security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/lsm_hooks.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129 static struct kmem_cache *file_security_cache;
 130
 131 /**
 132  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 133  *
 134  * Description:
 135  * This function checks the SECMARK reference counter to see if any SECMARK
 136  * targets are currently configured, if the reference counter is greater than
 137  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 138  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 139  * policy capability is enabled, SECMARK is always considered enabled.
 140  *
 141  */
 142 static int selinux_secmark_enabled(void)
 143 {
 144         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 145 }
 146
 147 /**
 148  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 149  *
 150  * Description:
 151  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 152  * (1) if any are enabled or false (0) if neither are enabled.  If the
 153  * always_check_network policy capability is enabled, peer labeling
 154  * is always considered enabled.
 155  *
 156  */
 157 static int selinux_peerlbl_enabled(void)
 158 {
 159         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 160 }
 161
 162 static int selinux_netcache_avc_callback(u32 event)
 163 {
 164         if (event == AVC_CALLBACK_RESET) {
 165                 sel_netif_flush();
 166                 sel_netnode_flush();
 167                 sel_netport_flush();
 168                 synchronize_net();
 169         }
 170         return 0;
 171 }
 172
 173 /*
 174  * initialise the security for the init task
 175  */
 176 static void cred_init_security(void)
 177 {
 178         struct cred *cred = (struct cred *) current->real_cred;
 179         struct task_security_struct *tsec;
 180
 181         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 182         if (!tsec)
 183                 panic("SELinux:  Failed to initialize initial task.\n");
 184
 185         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 186         cred->security = tsec;
 187 }
 188
 189 /*
 190  * get the security ID of a set of credentials
 191  */
 192 static inline u32 cred_sid(const struct cred *cred)
 193 {
 194         const struct task_security_struct *tsec;
 195
 196         tsec = cred->security;
 197         return tsec->sid;
 198 }
 199
 200 /*
 201  * get the objective security ID of a task
 202  */
 203 static inline u32 task_sid(const struct task_struct *task)
 204 {
 205         u32 sid;
 206
 207         rcu_read_lock();
 208         sid = cred_sid(__task_cred(task));
 209         rcu_read_unlock();
 210         return sid;
 211 }
 212
 213 /*
 214  * get the subjective security ID of the current task
 215  */
 216 static inline u32 current_sid(void)
 217 {
 218         const struct task_security_struct *tsec = current_security();
 219
 220         return tsec->sid;
 221 }
 222
 223 /* Allocate and free functions for each kind of security blob. */
 224
 225 static int inode_alloc_security(struct inode *inode)
 226 {
 227         struct inode_security_struct *isec;
 228         u32 sid = current_sid();
 229
 230         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 231         if (!isec)
 232                 return -ENOMEM;
 233
 234         mutex_init(&isec->lock);
 235         INIT_LIST_HEAD(&isec->list);
 236         isec->inode = inode;
 237         isec->sid = SECINITSID_UNLABELED;
 238         isec->sclass = SECCLASS_FILE;
 239         isec->task_sid = sid;
 240         inode->i_security = isec;
 241
 242         return 0;
 243 }
 244
 245 static void inode_free_rcu(struct rcu_head *head)
 246 {
 247         struct inode_security_struct *isec;
 248
 249         isec = container_of(head, struct inode_security_struct, rcu);
 250         kmem_cache_free(sel_inode_cache, isec);
 251 }
 252
 253 static void inode_free_security(struct inode *inode)
 254 {
 255         struct inode_security_struct *isec = inode->i_security;
 256         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 257
 258         /*
 259          * As not all inode security structures are in a list, we check for
 260          * empty list outside of the lock to make sure that we won't waste
 261          * time taking a lock doing nothing.
 262          *
 263          * The list_del_init() function can be safely called more than once.
 264          * It should not be possible for this function to be called with
 265          * concurrent list_add(), but for better safety against future changes
 266          * in the code, we use list_empty_careful() here.
 267          */
 268         if (!list_empty_careful(&isec->list)) {
 269                 spin_lock(&sbsec->isec_lock);
 270                 list_del_init(&isec->list);
 271                 spin_unlock(&sbsec->isec_lock);
 272         }
 273
 274         /*
 275          * The inode may still be referenced in a path walk and
 276          * a call to selinux_inode_permission() can be made
 277          * after inode_free_security() is called. Ideally, the VFS
 278          * wouldn't do this, but fixing that is a much harder
 279          * job. For now, simply free the i_security via RCU, and
 280          * leave the current inode->i_security pointer intact.
 281          * The inode will be freed after the RCU grace period too.
 282          */
 283         call_rcu(&isec->rcu, inode_free_rcu);
 284 }
 285
 286 static int file_alloc_security(struct file *file)
 287 {
 288         struct file_security_struct *fsec;
 289         u32 sid = current_sid();
 290
 291         fsec = kmem_cache_zalloc(file_security_cache, GFP_KERNEL);
 292         if (!fsec)
 293                 return -ENOMEM;
 294
 295         fsec->sid = sid;
 296         fsec->fown_sid = sid;
 297         file->f_security = fsec;
 298
 299         return 0;
 300 }
 301
 302 static void file_free_security(struct file *file)
 303 {
 304         struct file_security_struct *fsec = file->f_security;
 305         file->f_security = NULL;
 306         kmem_cache_free(file_security_cache, fsec);
 307 }
 308
 309 static int superblock_alloc_security(struct super_block *sb)
 310 {
 311         struct superblock_security_struct *sbsec;
 312
 313         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 314         if (!sbsec)
 315                 return -ENOMEM;
 316
 317         mutex_init(&sbsec->lock);
 318         INIT_LIST_HEAD(&sbsec->isec_head);
 319         spin_lock_init(&sbsec->isec_lock);
 320         sbsec->sb = sb;
 321         sbsec->sid = SECINITSID_UNLABELED;
 322         sbsec->def_sid = SECINITSID_FILE;
 323         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 324         sb->s_security = sbsec;
 325
 326         return 0;
 327 }
 328
 329 static void superblock_free_security(struct super_block *sb)
 330 {
 331         struct superblock_security_struct *sbsec = sb->s_security;
 332         sb->s_security = NULL;
 333         kfree(sbsec);
 334 }
 335
 336 /* The file system's label must be initialized prior to use. */
 337
 338 static const char *labeling_behaviors[7] = {
 339         "uses xattr",
 340         "uses transition SIDs",
 341         "uses task SIDs",
 342         "uses genfs_contexts",
 343         "not configured for labeling",
 344         "uses mountpoint labeling",
 345         "uses native labeling",
 346 };
 347
 348 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 349
 350 static inline int inode_doinit(struct inode *inode)
 351 {
 352         return inode_doinit_with_dentry(inode, NULL);
 353 }
 354
 355 enum {
 356         Opt_error = -1,
 357         Opt_context = 1,
 358         Opt_fscontext = 2,
 359         Opt_defcontext = 3,
 360         Opt_rootcontext = 4,
 361         Opt_labelsupport = 5,
 362         Opt_nextmntopt = 6,
 363 };
 364
 365 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 366
 367 static const match_table_t tokens = {
 368         {Opt_context, CONTEXT_STR "%s"},
 369         {Opt_fscontext, FSCONTEXT_STR "%s"},
 370         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 371         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 372         {Opt_labelsupport, LABELSUPP_STR},
 373         {Opt_error, NULL},
 374 };
 375
 376 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 377
 378 static int may_context_mount_sb_relabel(u32 sid,
 379                         struct superblock_security_struct *sbsec,
 380                         const struct cred *cred)
 381 {
 382         const struct task_security_struct *tsec = cred->security;
 383         int rc;
 384
 385         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 386                           FILESYSTEM__RELABELFROM, NULL);
 387         if (rc)
 388                 return rc;
 389
 390         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 391                           FILESYSTEM__RELABELTO, NULL);
 392         return rc;
 393 }
 394
 395 static int may_context_mount_inode_relabel(u32 sid,
 396                         struct superblock_security_struct *sbsec,
 397                         const struct cred *cred)
 398 {
 399         const struct task_security_struct *tsec = cred->security;
 400         int rc;
 401         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 402                           FILESYSTEM__RELABELFROM, NULL);
 403         if (rc)
 404                 return rc;
 405
 406         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 407                           FILESYSTEM__ASSOCIATE, NULL);
 408         return rc;
 409 }
 410
 411 static int selinux_is_sblabel_mnt(struct super_block *sb)
 412 {
 413         struct superblock_security_struct *sbsec = sb->s_security;
 414
 415         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 416                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 417                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 418                 sbsec->behavior == SECURITY_FS_USE_NATIVE ||
 419                 /* Special handling. Genfs but also in-core setxattr handler */
 420                 !strcmp(sb->s_type->name, "sysfs") ||
 421                 !strcmp(sb->s_type->name, "pstore") ||
 422                 !strcmp(sb->s_type->name, "debugfs") ||
 423                 !strcmp(sb->s_type->name, "rootfs");
 424 }
 425
 426 static int sb_finish_set_opts(struct super_block *sb)
 427 {
 428         struct superblock_security_struct *sbsec = sb->s_security;
 429         struct dentry *root = sb->s_root;
 430         struct inode *root_inode = d_backing_inode(root);
 431         int rc = 0;
 432
 433         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 434                 /* Make sure that the xattr handler exists and that no
 435                    error other than -ENODATA is returned by getxattr on
 436                    the root directory.  -ENODATA is ok, as this may be
 437                    the first boot of the SELinux kernel before we have
 438                    assigned xattr values to the filesystem. */
 439                 if (!root_inode->i_op->getxattr) {
 440                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 441                                "xattr support\n", sb->s_id, sb->s_type->name);
 442                         rc = -EOPNOTSUPP;
 443                         goto out;
 444                 }
 445                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 446                 if (rc < 0 && rc != -ENODATA) {
 447                         if (rc == -EOPNOTSUPP)
 448                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 449                                        "%s) has no security xattr handler\n",
 450                                        sb->s_id, sb->s_type->name);
 451                         else
 452                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 453                                        "%s) getxattr errno %d\n", sb->s_id,
 454                                        sb->s_type->name, -rc);
 455                         goto out;
 456                 }
 457         }
 458
 459         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 460                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 461                        sb->s_id, sb->s_type->name);
 462
 463         sbsec->flags |= SE_SBINITIALIZED;
 464         if (selinux_is_sblabel_mnt(sb))
 465                 sbsec->flags |= SBLABEL_MNT;
 466
 467         /* Initialize the root inode. */
 468         rc = inode_doinit_with_dentry(root_inode, root);
 469
 470         /* Initialize any other inodes associated with the superblock, e.g.
 471            inodes created prior to initial policy load or inodes created
 472            during get_sb by a pseudo filesystem that directly
 473            populates itself. */
 474         spin_lock(&sbsec->isec_lock);
 475 next_inode:
 476         if (!list_empty(&sbsec->isec_head)) {
 477                 struct inode_security_struct *isec =
 478                                 list_entry(sbsec->isec_head.next,
 479                                            struct inode_security_struct, list);
 480                 struct inode *inode = isec->inode;
 481                 list_del_init(&isec->list);
 482                 spin_unlock(&sbsec->isec_lock);
 483                 inode = igrab(inode);
 484                 if (inode) {
 485                         if (!IS_PRIVATE(inode))
 486                                 inode_doinit(inode);
 487                         iput(inode);
 488                 }
 489                 spin_lock(&sbsec->isec_lock);
 490                 goto next_inode;
 491         }
 492         spin_unlock(&sbsec->isec_lock);
 493 out:
 494         return rc;
 495 }
 496
 497 /*
 498  * This function should allow an FS to ask what it's mount security
 499  * options were so it can use those later for submounts, displaying
 500  * mount options, or whatever.
 501  */
 502 static int selinux_get_mnt_opts(const struct super_block *sb,
 503                                 struct security_mnt_opts *opts)
 504 {
 505         int rc = 0, i;
 506         struct superblock_security_struct *sbsec = sb->s_security;
 507         char *context = NULL;
 508         u32 len;
 509         char tmp;
 510
 511         security_init_mnt_opts(opts);
 512
 513         if (!(sbsec->flags & SE_SBINITIALIZED))
 514                 return -EINVAL;
 515
 516         if (!ss_initialized)
 517                 return -EINVAL;
 518
 519         /* make sure we always check enough bits to cover the mask */
 520         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 521
 522         tmp = sbsec->flags & SE_MNTMASK;
 523         /* count the number of mount options for this sb */
 524         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 525                 if (tmp & 0x01)
 526                         opts->num_mnt_opts++;
 527                 tmp >>= 1;
 528         }
 529         /* Check if the Label support flag is set */
 530         if (sbsec->flags & SBLABEL_MNT)
 531                 opts->num_mnt_opts++;
 532
 533         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 534         if (!opts->mnt_opts) {
 535                 rc = -ENOMEM;
 536                 goto out_free;
 537         }
 538
 539         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 540         if (!opts->mnt_opts_flags) {
 541                 rc = -ENOMEM;
 542                 goto out_free;
 543         }
 544
 545         i = 0;
 546         if (sbsec->flags & FSCONTEXT_MNT) {
 547                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 548                 if (rc)
 549                         goto out_free;
 550                 opts->mnt_opts[i] = context;
 551                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 552         }
 553         if (sbsec->flags & CONTEXT_MNT) {
 554                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 555                 if (rc)
 556                         goto out_free;
 557                 opts->mnt_opts[i] = context;
 558                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 559         }
 560         if (sbsec->flags & DEFCONTEXT_MNT) {
 561                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 562                 if (rc)
 563                         goto out_free;
 564                 opts->mnt_opts[i] = context;
 565                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 566         }
 567         if (sbsec->flags & ROOTCONTEXT_MNT) {
 568                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 569                 struct inode_security_struct *isec = root->i_security;
 570
 571                 rc = security_sid_to_context(isec->sid, &context, &len);
 572                 if (rc)
 573                         goto out_free;
 574                 opts->mnt_opts[i] = context;
 575                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 576         }
 577         if (sbsec->flags & SBLABEL_MNT) {
 578                 opts->mnt_opts[i] = NULL;
 579                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 580         }
 581
 582         BUG_ON(i != opts->num_mnt_opts);
 583
 584         return 0;
 585
 586 out_free:
 587         security_free_mnt_opts(opts);
 588         return rc;
 589 }
 590
 591 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 592                       u32 old_sid, u32 new_sid)
 593 {
 594         char mnt_flags = sbsec->flags & SE_MNTMASK;
 595
 596         /* check if the old mount command had the same options */
 597         if (sbsec->flags & SE_SBINITIALIZED)
 598                 if (!(sbsec->flags & flag) ||
 599                     (old_sid != new_sid))
 600                         return 1;
 601
 602         /* check if we were passed the same options twice,
 603          * aka someone passed context=a,context=b
 604          */
 605         if (!(sbsec->flags & SE_SBINITIALIZED))
 606                 if (mnt_flags & flag)
 607                         return 1;
 608         return 0;
 609 }
 610
 611 /*
 612  * Allow filesystems with binary mount data to explicitly set mount point
 613  * labeling information.
 614  */
 615 static int selinux_set_mnt_opts(struct super_block *sb,
 616                                 struct security_mnt_opts *opts,
 617                                 unsigned long kern_flags,
 618                                 unsigned long *set_kern_flags)
 619 {
 620         const struct cred *cred = current_cred();
 621         int rc = 0, i;
 622         struct superblock_security_struct *sbsec = sb->s_security;
 623         const char *name = sb->s_type->name;
 624         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 625         struct inode_security_struct *root_isec = inode->i_security;
 626         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 627         u32 defcontext_sid = 0;
 628         char **mount_options = opts->mnt_opts;
 629         int *flags = opts->mnt_opts_flags;
 630         int num_opts = opts->num_mnt_opts;
 631
 632         mutex_lock(&sbsec->lock);
 633
 634         if (!ss_initialized) {
 635                 if (!num_opts) {
 636                         /* Defer initialization until selinux_complete_init,
 637                            after the initial policy is loaded and the security
 638                            server is ready to handle calls. */
 639                         goto out;
 640                 }
 641                 rc = -EINVAL;
 642                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 643                         "before the security server is initialized\n");
 644                 goto out;
 645         }
 646         if (kern_flags && !set_kern_flags) {
 647                 /* Specifying internal flags without providing a place to
 648                  * place the results is not allowed */
 649                 rc = -EINVAL;
 650                 goto out;
 651         }
 652
 653         /*
 654          * Binary mount data FS will come through this function twice.  Once
 655          * from an explicit call and once from the generic calls from the vfs.
 656          * Since the generic VFS calls will not contain any security mount data
 657          * we need to skip the double mount verification.
 658          *
 659          * This does open a hole in which we will not notice if the first
 660          * mount using this sb set explict options and a second mount using
 661          * this sb does not set any security options.  (The first options
 662          * will be used for both mounts)
 663          */
 664         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 665             && (num_opts == 0))
 666                 goto out;
 667
 668         /*
 669          * parse the mount options, check if they are valid sids.
 670          * also check if someone is trying to mount the same sb more
 671          * than once with different security options.
 672          */
 673         for (i = 0; i < num_opts; i++) {
 674                 u32 sid;
 675
 676                 if (flags[i] == SBLABEL_MNT)
 677                         continue;
 678                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
 679                 if (rc) {
 680                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
 681                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 682                                mount_options[i], sb->s_id, name, rc);
 683                         goto out;
 684                 }
 685                 switch (flags[i]) {
 686                 case FSCONTEXT_MNT:
 687                         fscontext_sid = sid;
 688
 689                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 690                                         fscontext_sid))
 691                                 goto out_double_mount;
 692
 693                         sbsec->flags |= FSCONTEXT_MNT;
 694                         break;
 695                 case CONTEXT_MNT:
 696                         context_sid = sid;
 697
 698                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 699                                         context_sid))
 700                                 goto out_double_mount;
 701
 702                         sbsec->flags |= CONTEXT_MNT;
 703                         break;
 704                 case ROOTCONTEXT_MNT:
 705                         rootcontext_sid = sid;
 706
 707                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 708                                         rootcontext_sid))
 709                                 goto out_double_mount;
 710
 711                         sbsec->flags |= ROOTCONTEXT_MNT;
 712
 713                         break;
 714                 case DEFCONTEXT_MNT:
 715                         defcontext_sid = sid;
 716
 717                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 718                                         defcontext_sid))
 719                                 goto out_double_mount;
 720
 721                         sbsec->flags |= DEFCONTEXT_MNT;
 722
 723                         break;
 724                 default:
 725                         rc = -EINVAL;
 726                         goto out;
 727                 }
 728         }
 729
 730         if (sbsec->flags & SE_SBINITIALIZED) {
 731                 /* previously mounted with options, but not on this attempt? */
 732                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 733                         goto out_double_mount;
 734                 rc = 0;
 735                 goto out;
 736         }
 737
 738         if (strcmp(sb->s_type->name, "proc") == 0)
 739                 sbsec->flags |= SE_SBPROC | SE_SBGENFS;
 740
 741         if (!strcmp(sb->s_type->name, "debugfs") ||
 742             !strcmp(sb->s_type->name, "sysfs") ||
 743             !strcmp(sb->s_type->name, "pstore"))
 744                 sbsec->flags |= SE_SBGENFS;
 745
 746         if (!sbsec->behavior) {
 747                 /*
 748                  * Determine the labeling behavior to use for this
 749                  * filesystem type.
 750                  */
 751                 rc = security_fs_use(sb);
 752                 if (rc) {
 753                         printk(KERN_WARNING
 754                                 "%s: security_fs_use(%s) returned %d\n",
 755                                         __func__, sb->s_type->name, rc);
 756                         goto out;
 757                 }
 758         }
 759         /* sets the context of the superblock for the fs being mounted. */
 760         if (fscontext_sid) {
 761                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 762                 if (rc)
 763                         goto out;
 764
 765                 sbsec->sid = fscontext_sid;
 766         }
 767
 768         /*
 769          * Switch to using mount point labeling behavior.
 770          * sets the label used on all file below the mountpoint, and will set
 771          * the superblock context if not already set.
