data to a blank set of creds
3560  */
3561 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3562 {
3563         const struct task_security_struct *old_tsec = old->security;
3564         struct task_security_struct *tsec = new->security;
3565
3566         *tsec = *old_tsec;
3567 }
3568
3569 /*
3570  * set the security data for a kernel service
3571  * - all the creation contexts are set to unlabelled
3572  */
3573 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3574 {
3575         struct task_security_struct *tsec = new->security;
3576         u32 sid = current_sid();
3577         int ret;
3578
3579         ret = avc_has_perm(sid, secid,
3580                            SECCLASS_KERNEL_SERVICE,
3581                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3582                            NULL);
3583         if (ret == 0) {
3584                 tsec->sid = secid;
3585                 tsec->create_sid = 0;
3586                 tsec->keycreate_sid = 0;
3587                 tsec->sockcreate_sid = 0;
3588         }
3589         return ret;
3590 }
3591
3592 /*
3593  * set the file creation context in a security record to the same as the
3594  * objective context of the specified inode
3595  */
3596 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3597 {
3598         struct inode_security_struct *isec = inode->i_security;
3599         struct task_security_struct *tsec = new->security;
3600         u32 sid = current_sid();
3601         int ret;
3602
3603         ret = avc_has_perm(sid, isec->sid,
3604                            SECCLASS_KERNEL_SERVICE,
3605                            KERNEL_SERVICE__CREATE_FILES_AS,
3606                            NULL);
3607
3608         if (ret == 0)
3609                 tsec->create_sid = isec->sid;
3610         return ret;
3611 }
3612
3613 static int selinux_kernel_module_request(char *kmod_name)
3614 {
3615         u32 sid;
3616         struct common_audit_data ad;
3617
3618         sid = task_sid(current);
3619
3620         ad.type = LSM_AUDIT_DATA_KMOD;
3621         ad.u.kmod_name = kmod_name;
3622
3623         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3624                             SYSTEM__MODULE_REQUEST, &ad);
3625 }
3626
3627 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3628 {
3629         return current_has_perm(p, PROCESS__SETPGID);
3630 }
3631
3632 static int selinux_task_getpgid(struct task_struct *p)
3633 {
3634         return current_has_perm(p, PROCESS__GETPGID);
3635 }
3636
3637 static int selinux_task_getsid(struct task_struct *p)
3638 {
3639         return current_has_perm(p, PROCESS__GETSESSION);
3640 }
3641
3642 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3643 {
3644         *secid = task_sid(p);
3645 }
3646
3647 static int selinux_task_setnice(struct task_struct *p, int nice)
3648 {
3649         int rc;
3650
3651         rc = cap_task_setnice(p, nice);
3652         if (rc)
3653                 return rc;
3654
3655         return current_has_perm(p, PROCESS__SETSCHED);
3656 }
3657
3658 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3659 {
3660         int rc;
3661
3662         rc = cap_task_setioprio(p, ioprio);
3663         if (rc)
3664                 return rc;
3665
3666         return current_has_perm(p, PROCESS__SETSCHED);
3667 }
3668
3669 static int selinux_task_getioprio(struct task_struct *p)
3670 {
3671         return current_has_perm(p, PROCESS__GETSCHED);
3672 }
3673
3674 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3675                 struct rlimit *new_rlim)
3676 {
3677         struct rlimit *old_rlim = p->signal->rlim + resource;
3678
3679         /* Control the ability to change the hard limit (whether
3680            lowering or raising it), so that the hard limit can
3681            later be used as a safe reset point for the soft limit
3682            upon context transitions.  See selinux_bprm_committing_creds. */
3683         if (old_rlim->rlim_max != new_rlim->rlim_max)
3684                 return current_has_perm(p, PROCESS__SETRLIMIT);
3685
3686         return 0;
3687 }
3688
3689 static int selinux_task_setscheduler(struct task_struct *p)
3690 {
3691         int rc;
3692
3693         rc = cap_task_setscheduler(p);
3694         if (rc)
3695                 return rc;
3696
3697         return current_has_perm(p, PROCESS__SETSCHED);
3698 }
3699
3700 static int selinux_task_getscheduler(struct task_struct *p)
3701 {
3702         return current_has_perm(p, PROCESS__GETSCHED);
3703 }
3704
3705 static int selinux_task_movememory(struct task_struct *p)
3706 {
3707         return current_has_perm(p, PROCESS__SETSCHED);
3708 }
3709
3710 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3711                                 int sig, u32 secid)
3712 {
3713         u32 perm;
3714         int rc;
3715
3716         if (!sig)
3717                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3718         else
3719                 perm = signal_to_av(sig);
3720         if (secid)
3721                 rc = avc_has_perm(secid, task_sid(p),
3722                                   SECCLASS_PROCESS, perm, NULL);
3723         else
3724                 rc = current_has_perm(p, perm);
3725         return rc;
3726 }
3727
3728 static int selinux_task_wait(struct task_struct *p)
3729 {
3730         return task_has_perm(p, current, PROCESS__SIGCHLD);
3731 }
3732
3733 static void selinux_task_to_inode(struct task_struct *p,
3734                                   struct inode *inode)
3735 {
3736         struct inode_security_struct *isec = inode->i_security;
3737         u32 sid = task_sid(p);
3738
3739         isec->sid = sid;
3740         isec->initialized = 1;
3741 }
3742
3743 /* Returns error only if unable to parse addresses */
3744 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3745                         struct common_audit_data *ad, u8 *proto)
3746 {
3747         int offset, ihlen, ret = -EINVAL;
3748         struct iphdr _iph, *ih;
3749
3750         offset = skb_network_offset(skb);
3751         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3752         if (ih == NULL)
3753                 goto out;
3754
3755         ihlen = ih->ihl * 4;
3756         if (ihlen < sizeof(_iph))
3757                 goto out;
3758
3759         ad->u.net->v4info.saddr = ih->saddr;
3760         ad->u.net->v4info.daddr = ih->daddr;
3761         ret = 0;
3762
3763         if (proto)
3764                 *proto = ih->protocol;
3765
3766         switch (ih->protocol) {
3767         case IPPROTO_TCP: {
3768                 struct tcphdr _tcph, *th;
3769
3770                 if (ntohs(ih->frag_off) & IP_OFFSET)
3771                         break;
3772
3773                 offset += ihlen;
3774                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3775                 if (th == NULL)
3776                         break;
3777
3778                 ad->u.net->sport = th->source;
3779                 ad->u.net->dport = th->dest;
3780                 break;
3781         }
3782
3783         case IPPROTO_UDP: {
3784                 struct udphdr _udph, *uh;
3785
3786                 if (ntohs(ih->frag_off) & IP_OFFSET)
3787                         break;
3788
3789                 offset += ihlen;
3790                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3791                 if (uh == NULL)
3792                         break;
3793
3794                 ad->u.net->sport = uh->source;
3795                 ad->u.net->dport = uh->dest;
3796                 break;
3797         }
3798
3799         case IPPROTO_DCCP: {
3800                 struct dccp_hdr _dccph, *dh;
3801
3802                 if (ntohs(ih->frag_off) & IP_OFFSET)
3803                         break;
3804
3805                 offset += ihlen;
3806                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3807                 if (dh == NULL)
3808                         break;
3809
3810                 ad->u.net->sport = dh->dccph_sport;
3811                 ad->u.net->dport = dh->dccph_dport;
3812                 break;
3813         }
3814
3815         default:
3816                 break;
3817         }
3818 out:
3819         return ret;
3820 }
3821
3822 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3823
3824 /* Returns error only if unable to parse addresses */
3825 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3826                         struct common_audit_data *ad, u8 *proto)
3827 {
3828         u8 nexthdr;
3829         int ret = -EINVAL, offset;
3830         struct ipv6hdr _ipv6h, *ip6;
3831         __be16 frag_off;
3832
3833         offset = skb_network_offset(skb);
3834         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3835         if (ip6 == NULL)
3836                 goto out;
3837
3838         ad->u.net->v6info.saddr = ip6->saddr;
3839         ad->u.net->v6info.daddr = ip6->daddr;
3840         ret = 0;
3841
3842         nexthdr = ip6->nexthdr;
3843         offset += sizeof(_ipv6h);
3844         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3845         if (offset < 0)
3846                 goto out;
3847
3848         if (proto)
3849                 *proto = nexthdr;
3850
3851         switch (nexthdr) {
3852         case IPPROTO_TCP: {
3853                 struct tcphdr _tcph, *th;
3854
3855                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3856                 if (th == NULL)
3857                         break;
3858
3859                 ad->u.net->sport = th->source;
3860                 ad->u.net->dport = th->dest;
3861                 break;
3862         }
3863
3864         case IPPROTO_UDP: {
3865                 struct udphdr _udph, *uh;
3866
3867                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3868                 if (uh == NULL)
3869                         break;
3870
3871                 ad->u.net->sport = uh->source;
3872                 ad->u.net->dport = uh->dest;
3873                 break;
3874         }
3875
3876         case IPPROTO_DCCP: {
3877                 struct dccp_hdr _dccph, *dh;
3878
3879                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3880                 if (dh == NULL)
3881                         break;
3882
3883                 ad->u.net->sport = dh->dccph_sport;
3884                 ad->u.net->dport = dh->dccph_dport;
3885                 break;
3886         }
3887
3888         /* includes fragments */
3889         default:
3890                 break;
3891         }
3892 out:
3893         return ret;
3894 }
3895
3896 #endif /* IPV6 */
3897
3898 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3899                              char **_addrp, int src, u8 *proto)
3900 {
3901         char *addrp;
3902         int ret;
3903
3904         switch (ad->u.net->family) {
3905         case PF_INET:
3906                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3907                 if (ret)
3908                         goto parse_error;
3909                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3910                                        &ad->u.net->v4info.daddr);
3911                 goto okay;
3912
3913 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3914         case PF_INET6:
3915                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3916                 if (ret)
3917                         goto parse_error;
3918                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3919                                        &ad->u.net->v6info.daddr);
3920                 goto okay;
3921 #endif  /* IPV6 */
3922         default:
3923                 addrp = NULL;
3924                 goto okay;
3925         }
3926
3927 parse_error:
3928         printk(KERN_WARNING
3929                "SELinux: failure in selinux_parse_skb(),"
3930                " unable to parse packet\n");
3931         return ret;
3932
3933 okay:
3934         if (_addrp)
3935                 *_addrp = addrp;
3936         return 0;
3937 }
3938
3939 /**
3940  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3941  * @skb: the packet
3942  * @family: protocol family
3943  * @sid: the packet's peer label SID
3944  *
3945  * Description:
3946  * Check the various different forms of network peer labeling and determine
3947  * the peer label/SID for the packet; most of the magic actually occurs in
3948  * the security server function security_net_peersid_cmp().  The function
3949  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3950  * or -EACCES if @sid is invalid due to inconsistencies with the different
3951  * peer labels.
