security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/inet_connection_sock.h>
  56 #include <net/net_namespace.h>
  57 #include <net/netlabel.h>
  58 #include <linux/uaccess.h>
  59 #include <asm/ioctls.h>
  60 #include <linux/atomic.h>
  61 #include <linux/bitops.h>
  62 #include <linux/interrupt.h>
  63 #include <linux/netdevice.h>    /* for network interface checks */
  64 #include <net/netlink.h>
  65 #include <linux/tcp.h>
  66 #include <linux/udp.h>
  67 #include <linux/dccp.h>
  68 #include <linux/quota.h>
  69 #include <linux/un.h>           /* for Unix socket types */
  70 #include <net/af_unix.h>        /* for Unix socket types */
  71 #include <linux/parser.h>
  72 #include <linux/nfs_mount.h>
  73 #include <net/ipv6.h>
  74 #include <linux/hugetlb.h>
  75 #include <linux/personality.h>
  76 #include <linux/audit.h>
  77 #include <linux/string.h>
  78 #include <linux/selinux.h>
  79 #include <linux/mutex.h>
  80 #include <linux/posix-timers.h>
  81 #include <linux/syslog.h>
  82 #include <linux/user_namespace.h>
  83 #include <linux/export.h>
  84 #include <linux/msg.h>
  85 #include <linux/shm.h>
  86
  87 #include "avc.h"
  88 #include "objsec.h"
  89 #include "netif.h"
  90 #include "netnode.h"
  91 #include "netport.h"
  92 #include "xfrm.h"
  93 #include "netlabel.h"
  94 #include "audit.h"
  95 #include "avc_ss.h"
  96
  97 /* SECMARK reference count */
  98 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
  99
 100 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 101 int selinux_enforcing;
 102
 103 static int __init enforcing_setup(char *str)
 104 {
 105         unsigned long enforcing;
 106         if (!kstrtoul(str, 0, &enforcing))
 107                 selinux_enforcing = enforcing ? 1 : 0;
 108         return 1;
 109 }
 110 __setup("enforcing=", enforcing_setup);
 111 #endif
 112
 113 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 114 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 115
 116 static int __init selinux_enabled_setup(char *str)
 117 {
 118         unsigned long enabled;
 119         if (!kstrtoul(str, 0, &enabled))
 120                 selinux_enabled = enabled ? 1 : 0;
 121         return 1;
 122 }
 123 __setup("selinux=", selinux_enabled_setup);
 124 #else
 125 int selinux_enabled = 1;
 126 #endif
 127
 128 static struct kmem_cache *sel_inode_cache;
 129
 130 /**
 131  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 132  *
 133  * Description:
 134  * This function checks the SECMARK reference counter to see if any SECMARK
 135  * targets are currently configured, if the reference counter is greater than
 136  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 137  * enabled, false (0) if SECMARK is disabled.  If the always_check_network
 138  * policy capability is enabled, SECMARK is always considered enabled.
 139  *
 140  */
 141 static int selinux_secmark_enabled(void)
 142 {
 143         return (selinux_policycap_alwaysnetwork || atomic_read(&selinux_secmark_refcount));
 144 }
 145
 146 /**
 147  * selinux_peerlbl_enabled - Check to see if peer labeling is currently enabled
 148  *
 149  * Description:
 150  * This function checks if NetLabel or labeled IPSEC is enabled.  Returns true
 151  * (1) if any are enabled or false (0) if neither are enabled.  If the
 152  * always_check_network policy capability is enabled, peer labeling
 153  * is always considered enabled.
 154  *
 155  */
 156 static int selinux_peerlbl_enabled(void)
 157 {
 158         return (selinux_policycap_alwaysnetwork || netlbl_enabled() || selinux_xfrm_enabled());
 159 }
 160
 161 static int selinux_netcache_avc_callback(u32 event)
 162 {
 163         if (event == AVC_CALLBACK_RESET) {
 164                 sel_netif_flush();
 165                 sel_netnode_flush();
 166                 sel_netport_flush();
 167                 synchronize_net();
 168         }
 169         return 0;
 170 }
 171
 172 /*
 173  * initialise the security for the init task
 174  */
 175 static void cred_init_security(void)
 176 {
 177         struct cred *cred = (struct cred *) current->real_cred;
 178         struct task_security_struct *tsec;
 179
 180         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 181         if (!tsec)
 182                 panic("SELinux:  Failed to initialize initial task.\n");
 183
 184         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 185         cred->security = tsec;
 186 }
 187
 188 /*
 189  * get the security ID of a set of credentials
 190  */
 191 static inline u32 cred_sid(const struct cred *cred)
 192 {
 193         const struct task_security_struct *tsec;
 194
 195         tsec = cred->security;
 196         return tsec->sid;
 197 }
 198
 199 /*
 200  * get the objective security ID of a task
 201  */
 202 static inline u32 task_sid(const struct task_struct *task)
 203 {
 204         u32 sid;
 205
 206         rcu_read_lock();
 207         sid = cred_sid(__task_cred(task));
 208         rcu_read_unlock();
 209         return sid;
 210 }
 211
 212 /*
 213  * get the subjective security ID of the current task
 214  */
 215 static inline u32 current_sid(void)
 216 {
 217         const struct task_security_struct *tsec = current_security();
 218
 219         return tsec->sid;
 220 }
 221
 222 /* Allocate and free functions for each kind of security blob. */
 223
 224 static int inode_alloc_security(struct inode *inode)
 225 {
 226         struct inode_security_struct *isec;
 227         u32 sid = current_sid();
 228
 229         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 230         if (!isec)
 231                 return -ENOMEM;
 232
 233         mutex_init(&isec->lock);
 234         INIT_LIST_HEAD(&isec->list);
 235         isec->inode = inode;
 236         isec->sid = SECINITSID_UNLABELED;
 237         isec->sclass = SECCLASS_FILE;
 238         isec->task_sid = sid;
 239         inode->i_security = isec;
 240
 241         return 0;
 242 }
 243
 244 static void inode_free_rcu(struct rcu_head *head)
 245 {
 246         struct inode_security_struct *isec;
 247
 248         isec = container_of(head, struct inode_security_struct, rcu);
 249         kmem_cache_free(sel_inode_cache, isec);
 250 }
 251
 252 static void inode_free_security(struct inode *inode)
 253 {
 254         struct inode_security_struct *isec = inode->i_security;
 255         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 256
 257         spin_lock(&sbsec->isec_lock);
 258         if (!list_empty(&isec->list))
 259                 list_del_init(&isec->list);
 260         spin_unlock(&sbsec->isec_lock);
 261
 262         /*
 263          * The inode may still be referenced in a path walk and
 264          * a call to selinux_inode_permission() can be made
 265          * after inode_free_security() is called. Ideally, the VFS
 266          * wouldn't do this, but fixing that is a much harder
 267          * job. For now, simply free the i_security via RCU, and
 268          * leave the current inode->i_security pointer intact.
 269          * The inode will be freed after the RCU grace period too.
 270          */
 271         call_rcu(&isec->rcu, inode_free_rcu);
 272 }
 273
 274 static int file_alloc_security(struct file *file)
 275 {
 276         struct file_security_struct *fsec;
 277         u32 sid = current_sid();
 278
 279         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 280         if (!fsec)
 281                 return -ENOMEM;
 282
 283         fsec->sid = sid;
 284         fsec->fown_sid = sid;
 285         file->f_security = fsec;
 286
 287         return 0;
 288 }
 289
 290 static void file_free_security(struct file *file)
 291 {
 292         struct file_security_struct *fsec = file->f_security;
 293         file->f_security = NULL;
 294         kfree(fsec);
 295 }
 296
 297 static int superblock_alloc_security(struct super_block *sb)
 298 {
 299         struct superblock_security_struct *sbsec;
 300
 301         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 302         if (!sbsec)
 303                 return -ENOMEM;
 304
 305         mutex_init(&sbsec->lock);
 306         INIT_LIST_HEAD(&sbsec->isec_head);
 307         spin_lock_init(&sbsec->isec_lock);
 308         sbsec->sb = sb;
 309         sbsec->sid = SECINITSID_UNLABELED;
 310         sbsec->def_sid = SECINITSID_FILE;
 311         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 312         sb->s_security = sbsec;
 313
 314         return 0;
 315 }
 316
 317 static void superblock_free_security(struct super_block *sb)
 318 {
 319         struct superblock_security_struct *sbsec = sb->s_security;
 320         sb->s_security = NULL;
 321         kfree(sbsec);
 322 }
 323
 324 /* The file system's label must be initialized prior to use. */
 325
 326 static const char *labeling_behaviors[7] = {
 327         "uses xattr",
 328         "uses transition SIDs",
 329         "uses task SIDs",
 330         "uses genfs_contexts",
 331         "not configured for labeling",
 332         "uses mountpoint labeling",
 333         "uses native labeling",
 334 };
 335
 336 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 337
 338 static inline int inode_doinit(struct inode *inode)
 339 {
 340         return inode_doinit_with_dentry(inode, NULL);
 341 }
 342
 343 enum {
 344         Opt_error = -1,
 345         Opt_context = 1,
 346         Opt_fscontext = 2,
 347         Opt_defcontext = 3,
 348         Opt_rootcontext = 4,
 349         Opt_labelsupport = 5,
 350         Opt_nextmntopt = 6,
 351 };
 352
 353 #define NUM_SEL_MNT_OPTS        (Opt_nextmntopt - 1)
 354
 355 static const match_table_t tokens = {
 356         {Opt_context, CONTEXT_STR "%s"},
 357         {Opt_fscontext, FSCONTEXT_STR "%s"},
 358         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 359         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 360         {Opt_labelsupport, LABELSUPP_STR},
 361         {Opt_error, NULL},
 362 };
 363
 364 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 365
 366 static int may_context_mount_sb_relabel(u32 sid,
 367                         struct superblock_security_struct *sbsec,
 368                         const struct cred *cred)
 369 {
 370         const struct task_security_struct *tsec = cred->security;
 371         int rc;
 372
 373         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 374                           FILESYSTEM__RELABELFROM, NULL);
 375         if (rc)
 376                 return rc;
 377
 378         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 379                           FILESYSTEM__RELABELTO, NULL);
 380         return rc;
 381 }
 382
 383 static int may_context_mount_inode_relabel(u32 sid,
 384                         struct superblock_security_struct *sbsec,
 385                         const struct cred *cred)
 386 {
 387         const struct task_security_struct *tsec = cred->security;
 388         int rc;
 389         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 390                           FILESYSTEM__RELABELFROM, NULL);
 391         if (rc)
 392                 return rc;
 393
 394         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 395                           FILESYSTEM__ASSOCIATE, NULL);
 396         return rc;
 397 }
 398
 399 static int selinux_is_sblabel_mnt(struct super_block *sb)
 400 {
 401         struct superblock_security_struct *sbsec = sb->s_security;
 402
 403         return sbsec->behavior == SECURITY_FS_USE_XATTR ||
 404                 sbsec->behavior == SECURITY_FS_USE_TRANS ||
 405                 sbsec->behavior == SECURITY_FS_USE_TASK ||
 406                 /* Special handling. Genfs but also in-core setxattr handler */
 407                 !strcmp(sb->s_type->name, "sysfs") ||
 408                 !strcmp(sb->s_type->name, "pstore") ||
 409                 !strcmp(sb->s_type->name, "debugfs") ||
 410                 !strcmp(sb->s_type->name, "rootfs");
 411 }
 412
 413 static int sb_finish_set_opts(struct super_block *sb)
 414 {
 415         struct superblock_security_struct *sbsec = sb->s_security;
 416         struct dentry *root = sb->s_root;
 417         struct inode *root_inode = d_backing_inode(root);
 418         int rc = 0;
 419
 420         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 421                 /* Make sure that the xattr handler exists and that no
 422                    error other than -ENODATA is returned by getxattr on
 423                    the root directory.  -ENODATA is ok, as this may be
 424                    the first boot of the SELinux kernel before we have
 425                    assigned xattr values to the filesystem. */
 426                 if (!root_inode->i_op->getxattr) {
 427                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 428                                "xattr support\n", sb->s_id, sb->s_type->name);
 429                         rc = -EOPNOTSUPP;
 430                         goto out;
 431                 }
 432                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 433                 if (rc < 0 && rc != -ENODATA) {
 434                         if (rc == -EOPNOTSUPP)
 435                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 436                                        "%s) has no security xattr handler\n",
 437                                        sb->s_id, sb->s_type->name);
 438                         else
 439                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 440                                        "%s) getxattr errno %d\n", sb->s_id,
 441                                        sb->s_type->name, -rc);
 442                         goto out;
 443                 }
 444         }
 445
 446         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 447                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 448                        sb->s_id, sb->s_type->name);
 449
 450         sbsec->flags |= SE_SBINITIALIZED;
 451         if (selinux_is_sblabel_mnt(sb))
 452                 sbsec->flags |= SBLABEL_MNT;
 453
 454         /* Initialize the root inode. */
 455         rc = inode_doinit_with_dentry(root_inode, root);
 456
 457         /* Initialize any other inodes associated with the superblock, e.g.
 458            inodes created prior to initial policy load or inodes created
 459            during get_sb by a pseudo filesystem that directly
 460            populates itself. */
 461         spin_lock(&sbsec->isec_lock);
 462 next_inode:
 463         if (!list_empty(&sbsec->isec_head)) {
 464                 struct inode_security_struct *isec =
 465                                 list_entry(sbsec->isec_head.next,
 466                                            struct inode_security_struct, list);
 467                 struct inode *inode = isec->inode;
 468                 list_del_init(&isec->list);
 469                 spin_unlock(&sbsec->isec_lock);
 470                 inode = igrab(inode);
 471                 if (inode) {
 472                         if (!IS_PRIVATE(inode))
 473                                 inode_doinit(inode);
 474                         iput(inode);
 475                 }
 476                 spin_lock(&sbsec->isec_lock);
 477                 goto next_inode;
 478         }
 479         spin_unlock(&sbsec->isec_lock);
 480 out:
 481         return rc;
 482 }
 483
 484 /*
 485  * This function should allow an FS to ask what it's mount security
 486  * options were so it can use those later for submounts, displaying
 487  * mount options, or whatever.
 488  */
 489 static int selinux_get_mnt_opts(const struct super_block *sb,
 490                                 struct security_mnt_opts *opts)
 491 {
 492         int rc = 0, i;
 493         struct superblock_security_struct *sbsec = sb->s_security;
 494         char *context = NULL;
 495         u32 len;
 496         char tmp;
 497
 498         security_init_mnt_opts(opts);
 499
 500         if (!(sbsec->flags & SE_SBINITIALIZED))
 501                 return -EINVAL;
 502
 503         if (!ss_initialized)
 504                 return -EINVAL;
 505
 506         /* make sure we always check enough bits to cover the mask */
 507         BUILD_BUG_ON(SE_MNTMASK >= (1 << NUM_SEL_MNT_OPTS));
 508
 509         tmp = sbsec->flags & SE_MNTMASK;
 510         /* count the number of mount options for this sb */
 511         for (i = 0; i < NUM_SEL_MNT_OPTS; i++) {
 512                 if (tmp & 0x01)
 513                         opts->num_mnt_opts++;
 514                 tmp >>= 1;
 515         }
 516         /* Check if the Label support flag is set */
 517         if (sbsec->flags & SBLABEL_MNT)
 518                 opts->num_mnt_opts++;
 519
 520         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 521         if (!opts->mnt_opts) {
 522                 rc = -ENOMEM;
 523                 goto out_free;
 524         }
 525
 526         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 527         if (!opts->mnt_opts_flags) {
 528                 rc = -ENOMEM;
 529                 goto out_free;
 530         }
 531
 532         i = 0;
 533         if (sbsec->flags & FSCONTEXT_MNT) {
 534                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 535                 if (rc)
 536                         goto out_free;
 537                 opts->mnt_opts[i] = context;
 538                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 539         }
 540         if (sbsec->flags & CONTEXT_MNT) {
 541                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 542                 if (rc)
 543                         goto out_free;
 544                 opts->mnt_opts[i] = context;
 545                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 546         }
 547         if (sbsec->flags & DEFCONTEXT_MNT) {
 548                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 549                 if (rc)
 550                         goto out_free;
 551                 opts->mnt_opts[i] = context;
 552                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 553         }
 554         if (sbsec->flags & ROOTCONTEXT_MNT) {
 555                 struct inode *root = d_backing_inode(sbsec->sb->s_root);
 556                 struct inode_security_struct *isec = root->i_security;
 557
 558                 rc = security_sid_to_context(isec->sid, &context, &len);
 559                 if (rc)
 560                         goto out_free;
 561                 opts->mnt_opts[i] = context;
 562                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 563         }
 564         if (sbsec->flags & SBLABEL_MNT) {
 565                 opts->mnt_opts[i] = NULL;
 566                 opts->mnt_opts_flags[i++] = SBLABEL_MNT;
 567         }
 568
 569         BUG_ON(i != opts->num_mnt_opts);
 570
 571         return 0;
 572
 573 out_free:
 574         security_free_mnt_opts(opts);
 575         return rc;
 576 }
 577
 578 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 579                       u32 old_sid, u32 new_sid)
 580 {
 581         char mnt_flags = sbsec->flags & SE_MNTMASK;
 582
 583         /* check if the old mount command had the same options */
 584         if (sbsec->flags & SE_SBINITIALIZED)
 585                 if (!(sbsec->flags & flag) ||
 586                     (old_sid != new_sid))
 587                         return 1;
 588
 589         /* check if we were passed the same options twice,
 590          * aka someone passed context=a,context=b
 591          */
 592         if (!(sbsec->flags & SE_SBINITIALIZED))
 593                 if (mnt_flags & flag)
 594                         return 1;
 595         return 0;
 596 }
 597
 598 /*
 599  * Allow filesystems with binary mount data to explicitly set mount point
 600  * labeling information.
 601  */
 602 static int selinux_set_mnt_opts(struct super_block *sb,
 603                                 struct security_mnt_opts *opts,
 604                                 unsigned long kern_flags,
 605                                 unsigned long *set_kern_flags)
 606 {
 607         const struct cred *cred = current_cred();
 608         int rc = 0, i;
 609         struct superblock_security_struct *sbsec = sb->s_security;
 610         const char *name = sb->s_type->name;
 611         struct inode *inode = d_backing_inode(sbsec->sb->s_root);
 612         struct inode_security_struct *root_isec = inode->i_security;
 613         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 614         u32 defcontext_sid = 0;
 615         char **mount_options = opts->mnt_opts;
 616         int *flags = opts->mnt_opts_flags;
 617         int num_opts = opts->num_mnt_opts;
 618
 619         mutex_lock(&sbsec->lock);
 620
 621         if (!ss_initialized) {
 622                 if (!num_opts) {
 623                         /* Defer initialization until selinux_complete_init,
 624                            after the initial policy is loaded and the security
 625                            server is ready to handle calls. */
 626                         goto out;
 627                 }
 628                 rc = -EINVAL;
 629                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 630                         "before the security server is initialized\n");
 631                 goto out;
 632         }
 633         if (kern_flags && !set_kern_flags) {
 634                 /* Specifying internal flags without providing a place to
 635                  * place the results is not allowed */
 636                 rc = -EINVAL;
 637                 goto out;
 638         }
 639
 640         /*
 641          * Binary mount data FS will come through this function twice.  Once
 642          * from an explicit call and once from the generic calls from the vfs.
 643          * Since the generic VFS calls will not contain any security mount data
 644          * we need to skip the double mount verification.
 645          *
 646          * This does open a hole in which we will not notice if the first
 647          * mount using this sb set explict options and a second mount using
 648          * this sb does not set any security options.  (The first options
 649          * will be used for both mounts)
 650          */
 651         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 652             && (num_opts == 0))
 653                 goto out;
 654
 655         /*
 656          * parse the mount options, check if they are valid sids.
 657          * also check if someone is trying to mount the same sb more
 658          * than once with different security options.