 772          */
 773         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 774                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 775                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 776         }
 777
 778         if (context_sid) {
 779                 if (!fscontext_sid) {
 780                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 781                                                           cred);
 782                         if (rc)
 783                                 goto out;
 784                         sbsec->sid = context_sid;
 785                 } else {
 786                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 787                                                              cred);
 788                         if (rc)
 789                                 goto out;
 790                 }
 791                 if (!rootcontext_sid)
 792                         rootcontext_sid = context_sid;
 793
 794                 sbsec->mntpoint_sid = context_sid;
 795                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 796         }
 797
 798         if (rootcontext_sid) {
 799                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 800                                                      cred);
 801                 if (rc)
 802                         goto out;
 803
 804                 root_isec->sid = rootcontext_sid;
 805                 root_isec->initialized = 1;
 806         }
 807
 808         if (defcontext_sid) {
 809                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 810                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 811                         rc = -EINVAL;
 812                         printk(KERN_WARNING "SELinux: defcontext option is "
 813                                "invalid for this filesystem type\n");
 814                         goto out;
 815                 }
 816
 817                 if (defcontext_sid != sbsec->def_sid) {
 818                         rc = may_context_mount_inode_relabel(defcontext_sid,
 819                                                              sbsec, cred);
 820                         if (rc)
 821                                 goto out;
 822                 }
 823
 824                 sbsec->def_sid = defcontext_sid;
 825         }
 826
 827         rc = sb_finish_set_opts(sb);
 828 out:
 829         mutex_unlock(&sbsec->lock);
 830         return rc;
 831 out_double_mount:
 832         rc = -EINVAL;
 833         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 834                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 835         goto out;
 836 }
 837
 838 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 839                                     const struct super_block *newsb)
 840 {
 841         struct superblock_security_struct *old = oldsb->s_security;
 842         struct superblock_security_struct *new = newsb->s_security;
 843         char oldflags = old->flags & SE_MNTMASK;
 844         char newflags = new->flags & SE_MNTMASK;
 845
 846         if (oldflags != newflags)
 847                 goto mismatch;
 848         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 849                 goto mismatch;
 850         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 851                 goto mismatch;
 852         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 853                 goto mismatch;
 854         if (oldflags & ROOTCONTEXT_MNT) {
 855                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 856                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 857                 if (oldroot->sid != newroot->sid)
 858                         goto mismatch;
 859         }
 860         return 0;
 861 mismatch:
 862         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 863                             "different security settings for (dev %s, "
 864                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 865         return -EBUSY;
 866 }
 867
 868 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 869                                         struct super_block *newsb)
 870 {
 871         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 872         struct superblock_security_struct *newsbsec = newsb->s_security;
 873
 874         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 875         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 876         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 877
 878         /*
 879          * if the parent was able to be mounted it clearly had no special lsm
 880          * mount options.  thus we can safely deal with this superblock later
 881          */
 882         if (!ss_initialized)
 883                 return 0;
 884
 885         /* how can we clone if the old one wasn't set up?? */
 886         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 887
 888         /* if fs is reusing a sb, make sure that the contexts match */
 889         if (newsbsec->flags & SE_SBINITIALIZED)
 890                 return selinux_cmp_sb_context(oldsb, newsb);
 891
 892         mutex_lock(&newsbsec->lock);
 893
 894         newsbsec->flags = oldsbsec->flags;
 895
 896         newsbsec->sid = oldsbsec->sid;
 897         newsbsec->def_sid = oldsbsec->def_sid;
 898         newsbsec->behavior = oldsbsec->behavior;
 899
 900         if (set_context) {
 901                 u32 sid = oldsbsec->mntpoint_sid;
 902
 903                 if (!set_fscontext)
 904                         newsbsec->sid = sid;
 905                 if (!set_rootcontext) {
 906                         struct inode *newinode = d_backing_inode(newsb->s_root);
 907                         struct inode_security_struct *newisec = newinode->i_security;
 908                         newisec->sid = sid;
 909                 }
 910                 newsbsec->mntpoint_sid = sid;
 911         }
 912         if (set_rootcontext) {
 913                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 914                 const struct inode_security_struct *oldisec = oldinode->i_security;
 915                 struct inode *newinode = d_backing_inode(newsb->s_root);
 916                 struct inode_security_struct *newisec = newinode->i_security;
 917
 918                 newisec->sid = oldisec->sid;
 919         }
 920
 921         sb_finish_set_opts(newsb);
 922         mutex_unlock(&newsbsec->lock);
 923         return 0;
 924 }
 925
 926 static int selinux_parse_opts_str(char *options,
 927                                   struct security_mnt_opts *opts)
 928 {
 929         char *p;
 930         char *context = NULL, *defcontext = NULL;
 931         char *fscontext = NULL, *rootcontext = NULL;
 932         int rc, num_mnt_opts = 0;
 933
 934         opts->num_mnt_opts = 0;
 935
 936         /* Standard string-based options. */
 937         while ((p = strsep(&options, "|")) != NULL) {
 938                 int token;
 939                 substring_t args[MAX_OPT_ARGS];
 940
 941                 if (!*p)
 942                         continue;
 943
 944                 token = match_token(p, tokens, args);
 945
 946                 switch (token) {
 947                 case Opt_context:
 948                         if (context || defcontext) {
 949                                 rc = -EINVAL;
 950                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 951                                 goto out_err;
 952                         }
 953                         context = match_strdup(&args[0]);
 954                         if (!context) {
 955                                 rc = -ENOMEM;
 956                                 goto out_err;
 957                         }
 958                         break;
 959
 960                 case Opt_fscontext:
 961                         if (fscontext) {
 962                                 rc = -EINVAL;
 963                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 964                                 goto out_err;
 965                         }
 966                         fscontext = match_strdup(&args[0]);
 967                         if (!fscontext) {
 968                                 rc = -ENOMEM;
 969                                 goto out_err;
 970                         }
 971                         break;
 972
 973                 case Opt_rootcontext:
 974                         if (rootcontext) {
 975                                 rc = -EINVAL;
 976                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 977                                 goto out_err;
 978                         }
 979                         rootcontext = match_strdup(&args[0]);
 980                         if (!rootcontext) {
 981                                 rc = -ENOMEM;
 982                                 goto out_err;
 983                         }
 984                         break;
 985
 986                 case Opt_defcontext:
 987                         if (context || defcontext) {
 988                                 rc = -EINVAL;
 989                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 990                                 goto out_err;
 991                         }
 992                         defcontext = match_strdup(&args[0]);
 993                         if (!defcontext) {
 994                                 rc = -ENOMEM;
 995                                 goto out_err;
 996                         }
 997                         break;
 998                 case Opt_labelsupport:
 999                         break;
1000                 default:
1001                         rc = -EINVAL;
1002                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
1003                         goto out_err;
1004
1005                 }
1006         }
1007
1008         rc = -ENOMEM;
1009         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
1010         if (!opts->mnt_opts)
1011                 goto out_err;
1012
1013         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
1014         if (!opts->mnt_opts_flags) {
1015                 kfree(opts->mnt_opts);
1016                 goto out_err;
1017         }
1018
1019         if (fscontext) {
1020                 opts->mnt_opts[num_mnt_opts] = fscontext;
1021                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1022         }
1023         if (context) {
1024                 opts->mnt_opts[num_mnt_opts] = context;
1025                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1026         }
1027         if (rootcontext) {
1028                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1029                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1030         }
1031         if (defcontext) {
1032                 opts->mnt_opts[num_mnt_opts] = defcontext;
1033                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1034         }
1035
1036         opts->num_mnt_opts = num_mnt_opts;
1037         return 0;
1038
1039 out_err:
1040         kfree(context);
1041         kfree(defcontext);
1042         kfree(fscontext);
1043         kfree(rootcontext);
1044         return rc;
1045 }
1046 /*
1047  * string mount options parsing and call set the sbsec
1048  */
1049 static int superblock_doinit(struct super_block *sb, void *data)
1050 {
1051         int rc = 0;
1052         char *options = data;
1053         struct security_mnt_opts opts;
1054
1055         security_init_mnt_opts(&opts);
1056
1057         if (!data)
1058                 goto out;
1059
1060         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1061
1062         rc = selinux_parse_opts_str(options, &opts);
1063         if (rc)
1064                 goto out_err;
1065
1066 out:
1067         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1068
1069 out_err:
1070         security_free_mnt_opts(&opts);
1071         return rc;
1072 }
1073
1074 static void selinux_write_opts(struct seq_file *m,
1075                                struct security_mnt_opts *opts)
1076 {
1077         int i;
1078         char *prefix;
1079
1080         for (i = 0; i < opts->num_mnt_opts; i++) {
1081                 char *has_comma;
1082
1083                 if (opts->mnt_opts[i])
1084                         has_comma = strchr(opts->mnt_opts[i], ',');
1085                 else
1086                         has_comma = NULL;
1087
1088                 switch (opts->mnt_opts_flags[i]) {
1089                 case CONTEXT_MNT:
1090                         prefix = CONTEXT_STR;
1091                         break;
1092                 case FSCONTEXT_MNT:
1093                         prefix = FSCONTEXT_STR;
1094                         break;
1095                 case ROOTCONTEXT_MNT:
1096                         prefix = ROOTCONTEXT_STR;
1097                         break;
1098                 case DEFCONTEXT_MNT:
1099                         prefix = DEFCONTEXT_STR;
1100                         break;
1101                 case SBLABEL_MNT:
1102                         seq_putc(m, ',');
1103                         seq_puts(m, LABELSUPP_STR);
1104                         continue;
1105                 default:
1106                         BUG();
1107                         return;
1108                 };
1109                 /* we need a comma before each option */
1110                 seq_putc(m, ',');
1111                 seq_puts(m, prefix);
1112                 if (has_comma)
1113                         seq_putc(m, '\"');
1114                 seq_escape(m, opts->mnt_opts[i], "\"\n\\");
1115                 if (has_comma)
1116                         seq_putc(m, '\"');
1117         }
1118 }
1119
1120 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1121 {
1122         struct security_mnt_opts opts;
1123         int rc;
1124
1125         rc = selinux_get_mnt_opts(sb, &opts);
1126         if (rc) {
1127                 /* before policy load we may get EINVAL, don't show anything */
1128                 if (rc == -EINVAL)
1129                         rc = 0;
1130                 return rc;
1131         }
1132
1133         selinux_write_opts(m, &opts);
1134
1135         security_free_mnt_opts(&opts);
1136
1137         return rc;
1138 }
1139
1140 static inline u16 inode_mode_to_security_class(umode_t mode)
1141 {
1142         switch (mode & S_IFMT) {
1143         case S_IFSOCK:
1144                 return SECCLASS_SOCK_FILE;
1145         case S_IFLNK:
1146                 return SECCLASS_LNK_FILE;
1147         case S_IFREG:
1148                 return SECCLASS_FILE;
1149         case S_IFBLK:
1150                 return SECCLASS_BLK_FILE;
1151         case S_IFDIR:
1152                 return SECCLASS_DIR;
1153         case S_IFCHR:
1154                 return SECCLASS_CHR_FILE;
1155         case S_IFIFO:
1156                 return SECCLASS_FIFO_FILE;
1157
1158         }
1159
1160         return SECCLASS_FILE;
1161 }
1162
1163 static inline int default_protocol_stream(int protocol)
1164 {
1165         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1166 }
1167
1168 static inline int default_protocol_dgram(int protocol)
1169 {
1170         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1171 }
1172
1173 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1174 {
1175         switch (family) {
1176         case PF_UNIX:
1177                 switch (type) {
1178                 case SOCK_STREAM:
1179                 case SOCK_SEQPACKET:
1180                         return SECCLASS_UNIX_STREAM_SOCKET;
1181                 case SOCK_DGRAM:
1182                         return SECCLASS_UNIX_DGRAM_SOCKET;
1183                 }
1184                 break;
1185         case PF_INET:
1186         case PF_INET6:
1187                 switch (type) {
1188                 case SOCK_STREAM:
1189                         if (default_protocol_stream(protocol))
1190                                 return SECCLASS_TCP_SOCKET;
1191                         else
1192                                 return SECCLASS_RAWIP_SOCKET;
1193                 case SOCK_DGRAM:
1194                         if (default_protocol_dgram(protocol))
1195                                 return SECCLASS_UDP_SOCKET;
1196                         else
1197                                 return SECCLASS_RAWIP_SOCKET;
1198                 case SOCK_DCCP:
1199                         return SECCLASS_DCCP_SOCKET;
1200                 default:
1201                         return SECCLASS_RAWIP_SOCKET;
1202                 }
1203                 break;
1204         case PF_NETLINK:
1205                 switch (protocol) {
1206                 case NETLINK_ROUTE:
1207                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1208                 case NETLINK_SOCK_DIAG:
1209                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1210                 case NETLINK_NFLOG:
1211                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1212                 case NETLINK_XFRM:
1213                         return SECCLASS_NETLINK_XFRM_SOCKET;
1214                 case NETLINK_SELINUX:
1215                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1216                 case NETLINK_ISCSI:
1217                         return SECCLASS_NETLINK_ISCSI_SOCKET;
1218                 case NETLINK_AUDIT:
1219                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1220                 case NETLINK_FIB_LOOKUP:
1221                         return SECCLASS_NETLINK_FIB_LOOKUP_SOCKET;
1222                 case NETLINK_CONNECTOR:
1223                         return SECCLASS_NETLINK_CONNECTOR_SOCKET;
1224                 case NETLINK_NETFILTER:
1225                         return SECCLASS_NETLINK_NETFILTER_SOCKET;
1226                 case NETLINK_DNRTMSG:
1227                         return SECCLASS_NETLINK_DNRT_SOCKET;
1228                 case NETLINK_KOBJECT_UEVENT:
1229                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1230                 case NETLINK_GENERIC:
1231                         return SECCLASS_NETLINK_GENERIC_SOCKET;
1232                 case NETLINK_SCSITRANSPORT:
1233                         return SECCLASS_NETLINK_SCSITRANSPORT_SOCKET;
1234                 case NETLINK_RDMA:
1235                         return SECCLASS_NETLINK_RDMA_SOCKET;
1236                 case NETLINK_CRYPTO:
1237                         return SECCLASS_NETLINK_CRYPTO_SOCKET;
1238                 default:
1239                         return SECCLASS_NETLINK_SOCKET;
1240                 }
1241         case PF_PACKET:
1242                 return SECCLASS_PACKET_SOCKET;
1243         case PF_KEY:
1244                 return SECCLASS_KEY_SOCKET;
1245         case PF_APPLETALK:
1246                 return SECCLASS_APPLETALK_SOCKET;
1247         }
1248
1249         return SECCLASS_SOCKET;
1250 }
1251
1252 static int selinux_genfs_get_sid(struct dentry *dentry,
1253                                  u16 tclass,
1254                                  u16 flags,
1255                                  u32 *sid)
1256 {
1257         int rc;
1258         struct super_block *sb = dentry->d_inode->i_sb;
1259         char *buffer, *path;
1260
1261         buffer = (char *)__get_free_page(GFP_KERNEL);
1262         if (!buffer)
1263                 return -ENOMEM;
1264
1265         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1266         if (IS_ERR(path))
1267                 rc = PTR_ERR(path);
1268         else {
1269                 if (flags & SE_SBPROC) {
1270                         /* each process gets a /proc/PID/ entry. Strip off the
1271                          * PID part to get a valid selinux labeling.
1272                          * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1273                         while (path[1] >= '0' && path[1] <= '9') {
1274                                 path[1] = '/';
1275                                 path++;
1276                         }
1277                 }
1278                 rc = security_genfs_sid(sb->s_type->name, path, tclass, sid);
1279         }
1280         free_page((unsigned long)buffer);
1281         return rc;
1282 }
1283
1284 /* The inode's security attributes must be initialized before first use. */
1285 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1286 {
1287         struct superblock_security_struct *sbsec = NULL;
1288         struct inode_security_struct *isec = inode->i_security;
1289         u32 sid;
1290         struct dentry *dentry;
1291 #define INITCONTEXTLEN 255
1292         char *context = NULL;
1293         unsigned len = 0;
1294         int rc = 0;
1295
1296         if (isec->initialized)
1297                 goto out;
1298
1299         mutex_lock(&isec->lock);
1300         if (isec->initialized)
1301                 goto out_unlock;
1302
1303         sbsec = inode->i_sb->s_security;
1304         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1305                 /* Defer initialization until selinux_complete_init,
1306                    after the initial policy is loaded and the security
1307                    server is ready to handle calls. */
1308                 spin_lock(&sbsec->isec_lock);
1309                 if (list_empty(&isec->list))
1310                         list_add(&isec->list, &sbsec->isec_head);
1311                 spin_unlock(&sbsec->isec_lock);
1312                 goto out_unlock;
1313         }
1314
1315         switch (sbsec->behavior) {
1316         case SECURITY_FS_USE_NATIVE:
1317                 break;
1318         case SECURITY_FS_USE_XATTR:
1319                 if (!inode->i_op->getxattr) {
1320                         isec->sid = sbsec->def_sid;
1321                         break;
1322                 }
1323
1324                 /* Need a dentry, since the xattr API requires one.
1325                    Life would be simpler if we could just pass the inode. */
1326                 if (opt_dentry) {
1327                         /* Called from d_instantiate or d_splice_alias. */
1328                         dentry = dget(opt_dentry);
1329                 } else {
1330                         /* Called from selinux_complete_init, try to find a dentry. */
1331                         dentry = d_find_alias(inode);
1332                 }
1333                 if (!dentry) {
1334                         /*
1335                          * this is can be hit on boot when a file is accessed
1336                          * before the policy is loaded.  When we load policy we
1337                          * may find inodes that have no dentry on the
1338                          * sbsec->isec_head list.  No reason to complain as these
1339                          * will get fixed up the next time we go through
1340                          * inode_doinit with a dentry, before these inodes could
1341                          * be used again by userspace.
1342                          */
1343                         goto out_unlock;
1344                 }
1345
1346                 len = INITCONTEXTLEN;
1347                 context = kmalloc(len+1, GFP_NOFS);
1348                 if (!context) {
1349                         rc = -ENOMEM;
1350                         dput(dentry);
1351                         goto out_unlock;
1352                 }
1353                 context[len] = '\0';
1354                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1355                                            context, len);
1356                 if (rc == -ERANGE) {
1357                         kfree(context);
1358
1359                         /* Need a larger buffer.  Query for the right size. */
1360                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1361                                                    NULL, 0);
1362                         if (rc < 0) {
1363                                 dput(dentry);
1364                                 goto out_unlock;
1365                         }
1366                         len = rc;
1367                         context = kmalloc(len+1, GFP_NOFS);
1368                         if (!context) {
1369                                 rc = -ENOMEM;
1370                                 dput(dentry);
1371                                 goto out_unlock;
1372                         }
1373                         context[len] = '\0';
1374                         rc = inode->i_op->getxattr(dentry,
1375                                                    XATTR_NAME_SELINUX,
1376                                                    context, len);
1377                 }
1378                 dput(dentry);
1379                 if (rc < 0) {
1380                         if (rc != -ENODATA) {
1381                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1382                                        "%d for dev=%s ino=%ld\n", __func__,
1383                                        -rc, inode->i_sb->s_id, inode->i_ino);
1384                                 kfree(context);
1385                                 goto out_unlock;
1386                         }
1387                         /* Map ENODATA to the default file SID */
1388                         sid = sbsec->def_sid;
1389                         rc = 0;
1390                 } else {
1391                         rc = security_context_to_sid_default(context, rc, &sid,
1392                                                              sbsec->def_sid,
1393                                                              GFP_NOFS);
1394                         if (rc) {
1395                                 char *dev = inode->i_sb->s_id;
1396                                 unsigned long ino = inode->i_ino;
1397
1398                                 if (rc == -EINVAL) {
1399                                         if (printk_ratelimit())
1400                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1401                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1402                                                         "filesystem in question.\n", ino, dev, context);
1403                                 } else {
1404                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1405                                                "returned %d for dev=%s ino=%ld\n",
1406                                                __func__, context, -rc, dev, ino);
1407                                 }
1408                                 kfree(context);
1409                                 /* Leave with the unlabeled SID */
1410                                 rc = 0;
1411                                 break;
1412                         }
1413                 }
1414                 kfree(context);
1415                 isec->sid = sid;
1416                 break;
1417         case SECURITY_FS_USE_TASK:
1418                 isec->sid = isec->task_sid;
1419                 break;
1420         case SECURITY_FS_USE_TRANS:
1421                 /* Default to the fs SID. */
1422                 isec->sid = sbsec->sid;
1423
1424                 /* Try to obtain a transition SID. */
1425                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1426                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1427                                              isec->sclass, NULL, &sid);
1428                 if (rc)
1429                         goto out_unlock;
1430                 isec->sid = sid;
1431                 break;
1432         case SECURITY_FS_USE_MNTPOINT:
1433                 isec->sid = sbsec->mntpoint_sid;
1434                 break;
1435         default:
1436                 /* Default to the fs superblock SID. */
1437                 isec->sid = sbsec->sid;
1438
1439                 if ((sbsec->flags & SE_SBGENFS) && !S_ISLNK(inode->i_mode)) {
1440                         /* We must have a dentry to determine the label on
1441                          * procfs inodes */
1442                         if (opt_dentry)
1443                                 /* Called from d_instantiate or
1444                                  * d_splice_alias. */
1445                                 dentry = dget(opt_dentry);
1446                         else
1447                                 /* Called from selinux_complete_init, try to
1448                                  * find a dentry. */
1449                                 dentry = d_find_alias(inode);
1450                         /*
1451                          * This can be hit on boot when a file is accessed
1452                          * before the policy is loaded.  When we load policy we
1453                          * may find inodes that have no dentry on the
1454                          * sbsec->isec_head list.  No reason to complain as
1455                          * these will get fixed up the next time we go through
1456                          * inode_doinit() with a dentry, before these inodes
1457                          * could be used again by userspace.
1458                          */
1459                         if (!dentry)
1460                                 goto out_unlock;
1461                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1462                         rc = selinux_genfs_get_sid(dentry, isec->sclass,
1463                                                    sbsec->flags, &sid);
1464                         dput(dentry);
1465                         if (rc)
1466                                 goto out_unlock;
1467                         isec->sid = sid;
1468                 }
1469                 break;
1470         }
1471
1472         isec->initialized = 1;
1473
1474 out_unlock:
1475         mutex_unlock(&isec->lock);
1476 out:
1477         if (isec->sclass == SECCLASS_FILE)
1478                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1479         return rc;
1480 }
1481
1482 /* Convert a Linux signal to an access vector. */
1483 static inline u32 signal_to_av(int sig)
1484 {
1485         u32 perm = 0;
1486
1487         switch (sig) {
1488         case SIGCHLD:
1489                 /* Commonly granted from child to parent. */
1490                 perm = PROCESS__SIGCHLD;
1491                 break;
1492         case SIGKILL:
1493                 /* Cannot be caught or ignored */
1494                 perm = PROCESS__SIGKILL;
1495                 break;
1496         case SIGSTOP:
1497                 /* Cannot be caught or ignored */
1498                 perm = PROCESS__SIGSTOP;
1499                 break;
1500         default:
1501                 /* All other signals. */
1502                 perm = PROCESS__SIGNAL;
1503                 break;
1504         }
1505
1506         return perm;
1507 }
1508
1509 /*
1510  * Check permission between a pair of credentials
1511  * fork check, ptrace check, etc.
1512  */
1513 static int cred_has_perm(const struct cred *actor,
1514                          const struct cred *target,
1515                          u32 perms)
1516 {
1517         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1518
1519         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1520 }
1521
1522 /*
1523  * Check permission between a pair of tasks, e.g. signal checks,
1524  * fork check, ptrace check, etc.
1525  * tsk1 is the actor and tsk2 is the target
1526  * - this uses the default subjective creds of tsk1
1527  */
1528 static int task_has_perm(const struct task_struct *tsk1,
1529                          const struct task_struct *tsk2,
1530                          u32 perms)
1531 {
1532         const struct task_security_struct *__tsec1, *__tsec2;
1533         u32 sid1, sid2;
1534
1535         rcu_read_lock();
1536         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1537         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1538         rcu_read_unlock();
1539         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1540 }
1541
1542 /*
1543  * Check permission between current and another task, e.g. signal checks,
1544  * fork check, ptrace check, etc.
1545  * current is the actor and tsk2 is the target
1546  * - this uses current's subjective creds
1547  */
1548 static int current_has_perm(const struct task_struct *tsk,
1549                             u32 perms)
1550 {
1551         u32 sid, tsid;
1552
1553         sid = current_sid();
1554         tsid = task_sid(tsk);
1555         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1556 }
1557
1558 #if CAP_LAST_CAP > 63
1559 #error Fix SELinux to handle capabilities > 63.
1560 #endif
1561
1562 /* Check whether a task is allowed to use a capability. */
1563 static int cred_has_capability(const struct cred *cred,
1564                                int cap, int audit)
1565 {
1566         struct common_audit_data ad;
1567         struct av_decision avd;
1568         u16 sclass;
1569         u32 sid = cred_sid(cred);
1570         u32 av = CAP_TO_MASK(cap);
1571         int rc;
1572
1573         ad.type = LSM_AUDIT_DATA_CAP;
1574         ad.u.cap = cap;
1575
1576         switch (CAP_TO_INDEX(cap)) {
1577         case 0:
1578                 sclass = SECCLASS_CAPABILITY;
1579                 break;
1580         case 1:
1581                 sclass = SECCLASS_CAPABILITY2;
1582                 break;
1583         default:
1584                 printk(KERN_ERR
1585                        "SELinux:  out of range capability %d\n", cap);
1586                 BUG();
1587                 return -EINVAL;
1588         }
1589
1590         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1591         if (audit == SECURITY_CAP_AUDIT) {
1592                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1593                 if (rc2)
1594                         return rc2;
1595         }
1596         return rc;
1597 }
1598
1599 /* Check whether a task is allowed to use a system operation. */
1600 static int task_has_system(struct task_struct *tsk,
1601                            u32 perms)
1602 {
1603         u32 sid = task_sid(tsk);
1604
1605         return avc_has_perm(sid, SECINITSID_KERNEL,
1606                             SECCLASS_SYSTEM, perms, NULL);
1607 }
1608
1609 /* Check whether a task has a particular permission to an inode.