3952  *
3953  */
3954 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3955 {
3956         int err;
3957         u32 xfrm_sid;
3958         u32 nlbl_sid;
3959         u32 nlbl_type;
3960
3961         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3962         if (unlikely(err))
3963                 return -EACCES;
3964         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3965         if (unlikely(err))
3966                 return -EACCES;
3967
3968         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3969         if (unlikely(err)) {
3970                 printk(KERN_WARNING
3971                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3972                        " unable to determine packet's peer label\n");
3973                 return -EACCES;
3974         }
3975
3976         return 0;
3977 }
3978
3979 /**
3980  * selinux_conn_sid - Determine the child socket label for a connection
3981  * @sk_sid: the parent socket's SID
3982  * @skb_sid: the packet's SID
3983  * @conn_sid: the resulting connection SID
3984  *
3985  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3986  * combined with the MLS information from @skb_sid in order to create
3987  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3988  * of @sk_sid.  Returns zero on success, negative values on failure.
3989  *
3990  */
3991 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3992 {
3993         int err = 0;
3994
3995         if (skb_sid != SECSID_NULL)
3996                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
3997         else
3998                 *conn_sid = sk_sid;
3999
4000         return err;
4001 }
4002
4003 /* socket security operations */
4004
4005 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4006                                  u16 secclass, u32 *socksid)
4007 {
4008         if (tsec->sockcreate_sid > SECSID_NULL) {
4009                 *socksid = tsec->sockcreate_sid;
4010                 return 0;
4011         }
4012
4013         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4014                                        socksid);
4015 }
4016
4017 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4018 {
4019         struct sk_security_struct *sksec = sk->sk_security;
4020         struct common_audit_data ad;
4021         struct lsm_network_audit net = {0,};
4022         u32 tsid = task_sid(task);
4023
4024         if (sksec->sid == SECINITSID_KERNEL)
4025                 return 0;
4026
4027         ad.type = LSM_AUDIT_DATA_NET;
4028         ad.u.net = &net;
4029         ad.u.net->sk = sk;
4030
4031         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4032 }
4033
4034 static int selinux_socket_create(int family, int type,
4035                                  int protocol, int kern)
4036 {
4037         const struct task_security_struct *tsec = current_security();
4038         u32 newsid;
4039         u16 secclass;
4040         int rc;
4041
4042         if (kern)
4043                 return 0;
4044
4045         secclass = socket_type_to_security_class(family, type, protocol);
4046         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4047         if (rc)
4048                 return rc;
4049
4050         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4051 }
4052
4053 static int selinux_socket_post_create(struct socket *sock, int family,
4054                                       int type, int protocol, int kern)
4055 {
4056         const struct task_security_struct *tsec = current_security();
4057         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4058         struct sk_security_struct *sksec;
4059         int err = 0;
4060
4061         isec->sclass = socket_type_to_security_class(family, type, protocol);
4062
4063         if (kern)
4064                 isec->sid = SECINITSID_KERNEL;
4065         else {
4066                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4067                 if (err)
4068                         return err;
4069         }
4070
4071         isec->initialized = 1;
4072
4073         if (sock->sk) {
4074                 sksec = sock->sk->sk_security;
4075                 sksec->sid = isec->sid;
4076                 sksec->sclass = isec->sclass;
4077                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4078         }
4079
4080         return err;
4081 }
4082
4083 /* Range of port numbers used to automatically bind.
4084    Need to determine whether we should perform a name_bind
4085    permission check between the socket and the port number. */
4086
4087 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4088 {
4089         struct sock *sk = sock->sk;
4090         u16 family;
4091         int err;
4092
4093         err = sock_has_perm(current, sk, SOCKET__BIND);
4094         if (err)
4095                 goto out;
4096
4097         /*
4098          * If PF_INET or PF_INET6, check name_bind permission for the port.
4099          * Multiple address binding for SCTP is not supported yet: we just
4100          * check the first address now.
4101          */
4102         family = sk->sk_family;
4103         if (family == PF_INET || family == PF_INET6) {
4104                 char *addrp;
4105                 struct sk_security_struct *sksec = sk->sk_security;
4106                 struct common_audit_data ad;
4107                 struct lsm_network_audit net = {0,};
4108                 struct sockaddr_in *addr4 = NULL;
4109                 struct sockaddr_in6 *addr6 = NULL;
4110                 unsigned short snum;
4111                 u32 sid, node_perm;
4112
4113                 if (family == PF_INET) {
4114                         addr4 = (struct sockaddr_in *)address;
4115                         snum = ntohs(addr4->sin_port);
4116                         addrp = (char *)&addr4->sin_addr.s_addr;
4117                 } else {
4118                         addr6 = (struct sockaddr_in6 *)address;
4119                         snum = ntohs(addr6->sin6_port);
4120                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4121                 }
4122
4123                 if (snum) {
4124                         int low, high;
4125
4126                         inet_get_local_port_range(sock_net(sk), &low, &high);
4127
4128                         if (snum < max(PROT_SOCK, low) || snum > high) {
4129                                 err = sel_netport_sid(sk->sk_protocol,
4130                                                       snum, &sid);
4131                                 if (err)
4132                                         goto out;
4133                                 ad.type = LSM_AUDIT_DATA_NET;
4134                                 ad.u.net = &net;
4135                                 ad.u.net->sport = htons(snum);
4136                                 ad.u.net->family = family;
4137                                 err = avc_has_perm(sksec->sid, sid,
4138                                                    sksec->sclass,
4139                                                    SOCKET__NAME_BIND, &ad);
4140                                 if (err)
4141                                         goto out;
4142                         }
4143                 }
4144
4145                 switch (sksec->sclass) {
4146                 case SECCLASS_TCP_SOCKET:
4147                         node_perm = TCP_SOCKET__NODE_BIND;
4148                         break;
4149
4150                 case SECCLASS_UDP_SOCKET:
4151                         node_perm = UDP_SOCKET__NODE_BIND;
4152                         break;
4153
4154                 case SECCLASS_DCCP_SOCKET:
4155                         node_perm = DCCP_SOCKET__NODE_BIND;
4156                         break;
4157
4158                 default:
4159                         node_perm = RAWIP_SOCKET__NODE_BIND;
4160                         break;
4161                 }
4162
4163                 err = sel_netnode_sid(addrp, family, &sid);
4164                 if (err)
4165                         goto out;
4166
4167                 ad.type = LSM_AUDIT_DATA_NET;
4168                 ad.u.net = &net;
4169                 ad.u.net->sport = htons(snum);
4170                 ad.u.net->family = family;
4171
4172                 if (family == PF_INET)
4173                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4174                 else
4175                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4176
4177                 err = avc_has_perm(sksec->sid, sid,
4178                                    sksec->sclass, node_perm, &ad);
4179                 if (err)
4180                         goto out;
4181         }
4182 out:
4183         return err;
4184 }
4185
4186 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4187 {
4188         struct sock *sk = sock->sk;
4189         struct sk_security_struct *sksec = sk->sk_security;
4190         int err;
4191
4192         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4193         if (err)
4194                 return err;
4195
4196         /*
4197          * If a TCP or DCCP socket, check name_connect permission for the port.