 659          */
 660         for (i = 0; i < num_opts; i++) {
 661                 u32 sid;
 662
 663                 if (flags[i] == SBLABEL_MNT)
 664                         continue;
 665                 rc = security_context_to_sid(mount_options[i],
 666                                              strlen(mount_options[i]), &sid, GFP_KERNEL);
 667                 if (rc) {
 668                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 669                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 670                                mount_options[i], sb->s_id, name, rc);
 671                         goto out;
 672                 }
 673                 switch (flags[i]) {
 674                 case FSCONTEXT_MNT:
 675                         fscontext_sid = sid;
 676
 677                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 678                                         fscontext_sid))
 679                                 goto out_double_mount;
 680
 681                         sbsec->flags |= FSCONTEXT_MNT;
 682                         break;
 683                 case CONTEXT_MNT:
 684                         context_sid = sid;
 685
 686                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 687                                         context_sid))
 688                                 goto out_double_mount;
 689
 690                         sbsec->flags |= CONTEXT_MNT;
 691                         break;
 692                 case ROOTCONTEXT_MNT:
 693                         rootcontext_sid = sid;
 694
 695                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 696                                         rootcontext_sid))
 697                                 goto out_double_mount;
 698
 699                         sbsec->flags |= ROOTCONTEXT_MNT;
 700
 701                         break;
 702                 case DEFCONTEXT_MNT:
 703                         defcontext_sid = sid;
 704
 705                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 706                                         defcontext_sid))
 707                                 goto out_double_mount;
 708
 709                         sbsec->flags |= DEFCONTEXT_MNT;
 710
 711                         break;
 712                 default:
 713                         rc = -EINVAL;
 714                         goto out;
 715                 }
 716         }
 717
 718         if (sbsec->flags & SE_SBINITIALIZED) {
 719                 /* previously mounted with options, but not on this attempt? */
 720                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 721                         goto out_double_mount;
 722                 rc = 0;
 723                 goto out;
 724         }
 725
 726         if (strcmp(sb->s_type->name, "proc") == 0)
 727                 sbsec->flags |= SE_SBPROC;
 728
 729         if (!sbsec->behavior) {
 730                 /*
 731                  * Determine the labeling behavior to use for this
 732                  * filesystem type.
 733                  */
 734                 rc = security_fs_use(sb);
 735                 if (rc) {
 736                         printk(KERN_WARNING
 737                                 "%s: security_fs_use(%s) returned %d\n",
 738                                         __func__, sb->s_type->name, rc);
 739                         goto out;
 740                 }
 741         }
 742         /* sets the context of the superblock for the fs being mounted. */
 743         if (fscontext_sid) {
 744                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 745                 if (rc)
 746                         goto out;
 747
 748                 sbsec->sid = fscontext_sid;
 749         }
 750
 751         /*
 752          * Switch to using mount point labeling behavior.
 753          * sets the label used on all file below the mountpoint, and will set
 754          * the superblock context if not already set.
 755          */
 756         if (kern_flags & SECURITY_LSM_NATIVE_LABELS && !context_sid) {
 757                 sbsec->behavior = SECURITY_FS_USE_NATIVE;
 758                 *set_kern_flags |= SECURITY_LSM_NATIVE_LABELS;
 759         }
 760
 761         if (context_sid) {
 762                 if (!fscontext_sid) {
 763                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 764                                                           cred);
 765                         if (rc)
 766                                 goto out;
 767                         sbsec->sid = context_sid;
 768                 } else {
 769                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 770                                                              cred);
 771                         if (rc)
 772                                 goto out;
 773                 }
 774                 if (!rootcontext_sid)
 775                         rootcontext_sid = context_sid;
 776
 777                 sbsec->mntpoint_sid = context_sid;
 778                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 779         }
 780
 781         if (rootcontext_sid) {
 782                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 783                                                      cred);
 784                 if (rc)
 785                         goto out;
 786
 787                 root_isec->sid = rootcontext_sid;
 788                 root_isec->initialized = 1;
 789         }
 790
 791         if (defcontext_sid) {
 792                 if (sbsec->behavior != SECURITY_FS_USE_XATTR &&
 793                         sbsec->behavior != SECURITY_FS_USE_NATIVE) {
 794                         rc = -EINVAL;
 795                         printk(KERN_WARNING "SELinux: defcontext option is "
 796                                "invalid for this filesystem type\n");
 797                         goto out;
 798                 }
 799
 800                 if (defcontext_sid != sbsec->def_sid) {
 801                         rc = may_context_mount_inode_relabel(defcontext_sid,
 802                                                              sbsec, cred);
 803                         if (rc)
 804                                 goto out;
 805                 }
 806
 807                 sbsec->def_sid = defcontext_sid;
 808         }
 809
 810         rc = sb_finish_set_opts(sb);
 811 out:
 812         mutex_unlock(&sbsec->lock);
 813         return rc;
 814 out_double_mount:
 815         rc = -EINVAL;
 816         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 817                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 818         goto out;
 819 }
 820
 821 static int selinux_cmp_sb_context(const struct super_block *oldsb,
 822                                     const struct super_block *newsb)
 823 {
 824         struct superblock_security_struct *old = oldsb->s_security;
 825         struct superblock_security_struct *new = newsb->s_security;
 826         char oldflags = old->flags & SE_MNTMASK;
 827         char newflags = new->flags & SE_MNTMASK;
 828
 829         if (oldflags != newflags)
 830                 goto mismatch;
 831         if ((oldflags & FSCONTEXT_MNT) && old->sid != new->sid)
 832                 goto mismatch;
 833         if ((oldflags & CONTEXT_MNT) && old->mntpoint_sid != new->mntpoint_sid)
 834                 goto mismatch;
 835         if ((oldflags & DEFCONTEXT_MNT) && old->def_sid != new->def_sid)
 836                 goto mismatch;
 837         if (oldflags & ROOTCONTEXT_MNT) {
 838                 struct inode_security_struct *oldroot = d_backing_inode(oldsb->s_root)->i_security;
 839                 struct inode_security_struct *newroot = d_backing_inode(newsb->s_root)->i_security;
 840                 if (oldroot->sid != newroot->sid)
 841                         goto mismatch;
 842         }
 843         return 0;
 844 mismatch:
 845         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, "
 846                             "different security settings for (dev %s, "
 847                             "type %s)\n", newsb->s_id, newsb->s_type->name);
 848         return -EBUSY;
 849 }
 850
 851 static int selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 852                                         struct super_block *newsb)
 853 {
 854         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 855         struct superblock_security_struct *newsbsec = newsb->s_security;
 856
 857         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 858         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 859         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 860
 861         /*
 862          * if the parent was able to be mounted it clearly had no special lsm
 863          * mount options.  thus we can safely deal with this superblock later
 864          */
 865         if (!ss_initialized)
 866                 return 0;
 867
 868         /* how can we clone if the old one wasn't set up?? */
 869         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 870
 871         /* if fs is reusing a sb, make sure that the contexts match */
 872         if (newsbsec->flags & SE_SBINITIALIZED)
 873                 return selinux_cmp_sb_context(oldsb, newsb);
 874
 875         mutex_lock(&newsbsec->lock);
 876
 877         newsbsec->flags = oldsbsec->flags;
 878
 879         newsbsec->sid = oldsbsec->sid;
 880         newsbsec->def_sid = oldsbsec->def_sid;
 881         newsbsec->behavior = oldsbsec->behavior;
 882
 883         if (set_context) {
 884                 u32 sid = oldsbsec->mntpoint_sid;
 885
 886                 if (!set_fscontext)
 887                         newsbsec->sid = sid;
 888                 if (!set_rootcontext) {
 889                         struct inode *newinode = d_backing_inode(newsb->s_root);
 890                         struct inode_security_struct *newisec = newinode->i_security;
 891                         newisec->sid = sid;
 892                 }
 893                 newsbsec->mntpoint_sid = sid;
 894         }
 895         if (set_rootcontext) {
 896                 const struct inode *oldinode = d_backing_inode(oldsb->s_root);
 897                 const struct inode_security_struct *oldisec = oldinode->i_security;
 898                 struct inode *newinode = d_backing_inode(newsb->s_root);
 899                 struct inode_security_struct *newisec = newinode->i_security;
 900
 901                 newisec->sid = oldisec->sid;
 902         }
 903
 904         sb_finish_set_opts(newsb);
 905         mutex_unlock(&newsbsec->lock);
 906         return 0;
 907 }
 908
 909 static int selinux_parse_opts_str(char *options,
 910                                   struct security_mnt_opts *opts)
 911 {
 912         char *p;
 913         char *context = NULL, *defcontext = NULL;
 914         char *fscontext = NULL, *rootcontext = NULL;
 915         int rc, num_mnt_opts = 0;
 916
 917         opts->num_mnt_opts = 0;
 918
 919         /* Standard string-based options. */
 920         while ((p = strsep(&options, "|")) != NULL) {
 921                 int token;
 922                 substring_t args[MAX_OPT_ARGS];
 923
 924                 if (!*p)
 925                         continue;
 926
 927                 token = match_token(p, tokens, args);
 928
 929                 switch (token) {
 930                 case Opt_context:
 931                         if (context || defcontext) {
 932                                 rc = -EINVAL;
 933                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 934                                 goto out_err;
 935                         }
 936                         context = match_strdup(&args[0]);
 937                         if (!context) {
 938                                 rc = -ENOMEM;
 939                                 goto out_err;
 940                         }
 941                         break;
 942
 943                 case Opt_fscontext:
 944                         if (fscontext) {
 945                                 rc = -EINVAL;
 946                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 947                                 goto out_err;
 948                         }
 949                         fscontext = match_strdup(&args[0]);
 950                         if (!fscontext) {
 951                                 rc = -ENOMEM;
 952                                 goto out_err;
 953                         }
 954                         break;
 955
 956                 case Opt_rootcontext:
 957                         if (rootcontext) {
 958                                 rc = -EINVAL;
 959                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 960                                 goto out_err;
 961                         }
 962                         rootcontext = match_strdup(&args[0]);
 963                         if (!rootcontext) {
 964                                 rc = -ENOMEM;
 965                                 goto out_err;
 966                         }
 967                         break;
 968
 969                 case Opt_defcontext:
 970                         if (context || defcontext) {
 971                                 rc = -EINVAL;
 972                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 973                                 goto out_err;
 974                         }
 975                         defcontext = match_strdup(&args[0]);
 976                         if (!defcontext) {
 977                                 rc = -ENOMEM;
 978                                 goto out_err;
 979                         }
 980                         break;
 981                 case Opt_labelsupport:
 982                         break;
 983                 default:
 984                         rc = -EINVAL;
 985                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 986                         goto out_err;
 987
 988                 }
 989         }
 990
 991         rc = -ENOMEM;
 992         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 993         if (!opts->mnt_opts)
 994                 goto out_err;
 995
 996         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 997         if (!opts->mnt_opts_flags) {
 998                 kfree(opts->mnt_opts);
 999                 goto out_err;
1000         }
1001
1002         if (fscontext) {
1003                 opts->mnt_opts[num_mnt_opts] = fscontext;
1004                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
1005         }
1006         if (context) {
1007                 opts->mnt_opts[num_mnt_opts] = context;
1008                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
1009         }
1010         if (rootcontext) {
1011                 opts->mnt_opts[num_mnt_opts] = rootcontext;
1012                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
1013         }
1014         if (defcontext) {
1015                 opts->mnt_opts[num_mnt_opts] = defcontext;
1016                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
1017         }
1018
1019         opts->num_mnt_opts = num_mnt_opts;
1020         return 0;
1021
1022 out_err:
1023         kfree(context);
1024         kfree(defcontext);
1025         kfree(fscontext);
1026         kfree(rootcontext);
1027         return rc;
1028 }
1029 /*
1030  * string mount options parsing and call set the sbsec
1031  */
1032 static int superblock_doinit(struct super_block *sb, void *data)
1033 {
1034         int rc = 0;
1035         char *options = data;
1036         struct security_mnt_opts opts;
1037
1038         security_init_mnt_opts(&opts);
1039
1040         if (!data)
1041                 goto out;
1042
1043         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
1044
1045         rc = selinux_parse_opts_str(options, &opts);
1046         if (rc)
1047                 goto out_err;
1048
1049 out:
1050         rc = selinux_set_mnt_opts(sb, &opts, 0, NULL);
1051
1052 out_err:
1053         security_free_mnt_opts(&opts);
1054         return rc;
1055 }
1056
1057 static void selinux_write_opts(struct seq_file *m,
1058                                struct security_mnt_opts *opts)
1059 {
1060         int i;
1061         char *prefix;
1062
1063         for (i = 0; i < opts->num_mnt_opts; i++) {
1064                 char *has_comma;
1065
1066                 if (opts->mnt_opts[i])
1067                         has_comma = strchr(opts->mnt_opts[i], ',');
1068                 else
1069                         has_comma = NULL;
1070
1071                 switch (opts->mnt_opts_flags[i]) {
1072                 case CONTEXT_MNT:
1073                         prefix = CONTEXT_STR;
1074                         break;
1075                 case FSCONTEXT_MNT:
1076                         prefix = FSCONTEXT_STR;
1077                         break;
1078                 case ROOTCONTEXT_MNT:
1079                         prefix = ROOTCONTEXT_STR;
1080                         break;
1081                 case DEFCONTEXT_MNT:
1082                         prefix = DEFCONTEXT_STR;
1083                         break;
1084                 case SBLABEL_MNT:
1085                         seq_putc(m, ',');
1086                         seq_puts(m, LABELSUPP_STR);
1087                         continue;
1088                 default:
1089                         BUG();
1090                         return;
1091                 };
1092                 /* we need a comma before each option */
1093                 seq_putc(m, ',');
1094                 seq_puts(m, prefix);
1095                 if (has_comma)
1096                         seq_putc(m, '\"');
1097                 seq_puts(m, opts->mnt_opts[i]);
1098                 if (has_comma)
1099                         seq_putc(m, '\"');
1100         }
1101 }
1102
1103 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1104 {
1105         struct security_mnt_opts opts;
1106         int rc;
1107
1108         rc = selinux_get_mnt_opts(sb, &opts);
1109         if (rc) {
1110                 /* before policy load we may get EINVAL, don't show anything */
1111                 if (rc == -EINVAL)
1112                         rc = 0;
1113                 return rc;
1114         }
1115
1116         selinux_write_opts(m, &opts);
1117
1118         security_free_mnt_opts(&opts);
1119
1120         return rc;
1121 }
1122
1123 static inline u16 inode_mode_to_security_class(umode_t mode)
1124 {
1125         switch (mode & S_IFMT) {
1126         case S_IFSOCK:
1127                 return SECCLASS_SOCK_FILE;
1128         case S_IFLNK:
1129                 return SECCLASS_LNK_FILE;
1130         case S_IFREG:
1131                 return SECCLASS_FILE;
1132         case S_IFBLK:
1133                 return SECCLASS_BLK_FILE;
1134         case S_IFDIR:
1135                 return SECCLASS_DIR;
1136         case S_IFCHR:
1137                 return SECCLASS_CHR_FILE;
1138         case S_IFIFO:
1139                 return SECCLASS_FIFO_FILE;
1140
1141         }
1142
1143         return SECCLASS_FILE;
1144 }
1145
1146 static inline int default_protocol_stream(int protocol)
1147 {
1148         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1149 }
1150
1151 static inline int default_protocol_dgram(int protocol)
1152 {
1153         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1154 }
1155
1156 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1157 {
1158         switch (family) {
1159         case PF_UNIX:
1160                 switch (type) {
1161                 case SOCK_STREAM:
1162                 case SOCK_SEQPACKET:
1163                         return SECCLASS_UNIX_STREAM_SOCKET;
1164                 case SOCK_DGRAM:
1165                         return SECCLASS_UNIX_DGRAM_SOCKET;
1166                 }
1167                 break;
1168         case PF_INET:
1169         case PF_INET6:
1170                 switch (type) {
1171                 case SOCK_STREAM:
1172                         if (default_protocol_stream(protocol))
1173                                 return SECCLASS_TCP_SOCKET;
1174                         else
1175                                 return SECCLASS_RAWIP_SOCKET;
1176                 case SOCK_DGRAM:
1177                         if (default_protocol_dgram(protocol))
1178                                 return SECCLASS_UDP_SOCKET;
1179                         else
1180                                 return SECCLASS_RAWIP_SOCKET;
1181                 case SOCK_DCCP:
1182                         return SECCLASS_DCCP_SOCKET;
1183                 default:
1184                         return SECCLASS_RAWIP_SOCKET;
1185                 }
1186                 break;
1187         case PF_NETLINK:
1188                 switch (protocol) {
1189                 case NETLINK_ROUTE:
1190                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1191                 case NETLINK_FIREWALL:
1192                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1193                 case NETLINK_SOCK_DIAG:
1194                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1195                 case NETLINK_NFLOG:
1196                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1197                 case NETLINK_XFRM:
1198                         return SECCLASS_NETLINK_XFRM_SOCKET;
1199                 case NETLINK_SELINUX:
1200                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1201                 case NETLINK_AUDIT:
1202                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1203                 case NETLINK_IP6_FW:
1204                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1205                 case NETLINK_DNRTMSG:
1206                         return SECCLASS_NETLINK_DNRT_SOCKET;
1207                 case NETLINK_KOBJECT_UEVENT:
1208                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1209                 default:
1210                         return SECCLASS_NETLINK_SOCKET;
1211                 }
1212         case PF_PACKET:
1213                 return SECCLASS_PACKET_SOCKET;
1214         case PF_KEY:
1215                 return SECCLASS_KEY_SOCKET;
1216         case PF_APPLETALK:
1217                 return SECCLASS_APPLETALK_SOCKET;
1218         }
1219
1220         return SECCLASS_SOCKET;
1221 }
1222
1223 #ifdef CONFIG_PROC_FS
1224 static int selinux_proc_get_sid(struct dentry *dentry,
1225                                 u16 tclass,
1226                                 u32 *sid)
1227 {
1228         int rc;
1229         char *buffer, *path;
1230
1231         buffer = (char *)__get_free_page(GFP_KERNEL);
1232         if (!buffer)
1233                 return -ENOMEM;
1234
1235         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1236         if (IS_ERR(path))
1237                 rc = PTR_ERR(path);
1238         else {
1239                 /* each process gets a /proc/PID/ entry. Strip off the
1240                  * PID part to get a valid selinux labeling.
1241                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1242                 while (path[1] >= '0' && path[1] <= '9') {
1243                         path[1] = '/';
1244                         path++;
1245                 }
1246                 rc = security_genfs_sid("proc", path, tclass, sid);
1247         }
1248         free_page((unsigned long)buffer);
1249         return rc;
1250 }
1251 #else
1252 static int selinux_proc_get_sid(struct dentry *dentry,
1253                                 u16 tclass,
1254                                 u32 *sid)
1255 {
1256         return -EINVAL;
1257 }
1258 #endif
1259
1260 /* The inode's security attributes must be initialized before first use. */
1261 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1262 {
1263         struct superblock_security_struct *sbsec = NULL;
1264         struct inode_security_struct *isec = inode->i_security;
1265         u32 sid;
1266         struct dentry *dentry;
1267 #define INITCONTEXTLEN 255
1268         char *context = NULL;
1269         unsigned len = 0;
1270         int rc = 0;
1271
1272         if (isec->initialized)
1273                 goto out;
1274
1275         mutex_lock(&isec->lock);
1276         if (isec->initialized)
1277                 goto out_unlock;
1278
1279         sbsec = inode->i_sb->s_security;
1280         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1281                 /* Defer initialization until selinux_complete_init,
1282                    after the initial policy is loaded and the security
1283                    server is ready to handle calls. */
1284                 spin_lock(&sbsec->isec_lock);
1285                 if (list_empty(&isec->list))
1286                         list_add(&isec->list, &sbsec->isec_head);
1287                 spin_unlock(&sbsec->isec_lock);
1288                 goto out_unlock;
1289         }
1290
1291         switch (sbsec->behavior) {
1292         case SECURITY_FS_USE_NATIVE:
1293                 break;
1294         case SECURITY_FS_USE_XATTR:
1295                 if (!inode->i_op->getxattr) {
1296                         isec->sid = sbsec->def_sid;
1297                         break;
1298                 }
1299
1300                 /* Need a dentry, since the xattr API requires one.
1301                    Life would be simpler if we could just pass the inode. */
1302                 if (opt_dentry) {
1303                         /* Called from d_instantiate or d_splice_alias. */
1304                         dentry = dget(opt_dentry);
1305                 } else {
1306                         /* Called from selinux_complete_init, try to find a dentry. */
1307                         dentry = d_find_alias(inode);
1308                 }
1309                 if (!dentry) {
1310                         /*
1311                          * this is can be hit on boot when a file is accessed
1312                          * before the policy is loaded.  When we load policy we
1313                          * may find inodes that have no dentry on the
1314                          * sbsec->isec_head list.  No reason to complain as these
1315                          * will get fixed up the next time we go through
1316                          * inode_doinit with a dentry, before these inodes could
1317                          * be used again by userspace.