1610    The 'adp' parameter is optional and allows other audit
1611    data to be passed (e.g. the dentry). */
1612 static int inode_has_perm(const struct cred *cred,
1613                           struct inode *inode,
1614                           u32 perms,
1615                           struct common_audit_data *adp)
1616 {
1617         struct inode_security_struct *isec;
1618         u32 sid;
1619
1620         validate_creds(cred);
1621
1622         if (unlikely(IS_PRIVATE(inode)))
1623                 return 0;
1624
1625         sid = cred_sid(cred);
1626         isec = inode->i_security;
1627
1628         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1629 }
1630
1631 /* Same as inode_has_perm, but pass explicit audit data containing
1632    the dentry to help the auditing code to more easily generate the
1633    pathname if needed. */
1634 static inline int dentry_has_perm(const struct cred *cred,
1635                                   struct dentry *dentry,
1636                                   u32 av)
1637 {
1638         struct inode *inode = d_backing_inode(dentry);
1639         struct common_audit_data ad;
1640
1641         ad.type = LSM_AUDIT_DATA_DENTRY;
1642         ad.u.dentry = dentry;
1643         return inode_has_perm(cred, inode, av, &ad);
1644 }
1645
1646 /* Same as inode_has_perm, but pass explicit audit data containing
1647    the path to help the auditing code to more easily generate the
1648    pathname if needed. */
1649 static inline int path_has_perm(const struct cred *cred,
1650                                 const struct path *path,
1651                                 u32 av)
1652 {
1653         struct inode *inode = d_backing_inode(path->dentry);
1654         struct common_audit_data ad;
1655
1656         ad.type = LSM_AUDIT_DATA_PATH;
1657         ad.u.path = *path;
1658         return inode_has_perm(cred, inode, av, &ad);
1659 }
1660
1661 /* Same as path_has_perm, but uses the inode from the file struct. */
1662 static inline int file_path_has_perm(const struct cred *cred,
1663                                      struct file *file,
1664                                      u32 av)
1665 {
1666         struct common_audit_data ad;
1667
1668         ad.type = LSM_AUDIT_DATA_PATH;
1669         ad.u.path = file->f_path;
1670         return inode_has_perm(cred, file_inode(file), av, &ad);
1671 }
1672
1673 /* Check whether a task can use an open file descriptor to
1674    access an inode in a given way.  Check access to the
1675    descriptor itself, and then use dentry_has_perm to
1676    check a particular permission to the file.
1677    Access to the descriptor is implicitly granted if it
1678    has the same SID as the process.  If av is zero, then
1679    access to the file is not checked, e.g. for cases
1680    where only the descriptor is affected like seek. */
1681 static int file_has_perm(const struct cred *cred,
1682                          struct file *file,
1683                          u32 av)
1684 {
1685         struct file_security_struct *fsec = file->f_security;
1686         struct inode *inode = file_inode(file);
1687         struct common_audit_data ad;
1688         u32 sid = cred_sid(cred);
1689         int rc;
1690
1691         ad.type = LSM_AUDIT_DATA_PATH;
1692         ad.u.path = file->f_path;
1693
1694         if (sid != fsec->sid) {
1695                 rc = avc_has_perm(sid, fsec->sid,
1696                                   SECCLASS_FD,
1697                                   FD__USE,
1698                                   &ad);
1699                 if (rc)
1700                         goto out;
1701         }
1702
1703         /* av is zero if only checking access to the descriptor. */
1704         rc = 0;
1705         if (av)
1706                 rc = inode_has_perm(cred, inode, av, &ad);
1707
1708 out:
1709         return rc;
1710 }
1711
1712 /*
1713  * Determine the label for an inode that might be unioned.
1714  */
1715 static int selinux_determine_inode_label(const struct inode *dir,
1716                                          const struct qstr *name,
1717                                          u16 tclass,
1718                                          u32 *_new_isid)
1719 {
1720         const struct superblock_security_struct *sbsec = dir->i_sb->s_security;
1721         const struct inode_security_struct *dsec = dir->i_security;
1722         const struct task_security_struct *tsec = current_security();
1723
1724         if ((sbsec->flags & SE_SBINITIALIZED) &&
1725             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)) {
1726                 *_new_isid = sbsec->mntpoint_sid;
1727         } else if ((sbsec->flags & SBLABEL_MNT) &&
1728                    tsec->create_sid) {
1729                 *_new_isid = tsec->create_sid;
1730         } else {
1731                 return security_transition_sid(tsec->sid, dsec->sid, tclass,
1732                                                name, _new_isid);
1733         }
1734
1735         return 0;
1736 }
1737
1738 /* Check whether a task can create a file. */
1739 static int may_create(struct inode *dir,
1740                       struct dentry *dentry,
1741                       u16 tclass)
1742 {
1743         const struct task_security_struct *tsec = current_security();
1744         struct inode_security_struct *dsec;
1745         struct superblock_security_struct *sbsec;
1746         u32 sid, newsid;
1747         struct common_audit_data ad;
1748         int rc;
1749
1750         dsec = dir->i_security;
1751         sbsec = dir->i_sb->s_security;
1752
1753         sid = tsec->sid;
1754
1755         ad.type = LSM_AUDIT_DATA_DENTRY;
1756         ad.u.dentry = dentry;
1757
1758         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1759                           DIR__ADD_NAME | DIR__SEARCH,
1760                           &ad);
1761         if (rc)
1762                 return rc;
1763
1764         rc = selinux_determine_inode_label(dir, &dentry->d_name, tclass,
1765                                            &newsid);
1766         if (rc)
1767                 return rc;
1768
1769         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1770         if (rc)
1771                 return rc;
1772
1773         return avc_has_perm(newsid, sbsec->sid,
1774                             SECCLASS_FILESYSTEM,
1775                             FILESYSTEM__ASSOCIATE, &ad);
1776 }
1777
1778 /* Check whether a task can create a key. */
1779 static int may_create_key(u32 ksid,
1780                           struct task_struct *ctx)
1781 {
1782         u32 sid = task_sid(ctx);
1783
1784         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1785 }
1786
1787 #define MAY_LINK        0
1788 #define MAY_UNLINK      1
1789 #define MAY_RMDIR       2
1790
1791 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1792 static int may_link(struct inode *dir,
1793                     struct dentry *dentry,
1794                     int kind)
1795
1796 {
1797         struct inode_security_struct *dsec, *isec;
1798         struct common_audit_data ad;
1799         u32 sid = current_sid();
1800         u32 av;
1801         int rc;
1802
1803         dsec = dir->i_security;
1804         isec = d_backing_inode(dentry)->i_security;
1805
1806         ad.type = LSM_AUDIT_DATA_DENTRY;
1807         ad.u.dentry = dentry;
1808
1809         av = DIR__SEARCH;
1810         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1811         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1812         if (rc)
1813                 return rc;
1814
1815         switch (kind) {
1816         case MAY_LINK:
1817                 av = FILE__LINK;
1818                 break;
1819         case MAY_UNLINK:
1820                 av = FILE__UNLINK;
1821                 break;
1822         case MAY_RMDIR:
1823                 av = DIR__RMDIR;
1824                 break;
1825         default:
1826                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1827                         __func__, kind);
1828                 return 0;
1829         }
1830
1831         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1832         return rc;
1833 }
1834
1835 static inline int may_rename(struct inode *old_dir,
1836                              struct dentry *old_dentry,
1837                              struct inode *new_dir,
1838                              struct dentry *new_dentry)
1839 {
1840         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1841         struct common_audit_data ad;
1842         u32 sid = current_sid();
1843         u32 av;
1844         int old_is_dir, new_is_dir;
1845         int rc;
1846
1847         old_dsec = old_dir->i_security;
1848         old_isec = d_backing_inode(old_dentry)->i_security;
1849         old_is_dir = d_is_dir(old_dentry);
1850         new_dsec = new_dir->i_security;
1851
1852         ad.type = LSM_AUDIT_DATA_DENTRY;
1853
1854         ad.u.dentry = old_dentry;
1855         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1856                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1857         if (rc)
1858                 return rc;
1859         rc = avc_has_perm(sid, old_isec->sid,
1860                           old_isec->sclass, FILE__RENAME, &ad);
1861         if (rc)
1862                 return rc;
1863         if (old_is_dir && new_dir != old_dir) {
1864                 rc = avc_has_perm(sid, old_isec->sid,
1865                                   old_isec->sclass, DIR__REPARENT, &ad);
1866                 if (rc)
1867                         return rc;
1868         }
1869
1870         ad.u.dentry = new_dentry;
1871         av = DIR__ADD_NAME | DIR__SEARCH;
1872         if (d_is_positive(new_dentry))
1873                 av |= DIR__REMOVE_NAME;
1874         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1875         if (rc)
1876                 return rc;
1877         if (d_is_positive(new_dentry)) {
1878                 new_isec = d_backing_inode(new_dentry)->i_security;
1879                 new_is_dir = d_is_dir(new_dentry);
1880                 rc = avc_has_perm(sid, new_isec->sid,
1881                                   new_isec->sclass,
1882                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1883                 if (rc)
1884                         return rc;
1885         }
1886
1887         return 0;
1888 }
1889
1890 /* Check whether a task can perform a filesystem operation. */
1891 static int superblock_has_perm(const struct cred *cred,
1892                                struct super_block *sb,
1893                                u32 perms,
1894                                struct common_audit_data *ad)
1895 {
1896         struct superblock_security_struct *sbsec;
1897         u32 sid = cred_sid(cred);
1898
1899         sbsec = sb->s_security;
1900         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1901 }
1902
1903 /* Convert a Linux mode and permission mask to an access vector. */
1904 static inline u32 file_mask_to_av(int mode, int mask)
1905 {
1906         u32 av = 0;
1907
1908         if (!S_ISDIR(mode)) {
1909                 if (mask & MAY_EXEC)
1910                         av |= FILE__EXECUTE;
1911                 if (mask & MAY_READ)
1912                         av |= FILE__READ;
1913
1914                 if (mask & MAY_APPEND)
1915                         av |= FILE__APPEND;
1916                 else if (mask & MAY_WRITE)
1917                         av |= FILE__WRITE;
1918
1919         } else {
1920                 if (mask & MAY_EXEC)
1921                         av |= DIR__SEARCH;
1922                 if (mask & MAY_WRITE)
1923                         av |= DIR__WRITE;
1924                 if (mask & MAY_READ)
1925                         av |= DIR__READ;
1926         }
1927
1928         return av;
1929 }
1930
1931 /* Convert a Linux file to an access vector. */
1932 static inline u32 file_to_av(struct file *file)
1933 {
1934         u32 av = 0;
1935
1936         if (file->f_mode & FMODE_READ)
1937                 av |= FILE__READ;
1938         if (file->f_mode & FMODE_WRITE) {
1939                 if (file->f_flags & O_APPEND)
1940                         av |= FILE__APPEND;
1941                 else
1942                         av |= FILE__WRITE;
1943         }
1944         if (!av) {
1945                 /*
1946                  * Special file opened with flags 3 for ioctl-only use.
1947                  */
1948                 av = FILE__IOCTL;
1949         }
1950
1951         return av;
1952 }
1953
1954 /*
1955  * Convert a file to an access vector and include the correct open
1956  * open permission.
1957  */
1958 static inline u32 open_file_to_av(struct file *file)
1959 {
1960         u32 av = file_to_av(file);
1961
1962         if (selinux_policycap_openperm)
1963                 av |= FILE__OPEN;
1964
1965         return av;
1966 }
1967
1968 /* Hook functions begin here. */
1969
1970 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1971 {
1972         u32 mysid = current_sid();
1973         u32 mgrsid = task_sid(mgr);
1974
1975         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1976                             BINDER__SET_CONTEXT_MGR, NULL);
1977 }
1978
1979 static int selinux_binder_transaction(struct task_struct *from,
1980                                       struct task_struct *to)
1981 {
1982         u32 mysid = current_sid();
1983         u32 fromsid = task_sid(from);
1984         u32 tosid = task_sid(to);
1985         int rc;
1986
1987         if (mysid != fromsid) {
1988                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1989                                   BINDER__IMPERSONATE, NULL);
1990                 if (rc)
1991                         return rc;
1992         }
1993
1994         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1995                             NULL);
1996 }
1997
1998 static int selinux_binder_transfer_binder(struct task_struct *from,
1999                                           struct task_struct *to)
2000 {
2001         u32 fromsid = task_sid(from);
2002         u32 tosid = task_sid(to);
2003
2004         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
2005                             NULL);
2006 }
2007
2008 static int selinux_binder_transfer_file(struct task_struct *from,
2009                                         struct task_struct *to,
2010                                         struct file *file)
2011 {
2012         u32 sid = task_sid(to);
2013         struct file_security_struct *fsec = file->f_security;
2014         struct inode *inode = d_backing_inode(file->f_path.dentry);
2015         struct inode_security_struct *isec = inode->i_security;
2016         struct common_audit_data ad;
2017         int rc;
2018
2019         ad.type = LSM_AUDIT_DATA_PATH;
2020         ad.u.path = file->f_path;
2021
2022         if (sid != fsec->sid) {
2023                 rc = avc_has_perm(sid, fsec->sid,
2024                                   SECCLASS_FD,
2025                                   FD__USE,
2026                                   &ad);
2027                 if (rc)
2028                         return rc;
2029         }
2030
2031         if (unlikely(IS_PRIVATE(inode)))
2032                 return 0;
2033
2034         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
2035                             &ad);
2036 }
2037
2038 static int selinux_ptrace_access_check(struct task_struct *child,
2039                                      unsigned int mode)
2040 {
2041         if (mode & PTRACE_MODE_READ) {
2042                 u32 sid = current_sid();
2043                 u32 csid = task_sid(child);
2044                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2045         }
2046
2047         return current_has_perm(child, PROCESS__PTRACE);
2048 }
2049
2050 static int selinux_ptrace_traceme(struct task_struct *parent)
2051 {
2052         return task_has_perm(parent, current, PROCESS__PTRACE);
2053 }
2054
2055 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2056                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2057 {
2058         return current_has_perm(target, PROCESS__GETCAP);
2059 }
2060
2061 static int selinux_capset(struct cred *new, const struct cred *old,
2062                           const kernel_cap_t *effective,
2063                           const kernel_cap_t *inheritable,
2064                           const kernel_cap_t *permitted)
2065 {
2066         return cred_has_perm(old, new, PROCESS__SETCAP);
2067 }
2068
2069 /*
2070  * (This comment used to live with the selinux_task_setuid hook,
2071  * which was removed).
2072  *
2073  * Since setuid only affects the current process, and since the SELinux
2074  * controls are not based on the Linux identity attributes, SELinux does not
2075  * need to control this operation.  However, SELinux does control the use of
2076  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2077  */
2078
2079 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2080                            int cap, int audit)
2081 {
2082         return cred_has_capability(cred, cap, audit);
2083 }
2084
2085 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2086 {
2087         const struct cred *cred = current_cred();
2088         int rc = 0;
2089
2090         if (!sb)
2091                 return 0;
2092
2093         switch (cmds) {
2094         case Q_SYNC:
2095         case Q_QUOTAON:
2096         case Q_QUOTAOFF:
2097         case Q_SETINFO:
2098         case Q_SETQUOTA:
2099                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2100                 break;
2101         case Q_GETFMT:
2102         case Q_GETINFO:
2103         case Q_GETQUOTA:
2104                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2105                 break;
2106         default:
2107                 rc = 0;  /* let the kernel handle invalid cmds */
2108                 break;
2109         }
2110         return rc;
2111 }
2112
2113 static int selinux_quota_on(struct dentry *dentry)
2114 {
2115         const struct cred *cred = current_cred();
2116
2117         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2118 }
2119
2120 static int selinux_syslog(int type)
2121 {
2122         int rc;
2123
2124         switch (type) {
2125         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2126         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2127                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2128                 break;
2129         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2130         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2131         /* Set level of messages printed to console */
2132         case SYSLOG_ACTION_CONSOLE_LEVEL:
2133                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2134                 break;
2135         case SYSLOG_ACTION_CLOSE:       /* Close log */
2136         case SYSLOG_ACTION_OPEN:        /* Open log */
2137         case SYSLOG_ACTION_READ:        /* Read from log */
2138         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2139         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2140         default:
2141                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2142                 break;
2143         }
2144         return rc;
2145 }
2146
2147 /*
2148  * Check that a process has enough memory to allocate a new virtual
2149  * mapping. 0 means there is enough memory for the allocation to
2150  * succeed and -ENOMEM implies there is not.
2151  *
2152  * Do not audit the selinux permission check, as this is applied to all
2153  * processes that allocate mappings.
2154  */
2155 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2156 {
2157         int rc, cap_sys_admin = 0;
2158
2159         rc = cred_has_capability(current_cred(), CAP_SYS_ADMIN,
2160                                         SECURITY_CAP_NOAUDIT);
2161         if (rc == 0)
2162                 cap_sys_admin = 1;
2163
2164         return cap_sys_admin;
2165 }
2166
2167 /* binprm security operations */
2168
2169 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2170                             const struct task_security_struct *old_tsec,
2171                             const struct task_security_struct *new_tsec)
2172 {
2173         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2174         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2175         int rc;
2176
2177         if (!nnp && !nosuid)
2178                 return 0; /* neither NNP nor nosuid */
2179
2180         if (new_tsec->sid == old_tsec->sid)
2181                 return 0; /* No change in credentials */
2182
2183         /*
2184          * The only transitions we permit under NNP or nosuid
2185          * are transitions to bounded SIDs, i.e. SIDs that are
2186          * guaranteed to only be allowed a subset of the permissions
2187          * of the current SID.
2188          */
2189         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2190         if (rc) {
2191                 /*
2192                  * On failure, preserve the errno values for NNP vs nosuid.
2193                  * NNP:  Operation not permitted for caller.
2194                  * nosuid:  Permission denied to file.
2195                  */
2196                 if (nnp)
2197                         return -EPERM;
2198                 else
2199                         return -EACCES;
2200         }
2201         return 0;
2202 }
2203
2204 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2205 {
2206         const struct task_security_struct *old_tsec;
2207         struct task_security_struct *new_tsec;
2208         struct inode_security_struct *isec;
2209         struct common_audit_data ad;
2210         struct inode *inode = file_inode(bprm->file);
2211         int rc;
2212
2213         /* SELinux context only depends on initial program or script and not
2214          * the script interpreter */
2215         if (bprm->cred_prepared)
2216                 return 0;
2217
2218         old_tsec = current_security();
2219         new_tsec = bprm->cred->security;
2220         isec = inode->i_security;
2221
2222         /* Default to the current task SID. */
2223         new_tsec->sid = old_tsec->sid;
2224         new_tsec->osid = old_tsec->sid;
2225
2226         /* Reset fs, key, and sock SIDs on execve. */
2227         new_tsec->create_sid = 0;
2228         new_tsec->keycreate_sid = 0;
2229         new_tsec->sockcreate_sid = 0;
2230
2231         if (old_tsec->exec_sid) {
2232                 new_tsec->sid = old_tsec->exec_sid;
2233                 /* Reset exec SID on execve. */
2234                 new_tsec->exec_sid = 0;
2235
2236                 /* Fail on NNP or nosuid if not an allowed transition. */
2237                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2238                 if (rc)
2239                         return rc;
2240         } else {
2241                 /* Check for a default transition on this program. */
2242                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2243                                              SECCLASS_PROCESS, NULL,
2244                                              &new_tsec->sid);
2245                 if (rc)
2246                         return rc;
2247
2248                 /*
2249                  * Fallback to old SID on NNP or nosuid if not an allowed
2250                  * transition.
2251                  */
2252                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2253                 if (rc)
2254                         new_tsec->sid = old_tsec->sid;
2255         }
2256
2257         ad.type = LSM_AUDIT_DATA_PATH;
2258         ad.u.path = bprm->file->f_path;
2259
2260         if (new_tsec->sid == old_tsec->sid) {
2261                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2262                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2263                 if (rc)
2264                         return rc;
2265         } else {
2266                 /* Check permissions for the transition. */
2267                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2268                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2269                 if (rc)
2270                         return rc;
2271
2272                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2273                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2274                 if (rc)
2275                         return rc;
2276
2277                 /* Check for shared state */
2278                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2279                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2280                                           SECCLASS_PROCESS, PROCESS__SHARE,
2281                                           NULL);
2282                         if (rc)
2283                                 return -EPERM;
2284                 }
2285
2286                 /* Make sure that anyone attempting to ptrace over a task that
2287                  * changes its SID has the appropriate permit */
2288                 if (bprm->unsafe &
2289                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2290                         struct task_struct *tracer;
2291                         struct task_security_struct *sec;
2292                         u32 ptsid = 0;
2293
2294                         rcu_read_lock();
2295                         tracer = ptrace_parent(current);
2296                         if (likely(tracer != NULL)) {
2297                                 sec = __task_cred(tracer)->security;
2298                                 ptsid = sec->sid;
2299                         }
2300                         rcu_read_unlock();
2301
2302                         if (ptsid != 0) {
2303                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2304                                                   SECCLASS_PROCESS,
2305                                                   PROCESS__PTRACE, NULL);
2306                                 if (rc)
2307                                         return -EPERM;
2308                         }
2309                 }
2310
2311                 /* Clear any possibly unsafe personality bits on exec: */
2312                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2313         }
2314
2315         return 0;
2316 }
2317
2318 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2319 {
2320         const struct task_security_struct *tsec = current_security();
2321         u32 sid, osid;
2322         int atsecure = 0;
2323
2324         sid = tsec->sid;
2325         osid = tsec->osid;
2326
2327         if (osid != sid) {
2328                 /* Enable secure mode for SIDs transitions unless
2329                    the noatsecure permission is granted between
2330                    the two SIDs, i.e. ahp returns 0. */
2331                 atsecure = avc_has_perm(osid, sid,
2332                                         SECCLASS_PROCESS,
2333                                         PROCESS__NOATSECURE, NULL);
2334         }
2335
2336         return !!atsecure;
2337 }
2338
2339 static int match_file(const void *p, struct file *file, unsigned fd)
2340 {
2341         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2342 }
2343
2344 /* Derived from fs/exec.c:flush_old_files. */
2345 static inline void flush_unauthorized_files(const struct cred *cred,
2346                                             struct files_struct *files)
2347 {
2348         struct file *file, *devnull = NULL;
2349         struct tty_struct *tty;
2350         int drop_tty = 0;
2351         unsigned n;
2352
2353         tty = get_current_tty();
2354         if (tty) {
2355                 spin_lock(&tty_files_lock);
2356                 if (!list_empty(&tty->tty_files)) {
2357                         struct tty_file_private *file_priv;
2358
2359                         /* Revalidate access to controlling tty.
2360                            Use file_path_has_perm on the tty path directly
2361                            rather than using file_has_perm, as this particular
2362                            open file may belong to another process and we are
2363                            only interested in the inode-based check here. */
2364                         file_priv = list_first_entry(&tty->tty_files,
2365                                                 struct tty_file_private, list);
2366                         file = file_priv->file;
2367                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2368                                 drop_tty = 1;
2369                 }
2370                 spin_unlock(&tty_files_lock);
2371                 tty_kref_put(tty);
2372         }
2373         /* Reset controlling tty. */
2374         if (drop_tty)
2375                 no_tty();
2376
2377         /* Revalidate access to inherited open files. */
2378         n = iterate_fd(files, 0, match_file, cred);
2379         if (!n) /* none found? */
2380                 return;
2381
2382         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2383         if (IS_ERR(devnull))
2384                 devnull = NULL;
2385         /* replace all the matching ones with this */
2386         do {
2387                 replace_fd(n - 1, devnull, 0);
2388         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2389         if (devnull)
2390                 fput(devnull);
2391 }
2392
2393 /*
2394  * Prepare a process for imminent new credential changes due to exec
2395  */
2396 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2397 {
2398         struct task_security_struct *new_tsec;
2399         struct rlimit *rlim, *initrlim;
2400         int rc, i;
2401
2402         new_tsec = bprm->cred->security;
2403         if (new_tsec->sid == new_tsec->osid)
2404                 return;
2405
2406         /* Close files for which the new task SID is not authorized. */
2407         flush_unauthorized_files(bprm->cred, current->files);
2408
2409         /* Always clear parent death signal on SID transitions. */
2410         current->pdeath_signal = 0;
2411
2412         /* Check whether the new SID can inherit resource limits from the old
2413          * SID.  If not, reset all soft limits to the lower of the current
2414          * task's hard limit and the init task's soft limit.