4198          */
4199         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4200             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4201                 struct common_audit_data ad;
4202                 struct lsm_network_audit net = {0,};
4203                 struct sockaddr_in *addr4 = NULL;
4204                 struct sockaddr_in6 *addr6 = NULL;
4205                 unsigned short snum;
4206                 u32 sid, perm;
4207
4208                 if (sk->sk_family == PF_INET) {
4209                         addr4 = (struct sockaddr_in *)address;
4210                         if (addrlen < sizeof(struct sockaddr_in))
4211                                 return -EINVAL;
4212                         snum = ntohs(addr4->sin_port);
4213                 } else {
4214                         addr6 = (struct sockaddr_in6 *)address;
4215                         if (addrlen < SIN6_LEN_RFC2133)
4216                                 return -EINVAL;
4217                         snum = ntohs(addr6->sin6_port);
4218                 }
4219
4220                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4221                 if (err)
4222                         goto out;
4223
4224                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4225                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4226
4227                 ad.type = LSM_AUDIT_DATA_NET;
4228                 ad.u.net = &net;
4229                 ad.u.net->dport = htons(snum);
4230                 ad.u.net->family = sk->sk_family;
4231                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4232                 if (err)
4233                         goto out;
4234         }
4235
4236         err = selinux_netlbl_socket_connect(sk, address);
4237
4238 out:
4239         return err;
4240 }
4241
4242 static int selinux_socket_listen(struct socket *sock, int backlog)
4243 {
4244         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4245 }
4246
4247 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4248 {
4249         int err;
4250         struct inode_security_struct *isec;
4251         struct inode_security_struct *newisec;
4252
4253         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4254         if (err)
4255                 return err;
4256
4257         newisec = SOCK_INODE(newsock)->i_security;
4258
4259         isec = SOCK_INODE(sock)->i_security;
4260         newisec->sclass = isec->sclass;
4261         newisec->sid = isec->sid;
4262         newisec->initialized = 1;
4263
4264         return 0;
4265 }
4266
4267 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4268                                   int size)
4269 {
4270         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4271 }
4272
4273 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4274                                   int size, int flags)
4275 {
4276         return sock_has_perm(current, sock->sk, SOCKET__READ);
4277 }
4278
4279 static int selinux_socket_getsockname(struct socket *sock)
4280 {
4281         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4282 }
4283
4284 static int selinux_socket_getpeername(struct socket *sock)
4285 {
4286         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4287 }
4288
4289 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4290 {
4291         int err;
4292
4293         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4294         if (err)
4295                 return err;
4296
4297         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4298 }
4299
4300 static int selinux_socket_getsockopt(struct socket *sock, int level,
4301                                      int optname)
4302 {
4303         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4304 }
4305
4306 static int selinux_socket_shutdown(struct socket *sock, int how)
4307 {
4308         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4309 }
4310
4311 static int selinux_socket_unix_stream_connect(struct sock *sock,
4312                                               struct sock *other,
4313                                               struct sock *newsk)
4314 {
4315         struct sk_security_struct *sksec_sock = sock->sk_security;
4316         struct sk_security_struct *sksec_other = other->sk_security;
4317         struct sk_security_struct *sksec_new = newsk->sk_security;
4318         struct common_audit_data ad;
4319         struct lsm_network_audit net = {0,};
4320         int err;
4321
4322         ad.type = LSM_AUDIT_DATA_NET;
4323         ad.u.net = &net;
4324         ad.u.net->sk = other;
4325
4326         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4327                            sksec_other->sclass,
4328                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4329         if (err)
4330                 return err;
4331
4332         /* server child socket */
4333         sksec_new->peer_sid = sksec_sock->sid;
4334         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4335                                     &sksec_new->sid);
4336         if (err)
4337                 return err;
4338
4339         /* connecting socket */
4340         sksec_sock->peer_sid = sksec_new->sid;
4341
4342         return 0;
4343 }
4344
4345 static int selinux_socket_unix_may_send(struct socket *sock,
4346                                         struct socket *other)
4347 {
4348         struct sk_security_struct *ssec = sock->sk->sk_security;
4349         struct sk_security_struct *osec = other->sk->sk_security;
4350         struct common_audit_data ad;
4351         struct lsm_network_audit net = {0,};
4352
4353         ad.type = LSM_AUDIT_DATA_NET;
4354         ad.u.net = &net;
4355         ad.u.net->sk = other->sk;
4356
4357         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4358                             &ad);
4359 }
4360
4361 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4362                                     char *addrp, u16 family, u32 peer_sid,
4363                                     struct common_audit_data *ad)
4364 {
4365         int err;
4366         u32 if_sid;
4367         u32 node_sid;
4368
4369         err = sel_netif_sid(ns, ifindex, &if_sid);
4370         if (err)
4371                 return err;
4372         err = avc_has_perm(peer_sid, if_sid,
4373                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4374         if (err)
4375                 return err;
4376
4377         err = sel_netnode_sid(addrp, family, &node_sid);
4378         if (err)
4379                 return err;
4380         return avc_has_perm(peer_sid, node_sid,
4381                             SECCLASS_NODE, NODE__RECVFROM, ad);
4382 }
4383
4384 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4385                                        u16 family)
4386 {
4387         int err = 0;
4388         struct sk_security_struct *sksec = sk->sk_security;
4389         u32 sk_sid = sksec->sid;
4390         struct common_audit_data ad;
4391         struct lsm_network_audit net = {0,};
4392         char *addrp;
4393
4394         ad.type = LSM_AUDIT_DATA_NET;
4395         ad.u.net = &net;
4396         ad.u.net->netif = skb->skb_iif;
4397         ad.u.net->family = family;
4398         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4399         if (err)
4400                 return err;
4401
4402         if (selinux_secmark_enabled()) {
4403                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4404                                    PACKET__RECV, &ad);
4405                 if (err)
4406                         return err;
4407         }
4408
4409         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4410         if (err)
4411                 return err;
4412         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4413
4414         return err;
4415 }
4416
4417 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4418 {
4419         int err;
4420         struct sk_security_struct *sksec = sk->sk_security;
4421         u16 family = sk->sk_family;
4422         u32 sk_sid = sksec->sid;
4423         struct common_audit_data ad;
4424         struct lsm_network_audit net = {0,};
4425         char *addrp;
4426         u8 secmark_active;
4427         u8 peerlbl_active;
4428
4429         if (family != PF_INET && family != PF_INET6)
4430                 return 0;
4431
4432         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4433         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4434                 family = PF_INET;
4435
4436         /* If any sort of compatibility mode is enabled then handoff processing
4437          * to the selinux_sock_rcv_skb_compat() function to deal with the
4438          * special handling.  We do this in an attempt to keep this function
4439          * as fast and as clean as possible. */
4440         if (!selinux_policycap_netpeer)
4441                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4442
4443         secmark_active = selinux_secmark_enabled();
4444         peerlbl_active = selinux_peerlbl_enabled();
4445         if (!secmark_active && !peerlbl_active)
4446                 return 0;
4447
4448         ad.type = LSM_AUDIT_DATA_NET;
4449         ad.u.net = &net;
4450         ad.u.net->netif = skb->skb_iif;
4451         ad.u.net->family = family;
4452         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4453         if (err)
4454                 return err;
4455
4456         if (peerlbl_active) {
4457                 u32 peer_sid;
4458
4459                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4460                 if (err)
4461                         return err;
4462                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4463                                                addrp, family, peer_sid, &ad);
4464                 if (err) {
4465                         selinux_netlbl_err(skb, err, 0);
4466                         return err;
4467                 }
4468                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4469                                    PEER__RECV, &ad);
4470                 if (err) {
4471                         selinux_netlbl_err(skb, err, 0);
4472                         return err;
4473                 }
4474         }
4475
4476         if (secmark_active) {
4477                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4478                                    PACKET__RECV, &ad);
4479                 if (err)
4480                         return err;
4481         }
4482
4483         return err;
4484 }
4485
4486 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4487                                             int __user *optlen, unsigned len)
4488 {
4489         int err = 0;
4490         char *scontext;
4491         u32 scontext_len;
4492         struct sk_security_struct *sksec = sock->sk->sk_security;
4493         u32 peer_sid = SECSID_NULL;
4494
4495         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4496             sksec->sclass == SECCLASS_TCP_SOCKET)
4497                 peer_sid = sksec->peer_sid;
4498         if (peer_sid == SECSID_NULL)
4499                 return -ENOPROTOOPT;
4500
4501         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4502         if (err)
4503                 return err;
4504
4505         if (scontext_len > len) {
4506                 err = -ERANGE;
4507                 goto out_len;
4508         }
4509
4510         if (copy_to_user(optval, scontext, scontext_len))
4511                 err = -EFAULT;
4512
4513 out_len:
4514         if (put_user(scontext_len, optlen))
4515                 err = -EFAULT;
4516         kfree(scontext);
4517         return err;
4518 }
4519
4520 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4521 {
4522         u32 peer_secid = SECSID_NULL;
4523         u16 family;
4524
4525         if (skb && skb->protocol == htons(ETH_P_IP))
4526                 family = PF_INET;
4527         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4528                 family = PF_INET6;
4529         else if (sock)
4530                 family = sock->sk->sk_family;
4531         else
4532                 goto out;
4533
4534         if (sock && family == PF_UNIX)
4535                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4536         else if (skb)
4537                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4538
4539 out:
4540         *secid = peer_secid;
4541         if (peer_secid == SECSID_NULL)
4542                 return -EINVAL;
4543         return 0;
4544 }
4545
4546 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4547 {
4548         struct sk_security_struct *sksec;
4549
4550         sksec = kzalloc(sizeof(*sksec), priority);
4551         if (!sksec)
4552                 return -ENOMEM;
4553
4554         sksec->peer_sid = SECINITSID_UNLABELED;
4555         sksec->sid = SECINITSID_UNLABELED;
4556         selinux_netlbl_sk_security_reset(sksec);
4557         sk->sk_security = sksec;
4558
4559         return 0;
4560 }
4561
4562 static void selinux_sk_free_security(struct sock *sk)
4563 {
4564         struct sk_security_struct *sksec = sk->sk_security;
4565
4566         sk->sk_security = NULL;
4567         selinux_netlbl_sk_security_free(sksec);
4568         kfree(sksec);
4569 }
4570
4571 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4572 {
4573         struct sk_security_struct *sksec = sk->sk_security;
4574         struct sk_security_struct *newsksec = newsk->sk_security;
4575
4576         newsksec->sid = sksec->sid;
4577         newsksec->peer_sid = sksec->peer_sid;
4578         newsksec->sclass = sksec->sclass;
4579
4580         selinux_netlbl_sk_security_reset(newsksec);
4581 }
4582
4583 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4584 {
4585         if (!sk)
4586                 *secid = SECINITSID_ANY_SOCKET;
4587         else {
4588                 struct sk_security_struct *sksec = sk->sk_security;
4589
4590                 *secid = sksec->sid;
4591         }
4592 }
4593
4594 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4595 {
4596         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4597         struct sk_security_struct *sksec = sk->sk_security;
4598
4599         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4600             sk->sk_family == PF_UNIX)
4601                 isec->sid = sksec->sid;
4602         sksec->sclass = isec->sclass;
4603 }
4604
4605 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4606                                      struct request_sock *req)
4607 {
4608         struct sk_security_struct *sksec = sk->sk_security;
4609         int err;
4610         u16 family = req->rsk_ops->family;
4611         u32 connsid;
4612         u32 peersid;
4613
4614         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4615         if (err)
4616                 return err;
4617         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4618         if (err)
4619                 return err;
4620         req->secid = connsid;
4621         req->peer_secid = peersid;
4622
4623         return selinux_netlbl_inet_conn_request(req, family);
4624 }
4625
4626 static void selinux_inet_csk_clone(struct sock *newsk,
4627                                    const struct request_sock *req)
4628 {
4629         struct sk_security_struct *newsksec = newsk->sk_security;
4630
4631         newsksec->sid = req->secid;
4632         newsksec->peer_sid = req->peer_secid;
4633         /* NOTE: Ideally, we should also get the isec->sid for the
4634            new socket in sync, but we don't have the isec available yet.