1318                          */
1319                         goto out_unlock;
1320                 }
1321
1322                 len = INITCONTEXTLEN;
1323                 context = kmalloc(len+1, GFP_NOFS);
1324                 if (!context) {
1325                         rc = -ENOMEM;
1326                         dput(dentry);
1327                         goto out_unlock;
1328                 }
1329                 context[len] = '\0';
1330                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1331                                            context, len);
1332                 if (rc == -ERANGE) {
1333                         kfree(context);
1334
1335                         /* Need a larger buffer.  Query for the right size. */
1336                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1337                                                    NULL, 0);
1338                         if (rc < 0) {
1339                                 dput(dentry);
1340                                 goto out_unlock;
1341                         }
1342                         len = rc;
1343                         context = kmalloc(len+1, GFP_NOFS);
1344                         if (!context) {
1345                                 rc = -ENOMEM;
1346                                 dput(dentry);
1347                                 goto out_unlock;
1348                         }
1349                         context[len] = '\0';
1350                         rc = inode->i_op->getxattr(dentry,
1351                                                    XATTR_NAME_SELINUX,
1352                                                    context, len);
1353                 }
1354                 dput(dentry);
1355                 if (rc < 0) {
1356                         if (rc != -ENODATA) {
1357                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1358                                        "%d for dev=%s ino=%ld\n", __func__,
1359                                        -rc, inode->i_sb->s_id, inode->i_ino);
1360                                 kfree(context);
1361                                 goto out_unlock;
1362                         }
1363                         /* Map ENODATA to the default file SID */
1364                         sid = sbsec->def_sid;
1365                         rc = 0;
1366                 } else {
1367                         rc = security_context_to_sid_default(context, rc, &sid,
1368                                                              sbsec->def_sid,
1369                                                              GFP_NOFS);
1370                         if (rc) {
1371                                 char *dev = inode->i_sb->s_id;
1372                                 unsigned long ino = inode->i_ino;
1373
1374                                 if (rc == -EINVAL) {
1375                                         if (printk_ratelimit())
1376                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1377                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1378                                                         "filesystem in question.\n", ino, dev, context);
1379                                 } else {
1380                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1381                                                "returned %d for dev=%s ino=%ld\n",
1382                                                __func__, context, -rc, dev, ino);
1383                                 }
1384                                 kfree(context);
1385                                 /* Leave with the unlabeled SID */
1386                                 rc = 0;
1387                                 break;
1388                         }
1389                 }
1390                 kfree(context);
1391                 isec->sid = sid;
1392                 break;
1393         case SECURITY_FS_USE_TASK:
1394                 isec->sid = isec->task_sid;
1395                 break;
1396         case SECURITY_FS_USE_TRANS:
1397                 /* Default to the fs SID. */
1398                 isec->sid = sbsec->sid;
1399
1400                 /* Try to obtain a transition SID. */
1401                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1402                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1403                                              isec->sclass, NULL, &sid);
1404                 if (rc)
1405                         goto out_unlock;
1406                 isec->sid = sid;
1407                 break;
1408         case SECURITY_FS_USE_MNTPOINT:
1409                 isec->sid = sbsec->mntpoint_sid;
1410                 break;
1411         default:
1412                 /* Default to the fs superblock SID. */
1413                 isec->sid = sbsec->sid;
1414
1415                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1416                         /* We must have a dentry to determine the label on
1417                          * procfs inodes */
1418                         if (opt_dentry)
1419                                 /* Called from d_instantiate or
1420                                  * d_splice_alias. */
1421                                 dentry = dget(opt_dentry);
1422                         else
1423                                 /* Called from selinux_complete_init, try to
1424                                  * find a dentry. */
1425                                 dentry = d_find_alias(inode);
1426                         /*
1427                          * This can be hit on boot when a file is accessed
1428                          * before the policy is loaded.  When we load policy we
1429                          * may find inodes that have no dentry on the
1430                          * sbsec->isec_head list.  No reason to complain as
1431                          * these will get fixed up the next time we go through
1432                          * inode_doinit() with a dentry, before these inodes
1433                          * could be used again by userspace.
1434                          */
1435                         if (!dentry)
1436                                 goto out_unlock;
1437                         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1438                         rc = selinux_proc_get_sid(dentry, isec->sclass, &sid);
1439                         dput(dentry);
1440                         if (rc)
1441                                 goto out_unlock;
1442                         isec->sid = sid;
1443                 }
1444                 break;
1445         }
1446
1447         isec->initialized = 1;
1448
1449 out_unlock:
1450         mutex_unlock(&isec->lock);
1451 out:
1452         if (isec->sclass == SECCLASS_FILE)
1453                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1454         return rc;
1455 }
1456
1457 /* Convert a Linux signal to an access vector. */
1458 static inline u32 signal_to_av(int sig)
1459 {
1460         u32 perm = 0;
1461
1462         switch (sig) {
1463         case SIGCHLD:
1464                 /* Commonly granted from child to parent. */
1465                 perm = PROCESS__SIGCHLD;
1466                 break;
1467         case SIGKILL:
1468                 /* Cannot be caught or ignored */
1469                 perm = PROCESS__SIGKILL;
1470                 break;
1471         case SIGSTOP:
1472                 /* Cannot be caught or ignored */
1473                 perm = PROCESS__SIGSTOP;
1474                 break;
1475         default:
1476                 /* All other signals. */
1477                 perm = PROCESS__SIGNAL;
1478                 break;
1479         }
1480
1481         return perm;
1482 }
1483
1484 /*
1485  * Check permission between a pair of credentials
1486  * fork check, ptrace check, etc.
1487  */
1488 static int cred_has_perm(const struct cred *actor,
1489                          const struct cred *target,
1490                          u32 perms)
1491 {
1492         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1493
1494         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1495 }
1496
1497 /*
1498  * Check permission between a pair of tasks, e.g. signal checks,
1499  * fork check, ptrace check, etc.
1500  * tsk1 is the actor and tsk2 is the target
1501  * - this uses the default subjective creds of tsk1
1502  */
1503 static int task_has_perm(const struct task_struct *tsk1,
1504                          const struct task_struct *tsk2,
1505                          u32 perms)
1506 {
1507         const struct task_security_struct *__tsec1, *__tsec2;
1508         u32 sid1, sid2;
1509
1510         rcu_read_lock();
1511         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1512         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1513         rcu_read_unlock();
1514         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1515 }
1516
1517 /*
1518  * Check permission between current and another task, e.g. signal checks,
1519  * fork check, ptrace check, etc.
1520  * current is the actor and tsk2 is the target
1521  * - this uses current's subjective creds
1522  */
1523 static int current_has_perm(const struct task_struct *tsk,
1524                             u32 perms)
1525 {
1526         u32 sid, tsid;
1527
1528         sid = current_sid();
1529         tsid = task_sid(tsk);
1530         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1531 }
1532
1533 #if CAP_LAST_CAP > 63
1534 #error Fix SELinux to handle capabilities > 63.
1535 #endif
1536
1537 /* Check whether a task is allowed to use a capability. */
1538 static int cred_has_capability(const struct cred *cred,
1539                                int cap, int audit)
1540 {
1541         struct common_audit_data ad;
1542         struct av_decision avd;
1543         u16 sclass;
1544         u32 sid = cred_sid(cred);
1545         u32 av = CAP_TO_MASK(cap);
1546         int rc;
1547
1548         ad.type = LSM_AUDIT_DATA_CAP;
1549         ad.u.cap = cap;
1550
1551         switch (CAP_TO_INDEX(cap)) {
1552         case 0:
1553                 sclass = SECCLASS_CAPABILITY;
1554                 break;
1555         case 1:
1556                 sclass = SECCLASS_CAPABILITY2;
1557                 break;
1558         default:
1559                 printk(KERN_ERR
1560                        "SELinux:  out of range capability %d\n", cap);
1561                 BUG();
1562                 return -EINVAL;
1563         }
1564
1565         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1566         if (audit == SECURITY_CAP_AUDIT) {
1567                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1568                 if (rc2)
1569                         return rc2;
1570         }
1571         return rc;
1572 }
1573
1574 /* Check whether a task is allowed to use a system operation. */
1575 static int task_has_system(struct task_struct *tsk,
1576                            u32 perms)
1577 {
1578         u32 sid = task_sid(tsk);
1579
1580         return avc_has_perm(sid, SECINITSID_KERNEL,
1581                             SECCLASS_SYSTEM, perms, NULL);
1582 }
1583
1584 /* Check whether a task has a particular permission to an inode.
1585    The 'adp' parameter is optional and allows other audit
1586    data to be passed (e.g. the dentry). */
1587 static int inode_has_perm(const struct cred *cred,
1588                           struct inode *inode,
1589                           u32 perms,
1590                           struct common_audit_data *adp)
1591 {
1592         struct inode_security_struct *isec;
1593         u32 sid;
1594
1595         validate_creds(cred);
1596
1597         if (unlikely(IS_PRIVATE(inode)))
1598                 return 0;
1599
1600         sid = cred_sid(cred);
1601         isec = inode->i_security;
1602
1603         return avc_has_perm(sid, isec->sid, isec->sclass, perms, adp);
1604 }
1605
1606 /* Same as inode_has_perm, but pass explicit audit data containing
1607    the dentry to help the auditing code to more easily generate the
1608    pathname if needed. */
1609 static inline int dentry_has_perm(const struct cred *cred,
1610                                   struct dentry *dentry,
1611                                   u32 av)
1612 {
1613         struct inode *inode = d_backing_inode(dentry);
1614         struct common_audit_data ad;
1615
1616         ad.type = LSM_AUDIT_DATA_DENTRY;
1617         ad.u.dentry = dentry;
1618         return inode_has_perm(cred, inode, av, &ad);
1619 }
1620
1621 /* Same as inode_has_perm, but pass explicit audit data containing
1622    the path to help the auditing code to more easily generate the
1623    pathname if needed. */
1624 static inline int path_has_perm(const struct cred *cred,
1625                                 const struct path *path,
1626                                 u32 av)
1627 {
1628         struct inode *inode = d_backing_inode(path->dentry);
1629         struct common_audit_data ad;
1630
1631         ad.type = LSM_AUDIT_DATA_PATH;
1632         ad.u.path = *path;
1633         return inode_has_perm(cred, inode, av, &ad);
1634 }
1635
1636 /* Same as path_has_perm, but uses the inode from the file struct. */
1637 static inline int file_path_has_perm(const struct cred *cred,
1638                                      struct file *file,
1639                                      u32 av)
1640 {
1641         struct common_audit_data ad;
1642
1643         ad.type = LSM_AUDIT_DATA_PATH;
1644         ad.u.path = file->f_path;
1645         return inode_has_perm(cred, file_inode(file), av, &ad);
1646 }
1647
1648 /* Check whether a task can use an open file descriptor to
1649    access an inode in a given way.  Check access to the
1650    descriptor itself, and then use dentry_has_perm to
1651    check a particular permission to the file.
1652    Access to the descriptor is implicitly granted if it
1653    has the same SID as the process.  If av is zero, then
1654    access to the file is not checked, e.g. for cases
1655    where only the descriptor is affected like seek. */
1656 static int file_has_perm(const struct cred *cred,
1657                          struct file *file,
1658                          u32 av)
1659 {
1660         struct file_security_struct *fsec = file->f_security;
1661         struct inode *inode = file_inode(file);
1662         struct common_audit_data ad;
1663         u32 sid = cred_sid(cred);
1664         int rc;
1665
1666         ad.type = LSM_AUDIT_DATA_PATH;
1667         ad.u.path = file->f_path;
1668
1669         if (sid != fsec->sid) {
1670                 rc = avc_has_perm(sid, fsec->sid,
1671                                   SECCLASS_FD,
1672                                   FD__USE,
1673                                   &ad);
1674                 if (rc)
1675                         goto out;
1676         }
1677
1678         /* av is zero if only checking access to the descriptor. */
1679         rc = 0;
1680         if (av)
1681                 rc = inode_has_perm(cred, inode, av, &ad);
1682
1683 out:
1684         return rc;
1685 }
1686
1687 /* Check whether a task can create a file. */
1688 static int may_create(struct inode *dir,
1689                       struct dentry *dentry,
1690                       u16 tclass)
1691 {
1692         const struct task_security_struct *tsec = current_security();
1693         struct inode_security_struct *dsec;
1694         struct superblock_security_struct *sbsec;
1695         u32 sid, newsid;
1696         struct common_audit_data ad;
1697         int rc;
1698
1699         dsec = dir->i_security;
1700         sbsec = dir->i_sb->s_security;
1701
1702         sid = tsec->sid;
1703         newsid = tsec->create_sid;
1704
1705         ad.type = LSM_AUDIT_DATA_DENTRY;
1706         ad.u.dentry = dentry;
1707
1708         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1709                           DIR__ADD_NAME | DIR__SEARCH,
1710                           &ad);
1711         if (rc)
1712                 return rc;
1713
1714         if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
1715                 rc = security_transition_sid(sid, dsec->sid, tclass,
1716                                              &dentry->d_name, &newsid);
1717                 if (rc)
1718                         return rc;
1719         }
1720
1721         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1722         if (rc)
1723                 return rc;
1724
1725         return avc_has_perm(newsid, sbsec->sid,
1726                             SECCLASS_FILESYSTEM,
1727                             FILESYSTEM__ASSOCIATE, &ad);
1728 }
1729
1730 /* Check whether a task can create a key. */
1731 static int may_create_key(u32 ksid,
1732                           struct task_struct *ctx)
1733 {
1734         u32 sid = task_sid(ctx);
1735
1736         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1737 }
1738
1739 #define MAY_LINK        0
1740 #define MAY_UNLINK      1
1741 #define MAY_RMDIR       2
1742
1743 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1744 static int may_link(struct inode *dir,
1745                     struct dentry *dentry,
1746                     int kind)
1747
1748 {
1749         struct inode_security_struct *dsec, *isec;
1750         struct common_audit_data ad;
1751         u32 sid = current_sid();
1752         u32 av;
1753         int rc;
1754
1755         dsec = dir->i_security;
1756         isec = d_backing_inode(dentry)->i_security;
1757
1758         ad.type = LSM_AUDIT_DATA_DENTRY;
1759         ad.u.dentry = dentry;
1760
1761         av = DIR__SEARCH;
1762         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1763         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1764         if (rc)
1765                 return rc;
1766
1767         switch (kind) {
1768         case MAY_LINK:
1769                 av = FILE__LINK;
1770                 break;
1771         case MAY_UNLINK:
1772                 av = FILE__UNLINK;
1773                 break;
1774         case MAY_RMDIR:
1775                 av = DIR__RMDIR;
1776                 break;
1777         default:
1778                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1779                         __func__, kind);
1780                 return 0;
1781         }
1782
1783         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1784         return rc;
1785 }
1786
1787 static inline int may_rename(struct inode *old_dir,
1788                              struct dentry *old_dentry,
1789                              struct inode *new_dir,
1790                              struct dentry *new_dentry)
1791 {
1792         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1793         struct common_audit_data ad;
1794         u32 sid = current_sid();
1795         u32 av;
1796         int old_is_dir, new_is_dir;
1797         int rc;
1798
1799         old_dsec = old_dir->i_security;
1800         old_isec = d_backing_inode(old_dentry)->i_security;
1801         old_is_dir = d_is_dir(old_dentry);
1802         new_dsec = new_dir->i_security;
1803
1804         ad.type = LSM_AUDIT_DATA_DENTRY;
1805
1806         ad.u.dentry = old_dentry;
1807         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1808                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1809         if (rc)
1810                 return rc;
1811         rc = avc_has_perm(sid, old_isec->sid,
1812                           old_isec->sclass, FILE__RENAME, &ad);
1813         if (rc)
1814                 return rc;
1815         if (old_is_dir && new_dir != old_dir) {
1816                 rc = avc_has_perm(sid, old_isec->sid,
1817                                   old_isec->sclass, DIR__REPARENT, &ad);
1818                 if (rc)
1819                         return rc;
1820         }
1821
1822         ad.u.dentry = new_dentry;
1823         av = DIR__ADD_NAME | DIR__SEARCH;
1824         if (d_is_positive(new_dentry))
1825                 av |= DIR__REMOVE_NAME;
1826         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1827         if (rc)
1828                 return rc;
1829         if (d_is_positive(new_dentry)) {
1830                 new_isec = d_backing_inode(new_dentry)->i_security;
1831                 new_is_dir = d_is_dir(new_dentry);
1832                 rc = avc_has_perm(sid, new_isec->sid,
1833                                   new_isec->sclass,
1834                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1835                 if (rc)
1836                         return rc;
1837         }
1838
1839         return 0;
1840 }
1841
1842 /* Check whether a task can perform a filesystem operation. */
1843 static int superblock_has_perm(const struct cred *cred,
1844                                struct super_block *sb,
1845                                u32 perms,
1846                                struct common_audit_data *ad)
1847 {
1848         struct superblock_security_struct *sbsec;
1849         u32 sid = cred_sid(cred);
1850
1851         sbsec = sb->s_security;
1852         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1853 }
1854
1855 /* Convert a Linux mode and permission mask to an access vector. */
1856 static inline u32 file_mask_to_av(int mode, int mask)
1857 {
1858         u32 av = 0;
1859
1860         if (!S_ISDIR(mode)) {
1861                 if (mask & MAY_EXEC)
1862                         av |= FILE__EXECUTE;
1863                 if (mask & MAY_READ)
1864                         av |= FILE__READ;
1865
1866                 if (mask & MAY_APPEND)
1867                         av |= FILE__APPEND;
1868                 else if (mask & MAY_WRITE)
1869                         av |= FILE__WRITE;
1870
1871         } else {
1872                 if (mask & MAY_EXEC)
1873                         av |= DIR__SEARCH;
1874                 if (mask & MAY_WRITE)
1875                         av |= DIR__WRITE;
1876                 if (mask & MAY_READ)
1877                         av |= DIR__READ;
1878         }
1879
1880         return av;
1881 }
1882
1883 /* Convert a Linux file to an access vector. */
1884 static inline u32 file_to_av(struct file *file)
1885 {
1886         u32 av = 0;
1887
1888         if (file->f_mode & FMODE_READ)
1889                 av |= FILE__READ;
1890         if (file->f_mode & FMODE_WRITE) {
1891                 if (file->f_flags & O_APPEND)
1892                         av |= FILE__APPEND;
1893                 else
1894                         av |= FILE__WRITE;
1895         }
1896         if (!av) {
1897                 /*
1898                  * Special file opened with flags 3 for ioctl-only use.
1899                  */
1900                 av = FILE__IOCTL;
1901         }
1902
1903         return av;
1904 }
1905
1906 /*
1907  * Convert a file to an access vector and include the correct open
1908  * open permission.
1909  */
1910 static inline u32 open_file_to_av(struct file *file)
1911 {
1912         u32 av = file_to_av(file);
1913
1914         if (selinux_policycap_openperm)
1915                 av |= FILE__OPEN;
1916
1917         return av;
1918 }
1919
1920 /* Hook functions begin here. */
1921
1922 static int selinux_binder_set_context_mgr(struct task_struct *mgr)
1923 {
1924         u32 mysid = current_sid();
1925         u32 mgrsid = task_sid(mgr);
1926
1927         return avc_has_perm(mysid, mgrsid, SECCLASS_BINDER,
1928                             BINDER__SET_CONTEXT_MGR, NULL);
1929 }
1930
1931 static int selinux_binder_transaction(struct task_struct *from,
1932                                       struct task_struct *to)
1933 {
1934         u32 mysid = current_sid();
1935         u32 fromsid = task_sid(from);
1936         u32 tosid = task_sid(to);
1937         int rc;
1938
1939         if (mysid != fromsid) {
1940                 rc = avc_has_perm(mysid, fromsid, SECCLASS_BINDER,
1941                                   BINDER__IMPERSONATE, NULL);
1942                 if (rc)
1943                         return rc;
1944         }
1945
1946         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__CALL,
1947                             NULL);
1948 }
1949
1950 static int selinux_binder_transfer_binder(struct task_struct *from,
1951                                           struct task_struct *to)
1952 {
1953         u32 fromsid = task_sid(from);
1954         u32 tosid = task_sid(to);
1955
1956         return avc_has_perm(fromsid, tosid, SECCLASS_BINDER, BINDER__TRANSFER,
1957                             NULL);
1958 }
1959
1960 static int selinux_binder_transfer_file(struct task_struct *from,
1961                                         struct task_struct *to,
1962                                         struct file *file)
1963 {
1964         u32 sid = task_sid(to);
1965         struct file_security_struct *fsec = file->f_security;
1966         struct inode *inode = d_backing_inode(file->f_path.dentry);
1967         struct inode_security_struct *isec = inode->i_security;
1968         struct common_audit_data ad;
1969         int rc;
1970
1971         ad.type = LSM_AUDIT_DATA_PATH;
1972         ad.u.path = file->f_path;
1973
1974         if (sid != fsec->sid) {
1975                 rc = avc_has_perm(sid, fsec->sid,
1976                                   SECCLASS_FD,
1977                                   FD__USE,
1978                                   &ad);
1979                 if (rc)
1980                         return rc;
1981         }
1982
1983         if (unlikely(IS_PRIVATE(inode)))
1984                 return 0;
1985
1986         return avc_has_perm(sid, isec->sid, isec->sclass, file_to_av(file),
1987                             &ad);
1988 }
1989
1990 static int selinux_ptrace_access_check(struct task_struct *child,
1991                                      unsigned int mode)
1992 {
1993         int rc;
1994
1995         rc = cap_ptrace_access_check(child, mode);
1996         if (rc)
1997                 return rc;
1998
1999         if (mode & PTRACE_MODE_READ) {
2000                 u32 sid = current_sid();
2001                 u32 csid = task_sid(child);
2002                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
2003         }
2004
2005         return current_has_perm(child, PROCESS__PTRACE);
2006 }
2007
2008 static int selinux_ptrace_traceme(struct task_struct *parent)
2009 {
2010         int rc;
2011
2012         rc = cap_ptrace_traceme(parent);
2013         if (rc)
2014                 return rc;
2015
2016         return task_has_perm(parent, current, PROCESS__PTRACE);
2017 }
2018
2019 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
2020                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
2021 {
2022         int error;
2023
2024         error = current_has_perm(target, PROCESS__GETCAP);
2025         if (error)
2026                 return error;
2027
2028         return cap_capget(target, effective, inheritable, permitted);
2029 }
2030
2031 static int selinux_capset(struct cred *new, const struct cred *old,
2032                           const kernel_cap_t *effective,
2033                           const kernel_cap_t *inheritable,
2034                           const kernel_cap_t *permitted)
2035 {
2036         int error;
2037
2038         error = cap_capset(new, old,
2039                                       effective, inheritable, permitted);
2040         if (error)
2041                 return error;
2042
2043         return cred_has_perm(old, new, PROCESS__SETCAP);
2044 }
2045
2046 /*
2047  * (This comment used to live with the selinux_task_setuid hook,
2048  * which was removed).