2415          *
2416          * Note that the setting of hard limits (even to lower them) can be
2417          * controlled by the setrlimit check.  The inclusion of the init task's
2418          * soft limit into the computation is to avoid resetting soft limits
2419          * higher than the default soft limit for cases where the default is
2420          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2421          */
2422         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2423                           PROCESS__RLIMITINH, NULL);
2424         if (rc) {
2425                 /* protect against do_prlimit() */
2426                 task_lock(current);
2427                 for (i = 0; i < RLIM_NLIMITS; i++) {
2428                         rlim = current->signal->rlim + i;
2429                         initrlim = init_task.signal->rlim + i;
2430                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2431                 }
2432                 task_unlock(current);
2433                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2434         }
2435 }
2436
2437 /*
2438  * Clean up the process immediately after the installation of new credentials
2439  * due to exec
2440  */
2441 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2442 {
2443         const struct task_security_struct *tsec = current_security();
2444         struct itimerval itimer;
2445         u32 osid, sid;
2446         int rc, i;
2447
2448         osid = tsec->osid;
2449         sid = tsec->sid;
2450
2451         if (sid == osid)
2452                 return;
2453
2454         /* Check whether the new SID can inherit signal state from the old SID.
2455          * If not, clear itimers to avoid subsequent signal generation and
2456          * flush and unblock signals.
2457          *
2458          * This must occur _after_ the task SID has been updated so that any
2459          * kill done after the flush will be checked against the new SID.
2460          */
2461         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2462         if (rc) {
2463                 memset(&itimer, 0, sizeof itimer);
2464                 for (i = 0; i < 3; i++)
2465                         do_setitimer(i, &itimer, NULL);
2466                 spin_lock_irq(&current->sighand->siglock);
2467                 if (!fatal_signal_pending(current)) {
2468                         flush_sigqueue(&current->pending);
2469                         flush_sigqueue(&current->signal->shared_pending);
2470                         flush_signal_handlers(current, 1);
2471                         sigemptyset(&current->blocked);
2472                         recalc_sigpending();
2473                 }
2474                 spin_unlock_irq(&current->sighand->siglock);
2475         }
2476
2477         /* Wake up the parent if it is waiting so that it can recheck
2478          * wait permission to the new task SID. */
2479         read_lock(&tasklist_lock);
2480         __wake_up_parent(current, current->real_parent);
2481         read_unlock(&tasklist_lock);
2482 }
2483
2484 /* superblock security operations */
2485
2486 static int selinux_sb_alloc_security(struct super_block *sb)
2487 {
2488         return superblock_alloc_security(sb);
2489 }
2490
2491 static void selinux_sb_free_security(struct super_block *sb)
2492 {
2493         superblock_free_security(sb);
2494 }
2495
2496 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2497 {
2498         if (plen > olen)
2499                 return 0;
2500
2501         return !memcmp(prefix, option, plen);
2502 }
2503
2504 static inline int selinux_option(char *option, int len)
2505 {
2506         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2507                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2508                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2509                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2510                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2511 }
2512
2513 static inline void take_option(char **to, char *from, int *first, int len)
2514 {
2515         if (!*first) {
2516                 **to = ',';
2517                 *to += 1;
2518         } else
2519                 *first = 0;
2520         memcpy(*to, from, len);
2521         *to += len;
2522 }
2523
2524 static inline void take_selinux_option(char **to, char *from, int *first,
2525                                        int len)
2526 {
2527         int current_size = 0;
2528
2529         if (!*first) {
2530                 **to = '|';
2531                 *to += 1;
2532         } else
2533                 *first = 0;
2534
2535         while (current_size < len) {
2536                 if (*from != '"') {
2537                         **to = *from;
2538                         *to += 1;
2539                 }
2540                 from += 1;
2541                 current_size += 1;
2542         }
2543 }
2544
2545 static int selinux_sb_copy_data(char *orig, char *copy)
2546 {
2547         int fnosec, fsec, rc = 0;
2548         char *in_save, *in_curr, *in_end;
2549         char *sec_curr, *nosec_save, *nosec;
2550         int open_quote = 0;
2551
2552         in_curr = orig;
2553         sec_curr = copy;
2554
2555         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2556         if (!nosec) {
2557                 rc = -ENOMEM;
2558                 goto out;
2559         }
2560
2561         nosec_save = nosec;
2562         fnosec = fsec = 1;
2563         in_save = in_end = orig;
2564
2565         do {
2566                 if (*in_end == '"')
2567                         open_quote = !open_quote;
2568                 if ((*in_end == ',' && open_quote == 0) ||
2569                                 *in_end == '\0') {
2570                         int len = in_end - in_curr;
2571
2572                         if (selinux_option(in_curr, len))
2573                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2574                         else
2575                                 take_option(&nosec, in_curr, &fnosec, len);
2576
2577                         in_curr = in_end + 1;
2578                 }
2579         } while (*in_end++);
2580
2581         strcpy(in_save, nosec_save);
2582         free_page((unsigned long)nosec_save);
2583 out:
2584         return rc;
2585 }
2586
2587 static int selinux_sb_remount(struct super_block *sb, void *data)
2588 {
2589         int rc, i, *flags;
2590         struct security_mnt_opts opts;
2591         char *secdata, **mount_options;
2592         struct superblock_security_struct *sbsec = sb->s_security;
2593
2594         if (!(sbsec->flags & SE_SBINITIALIZED))
2595                 return 0;
2596
2597         if (!data)
2598                 return 0;
2599
2600         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2601                 return 0;
2602
2603         security_init_mnt_opts(&opts);
2604         secdata = alloc_secdata();
2605         if (!secdata)
2606                 return -ENOMEM;
2607         rc = selinux_sb_copy_data(data, secdata);
2608         if (rc)
2609                 goto out_free_secdata;
2610
2611         rc = selinux_parse_opts_str(secdata, &opts);
2612         if (rc)
2613                 goto out_free_secdata;
2614
2615         mount_options = opts.mnt_opts;
2616         flags = opts.mnt_opts_flags;
2617
2618         for (i = 0; i < opts.num_mnt_opts; i++) {
2619                 u32 sid;
2620
2621                 if (flags[i] == SBLABEL_MNT)
2622                         continue;
2623                 rc = security_context_str_to_sid(mount_options[i], &sid, GFP_KERNEL);
2624                 if (rc) {
2625                         printk(KERN_WARNING "SELinux: security_context_str_to_sid"
2626                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2627                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2628                         goto out_free_opts;
2629                 }
2630                 rc = -EINVAL;
2631                 switch (flags[i]) {
2632                 case FSCONTEXT_MNT:
2633                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2634                                 goto out_bad_option;
2635                         break;
2636                 case CONTEXT_MNT:
2637                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2638                                 goto out_bad_option;
2639                         break;
2640                 case ROOTCONTEXT_MNT: {
2641                         struct inode_security_struct *root_isec;
2642                         root_isec = d_backing_inode(sb->s_root)->i_security;
2643
2644                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2645                                 goto out_bad_option;
2646                         break;
2647                 }
2648                 case DEFCONTEXT_MNT:
2649                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2650                                 goto out_bad_option;
2651                         break;
2652                 default:
2653                         goto out_free_opts;
2654                 }
2655         }
2656
2657         rc = 0;
2658 out_free_opts:
2659         security_free_mnt_opts(&opts);
2660 out_free_secdata:
2661         free_secdata(secdata);
2662         return rc;
2663 out_bad_option:
2664         printk(KERN_WARNING "SELinux: unable to change security options "
2665                "during remount (dev %s, type=%s)\n", sb->s_id,
2666                sb->s_type->name);
2667         goto out_free_opts;
2668 }
2669
2670 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2671 {
2672         const struct cred *cred = current_cred();
2673         struct common_audit_data ad;
2674         int rc;
2675
2676         rc = superblock_doinit(sb, data);
2677         if (rc)
2678                 return rc;
2679
2680         /* Allow all mounts performed by the kernel */
2681         if (flags & MS_KERNMOUNT)
2682                 return 0;
2683
2684         ad.type = LSM_AUDIT_DATA_DENTRY;
2685         ad.u.dentry = sb->s_root;
2686         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2687 }
2688
2689 static int selinux_sb_statfs(struct dentry *dentry)
2690 {
2691         const struct cred *cred = current_cred();
2692         struct common_audit_data ad;
2693
2694         ad.type = LSM_AUDIT_DATA_DENTRY;
2695         ad.u.dentry = dentry->d_sb->s_root;
2696         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2697 }
2698
2699 static int selinux_mount(const char *dev_name,
2700                          struct path *path,
2701                          const char *type,
2702                          unsigned long flags,
2703                          void *data)
2704 {
2705         const struct cred *cred = current_cred();
2706
2707         if (flags & MS_REMOUNT)
2708                 return superblock_has_perm(cred, path->dentry->d_sb,
2709                                            FILESYSTEM__REMOUNT, NULL);
2710         else
2711                 return path_has_perm(cred, path, FILE__MOUNTON);
2712 }
2713
2714 static int selinux_umount(struct vfsmount *mnt, int flags)
2715 {
2716         const struct cred *cred = current_cred();
2717
2718         return superblock_has_perm(cred, mnt->mnt_sb,
2719                                    FILESYSTEM__UNMOUNT, NULL);
2720 }
2721
2722 /* inode security operations */
2723
2724 static int selinux_inode_alloc_security(struct inode *inode)
2725 {
2726         return inode_alloc_security(inode);
2727 }
2728
2729 static void selinux_inode_free_security(struct inode *inode)
2730 {
2731         inode_free_security(inode);
2732 }
2733
2734 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2735                                         struct qstr *name, void **ctx,
2736                                         u32 *ctxlen)
2737 {
2738         u32 newsid;
2739         int rc;
2740
2741         rc = selinux_determine_inode_label(d_inode(dentry->d_parent), name,
2742                                            inode_mode_to_security_class(mode),
2743                                            &newsid);
2744         if (rc)
2745                 return rc;
2746
2747         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2748 }
2749
2750 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2751                                        const struct qstr *qstr,
2752                                        const char **name,
2753                                        void **value, size_t *len)
2754 {
2755         const struct task_security_struct *tsec = current_security();
2756         struct inode_security_struct *dsec;
2757         struct superblock_security_struct *sbsec;
2758         u32 sid, newsid, clen;
2759         int rc;
2760         char *context;
2761
2762         dsec = dir->i_security;
2763         sbsec = dir->i_sb->s_security;
2764
2765         sid = tsec->sid;
2766         newsid = tsec->create_sid;
2767
2768         rc = selinux_determine_inode_label(
2769                 dir, qstr,
2770                 inode_mode_to_security_class(inode->i_mode),
2771                 &newsid);
2772         if (rc)
2773                 return rc;
2774
2775         /* Possibly defer initialization to selinux_complete_init. */
2776         if (sbsec->flags & SE_SBINITIALIZED) {
2777                 struct inode_security_struct *isec = inode->i_security;
2778                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2779                 isec->sid = newsid;
2780                 isec->initialized = 1;
2781         }
2782
2783         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2784                 return -EOPNOTSUPP;
2785
2786         if (name)
2787                 *name = XATTR_SELINUX_SUFFIX;
2788
2789         if (value && len) {
2790                 rc = security_sid_to_context_force(newsid, &context, &clen);
2791                 if (rc)
2792                         return rc;
2793                 *value = context;
2794                 *len = clen;
2795         }
2796
2797         return 0;
2798 }
2799
2800 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2801 {
2802         return may_create(dir, dentry, SECCLASS_FILE);
2803 }
2804
2805 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2806 {
2807         return may_link(dir, old_dentry, MAY_LINK);
2808 }
2809
2810 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2811 {
2812         return may_link(dir, dentry, MAY_UNLINK);
2813 }
2814
2815 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2816 {
2817         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2818 }
2819
2820 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2821 {
2822         return may_create(dir, dentry, SECCLASS_DIR);
2823 }
2824
2825 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2826 {
2827         return may_link(dir, dentry, MAY_RMDIR);
2828 }
2829
2830 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2831 {
2832         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2833 }
2834
2835 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2836                                 struct inode *new_inode, struct dentry *new_dentry)
2837 {
2838         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2839 }
2840
2841 static int selinux_inode_readlink(struct dentry *dentry)
2842 {
2843         const struct cred *cred = current_cred();
2844
2845         return dentry_has_perm(cred, dentry, FILE__READ);
2846 }
2847
2848 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2849                                      bool rcu)
2850 {
2851         const struct cred *cred = current_cred();
2852         struct common_audit_data ad;
2853         struct inode_security_struct *isec;
2854         u32 sid;
2855
2856         validate_creds(cred);
2857
2858         ad.type = LSM_AUDIT_DATA_DENTRY;
2859         ad.u.dentry = dentry;
2860         sid = cred_sid(cred);
2861         isec = inode->i_security;
2862
2863         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2864                                   rcu ? MAY_NOT_BLOCK : 0);
2865 }
2866
2867 static noinline int audit_inode_permission(struct inode *inode,
2868                                            u32 perms, u32 audited, u32 denied,
2869                                            int result,
2870                                            unsigned flags)
2871 {
2872         struct common_audit_data ad;
2873         struct inode_security_struct *isec = inode->i_security;
2874         int rc;
2875
2876         ad.type = LSM_AUDIT_DATA_INODE;
2877         ad.u.inode = inode;
2878
2879         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2880                             audited, denied, result, &ad, flags);
2881         if (rc)
2882                 return rc;
2883         return 0;
2884 }
2885
2886 static int selinux_inode_permission(struct inode *inode, int mask)
2887 {
2888         const struct cred *cred = current_cred();
2889         u32 perms;
2890         bool from_access;
2891         unsigned flags = mask & MAY_NOT_BLOCK;
2892         struct inode_security_struct *isec;
2893         u32 sid;
2894         struct av_decision avd;
2895         int rc, rc2;
2896         u32 audited, denied;
2897
2898         from_access = mask & MAY_ACCESS;
2899         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2900
2901         /* No permission to check.  Existence test. */
2902         if (!mask)
2903                 return 0;
2904
2905         validate_creds(cred);
2906
2907         if (unlikely(IS_PRIVATE(inode)))
2908                 return 0;
2909
2910         perms = file_mask_to_av(inode->i_mode, mask);
2911
2912         sid = cred_sid(cred);
2913         isec = inode->i_security;
2914
2915         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2916         audited = avc_audit_required(perms, &avd, rc,
2917                                      from_access ? FILE__AUDIT_ACCESS : 0,
2918                                      &denied);
2919         if (likely(!audited))
2920                 return rc;
2921
2922         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2923         if (rc2)
2924                 return rc2;
2925         return rc;
2926 }
2927
2928 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2929 {
2930         const struct cred *cred = current_cred();
2931         unsigned int ia_valid = iattr->ia_valid;
2932         __u32 av = FILE__WRITE;
2933
2934         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2935         if (ia_valid & ATTR_FORCE) {
2936                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2937                               ATTR_FORCE);
2938                 if (!ia_valid)
2939                         return 0;
2940         }
2941
2942         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2943                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2944                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2945
2946         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE)
2947                         && !(ia_valid & ATTR_FILE))
2948                 av |= FILE__OPEN;
2949
2950         return dentry_has_perm(cred, dentry, av);
2951 }
2952
2953 static int selinux_inode_getattr(const struct path *path)
2954 {
2955         return path_has_perm(current_cred(), path, FILE__GETATTR);
2956 }
2957
2958 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2959 {
2960         const struct cred *cred = current_cred();
2961
2962         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2963                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2964                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2965                         if (!capable(CAP_SETFCAP))
2966                                 return -EPERM;
2967                 } else if (!capable(CAP_SYS_ADMIN)) {
2968                         /* A different attribute in the security namespace.
2969                            Restrict to administrator. */
2970                         return -EPERM;
2971                 }
2972         }
2973
2974         /* Not an attribute we recognize, so just check the
2975            ordinary setattr permission. */
2976         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2977 }
2978
2979 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2980                                   const void *value, size_t size, int flags)
2981 {
2982         struct inode *inode = d_backing_inode(dentry);
2983         struct inode_security_struct *isec = inode->i_security;
2984         struct superblock_security_struct *sbsec;
2985         struct common_audit_data ad;
2986         u32 newsid, sid = current_sid();
2987         int rc = 0;
2988
2989         if (strcmp(name, XATTR_NAME_SELINUX))
2990                 return selinux_inode_setotherxattr(dentry, name);
2991
2992         sbsec = inode->i_sb->s_security;
2993         if (!(sbsec->flags & SBLABEL_MNT))
2994                 return -EOPNOTSUPP;
2995
2996         if (!inode_owner_or_capable(inode))
2997                 return -EPERM;
2998
2999         ad.type = LSM_AUDIT_DATA_DENTRY;
3000         ad.u.dentry = dentry;
3001
3002         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3003                           FILE__RELABELFROM, &ad);
3004         if (rc)
3005                 return rc;
3006
3007         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3008         if (rc == -EINVAL) {
3009                 if (!capable(CAP_MAC_ADMIN)) {
3010                         struct audit_buffer *ab;
3011                         size_t audit_size;
3012                         const char *str;
3013
3014                         /* We strip a nul only if it is at the end, otherwise the
3015                          * context contains a nul and we should audit that */
3016                         if (value) {
3017                                 str = value;
3018                                 if (str[size - 1] == '\0')
3019                                         audit_size = size - 1;
3020                                 else
3021                                         audit_size = size;
3022                         } else {
3023                                 str = "";
3024                                 audit_size = 0;
3025                         }
3026                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3027                         audit_log_format(ab, "op=setxattr invalid_context=");
3028                         audit_log_n_untrustedstring(ab, value, audit_size);
3029                         audit_log_end(ab);
3030
3031                         return rc;
3032                 }
3033                 rc = security_context_to_sid_force(value, size, &newsid);
3034         }
3035         if (rc)
3036                 return rc;
3037
3038         rc = avc_has_perm(sid, newsid, isec->sclass,
3039                           FILE__RELABELTO, &ad);
3040         if (rc)
3041                 return rc;
3042
3043         rc = security_validate_transition(isec->sid, newsid, sid,
3044                                           isec->sclass);
3045         if (rc)
3046                 return rc;
3047
3048         return avc_has_perm(newsid,
3049                             sbsec->sid,
3050                             SECCLASS_FILESYSTEM,
3051                             FILESYSTEM__ASSOCIATE,
3052                             &ad);
3053 }
3054
3055 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3056                                         const void *value, size_t size,
3057                                         int flags)
3058 {
3059         struct inode *inode = d_backing_inode(dentry);
3060         struct inode_security_struct *isec = inode->i_security;
3061         u32 newsid;
3062         int rc;
3063
3064         if (strcmp(name, XATTR_NAME_SELINUX)) {
3065                 /* Not an attribute we recognize, so nothing to do. */
3066                 return;
3067         }
3068
3069         rc = security_context_to_sid_force(value, size, &newsid);
3070         if (rc) {
3071                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3072                        "for (%s, %lu), rc=%d\n",
3073                        inode->i_sb->s_id, inode->i_ino, -rc);
3074                 return;
3075         }
3076
3077         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3078         isec->sid = newsid;
3079         isec->initialized = 1;
3080
3081         return;
3082 }
3083
3084 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3085 {
3086         const struct cred *cred = current_cred();
3087
3088         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3089 }
3090
3091 static int selinux_inode_listxattr(struct dentry *dentry)
3092 {
3093         const struct cred *cred = current_cred();
3094
3095         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3096 }
3097
3098 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3099 {
3100         if (strcmp(name, XATTR_NAME_SELINUX))
3101                 return selinux_inode_setotherxattr(dentry, name);
3102
3103         /* No one is allowed to remove a SELinux security label.
3104            You can change the label, but all data must be labeled. */
3105         return -EACCES;
3106 }
3107
3108 /*
3109  * Copy the inode security context value to the user.
3110  *
3111  * Permission check is handled by selinux_inode_getxattr hook.
3112  */
3113 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3114 {
3115         u32 size;
3116         int error;
3117         char *context = NULL;
3118         struct inode_security_struct *isec = inode->i_security;
3119
3120         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3121                 return -EOPNOTSUPP;
3122
3123         /*
3124          * If the caller has CAP_MAC_ADMIN, then get the raw context
3125          * value even if it is not defined by current policy; otherwise,
3126          * use the in-core value under current policy.
3127          * Use the non-auditing forms of the permission checks since
3128          * getxattr may be called by unprivileged processes commonly
3129          * and lack of permission just means that we fall back to the
3130          * in-core context value, not a denial.
3131          */
3132         error = cap_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3133                             SECURITY_CAP_NOAUDIT);
3134         if (!error)
3135                 error = cred_has_capability(current_cred(), CAP_MAC_ADMIN,
3136                                             SECURITY_CAP_NOAUDIT);
3137         if (!error)
3138                 error = security_sid_to_context_force(isec->sid, &context,
3139                                                       &size);
3140         else
3141                 error = security_sid_to_context(isec->sid, &context, &size);
3142         if (error)
3143                 return error;
3144         error = size;
3145         if (alloc) {
3146                 *buffer = context;
3147                 goto out_nofree;
3148         }
3149         kfree(context);
3150 out_nofree:
3151         return error;
3152 }
3153
3154 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3155                                      const void *value, size_t size, int flags)
3156 {
3157         struct inode_security_struct *isec = inode->i_security;
3158         u32 newsid;
3159         int rc;
3160
3161         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3162                 return -EOPNOTSUPP;
3163
3164         if (!value || !size)
3165                 return -EACCES;
3166
3167         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3168         if (rc)
3169                 return rc;
3170
3171         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3172         isec->sid = newsid;
3173         isec->initialized = 1;
3174         return 0;
3175 }
3176
3177 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3178 {
3179         const int len = sizeof(XATTR_NAME_SELINUX);
3180         if (buffer && len <= buffer_size)
3181                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3182         return len;
3183 }
3184
3185 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3186 {
3187         struct inode_security_struct *isec = inode->i_security;
3188         *secid = isec->sid;
3189 }
3190
3191 /* file security operations */
3192
3193 static int selinux_revalidate_file_permission(struct file *file, int mask)
3194 {
3195         const struct cred *cred = current_cred();
3196         struct inode *inode = file_inode(file);
3197
3198         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3199         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3200                 mask |= MAY_APPEND;
3201
3202         return file_has_perm(cred, file,
3203                              file_mask_to_av(inode->i_mode, mask));
3204 }
3205
3206 static int selinux_file_permission(struct file *file, int mask)
3207 {
3208         struct inode *inode = file_inode(file);
3209         struct file_security_struct *fsec = file->f_security;
3210         struct inode_security_struct *isec = inode->i_security;
3211         u32 sid = current_sid();
3212
3213         if (!mask)
3214                 /* No permission to check.  Existence test. */
3215                 return 0;
3216
3217         if (sid == fsec->sid && fsec->isid == isec->sid &&
3218             fsec->pseqno == avc_policy_seqno())
3219                 /* No change since file_open check. */
3220                 return 0;
3221
3222         return selinux_revalidate_file_permission(file, mask);
3223 }
3224
3225 static int selinux_file_alloc_security(struct file *file)
3226 {
3227         return file_alloc_security(file);
3228 }
3229
3230 static void selinux_file_free_security(struct file *file)
3231 {
3232         file_free_security(file);
3233 }
3234
3235 /*
3236  * Check whether a task has the ioctl permission and cmd
3237  * operation to an inode.