4635            So we will wait until sock_graft to do it, by which
4636            time it will have been created and available. */
4637
4638         /* We don't need to take any sort of lock here as we are the only
4639          * thread with access to newsksec */
4640         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4641 }
4642
4643 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4644 {
4645         u16 family = sk->sk_family;
4646         struct sk_security_struct *sksec = sk->sk_security;
4647
4648         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4649         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4650                 family = PF_INET;
4651
4652         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4653 }
4654
4655 static void selinux_skb_owned_by(struct sk_buff *skb, struct sock *sk)
4656 {
4657         skb_set_owner_w(skb, sk);
4658 }
4659
4660 static int selinux_secmark_relabel_packet(u32 sid)
4661 {
4662         const struct task_security_struct *__tsec;
4663         u32 tsid;
4664
4665         __tsec = current_security();
4666         tsid = __tsec->sid;
4667
4668         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4669 }
4670
4671 static void selinux_secmark_refcount_inc(void)
4672 {
4673         atomic_inc(&selinux_secmark_refcount);
4674 }
4675
4676 static void selinux_secmark_refcount_dec(void)
4677 {
4678         atomic_dec(&selinux_secmark_refcount);
4679 }
4680
4681 static void selinux_req_classify_flow(const struct request_sock *req,
4682                                       struct flowi *fl)
4683 {
4684         fl->flowi_secid = req->secid;
4685 }
4686
4687 static int selinux_tun_dev_alloc_security(void **security)
4688 {
4689         struct tun_security_struct *tunsec;
4690
4691         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4692         if (!tunsec)
4693                 return -ENOMEM;
4694         tunsec->sid = current_sid();
4695
4696         *security = tunsec;
4697         return 0;
4698 }
4699
4700 static void selinux_tun_dev_free_security(void *security)
4701 {
4702         kfree(security);
4703 }
4704
4705 static int selinux_tun_dev_create(void)
4706 {
4707         u32 sid = current_sid();
4708
4709         /* we aren't taking into account the "sockcreate" SID since the socket
4710          * that is being created here is not a socket in the traditional sense,
4711          * instead it is a private sock, accessible only to the kernel, and
4712          * representing a wide range of network traffic spanning multiple
4713          * connections unlike traditional sockets - check the TUN driver to
4714          * get a better understanding of why this socket is special */
4715
4716         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4717                             NULL);
4718 }
4719
4720 static int selinux_tun_dev_attach_queue(void *security)
4721 {
4722         struct tun_security_struct *tunsec = security;
4723
4724         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4725                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4726 }
4727
4728 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4729 {
4730         struct tun_security_struct *tunsec = security;
4731         struct sk_security_struct *sksec = sk->sk_security;
4732
4733         /* we don't currently perform any NetLabel based labeling here and it
4734          * isn't clear that we would want to do so anyway; while we could apply
4735          * labeling without the support of the TUN user the resulting labeled
4736          * traffic from the other end of the connection would almost certainly
4737          * cause confusion to the TUN user that had no idea network labeling
4738          * protocols were being used */
4739
4740         sksec->sid = tunsec->sid;
4741         sksec->sclass = SECCLASS_TUN_SOCKET;
4742
4743         return 0;
4744 }
4745
4746 static int selinux_tun_dev_open(void *security)
4747 {
4748         struct tun_security_struct *tunsec = security;
4749         u32 sid = current_sid();
4750         int err;
4751
4752         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4753                            TUN_SOCKET__RELABELFROM, NULL);
4754         if (err)
4755                 return err;
4756         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4757                            TUN_SOCKET__RELABELTO, NULL);
4758         if (err)
4759                 return err;
4760         tunsec->sid = sid;
4761
4762         return 0;
4763 }
4764
4765 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4766 {
4767         int err = 0;
4768         u32 perm;
4769         struct nlmsghdr *nlh;
4770         struct sk_security_struct *sksec = sk->sk_security;
4771
4772         if (skb->len < NLMSG_HDRLEN) {
4773                 err = -EINVAL;
4774                 goto out;
4775         }
4776         nlh = nlmsg_hdr(skb);
4777
4778         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4779         if (err) {
4780                 if (err == -EINVAL) {
4781                         printk(KERN_WARNING
4782                                "SELinux: unrecognized netlink message:"
4783                                " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4784                                sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4785                         if (!selinux_enforcing || security_get_allow_unknown())
4786                                 err = 0;
4787                 }
4788
4789                 /* Ignore */
4790                 if (err == -ENOENT)
4791                         err = 0;
4792                 goto out;
4793         }
4794
4795         err = sock_has_perm(current, sk, perm);
4796 out:
4797         return err;
4798 }
4799
4800 #ifdef CONFIG_NETFILTER
4801
4802 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4803                                        const struct net_device *indev,
4804                                        u16 family)
4805 {
4806         int err;
4807         char *addrp;
4808         u32 peer_sid;
4809         struct common_audit_data ad;
4810         struct lsm_network_audit net = {0,};
4811         u8 secmark_active;
4812         u8 netlbl_active;
4813         u8 peerlbl_active;
4814
4815         if (!selinux_policycap_netpeer)
4816                 return NF_ACCEPT;
4817
4818         secmark_active = selinux_secmark_enabled();
4819         netlbl_active = netlbl_enabled();
4820         peerlbl_active = selinux_peerlbl_enabled();
4821         if (!secmark_active && !peerlbl_active)
4822                 return NF_ACCEPT;
4823
4824         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4825                 return NF_DROP;
4826
4827         ad.type = LSM_AUDIT_DATA_NET;
4828         ad.u.net = &net;
4829         ad.u.net->netif = indev->ifindex;
4830         ad.u.net->family = family;
4831         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4832                 return NF_DROP;
4833
4834         if (peerlbl_active) {
4835                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4836                                                addrp, family, peer_sid, &ad);
4837                 if (err) {
4838                         selinux_netlbl_err(skb, err, 1);
4839                         return NF_DROP;
4840                 }
4841         }
4842
4843         if (secmark_active)
4844                 if (avc_has_perm(peer_sid, skb->secmark,
4845                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4846                         return NF_DROP;
4847
4848         if (netlbl_active)
4849                 /* we do this in the FORWARD path and not the POST_ROUTING
4850                  * path because we want to make sure we apply the necessary
4851                  * labeling before IPsec is applied so we can leverage AH
4852                  * protection */
4853                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4854                         return NF_DROP;
4855
4856         return NF_ACCEPT;
4857 }
4858
4859 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4860                                          struct sk_buff *skb,
4861                                          const struct net_device *in,
4862                                          const struct net_device *out,
4863                                          int (*okfn)(struct sk_buff *))
4864 {
4865         return selinux_ip_forward(skb, in, PF_INET);
4866 }
4867
4868 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4869 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4870                                          struct sk_buff *skb,
4871                                          const struct net_device *in,
4872                                          const struct net_device *out,
4873                                          int (*okfn)(struct sk_buff *))
4874 {
4875         return selinux_ip_forward(skb, in, PF_INET6);
4876 }
4877 #endif  /* IPV6 */
4878
4879 static unsigned int selinux_ip_output(struct sk_buff *skb,
4880                                       u16 family)
4881 {
4882         struct sock *sk;
4883         u32 sid;
4884
4885         if (!netlbl_enabled())
4886                 return NF_ACCEPT;
4887
4888         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4889          * because we want to make sure we apply the necessary labeling
4890          * before IPsec is applied so we can leverage AH protection */
4891         sk = skb->sk;
4892         if (sk) {
4893                 struct sk_security_struct *sksec;
4894
4895                 if (sk->sk_state == TCP_LISTEN)
4896                         /* if the socket is the listening state then this
4897                          * packet is a SYN-ACK packet which means it needs to
4898                          * be labeled based on the connection/request_sock and
4899                          * not the parent socket.  unfortunately, we can't
4900                          * lookup the request_sock yet as it isn't queued on
4901                          * the parent socket until after the SYN-ACK is sent.
4902                          * the "solution" is to simply pass the packet as-is
4903                          * as any IP option based labeling should be copied
4904                          * from the initial connection request (in the IP
4905                          * layer).  it is far from ideal, but until we get a
4906                          * security label in the packet itself this is the
4907                          * best we can do. */
4908                         return NF_ACCEPT;
4909
4910                 /* standard practice, label using the parent socket */
4911                 sksec = sk->sk_security;
4912                 sid = sksec->sid;
4913         } else
4914                 sid = SECINITSID_KERNEL;
4915         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4916                 return NF_DROP;
4917
4918         return NF_ACCEPT;
4919 }
4920
4921 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4922                                         struct sk_buff *skb,
4923                                         const struct net_device *in,
4924                                         const struct net_device *out,
4925                                         int (*okfn)(struct sk_buff *))
4926 {
4927         return selinux_ip_output(skb, PF_INET);
4928 }
4929
4930 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4931                                                 int ifindex,
4932                                                 u16 family)
4933 {
4934         struct sock *sk = skb->sk;
4935         struct sk_security_struct *sksec;
4936         struct common_audit_data ad;
4937         struct lsm_network_audit net = {0,};
4938         char *addrp;
4939         u8 proto;
4940
4941         if (sk == NULL)
4942                 return NF_ACCEPT;
4943         sksec = sk->sk_security;
4944
4945         ad.type = LSM_AUDIT_DATA_NET;
4946         ad.u.net = &net;
4947         ad.u.net->netif = ifindex;
4948         ad.u.net->family = family;
4949         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4950                 return NF_DROP;
4951
4952         if (selinux_secmark_enabled())
4953                 if (avc_has_perm(sksec->sid, skb->secmark,
4954                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4955                         return NF_DROP_ERR(-ECONNREFUSED);
4956
4957         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4958                 return NF_DROP_ERR(-ECONNREFUSED);
4959
4960         return NF_ACCEPT;
4961 }
4962
4963 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4964                                          const struct net_device *outdev,
4965                                          u16 family)
4966 {
4967         u32 secmark_perm;
4968         u32 peer_sid;
4969         int ifindex = outdev->ifindex;
4970         struct sock *sk;
4971         struct common_audit_data ad;
4972         struct lsm_network_audit net = {0,};
4973         char *addrp;
4974         u8 secmark_active;
4975         u8 peerlbl_active;
4976
4977         /* If any sort of compatibility mode is enabled then handoff processing
4978          * to the selinux_ip_postroute_compat() function to deal with the
4979          * special handling.  We do this in an attempt to keep this function
4980          * as fast and as clean as possible. */
4981         if (!selinux_policycap_netpeer)
4982                 return selinux_ip_postroute_compat(skb, ifindex, family);
4983
4984         secmark_active = selinux_secmark_enabled();
4985         peerlbl_active = selinux_peerlbl_enabled();
4986         if (!secmark_active && !peerlbl_active)
4987                 return NF_ACCEPT;
4988
4989         sk = skb->sk;
4990
4991 #ifdef CONFIG_XFRM
4992         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4993          * packet transformation so allow the packet to pass without any checks
4994          * since we'll have another chance to perform access control checks
4995          * when the packet is on it's final way out.