2049  *
2050  * Since setuid only affects the current process, and since the SELinux
2051  * controls are not based on the Linux identity attributes, SELinux does not
2052  * need to control this operation.  However, SELinux does control the use of
2053  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
2054  */
2055
2056 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
2057                            int cap, int audit)
2058 {
2059         int rc;
2060
2061         rc = cap_capable(cred, ns, cap, audit);
2062         if (rc)
2063                 return rc;
2064
2065         return cred_has_capability(cred, cap, audit);
2066 }
2067
2068 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
2069 {
2070         const struct cred *cred = current_cred();
2071         int rc = 0;
2072
2073         if (!sb)
2074                 return 0;
2075
2076         switch (cmds) {
2077         case Q_SYNC:
2078         case Q_QUOTAON:
2079         case Q_QUOTAOFF:
2080         case Q_SETINFO:
2081         case Q_SETQUOTA:
2082                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
2083                 break;
2084         case Q_GETFMT:
2085         case Q_GETINFO:
2086         case Q_GETQUOTA:
2087                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
2088                 break;
2089         default:
2090                 rc = 0;  /* let the kernel handle invalid cmds */
2091                 break;
2092         }
2093         return rc;
2094 }
2095
2096 static int selinux_quota_on(struct dentry *dentry)
2097 {
2098         const struct cred *cred = current_cred();
2099
2100         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
2101 }
2102
2103 static int selinux_syslog(int type)
2104 {
2105         int rc;
2106
2107         switch (type) {
2108         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
2109         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
2110                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
2111                 break;
2112         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
2113         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
2114         /* Set level of messages printed to console */
2115         case SYSLOG_ACTION_CONSOLE_LEVEL:
2116                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
2117                 break;
2118         case SYSLOG_ACTION_CLOSE:       /* Close log */
2119         case SYSLOG_ACTION_OPEN:        /* Open log */
2120         case SYSLOG_ACTION_READ:        /* Read from log */
2121         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
2122         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
2123         default:
2124                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
2125                 break;
2126         }
2127         return rc;
2128 }
2129
2130 /*
2131  * Check that a process has enough memory to allocate a new virtual
2132  * mapping. 0 means there is enough memory for the allocation to
2133  * succeed and -ENOMEM implies there is not.
2134  *
2135  * Do not audit the selinux permission check, as this is applied to all
2136  * processes that allocate mappings.
2137  */
2138 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
2139 {
2140         int rc, cap_sys_admin = 0;
2141
2142         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
2143                              SECURITY_CAP_NOAUDIT);
2144         if (rc == 0)
2145                 cap_sys_admin = 1;
2146
2147         return __vm_enough_memory(mm, pages, cap_sys_admin);
2148 }
2149
2150 /* binprm security operations */
2151
2152 static int check_nnp_nosuid(const struct linux_binprm *bprm,
2153                             const struct task_security_struct *old_tsec,
2154                             const struct task_security_struct *new_tsec)
2155 {
2156         int nnp = (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS);
2157         int nosuid = (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID);
2158         int rc;
2159
2160         if (!nnp && !nosuid)
2161                 return 0; /* neither NNP nor nosuid */
2162
2163         if (new_tsec->sid == old_tsec->sid)
2164                 return 0; /* No change in credentials */
2165
2166         /*
2167          * The only transitions we permit under NNP or nosuid
2168          * are transitions to bounded SIDs, i.e. SIDs that are
2169          * guaranteed to only be allowed a subset of the permissions
2170          * of the current SID.
2171          */
2172         rc = security_bounded_transition(old_tsec->sid, new_tsec->sid);
2173         if (rc) {
2174                 /*
2175                  * On failure, preserve the errno values for NNP vs nosuid.
2176                  * NNP:  Operation not permitted for caller.
2177                  * nosuid:  Permission denied to file.
2178                  */
2179                 if (nnp)
2180                         return -EPERM;
2181                 else
2182                         return -EACCES;
2183         }
2184         return 0;
2185 }
2186
2187 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
2188 {
2189         const struct task_security_struct *old_tsec;
2190         struct task_security_struct *new_tsec;
2191         struct inode_security_struct *isec;
2192         struct common_audit_data ad;
2193         struct inode *inode = file_inode(bprm->file);
2194         int rc;
2195
2196         rc = cap_bprm_set_creds(bprm);
2197         if (rc)
2198                 return rc;
2199
2200         /* SELinux context only depends on initial program or script and not
2201          * the script interpreter */
2202         if (bprm->cred_prepared)
2203                 return 0;
2204
2205         old_tsec = current_security();
2206         new_tsec = bprm->cred->security;
2207         isec = inode->i_security;
2208
2209         /* Default to the current task SID. */
2210         new_tsec->sid = old_tsec->sid;
2211         new_tsec->osid = old_tsec->sid;
2212
2213         /* Reset fs, key, and sock SIDs on execve. */
2214         new_tsec->create_sid = 0;
2215         new_tsec->keycreate_sid = 0;
2216         new_tsec->sockcreate_sid = 0;
2217
2218         if (old_tsec->exec_sid) {
2219                 new_tsec->sid = old_tsec->exec_sid;
2220                 /* Reset exec SID on execve. */
2221                 new_tsec->exec_sid = 0;
2222
2223                 /* Fail on NNP or nosuid if not an allowed transition. */
2224                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2225                 if (rc)
2226                         return rc;
2227         } else {
2228                 /* Check for a default transition on this program. */
2229                 rc = security_transition_sid(old_tsec->sid, isec->sid,
2230                                              SECCLASS_PROCESS, NULL,
2231                                              &new_tsec->sid);
2232                 if (rc)
2233                         return rc;
2234
2235                 /*
2236                  * Fallback to old SID on NNP or nosuid if not an allowed
2237                  * transition.
2238                  */
2239                 rc = check_nnp_nosuid(bprm, old_tsec, new_tsec);
2240                 if (rc)
2241                         new_tsec->sid = old_tsec->sid;
2242         }
2243
2244         ad.type = LSM_AUDIT_DATA_PATH;
2245         ad.u.path = bprm->file->f_path;
2246
2247         if (new_tsec->sid == old_tsec->sid) {
2248                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2249                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2250                 if (rc)
2251                         return rc;
2252         } else {
2253                 /* Check permissions for the transition. */
2254                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2255                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2256                 if (rc)
2257                         return rc;
2258
2259                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2260                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2261                 if (rc)
2262                         return rc;
2263
2264                 /* Check for shared state */
2265                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2266                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2267                                           SECCLASS_PROCESS, PROCESS__SHARE,
2268                                           NULL);
2269                         if (rc)
2270                                 return -EPERM;
2271                 }
2272
2273                 /* Make sure that anyone attempting to ptrace over a task that
2274                  * changes its SID has the appropriate permit */
2275                 if (bprm->unsafe &
2276                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2277                         struct task_struct *tracer;
2278                         struct task_security_struct *sec;
2279                         u32 ptsid = 0;
2280
2281                         rcu_read_lock();
2282                         tracer = ptrace_parent(current);
2283                         if (likely(tracer != NULL)) {
2284                                 sec = __task_cred(tracer)->security;
2285                                 ptsid = sec->sid;
2286                         }
2287                         rcu_read_unlock();
2288
2289                         if (ptsid != 0) {
2290                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2291                                                   SECCLASS_PROCESS,
2292                                                   PROCESS__PTRACE, NULL);
2293                                 if (rc)
2294                                         return -EPERM;
2295                         }
2296                 }
2297
2298                 /* Clear any possibly unsafe personality bits on exec: */
2299                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2300         }
2301
2302         return 0;
2303 }
2304
2305 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2306 {
2307         const struct task_security_struct *tsec = current_security();
2308         u32 sid, osid;
2309         int atsecure = 0;
2310
2311         sid = tsec->sid;
2312         osid = tsec->osid;
2313
2314         if (osid != sid) {
2315                 /* Enable secure mode for SIDs transitions unless
2316                    the noatsecure permission is granted between
2317                    the two SIDs, i.e. ahp returns 0. */
2318                 atsecure = avc_has_perm(osid, sid,
2319                                         SECCLASS_PROCESS,
2320                                         PROCESS__NOATSECURE, NULL);
2321         }
2322
2323         return (atsecure || cap_bprm_secureexec(bprm));
2324 }
2325
2326 static int match_file(const void *p, struct file *file, unsigned fd)
2327 {
2328         return file_has_perm(p, file, file_to_av(file)) ? fd + 1 : 0;
2329 }
2330
2331 /* Derived from fs/exec.c:flush_old_files. */
2332 static inline void flush_unauthorized_files(const struct cred *cred,
2333                                             struct files_struct *files)
2334 {
2335         struct file *file, *devnull = NULL;
2336         struct tty_struct *tty;
2337         int drop_tty = 0;
2338         unsigned n;
2339
2340         tty = get_current_tty();
2341         if (tty) {
2342                 spin_lock(&tty_files_lock);
2343                 if (!list_empty(&tty->tty_files)) {
2344                         struct tty_file_private *file_priv;
2345
2346                         /* Revalidate access to controlling tty.
2347                            Use file_path_has_perm on the tty path directly
2348                            rather than using file_has_perm, as this particular
2349                            open file may belong to another process and we are
2350                            only interested in the inode-based check here. */
2351                         file_priv = list_first_entry(&tty->tty_files,
2352                                                 struct tty_file_private, list);
2353                         file = file_priv->file;
2354                         if (file_path_has_perm(cred, file, FILE__READ | FILE__WRITE))
2355                                 drop_tty = 1;
2356                 }
2357                 spin_unlock(&tty_files_lock);
2358                 tty_kref_put(tty);
2359         }
2360         /* Reset controlling tty. */
2361         if (drop_tty)
2362                 no_tty();
2363
2364         /* Revalidate access to inherited open files. */
2365         n = iterate_fd(files, 0, match_file, cred);
2366         if (!n) /* none found? */
2367                 return;
2368
2369         devnull = dentry_open(&selinux_null, O_RDWR, cred);
2370         if (IS_ERR(devnull))
2371                 devnull = NULL;
2372         /* replace all the matching ones with this */
2373         do {
2374                 replace_fd(n - 1, devnull, 0);
2375         } while ((n = iterate_fd(files, n, match_file, cred)) != 0);
2376         if (devnull)
2377                 fput(devnull);
2378 }
2379
2380 /*
2381  * Prepare a process for imminent new credential changes due to exec
2382  */
2383 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2384 {
2385         struct task_security_struct *new_tsec;
2386         struct rlimit *rlim, *initrlim;
2387         int rc, i;
2388
2389         new_tsec = bprm->cred->security;
2390         if (new_tsec->sid == new_tsec->osid)
2391                 return;
2392
2393         /* Close files for which the new task SID is not authorized. */
2394         flush_unauthorized_files(bprm->cred, current->files);
2395
2396         /* Always clear parent death signal on SID transitions. */
2397         current->pdeath_signal = 0;
2398
2399         /* Check whether the new SID can inherit resource limits from the old
2400          * SID.  If not, reset all soft limits to the lower of the current
2401          * task's hard limit and the init task's soft limit.
2402          *
2403          * Note that the setting of hard limits (even to lower them) can be
2404          * controlled by the setrlimit check.  The inclusion of the init task's
2405          * soft limit into the computation is to avoid resetting soft limits
2406          * higher than the default soft limit for cases where the default is
2407          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2408          */
2409         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2410                           PROCESS__RLIMITINH, NULL);
2411         if (rc) {
2412                 /* protect against do_prlimit() */
2413                 task_lock(current);
2414                 for (i = 0; i < RLIM_NLIMITS; i++) {
2415                         rlim = current->signal->rlim + i;
2416                         initrlim = init_task.signal->rlim + i;
2417                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2418                 }
2419                 task_unlock(current);
2420                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2421         }
2422 }
2423
2424 /*
2425  * Clean up the process immediately after the installation of new credentials
2426  * due to exec
2427  */
2428 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2429 {
2430         const struct task_security_struct *tsec = current_security();
2431         struct itimerval itimer;
2432         u32 osid, sid;
2433         int rc, i;
2434
2435         osid = tsec->osid;
2436         sid = tsec->sid;
2437
2438         if (sid == osid)
2439                 return;
2440
2441         /* Check whether the new SID can inherit signal state from the old SID.
2442          * If not, clear itimers to avoid subsequent signal generation and
2443          * flush and unblock signals.
2444          *
2445          * This must occur _after_ the task SID has been updated so that any
2446          * kill done after the flush will be checked against the new SID.
2447          */
2448         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2449         if (rc) {
2450                 memset(&itimer, 0, sizeof itimer);
2451                 for (i = 0; i < 3; i++)
2452                         do_setitimer(i, &itimer, NULL);
2453                 spin_lock_irq(&current->sighand->siglock);
2454                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2455                         __flush_signals(current);
2456                         flush_signal_handlers(current, 1);
2457                         sigemptyset(&current->blocked);
2458                 }
2459                 spin_unlock_irq(&current->sighand->siglock);
2460         }
2461
2462         /* Wake up the parent if it is waiting so that it can recheck
2463          * wait permission to the new task SID. */
2464         read_lock(&tasklist_lock);
2465         __wake_up_parent(current, current->real_parent);
2466         read_unlock(&tasklist_lock);
2467 }
2468
2469 /* superblock security operations */
2470
2471 static int selinux_sb_alloc_security(struct super_block *sb)
2472 {
2473         return superblock_alloc_security(sb);
2474 }
2475
2476 static void selinux_sb_free_security(struct super_block *sb)
2477 {
2478         superblock_free_security(sb);
2479 }
2480
2481 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2482 {
2483         if (plen > olen)
2484                 return 0;
2485
2486         return !memcmp(prefix, option, plen);
2487 }
2488
2489 static inline int selinux_option(char *option, int len)
2490 {
2491         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2492                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2493                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2494                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2495                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2496 }
2497
2498 static inline void take_option(char **to, char *from, int *first, int len)
2499 {
2500         if (!*first) {
2501                 **to = ',';
2502                 *to += 1;
2503         } else
2504                 *first = 0;
2505         memcpy(*to, from, len);
2506         *to += len;
2507 }
2508
2509 static inline void take_selinux_option(char **to, char *from, int *first,
2510                                        int len)
2511 {
2512         int current_size = 0;
2513
2514         if (!*first) {
2515                 **to = '|';
2516                 *to += 1;
2517         } else
2518                 *first = 0;
2519
2520         while (current_size < len) {
2521                 if (*from != '"') {
2522                         **to = *from;
2523                         *to += 1;
2524                 }
2525                 from += 1;
2526                 current_size += 1;
2527         }
2528 }
2529
2530 static int selinux_sb_copy_data(char *orig, char *copy)
2531 {
2532         int fnosec, fsec, rc = 0;
2533         char *in_save, *in_curr, *in_end;
2534         char *sec_curr, *nosec_save, *nosec;
2535         int open_quote = 0;
2536
2537         in_curr = orig;
2538         sec_curr = copy;
2539
2540         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2541         if (!nosec) {
2542                 rc = -ENOMEM;
2543                 goto out;
2544         }
2545
2546         nosec_save = nosec;
2547         fnosec = fsec = 1;
2548         in_save = in_end = orig;
2549
2550         do {
2551                 if (*in_end == '"')
2552                         open_quote = !open_quote;
2553                 if ((*in_end == ',' && open_quote == 0) ||
2554                                 *in_end == '\0') {
2555                         int len = in_end - in_curr;
2556
2557                         if (selinux_option(in_curr, len))
2558                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2559                         else
2560                                 take_option(&nosec, in_curr, &fnosec, len);
2561
2562                         in_curr = in_end + 1;
2563                 }
2564         } while (*in_end++);
2565
2566         strcpy(in_save, nosec_save);
2567         free_page((unsigned long)nosec_save);
2568 out:
2569         return rc;
2570 }
2571
2572 static int selinux_sb_remount(struct super_block *sb, void *data)
2573 {
2574         int rc, i, *flags;
2575         struct security_mnt_opts opts;
2576         char *secdata, **mount_options;
2577         struct superblock_security_struct *sbsec = sb->s_security;
2578
2579         if (!(sbsec->flags & SE_SBINITIALIZED))
2580                 return 0;
2581
2582         if (!data)
2583                 return 0;
2584
2585         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2586                 return 0;
2587
2588         security_init_mnt_opts(&opts);
2589         secdata = alloc_secdata();
2590         if (!secdata)
2591                 return -ENOMEM;
2592         rc = selinux_sb_copy_data(data, secdata);
2593         if (rc)
2594                 goto out_free_secdata;
2595
2596         rc = selinux_parse_opts_str(secdata, &opts);
2597         if (rc)
2598                 goto out_free_secdata;
2599
2600         mount_options = opts.mnt_opts;
2601         flags = opts.mnt_opts_flags;
2602
2603         for (i = 0; i < opts.num_mnt_opts; i++) {
2604                 u32 sid;
2605                 size_t len;
2606
2607                 if (flags[i] == SBLABEL_MNT)
2608                         continue;
2609                 len = strlen(mount_options[i]);
2610                 rc = security_context_to_sid(mount_options[i], len, &sid,
2611                                              GFP_KERNEL);
2612                 if (rc) {
2613                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2614                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2615                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2616                         goto out_free_opts;
2617                 }
2618                 rc = -EINVAL;
2619                 switch (flags[i]) {
2620                 case FSCONTEXT_MNT:
2621                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2622                                 goto out_bad_option;
2623                         break;
2624                 case CONTEXT_MNT:
2625                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2626                                 goto out_bad_option;
2627                         break;
2628                 case ROOTCONTEXT_MNT: {
2629                         struct inode_security_struct *root_isec;
2630                         root_isec = d_backing_inode(sb->s_root)->i_security;
2631
2632                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2633                                 goto out_bad_option;
2634                         break;
2635                 }
2636                 case DEFCONTEXT_MNT:
2637                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2638                                 goto out_bad_option;
2639                         break;
2640                 default:
2641                         goto out_free_opts;
2642                 }
2643         }
2644
2645         rc = 0;
2646 out_free_opts:
2647         security_free_mnt_opts(&opts);
2648 out_free_secdata:
2649         free_secdata(secdata);
2650         return rc;
2651 out_bad_option:
2652         printk(KERN_WARNING "SELinux: unable to change security options "
2653                "during remount (dev %s, type=%s)\n", sb->s_id,
2654                sb->s_type->name);
2655         goto out_free_opts;
2656 }
2657
2658 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2659 {
2660         const struct cred *cred = current_cred();
2661         struct common_audit_data ad;
2662         int rc;
2663
2664         rc = superblock_doinit(sb, data);
2665         if (rc)
2666                 return rc;
2667
2668         /* Allow all mounts performed by the kernel */
2669         if (flags & MS_KERNMOUNT)
2670                 return 0;
2671
2672         ad.type = LSM_AUDIT_DATA_DENTRY;
2673         ad.u.dentry = sb->s_root;
2674         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2675 }
2676
2677 static int selinux_sb_statfs(struct dentry *dentry)
2678 {
2679         const struct cred *cred = current_cred();
2680         struct common_audit_data ad;
2681
2682         ad.type = LSM_AUDIT_DATA_DENTRY;
2683         ad.u.dentry = dentry->d_sb->s_root;
2684         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2685 }
2686
2687 static int selinux_mount(const char *dev_name,
2688                          struct path *path,
2689                          const char *type,
2690                          unsigned long flags,
2691                          void *data)
2692 {
2693         const struct cred *cred = current_cred();
2694
2695         if (flags & MS_REMOUNT)
2696                 return superblock_has_perm(cred, path->dentry->d_sb,
2697                                            FILESYSTEM__REMOUNT, NULL);
2698         else
2699                 return path_has_perm(cred, path, FILE__MOUNTON);
2700 }
2701