3238  */
3239 static int ioctl_has_perm(const struct cred *cred, struct file *file,
3240                 u32 requested, u16 cmd)
3241 {
3242         struct common_audit_data ad;
3243         struct file_security_struct *fsec = file->f_security;
3244         struct inode *inode = file_inode(file);
3245         struct inode_security_struct *isec = inode->i_security;
3246         struct lsm_ioctlop_audit ioctl;
3247         u32 ssid = cred_sid(cred);
3248         int rc;
3249         u8 driver = cmd >> 8;
3250         u8 xperm = cmd & 0xff;
3251
3252         ad.type = LSM_AUDIT_DATA_IOCTL_OP;
3253         ad.u.op = &ioctl;
3254         ad.u.op->cmd = cmd;
3255         ad.u.op->path = file->f_path;
3256
3257         if (ssid != fsec->sid) {
3258                 rc = avc_has_perm(ssid, fsec->sid,
3259                                 SECCLASS_FD,
3260                                 FD__USE,
3261                                 &ad);
3262                 if (rc)
3263                         goto out;
3264         }
3265
3266         if (unlikely(IS_PRIVATE(inode)))
3267                 return 0;
3268
3269         rc = avc_has_extended_perms(ssid, isec->sid, isec->sclass,
3270                         requested, driver, xperm, &ad);
3271 out:
3272         return rc;
3273 }
3274
3275 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3276                               unsigned long arg)
3277 {
3278         const struct cred *cred = current_cred();
3279         int error = 0;
3280
3281         switch (cmd) {
3282         case FIONREAD:
3283         /* fall through */
3284         case FIBMAP:
3285         /* fall through */
3286         case FIGETBSZ:
3287         /* fall through */
3288         case FS_IOC_GETFLAGS:
3289         /* fall through */
3290         case FS_IOC_GETVERSION:
3291                 error = file_has_perm(cred, file, FILE__GETATTR);
3292                 break;
3293
3294         case FS_IOC_SETFLAGS:
3295         /* fall through */
3296         case FS_IOC_SETVERSION:
3297                 error = file_has_perm(cred, file, FILE__SETATTR);
3298                 break;
3299
3300         /* sys_ioctl() checks */
3301         case FIONBIO:
3302         /* fall through */
3303         case FIOASYNC:
3304                 error = file_has_perm(cred, file, 0);
3305                 break;
3306
3307         case KDSKBENT:
3308         case KDSKBSENT:
3309                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3310                                             SECURITY_CAP_AUDIT);
3311                 break;
3312
3313         /* default case assumes that the command will go
3314          * to the file's ioctl() function.
3315          */
3316         default:
3317                 error = ioctl_has_perm(cred, file, FILE__IOCTL, (u16) cmd);
3318         }
3319         return error;
3320 }
3321
3322 static int default_noexec;
3323
3324 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3325 {
3326         const struct cred *cred = current_cred();
3327         int rc = 0;
3328
3329         if (default_noexec &&
3330             (prot & PROT_EXEC) && (!file || IS_PRIVATE(file_inode(file)) ||
3331                                    (!shared && (prot & PROT_WRITE)))) {
3332                 /*
3333                  * We are making executable an anonymous mapping or a
3334                  * private file mapping that will also be writable.
3335                  * This has an additional check.
3336                  */
3337                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3338                 if (rc)
3339                         goto error;
3340         }
3341
3342         if (file) {
3343                 /* read access is always possible with a mapping */
3344                 u32 av = FILE__READ;
3345
3346                 /* write access only matters if the mapping is shared */
3347                 if (shared && (prot & PROT_WRITE))
3348                         av |= FILE__WRITE;
3349
3350                 if (prot & PROT_EXEC)
3351                         av |= FILE__EXECUTE;
3352
3353                 return file_has_perm(cred, file, av);
3354         }
3355
3356 error:
3357         return rc;
3358 }
3359
3360 static int selinux_mmap_addr(unsigned long addr)
3361 {
3362         int rc = 0;
3363
3364         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3365                 u32 sid = current_sid();
3366                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3367                                   MEMPROTECT__MMAP_ZERO, NULL);
3368         }
3369
3370         return rc;
3371 }
3372
3373 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3374                              unsigned long prot, unsigned long flags)
3375 {
3376         if (selinux_checkreqprot)
3377                 prot = reqprot;
3378
3379         return file_map_prot_check(file, prot,
3380                                    (flags & MAP_TYPE) == MAP_SHARED);
3381 }
3382
3383 static int selinux_file_mprotect(struct vm_area_struct *vma,
3384                                  unsigned long reqprot,
3385                                  unsigned long prot)
3386 {
3387         const struct cred *cred = current_cred();
3388
3389         if (selinux_checkreqprot)
3390                 prot = reqprot;
3391
3392         if (default_noexec &&
3393             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3394                 int rc = 0;
3395                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3396                     vma->vm_end <= vma->vm_mm->brk) {
3397                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3398                 } else if (!vma->vm_file &&
3399                            vma->vm_start <= vma->vm_mm->start_stack &&
3400                            vma->vm_end >= vma->vm_mm->start_stack) {
3401                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3402                 } else if (vma->vm_file && vma->anon_vma) {
3403                         /*
3404                          * We are making executable a file mapping that has
3405                          * had some COW done. Since pages might have been
3406                          * written, check ability to execute the possibly
3407                          * modified content.  This typically should only
3408                          * occur for text relocations.
3409                          */
3410                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3411                 }
3412                 if (rc)
3413                         return rc;
3414         }
3415
3416         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3417 }
3418
3419 static int selinux_file_lock(struct file *file, unsigned int cmd)
3420 {
3421         const struct cred *cred = current_cred();
3422
3423         return file_has_perm(cred, file, FILE__LOCK);
3424 }
3425
3426 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3427                               unsigned long arg)
3428 {
3429         const struct cred *cred = current_cred();
3430         int err = 0;
3431
3432         switch (cmd) {
3433         case F_SETFL:
3434                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3435                         err = file_has_perm(cred, file, FILE__WRITE);
3436                         break;
3437                 }
3438                 /* fall through */
3439         case F_SETOWN:
3440         case F_SETSIG:
3441         case F_GETFL:
3442         case F_GETOWN:
3443         case F_GETSIG:
3444         case F_GETOWNER_UIDS:
3445                 /* Just check FD__USE permission */
3446                 err = file_has_perm(cred, file, 0);
3447                 break;
3448         case F_GETLK:
3449         case F_SETLK:
3450         case F_SETLKW:
3451         case F_OFD_GETLK:
3452         case F_OFD_SETLK:
3453         case F_OFD_SETLKW:
3454 #if BITS_PER_LONG == 32
3455         case F_GETLK64:
3456         case F_SETLK64:
3457         case F_SETLKW64:
3458 #endif
3459                 err = file_has_perm(cred, file, FILE__LOCK);
3460                 break;
3461         }
3462
3463         return err;
3464 }
3465
3466 static void selinux_file_set_fowner(struct file *file)
3467 {
3468         struct file_security_struct *fsec;
3469
3470         fsec = file->f_security;
3471         fsec->fown_sid = current_sid();
3472 }
3473
3474 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3475                                        struct fown_struct *fown, int signum)
3476 {
3477         struct file *file;
3478         u32 sid = task_sid(tsk);
3479         u32 perm;
3480         struct file_security_struct *fsec;
3481
3482         /* struct fown_struct is never outside the context of a struct file */
3483         file = container_of(fown, struct file, f_owner);
3484
3485         fsec = file->f_security;
3486
3487         if (!signum)
3488                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3489         else
3490                 perm = signal_to_av(signum);
3491
3492         return avc_has_perm(fsec->fown_sid, sid,
3493                             SECCLASS_PROCESS, perm, NULL);
3494 }
3495
3496 static int selinux_file_receive(struct file *file)
3497 {
3498         const struct cred *cred = current_cred();
3499
3500         return file_has_perm(cred, file, file_to_av(file));
3501 }
3502
3503 static int selinux_file_open(struct file *file, const struct cred *cred)
3504 {
3505         struct file_security_struct *fsec;
3506         struct inode_security_struct *isec;
3507
3508         fsec = file->f_security;
3509         isec = file_inode(file)->i_security;
3510         /*
3511          * Save inode label and policy sequence number
3512          * at open-time so that selinux_file_permission
3513          * can determine whether revalidation is necessary.
3514          * Task label is already saved in the file security
3515          * struct as its SID.
3516          */
3517         fsec->isid = isec->sid;
3518         fsec->pseqno = avc_policy_seqno();
3519         /*
3520          * Since the inode label or policy seqno may have changed
3521          * between the selinux_inode_permission check and the saving
3522          * of state above, recheck that access is still permitted.
3523          * Otherwise, access might never be revalidated against the
3524          * new inode label or new policy.
3525          * This check is not redundant - do not remove.
3526          */
3527         return file_path_has_perm(cred, file, open_file_to_av(file));
3528 }
3529
3530 /* task security operations */
3531
3532 static int selinux_task_create(unsigned long clone_flags)
3533 {
3534         return current_has_perm(current, PROCESS__FORK);
3535 }
3536
3537 /*
3538  * allocate the SELinux part of blank credentials
3539  */
3540 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3541 {
3542         struct task_security_struct *tsec;
3543
3544         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3545         if (!tsec)
3546                 return -ENOMEM;
3547
3548         cred->security = tsec;
3549         return 0;
3550 }
3551
3552 /*
3553  * detach and free the LSM part of a set of credentials
3554  */
3555 static void selinux_cred_free(struct cred *cred)
3556 {
3557         struct task_security_struct *tsec = cred->security;
3558
3559         /*
3560          * cred->security == NULL if security_cred_alloc_blank() or
3561          * security_prepare_creds() returned an error.
3562          */
3563         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3564         cred->security = (void *) 0x7UL;
3565         kfree(tsec);
3566 }
3567
3568 /*
3569  * prepare a new set of credentials for modification
3570  */
3571 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3572                                 gfp_t gfp)
3573 {
3574         const struct task_security_struct *old_tsec;
3575         struct task_security_struct *tsec;
3576
3577         old_tsec = old->security;
3578
3579         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3580         if (!tsec)
3581                 return -ENOMEM;
3582
3583         new->security = tsec;
3584         return 0;
3585 }
3586
3587 /*
3588  * transfer the SELinux data to a blank set of creds
3589  */
3590 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3591 {
3592         const struct task_security_struct *old_tsec = old->security;
3593         struct task_security_struct *tsec = new->security;
3594
3595         *tsec = *old_tsec;
3596 }
3597
3598 /*
3599  * set the security data for a kernel service
3600  * - all the creation contexts are set to unlabelled
3601  */
3602 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3603 {
3604         struct task_security_struct *tsec = new->security;
3605         u32 sid = current_sid();
3606         int ret;
3607
3608         ret = avc_has_perm(sid, secid,
3609                            SECCLASS_KERNEL_SERVICE,
3610                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3611                            NULL);
3612         if (ret == 0) {
3613                 tsec->sid = secid;
3614                 tsec->create_sid = 0;
3615                 tsec->keycreate_sid = 0;
3616                 tsec->sockcreate_sid = 0;
3617         }
3618         return ret;
3619 }
3620
3621 /*
3622  * set the file creation context in a security record to the same as the
3623  * objective context of the specified inode
3624  */
3625 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3626 {
3627         struct inode_security_struct *isec = inode->i_security;
3628         struct task_security_struct *tsec = new->security;
3629         u32 sid = current_sid();
3630         int ret;
3631
3632         ret = avc_has_perm(sid, isec->sid,
3633                            SECCLASS_KERNEL_SERVICE,
3634                            KERNEL_SERVICE__CREATE_FILES_AS,
3635                            NULL);
3636
3637         if (ret == 0)
3638                 tsec->create_sid = isec->sid;
3639         return ret;
3640 }
3641
3642 static int selinux_kernel_module_request(char *kmod_name)
3643 {
3644         u32 sid;
3645         struct common_audit_data ad;
3646
3647         sid = task_sid(current);
3648
3649         ad.type = LSM_AUDIT_DATA_KMOD;
3650         ad.u.kmod_name = kmod_name;
3651
3652         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3653                             SYSTEM__MODULE_REQUEST, &ad);
3654 }
3655
3656 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3657 {
3658         return current_has_perm(p, PROCESS__SETPGID);
3659 }
3660
3661 static int selinux_task_getpgid(struct task_struct *p)
3662 {
3663         return current_has_perm(p, PROCESS__GETPGID);
3664 }
3665
3666 static int selinux_task_getsid(struct task_struct *p)
3667 {
3668         return current_has_perm(p, PROCESS__GETSESSION);
3669 }
3670
3671 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3672 {
3673         *secid = task_sid(p);
3674 }
3675
3676 static int selinux_task_setnice(struct task_struct *p, int nice)
3677 {
3678         return current_has_perm(p, PROCESS__SETSCHED);
3679 }
3680
3681 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3682 {
3683         return current_has_perm(p, PROCESS__SETSCHED);
3684 }
3685
3686 static int selinux_task_getioprio(struct task_struct *p)
3687 {
3688         return current_has_perm(p, PROCESS__GETSCHED);
3689 }
3690
3691 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3692                 struct rlimit *new_rlim)
3693 {
3694         struct rlimit *old_rlim = p->signal->rlim + resource;
3695
3696         /* Control the ability to change the hard limit (whether
3697            lowering or raising it), so that the hard limit can
3698            later be used as a safe reset point for the soft limit
3699            upon context transitions.  See selinux_bprm_committing_creds. */
3700         if (old_rlim->rlim_max != new_rlim->rlim_max)
3701                 return current_has_perm(p, PROCESS__SETRLIMIT);
3702
3703         return 0;
3704 }
3705
3706 static int selinux_task_setscheduler(struct task_struct *p)
3707 {
3708         return current_has_perm(p, PROCESS__SETSCHED);
3709 }
3710
3711 static int selinux_task_getscheduler(struct task_struct *p)
3712 {
3713         return current_has_perm(p, PROCESS__GETSCHED);
3714 }
3715
3716 static int selinux_task_movememory(struct task_struct *p)
3717 {
3718         return current_has_perm(p, PROCESS__SETSCHED);
3719 }
3720
3721 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3722                                 int sig, u32 secid)
3723 {
3724         u32 perm;
3725         int rc;
3726
3727         if (!sig)
3728                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3729         else
3730                 perm = signal_to_av(sig);
3731         if (secid)
3732                 rc = avc_has_perm(secid, task_sid(p),
3733                                   SECCLASS_PROCESS, perm, NULL);
3734         else
3735                 rc = current_has_perm(p, perm);
3736         return rc;
3737 }
3738
3739 static int selinux_task_wait(struct task_struct *p)
3740 {
3741         return task_has_perm(p, current, PROCESS__SIGCHLD);
3742 }
3743
3744 static void selinux_task_to_inode(struct task_struct *p,
3745                                   struct inode *inode)
3746 {
3747         struct inode_security_struct *isec = inode->i_security;
3748         u32 sid = task_sid(p);
3749
3750         isec->sid = sid;
3751         isec->initialized = 1;
3752 }
3753
3754 /* Returns error only if unable to parse addresses */
3755 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3756                         struct common_audit_data *ad, u8 *proto)
3757 {
3758         int offset, ihlen, ret = -EINVAL;
3759         struct iphdr _iph, *ih;
3760
3761         offset = skb_network_offset(skb);
3762         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3763         if (ih == NULL)
3764                 goto out;
3765
3766         ihlen = ih->ihl * 4;
3767         if (ihlen < sizeof(_iph))
3768                 goto out;
3769
3770         ad->u.net->v4info.saddr = ih->saddr;
3771         ad->u.net->v4info.daddr = ih->daddr;
3772         ret = 0;
3773
3774         if (proto)
3775                 *proto = ih->protocol;
3776
3777         switch (ih->protocol) {
3778         case IPPROTO_TCP: {
3779                 struct tcphdr _tcph, *th;
3780
3781                 if (ntohs(ih->frag_off) & IP_OFFSET)
3782                         break;
3783
3784                 offset += ihlen;
3785                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3786                 if (th == NULL)
3787                         break;
3788
3789                 ad->u.net->sport = th->source;
3790                 ad->u.net->dport = th->dest;
3791                 break;
3792         }
3793
3794         case IPPROTO_UDP: {
3795                 struct udphdr _udph, *uh;
3796
3797                 if (ntohs(ih->frag_off) & IP_OFFSET)
3798                         break;
3799
3800                 offset += ihlen;
3801                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3802                 if (uh == NULL)
3803                         break;
3804
3805                 ad->u.net->sport = uh->source;
3806                 ad->u.net->dport = uh->dest;
3807                 break;
3808         }
3809
3810         case IPPROTO_DCCP: {
3811                 struct dccp_hdr _dccph, *dh;
3812
3813                 if (ntohs(ih->frag_off) & IP_OFFSET)
3814                         break;
3815
3816                 offset += ihlen;
3817                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3818                 if (dh == NULL)
3819                         break;
3820
3821                 ad->u.net->sport = dh->dccph_sport;
3822                 ad->u.net->dport = dh->dccph_dport;
3823                 break;
3824         }
3825
3826         default:
3827                 break;
3828         }
3829 out:
3830         return ret;
3831 }
3832
3833 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3834
3835 /* Returns error only if unable to parse addresses */
3836 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3837                         struct common_audit_data *ad, u8 *proto)
3838 {
3839         u8 nexthdr;
3840         int ret = -EINVAL, offset;
3841         struct ipv6hdr _ipv6h, *ip6;
3842         __be16 frag_off;
3843
3844         offset = skb_network_offset(skb);
3845         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3846         if (ip6 == NULL)
3847                 goto out;
3848
3849         ad->u.net->v6info.saddr = ip6->saddr;
3850         ad->u.net->v6info.daddr = ip6->daddr;
3851         ret = 0;
3852
3853         nexthdr = ip6->nexthdr;
3854         offset += sizeof(_ipv6h);
3855         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3856         if (offset < 0)
3857                 goto out;
3858
3859         if (proto)
3860                 *proto = nexthdr;
3861
3862         switch (nexthdr) {
3863         case IPPROTO_TCP: {
3864                 struct tcphdr _tcph, *th;
3865
3866                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3867                 if (th == NULL)
3868                         break;
3869
3870                 ad->u.net->sport = th->source;
3871                 ad->u.net->dport = th->dest;
3872                 break;
3873         }
3874
3875         case IPPROTO_UDP: {
3876                 struct udphdr _udph, *uh;
3877
3878                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3879                 if (uh == NULL)
3880                         break;
3881
3882                 ad->u.net->sport = uh->source;
3883                 ad->u.net->dport = uh->dest;
3884                 break;
3885         }
3886
3887         case IPPROTO_DCCP: {
3888                 struct dccp_hdr _dccph, *dh;
3889
3890                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3891                 if (dh == NULL)
3892                         break;
3893
3894                 ad->u.net->sport = dh->dccph_sport;
3895                 ad->u.net->dport = dh->dccph_dport;
3896                 break;
3897         }
3898
3899         /* includes fragments */
3900         default:
3901                 break;
3902         }
3903 out:
3904         return ret;
3905 }
3906
3907 #endif /* IPV6 */
3908
3909 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3910                              char **_addrp, int src, u8 *proto)
3911 {
3912         char *addrp;
3913         int ret;
3914
3915         switch (ad->u.net->family) {
3916         case PF_INET:
3917                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3918                 if (ret)
3919                         goto parse_error;
3920                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3921                                        &ad->u.net->v4info.daddr);
3922                 goto okay;
3923
3924 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3925         case PF_INET6:
3926                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3927                 if (ret)
3928                         goto parse_error;
3929                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3930                                        &ad->u.net->v6info.daddr);
3931                 goto okay;
3932 #endif  /* IPV6 */
3933         default:
3934                 addrp = NULL;
3935                 goto okay;
3936         }
3937
3938 parse_error:
3939         printk(KERN_WARNING
3940                "SELinux: failure in selinux_parse_skb(),"
3941                " unable to parse packet\n");
3942         return ret;
3943
3944 okay:
3945         if (_addrp)
3946                 *_addrp = addrp;
3947         return 0;
3948 }
3949
3950 /**
3951  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3952  * @skb: the packet
3953  * @family: protocol family
3954  * @sid: the packet's peer label SID
3955  *
3956  * Description:
3957  * Check the various different forms of network peer labeling and determine
3958  * the peer label/SID for the packet; most of the magic actually occurs in
3959  * the security server function security_net_peersid_cmp().  The function
3960  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3961  * or -EACCES if @sid is invalid due to inconsistencies with the different
3962  * peer labels.
3963  *
3964  */
3965 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3966 {
3967         int err;
3968         u32 xfrm_sid;
3969         u32 nlbl_sid;
3970         u32 nlbl_type;
3971
3972         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3973         if (unlikely(err))
3974                 return -EACCES;
3975         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3976         if (unlikely(err))
3977                 return -EACCES;
3978
3979         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3980         if (unlikely(err)) {
3981                 printk(KERN_WARNING
3982                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3983                        " unable to determine packet's peer label\n");
3984                 return -EACCES;
3985         }
3986
3987         return 0;
3988 }
3989
3990 /**
3991  * selinux_conn_sid - Determine the child socket label for a connection
3992  * @sk_sid: the parent socket's SID
3993  * @skb_sid: the packet's SID
3994  * @conn_sid: the resulting connection SID
3995  *
3996  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3997  * combined with the MLS information from @skb_sid in order to create
3998  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3999  * of @sk_sid.  Returns zero on success, negative values on failure.
4000  *
4001  */
4002 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
4003 {
4004         int err = 0;
4005
4006         if (skb_sid != SECSID_NULL)
4007                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4008         else
4009                 *conn_sid = sk_sid;
4010
4011         return err;
4012 }
4013
4014 /* socket security operations */
4015
4016 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4017                                  u16 secclass, u32 *socksid)
4018 {
4019         if (tsec->sockcreate_sid > SECSID_NULL) {
4020                 *socksid = tsec->sockcreate_sid;
4021                 return 0;
4022         }
4023
4024         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4025                                        socksid);
4026 }
4027
4028 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4029 {
4030         struct sk_security_struct *sksec = sk->sk_security;
4031         struct common_audit_data ad;
4032         struct lsm_network_audit net = {0,};
4033         u32 tsid = task_sid(task);
4034
4035         if (sksec->sid == SECINITSID_KERNEL)
4036                 return 0;
4037
4038         ad.type = LSM_AUDIT_DATA_NET;
4039         ad.u.net = &net;
4040         ad.u.net->sk = sk;
4041
4042         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4043 }
4044
4045 static int selinux_socket_create(int family, int type,
4046                                  int protocol, int kern)
4047 {
4048         const struct task_security_struct *tsec = current_security();
4049         u32 newsid;
4050         u16 secclass;
4051         int rc;
4052
4053         if (kern)
4054                 return 0;
4055
4056         secclass = socket_type_to_security_class(family, type, protocol);
4057         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4058         if (rc)
4059                 return rc;
4060
4061         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4062 }
4063
4064 static int selinux_socket_post_create(struct socket *sock, int family,
4065                                       int type, int protocol, int kern)
4066 {
4067         const struct task_security_struct *tsec = current_security();
4068         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4069         struct sk_security_struct *sksec;
4070         int err = 0;
4071
4072         isec->sclass = socket_type_to_security_class(family, type, protocol);
4073
4074         if (kern)
4075                 isec->sid = SECINITSID_KERNEL;
4076         else {
4077                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4078                 if (err)
4079                         return err;
4080         }
4081
4082         isec->initialized = 1;
4083
4084         if (sock->sk) {
4085                 sksec = sock->sk->sk_security;
4086                 sksec->sid = isec->sid;
4087                 sksec->sclass = isec->sclass;
4088                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4089         }
4090
4091         return err;
4092 }
4093
4094 /* Range of port numbers used to automatically bind.
4095    Need to determine whether we should perform a name_bind
4096    permission check between the socket and the port number. */
4097
4098 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4099 {
4100         struct sock *sk = sock->sk;
4101         u16 family;
4102         int err;
4103
4104         err = sock_has_perm(current, sk, SOCKET__BIND);
4105         if (err)
4106                 goto out;
4107
4108         /*
4109          * If PF_INET or PF_INET6, check name_bind permission for the port.
4110          * Multiple address binding for SCTP is not supported yet: we just
4111          * check the first address now.