4996          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4997          *       is NULL, in this case go ahead and apply access control.
4998          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4999          *       TCP listening state we cannot wait until the XFRM processing
5000          *       is done as we will miss out on the SA label if we do;
5001          *       unfortunately, this means more work, but it is only once per
5002          *       connection. */
5003         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5004             !(sk != NULL && sk->sk_state == TCP_LISTEN))
5005                 return NF_ACCEPT;
5006 #endif
5007
5008         if (sk == NULL) {
5009                 /* Without an associated socket the packet is either coming
5010                  * from the kernel or it is being forwarded; check the packet
5011                  * to determine which and if the packet is being forwarded
5012                  * query the packet directly to determine the security label. */
5013                 if (skb->skb_iif) {
5014                         secmark_perm = PACKET__FORWARD_OUT;
5015                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5016                                 return NF_DROP;
5017                 } else {
5018                         secmark_perm = PACKET__SEND;
5019                         peer_sid = SECINITSID_KERNEL;
5020                 }
5021         } else if (sk->sk_state == TCP_LISTEN) {
5022                 /* Locally generated packet but the associated socket is in the
5023                  * listening state which means this is a SYN-ACK packet.  In
5024                  * this particular case the correct security label is assigned
5025                  * to the connection/request_sock but unfortunately we can't
5026                  * query the request_sock as it isn't queued on the parent
5027                  * socket until after the SYN-ACK packet is sent; the only
5028                  * viable choice is to regenerate the label like we do in
5029                  * selinux_inet_conn_request().  See also selinux_ip_output()
5030                  * for similar problems. */
5031                 u32 skb_sid;
5032                 struct sk_security_struct *sksec = sk->sk_security;
5033                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5034                         return NF_DROP;
5035                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5036                  * and the packet has been through at least one XFRM
5037                  * transformation then we must be dealing with the "final"
5038                  * form of labeled IPsec packet; since we've already applied
5039                  * all of our access controls on this packet we can safely
5040                  * pass the packet. */
5041                 if (skb_sid == SECSID_NULL) {
5042                         switch (family) {
5043                         case PF_INET:
5044                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5045                                         return NF_ACCEPT;
5046                                 break;
5047                         case PF_INET6:
5048                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5049                                         return NF_ACCEPT;
5050                                 break;
5051                         default:
5052                                 return NF_DROP_ERR(-ECONNREFUSED);
5053                         }
5054                 }
5055                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5056                         return NF_DROP;
5057                 secmark_perm = PACKET__SEND;
5058         } else {
5059                 /* Locally generated packet, fetch the security label from the
5060                  * associated socket. */
5061                 struct sk_security_struct *sksec = sk->sk_security;
5062                 peer_sid = sksec->sid;
5063                 secmark_perm = PACKET__SEND;
5064         }
5065
5066         ad.type = LSM_AUDIT_DATA_NET;
5067         ad.u.net = &net;
5068         ad.u.net->netif = ifindex;
5069         ad.u.net->family = family;
5070         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5071                 return NF_DROP;
5072
5073         if (secmark_active)
5074                 if (avc_has_perm(peer_sid, skb->secmark,
5075                                  SECCLASS_PACKET, secmark_perm, &ad))
5076                         return NF_DROP_ERR(-ECONNREFUSED);
5077
5078         if (peerlbl_active) {
5079                 u32 if_sid;
5080                 u32 node_sid;
5081
5082                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5083                         return NF_DROP;
5084                 if (avc_has_perm(peer_sid, if_sid,
5085                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5086                         return NF_DROP_ERR(-ECONNREFUSED);
5087
5088                 if (sel_netnode_sid(addrp, family, &node_sid))
5089                         return NF_DROP;
5090                 if (avc_has_perm(peer_sid, node_sid,
5091                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5092                         return NF_DROP_ERR(-ECONNREFUSED);
5093         }
5094
5095         return NF_ACCEPT;
5096 }
5097
5098 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5099                                            struct sk_buff *skb,
5100                                            const struct net_device *in,
5101                                            const struct net_device *out,
5102                                            int (*okfn)(struct sk_buff *))
5103 {
5104         return selinux_ip_postroute(skb, out, PF_INET);
5105 }
5106
5107 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5108 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5109                                            struct sk_buff *skb,
5110                                            const struct net_device *in,
5111                                            const struct net_device *out,
5112                                            int (*okfn)(struct sk_buff *))
5113 {
5114         return selinux_ip_postroute(skb, out, PF_INET6);
5115 }
5116 #endif  /* IPV6 */
5117
5118 #endif  /* CONFIG_NETFILTER */
5119
5120 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5121 {
5122         int err;
5123
5124         err = cap_netlink_send(sk, skb);
5125         if (err)
5126                 return err;
5127
5128         return selinux_nlmsg_perm(sk, skb);
5129 }
5130
5131 static int ipc_alloc_security(struct task_struct *task,
5132                               struct kern_ipc_perm *perm,
5133                               u16 sclass)
5134 {
5135         struct ipc_security_struct *isec;
5136         u32 sid;
5137
5138         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5139         if (!isec)
5140                 return -ENOMEM;
5141
5142         sid = task_sid(task);
5143         isec->sclass = sclass;
5144         isec->sid = sid;
5145         perm->security = isec;
5146
5147         return 0;
5148 }
5149
5150 static void ipc_free_security(struct kern_ipc_perm *perm)
5151 {
5152         struct ipc_security_struct *isec = perm->security;
5153         perm->security = NULL;
5154         kfree(isec);
5155 }
5156
5157 static int msg_msg_alloc_security(struct msg_msg *msg)
5158 {
5159         struct msg_security_struct *msec;
5160
5161         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5162         if (!msec)
5163                 return -ENOMEM;
5164
5165         msec->sid = SECINITSID_UNLABELED;
5166         msg->security = msec;
5167
5168         return 0;
5169 }
5170
5171 static void msg_msg_free_security(struct msg_msg *msg)
5172 {
5173         struct msg_security_struct *msec = msg->security;
5174
5175         msg->security = NULL;
5176         kfree(msec);
5177 }
5178
5179 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5180                         u32 perms)
5181 {
5182         struct ipc_security_struct *isec;
5183         struct common_audit_data ad;
5184         u32 sid = current_sid();
5185
5186         isec = ipc_perms->security;
5187
5188         ad.type = LSM_AUDIT_DATA_IPC;
5189         ad.u.ipc_id = ipc_perms->key;
5190
5191         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5192 }
5193
5194 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5195 {
5196         return msg_msg_alloc_security(msg);
5197 }
5198
5199 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5200 {
5201         msg_msg_free_security(msg);
5202 }
5203
5204 /* message queue security operations */
5205 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5206 {
5207         struct ipc_security_struct *isec;
5208         struct common_audit_data ad;
5209         u32 sid = current_sid();
5210         int rc;
5211
5212         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5213         if (rc)
5214                 return rc;
5215
5216         isec = msq->q_perm.security;
5217
5218         ad.type = LSM_AUDIT_DATA_IPC;
5219         ad.u.ipc_id = msq->q_perm.key;
5220
5221         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5222                           MSGQ__CREATE, &ad);
5223         if (rc) {
5224                 ipc_free_security(&msq->q_perm);
5225                 return rc;
5226         }
5227         return 0;
5228 }
5229
5230 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5231 {
5232         ipc_free_security(&msq->q_perm);
5233 }
5234
5235 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5236 {
5237         struct ipc_security_struct *isec;
5238         struct common_audit_data ad;
5239         u32 sid = current_sid();
5240
5241         isec = msq->q_perm.security;
5242
5243         ad.type = LSM_AUDIT_DATA_IPC;
5244         ad.u.ipc_id = msq->q_perm.key;
5245
5246         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5247                             MSGQ__ASSOCIATE, &ad);
5248 }
5249
5250 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5251 {
5252         int err;
5253         int perms;
5254
5255         switch (cmd) {
5256         case IPC_INFO:
5257         case MSG_INFO:
5258                 /* No specific object, just general system-wide information. */
5259                 return task_has_system(current, SYSTEM__IPC_INFO);
5260         case IPC_STAT:
5261         case MSG_STAT:
5262                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5263                 break;
5264         case IPC_SET:
5265                 perms = MSGQ__SETATTR;
5266                 break;
5267         case IPC_RMID:
5268                 perms = MSGQ__DESTROY;
5269                 break;
5270         default:
5271                 return 0;
5272         }
5273
5274         err = ipc_has_perm(&msq->q_perm, perms);
5275         return err;
5276 }
5277
5278 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5279 {
5280         struct ipc_security_struct *isec;
5281         struct msg_security_struct *msec;
5282         struct common_audit_data ad;
5283         u32 sid = current_sid();
5284         int rc;
5285