2702 static int selinux_umount(struct vfsmount *mnt, int flags)
2703 {
2704         const struct cred *cred = current_cred();
2705
2706         return superblock_has_perm(cred, mnt->mnt_sb,
2707                                    FILESYSTEM__UNMOUNT, NULL);
2708 }
2709
2710 /* inode security operations */
2711
2712 static int selinux_inode_alloc_security(struct inode *inode)
2713 {
2714         return inode_alloc_security(inode);
2715 }
2716
2717 static void selinux_inode_free_security(struct inode *inode)
2718 {
2719         inode_free_security(inode);
2720 }
2721
2722 static int selinux_dentry_init_security(struct dentry *dentry, int mode,
2723                                         struct qstr *name, void **ctx,
2724                                         u32 *ctxlen)
2725 {
2726         const struct cred *cred = current_cred();
2727         struct task_security_struct *tsec;
2728         struct inode_security_struct *dsec;
2729         struct superblock_security_struct *sbsec;
2730         struct inode *dir = d_backing_inode(dentry->d_parent);
2731         u32 newsid;
2732         int rc;
2733
2734         tsec = cred->security;
2735         dsec = dir->i_security;
2736         sbsec = dir->i_sb->s_security;
2737
2738         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2739                 newsid = tsec->create_sid;
2740         } else {
2741                 rc = security_transition_sid(tsec->sid, dsec->sid,
2742                                              inode_mode_to_security_class(mode),
2743                                              name,
2744                                              &newsid);
2745                 if (rc) {
2746                         printk(KERN_WARNING
2747                                 "%s: security_transition_sid failed, rc=%d\n",
2748                                __func__, -rc);
2749                         return rc;
2750                 }
2751         }
2752
2753         return security_sid_to_context(newsid, (char **)ctx, ctxlen);
2754 }
2755
2756 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2757                                        const struct qstr *qstr,
2758                                        const char **name,
2759                                        void **value, size_t *len)
2760 {
2761         const struct task_security_struct *tsec = current_security();
2762         struct inode_security_struct *dsec;
2763         struct superblock_security_struct *sbsec;
2764         u32 sid, newsid, clen;
2765         int rc;
2766         char *context;
2767
2768         dsec = dir->i_security;
2769         sbsec = dir->i_sb->s_security;
2770
2771         sid = tsec->sid;
2772         newsid = tsec->create_sid;
2773
2774         if ((sbsec->flags & SE_SBINITIALIZED) &&
2775             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2776                 newsid = sbsec->mntpoint_sid;
2777         else if (!newsid || !(sbsec->flags & SBLABEL_MNT)) {
2778                 rc = security_transition_sid(sid, dsec->sid,
2779                                              inode_mode_to_security_class(inode->i_mode),
2780                                              qstr, &newsid);
2781                 if (rc) {
2782                         printk(KERN_WARNING "%s:  "
2783                                "security_transition_sid failed, rc=%d (dev=%s "
2784                                "ino=%ld)\n",
2785                                __func__,
2786                                -rc, inode->i_sb->s_id, inode->i_ino);
2787                         return rc;
2788                 }
2789         }
2790
2791         /* Possibly defer initialization to selinux_complete_init. */
2792         if (sbsec->flags & SE_SBINITIALIZED) {
2793                 struct inode_security_struct *isec = inode->i_security;
2794                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2795                 isec->sid = newsid;
2796                 isec->initialized = 1;
2797         }
2798
2799         if (!ss_initialized || !(sbsec->flags & SBLABEL_MNT))
2800                 return -EOPNOTSUPP;
2801
2802         if (name)
2803                 *name = XATTR_SELINUX_SUFFIX;
2804
2805         if (value && len) {
2806                 rc = security_sid_to_context_force(newsid, &context, &clen);
2807                 if (rc)
2808                         return rc;
2809                 *value = context;
2810                 *len = clen;
2811         }
2812
2813         return 0;
2814 }
2815
2816 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2817 {
2818         return may_create(dir, dentry, SECCLASS_FILE);
2819 }
2820
2821 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2822 {
2823         return may_link(dir, old_dentry, MAY_LINK);
2824 }
2825
2826 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2827 {
2828         return may_link(dir, dentry, MAY_UNLINK);
2829 }
2830
2831 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2832 {
2833         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2834 }
2835
2836 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2837 {
2838         return may_create(dir, dentry, SECCLASS_DIR);
2839 }
2840
2841 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2842 {
2843         return may_link(dir, dentry, MAY_RMDIR);
2844 }
2845
2846 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2847 {
2848         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2849 }
2850
2851 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2852                                 struct inode *new_inode, struct dentry *new_dentry)
2853 {
2854         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2855 }
2856
2857 static int selinux_inode_readlink(struct dentry *dentry)
2858 {
2859         const struct cred *cred = current_cred();
2860
2861         return dentry_has_perm(cred, dentry, FILE__READ);
2862 }
2863
2864 static int selinux_inode_follow_link(struct dentry *dentry, struct inode *inode,
2865                                      bool rcu)
2866 {
2867         const struct cred *cred = current_cred();
2868         struct common_audit_data ad;
2869         struct inode_security_struct *isec;
2870         u32 sid;
2871
2872         validate_creds(cred);
2873
2874         ad.type = LSM_AUDIT_DATA_DENTRY;
2875         ad.u.dentry = dentry;
2876         sid = cred_sid(cred);
2877         isec = inode->i_security;
2878
2879         return avc_has_perm_flags(sid, isec->sid, isec->sclass, FILE__READ, &ad,
2880                                   rcu ? MAY_NOT_BLOCK : 0);
2881 }
2882
2883 static noinline int audit_inode_permission(struct inode *inode,
2884                                            u32 perms, u32 audited, u32 denied,
2885                                            int result,
2886                                            unsigned flags)
2887 {
2888         struct common_audit_data ad;
2889         struct inode_security_struct *isec = inode->i_security;
2890         int rc;
2891
2892         ad.type = LSM_AUDIT_DATA_INODE;
2893         ad.u.inode = inode;
2894
2895         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2896                             audited, denied, result, &ad, flags);
2897         if (rc)
2898                 return rc;
2899         return 0;
2900 }
2901
2902 static int selinux_inode_permission(struct inode *inode, int mask)
2903 {
2904         const struct cred *cred = current_cred();
2905         u32 perms;
2906         bool from_access;
2907         unsigned flags = mask & MAY_NOT_BLOCK;
2908         struct inode_security_struct *isec;
2909         u32 sid;
2910         struct av_decision avd;
2911         int rc, rc2;
2912         u32 audited, denied;
2913
2914         from_access = mask & MAY_ACCESS;
2915         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2916
2917         /* No permission to check.  Existence test. */
2918         if (!mask)
2919                 return 0;
2920
2921         validate_creds(cred);
2922
2923         if (unlikely(IS_PRIVATE(inode)))
2924                 return 0;
2925
2926         perms = file_mask_to_av(inode->i_mode, mask);
2927
2928         sid = cred_sid(cred);
2929         isec = inode->i_security;
2930
2931         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2932         audited = avc_audit_required(perms, &avd, rc,
2933                                      from_access ? FILE__AUDIT_ACCESS : 0,
2934                                      &denied);
2935         if (likely(!audited))
2936                 return rc;
2937
2938         rc2 = audit_inode_permission(inode, perms, audited, denied, rc, flags);
2939         if (rc2)
2940                 return rc2;
2941         return rc;
2942 }
2943
2944 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2945 {
2946         const struct cred *cred = current_cred();
2947         unsigned int ia_valid = iattr->ia_valid;
2948         __u32 av = FILE__WRITE;
2949
2950         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2951         if (ia_valid & ATTR_FORCE) {
2952                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2953                               ATTR_FORCE);
2954                 if (!ia_valid)
2955                         return 0;
2956         }
2957
2958         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2959                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2960                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2961
2962         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2963                 av |= FILE__OPEN;
2964
2965         return dentry_has_perm(cred, dentry, av);
2966 }
2967
2968 static int selinux_inode_getattr(const struct path *path)
2969 {
2970         return path_has_perm(current_cred(), path, FILE__GETATTR);
2971 }
2972
2973 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2974 {
2975         const struct cred *cred = current_cred();
2976
2977         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2978                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2979                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2980                         if (!capable(CAP_SETFCAP))
2981                                 return -EPERM;
2982                 } else if (!capable(CAP_SYS_ADMIN)) {
2983                         /* A different attribute in the security namespace.
2984                            Restrict to administrator. */
2985                         return -EPERM;
2986                 }
2987         }
2988
2989         /* Not an attribute we recognize, so just check the
2990            ordinary setattr permission. */
2991         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2992 }
2993
2994 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2995                                   const void *value, size_t size, int flags)
2996 {
2997         struct inode *inode = d_backing_inode(dentry);
2998         struct inode_security_struct *isec = inode->i_security;
2999         struct superblock_security_struct *sbsec;
3000         struct common_audit_data ad;
3001         u32 newsid, sid = current_sid();
3002         int rc = 0;
3003
3004         if (strcmp(name, XATTR_NAME_SELINUX))
3005                 return selinux_inode_setotherxattr(dentry, name);
3006
3007         sbsec = inode->i_sb->s_security;
3008         if (!(sbsec->flags & SBLABEL_MNT))
3009                 return -EOPNOTSUPP;
3010
3011         if (!inode_owner_or_capable(inode))
3012                 return -EPERM;
3013
3014         ad.type = LSM_AUDIT_DATA_DENTRY;
3015         ad.u.dentry = dentry;
3016
3017         rc = avc_has_perm(sid, isec->sid, isec->sclass,
3018                           FILE__RELABELFROM, &ad);
3019         if (rc)
3020                 return rc;
3021
3022         rc = security_context_to_sid(value, size, &newsid, GFP_KERNEL);
3023         if (rc == -EINVAL) {
3024                 if (!capable(CAP_MAC_ADMIN)) {
3025                         struct audit_buffer *ab;
3026                         size_t audit_size;
3027                         const char *str;
3028
3029                         /* We strip a nul only if it is at the end, otherwise the
3030                          * context contains a nul and we should audit that */
3031                         if (value) {
3032                                 str = value;
3033                                 if (str[size - 1] == '\0')
3034                                         audit_size = size - 1;
3035                                 else
3036                                         audit_size = size;
3037                         } else {
3038                                 str = "";
3039                                 audit_size = 0;
3040                         }
3041                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
3042                         audit_log_format(ab, "op=setxattr invalid_context=");
3043                         audit_log_n_untrustedstring(ab, value, audit_size);
3044                         audit_log_end(ab);
3045
3046                         return rc;
3047                 }
3048                 rc = security_context_to_sid_force(value, size, &newsid);
3049         }
3050         if (rc)
3051                 return rc;
3052
3053         rc = avc_has_perm(sid, newsid, isec->sclass,
3054                           FILE__RELABELTO, &ad);
3055         if (rc)
3056                 return rc;
3057
3058         rc = security_validate_transition(isec->sid, newsid, sid,
3059                                           isec->sclass);
3060         if (rc)
3061                 return rc;
3062
3063         return avc_has_perm(newsid,
3064                             sbsec->sid,
3065                             SECCLASS_FILESYSTEM,
3066                             FILESYSTEM__ASSOCIATE,
3067                             &ad);
3068 }
3069
3070 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
3071                                         const void *value, size_t size,
3072                                         int flags)
3073 {
3074         struct inode *inode = d_backing_inode(dentry);
3075         struct inode_security_struct *isec = inode->i_security;
3076         u32 newsid;
3077         int rc;
3078
3079         if (strcmp(name, XATTR_NAME_SELINUX)) {
3080                 /* Not an attribute we recognize, so nothing to do. */
3081                 return;
3082         }
3083
3084         rc = security_context_to_sid_force(value, size, &newsid);
3085         if (rc) {
3086                 printk(KERN_ERR "SELinux:  unable to map context to SID"
3087                        "for (%s, %lu), rc=%d\n",
3088                        inode->i_sb->s_id, inode->i_ino, -rc);
3089                 return;
3090         }
3091
3092         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3093         isec->sid = newsid;
3094         isec->initialized = 1;
3095
3096         return;
3097 }
3098
3099 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
3100 {
3101         const struct cred *cred = current_cred();
3102
3103         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3104 }
3105
3106 static int selinux_inode_listxattr(struct dentry *dentry)
3107 {
3108         const struct cred *cred = current_cred();
3109
3110         return dentry_has_perm(cred, dentry, FILE__GETATTR);
3111 }
3112
3113 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
3114 {
3115         if (strcmp(name, XATTR_NAME_SELINUX))
3116                 return selinux_inode_setotherxattr(dentry, name);
3117
3118         /* No one is allowed to remove a SELinux security label.
3119            You can change the label, but all data must be labeled. */
3120         return -EACCES;
3121 }
3122
3123 /*
3124  * Copy the inode security context value to the user.
3125  *
3126  * Permission check is handled by selinux_inode_getxattr hook.
3127  */
3128 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
3129 {
3130         u32 size;
3131         int error;
3132         char *context = NULL;
3133         struct inode_security_struct *isec = inode->i_security;
3134
3135         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3136                 return -EOPNOTSUPP;
3137
3138         /*
3139          * If the caller has CAP_MAC_ADMIN, then get the raw context
3140          * value even if it is not defined by current policy; otherwise,
3141          * use the in-core value under current policy.
3142          * Use the non-auditing forms of the permission checks since
3143          * getxattr may be called by unprivileged processes commonly
3144          * and lack of permission just means that we fall back to the
3145          * in-core context value, not a denial.
3146          */
3147         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
3148                                 SECURITY_CAP_NOAUDIT);
3149         if (!error)
3150                 error = security_sid_to_context_force(isec->sid, &context,
3151                                                       &size);
3152         else
3153                 error = security_sid_to_context(isec->sid, &context, &size);
3154         if (error)
3155                 return error;
3156         error = size;
3157         if (alloc) {
3158                 *buffer = context;
3159                 goto out_nofree;
3160         }
3161         kfree(context);
3162 out_nofree:
3163         return error;
3164 }
3165
3166 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
3167                                      const void *value, size_t size, int flags)
3168 {
3169         struct inode_security_struct *isec = inode->i_security;
3170         u32 newsid;
3171         int rc;
3172
3173         if (strcmp(name, XATTR_SELINUX_SUFFIX))
3174                 return -EOPNOTSUPP;
3175
3176         if (!value || !size)
3177                 return -EACCES;
3178
3179         rc = security_context_to_sid((void *)value, size, &newsid, GFP_KERNEL);
3180         if (rc)
3181                 return rc;
3182
3183         isec->sclass = inode_mode_to_security_class(inode->i_mode);
3184         isec->sid = newsid;
3185         isec->initialized = 1;
3186         return 0;
3187 }
3188
3189 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
3190 {
3191         const int len = sizeof(XATTR_NAME_SELINUX);
3192         if (buffer && len <= buffer_size)
3193                 memcpy(buffer, XATTR_NAME_SELINUX, len);
3194         return len;
3195 }
3196
3197 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
3198 {
3199         struct inode_security_struct *isec = inode->i_security;
3200         *secid = isec->sid;
3201 }
3202
3203 /* file security operations */
3204
3205 static int selinux_revalidate_file_permission(struct file *file, int mask)
3206 {
3207         const struct cred *cred = current_cred();
3208         struct inode *inode = file_inode(file);
3209
3210         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
3211         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
3212                 mask |= MAY_APPEND;
3213
3214         return file_has_perm(cred, file,
3215                              file_mask_to_av(inode->i_mode, mask));
3216 }
3217
3218 static int selinux_file_permission(struct file *file, int mask)
3219 {
3220         struct inode *inode = file_inode(file);
3221         struct file_security_struct *fsec = file->f_security;
3222         struct inode_security_struct *isec = inode->i_security;
3223         u32 sid = current_sid();
3224
3225         if (!mask)
3226                 /* No permission to check.  Existence test. */
3227                 return 0;
3228
3229         if (sid == fsec->sid && fsec->isid == isec->sid &&
3230             fsec->pseqno == avc_policy_seqno())
3231                 /* No change since file_open check. */
3232                 return 0;
3233
3234         return selinux_revalidate_file_permission(file, mask);
3235 }
3236
3237 static int selinux_file_alloc_security(struct file *file)
3238 {
3239         return file_alloc_security(file);
3240 }
3241
3242 static void selinux_file_free_security(struct file *file)
3243 {
3244         file_free_security(file);
3245 }
3246
3247 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3248                               unsigned long arg)
3249 {
3250         const struct cred *cred = current_cred();
3251         int error = 0;
3252
3253         switch (cmd) {
3254         case FIONREAD:
3255         /* fall through */
3256         case FIBMAP:
3257         /* fall through */
3258         case FIGETBSZ:
3259         /* fall through */
3260         case FS_IOC_GETFLAGS:
3261         /* fall through */
3262         case FS_IOC_GETVERSION:
3263                 error = file_has_perm(cred, file, FILE__GETATTR);
3264                 break;
3265
3266         case FS_IOC_SETFLAGS:
3267         /* fall through */
3268         case FS_IOC_SETVERSION:
3269                 error = file_has_perm(cred, file, FILE__SETATTR);
3270                 break;
3271
3272         /* sys_ioctl() checks */
3273         case FIONBIO:
3274         /* fall through */
3275         case FIOASYNC:
3276                 error = file_has_perm(cred, file, 0);
3277                 break;
3278
3279         case KDSKBENT:
3280         case KDSKBSENT:
3281                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3282                                             SECURITY_CAP_AUDIT);
3283                 break;
3284
3285         /* default case assumes that the command will go
3286          * to the file's ioctl() function.
3287          */
3288         default:
3289                 error = file_has_perm(cred, file, FILE__IOCTL);
3290         }
3291         return error;
3292 }
3293
3294 static int default_noexec;
3295
3296 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3297 {
3298         const struct cred *cred = current_cred();
3299         int rc = 0;
3300
3301         if (default_noexec &&
3302             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3303                 /*
3304                  * We are making executable an anonymous mapping or a
3305                  * private file mapping that will also be writable.
3306                  * This has an additional check.
3307                  */
3308                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3309                 if (rc)
3310                         goto error;
3311         }
3312
3313         if (file) {
3314                 /* read access is always possible with a mapping */
3315                 u32 av = FILE__READ;
3316
3317                 /* write access only matters if the mapping is shared */
3318                 if (shared && (prot & PROT_WRITE))
3319                         av |= FILE__WRITE;
3320
3321                 if (prot & PROT_EXEC)
3322                         av |= FILE__EXECUTE;
3323
3324                 return file_has_perm(cred, file, av);
3325         }
3326
3327 error:
3328         return rc;
3329 }
3330
3331 static int selinux_mmap_addr(unsigned long addr)
3332 {
3333         int rc;
3334
3335         /* do DAC check on address space usage */
3336         rc = cap_mmap_addr(addr);
3337         if (rc)
3338                 return rc;
3339
3340         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3341                 u32 sid = current_sid();
3342                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3343                                   MEMPROTECT__MMAP_ZERO, NULL);
3344         }
3345
3346         return rc;
3347 }
3348
3349 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3350                              unsigned long prot, unsigned long flags)
3351 {
3352         if (selinux_checkreqprot)
3353                 prot = reqprot;
3354
3355         return file_map_prot_check(file, prot,
3356                                    (flags & MAP_TYPE) == MAP_SHARED);
3357 }
3358
3359 static int selinux_file_mprotect(struct vm_area_struct *vma,
3360                                  unsigned long reqprot,
3361                                  unsigned long prot)
3362 {
3363         const struct cred *cred = current_cred();
3364
3365         if (selinux_checkreqprot)
3366                 prot = reqprot;
3367
3368         if (default_noexec &&
3369             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3370                 int rc = 0;
3371                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3372                     vma->vm_end <= vma->vm_mm->brk) {
3373                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3374                 } else if (!vma->vm_file &&
3375                            vma->vm_start <= vma->vm_mm->start_stack &&
3376                            vma->vm_end >= vma->vm_mm->start_stack) {
3377                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3378                 } else if (vma->vm_file && vma->anon_vma) {
3379                         /*
3380                          * We are making executable a file mapping that has
3381                          * had some COW done. Since pages might have been
3382                          * written, check ability to execute the possibly
3383                          * modified content.  This typically should only
3384                          * occur for text relocations.