4112          */
4113         family = sk->sk_family;
4114         if (family == PF_INET || family == PF_INET6) {
4115                 char *addrp;
4116                 struct sk_security_struct *sksec = sk->sk_security;
4117                 struct common_audit_data ad;
4118                 struct lsm_network_audit net = {0,};
4119                 struct sockaddr_in *addr4 = NULL;
4120                 struct sockaddr_in6 *addr6 = NULL;
4121                 unsigned short snum;
4122                 u32 sid, node_perm;
4123
4124                 if (family == PF_INET) {
4125                         addr4 = (struct sockaddr_in *)address;
4126                         snum = ntohs(addr4->sin_port);
4127                         addrp = (char *)&addr4->sin_addr.s_addr;
4128                 } else {
4129                         addr6 = (struct sockaddr_in6 *)address;
4130                         snum = ntohs(addr6->sin6_port);
4131                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4132                 }
4133
4134                 if (snum) {
4135                         int low, high;
4136
4137                         inet_get_local_port_range(sock_net(sk), &low, &high);
4138
4139                         if (snum < max(PROT_SOCK, low) || snum > high) {
4140                                 err = sel_netport_sid(sk->sk_protocol,
4141                                                       snum, &sid);
4142                                 if (err)
4143                                         goto out;
4144                                 ad.type = LSM_AUDIT_DATA_NET;
4145                                 ad.u.net = &net;
4146                                 ad.u.net->sport = htons(snum);
4147                                 ad.u.net->family = family;
4148                                 err = avc_has_perm(sksec->sid, sid,
4149                                                    sksec->sclass,
4150                                                    SOCKET__NAME_BIND, &ad);
4151                                 if (err)
4152                                         goto out;
4153                         }
4154                 }
4155
4156                 switch (sksec->sclass) {
4157                 case SECCLASS_TCP_SOCKET:
4158                         node_perm = TCP_SOCKET__NODE_BIND;
4159                         break;
4160
4161                 case SECCLASS_UDP_SOCKET:
4162                         node_perm = UDP_SOCKET__NODE_BIND;
4163                         break;
4164
4165                 case SECCLASS_DCCP_SOCKET:
4166                         node_perm = DCCP_SOCKET__NODE_BIND;
4167                         break;
4168
4169                 default:
4170                         node_perm = RAWIP_SOCKET__NODE_BIND;
4171                         break;
4172                 }
4173
4174                 err = sel_netnode_sid(addrp, family, &sid);
4175                 if (err)
4176                         goto out;
4177
4178                 ad.type = LSM_AUDIT_DATA_NET;
4179                 ad.u.net = &net;
4180                 ad.u.net->sport = htons(snum);
4181                 ad.u.net->family = family;
4182
4183                 if (family == PF_INET)
4184                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4185                 else
4186                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4187
4188                 err = avc_has_perm(sksec->sid, sid,
4189                                    sksec->sclass, node_perm, &ad);
4190                 if (err)
4191                         goto out;
4192         }
4193 out:
4194         return err;
4195 }
4196
4197 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4198 {
4199         struct sock *sk = sock->sk;
4200         struct sk_security_struct *sksec = sk->sk_security;
4201         int err;
4202
4203         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4204         if (err)
4205                 return err;
4206
4207         /*
4208          * If a TCP or DCCP socket, check name_connect permission for the port.
4209          */
4210         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4211             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4212                 struct common_audit_data ad;
4213                 struct lsm_network_audit net = {0,};
4214                 struct sockaddr_in *addr4 = NULL;
4215                 struct sockaddr_in6 *addr6 = NULL;
4216                 unsigned short snum;
4217                 u32 sid, perm;
4218
4219                 if (sk->sk_family == PF_INET) {
4220                         addr4 = (struct sockaddr_in *)address;
4221                         if (addrlen < sizeof(struct sockaddr_in))
4222                                 return -EINVAL;
4223                         snum = ntohs(addr4->sin_port);
4224                 } else {
4225                         addr6 = (struct sockaddr_in6 *)address;
4226                         if (addrlen < SIN6_LEN_RFC2133)
4227                                 return -EINVAL;
4228                         snum = ntohs(addr6->sin6_port);
4229                 }
4230
4231                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4232                 if (err)
4233                         goto out;
4234
4235                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4236                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4237
4238                 ad.type = LSM_AUDIT_DATA_NET;
4239                 ad.u.net = &net;
4240                 ad.u.net->dport = htons(snum);
4241                 ad.u.net->family = sk->sk_family;
4242                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4243                 if (err)
4244                         goto out;
4245         }
4246
4247         err = selinux_netlbl_socket_connect(sk, address);
4248
4249 out:
4250         return err;
4251 }
4252
4253 static int selinux_socket_listen(struct socket *sock, int backlog)
4254 {
4255         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4256 }
4257
4258 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4259 {
4260         int err;
4261         struct inode_security_struct *isec;
4262         struct inode_security_struct *newisec;
4263
4264         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4265         if (err)
4266                 return err;
4267
4268         newisec = SOCK_INODE(newsock)->i_security;
4269
4270         isec = SOCK_INODE(sock)->i_security;
4271         newisec->sclass = isec->sclass;
4272         newisec->sid = isec->sid;
4273         newisec->initialized = 1;
4274
4275         return 0;
4276 }
4277
4278 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4279                                   int size)
4280 {
4281         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4282 }
4283
4284 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4285                                   int size, int flags)
4286 {
4287         return sock_has_perm(current, sock->sk, SOCKET__READ);
4288 }
4289
4290 static int selinux_socket_getsockname(struct socket *sock)
4291 {
4292         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4293 }
4294
4295 static int selinux_socket_getpeername(struct socket *sock)
4296 {
4297         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4298 }
4299
4300 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4301 {
4302         int err;
4303
4304         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4305         if (err)
4306                 return err;
4307
4308         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4309 }
4310
4311 static int selinux_socket_getsockopt(struct socket *sock, int level,
4312                                      int optname)
4313 {
4314         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4315 }
4316
4317 static int selinux_socket_shutdown(struct socket *sock, int how)
4318 {
4319         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4320 }
4321
4322 static int selinux_socket_unix_stream_connect(struct sock *sock,
4323                                               struct sock *other,
4324                                               struct sock *newsk)
4325 {
4326         struct sk_security_struct *sksec_sock = sock->sk_security;
4327         struct sk_security_struct *sksec_other = other->sk_security;
4328         struct sk_security_struct *sksec_new = newsk->sk_security;
4329         struct common_audit_data ad;
4330         struct lsm_network_audit net = {0,};
4331         int err;
4332
4333         ad.type = LSM_AUDIT_DATA_NET;
4334         ad.u.net = &net;
4335         ad.u.net->sk = other;
4336
4337         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4338                            sksec_other->sclass,
4339                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4340         if (err)
4341                 return err;
4342
4343         /* server child socket */
4344         sksec_new->peer_sid = sksec_sock->sid;
4345         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4346                                     &sksec_new->sid);
4347         if (err)
4348                 return err;
4349
4350         /* connecting socket */
4351         sksec_sock->peer_sid = sksec_new->sid;
4352
4353         return 0;
4354 }
4355
4356 static int selinux_socket_unix_may_send(struct socket *sock,
4357                                         struct socket *other)
4358 {
4359         struct sk_security_struct *ssec = sock->sk->sk_security;
4360         struct sk_security_struct *osec = other->sk->sk_security;
4361         struct common_audit_data ad;
4362         struct lsm_network_audit net = {0,};
4363
4364         ad.type = LSM_AUDIT_DATA_NET;
4365         ad.u.net = &net;
4366         ad.u.net->sk = other->sk;
4367
4368         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4369                             &ad);
4370 }
4371
4372 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4373                                     char *addrp, u16 family, u32 peer_sid,
4374                                     struct common_audit_data *ad)
4375 {
4376         int err;
4377         u32 if_sid;
4378         u32 node_sid;
4379
4380         err = sel_netif_sid(ns, ifindex, &if_sid);
4381         if (err)
4382                 return err;
4383         err = avc_has_perm(peer_sid, if_sid,
4384                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4385         if (err)
4386                 return err;
4387
4388         err = sel_netnode_sid(addrp, family, &node_sid);
4389         if (err)
4390                 return err;
4391         return avc_has_perm(peer_sid, node_sid,
4392                             SECCLASS_NODE, NODE__RECVFROM, ad);
4393 }
4394
4395 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4396                                        u16 family)
4397 {
4398         int err = 0;
4399         struct sk_security_struct *sksec = sk->sk_security;
4400         u32 sk_sid = sksec->sid;
4401         struct common_audit_data ad;
4402         struct lsm_network_audit net = {0,};
4403         char *addrp;
4404
4405         ad.type = LSM_AUDIT_DATA_NET;
4406         ad.u.net = &net;
4407         ad.u.net->netif = skb->skb_iif;
4408         ad.u.net->family = family;
4409         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4410         if (err)
4411                 return err;
4412
4413         if (selinux_secmark_enabled()) {
4414                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4415                                    PACKET__RECV, &ad);
4416                 if (err)
4417                         return err;
4418         }
4419
4420         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4421         if (err)
4422                 return err;
4423         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4424
4425         return err;
4426 }
4427
4428 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4429 {
4430         int err;
4431         struct sk_security_struct *sksec = sk->sk_security;
4432         u16 family = sk->sk_family;
4433         u32 sk_sid = sksec->sid;
4434         struct common_audit_data ad;
4435         struct lsm_network_audit net = {0,};
4436         char *addrp;
4437         u8 secmark_active;
4438         u8 peerlbl_active;
4439
4440         if (family != PF_INET && family != PF_INET6)
4441                 return 0;
4442
4443         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4444         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4445                 family = PF_INET;
4446
4447         /* If any sort of compatibility mode is enabled then handoff processing
4448          * to the selinux_sock_rcv_skb_compat() function to deal with the
4449          * special handling.  We do this in an attempt to keep this function
4450          * as fast and as clean as possible. */
4451         if (!selinux_policycap_netpeer)
4452                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4453
4454         secmark_active = selinux_secmark_enabled();
4455         peerlbl_active = selinux_peerlbl_enabled();
4456         if (!secmark_active && !peerlbl_active)
4457                 return 0;
4458
4459         ad.type = LSM_AUDIT_DATA_NET;
4460         ad.u.net = &net;
4461         ad.u.net->netif = skb->skb_iif;
4462         ad.u.net->family = family;
4463         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4464         if (err)
4465                 return err;
4466
4467         if (peerlbl_active) {
4468                 u32 peer_sid;
4469
4470                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4471                 if (err)
4472                         return err;
4473                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4474                                                addrp, family, peer_sid, &ad);
4475                 if (err) {
4476                         selinux_netlbl_err(skb, err, 0);
4477                         return err;
4478                 }
4479                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4480                                    PEER__RECV, &ad);
4481                 if (err) {
4482                         selinux_netlbl_err(skb, err, 0);
4483                         return err;
4484                 }
4485         }
4486
4487         if (secmark_active) {
4488                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4489                                    PACKET__RECV, &ad);
4490                 if (err)
4491                         return err;
4492         }
4493
4494         return err;
4495 }
4496
4497 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4498                                             int __user *optlen, unsigned len)
4499 {
4500         int err = 0;
4501         char *scontext;
4502         u32 scontext_len;
4503         struct sk_security_struct *sksec = sock->sk->sk_security;
4504         u32 peer_sid = SECSID_NULL;
4505
4506         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4507             sksec->sclass == SECCLASS_TCP_SOCKET)
4508                 peer_sid = sksec->peer_sid;
4509         if (peer_sid == SECSID_NULL)
4510                 return -ENOPROTOOPT;
4511
4512         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4513         if (err)
4514                 return err;
4515
4516         if (scontext_len > len) {
4517                 err = -ERANGE;
4518                 goto out_len;
4519         }
4520
4521         if (copy_to_user(optval, scontext, scontext_len))
4522                 err = -EFAULT;
4523
4524 out_len:
4525         if (put_user(scontext_len, optlen))
4526                 err = -EFAULT;
4527         kfree(scontext);
4528         return err;
4529 }
4530
4531 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4532 {
4533         u32 peer_secid = SECSID_NULL;
4534         u16 family;
4535
4536         if (skb && skb->protocol == htons(ETH_P_IP))
4537                 family = PF_INET;
4538         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4539                 family = PF_INET6;
4540         else if (sock)
4541                 family = sock->sk->sk_family;
4542         else
4543                 goto out;
4544
4545         if (sock && family == PF_UNIX)
4546                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4547         else if (skb)
4548                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4549
4550 out:
4551         *secid = peer_secid;
4552         if (peer_secid == SECSID_NULL)
4553                 return -EINVAL;
4554         return 0;
4555 }
4556
4557 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4558 {
4559         struct sk_security_struct *sksec;
4560
4561         sksec = kzalloc(sizeof(*sksec), priority);
4562         if (!sksec)
4563                 return -ENOMEM;
4564
4565         sksec->peer_sid = SECINITSID_UNLABELED;
4566         sksec->sid = SECINITSID_UNLABELED;
4567         sksec->sclass = SECCLASS_SOCKET;
4568         selinux_netlbl_sk_security_reset(sksec);
4569         sk->sk_security = sksec;
4570
4571         return 0;
4572 }
4573
4574 static void selinux_sk_free_security(struct sock *sk)
4575 {
4576         struct sk_security_struct *sksec = sk->sk_security;
4577
4578         sk->sk_security = NULL;
4579         selinux_netlbl_sk_security_free(sksec);
4580         kfree(sksec);
4581 }
4582
4583 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4584 {
4585         struct sk_security_struct *sksec = sk->sk_security;
4586         struct sk_security_struct *newsksec = newsk->sk_security;
4587
4588         newsksec->sid = sksec->sid;
4589         newsksec->peer_sid = sksec->peer_sid;
4590         newsksec->sclass = sksec->sclass;
4591
4592         selinux_netlbl_sk_security_reset(newsksec);
4593 }
4594
4595 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4596 {
4597         if (!sk)
4598                 *secid = SECINITSID_ANY_SOCKET;
4599         else {
4600                 struct sk_security_struct *sksec = sk->sk_security;
4601
4602                 *secid = sksec->sid;
4603         }
4604 }
4605
4606 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4607 {
4608         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4609         struct sk_security_struct *sksec = sk->sk_security;
4610
4611         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4612             sk->sk_family == PF_UNIX)
4613                 isec->sid = sksec->sid;
4614         sksec->sclass = isec->sclass;
4615 }
4616
4617 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4618                                      struct request_sock *req)
4619 {
4620         struct sk_security_struct *sksec = sk->sk_security;
4621         int err;
4622         u16 family = req->rsk_ops->family;
4623         u32 connsid;
4624         u32 peersid;
4625
4626         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4627         if (err)
4628                 return err;
4629         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4630         if (err)
4631                 return err;
4632         req->secid = connsid;
4633         req->peer_secid = peersid;
4634
4635         return selinux_netlbl_inet_conn_request(req, family);
4636 }
4637
4638 static void selinux_inet_csk_clone(struct sock *newsk,
4639                                    const struct request_sock *req)
4640 {
4641         struct sk_security_struct *newsksec = newsk->sk_security;
4642
4643         newsksec->sid = req->secid;
4644         newsksec->peer_sid = req->peer_secid;
4645         /* NOTE: Ideally, we should also get the isec->sid for the
4646            new socket in sync, but we don't have the isec available yet.
4647            So we will wait until sock_graft to do it, by which
4648            time it will have been created and available. */
4649
4650         /* We don't need to take any sort of lock here as we are the only
4651          * thread with access to newsksec */
4652         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4653 }
4654
4655 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4656 {
4657         u16 family = sk->sk_family;
4658         struct sk_security_struct *sksec = sk->sk_security;
4659
4660         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4661         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4662                 family = PF_INET;
4663
4664         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4665 }
4666
4667 static int selinux_secmark_relabel_packet(u32 sid)
4668 {
4669         const struct task_security_struct *__tsec;
4670         u32 tsid;
4671
4672         __tsec = current_security();
4673         tsid = __tsec->sid;
4674
4675         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4676 }
4677
4678 static void selinux_secmark_refcount_inc(void)
4679 {
4680         atomic_inc(&selinux_secmark_refcount);
4681 }
4682
4683 static void selinux_secmark_refcount_dec(void)
4684 {
4685         atomic_dec(&selinux_secmark_refcount);
4686 }
4687
4688 static void selinux_req_classify_flow(const struct request_sock *req,
4689                                       struct flowi *fl)
4690 {
4691         fl->flowi_secid = req->secid;
4692 }
4693
4694 static int selinux_tun_dev_alloc_security(void **security)
4695 {
4696         struct tun_security_struct *tunsec;
4697
4698         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4699         if (!tunsec)
4700                 return -ENOMEM;
4701         tunsec->sid = current_sid();
4702
4703         *security = tunsec;
4704         return 0;
4705 }
4706
4707 static void selinux_tun_dev_free_security(void *security)
4708 {
4709         kfree(security);
4710 }
4711
4712 static int selinux_tun_dev_create(void)
4713 {
4714         u32 sid = current_sid();
4715
4716         /* we aren't taking into account the "sockcreate" SID since the socket
4717          * that is being created here is not a socket in the traditional sense,
4718          * instead it is a private sock, accessible only to the kernel, and
4719          * representing a wide range of network traffic spanning multiple
4720          * connections unlike traditional sockets - check the TUN driver to
4721          * get a better understanding of why this socket is special */
4722
4723         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4724                             NULL);
4725 }
4726
4727 static int selinux_tun_dev_attach_queue(void *security)
4728 {
4729         struct tun_security_struct *tunsec = security;
4730
4731         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4732                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4733 }
4734
4735 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4736 {
4737         struct tun_security_struct *tunsec = security;
4738         struct sk_security_struct *sksec = sk->sk_security;
4739
4740         /* we don't currently perform any NetLabel based labeling here and it
4741          * isn't clear that we would want to do so anyway; while we could apply
4742          * labeling without the support of the TUN user the resulting labeled
4743          * traffic from the other end of the connection would almost certainly
4744          * cause confusion to the TUN user that had no idea network labeling
4745          * protocols were being used */
4746
4747         sksec->sid = tunsec->sid;
4748         sksec->sclass = SECCLASS_TUN_SOCKET;
4749
4750         return 0;
4751 }
4752
4753 static int selinux_tun_dev_open(void *security)
4754 {
4755         struct tun_security_struct *tunsec = security;
4756         u32 sid = current_sid();
4757         int err;
4758
4759         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4760                            TUN_SOCKET__RELABELFROM, NULL);
4761         if (err)
4762                 return err;
4763         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4764                            TUN_SOCKET__RELABELTO, NULL);
4765         if (err)
4766                 return err;
4767         tunsec->sid = sid;
4768
4769         return 0;
4770 }
4771
4772 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4773 {
4774         int err = 0;
4775         u32 perm;
4776         struct nlmsghdr *nlh;
4777         struct sk_security_struct *sksec = sk->sk_security;
4778
4779         if (skb->len < NLMSG_HDRLEN) {
4780                 err = -EINVAL;
4781                 goto out;
4782         }
4783         nlh = nlmsg_hdr(skb);
4784
4785         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4786         if (err) {
4787                 if (err == -EINVAL) {
4788                         printk(KERN_WARNING
4789                                "SELinux: unrecognized netlink message:"
4790                                " protocol=%hu nlmsg_type=%hu sclass=%s\n",
4791                                sk->sk_protocol, nlh->nlmsg_type,
4792                                secclass_map[sksec->sclass - 1].name);
4793                         if (!selinux_enforcing || security_get_allow_unknown())
4794                                 err = 0;
4795                 }
4796
4797                 /* Ignore */
4798                 if (err == -ENOENT)
4799                         err = 0;
4800                 goto out;
4801         }
4802
4803         err = sock_has_perm(current, sk, perm);
4804 out:
4805         return err;
4806 }
4807
4808 #ifdef CONFIG_NETFILTER
4809
4810 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4811                                        const struct net_device *indev,
4812                                        u16 family)
4813 {
4814         int err;
4815         char *addrp;
4816         u32 peer_sid;
4817         struct common_audit_data ad;
4818         struct lsm_network_audit net = {0,};
4819         u8 secmark_active;
4820         u8 netlbl_active;
4821         u8 peerlbl_active;
4822
4823         if (!selinux_policycap_netpeer)
4824                 return NF_ACCEPT;
4825
4826         secmark_active = selinux_secmark_enabled();
4827         netlbl_active = netlbl_enabled();
4828         peerlbl_active = selinux_peerlbl_enabled();
4829         if (!secmark_active && !peerlbl_active)
4830                 return NF_ACCEPT;
4831
4832         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4833                 return NF_DROP;
4834
4835         ad.type = LSM_AUDIT_DATA_NET;
4836         ad.u.net = &net;
4837         ad.u.net->netif = indev->ifindex;
4838         ad.u.net->family = family;
4839         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4840                 return NF_DROP;
4841
4842         if (peerlbl_active) {
4843                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4844                                                addrp, family, peer_sid, &ad);
4845                 if (err) {
4846                         selinux_netlbl_err(skb, err, 1);
4847                         return NF_DROP;
4848                 }
4849         }
4850
4851         if (secmark_active)
4852                 if (avc_has_perm(peer_sid, skb->secmark,
4853                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4854                         return NF_DROP;
4855
4856         if (netlbl_active)
4857                 /* we do this in the FORWARD path and not the POST_ROUTING
4858                  * path because we want to make sure we apply the necessary
4859                  * labeling before IPsec is applied so we can leverage AH
4860                  * protection */
4861                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4862                         return NF_DROP;
4863
4864         return NF_ACCEPT;
4865 }
4866
4867 static unsigned int selinux_ipv4_forward(void *priv,
4868                                          struct sk_buff *skb,
4869                                          const struct nf_hook_state *state)
4870 {
4871         return selinux_ip_forward(skb, state->in, PF_INET);
4872 }
4873
4874 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4875 static unsigned int selinux_ipv6_forward(void *priv,
4876                                          struct sk_buff *skb,
4877                                          const struct nf_hook_state *state)
4878 {
4879         return selinux_ip_forward(skb, state->in, PF_INET6);
4880 }
4881 #endif  /* IPV6 */
4882
4883 static unsigned int selinux_ip_output(struct sk_buff *skb,
4884                                       u16 family)
4885 {
4886         struct sock *sk;
4887         u32 sid;
4888
4889         if (!netlbl_enabled())
4890                 return NF_ACCEPT;
4891
4892         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4893          * because we want to make sure we apply the necessary labeling
4894          * before IPsec is applied so we can leverage AH protection */
4895         sk = skb->sk;
4896         if (sk) {
4897                 struct sk_security_struct *sksec;
4898
4899                 if (sk_listener(sk))
4900                         /* if the socket is the listening state then this
4901                          * packet is a SYN-ACK packet which means it needs to
4902                          * be labeled based on the connection/request_sock and
4903                          * not the parent socket.  unfortunately, we can't
4904                          * lookup the request_sock yet as it isn't queued on
4905                          * the parent socket until after the SYN-ACK is sent.