5286         isec = msq->q_perm.security;
5287         msec = msg->security;
5288
5289         /*
5290          * First time through, need to assign label to the message
5291          */
5292         if (msec->sid == SECINITSID_UNLABELED) {
5293                 /*
5294                  * Compute new sid based on current process and
5295                  * message queue this message will be stored in
5296                  */
5297                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5298                                              NULL, &msec->sid);
5299                 if (rc)
5300                         return rc;
5301         }
5302
5303         ad.type = LSM_AUDIT_DATA_IPC;
5304         ad.u.ipc_id = msq->q_perm.key;
5305
5306         /* Can this process write to the queue? */
5307         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5308                           MSGQ__WRITE, &ad);
5309         if (!rc)
5310                 /* Can this process send the message */
5311                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5312                                   MSG__SEND, &ad);
5313         if (!rc)
5314                 /* Can the message be put in the queue? */
5315                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5316                                   MSGQ__ENQUEUE, &ad);
5317
5318         return rc;
5319 }
5320
5321 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5322                                     struct task_struct *target,
5323                                     long type, int mode)
5324 {
5325         struct ipc_security_struct *isec;
5326         struct msg_security_struct *msec;
5327         struct common_audit_data ad;
5328         u32 sid = task_sid(target);
5329         int rc;
5330
5331         isec = msq->q_perm.security;
5332         msec = msg->security;
5333
5334         ad.type = LSM_AUDIT_DATA_IPC;
5335         ad.u.ipc_id = msq->q_perm.key;
5336
5337         rc = avc_has_perm(sid, isec->sid,
5338                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5339         if (!rc)
5340                 rc = avc_has_perm(sid, msec->sid,
5341                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5342         return rc;
5343 }
5344
5345 /* Shared Memory security operations */
5346 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5347 {
5348         struct ipc_security_struct *isec;
5349         struct common_audit_data ad;
5350         u32 sid = current_sid();
5351         int rc;
5352
5353         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5354         if (rc)
5355                 return rc;
5356
5357         isec = shp->shm_perm.security;
5358
5359         ad.type = LSM_AUDIT_DATA_IPC;
5360         ad.u.ipc_id = shp->shm_perm.key;
5361
5362         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5363                           SHM__CREATE, &ad);
5364         if (rc) {
5365                 ipc_free_security(&shp->shm_perm);
5366                 return rc;
5367         }
5368         return 0;
5369 }
5370
5371 static void selinux_shm_free_security(struct shmid_kernel *shp)
5372 {
5373         ipc_free_security(&shp->shm_perm);
5374 }
5375
5376 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5377 {
5378         struct ipc_security_struct *isec;
5379         struct common_audit_data ad;
5380         u32 sid = current_sid();
5381
5382         isec = shp->shm_perm.security;
5383
5384         ad.type = LSM_AUDIT_DATA_IPC;
5385         ad.u.ipc_id = shp->shm_perm.key;
5386
5387         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5388                             SHM__ASSOCIATE, &ad);
5389 }
5390
5391 /* Note, at this point, shp is locked down */
5392 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5393 {
5394         int perms;
5395         int err;
5396
5397         switch (cmd) {
5398         case IPC_INFO:
5399         case SHM_INFO:
5400                 /* No specific object, just general system-wide information. */
5401                 return task_has_system(current, SYSTEM__IPC_INFO);
5402         case IPC_STAT:
5403         case SHM_STAT:
5404                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5405                 break;
5406         case IPC_SET:
5407                 perms = SHM__SETATTR;
5408                 break;
5409         case SHM_LOCK:
5410         case SHM_UNLOCK:
5411                 perms = SHM__LOCK;
5412                 break;
5413         case IPC_RMID:
5414                 perms = SHM__DESTROY;
5415                 break;
5416         default:
5417                 return 0;
5418         }
5419
5420         err = ipc_has_perm(&shp->shm_perm, perms);
5421         return err;
5422 }
5423
5424 static int selinux_shm_shmat(struct shmid_kernel *shp,
5425                              char __user *shmaddr, int shmflg)
5426 {
5427         u32 perms;
5428
5429         if (shmflg & SHM_RDONLY)
5430                 perms = SHM__READ;
5431         else
5432                 perms = SHM__READ | SHM__WRITE;
5433
5434         return ipc_has_perm(&shp->shm_perm, perms);
5435 }
5436
5437 /* Semaphore security operations */
5438 static int selinux_sem_alloc_security(struct sem_array *sma)
5439 {
5440         struct ipc_security_struct *isec;
5441         struct common_audit_data ad;
5442         u32 sid = current_sid();
5443         int rc;
5444
5445         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5446         if (rc)
5447                 return rc;
5448
5449         isec = sma->sem_perm.security;
5450
5451         ad.type = LSM_AUDIT_DATA_IPC;
5452         ad.u.ipc_id = sma->sem_perm.key;
5453
5454         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5455                           SEM__CREATE, &ad);
5456         if (rc) {
5457                 ipc_free_security(&sma->sem_perm);
5458                 return rc;
5459         }
5460         return 0;
5461 }
5462
5463 static void selinux_sem_free_security(struct sem_array *sma)
5464 {
5465         ipc_free_security(&sma->sem_perm);
5466 }
5467
5468 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5469 {
5470         struct ipc_security_struct *isec;
5471         struct common_audit_data ad;
5472         u32 sid = current_sid();
5473
5474         isec = sma->sem_perm.security;
5475
5476         ad.type = LSM_AUDIT_DATA_IPC;
5477         ad.u.ipc_id = sma->sem_perm.key;
5478
5479         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5480                             SEM__ASSOCIATE, &ad);
5481 }
5482
5483 /* Note, at this point, sma is locked down */
5484 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5485 {
5486         int err;
5487         u32 perms;
5488
5489         switch (cmd) {
5490         case IPC_INFO:
5491         case SEM_INFO:
5492                 /* No specific object, just general system-wide information. */
5493                 return task_has_system(current, SYSTEM__IPC_INFO);
5494         case GETPID:
5495         case GETNCNT:
5496         case GETZCNT:
5497                 perms = SEM__GETATTR;
5498                 break;
5499         case GETVAL:
5500         case GETALL:
5501                 perms = SEM__READ;
5502                 break;
5503         case SETVAL:
5504         case SETALL:
5505                 perms = SEM__WRITE;
5506                 break;
5507         case IPC_RMID:
5508                 perms = SEM__DESTROY;
5509                 break;
5510         case IPC_SET:
5511                 perms = SEM__SETATTR;
5512                 break;
5513         case IPC_STAT:
5514         case SEM_STAT:
5515                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5516                 break;
5517         default:
5518                 return 0;
5519         }
5520
5521         err = ipc_has_perm(&sma->sem_perm, perms);
5522         return err;
5523 }
5524
5525 static int selinux_sem_semop(struct sem_array *sma,
5526                              struct sembuf *sops, unsigned nsops, int alter)
5527 {
5528         u32 perms;
5529
5530         if (alter)
5531                 perms = SEM__READ | SEM__WRITE;
5532         else
5533                 perms = SEM__READ;
5534
5535         return ipc_has_perm(&sma->sem_perm, perms);
5536 }
5537
5538 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5539 {
5540         u32 av = 0;
5541
5542         av = 0;
5543         if (flag & S_IRUGO)
5544                 av |= IPC__UNIX_READ;
5545         if (flag & S_IWUGO)
5546                 av |= IPC__UNIX_WRITE;
5547
5548         if (av == 0)
5549                 return 0;
5550
5551         return ipc_has_perm(ipcp, av);
5552 }
5553
5554 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5555 {
5556         struct ipc_security_struct *isec = ipcp->security;
5557         *secid = isec->sid;
5558 }
5559
5560 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5561 {
5562         if (inode)
5563                 inode_doinit_with_dentry(inode, dentry);
5564 }
5565
5566 static int selinux_getprocattr(struct task_struct *p,
5567                                char *name, char **value)
5568 {
5569         const struct task_security_struct *__tsec;
5570         u32 sid;
5571         int error;
5572         unsigned len;
5573
5574         if (current != p) {
5575                 error = current_has_perm(p, PROCESS__GETATTR);
5576                 if (error)
5577                         return error;
5578         }
5579
5580         rcu_read_lock();
5581         __tsec = __task_cred(p)->security;
5582
5583         if (!strcmp(name, "current"))
5584                 sid = __tsec->sid;
5585         else if (!strcmp(name, "prev"))
5586                 sid = __tsec->osid;
5587         else if (!strcmp(name, "exec"))
5588                 sid = __tsec->exec_sid;
5589         else if (!strcmp(name, "fscreate"))
5590                 sid = __tsec->create_sid;
5591         else if (!strcmp(name, "keycreate"))
5592                 sid = __tsec->keycreate_sid;
5593         else if (!strcmp(name, "sockcreate"))
5594                 sid = __tsec->sockcreate_sid;
5595         else
5596                 goto invalid;
5597         rcu_read_unlock();
5598
5599         if (!sid)
5600                 return 0;
5601
5602         error = security_sid_to_context(sid, value, &len);
5603         if (error)
5604                 return error;
5605         return len;
5606
5607 invalid:
5608         rcu_read_unlock();
5609         return -EINVAL;
5610 }
5611
5612 static int selinux_setprocattr(struct task_struct *p,
5613                                char *name, void *value, size_t size)
5614 {
5615         struct task_security_struct *tsec;
5616         struct task_struct *tracer;
5617         struct cred *new;
5618         u32 sid = 0, ptsid;
5619         int error;
5620         char *str = value;
5621
5622         if (current != p) {
5623                 /* SELinux only allows a process to change its own
5624                    security attributes. */
5625                 return -EACCES;
5626         }
5627
5628         /*
5629          * Basic control over ability to set these attributes at all.
5630          * current == p, but we'll pass them separately in case the
5631          * above restriction is ever removed.