3385                          */
3386                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3387                 }
3388                 if (rc)
3389                         return rc;
3390         }
3391
3392         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3393 }
3394
3395 static int selinux_file_lock(struct file *file, unsigned int cmd)
3396 {
3397         const struct cred *cred = current_cred();
3398
3399         return file_has_perm(cred, file, FILE__LOCK);
3400 }
3401
3402 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3403                               unsigned long arg)
3404 {
3405         const struct cred *cred = current_cred();
3406         int err = 0;
3407
3408         switch (cmd) {
3409         case F_SETFL:
3410                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3411                         err = file_has_perm(cred, file, FILE__WRITE);
3412                         break;
3413                 }
3414                 /* fall through */
3415         case F_SETOWN:
3416         case F_SETSIG:
3417         case F_GETFL:
3418         case F_GETOWN:
3419         case F_GETSIG:
3420         case F_GETOWNER_UIDS:
3421                 /* Just check FD__USE permission */
3422                 err = file_has_perm(cred, file, 0);
3423                 break;
3424         case F_GETLK:
3425         case F_SETLK:
3426         case F_SETLKW:
3427         case F_OFD_GETLK:
3428         case F_OFD_SETLK:
3429         case F_OFD_SETLKW:
3430 #if BITS_PER_LONG == 32
3431         case F_GETLK64:
3432         case F_SETLK64:
3433         case F_SETLKW64:
3434 #endif
3435                 err = file_has_perm(cred, file, FILE__LOCK);
3436                 break;
3437         }
3438
3439         return err;
3440 }
3441
3442 static void selinux_file_set_fowner(struct file *file)
3443 {
3444         struct file_security_struct *fsec;
3445
3446         fsec = file->f_security;
3447         fsec->fown_sid = current_sid();
3448 }
3449
3450 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3451                                        struct fown_struct *fown, int signum)
3452 {
3453         struct file *file;
3454         u32 sid = task_sid(tsk);
3455         u32 perm;
3456         struct file_security_struct *fsec;
3457
3458         /* struct fown_struct is never outside the context of a struct file */
3459         file = container_of(fown, struct file, f_owner);
3460
3461         fsec = file->f_security;
3462
3463         if (!signum)
3464                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3465         else
3466                 perm = signal_to_av(signum);
3467
3468         return avc_has_perm(fsec->fown_sid, sid,
3469                             SECCLASS_PROCESS, perm, NULL);
3470 }
3471
3472 static int selinux_file_receive(struct file *file)
3473 {
3474         const struct cred *cred = current_cred();
3475
3476         return file_has_perm(cred, file, file_to_av(file));
3477 }
3478
3479 static int selinux_file_open(struct file *file, const struct cred *cred)
3480 {
3481         struct file_security_struct *fsec;
3482         struct inode_security_struct *isec;
3483
3484         fsec = file->f_security;
3485         isec = file_inode(file)->i_security;
3486         /*
3487          * Save inode label and policy sequence number
3488          * at open-time so that selinux_file_permission
3489          * can determine whether revalidation is necessary.
3490          * Task label is already saved in the file security
3491          * struct as its SID.
3492          */
3493         fsec->isid = isec->sid;
3494         fsec->pseqno = avc_policy_seqno();
3495         /*
3496          * Since the inode label or policy seqno may have changed
3497          * between the selinux_inode_permission check and the saving
3498          * of state above, recheck that access is still permitted.
3499          * Otherwise, access might never be revalidated against the
3500          * new inode label or new policy.
3501          * This check is not redundant - do not remove.
3502          */
3503         return file_path_has_perm(cred, file, open_file_to_av(file));
3504 }
3505
3506 /* task security operations */
3507
3508 static int selinux_task_create(unsigned long clone_flags)
3509 {
3510         return current_has_perm(current, PROCESS__FORK);
3511 }
3512
3513 /*
3514  * allocate the SELinux part of blank credentials
3515  */
3516 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3517 {
3518         struct task_security_struct *tsec;
3519
3520         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3521         if (!tsec)
3522                 return -ENOMEM;
3523
3524         cred->security = tsec;
3525         return 0;
3526 }
3527
3528 /*
3529  * detach and free the LSM part of a set of credentials
3530  */
3531 static void selinux_cred_free(struct cred *cred)
3532 {
3533         struct task_security_struct *tsec = cred->security;
3534
3535         /*
3536          * cred->security == NULL if security_cred_alloc_blank() or
3537          * security_prepare_creds() returned an error.
3538          */
3539         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3540         cred->security = (void *) 0x7UL;
3541         kfree(tsec);
3542 }
3543
3544 /*
3545  * prepare a new set of credentials for modification
3546  */
3547 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3548                                 gfp_t gfp)
3549 {
3550         const struct task_security_struct *old_tsec;
3551         struct task_security_struct *tsec;
3552
3553         old_tsec = old->security;
3554
3555         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3556         if (!tsec)
3557                 return -ENOMEM;
3558
3559         new->security = tsec;
3560         return 0;
3561 }
3562
3563 /*
3564  * transfer the SELinux data to a blank set of creds
3565  */
3566 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3567 {
3568         const struct task_security_struct *old_tsec = old->security;
3569         struct task_security_struct *tsec = new->security;
3570
3571         *tsec = *old_tsec;
3572 }
3573
3574 /*
3575  * set the security data for a kernel service
3576  * - all the creation contexts are set to unlabelled
3577  */
3578 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3579 {
3580         struct task_security_struct *tsec = new->security;
3581         u32 sid = current_sid();
3582         int ret;
3583
3584         ret = avc_has_perm(sid, secid,
3585                            SECCLASS_KERNEL_SERVICE,
3586                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3587                            NULL);
3588         if (ret == 0) {
3589                 tsec->sid = secid;
3590                 tsec->create_sid = 0;
3591                 tsec->keycreate_sid = 0;
3592                 tsec->sockcreate_sid = 0;
3593         }
3594         return ret;
3595 }
3596
3597 /*
3598  * set the file creation context in a security record to the same as the
3599  * objective context of the specified inode
3600  */
3601 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3602 {
3603         struct inode_security_struct *isec = inode->i_security;
3604         struct task_security_struct *tsec = new->security;
3605         u32 sid = current_sid();
3606         int ret;
3607
3608         ret = avc_has_perm(sid, isec->sid,
3609                            SECCLASS_KERNEL_SERVICE,
3610                            KERNEL_SERVICE__CREATE_FILES_AS,
3611                            NULL);
3612
3613         if (ret == 0)
3614                 tsec->create_sid = isec->sid;
3615         return ret;
3616 }
3617
3618 static int selinux_kernel_module_request(char *kmod_name)
3619 {
3620         u32 sid;
3621         struct common_audit_data ad;
3622
3623         sid = task_sid(current);
3624
3625         ad.type = LSM_AUDIT_DATA_KMOD;
3626         ad.u.kmod_name = kmod_name;
3627
3628         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3629                             SYSTEM__MODULE_REQUEST, &ad);
3630 }
3631
3632 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3633 {
3634         return current_has_perm(p, PROCESS__SETPGID);
3635 }
3636
3637 static int selinux_task_getpgid(struct task_struct *p)
3638 {
3639         return current_has_perm(p, PROCESS__GETPGID);
3640 }
3641
3642 static int selinux_task_getsid(struct task_struct *p)
3643 {
3644         return current_has_perm(p, PROCESS__GETSESSION);
3645 }
3646
3647 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3648 {
3649         *secid = task_sid(p);
3650 }
3651
3652 static int selinux_task_setnice(struct task_struct *p, int nice)
3653 {
3654         int rc;
3655
3656         rc = cap_task_setnice(p, nice);
3657         if (rc)
3658                 return rc;
3659
3660         return current_has_perm(p, PROCESS__SETSCHED);
3661 }
3662
3663 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3664 {
3665         int rc;
3666
3667         rc = cap_task_setioprio(p, ioprio);
3668         if (rc)
3669                 return rc;
3670
3671         return current_has_perm(p, PROCESS__SETSCHED);
3672 }
3673
3674 static int selinux_task_getioprio(struct task_struct *p)
3675 {
3676         return current_has_perm(p, PROCESS__GETSCHED);
3677 }
3678
3679 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3680                 struct rlimit *new_rlim)
3681 {
3682         struct rlimit *old_rlim = p->signal->rlim + resource;
3683
3684         /* Control the ability to change the hard limit (whether
3685            lowering or raising it), so that the hard limit can
3686            later be used as a safe reset point for the soft limit
3687            upon context transitions.  See selinux_bprm_committing_creds. */
3688         if (old_rlim->rlim_max != new_rlim->rlim_max)
3689                 return current_has_perm(p, PROCESS__SETRLIMIT);
3690
3691         return 0;
3692 }
3693
3694 static int selinux_task_setscheduler(struct task_struct *p)
3695 {
3696         int rc;
3697
3698         rc = cap_task_setscheduler(p);
3699         if (rc)
3700                 return rc;
3701
3702         return current_has_perm(p, PROCESS__SETSCHED);
3703 }
3704
3705 static int selinux_task_getscheduler(struct task_struct *p)
3706 {
3707         return current_has_perm(p, PROCESS__GETSCHED);
3708 }
3709
3710 static int selinux_task_movememory(struct task_struct *p)
3711 {
3712         return current_has_perm(p, PROCESS__SETSCHED);
3713 }
3714
3715 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3716                                 int sig, u32 secid)
3717 {
3718         u32 perm;
3719         int rc;
3720
3721         if (!sig)
3722                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3723         else
3724                 perm = signal_to_av(sig);
3725         if (secid)
3726                 rc = avc_has_perm(secid, task_sid(p),
3727                                   SECCLASS_PROCESS, perm, NULL);
3728         else
3729                 rc = current_has_perm(p, perm);
3730         return rc;
3731 }
3732
3733 static int selinux_task_wait(struct task_struct *p)
3734 {
3735         return task_has_perm(p, current, PROCESS__SIGCHLD);
3736 }
3737
3738 static void selinux_task_to_inode(struct task_struct *p,
3739                                   struct inode *inode)
3740 {
3741         struct inode_security_struct *isec = inode->i_security;
3742         u32 sid = task_sid(p);
3743
3744         isec->sid = sid;
3745         isec->initialized = 1;
3746 }
3747
3748 /* Returns error only if unable to parse addresses */
3749 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3750                         struct common_audit_data *ad, u8 *proto)
3751 {
3752         int offset, ihlen, ret = -EINVAL;
3753         struct iphdr _iph, *ih;
3754
3755         offset = skb_network_offset(skb);
3756         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3757         if (ih == NULL)
3758                 goto out;
3759
3760         ihlen = ih->ihl * 4;
3761         if (ihlen < sizeof(_iph))
3762                 goto out;
3763
3764         ad->u.net->v4info.saddr = ih->saddr;
3765         ad->u.net->v4info.daddr = ih->daddr;
3766         ret = 0;
3767
3768         if (proto)
3769                 *proto = ih->protocol;
3770
3771         switch (ih->protocol) {
3772         case IPPROTO_TCP: {
3773                 struct tcphdr _tcph, *th;
3774
3775                 if (ntohs(ih->frag_off) & IP_OFFSET)
3776                         break;
3777
3778                 offset += ihlen;
3779                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3780                 if (th == NULL)
3781                         break;
3782
3783                 ad->u.net->sport = th->source;
3784                 ad->u.net->dport = th->dest;
3785                 break;
3786         }
3787
3788         case IPPROTO_UDP: {
3789                 struct udphdr _udph, *uh;
3790
3791                 if (ntohs(ih->frag_off) & IP_OFFSET)
3792                         break;
3793
3794                 offset += ihlen;
3795                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3796                 if (uh == NULL)
3797                         break;
3798
3799                 ad->u.net->sport = uh->source;
3800                 ad->u.net->dport = uh->dest;
3801                 break;
3802         }
3803
3804         case IPPROTO_DCCP: {
3805                 struct dccp_hdr _dccph, *dh;
3806
3807                 if (ntohs(ih->frag_off) & IP_OFFSET)
3808                         break;
3809
3810                 offset += ihlen;
3811                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3812                 if (dh == NULL)
3813                         break;
3814
3815                 ad->u.net->sport = dh->dccph_sport;
3816                 ad->u.net->dport = dh->dccph_dport;
3817                 break;
3818         }
3819
3820         default:
3821                 break;
3822         }
3823 out:
3824         return ret;
3825 }
3826
3827 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3828
3829 /* Returns error only if unable to parse addresses */
3830 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3831                         struct common_audit_data *ad, u8 *proto)
3832 {
3833         u8 nexthdr;
3834         int ret = -EINVAL, offset;
3835         struct ipv6hdr _ipv6h, *ip6;
3836         __be16 frag_off;
3837
3838         offset = skb_network_offset(skb);
3839         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3840         if (ip6 == NULL)
3841                 goto out;
3842
3843         ad->u.net->v6info.saddr = ip6->saddr;
3844         ad->u.net->v6info.daddr = ip6->daddr;
3845         ret = 0;
3846
3847         nexthdr = ip6->nexthdr;
3848         offset += sizeof(_ipv6h);
3849         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3850         if (offset < 0)
3851                 goto out;
3852
3853         if (proto)
3854                 *proto = nexthdr;
3855
3856         switch (nexthdr) {
3857         case IPPROTO_TCP: {
3858                 struct tcphdr _tcph, *th;
3859
3860                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3861                 if (th == NULL)
3862                         break;
3863
3864                 ad->u.net->sport = th->source;
3865                 ad->u.net->dport = th->dest;
3866                 break;
3867         }
3868
3869         case IPPROTO_UDP: {
3870                 struct udphdr _udph, *uh;
3871
3872                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3873                 if (uh == NULL)
3874                         break;
3875
3876                 ad->u.net->sport = uh->source;
3877                 ad->u.net->dport = uh->dest;
3878                 break;
3879         }
3880
3881         case IPPROTO_DCCP: {
3882                 struct dccp_hdr _dccph, *dh;
3883
3884                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3885                 if (dh == NULL)
3886                         break;
3887
3888                 ad->u.net->sport = dh->dccph_sport;
3889                 ad->u.net->dport = dh->dccph_dport;
3890                 break;
3891         }
3892
3893         /* includes fragments */
3894         default:
3895                 break;
3896         }
3897 out:
3898         return ret;
3899 }
3900
3901 #endif /* IPV6 */
3902
3903 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3904                              char **_addrp, int src, u8 *proto)
3905 {
3906         char *addrp;
3907         int ret;
3908
3909         switch (ad->u.net->family) {
3910         case PF_INET:
3911                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3912                 if (ret)
3913                         goto parse_error;
3914                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3915                                        &ad->u.net->v4info.daddr);
3916                 goto okay;
3917
3918 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3919         case PF_INET6:
3920                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3921                 if (ret)
3922                         goto parse_error;
3923                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3924                                        &ad->u.net->v6info.daddr);
3925                 goto okay;
3926 #endif  /* IPV6 */
3927         default:
3928                 addrp = NULL;
3929                 goto okay;
3930         }
3931
3932 parse_error:
3933         printk(KERN_WARNING
3934                "SELinux: failure in selinux_parse_skb(),"
3935                " unable to parse packet\n");
3936         return ret;
3937
3938 okay:
3939         if (_addrp)
3940                 *_addrp = addrp;
3941         return 0;
3942 }
3943
3944 /**
3945  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3946  * @skb: the packet
3947  * @family: protocol family
3948  * @sid: the packet's peer label SID
3949  *
3950  * Description:
3951  * Check the various different forms of network peer labeling and determine
3952  * the peer label/SID for the packet; most of the magic actually occurs in
3953  * the security server function security_net_peersid_cmp().  The function
3954  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3955  * or -EACCES if @sid is invalid due to inconsistencies with the different
3956  * peer labels.
3957  *
3958  */
3959 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3960 {
3961         int err;
3962         u32 xfrm_sid;
3963         u32 nlbl_sid;
3964         u32 nlbl_type;
3965
3966         err = selinux_xfrm_skb_sid(skb, &xfrm_sid);
3967         if (unlikely(err))
3968                 return -EACCES;
3969         err = selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3970         if (unlikely(err))
3971                 return -EACCES;
3972
3973         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3974         if (unlikely(err)) {
3975                 printk(KERN_WARNING
3976                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3977                        " unable to determine packet's peer label\n");
3978                 return -EACCES;
3979         }
3980
3981         return 0;
3982 }
3983
3984 /**
3985  * selinux_conn_sid - Determine the child socket label for a connection
3986  * @sk_sid: the parent socket's SID
3987  * @skb_sid: the packet's SID
3988  * @conn_sid: the resulting connection SID
3989  *
3990  * If @skb_sid is valid then the user:role:type information from @sk_sid is
3991  * combined with the MLS information from @skb_sid in order to create
3992  * @conn_sid.  If @skb_sid is not valid then then @conn_sid is simply a copy
3993  * of @sk_sid.  Returns zero on success, negative values on failure.
3994  *
3995  */
3996 static int selinux_conn_sid(u32 sk_sid, u32 skb_sid, u32 *conn_sid)
3997 {
3998         int err = 0;
3999
4000         if (skb_sid != SECSID_NULL)
4001                 err = security_sid_mls_copy(sk_sid, skb_sid, conn_sid);
4002         else
4003                 *conn_sid = sk_sid;
4004
4005         return err;
4006 }
4007
4008 /* socket security operations */
4009
4010 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
4011                                  u16 secclass, u32 *socksid)
4012 {
4013         if (tsec->sockcreate_sid > SECSID_NULL) {
4014                 *socksid = tsec->sockcreate_sid;
4015                 return 0;
4016         }
4017
4018         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
4019                                        socksid);
4020 }
4021
4022 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
4023 {
4024         struct sk_security_struct *sksec = sk->sk_security;
4025         struct common_audit_data ad;
4026         struct lsm_network_audit net = {0,};
4027         u32 tsid = task_sid(task);
4028
4029         if (sksec->sid == SECINITSID_KERNEL)
4030                 return 0;
4031
4032         ad.type = LSM_AUDIT_DATA_NET;
4033         ad.u.net = &net;
4034         ad.u.net->sk = sk;
4035
4036         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
4037 }
4038
4039 static int selinux_socket_create(int family, int type,
4040                                  int protocol, int kern)
4041 {
4042         const struct task_security_struct *tsec = current_security();
4043         u32 newsid;
4044         u16 secclass;
4045         int rc;
4046
4047         if (kern)
4048                 return 0;
4049
4050         secclass = socket_type_to_security_class(family, type, protocol);
4051         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
4052         if (rc)
4053                 return rc;
4054
4055         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
4056 }
4057
4058 static int selinux_socket_post_create(struct socket *sock, int family,
4059                                       int type, int protocol, int kern)
4060 {
4061         const struct task_security_struct *tsec = current_security();
4062         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
4063         struct sk_security_struct *sksec;
4064         int err = 0;
4065
4066         isec->sclass = socket_type_to_security_class(family, type, protocol);
4067
4068         if (kern)
4069                 isec->sid = SECINITSID_KERNEL;
4070         else {
4071                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
4072                 if (err)
4073                         return err;
4074         }
4075
4076         isec->initialized = 1;
4077
4078         if (sock->sk) {
4079                 sksec = sock->sk->sk_security;
4080                 sksec->sid = isec->sid;
4081                 sksec->sclass = isec->sclass;
4082                 err = selinux_netlbl_socket_post_create(sock->sk, family);
4083         }
4084
4085         return err;
4086 }
4087
4088 /* Range of port numbers used to automatically bind.
4089    Need to determine whether we should perform a name_bind
4090    permission check between the socket and the port number. */
4091
4092 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
4093 {
4094         struct sock *sk = sock->sk;
4095         u16 family;
4096         int err;
4097
4098         err = sock_has_perm(current, sk, SOCKET__BIND);
4099         if (err)
4100                 goto out;
4101
4102         /*
4103          * If PF_INET or PF_INET6, check name_bind permission for the port.