4906                          * the "solution" is to simply pass the packet as-is
4907                          * as any IP option based labeling should be copied
4908                          * from the initial connection request (in the IP
4909                          * layer).  it is far from ideal, but until we get a
4910                          * security label in the packet itself this is the
4911                          * best we can do. */
4912                         return NF_ACCEPT;
4913
4914                 /* standard practice, label using the parent socket */
4915                 sksec = sk->sk_security;
4916                 sid = sksec->sid;
4917         } else
4918                 sid = SECINITSID_KERNEL;
4919         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4920                 return NF_DROP;
4921
4922         return NF_ACCEPT;
4923 }
4924
4925 static unsigned int selinux_ipv4_output(void *priv,
4926                                         struct sk_buff *skb,
4927                                         const struct nf_hook_state *state)
4928 {
4929         return selinux_ip_output(skb, PF_INET);
4930 }
4931
4932 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4933                                                 int ifindex,
4934                                                 u16 family)
4935 {
4936         struct sock *sk = skb->sk;
4937         struct sk_security_struct *sksec;
4938         struct common_audit_data ad;
4939         struct lsm_network_audit net = {0,};
4940         char *addrp;
4941         u8 proto;
4942
4943         if (sk == NULL)
4944                 return NF_ACCEPT;
4945         sksec = sk->sk_security;
4946
4947         ad.type = LSM_AUDIT_DATA_NET;
4948         ad.u.net = &net;
4949         ad.u.net->netif = ifindex;
4950         ad.u.net->family = family;
4951         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4952                 return NF_DROP;
4953
4954         if (selinux_secmark_enabled())
4955                 if (avc_has_perm(sksec->sid, skb->secmark,
4956                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4957                         return NF_DROP_ERR(-ECONNREFUSED);
4958
4959         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4960                 return NF_DROP_ERR(-ECONNREFUSED);
4961
4962         return NF_ACCEPT;
4963 }
4964
4965 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4966                                          const struct net_device *outdev,
4967                                          u16 family)
4968 {
4969         u32 secmark_perm;
4970         u32 peer_sid;
4971         int ifindex = outdev->ifindex;
4972         struct sock *sk;
4973         struct common_audit_data ad;
4974         struct lsm_network_audit net = {0,};
4975         char *addrp;
4976         u8 secmark_active;
4977         u8 peerlbl_active;
4978
4979         /* If any sort of compatibility mode is enabled then handoff processing
4980          * to the selinux_ip_postroute_compat() function to deal with the
4981          * special handling.  We do this in an attempt to keep this function
4982          * as fast and as clean as possible. */
4983         if (!selinux_policycap_netpeer)
4984                 return selinux_ip_postroute_compat(skb, ifindex, family);
4985
4986         secmark_active = selinux_secmark_enabled();
4987         peerlbl_active = selinux_peerlbl_enabled();
4988         if (!secmark_active && !peerlbl_active)
4989                 return NF_ACCEPT;
4990
4991         sk = skb->sk;
4992
4993 #ifdef CONFIG_XFRM
4994         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4995          * packet transformation so allow the packet to pass without any checks
4996          * since we'll have another chance to perform access control checks
4997          * when the packet is on it's final way out.
4998          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4999          *       is NULL, in this case go ahead and apply access control.
5000          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
5001          *       TCP listening state we cannot wait until the XFRM processing
5002          *       is done as we will miss out on the SA label if we do;
5003          *       unfortunately, this means more work, but it is only once per
5004          *       connection. */
5005         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
5006             !(sk && sk_listener(sk)))
5007                 return NF_ACCEPT;
5008 #endif
5009
5010         if (sk == NULL) {
5011                 /* Without an associated socket the packet is either coming
5012                  * from the kernel or it is being forwarded; check the packet
5013                  * to determine which and if the packet is being forwarded
5014                  * query the packet directly to determine the security label. */
5015                 if (skb->skb_iif) {
5016                         secmark_perm = PACKET__FORWARD_OUT;
5017                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5018                                 return NF_DROP;
5019                 } else {
5020                         secmark_perm = PACKET__SEND;
5021                         peer_sid = SECINITSID_KERNEL;
5022                 }
5023         } else if (sk_listener(sk)) {
5024                 /* Locally generated packet but the associated socket is in the
5025                  * listening state which means this is a SYN-ACK packet.  In
5026                  * this particular case the correct security label is assigned
5027                  * to the connection/request_sock but unfortunately we can't
5028                  * query the request_sock as it isn't queued on the parent
5029                  * socket until after the SYN-ACK packet is sent; the only
5030                  * viable choice is to regenerate the label like we do in
5031                  * selinux_inet_conn_request().  See also selinux_ip_output()
5032                  * for similar problems. */
5033                 u32 skb_sid;
5034                 struct sk_security_struct *sksec;
5035
5036                 if (sk->sk_state == TCP_NEW_SYN_RECV)
5037                         sk = inet_reqsk(sk)->rsk_listener;
5038                 sksec = sk->sk_security;
5039                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5040                         return NF_DROP;
5041                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5042                  * and the packet has been through at least one XFRM
5043                  * transformation then we must be dealing with the "final"
5044                  * form of labeled IPsec packet; since we've already applied
5045                  * all of our access controls on this packet we can safely
5046                  * pass the packet. */
5047                 if (skb_sid == SECSID_NULL) {
5048                         switch (family) {
5049                         case PF_INET:
5050                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5051                                         return NF_ACCEPT;
5052                                 break;
5053                         case PF_INET6:
5054                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5055                                         return NF_ACCEPT;
5056                                 break;
5057                         default:
5058                                 return NF_DROP_ERR(-ECONNREFUSED);
5059                         }
5060                 }
5061                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5062                         return NF_DROP;
5063                 secmark_perm = PACKET__SEND;
5064         } else {
5065                 /* Locally generated packet, fetch the security label from the
5066                  * associated socket. */
5067                 struct sk_security_struct *sksec = sk->sk_security;
5068                 peer_sid = sksec->sid;
5069                 secmark_perm = PACKET__SEND;
5070         }
5071
5072         ad.type = LSM_AUDIT_DATA_NET;
5073         ad.u.net = &net;
5074         ad.u.net->netif = ifindex;
5075         ad.u.net->family = family;
5076         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5077                 return NF_DROP;
5078
5079         if (secmark_active)
5080                 if (avc_has_perm(peer_sid, skb->secmark,
5081                                  SECCLASS_PACKET, secmark_perm, &ad))
5082                         return NF_DROP_ERR(-ECONNREFUSED);
5083
5084         if (peerlbl_active) {
5085                 u32 if_sid;
5086                 u32 node_sid;
5087
5088                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5089                         return NF_DROP;
5090                 if (avc_has_perm(peer_sid, if_sid,
5091                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5092                         return NF_DROP_ERR(-ECONNREFUSED);
5093
5094                 if (sel_netnode_sid(addrp, family, &node_sid))
5095                         return NF_DROP;
5096                 if (avc_has_perm(peer_sid, node_sid,
5097                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5098                         return NF_DROP_ERR(-ECONNREFUSED);
5099         }
5100
5101         return NF_ACCEPT;
5102 }
5103
5104 static unsigned int selinux_ipv4_postroute(void *priv,
5105                                            struct sk_buff *skb,
5106                                            const struct nf_hook_state *state)
5107 {
5108         return selinux_ip_postroute(skb, state->out, PF_INET);
5109 }
5110
5111 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5112 static unsigned int selinux_ipv6_postroute(void *priv,
5113                                            struct sk_buff *skb,
5114                                            const struct nf_hook_state *state)
5115 {
5116         return selinux_ip_postroute(skb, state->out, PF_INET6);
5117 }
5118 #endif  /* IPV6 */
5119
5120 #endif  /* CONFIG_NETFILTER */
5121
5122 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5123 {
5124         return selinux_nlmsg_perm(sk, skb);
5125 }
5126
5127 static int ipc_alloc_security(struct task_struct *task,
5128                               struct kern_ipc_perm *perm,
5129                               u16 sclass)
5130 {
5131         struct ipc_security_struct *isec;
5132         u32 sid;
5133
5134         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5135         if (!isec)
5136                 return -ENOMEM;
5137
5138         sid = task_sid(task);
5139         isec->sclass = sclass;
5140         isec->sid = sid;
5141         perm->security = isec;
5142
5143         return 0;
5144 }
5145
5146 static void ipc_free_security(struct kern_ipc_perm *perm)
5147 {
5148         struct ipc_security_struct *isec = perm->security;
5149         perm->security = NULL;
5150         kfree(isec);
5151 }
5152
5153 static int msg_msg_alloc_security(struct msg_msg *msg)
5154 {
5155         struct msg_security_struct *msec;
5156
5157         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5158         if (!msec)
5159                 return -ENOMEM;
5160
5161         msec->sid = SECINITSID_UNLABELED;
5162         msg->security = msec;
5163
5164         return 0;
5165 }
5166
5167 static void msg_msg_free_security(struct msg_msg *msg)
5168 {
5169         struct msg_security_struct *msec = msg->security;
5170
5171         msg->security = NULL;
5172         kfree(msec);
5173 }
5174
5175 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5176                         u32 perms)
5177 {
5178         struct ipc_security_struct *isec;
5179         struct common_audit_data ad;
5180         u32 sid = current_sid();
5181
5182         isec = ipc_perms->security;
5183
5184         ad.type = LSM_AUDIT_DATA_IPC;
5185         ad.u.ipc_id = ipc_perms->key;
5186
5187         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5188 }
5189
5190 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5191 {
5192         return msg_msg_alloc_security(msg);
5193 }
5194
5195 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5196 {
5197         msg_msg_free_security(msg);
5198 }
5199
5200 /* message queue security operations */
5201 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5202 {
5203         struct ipc_security_struct *isec;
5204         struct common_audit_data ad;
5205         u32 sid = current_sid();
5206         int rc;
5207
5208         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5209         if (rc)
5210                 return rc;
5211
5212         isec = msq->q_perm.security;
5213
5214         ad.type = LSM_AUDIT_DATA_IPC;
5215         ad.u.ipc_id = msq->q_perm.key;
5216
5217         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5218                           MSGQ__CREATE, &ad);
5219         if (rc) {
5220                 ipc_free_security(&msq->q_perm);
5221                 return rc;
5222         }
5223         return 0;
5224 }
5225
5226 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5227 {
5228         ipc_free_security(&msq->q_perm);
5229 }
5230
5231 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5232 {
5233         struct ipc_security_struct *isec;
5234         struct common_audit_data ad;
5235         u32 sid = current_sid();
5236
5237         isec = msq->q_perm.security;
5238
5239         ad.type = LSM_AUDIT_DATA_IPC;
5240         ad.u.ipc_id = msq->q_perm.key;
5241
5242         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5243                             MSGQ__ASSOCIATE, &ad);
5244 }
5245
5246 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5247 {
5248         int err;
5249         int perms;
5250
5251         switch (cmd) {
5252         case IPC_INFO:
5253         case MSG_INFO:
5254                 /* No specific object, just general system-wide information. */
5255                 return task_has_system(current, SYSTEM__IPC_INFO);
5256         case IPC_STAT:
5257         case MSG_STAT:
5258                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5259                 break;
5260         case IPC_SET:
5261                 perms = MSGQ__SETATTR;
5262                 break;
5263         case IPC_RMID:
5264                 perms = MSGQ__DESTROY;
5265                 break;
5266         default:
5267                 return 0;
5268         }
5269
5270         err = ipc_has_perm(&msq->q_perm, perms);
5271         return err;
5272 }
5273
5274 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5275 {
5276         struct ipc_security_struct *isec;
5277         struct msg_security_struct *msec;
5278         struct common_audit_data ad;
5279         u32 sid = current_sid();
5280         int rc;
5281
5282         isec = msq->q_perm.security;
5283         msec = msg->security;
5284
5285         /*
5286          * First time through, need to assign label to the message
5287          */
5288         if (msec->sid == SECINITSID_UNLABELED) {
5289                 /*
5290                  * Compute new sid based on current process and
5291                  * message queue this message will be stored in
5292                  */
5293                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5294                                              NULL, &msec->sid);
5295                 if (rc)
5296                         return rc;
5297         }
5298
5299         ad.type = LSM_AUDIT_DATA_IPC;
5300         ad.u.ipc_id = msq->q_perm.key;
5301
5302         /* Can this process write to the queue? */
5303         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5304                           MSGQ__WRITE, &ad);
5305         if (!rc)
5306                 /* Can this process send the message */
5307                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5308                                   MSG__SEND, &ad);
5309         if (!rc)
5310                 /* Can the message be put in the queue? */
5311                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5312                                   MSGQ__ENQUEUE, &ad);
5313
5314         return rc;
5315 }
5316
5317 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5318                                     struct task_struct *target,
5319                                     long type, int mode)
5320 {
5321         struct ipc_security_struct *isec;
5322         struct msg_security_struct *msec;
5323         struct common_audit_data ad;
5324         u32 sid = task_sid(target);
5325         int rc;
5326
5327         isec = msq->q_perm.security;
5328         msec = msg->security;
5329
5330         ad.type = LSM_AUDIT_DATA_IPC;
5331         ad.u.ipc_id = msq->q_perm.key;
5332
5333         rc = avc_has_perm(sid, isec->sid,
5334                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5335         if (!rc)
5336                 rc = avc_has_perm(sid, msec->sid,
5337                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5338         return rc;
5339 }
5340
5341 /* Shared Memory security operations */
5342 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5343 {
5344         struct ipc_security_struct *isec;
5345         struct common_audit_data ad;
5346         u32 sid = current_sid();
5347         int rc;
5348
5349         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5350         if (rc)
5351                 return rc;
5352
5353         isec = shp->shm_perm.security;
5354
5355         ad.type = LSM_AUDIT_DATA_IPC;
5356         ad.u.ipc_id = shp->shm_perm.key;
5357
5358         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5359                           SHM__CREATE, &ad);
5360         if (rc) {
5361                 ipc_free_security(&shp->shm_perm);
5362                 return rc;
5363         }
5364         return 0;
5365 }
5366
5367 static void selinux_shm_free_security(struct shmid_kernel *shp)
5368 {
5369         ipc_free_security(&shp->shm_perm);
5370 }
5371
5372 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5373 {
5374         struct ipc_security_struct *isec;
5375         struct common_audit_data ad;
5376         u32 sid = current_sid();
5377
5378         isec = shp->shm_perm.security;
5379
5380         ad.type = LSM_AUDIT_DATA_IPC;
5381         ad.u.ipc_id = shp->shm_perm.key;
5382
5383         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5384                             SHM__ASSOCIATE, &ad);
5385 }
5386
5387 /* Note, at this point, shp is locked down */
5388 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5389 {
5390         int perms;
5391         int err;
5392
5393         switch (cmd) {
5394         case IPC_INFO:
5395         case SHM_INFO:
5396                 /* No specific object, just general system-wide information. */
5397                 return task_has_system(current, SYSTEM__IPC_INFO);
5398         case IPC_STAT:
5399         case SHM_STAT:
5400                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5401                 break;
5402         case IPC_SET:
5403                 perms = SHM__SETATTR;
5404                 break;
5405         case SHM_LOCK:
5406         case SHM_UNLOCK:
5407                 perms = SHM__LOCK;
5408                 break;
5409         case IPC_RMID:
5410                 perms = SHM__DESTROY;
5411                 break;
5412         default:
5413                 return 0;
5414         }
5415
5416         err = ipc_has_perm(&shp->shm_perm, perms);
5417         return err;
5418 }
5419
5420 static int selinux_shm_shmat(struct shmid_kernel *shp,
5421                              char __user *shmaddr, int shmflg)
5422 {
5423         u32 perms;
5424
5425         if (shmflg & SHM_RDONLY)
5426                 perms = SHM__READ;
5427         else
5428                 perms = SHM__READ | SHM__WRITE;
5429
5430         return ipc_has_perm(&shp->shm_perm, perms);
5431 }
5432
5433 /* Semaphore security operations */
5434 static int selinux_sem_alloc_security(struct sem_array *sma)
5435 {
5436         struct ipc_security_struct *isec;
5437         struct common_audit_data ad;
5438         u32 sid = current_sid();
5439         int rc;
5440
5441         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5442         if (rc)
5443                 return rc;
5444
5445         isec = sma->sem_perm.security;
5446
5447         ad.type = LSM_AUDIT_DATA_IPC;
5448         ad.u.ipc_id = sma->sem_perm.key;
5449
5450         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5451                           SEM__CREATE, &ad);
5452         if (rc) {
5453                 ipc_free_security(&sma->sem_perm);
5454                 return rc;
5455         }
5456         return 0;
5457 }
5458
5459 static void selinux_sem_free_security(struct sem_array *sma)
5460 {
5461         ipc_free_security(&sma->sem_perm);
5462 }
5463
5464 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5465 {
5466         struct ipc_security_struct *isec;
5467         struct common_audit_data ad;
5468         u32 sid = current_sid();
5469
5470         isec = sma->sem_perm.security;
5471
5472         ad.type = LSM_AUDIT_DATA_IPC;
5473         ad.u.ipc_id = sma->sem_perm.key;
5474
5475         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5476                             SEM__ASSOCIATE, &ad);
5477 }
5478
5479 /* Note, at this point, sma is locked down */
5480 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5481 {
5482         int err;
5483         u32 perms;
5484
5485         switch (cmd) {
5486         case IPC_INFO:
5487         case SEM_INFO:
5488                 /* No specific object, just general system-wide information. */
5489                 return task_has_system(current, SYSTEM__IPC_INFO);
5490         case GETPID:
5491         case GETNCNT:
5492         case GETZCNT:
5493                 perms = SEM__GETATTR;
5494                 break;
5495         case GETVAL:
5496         case GETALL:
5497                 perms = SEM__READ;
5498                 break;
5499         case SETVAL:
5500         case SETALL:
5501                 perms = SEM__WRITE;
5502                 break;
5503         case IPC_RMID:
5504                 perms = SEM__DESTROY;
5505                 break;
5506         case IPC_SET:
5507                 perms = SEM__SETATTR;
5508                 break;
5509         case IPC_STAT:
5510         case SEM_STAT:
5511                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5512                 break;
5513         default:
5514                 return 0;
5515         }
5516
5517         err = ipc_has_perm(&sma->sem_perm, perms);
5518         return err;
5519 }
5520
5521 static int selinux_sem_semop(struct sem_array *sma,
5522                              struct sembuf *sops, unsigned nsops, int alter)
5523 {
5524         u32 perms;
5525
5526         if (alter)
5527                 perms = SEM__READ | SEM__WRITE;
5528         else
5529                 perms = SEM__READ;
5530
5531         return ipc_has_perm(&sma->sem_perm, perms);
5532 }
5533
5534 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5535 {
5536         u32 av = 0;
5537
5538         av = 0;
5539         if (flag & S_IRUGO)
5540                 av |= IPC__UNIX_READ;
5541         if (flag & S_IWUGO)
5542                 av |= IPC__UNIX_WRITE;
5543
5544         if (av == 0)
5545                 return 0;
5546
5547         return ipc_has_perm(ipcp, av);
5548 }
5549
5550 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5551 {
5552         struct ipc_security_struct *isec = ipcp->security;
5553         *secid = isec->sid;
5554 }
5555
5556 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5557 {
5558         if (inode)
5559                 inode_doinit_with_dentry(inode, dentry);
5560 }
5561
5562 static int selinux_getprocattr(struct task_struct *p,
5563                                char *name, char **value)
5564 {
5565         const struct task_security_struct *__tsec;
5566         u32 sid;
5567         int error;
5568         unsigned len;
5569
5570         if (current != p) {
5571                 error = current_has_perm(p, PROCESS__GETATTR);
5572                 if (error)
5573                         return error;
5574         }
5575
5576         rcu_read_lock();
5577         __tsec = __task_cred(p)->security;
5578
5579         if (!strcmp(name, "current"))
5580                 sid = __tsec->sid;
5581         else if (!strcmp(name, "prev"))
5582                 sid = __tsec->osid;
5583         else if (!strcmp(name, "exec"))
5584                 sid = __tsec->exec_sid;
5585         else if (!strcmp(name, "fscreate"))
5586                 sid = __tsec->create_sid;
5587         else if (!strcmp(name, "keycreate"))
5588                 sid = __tsec->keycreate_sid;
5589         else if (!strcmp(name, "sockcreate"))
5590                 sid = __tsec->sockcreate_sid;
5591         else
5592                 goto invalid;
5593         rcu_read_unlock();
5594
5595         if (!sid)
5596                 return 0;
5597
5598         error = security_sid_to_context(sid, value, &len);
5599         if (error)
5600                 return error;
5601         return len;
5602
5603 invalid:
5604         rcu_read_unlock();
5605         return -EINVAL;
5606 }
5607
5608 static int selinux_setprocattr(struct task_struct *p,
5609                                char *name, void *value, size_t size)
5610 {
5611         struct task_security_struct *tsec;
5612         struct task_struct *tracer;
5613         struct cred *new;
5614         u32 sid = 0, ptsid;
5615         int error;
5616         char *str = value;
5617
5618         if (current != p) {
5619                 /* SELinux only allows a process to change its own
5620                    security attributes. */
5621                 return -EACCES;
5622         }
5623
5624         /*
5625          * Basic control over ability to set these attributes at all.
5626          * current == p, but we'll pass them separately in case the
5627          * above restriction is ever removed.
5628          */
5629         if (!strcmp(name, "exec"))
5630                 error = current_has_perm(p, PROCESS__SETEXEC);
5631         else if (!strcmp(name, "fscreate"))
5632                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5633         else if (!strcmp(name, "keycreate"))
5634                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5635         else if (!strcmp(name, "sockcreate"))
5636                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5637         else if (!strcmp(name, "current"))
5638                 error = current_has_perm(p, PROCESS__SETCURRENT);
5639         else
5640                 error = -EINVAL;
5641         if (error)
5642                 return error;
5643
5644         /* Obtain a SID for the context, if one was specified. */
5645         if (size && str[1] && str[1] != '\n') {
5646                 if (str[size-1] == '\n') {
5647                         str[size-1] = 0;
5648                         size--;
5649                 }
5650                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5651                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5652                         if (!capable(CAP_MAC_ADMIN)) {
5653                                 struct audit_buffer *ab;
5654                                 size_t audit_size;
5655
5656                                 /* We strip a nul only if it is at the end, otherwise the
5657                                  * context contains a nul and we should audit that */
5658                                 if (str[size - 1] == '\0')
5659                                         audit_size = size - 1;
5660                                 else
5661                                         audit_size = size;
5662                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5663                                 audit_log_format(ab, "op=fscreate invalid_context=");
5664                                 audit_log_n_untrustedstring(ab, value, audit_size);
5665                                 audit_log_end(ab);
5666
5667                                 return error;
5668                         }
5669                         error = security_context_to_sid_force(value, size,
5670                                                               &sid);
5671                 }
5672                 if (error)
5673                         return error;
5674         }
5675
5676         new = prepare_creds();
5677         if (!new)
5678                 return -ENOMEM;
5679
5680         /* Permission checking based on the specified context is
5681            performed during the actual operation (execve,
5682            open/mkdir/...), when we know the full context of the
5683            operation.  See selinux_bprm_set_creds for the execve
5684            checks and may_create for the file creation checks. The
5685            operation will then fail if the context is not permitted. */
5686         tsec = new->security;
5687         if (!strcmp(name, "exec")) {
5688                 tsec->exec_sid = sid;
5689         } else if (!strcmp(name, "fscreate")) {
5690                 tsec->create_sid = sid;
5691         } else if (!strcmp(name, "keycreate")) {
5692                 error = may_create_key(sid, p);
5693                 if (error)
5694                         goto abort_change;
5695                 tsec->keycreate_sid = sid;
5696         } else if (!strcmp(name, "sockcreate")) {
5697                 tsec->sockcreate_sid = sid;
5698         } else if (!strcmp(name, "current")) {
5699                 error = -EINVAL;
5700                 if (sid == 0)
5701                         goto abort_change;
5702
5703                 /* Only allow single threaded processes to change context */
5704                 error = -EPERM;
5705                 if (!current_is_single_threaded()) {
5706                         error = security_bounded_transition(tsec->sid, sid);
5707                         if (error)
5708                                 goto abort_change;
5709                 }
5710
5711                 /* Check permissions for the transition. */
5712                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5713                                      PROCESS__DYNTRANSITION, NULL);
5714                 if (error)
5715                         goto abort_change;
5716
5717                 /* Check for ptracing, and update the task SID if ok.