5632          */
5633         if (!strcmp(name, "exec"))
5634                 error = current_has_perm(p, PROCESS__SETEXEC);
5635         else if (!strcmp(name, "fscreate"))
5636                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5637         else if (!strcmp(name, "keycreate"))
5638                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5639         else if (!strcmp(name, "sockcreate"))
5640                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5641         else if (!strcmp(name, "current"))
5642                 error = current_has_perm(p, PROCESS__SETCURRENT);
5643         else
5644                 error = -EINVAL;
5645         if (error)
5646                 return error;
5647
5648         /* Obtain a SID for the context, if one was specified. */
5649         if (size && str[1] && str[1] != '\n') {
5650                 if (str[size-1] == '\n') {
5651                         str[size-1] = 0;
5652                         size--;
5653                 }
5654                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5655                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5656                         if (!capable(CAP_MAC_ADMIN)) {
5657                                 struct audit_buffer *ab;
5658                                 size_t audit_size;
5659
5660                                 /* We strip a nul only if it is at the end, otherwise the
5661                                  * context contains a nul and we should audit that */
5662                                 if (str[size - 1] == '\0')
5663                                         audit_size = size - 1;
5664                                 else
5665                                         audit_size = size;
5666                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5667                                 audit_log_format(ab, "op=fscreate invalid_context=");
5668                                 audit_log_n_untrustedstring(ab, value, audit_size);
5669                                 audit_log_end(ab);
5670
5671                                 return error;
5672                         }
5673                         error = security_context_to_sid_force(value, size,
5674                                                               &sid);
5675                 }
5676                 if (error)
5677                         return error;
5678         }
5679
5680         new = prepare_creds();
5681         if (!new)
5682                 return -ENOMEM;
5683
5684         /* Permission checking based on the specified context is
5685            performed during the actual operation (execve,
5686            open/mkdir/...), when we know the full context of the
5687            operation.  See selinux_bprm_set_creds for the execve
5688            checks and may_create for the file creation checks. The
5689            operation will then fail if the context is not permitted. */
5690         tsec = new->security;
5691         if (!strcmp(name, "exec")) {
5692                 tsec->exec_sid = sid;
5693         } else if (!strcmp(name, "fscreate")) {
5694                 tsec->create_sid = sid;
5695         } else if (!strcmp(name, "keycreate")) {
5696                 error = may_create_key(sid, p);
5697                 if (error)
5698                         goto abort_change;
5699                 tsec->keycreate_sid = sid;
5700         } else if (!strcmp(name, "sockcreate")) {
5701                 tsec->sockcreate_sid = sid;
5702         } else if (!strcmp(name, "current")) {
5703                 error = -EINVAL;
5704                 if (sid == 0)
5705                         goto abort_change;
5706
5707                 /* Only allow single threaded processes to change context */
5708                 error = -EPERM;
5709                 if (!current_is_single_threaded()) {
5710                         error = security_bounded_transition(tsec->sid, sid);
5711                         if (error)
5712                                 goto abort_change;
5713                 }
5714
5715                 /* Check permissions for the transition. */
5716                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5717                                      PROCESS__DYNTRANSITION, NULL);
5718                 if (error)
5719                         goto abort_change;
5720
5721                 /* Check for ptracing, and update the task SID if ok.
5722                    Otherwise, leave SID unchanged and fail. */
5723                 ptsid = 0;
5724                 rcu_read_lock();
5725                 tracer = ptrace_parent(p);
5726                 if (tracer)
5727                         ptsid = task_sid(tracer);
5728                 rcu_read_unlock();
5729
5730                 if (tracer) {
5731                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5732                                              PROCESS__PTRACE, NULL);
5733                         if (error)
5734                                 goto abort_change;
5735                 }
5736
5737                 tsec->sid = sid;
5738         } else {
5739                 error = -EINVAL;
5740                 goto abort_change;
5741         }
5742
5743         commit_creds(new);
5744         return size;
5745
5746 abort_change:
5747         abort_creds(new);
5748         return error;
5749 }
5750
5751 static int selinux_ismaclabel(const char *name)
5752 {
5753         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5754 }
5755
5756 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5757 {
5758         return security_sid_to_context(secid, secdata, seclen);
5759 }
5760
5761 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5762 {
5763         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5764 }
5765
5766 static void selinux_release_secctx(char *secdata, u32 seclen)
5767 {
5768         kfree(secdata);
5769 }
5770
5771 /*
5772  *      called with inode->i_mutex locked
5773  */
5774 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5775 {
5776         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5777 }
5778
5779 /*
5780  *      called with inode->i_mutex locked
5781  */
5782 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5783 {
5784         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5785 }
5786
5787 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5788 {
5789         int len = 0;
5790         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5791                                                 ctx, true);
5792         if (len < 0)
5793                 return len;
5794         *ctxlen = len;
5795         return 0;
5796 }
5797 #ifdef CONFIG_KEYS
5798
5799 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5800                              unsigned long flags)
5801 {
5802         const struct task_security_struct *tsec;
5803         struct key_security_struct *ksec;
5804
5805         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5806         if (!ksec)
5807                 return -ENOMEM;
5808
5809         tsec = cred->security;
5810         if (tsec->keycreate_sid)
5811                 ksec->sid = tsec->keycreate_sid;
5812         else
5813                 ksec->sid = tsec->sid;
5814
5815         k->security = ksec;
5816         return 0;
5817 }
5818
5819 static void selinux_key_free(struct key *k)
5820 {
5821         struct key_security_struct *ksec = k->security;
5822
5823         k->security = NULL;
5824         kfree(ksec);
5825 }
5826
5827 static int selinux_key_permission(key_ref_t key_ref,
5828                                   const struct cred *cred,
5829                                   unsigned perm)
5830 {
5831         struct key *key;
5832         struct key_security_struct *ksec;
5833         u32 sid;
5834
5835         /* if no specific permissions are requested, we skip the
5836            permission check. No serious, additional covert channels
5837            appear to be created. */
5838         if (perm == 0)
5839                 return 0;
5840
5841         sid = cred_sid(cred);
5842
5843         key = key_ref_to_ptr(key_ref);
5844         ksec = key->security;
5845
5846         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5847 }
5848
5849 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5850 {
5851         struct key_security_struct *ksec = key->security;
5852         char *context = NULL;
5853         unsigned len;
5854         int rc;
5855
5856         rc = security_sid_to_context(ksec->sid, &context, &len);
5857         if (!rc)
5858                 rc = len;
5859         *_buffer = context;
5860         return rc;
5861 }
5862
5863 #endif
5864
5865 static struct security_operations selinux_ops = {
5866         .name =                         "selinux",
5867
5868         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5869         .binder_transaction =           selinux_binder_transaction,
5870         .binder_transfer_binder =       selinux_binder_transfer_binder,
5871         .binder_transfer_file =         selinux_binder_transfer_file,
5872
5873         .ptrace_access_check =          selinux_ptrace_access_check,
5874         .ptrace_traceme =               selinux_ptrace_traceme,
5875         .capget =                       selinux_capget,
5876         .capset =                       selinux_capset,
5877         .capable =                      selinux_capable,
5878         .quotactl =                     selinux_quotactl,
5879         .quota_on =                     selinux_quota_on,
5880         .syslog =                       selinux_syslog,
5881         .vm_enough_memory =             selinux_vm_enough_memory,
5882
5883         .netlink_send =                 selinux_netlink_send,
5884
5885         .bprm_set_creds =               selinux_bprm_set_creds,
5886         .bprm_committing_creds =        selinux_bprm_committing_creds,
5887         .bprm_committed_creds =         selinux_bprm_committed_creds,
5888         .bprm_secureexec =              selinux_bprm_secureexec,
5889
5890         .sb_alloc_security =            selinux_sb_alloc_security,
5891         .sb_free_security =             selinux_sb_free_security,
5892         .sb_copy_data =                 selinux_sb_copy_data,
5893         .sb_remount =                   selinux_sb_remount,
5894         .sb_kern_mount =                selinux_sb_kern_mount,
5895         .sb_show_options =              selinux_sb_show_options,
5896         .sb_statfs =                    selinux_sb_statfs,
5897         .sb_mount =                     selinux_mount,
5898         .sb_umount =                    selinux_umount,
5899         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5900         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5901         .sb_parse_opts_str =            selinux_parse_opts_str,
5902
5903         .dentry_init_security =         selinux_dentry_init_security,
5904
5905         .inode_alloc_security =         selinux_inode_alloc_security,
5906         .inode_free_security =          selinux_inode_free_security,
5907         .inode_init_security =          selinux_inode_init_security,
5908         .inode_create =                 selinux_inode_create,
5909         .inode_link =                   selinux_inode_link,
5910         .inode_unlink =                 selinux_inode_unlink,
5911         .inode_symlink =                selinux_inode_symlink,
5912         .inode_mkdir =                  selinux_inode_mkdir,
5913         .inode_rmdir =                  selinux_inode_rmdir,
5914         .inode_mknod =                  selinux_inode_mknod,
5915         .inode_rename =                 selinux_inode_rename,
5916         .inode_readlink =               selinux_inode_readlink,
5917         .inode_follow_link =            selinux_inode_follow_link,
5918         .inode_permission =             selinux_inode_permission,
5919         .inode_setattr =                selinux_inode_setattr,
5920         .inode_getattr =                selinux_inode_getattr,
5921         .inode_setxattr =               selinux_inode_setxattr,
5922         .inode_post_setxattr =          selinux_inode_post_setxattr,
5923         .inode_getxattr =               selinux_inode_getxattr,
5924         .inode_listxattr =              selinux_inode_listxattr,
5925         .inode_removexattr =            selinux_inode_removexattr,
5926         .inode_getsecurity =            selinux_inode_getsecurity,
5927         .inode_setsecurity =            selinux_inode_setsecurity,
5928         .inode_listsecurity =           selinux_inode_listsecurity,
5929         .inode_getsecid =               selinux_inode_getsecid,
5930
5931         .file_permission =              selinux_file_permission,
5932         .file_alloc_security =          selinux_file_alloc_security,
5933         .file_free_security =           selinux_file_free_security,
5934         .file_ioctl =                   selinux_file_ioctl,
5935         .mmap_file =                    selinux_mmap_file,
5936         .mmap_addr =                    selinux_mmap_addr,
5937         .file_mprotect =                selinux_file_mprotect,
5938         .file_lock =                    selinux_file_lock,
5939         .file_fcntl =                   selinux_file_fcntl,
5940         .file_set_fowner =              selinux_file_set_fowner,
5941         .file_send_sigiotask =          selinux_file_send_sigiotask,