4104          * Multiple address binding for SCTP is not supported yet: we just
4105          * check the first address now.
4106          */
4107         family = sk->sk_family;
4108         if (family == PF_INET || family == PF_INET6) {
4109                 char *addrp;
4110                 struct sk_security_struct *sksec = sk->sk_security;
4111                 struct common_audit_data ad;
4112                 struct lsm_network_audit net = {0,};
4113                 struct sockaddr_in *addr4 = NULL;
4114                 struct sockaddr_in6 *addr6 = NULL;
4115                 unsigned short snum;
4116                 u32 sid, node_perm;
4117
4118                 if (family == PF_INET) {
4119                         addr4 = (struct sockaddr_in *)address;
4120                         snum = ntohs(addr4->sin_port);
4121                         addrp = (char *)&addr4->sin_addr.s_addr;
4122                 } else {
4123                         addr6 = (struct sockaddr_in6 *)address;
4124                         snum = ntohs(addr6->sin6_port);
4125                         addrp = (char *)&addr6->sin6_addr.s6_addr;
4126                 }
4127
4128                 if (snum) {
4129                         int low, high;
4130
4131                         inet_get_local_port_range(sock_net(sk), &low, &high);
4132
4133                         if (snum < max(PROT_SOCK, low) || snum > high) {
4134                                 err = sel_netport_sid(sk->sk_protocol,
4135                                                       snum, &sid);
4136                                 if (err)
4137                                         goto out;
4138                                 ad.type = LSM_AUDIT_DATA_NET;
4139                                 ad.u.net = &net;
4140                                 ad.u.net->sport = htons(snum);
4141                                 ad.u.net->family = family;
4142                                 err = avc_has_perm(sksec->sid, sid,
4143                                                    sksec->sclass,
4144                                                    SOCKET__NAME_BIND, &ad);
4145                                 if (err)
4146                                         goto out;
4147                         }
4148                 }
4149
4150                 switch (sksec->sclass) {
4151                 case SECCLASS_TCP_SOCKET:
4152                         node_perm = TCP_SOCKET__NODE_BIND;
4153                         break;
4154
4155                 case SECCLASS_UDP_SOCKET:
4156                         node_perm = UDP_SOCKET__NODE_BIND;
4157                         break;
4158
4159                 case SECCLASS_DCCP_SOCKET:
4160                         node_perm = DCCP_SOCKET__NODE_BIND;
4161                         break;
4162
4163                 default:
4164                         node_perm = RAWIP_SOCKET__NODE_BIND;
4165                         break;
4166                 }
4167
4168                 err = sel_netnode_sid(addrp, family, &sid);
4169                 if (err)
4170                         goto out;
4171
4172                 ad.type = LSM_AUDIT_DATA_NET;
4173                 ad.u.net = &net;
4174                 ad.u.net->sport = htons(snum);
4175                 ad.u.net->family = family;
4176
4177                 if (family == PF_INET)
4178                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
4179                 else
4180                         ad.u.net->v6info.saddr = addr6->sin6_addr;
4181
4182                 err = avc_has_perm(sksec->sid, sid,
4183                                    sksec->sclass, node_perm, &ad);
4184                 if (err)
4185                         goto out;
4186         }
4187 out:
4188         return err;
4189 }
4190
4191 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
4192 {
4193         struct sock *sk = sock->sk;
4194         struct sk_security_struct *sksec = sk->sk_security;
4195         int err;
4196
4197         err = sock_has_perm(current, sk, SOCKET__CONNECT);
4198         if (err)
4199                 return err;
4200
4201         /*
4202          * If a TCP or DCCP socket, check name_connect permission for the port.
4203          */
4204         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
4205             sksec->sclass == SECCLASS_DCCP_SOCKET) {
4206                 struct common_audit_data ad;
4207                 struct lsm_network_audit net = {0,};
4208                 struct sockaddr_in *addr4 = NULL;
4209                 struct sockaddr_in6 *addr6 = NULL;
4210                 unsigned short snum;
4211                 u32 sid, perm;
4212
4213                 if (sk->sk_family == PF_INET) {
4214                         addr4 = (struct sockaddr_in *)address;
4215                         if (addrlen < sizeof(struct sockaddr_in))
4216                                 return -EINVAL;
4217                         snum = ntohs(addr4->sin_port);
4218                 } else {
4219                         addr6 = (struct sockaddr_in6 *)address;
4220                         if (addrlen < SIN6_LEN_RFC2133)
4221                                 return -EINVAL;
4222                         snum = ntohs(addr6->sin6_port);
4223                 }
4224
4225                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
4226                 if (err)
4227                         goto out;
4228
4229                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
4230                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
4231
4232                 ad.type = LSM_AUDIT_DATA_NET;
4233                 ad.u.net = &net;
4234                 ad.u.net->dport = htons(snum);
4235                 ad.u.net->family = sk->sk_family;
4236                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
4237                 if (err)
4238                         goto out;
4239         }
4240
4241         err = selinux_netlbl_socket_connect(sk, address);
4242
4243 out:
4244         return err;
4245 }
4246
4247 static int selinux_socket_listen(struct socket *sock, int backlog)
4248 {
4249         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
4250 }
4251
4252 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
4253 {
4254         int err;
4255         struct inode_security_struct *isec;
4256         struct inode_security_struct *newisec;
4257
4258         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
4259         if (err)
4260                 return err;
4261
4262         newisec = SOCK_INODE(newsock)->i_security;
4263
4264         isec = SOCK_INODE(sock)->i_security;
4265         newisec->sclass = isec->sclass;
4266         newisec->sid = isec->sid;
4267         newisec->initialized = 1;
4268
4269         return 0;
4270 }
4271
4272 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4273                                   int size)
4274 {
4275         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4276 }
4277
4278 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4279                                   int size, int flags)
4280 {
4281         return sock_has_perm(current, sock->sk, SOCKET__READ);
4282 }
4283
4284 static int selinux_socket_getsockname(struct socket *sock)
4285 {
4286         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4287 }
4288
4289 static int selinux_socket_getpeername(struct socket *sock)
4290 {
4291         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4292 }
4293
4294 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4295 {
4296         int err;
4297
4298         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4299         if (err)
4300                 return err;
4301
4302         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4303 }
4304
4305 static int selinux_socket_getsockopt(struct socket *sock, int level,
4306                                      int optname)
4307 {
4308         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4309 }
4310
4311 static int selinux_socket_shutdown(struct socket *sock, int how)
4312 {
4313         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4314 }
4315
4316 static int selinux_socket_unix_stream_connect(struct sock *sock,
4317                                               struct sock *other,
4318                                               struct sock *newsk)
4319 {
4320         struct sk_security_struct *sksec_sock = sock->sk_security;
4321         struct sk_security_struct *sksec_other = other->sk_security;
4322         struct sk_security_struct *sksec_new = newsk->sk_security;
4323         struct common_audit_data ad;
4324         struct lsm_network_audit net = {0,};
4325         int err;
4326
4327         ad.type = LSM_AUDIT_DATA_NET;
4328         ad.u.net = &net;
4329         ad.u.net->sk = other;
4330
4331         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4332                            sksec_other->sclass,
4333                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4334         if (err)
4335                 return err;
4336
4337         /* server child socket */
4338         sksec_new->peer_sid = sksec_sock->sid;
4339         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4340                                     &sksec_new->sid);
4341         if (err)
4342                 return err;
4343
4344         /* connecting socket */
4345         sksec_sock->peer_sid = sksec_new->sid;
4346
4347         return 0;
4348 }
4349
4350 static int selinux_socket_unix_may_send(struct socket *sock,
4351                                         struct socket *other)
4352 {
4353         struct sk_security_struct *ssec = sock->sk->sk_security;
4354         struct sk_security_struct *osec = other->sk->sk_security;
4355         struct common_audit_data ad;
4356         struct lsm_network_audit net = {0,};
4357
4358         ad.type = LSM_AUDIT_DATA_NET;
4359         ad.u.net = &net;
4360         ad.u.net->sk = other->sk;
4361
4362         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4363                             &ad);
4364 }
4365
4366 static int selinux_inet_sys_rcv_skb(struct net *ns, int ifindex,
4367                                     char *addrp, u16 family, u32 peer_sid,
4368                                     struct common_audit_data *ad)
4369 {
4370         int err;
4371         u32 if_sid;
4372         u32 node_sid;
4373
4374         err = sel_netif_sid(ns, ifindex, &if_sid);
4375         if (err)
4376                 return err;
4377         err = avc_has_perm(peer_sid, if_sid,
4378                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4379         if (err)
4380                 return err;
4381
4382         err = sel_netnode_sid(addrp, family, &node_sid);
4383         if (err)
4384                 return err;
4385         return avc_has_perm(peer_sid, node_sid,
4386                             SECCLASS_NODE, NODE__RECVFROM, ad);
4387 }
4388
4389 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4390                                        u16 family)
4391 {
4392         int err = 0;
4393         struct sk_security_struct *sksec = sk->sk_security;
4394         u32 sk_sid = sksec->sid;
4395         struct common_audit_data ad;
4396         struct lsm_network_audit net = {0,};
4397         char *addrp;
4398
4399         ad.type = LSM_AUDIT_DATA_NET;
4400         ad.u.net = &net;
4401         ad.u.net->netif = skb->skb_iif;
4402         ad.u.net->family = family;
4403         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4404         if (err)
4405                 return err;
4406
4407         if (selinux_secmark_enabled()) {
4408                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4409                                    PACKET__RECV, &ad);
4410                 if (err)
4411                         return err;
4412         }
4413
4414         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4415         if (err)
4416                 return err;
4417         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4418
4419         return err;
4420 }
4421
4422 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4423 {
4424         int err;
4425         struct sk_security_struct *sksec = sk->sk_security;
4426         u16 family = sk->sk_family;
4427         u32 sk_sid = sksec->sid;
4428         struct common_audit_data ad;
4429         struct lsm_network_audit net = {0,};
4430         char *addrp;
4431         u8 secmark_active;
4432         u8 peerlbl_active;
4433
4434         if (family != PF_INET && family != PF_INET6)
4435                 return 0;
4436
4437         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4438         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4439                 family = PF_INET;
4440
4441         /* If any sort of compatibility mode is enabled then handoff processing
4442          * to the selinux_sock_rcv_skb_compat() function to deal with the
4443          * special handling.  We do this in an attempt to keep this function
4444          * as fast and as clean as possible. */
4445         if (!selinux_policycap_netpeer)
4446                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4447
4448         secmark_active = selinux_secmark_enabled();
4449         peerlbl_active = selinux_peerlbl_enabled();
4450         if (!secmark_active && !peerlbl_active)
4451                 return 0;
4452
4453         ad.type = LSM_AUDIT_DATA_NET;
4454         ad.u.net = &net;
4455         ad.u.net->netif = skb->skb_iif;
4456         ad.u.net->family = family;
4457         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4458         if (err)
4459                 return err;
4460
4461         if (peerlbl_active) {
4462                 u32 peer_sid;
4463
4464                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4465                 if (err)
4466                         return err;
4467                 err = selinux_inet_sys_rcv_skb(sock_net(sk), skb->skb_iif,
4468                                                addrp, family, peer_sid, &ad);
4469                 if (err) {
4470                         selinux_netlbl_err(skb, err, 0);
4471                         return err;
4472                 }
4473                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4474                                    PEER__RECV, &ad);
4475                 if (err) {
4476                         selinux_netlbl_err(skb, err, 0);
4477                         return err;
4478                 }
4479         }
4480
4481         if (secmark_active) {
4482                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4483                                    PACKET__RECV, &ad);
4484                 if (err)
4485                         return err;
4486         }
4487
4488         return err;
4489 }
4490
4491 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4492                                             int __user *optlen, unsigned len)
4493 {
4494         int err = 0;
4495         char *scontext;
4496         u32 scontext_len;
4497         struct sk_security_struct *sksec = sock->sk->sk_security;
4498         u32 peer_sid = SECSID_NULL;
4499
4500         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4501             sksec->sclass == SECCLASS_TCP_SOCKET)
4502                 peer_sid = sksec->peer_sid;
4503         if (peer_sid == SECSID_NULL)
4504                 return -ENOPROTOOPT;
4505
4506         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4507         if (err)
4508                 return err;
4509
4510         if (scontext_len > len) {
4511                 err = -ERANGE;
4512                 goto out_len;
4513         }
4514
4515         if (copy_to_user(optval, scontext, scontext_len))
4516                 err = -EFAULT;
4517
4518 out_len:
4519         if (put_user(scontext_len, optlen))
4520                 err = -EFAULT;
4521         kfree(scontext);
4522         return err;
4523 }
4524
4525 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4526 {
4527         u32 peer_secid = SECSID_NULL;
4528         u16 family;
4529
4530         if (skb && skb->protocol == htons(ETH_P_IP))
4531                 family = PF_INET;
4532         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4533                 family = PF_INET6;
4534         else if (sock)
4535                 family = sock->sk->sk_family;
4536         else
4537                 goto out;
4538
4539         if (sock && family == PF_UNIX)
4540                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4541         else if (skb)
4542                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4543
4544 out:
4545         *secid = peer_secid;
4546         if (peer_secid == SECSID_NULL)
4547                 return -EINVAL;
4548         return 0;
4549 }
4550
4551 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4552 {
4553         struct sk_security_struct *sksec;
4554
4555         sksec = kzalloc(sizeof(*sksec), priority);
4556         if (!sksec)
4557                 return -ENOMEM;
4558
4559         sksec->peer_sid = SECINITSID_UNLABELED;
4560         sksec->sid = SECINITSID_UNLABELED;
4561         selinux_netlbl_sk_security_reset(sksec);
4562         sk->sk_security = sksec;
4563
4564         return 0;
4565 }
4566
4567 static void selinux_sk_free_security(struct sock *sk)
4568 {
4569         struct sk_security_struct *sksec = sk->sk_security;
4570
4571         sk->sk_security = NULL;
4572         selinux_netlbl_sk_security_free(sksec);
4573         kfree(sksec);
4574 }
4575
4576 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4577 {
4578         struct sk_security_struct *sksec = sk->sk_security;
4579         struct sk_security_struct *newsksec = newsk->sk_security;
4580
4581         newsksec->sid = sksec->sid;
4582         newsksec->peer_sid = sksec->peer_sid;
4583         newsksec->sclass = sksec->sclass;
4584
4585         selinux_netlbl_sk_security_reset(newsksec);
4586 }
4587
4588 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4589 {
4590         if (!sk)
4591                 *secid = SECINITSID_ANY_SOCKET;
4592         else {
4593                 struct sk_security_struct *sksec = sk->sk_security;
4594
4595                 *secid = sksec->sid;
4596         }
4597 }
4598
4599 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4600 {
4601         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4602         struct sk_security_struct *sksec = sk->sk_security;
4603
4604         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4605             sk->sk_family == PF_UNIX)
4606                 isec->sid = sksec->sid;
4607         sksec->sclass = isec->sclass;
4608 }
4609
4610 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4611                                      struct request_sock *req)
4612 {
4613         struct sk_security_struct *sksec = sk->sk_security;
4614         int err;
4615         u16 family = req->rsk_ops->family;
4616         u32 connsid;
4617         u32 peersid;
4618
4619         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4620         if (err)
4621                 return err;
4622         err = selinux_conn_sid(sksec->sid, peersid, &connsid);
4623         if (err)
4624                 return err;
4625         req->secid = connsid;
4626         req->peer_secid = peersid;
4627
4628         return selinux_netlbl_inet_conn_request(req, family);
4629 }
4630
4631 static void selinux_inet_csk_clone(struct sock *newsk,
4632                                    const struct request_sock *req)
4633 {
4634         struct sk_security_struct *newsksec = newsk->sk_security;
4635
4636         newsksec->sid = req->secid;
4637         newsksec->peer_sid = req->peer_secid;
4638         /* NOTE: Ideally, we should also get the isec->sid for the
4639            new socket in sync, but we don't have the isec available yet.
4640            So we will wait until sock_graft to do it, by which
4641            time it will have been created and available. */
4642
4643         /* We don't need to take any sort of lock here as we are the only
4644          * thread with access to newsksec */
4645         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4646 }
4647
4648 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4649 {
4650         u16 family = sk->sk_family;
4651         struct sk_security_struct *sksec = sk->sk_security;
4652
4653         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4654         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4655                 family = PF_INET;
4656
4657         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4658 }
4659
4660 static int selinux_secmark_relabel_packet(u32 sid)
4661 {
4662         const struct task_security_struct *__tsec;
4663         u32 tsid;
4664
4665         __tsec = current_security();
4666         tsid = __tsec->sid;
4667
4668         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4669 }
4670
4671 static void selinux_secmark_refcount_inc(void)
4672 {
4673         atomic_inc(&selinux_secmark_refcount);
4674 }
4675
4676 static void selinux_secmark_refcount_dec(void)
4677 {
4678         atomic_dec(&selinux_secmark_refcount);
4679 }
4680
4681 static void selinux_req_classify_flow(const struct request_sock *req,
4682                                       struct flowi *fl)
4683 {
4684         fl->flowi_secid = req->secid;
4685 }
4686
4687 static int selinux_tun_dev_alloc_security(void **security)
4688 {
4689         struct tun_security_struct *tunsec;
4690
4691         tunsec = kzalloc(sizeof(*tunsec), GFP_KERNEL);
4692         if (!tunsec)
4693                 return -ENOMEM;
4694         tunsec->sid = current_sid();
4695
4696         *security = tunsec;
4697         return 0;
4698 }
4699
4700 static void selinux_tun_dev_free_security(void *security)
4701 {
4702         kfree(security);
4703 }
4704
4705 static int selinux_tun_dev_create(void)
4706 {
4707         u32 sid = current_sid();
4708
4709         /* we aren't taking into account the "sockcreate" SID since the socket
4710          * that is being created here is not a socket in the traditional sense,
4711          * instead it is a private sock, accessible only to the kernel, and
4712          * representing a wide range of network traffic spanning multiple
4713          * connections unlike traditional sockets - check the TUN driver to
4714          * get a better understanding of why this socket is special */
4715
4716         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4717                             NULL);
4718 }
4719
4720 static int selinux_tun_dev_attach_queue(void *security)
4721 {
4722         struct tun_security_struct *tunsec = security;
4723
4724         return avc_has_perm(current_sid(), tunsec->sid, SECCLASS_TUN_SOCKET,
4725                             TUN_SOCKET__ATTACH_QUEUE, NULL);
4726 }
4727
4728 static int selinux_tun_dev_attach(struct sock *sk, void *security)
4729 {
4730         struct tun_security_struct *tunsec = security;
4731         struct sk_security_struct *sksec = sk->sk_security;
4732
4733         /* we don't currently perform any NetLabel based labeling here and it
4734          * isn't clear that we would want to do so anyway; while we could apply
4735          * labeling without the support of the TUN user the resulting labeled
4736          * traffic from the other end of the connection would almost certainly
4737          * cause confusion to the TUN user that had no idea network labeling
4738          * protocols were being used */
4739
4740         sksec->sid = tunsec->sid;
4741         sksec->sclass = SECCLASS_TUN_SOCKET;
4742
4743         return 0;
4744 }
4745
4746 static int selinux_tun_dev_open(void *security)
4747 {
4748         struct tun_security_struct *tunsec = security;
4749         u32 sid = current_sid();
4750         int err;
4751
4752         err = avc_has_perm(sid, tunsec->sid, SECCLASS_TUN_SOCKET,
4753                            TUN_SOCKET__RELABELFROM, NULL);
4754         if (err)
4755                 return err;
4756         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4757                            TUN_SOCKET__RELABELTO, NULL);
4758         if (err)
4759                 return err;
4760         tunsec->sid = sid;
4761
4762         return 0;
4763 }
4764
4765 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4766 {
4767         int err = 0;
4768         u32 perm;
4769         struct nlmsghdr *nlh;
4770         struct sk_security_struct *sksec = sk->sk_security;
4771
4772         if (skb->len < NLMSG_HDRLEN) {
4773                 err = -EINVAL;
4774                 goto out;
4775         }
4776         nlh = nlmsg_hdr(skb);
4777
4778         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4779         if (err) {
4780                 if (err == -EINVAL) {
4781                         printk(KERN_WARNING
4782                                "SELinux: unrecognized netlink message:"
4783                                " protocol=%hu nlmsg_type=%hu sclass=%hu\n",
4784                                sk->sk_protocol, nlh->nlmsg_type, sksec->sclass);
4785                         if (!selinux_enforcing || security_get_allow_unknown())
4786                                 err = 0;
4787                 }
4788
4789                 /* Ignore */
4790                 if (err == -ENOENT)
4791                         err = 0;
4792                 goto out;
4793         }
4794
4795         err = sock_has_perm(current, sk, perm);
4796 out:
4797         return err;
4798 }
4799
4800 #ifdef CONFIG_NETFILTER
4801
4802 static unsigned int selinux_ip_forward(struct sk_buff *skb,
4803                                        const struct net_device *indev,
4804                                        u16 family)
4805 {
4806         int err;
4807         char *addrp;
4808         u32 peer_sid;
4809         struct common_audit_data ad;
4810         struct lsm_network_audit net = {0,};
4811         u8 secmark_active;
4812         u8 netlbl_active;
4813         u8 peerlbl_active;
4814
4815         if (!selinux_policycap_netpeer)
4816                 return NF_ACCEPT;
4817
4818         secmark_active = selinux_secmark_enabled();
4819         netlbl_active = netlbl_enabled();
4820         peerlbl_active = selinux_peerlbl_enabled();
4821         if (!secmark_active && !peerlbl_active)
4822                 return NF_ACCEPT;
4823
4824         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4825                 return NF_DROP;
4826
4827         ad.type = LSM_AUDIT_DATA_NET;
4828         ad.u.net = &net;
4829         ad.u.net->netif = indev->ifindex;
4830         ad.u.net->family = family;
4831         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4832                 return NF_DROP;
4833
4834         if (peerlbl_active) {
4835                 err = selinux_inet_sys_rcv_skb(dev_net(indev), indev->ifindex,
4836                                                addrp, family, peer_sid, &ad);
4837                 if (err) {
4838                         selinux_netlbl_err(skb, err, 1);
4839                         return NF_DROP;
4840                 }
4841         }
4842
4843         if (secmark_active)
4844                 if (avc_has_perm(peer_sid, skb->secmark,
4845                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4846                         return NF_DROP;
4847
4848         if (netlbl_active)
4849                 /* we do this in the FORWARD path and not the POST_ROUTING
4850                  * path because we want to make sure we apply the necessary
4851                  * labeling before IPsec is applied so we can leverage AH
4852                  * protection */
4853                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4854                         return NF_DROP;
4855
4856         return NF_ACCEPT;
4857 }
4858
4859 static unsigned int selinux_ipv4_forward(const struct nf_hook_ops *ops,
4860                                          struct sk_buff *skb,
4861                                          const struct nf_hook_state *state)
4862 {
4863         return selinux_ip_forward(skb, state->in, PF_INET);
4864 }
4865
4866 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4867 static unsigned int selinux_ipv6_forward(const struct nf_hook_ops *ops,
4868                                          struct sk_buff *skb,
4869                                          const struct nf_hook_state *state)
4870 {
4871         return selinux_ip_forward(skb, state->in, PF_INET6);
4872 }
4873 #endif  /* IPV6 */
4874
4875 static unsigned int selinux_ip_output(struct sk_buff *skb,
4876                                       u16 family)
4877 {
4878         struct sock *sk;
4879         u32 sid;
4880
4881         if (!netlbl_enabled())
4882                 return NF_ACCEPT;
4883
4884         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4885          * because we want to make sure we apply the necessary labeling
4886          * before IPsec is applied so we can leverage AH protection */
4887         sk = skb->sk;
4888         if (sk) {
4889                 struct sk_security_struct *sksec;
4890
4891                 if (sk->sk_state == TCP_LISTEN)
4892                         /* if the socket is the listening state then this
4893                          * packet is a SYN-ACK packet which means it needs to
4894                          * be labeled based on the connection/request_sock and
4895                          * not the parent socket.  unfortunately, we can't
4896                          * lookup the request_sock yet as it isn't queued on
4897                          * the parent socket until after the SYN-ACK is sent.