5718                    Otherwise, leave SID unchanged and fail. */
5719                 ptsid = 0;
5720                 rcu_read_lock();
5721                 tracer = ptrace_parent(p);
5722                 if (tracer)
5723                         ptsid = task_sid(tracer);
5724                 rcu_read_unlock();
5725
5726                 if (tracer) {
5727                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5728                                              PROCESS__PTRACE, NULL);
5729                         if (error)
5730                                 goto abort_change;
5731                 }
5732
5733                 tsec->sid = sid;
5734         } else {
5735                 error = -EINVAL;
5736                 goto abort_change;
5737         }
5738
5739         commit_creds(new);
5740         return size;
5741
5742 abort_change:
5743         abort_creds(new);
5744         return error;
5745 }
5746
5747 static int selinux_ismaclabel(const char *name)
5748 {
5749         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5750 }
5751
5752 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5753 {
5754         return security_sid_to_context(secid, secdata, seclen);
5755 }
5756
5757 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5758 {
5759         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5760 }
5761
5762 static void selinux_release_secctx(char *secdata, u32 seclen)
5763 {
5764         kfree(secdata);
5765 }
5766
5767 /*
5768  *      called with inode->i_mutex locked
5769  */
5770 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5771 {
5772         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5773 }
5774
5775 /*
5776  *      called with inode->i_mutex locked
5777  */
5778 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5779 {
5780         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5781 }
5782
5783 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5784 {
5785         int len = 0;
5786         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5787                                                 ctx, true);
5788         if (len < 0)
5789                 return len;
5790         *ctxlen = len;
5791         return 0;
5792 }
5793 #ifdef CONFIG_KEYS
5794
5795 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5796                              unsigned long flags)
5797 {
5798         const struct task_security_struct *tsec;
5799         struct key_security_struct *ksec;
5800
5801         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5802         if (!ksec)
5803                 return -ENOMEM;
5804
5805         tsec = cred->security;
5806         if (tsec->keycreate_sid)
5807                 ksec->sid = tsec->keycreate_sid;
5808         else
5809                 ksec->sid = tsec->sid;
5810
5811         k->security = ksec;
5812         return 0;
5813 }
5814
5815 static void selinux_key_free(struct key *k)
5816 {
5817         struct key_security_struct *ksec = k->security;
5818
5819         k->security = NULL;
5820         kfree(ksec);
5821 }
5822
5823 static int selinux_key_permission(key_ref_t key_ref,
5824                                   const struct cred *cred,
5825                                   unsigned perm)
5826 {
5827         struct key *key;
5828         struct key_security_struct *ksec;
5829         u32 sid;
5830
5831         /* if no specific permissions are requested, we skip the
5832            permission check. No serious, additional covert channels
5833            appear to be created. */
5834         if (perm == 0)
5835                 return 0;
5836
5837         sid = cred_sid(cred);
5838
5839         key = key_ref_to_ptr(key_ref);
5840         ksec = key->security;
5841
5842         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5843 }
5844
5845 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5846 {
5847         struct key_security_struct *ksec = key->security;
5848         char *context = NULL;
5849         unsigned len;
5850         int rc;
5851
5852         rc = security_sid_to_context(ksec->sid, &context, &len);
5853         if (!rc)
5854                 rc = len;
5855         *_buffer = context;
5856         return rc;
5857 }
5858
5859 #endif
5860
5861 static struct security_hook_list selinux_hooks[] = {
5862         LSM_HOOK_INIT(binder_set_context_mgr, selinux_binder_set_context_mgr),
5863         LSM_HOOK_INIT(binder_transaction, selinux_binder_transaction),
5864         LSM_HOOK_INIT(binder_transfer_binder, selinux_binder_transfer_binder),
5865         LSM_HOOK_INIT(binder_transfer_file, selinux_binder_transfer_file),
5866
5867         LSM_HOOK_INIT(ptrace_access_check, selinux_ptrace_access_check),
5868         LSM_HOOK_INIT(ptrace_traceme, selinux_ptrace_traceme),
5869         LSM_HOOK_INIT(capget, selinux_capget),
5870         LSM_HOOK_INIT(capset, selinux_capset),
5871         LSM_HOOK_INIT(capable, selinux_capable),
5872         LSM_HOOK_INIT(quotactl, selinux_quotactl),
5873         LSM_HOOK_INIT(quota_on, selinux_quota_on),
5874         LSM_HOOK_INIT(syslog, selinux_syslog),
5875         LSM_HOOK_INIT(vm_enough_memory, selinux_vm_enough_memory),
5876
5877         LSM_HOOK_INIT(netlink_send, selinux_netlink_send),
5878
5879         LSM_HOOK_INIT(bprm_set_creds, selinux_bprm_set_creds),
5880         LSM_HOOK_INIT(bprm_committing_creds, selinux_bprm_committing_creds),
5881         LSM_HOOK_INIT(bprm_committed_creds, selinux_bprm_committed_creds),
5882         LSM_HOOK_INIT(bprm_secureexec, selinux_bprm_secureexec),
5883
5884         LSM_HOOK_INIT(sb_alloc_security, selinux_sb_alloc_security),
5885         LSM_HOOK_INIT(sb_free_security, selinux_sb_free_security),
5886         LSM_HOOK_INIT(sb_copy_data, selinux_sb_copy_data),
5887         LSM_HOOK_INIT(sb_remount, selinux_sb_remount),
5888         LSM_HOOK_INIT(sb_kern_mount, selinux_sb_kern_mount),
5889         LSM_HOOK_INIT(sb_show_options, selinux_sb_show_options),
5890         LSM_HOOK_INIT(sb_statfs, selinux_sb_statfs),
5891         LSM_HOOK_INIT(sb_mount, selinux_mount),
5892         LSM_HOOK_INIT(sb_umount, selinux_umount),
5893         LSM_HOOK_INIT(sb_set_mnt_opts, selinux_set_mnt_opts),
5894         LSM_HOOK_INIT(sb_clone_mnt_opts, selinux_sb_clone_mnt_opts),
5895         LSM_HOOK_INIT(sb_parse_opts_str, selinux_parse_opts_str),
5896
5897         LSM_HOOK_INIT(dentry_init_security, selinux_dentry_init_security),
5898
5899         LSM_HOOK_INIT(inode_alloc_security, selinux_inode_alloc_security),
5900         LSM_HOOK_INIT(inode_free_security, selinux_inode_free_security),
5901         LSM_HOOK_INIT(inode_init_security, selinux_inode_init_security),
5902         LSM_HOOK_INIT(inode_create, selinux_inode_create),
5903         LSM_HOOK_INIT(inode_link, selinux_inode_link),
5904         LSM_HOOK_INIT(inode_unlink, selinux_inode_unlink),
5905         LSM_HOOK_INIT(inode_symlink, selinux_inode_symlink),
5906         LSM_HOOK_INIT(inode_mkdir, selinux_inode_mkdir),
5907         LSM_HOOK_INIT(inode_rmdir, selinux_inode_rmdir),
5908         LSM_HOOK_INIT(inode_mknod, selinux_inode_mknod),
5909         LSM_HOOK_INIT(inode_rename, selinux_inode_rename),
5910         LSM_HOOK_INIT(inode_readlink, selinux_inode_readlink),
5911         LSM_HOOK_INIT(inode_follow_link, selinux_inode_follow_link),
5912         LSM_HOOK_INIT(inode_permission, selinux_inode_permission),
5913         LSM_HOOK_INIT(inode_setattr, selinux_inode_setattr),
5914         LSM_HOOK_INIT(inode_getattr, selinux_inode_getattr),
5915         LSM_HOOK_INIT(inode_setxattr, selinux_inode_setxattr),
5916         LSM_HOOK_INIT(inode_post_setxattr, selinux_inode_post_setxattr),
5917         LSM_HOOK_INIT(inode_getxattr, selinux_inode_getxattr),
5918         LSM_HOOK_INIT(inode_listxattr, selinux_inode_listxattr),
5919         LSM_HOOK_INIT(inode_removexattr, selinux_inode_removexattr),
5920         LSM_HOOK_INIT(inode_getsecurity, selinux_inode_getsecurity),
5921         LSM_HOOK_INIT(inode_setsecurity, selinux_inode_setsecurity),
5922         LSM_HOOK_INIT(inode_listsecurity, selinux_inode_listsecurity),
5923         LSM_HOOK_INIT(inode_getsecid, selinux_inode_getsecid),
5924
5925         LSM_HOOK_INIT(file_permission, selinux_file_permission),
5926         LSM_HOOK_INIT(file_alloc_security, selinux_file_alloc_security),
5927         LSM_HOOK_INIT(file_free_security, selinux_file_free_security),
5928         LSM_HOOK_INIT(file_ioctl, selinux_file_ioctl),
5929         LSM_HOOK_INIT(mmap_file, selinux_mmap_file),
5930         LSM_HOOK_INIT(mmap_addr, selinux_mmap_addr),
5931         LSM_HOOK_INIT(file_mprotect, selinux_file_mprotect),
5932         LSM_HOOK_INIT(file_lock, selinux_file_lock),
5933         LSM_HOOK_INIT(file_fcntl, selinux_file_fcntl),
5934         LSM_HOOK_INIT(file_set_fowner, selinux_file_set_fowner),
5935         LSM_HOOK_INIT(file_send_sigiotask, selinux_file_send_sigiotask),
5936         LSM_HOOK_INIT(file_receive, selinux_file_receive),
5937
5938         LSM_HOOK_INIT(file_open, selinux_file_open),
5939
5940         LSM_HOOK_INIT(task_create, selinux_task_create),
5941         LSM_HOOK_INIT(cred_alloc_blank, selinux_cred_alloc_blank),
5942         LSM_HOOK_INIT(cred_free, selinux_cred_free),
5943         LSM_HOOK_INIT(cred_prepare, selinux_cred_prepare),
5944         LSM_HOOK_INIT(cred_transfer, selinux_cred_transfer),
5945         LSM_HOOK_INIT(kernel_act_as, selinux_kernel_act_as),
5946         LSM_HOOK_INIT(kernel_create_files_as, selinux_kernel_create_files_as),
5947         LSM_HOOK_INIT(kernel_module_request, selinux_kernel_module_request),
5948         LSM_HOOK_INIT(task_setpgid, selinux_task_setpgid),
5949         LSM_HOOK_INIT(task_getpgid, selinux_task_getpgid),
5950         LSM_HOOK_INIT(task_getsid, selinux_task_getsid),
5951         LSM_HOOK_INIT(task_getsecid, selinux_task_getsecid),
5952         LSM_HOOK_INIT(task_setnice, selinux_task_setnice),
5953         LSM_HOOK_INIT(task_setioprio, selinux_task_setioprio),
5954         LSM_HOOK_INIT(task_getioprio, selinux_task_getioprio),
5955         LSM_HOOK_INIT(task_setrlimit, selinux_task_setrlimit),
5956         LSM_HOOK_INIT(task_setscheduler, selinux_task_setscheduler),
5957         LSM_HOOK_INIT(task_getscheduler, selinux_task_getscheduler),
5958         LSM_HOOK_INIT(task_movememory, selinux_task_movememory),
5959         LSM_HOOK_INIT(task_kill, selinux_task_kill),
5960         LSM_HOOK_INIT(task_wait, selinux_task_wait),
5961         LSM_HOOK_INIT(task_to_inode, selinux_task_to_inode),
5962
5963         LSM_HOOK_INIT(ipc_permission, selinux_ipc_permission),
5964         LSM_HOOK_INIT(ipc_getsecid, selinux_ipc_getsecid),
5965
5966         LSM_HOOK_INIT(msg_msg_alloc_security, selinux_msg_msg_alloc_security),
5967         LSM_HOOK_INIT(msg_msg_free_security, selinux_msg_msg_free_security),
5968
5969         LSM_HOOK_INIT(msg_queue_alloc_security,
5970                         selinux_msg_queue_alloc_security),
5971         LSM_HOOK_INIT(msg_queue_free_security, selinux_msg_queue_free_security),
5972         LSM_HOOK_INIT(msg_queue_associate, selinux_msg_queue_associate),
5973         LSM_HOOK_INIT(msg_queue_msgctl, selinux_msg_queue_msgctl),
5974         LSM_HOOK_INIT(msg_queue_msgsnd, selinux_msg_queue_msgsnd),
5975         LSM_HOOK_INIT(msg_queue_msgrcv, selinux_msg_queue_msgrcv),
5976
5977         LSM_HOOK_INIT(shm_alloc_security, selinux_shm_alloc_security),
5978         LSM_HOOK_INIT(shm_free_security, selinux_shm_free_security),
5979         LSM_HOOK_INIT(shm_associate, selinux_shm_associate),
5980         LSM_HOOK_INIT(shm_shmctl, selinux_shm_shmctl),
5981         LSM_HOOK_INIT(shm_shmat, selinux_shm_shmat),
5982
5983         LSM_HOOK_INIT(sem_alloc_security, selinux_sem_alloc_security),
5984         LSM_HOOK_INIT(sem_free_security, selinux_sem_free_security),
5985         LSM_HOOK_INIT(sem_associate, selinux_sem_associate),
5986         LSM_HOOK_INIT(sem_semctl, selinux_sem_semctl),
5987         LSM_HOOK_INIT(sem_semop, selinux_sem_semop),
5988
5989         LSM_HOOK_INIT(d_instantiate, selinux_d_instantiate),
5990
5991         LSM_HOOK_INIT(getprocattr, selinux_getprocattr),
5992         LSM_HOOK_INIT(setprocattr, selinux_setprocattr),
5993
5994         LSM_HOOK_INIT(ismaclabel, selinux_ismaclabel),
5995         LSM_HOOK_INIT(secid_to_secctx, selinux_secid_to_secctx),
5996         LSM_HOOK_INIT(secctx_to_secid, selinux_secctx_to_secid),
5997         LSM_HOOK_INIT(release_secctx, selinux_release_secctx),
5998         LSM_HOOK_INIT(inode_notifysecctx, selinux_inode_notifysecctx),
5999         LSM_HOOK_INIT(inode_setsecctx, selinux_inode_setsecctx),
6000         LSM_HOOK_INIT(inode_getsecctx, selinux_inode_getsecctx),
6001
6002         LSM_HOOK_INIT(unix_stream_connect, selinux_socket_unix_stream_connect),
6003         LSM_HOOK_INIT(unix_may_send, selinux_socket_unix_may_send),
6004
6005         LSM_HOOK_INIT(socket_create, selinux_socket_create),
6006         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
6007         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
6008         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
6009         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
6010         LSM_HOOK_INIT(socket_accept, selinux_socket_accept),
6011         LSM_HOOK_INIT(socket_sendmsg, selinux_socket_sendmsg),
6012         LSM_HOOK_INIT(socket_recvmsg, selinux_socket_recvmsg),
6013         LSM_HOOK_INIT(socket_getsockname, selinux_socket_getsockname),
6014         LSM_HOOK_INIT(socket_getpeername, selinux_socket_getpeername),
6015         LSM_HOOK_INIT(socket_getsockopt, selinux_socket_getsockopt),
6016         LSM_HOOK_INIT(socket_setsockopt, selinux_socket_setsockopt),
6017         LSM_HOOK_INIT(socket_shutdown, selinux_socket_shutdown),
6018         LSM_HOOK_INIT(socket_sock_rcv_skb, selinux_socket_sock_rcv_skb),
6019         LSM_HOOK_INIT(socket_getpeersec_stream,
6020                         selinux_socket_getpeersec_stream),
6021         LSM_HOOK_INIT(socket_getpeersec_dgram, selinux_socket_getpeersec_dgram),
6022         LSM_HOOK_INIT(sk_alloc_security, selinux_sk_alloc_security),
6023         LSM_HOOK_INIT(sk_free_security, selinux_sk_free_security),
6024         LSM_HOOK_INIT(sk_clone_security, selinux_sk_clone_security),
6025         LSM_HOOK_INIT(sk_getsecid, selinux_sk_getsecid),
6026         LSM_HOOK_INIT(sock_graft, selinux_sock_graft),
6027         LSM_HOOK_INIT(inet_conn_request, selinux_inet_conn_request),
6028         LSM_HOOK_INIT(inet_csk_clone, selinux_inet_csk_clone),
6029         LSM_HOOK_INIT(inet_conn_established, selinux_inet_conn_established),
6030         LSM_HOOK_INIT(secmark_relabel_packet, selinux_secmark_relabel_packet),
6031         LSM_HOOK_INIT(secmark_refcount_inc, selinux_secmark_refcount_inc),
6032         LSM_HOOK_INIT(secmark_refcount_dec, selinux_secmark_refcount_dec),
6033         LSM_HOOK_INIT(req_classify_flow, selinux_req_classify_flow),
6034         LSM_HOOK_INIT(tun_dev_alloc_security, selinux_tun_dev_alloc_security),
6035         LSM_HOOK_INIT(tun_dev_free_security, selinux_tun_dev_free_security),
6036         LSM_HOOK_INIT(tun_dev_create, selinux_tun_dev_create),
6037         LSM_HOOK_INIT(tun_dev_attach_queue, selinux_tun_dev_attach_queue),
6038         LSM_HOOK_INIT(tun_dev_attach, selinux_tun_dev_attach),
6039         LSM_HOOK_INIT(tun_dev_open, selinux_tun_dev_open),
6040
6041 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6042         LSM_HOOK_INIT(xfrm_policy_alloc_security, selinux_xfrm_policy_alloc),
6043         LSM_HOOK_INIT(xfrm_policy_clone_security, selinux_xfrm_policy_clone),
6044         LSM_HOOK_INIT(xfrm_policy_free_security, selinux_xfrm_policy_free),
6045         LSM_HOOK_INIT(xfrm_policy_delete_security, selinux_xfrm_policy_delete),
6046         LSM_HOOK_INIT(xfrm_state_alloc, selinux_xfrm_state_alloc),
6047         LSM_HOOK_INIT(xfrm_state_alloc_acquire,
6048                         selinux_xfrm_state_alloc_acquire),
6049         LSM_HOOK_INIT(xfrm_state_free_security, selinux_xfrm_state_free),
6050         LSM_HOOK_INIT(xfrm_state_delete_security, selinux_xfrm_state_delete),
6051         LSM_HOOK_INIT(xfrm_policy_lookup, selinux_xfrm_policy_lookup),
6052         LSM_HOOK_INIT(xfrm_state_pol_flow_match,
6053                         selinux_xfrm_state_pol_flow_match),
6054         LSM_HOOK_INIT(xfrm_decode_session, selinux_xfrm_decode_session),
6055 #endif
6056
6057 #ifdef CONFIG_KEYS
6058         LSM_HOOK_INIT(key_alloc, selinux_key_alloc),
6059         LSM_HOOK_INIT(key_free, selinux_key_free),
6060         LSM_HOOK_INIT(key_permission, selinux_key_permission),
6061         LSM_HOOK_INIT(key_getsecurity, selinux_key_getsecurity),
6062 #endif
6063
6064 #ifdef CONFIG_AUDIT
6065         LSM_HOOK_INIT(audit_rule_init, selinux_audit_rule_init),
6066         LSM_HOOK_INIT(audit_rule_known, selinux_audit_rule_known),
6067         LSM_HOOK_INIT(audit_rule_match, selinux_audit_rule_match),
6068         LSM_HOOK_INIT(audit_rule_free, selinux_audit_rule_free),
6069 #endif
6070 };
6071
6072 static __init int selinux_init(void)
6073 {
6074         if (!security_module_enable("selinux")) {
6075                 selinux_enabled = 0;
6076                 return 0;
6077         }
6078
6079         if (!selinux_enabled) {
6080                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6081                 return 0;
6082         }
6083
6084         printk(KERN_INFO "SELinux:  Initializing.\n");
6085
6086         /* Set the security state for the initial task. */
6087         cred_init_security();
6088
6089         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6090
6091         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6092                                             sizeof(struct inode_security_struct),
6093                                             0, SLAB_PANIC, NULL);
6094         file_security_cache = kmem_cache_create("selinux_file_security",
6095                                             sizeof(struct file_security_struct),
6096                                             0, SLAB_PANIC, NULL);
6097         avc_init();
6098
6099         security_add_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6100
6101         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6102                 panic("SELinux: Unable to register AVC netcache callback\n");
6103
6104         if (selinux_enforcing)
6105                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6106         else
6107                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6108
6109         return 0;
6110 }
6111
6112 static void delayed_superblock_init(struct super_block *sb, void *unused)
6113 {
6114         superblock_doinit(sb, NULL);
6115 }
6116
6117 void selinux_complete_init(void)
6118 {
6119         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6120
6121         /* Set up any superblocks initialized prior to the policy load. */
6122         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6123         iterate_supers(delayed_superblock_init, NULL);
6124 }
6125
6126 /* SELinux requires early initialization in order to label
6127    all processes and objects when they are created. */
6128 security_initcall(selinux_init);
6129
6130 #if defined(CONFIG_NETFILTER)
6131
6132 static struct nf_hook_ops selinux_nf_ops[] = {
6133         {
6134                 .hook =         selinux_ipv4_postroute,
6135                 .pf =           NFPROTO_IPV4,
6136                 .hooknum =      NF_INET_POST_ROUTING,
6137                 .priority =     NF_IP_PRI_SELINUX_LAST,
6138         },
6139         {
6140                 .hook =         selinux_ipv4_forward,
6141                 .pf =           NFPROTO_IPV4,
6142                 .hooknum =      NF_INET_FORWARD,
6143                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6144         },
6145         {
6146                 .hook =         selinux_ipv4_output,
6147                 .pf =           NFPROTO_IPV4,
6148                 .hooknum =      NF_INET_LOCAL_OUT,
6149                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6150         },
6151 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6152         {
6153                 .hook =         selinux_ipv6_postroute,
6154                 .pf =           NFPROTO_IPV6,
6155                 .hooknum =      NF_INET_POST_ROUTING,
6156                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6157         },
6158         {
6159                 .hook =         selinux_ipv6_forward,
6160                 .pf =           NFPROTO_IPV6,
6161                 .hooknum =      NF_INET_FORWARD,
6162                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6163         },
6164 #endif  /* IPV6 */
6165 };
6166
6167 static int __init selinux_nf_ip_init(void)
6168 {
6169         int err;
6170
6171         if (!selinux_enabled)
6172                 return 0;
6173
6174         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6175
6176         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6177         if (err)
6178                 panic("SELinux: nf_register_hooks: error %d\n", err);
6179
6180         return 0;
6181 }
6182
6183 __initcall(selinux_nf_ip_init);
6184
6185 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6186 static void selinux_nf_ip_exit(void)
6187 {
6188         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6189
6190         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6191 }
6192 #endif
6193
6194 #else /* CONFIG_NETFILTER */
6195
6196 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6197 #define selinux_nf_ip_exit()
6198 #endif
6199
6200 #endif /* CONFIG_NETFILTER */
6201
6202 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6203 static int selinux_disabled;
6204
6205 int selinux_disable(void)
6206 {
6207         if (ss_initialized) {
6208                 /* Not permitted after initial policy load. */
6209                 return -EINVAL;
6210         }
6211
6212         if (selinux_disabled) {
6213                 /* Only do this once. */
6214                 return -EINVAL;
6215         }
6216
6217         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6218
6219         selinux_disabled = 1;
6220         selinux_enabled = 0;
6221
6222         security_delete_hooks(selinux_hooks, ARRAY_SIZE(selinux_hooks));
6223
6224         /* Try to destroy the avc node cache */
6225         avc_disable();
6226
6227         /* Unregister netfilter hooks. */
6228         selinux_nf_ip_exit();
6229
6230         /* Unregister selinuxfs. */
6231         exit_sel_fs();
6232
6233         return 0;
6234 }
6235 #endif