5942         .file_receive =                 selinux_file_receive,
5943
5944         .file_open =                    selinux_file_open,
5945
5946         .task_create =                  selinux_task_create,
5947         .cred_alloc_blank =             selinux_cred_alloc_blank,
5948         .cred_free =                    selinux_cred_free,
5949         .cred_prepare =                 selinux_cred_prepare,
5950         .cred_transfer =                selinux_cred_transfer,
5951         .kernel_act_as =                selinux_kernel_act_as,
5952         .kernel_create_files_as =       selinux_kernel_create_files_as,
5953         .kernel_module_request =        selinux_kernel_module_request,
5954         .task_setpgid =                 selinux_task_setpgid,
5955         .task_getpgid =                 selinux_task_getpgid,
5956         .task_getsid =                  selinux_task_getsid,
5957         .task_getsecid =                selinux_task_getsecid,
5958         .task_setnice =                 selinux_task_setnice,
5959         .task_setioprio =               selinux_task_setioprio,
5960         .task_getioprio =               selinux_task_getioprio,
5961         .task_setrlimit =               selinux_task_setrlimit,
5962         .task_setscheduler =            selinux_task_setscheduler,
5963         .task_getscheduler =            selinux_task_getscheduler,
5964         .task_movememory =              selinux_task_movememory,
5965         .task_kill =                    selinux_task_kill,
5966         .task_wait =                    selinux_task_wait,
5967         .task_to_inode =                selinux_task_to_inode,
5968
5969         .ipc_permission =               selinux_ipc_permission,
5970         .ipc_getsecid =                 selinux_ipc_getsecid,
5971
5972         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5973         .msg_msg_free_security =        selinux_msg_msg_free_security,
5974
5975         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5976         .msg_queue_free_security =      selinux_msg_queue_free_security,
5977         .msg_queue_associate =          selinux_msg_queue_associate,
5978         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5979         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5980         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5981
5982         .shm_alloc_security =           selinux_shm_alloc_security,
5983         .shm_free_security =            selinux_shm_free_security,
5984         .shm_associate =                selinux_shm_associate,
5985         .shm_shmctl =                   selinux_shm_shmctl,
5986         .shm_shmat =                    selinux_shm_shmat,
5987
5988         .sem_alloc_security =           selinux_sem_alloc_security,
5989         .sem_free_security =            selinux_sem_free_security,
5990         .sem_associate =                selinux_sem_associate,
5991         .sem_semctl =                   selinux_sem_semctl,
5992         .sem_semop =                    selinux_sem_semop,
5993
5994         .d_instantiate =                selinux_d_instantiate,
5995
5996         .getprocattr =                  selinux_getprocattr,
5997         .setprocattr =                  selinux_setprocattr,
5998
5999         .ismaclabel =                   selinux_ismaclabel,
6000         .secid_to_secctx =              selinux_secid_to_secctx,
6001         .secctx_to_secid =              selinux_secctx_to_secid,
6002         .release_secctx =               selinux_release_secctx,
6003         .inode_notifysecctx =           selinux_inode_notifysecctx,
6004         .inode_setsecctx =              selinux_inode_setsecctx,
6005         .inode_getsecctx =              selinux_inode_getsecctx,
6006
6007         .unix_stream_connect =          selinux_socket_unix_stream_connect,
6008         .unix_may_send =                selinux_socket_unix_may_send,
6009
6010         .socket_create =                selinux_socket_create,
6011         .socket_post_create =           selinux_socket_post_create,
6012         .socket_bind =                  selinux_socket_bind,
6013         .socket_connect =               selinux_socket_connect,
6014         .socket_listen =                selinux_socket_listen,
6015         .socket_accept =                selinux_socket_accept,
6016         .socket_sendmsg =               selinux_socket_sendmsg,
6017         .socket_recvmsg =               selinux_socket_recvmsg,
6018         .socket_getsockname =           selinux_socket_getsockname,
6019         .socket_getpeername =           selinux_socket_getpeername,
6020         .socket_getsockopt =            selinux_socket_getsockopt,
6021         .socket_setsockopt =            selinux_socket_setsockopt,
6022         .socket_shutdown =              selinux_socket_shutdown,
6023         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
6024         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
6025         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
6026         .sk_alloc_security =            selinux_sk_alloc_security,
6027         .sk_free_security =             selinux_sk_free_security,
6028         .sk_clone_security =            selinux_sk_clone_security,
6029         .sk_getsecid =                  selinux_sk_getsecid,
6030         .sock_graft =                   selinux_sock_graft,
6031         .inet_conn_request =            selinux_inet_conn_request,
6032         .inet_csk_clone =               selinux_inet_csk_clone,
6033         .inet_conn_established =        selinux_inet_conn_established,
6034         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
6035         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
6036         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
6037         .req_classify_flow =            selinux_req_classify_flow,
6038         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
6039         .tun_dev_free_security =        selinux_tun_dev_free_security,
6040         .tun_dev_create =               selinux_tun_dev_create,
6041         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
6042         .tun_dev_attach =               selinux_tun_dev_attach,
6043         .tun_dev_open =                 selinux_tun_dev_open,
6044         .skb_owned_by =                 selinux_skb_owned_by,
6045
6046 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6047         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
6048         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
6049         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
6050         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
6051         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
6052         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
6053         .xfrm_state_free_security =     selinux_xfrm_state_free,
6054         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
6055         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
6056         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
6057         .xfrm_decode_session =          selinux_xfrm_decode_session,
6058 #endif
6059
6060 #ifdef CONFIG_KEYS
6061         .key_alloc =                    selinux_key_alloc,
6062         .key_free =                     selinux_key_free,
6063         .key_permission =               selinux_key_permission,
6064         .key_getsecurity =              selinux_key_getsecurity,
6065 #endif
6066
6067 #ifdef CONFIG_AUDIT
6068         .audit_rule_init =              selinux_audit_rule_init,
6069         .audit_rule_known =             selinux_audit_rule_known,
6070         .audit_rule_match =             selinux_audit_rule_match,
6071         .audit_rule_free =              selinux_audit_rule_free,
6072 #endif
6073 };
6074
6075 static __init int selinux_init(void)
6076 {
6077         if (!security_module_enable(&selinux_ops)) {
6078                 selinux_enabled = 0;
6079                 return 0;
6080         }
6081
6082         if (!selinux_enabled) {
6083                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6084                 return 0;
6085         }
6086
6087         printk(KERN_INFO "SELinux:  Initializing.\n");
6088
6089         /* Set the security state for the initial task. */
6090         cred_init_security();
6091
6092         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6093
6094         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6095                                             sizeof(struct inode_security_struct),
6096                                             0, SLAB_PANIC, NULL);
6097         avc_init();
6098
6099         if (register_security(&selinux_ops))
6100                 panic("SELinux: Unable to register with kernel.\n");
6101
6102         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6103                 panic("SELinux: Unable to register AVC netcache callback\n");
6104
6105         if (selinux_enforcing)
6106                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6107         else
6108                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6109
6110         return 0;
6111 }
6112
6113 static void delayed_superblock_init(struct super_block *sb, void *unused)
6114 {
6115         superblock_doinit(sb, NULL);
6116 }
6117
6118 void selinux_complete_init(void)
6119 {
6120         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6121
6122         /* Set up any superblocks initialized prior to the policy load. */
6123         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6124         iterate_supers(delayed_superblock_init, NULL);
6125 }
6126
6127 /* SELinux requires early initialization in order to label
6128    all processes and objects when they are created. */
6129 security_initcall(selinux_init);
6130
6131 #if defined(CONFIG_NETFILTER)
6132
6133 static struct nf_hook_ops selinux_nf_ops[] = {
6134         {
6135                 .hook =         selinux_ipv4_postroute,
6136                 .owner =        THIS_MODULE,
6137                 .pf =           NFPROTO_IPV4,
6138                 .hooknum =      NF_INET_POST_ROUTING,
6139                 .priority =     NF_IP_PRI_SELINUX_LAST,
6140         },
6141         {
6142                 .hook =         selinux_ipv4_forward,
6143                 .owner =        THIS_MODULE,
6144                 .pf =           NFPROTO_IPV4,
6145                 .hooknum =      NF_INET_FORWARD,
6146                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6147         },
6148         {
6149                 .hook =         selinux_ipv4_output,
6150                 .owner =        THIS_MODULE,
6151                 .pf =           NFPROTO_IPV4,
6152                 .hooknum =      NF_INET_LOCAL_OUT,
6153                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6154         },
6155 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6156         {
6157                 .hook =         selinux_ipv6_postroute,
6158                 .owner =        THIS_MODULE,
6159                 .pf =           NFPROTO_IPV6,
6160                 .hooknum =      NF_INET_POST_ROUTING,
6161                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6162         },
6163         {
6164                 .hook =         selinux_ipv6_forward,
6165                 .owner =        THIS_MODULE,
6166                 .pf =           NFPROTO_IPV6,
6167                 .hooknum =      NF_INET_FORWARD,
6168                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6169         },
6170 #endif  /* IPV6 */
6171 };
6172
6173 static int __init selinux_nf_ip_init(void)
6174 {
6175         int err;
6176
6177         if (!selinux_enabled)
6178                 return 0;
6179
6180         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6181
6182         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6183         if (err)
6184                 panic("SELinux: nf_register_hooks: error %d\n", err);
6185
6186         return 0;
6187 }
6188
6189 __initcall(selinux_nf_ip_init);
6190
6191 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6192 static void selinux_nf_ip_exit(void)
6193 {
6194         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6195
6196         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6197 }
6198 #endif
6199
6200 #else /* CONFIG_NETFILTER */
6201
6202 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6203 #define selinux_nf_ip_exit()
6204 #endif
6205
6206 #endif /* CONFIG_NETFILTER */
6207
6208 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6209 static int selinux_disabled;
6210
6211 int selinux_disable(void)
6212 {
6213         if (ss_initialized) {
6214                 /* Not permitted after initial policy load. */
6215                 return -EINVAL;
6216         }
6217
6218         if (selinux_disabled) {
6219                 /* Only do this once. */
6220                 return -EINVAL;
6221         }
6222
6223         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6224
6225         selinux_disabled = 1;
6226         selinux_enabled = 0;
6227
6228         reset_security_ops();
6229
6230         /* Try to destroy the avc node cache */
6231         avc_disable();
6232
6233         /* Unregister netfilter hooks. */
6234         selinux_nf_ip_exit();
6235
6236         /* Unregister selinuxfs. */
6237         exit_sel_fs();
6238
6239         return 0;
6240 }
6241 #endif