4898                          * the "solution" is to simply pass the packet as-is
4899                          * as any IP option based labeling should be copied
4900                          * from the initial connection request (in the IP
4901                          * layer).  it is far from ideal, but until we get a
4902                          * security label in the packet itself this is the
4903                          * best we can do. */
4904                         return NF_ACCEPT;
4905
4906                 /* standard practice, label using the parent socket */
4907                 sksec = sk->sk_security;
4908                 sid = sksec->sid;
4909         } else
4910                 sid = SECINITSID_KERNEL;
4911         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4912                 return NF_DROP;
4913
4914         return NF_ACCEPT;
4915 }
4916
4917 static unsigned int selinux_ipv4_output(const struct nf_hook_ops *ops,
4918                                         struct sk_buff *skb,
4919                                         const struct nf_hook_state *state)
4920 {
4921         return selinux_ip_output(skb, PF_INET);
4922 }
4923
4924 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4925                                                 int ifindex,
4926                                                 u16 family)
4927 {
4928         struct sock *sk = skb->sk;
4929         struct sk_security_struct *sksec;
4930         struct common_audit_data ad;
4931         struct lsm_network_audit net = {0,};
4932         char *addrp;
4933         u8 proto;
4934
4935         if (sk == NULL)
4936                 return NF_ACCEPT;
4937         sksec = sk->sk_security;
4938
4939         ad.type = LSM_AUDIT_DATA_NET;
4940         ad.u.net = &net;
4941         ad.u.net->netif = ifindex;
4942         ad.u.net->family = family;
4943         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4944                 return NF_DROP;
4945
4946         if (selinux_secmark_enabled())
4947                 if (avc_has_perm(sksec->sid, skb->secmark,
4948                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4949                         return NF_DROP_ERR(-ECONNREFUSED);
4950
4951         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4952                 return NF_DROP_ERR(-ECONNREFUSED);
4953
4954         return NF_ACCEPT;
4955 }
4956
4957 static unsigned int selinux_ip_postroute(struct sk_buff *skb,
4958                                          const struct net_device *outdev,
4959                                          u16 family)
4960 {
4961         u32 secmark_perm;
4962         u32 peer_sid;
4963         int ifindex = outdev->ifindex;
4964         struct sock *sk;
4965         struct common_audit_data ad;
4966         struct lsm_network_audit net = {0,};
4967         char *addrp;
4968         u8 secmark_active;
4969         u8 peerlbl_active;
4970
4971         /* If any sort of compatibility mode is enabled then handoff processing
4972          * to the selinux_ip_postroute_compat() function to deal with the
4973          * special handling.  We do this in an attempt to keep this function
4974          * as fast and as clean as possible. */
4975         if (!selinux_policycap_netpeer)
4976                 return selinux_ip_postroute_compat(skb, ifindex, family);
4977
4978         secmark_active = selinux_secmark_enabled();
4979         peerlbl_active = selinux_peerlbl_enabled();
4980         if (!secmark_active && !peerlbl_active)
4981                 return NF_ACCEPT;
4982
4983         sk = skb->sk;
4984
4985 #ifdef CONFIG_XFRM
4986         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4987          * packet transformation so allow the packet to pass without any checks
4988          * since we'll have another chance to perform access control checks
4989          * when the packet is on it's final way out.
4990          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4991          *       is NULL, in this case go ahead and apply access control.
4992          * NOTE: if this is a local socket (skb->sk != NULL) that is in the
4993          *       TCP listening state we cannot wait until the XFRM processing
4994          *       is done as we will miss out on the SA label if we do;
4995          *       unfortunately, this means more work, but it is only once per
4996          *       connection. */
4997         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL &&
4998             !(sk != NULL && sk->sk_state == TCP_LISTEN))
4999                 return NF_ACCEPT;
5000 #endif
5001
5002         if (sk == NULL) {
5003                 /* Without an associated socket the packet is either coming
5004                  * from the kernel or it is being forwarded; check the packet
5005                  * to determine which and if the packet is being forwarded
5006                  * query the packet directly to determine the security label. */
5007                 if (skb->skb_iif) {
5008                         secmark_perm = PACKET__FORWARD_OUT;
5009                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
5010                                 return NF_DROP;
5011                 } else {
5012                         secmark_perm = PACKET__SEND;
5013                         peer_sid = SECINITSID_KERNEL;
5014                 }
5015         } else if (sk->sk_state == TCP_LISTEN) {
5016                 /* Locally generated packet but the associated socket is in the
5017                  * listening state which means this is a SYN-ACK packet.  In
5018                  * this particular case the correct security label is assigned
5019                  * to the connection/request_sock but unfortunately we can't
5020                  * query the request_sock as it isn't queued on the parent
5021                  * socket until after the SYN-ACK packet is sent; the only
5022                  * viable choice is to regenerate the label like we do in
5023                  * selinux_inet_conn_request().  See also selinux_ip_output()
5024                  * for similar problems. */
5025                 u32 skb_sid;
5026                 struct sk_security_struct *sksec = sk->sk_security;
5027                 if (selinux_skb_peerlbl_sid(skb, family, &skb_sid))
5028                         return NF_DROP;
5029                 /* At this point, if the returned skb peerlbl is SECSID_NULL
5030                  * and the packet has been through at least one XFRM
5031                  * transformation then we must be dealing with the "final"
5032                  * form of labeled IPsec packet; since we've already applied
5033                  * all of our access controls on this packet we can safely
5034                  * pass the packet. */
5035                 if (skb_sid == SECSID_NULL) {
5036                         switch (family) {
5037                         case PF_INET:
5038                                 if (IPCB(skb)->flags & IPSKB_XFRM_TRANSFORMED)
5039                                         return NF_ACCEPT;
5040                                 break;
5041                         case PF_INET6:
5042                                 if (IP6CB(skb)->flags & IP6SKB_XFRM_TRANSFORMED)
5043                                         return NF_ACCEPT;
5044                                 break;
5045                         default:
5046                                 return NF_DROP_ERR(-ECONNREFUSED);
5047                         }
5048                 }
5049                 if (selinux_conn_sid(sksec->sid, skb_sid, &peer_sid))
5050                         return NF_DROP;
5051                 secmark_perm = PACKET__SEND;
5052         } else {
5053                 /* Locally generated packet, fetch the security label from the
5054                  * associated socket. */
5055                 struct sk_security_struct *sksec = sk->sk_security;
5056                 peer_sid = sksec->sid;
5057                 secmark_perm = PACKET__SEND;
5058         }
5059
5060         ad.type = LSM_AUDIT_DATA_NET;
5061         ad.u.net = &net;
5062         ad.u.net->netif = ifindex;
5063         ad.u.net->family = family;
5064         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
5065                 return NF_DROP;
5066
5067         if (secmark_active)
5068                 if (avc_has_perm(peer_sid, skb->secmark,
5069                                  SECCLASS_PACKET, secmark_perm, &ad))
5070                         return NF_DROP_ERR(-ECONNREFUSED);
5071
5072         if (peerlbl_active) {
5073                 u32 if_sid;
5074                 u32 node_sid;
5075
5076                 if (sel_netif_sid(dev_net(outdev), ifindex, &if_sid))
5077                         return NF_DROP;
5078                 if (avc_has_perm(peer_sid, if_sid,
5079                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
5080                         return NF_DROP_ERR(-ECONNREFUSED);
5081
5082                 if (sel_netnode_sid(addrp, family, &node_sid))
5083                         return NF_DROP;
5084                 if (avc_has_perm(peer_sid, node_sid,
5085                                  SECCLASS_NODE, NODE__SENDTO, &ad))
5086                         return NF_DROP_ERR(-ECONNREFUSED);
5087         }
5088
5089         return NF_ACCEPT;
5090 }
5091
5092 static unsigned int selinux_ipv4_postroute(const struct nf_hook_ops *ops,
5093                                            struct sk_buff *skb,
5094                                            const struct nf_hook_state *state)
5095 {
5096         return selinux_ip_postroute(skb, state->out, PF_INET);
5097 }
5098
5099 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5100 static unsigned int selinux_ipv6_postroute(const struct nf_hook_ops *ops,
5101                                            struct sk_buff *skb,
5102                                            const struct nf_hook_state *state)
5103 {
5104         return selinux_ip_postroute(skb, state->out, PF_INET6);
5105 }
5106 #endif  /* IPV6 */
5107
5108 #endif  /* CONFIG_NETFILTER */
5109
5110 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
5111 {
5112         int err;
5113
5114         err = cap_netlink_send(sk, skb);
5115         if (err)
5116                 return err;
5117
5118         return selinux_nlmsg_perm(sk, skb);
5119 }
5120
5121 static int ipc_alloc_security(struct task_struct *task,
5122                               struct kern_ipc_perm *perm,
5123                               u16 sclass)
5124 {
5125         struct ipc_security_struct *isec;
5126         u32 sid;
5127
5128         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
5129         if (!isec)
5130                 return -ENOMEM;
5131
5132         sid = task_sid(task);
5133         isec->sclass = sclass;
5134         isec->sid = sid;
5135         perm->security = isec;
5136
5137         return 0;
5138 }
5139
5140 static void ipc_free_security(struct kern_ipc_perm *perm)
5141 {
5142         struct ipc_security_struct *isec = perm->security;
5143         perm->security = NULL;
5144         kfree(isec);
5145 }
5146
5147 static int msg_msg_alloc_security(struct msg_msg *msg)
5148 {
5149         struct msg_security_struct *msec;
5150
5151         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
5152         if (!msec)
5153                 return -ENOMEM;
5154
5155         msec->sid = SECINITSID_UNLABELED;
5156         msg->security = msec;
5157
5158         return 0;
5159 }
5160
5161 static void msg_msg_free_security(struct msg_msg *msg)
5162 {
5163         struct msg_security_struct *msec = msg->security;
5164
5165         msg->security = NULL;
5166         kfree(msec);
5167 }
5168
5169 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
5170                         u32 perms)
5171 {
5172         struct ipc_security_struct *isec;
5173         struct common_audit_data ad;
5174         u32 sid = current_sid();
5175
5176         isec = ipc_perms->security;
5177
5178         ad.type = LSM_AUDIT_DATA_IPC;
5179         ad.u.ipc_id = ipc_perms->key;
5180
5181         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
5182 }
5183
5184 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
5185 {
5186         return msg_msg_alloc_security(msg);
5187 }
5188
5189 static void selinux_msg_msg_free_security(struct msg_msg *msg)
5190 {
5191         msg_msg_free_security(msg);
5192 }
5193
5194 /* message queue security operations */
5195 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
5196 {
5197         struct ipc_security_struct *isec;
5198         struct common_audit_data ad;
5199         u32 sid = current_sid();
5200         int rc;
5201
5202         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
5203         if (rc)
5204                 return rc;
5205
5206         isec = msq->q_perm.security;
5207
5208         ad.type = LSM_AUDIT_DATA_IPC;
5209         ad.u.ipc_id = msq->q_perm.key;
5210
5211         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5212                           MSGQ__CREATE, &ad);
5213         if (rc) {
5214                 ipc_free_security(&msq->q_perm);
5215                 return rc;
5216         }
5217         return 0;
5218 }
5219
5220 static void selinux_msg_queue_free_security(struct msg_queue *msq)
5221 {
5222         ipc_free_security(&msq->q_perm);
5223 }
5224
5225 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
5226 {
5227         struct ipc_security_struct *isec;
5228         struct common_audit_data ad;
5229         u32 sid = current_sid();
5230
5231         isec = msq->q_perm.security;
5232
5233         ad.type = LSM_AUDIT_DATA_IPC;
5234         ad.u.ipc_id = msq->q_perm.key;
5235
5236         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5237                             MSGQ__ASSOCIATE, &ad);
5238 }
5239
5240 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
5241 {
5242         int err;
5243         int perms;
5244
5245         switch (cmd) {
5246         case IPC_INFO:
5247         case MSG_INFO:
5248                 /* No specific object, just general system-wide information. */
5249                 return task_has_system(current, SYSTEM__IPC_INFO);
5250         case IPC_STAT:
5251         case MSG_STAT:
5252                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
5253                 break;
5254         case IPC_SET:
5255                 perms = MSGQ__SETATTR;
5256                 break;
5257         case IPC_RMID:
5258                 perms = MSGQ__DESTROY;
5259                 break;
5260         default:
5261                 return 0;
5262         }
5263
5264         err = ipc_has_perm(&msq->q_perm, perms);
5265         return err;
5266 }
5267
5268 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
5269 {
5270         struct ipc_security_struct *isec;
5271         struct msg_security_struct *msec;
5272         struct common_audit_data ad;
5273         u32 sid = current_sid();
5274         int rc;
5275
5276         isec = msq->q_perm.security;
5277         msec = msg->security;
5278
5279         /*
5280          * First time through, need to assign label to the message
5281          */
5282         if (msec->sid == SECINITSID_UNLABELED) {
5283                 /*
5284                  * Compute new sid based on current process and
5285                  * message queue this message will be stored in
5286                  */
5287                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
5288                                              NULL, &msec->sid);
5289                 if (rc)
5290                         return rc;
5291         }
5292
5293         ad.type = LSM_AUDIT_DATA_IPC;
5294         ad.u.ipc_id = msq->q_perm.key;
5295
5296         /* Can this process write to the queue? */
5297         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
5298                           MSGQ__WRITE, &ad);
5299         if (!rc)
5300                 /* Can this process send the message */
5301                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
5302                                   MSG__SEND, &ad);
5303         if (!rc)
5304                 /* Can the message be put in the queue? */
5305                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
5306                                   MSGQ__ENQUEUE, &ad);
5307
5308         return rc;
5309 }
5310
5311 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
5312                                     struct task_struct *target,
5313                                     long type, int mode)
5314 {
5315         struct ipc_security_struct *isec;
5316         struct msg_security_struct *msec;
5317         struct common_audit_data ad;
5318         u32 sid = task_sid(target);
5319         int rc;
5320
5321         isec = msq->q_perm.security;
5322         msec = msg->security;
5323
5324         ad.type = LSM_AUDIT_DATA_IPC;
5325         ad.u.ipc_id = msq->q_perm.key;
5326
5327         rc = avc_has_perm(sid, isec->sid,
5328                           SECCLASS_MSGQ, MSGQ__READ, &ad);
5329         if (!rc)
5330                 rc = avc_has_perm(sid, msec->sid,
5331                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
5332         return rc;
5333 }
5334
5335 /* Shared Memory security operations */
5336 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
5337 {
5338         struct ipc_security_struct *isec;
5339         struct common_audit_data ad;
5340         u32 sid = current_sid();
5341         int rc;
5342
5343         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5344         if (rc)
5345                 return rc;
5346
5347         isec = shp->shm_perm.security;
5348
5349         ad.type = LSM_AUDIT_DATA_IPC;
5350         ad.u.ipc_id = shp->shm_perm.key;
5351
5352         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5353                           SHM__CREATE, &ad);
5354         if (rc) {
5355                 ipc_free_security(&shp->shm_perm);
5356                 return rc;
5357         }
5358         return 0;
5359 }
5360
5361 static void selinux_shm_free_security(struct shmid_kernel *shp)
5362 {
5363         ipc_free_security(&shp->shm_perm);
5364 }
5365
5366 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5367 {
5368         struct ipc_security_struct *isec;
5369         struct common_audit_data ad;
5370         u32 sid = current_sid();
5371
5372         isec = shp->shm_perm.security;
5373
5374         ad.type = LSM_AUDIT_DATA_IPC;
5375         ad.u.ipc_id = shp->shm_perm.key;
5376
5377         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5378                             SHM__ASSOCIATE, &ad);
5379 }
5380
5381 /* Note, at this point, shp is locked down */
5382 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5383 {
5384         int perms;
5385         int err;
5386
5387         switch (cmd) {
5388         case IPC_INFO:
5389         case SHM_INFO:
5390                 /* No specific object, just general system-wide information. */
5391                 return task_has_system(current, SYSTEM__IPC_INFO);
5392         case IPC_STAT:
5393         case SHM_STAT:
5394                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5395                 break;
5396         case IPC_SET:
5397                 perms = SHM__SETATTR;
5398                 break;
5399         case SHM_LOCK:
5400         case SHM_UNLOCK:
5401                 perms = SHM__LOCK;
5402                 break;
5403         case IPC_RMID:
5404                 perms = SHM__DESTROY;
5405                 break;
5406         default:
5407                 return 0;
5408         }
5409
5410         err = ipc_has_perm(&shp->shm_perm, perms);
5411         return err;
5412 }
5413
5414 static int selinux_shm_shmat(struct shmid_kernel *shp,
5415                              char __user *shmaddr, int shmflg)
5416 {
5417         u32 perms;
5418
5419         if (shmflg & SHM_RDONLY)
5420                 perms = SHM__READ;
5421         else
5422                 perms = SHM__READ | SHM__WRITE;
5423
5424         return ipc_has_perm(&shp->shm_perm, perms);
5425 }
5426
5427 /* Semaphore security operations */
5428 static int selinux_sem_alloc_security(struct sem_array *sma)
5429 {
5430         struct ipc_security_struct *isec;
5431         struct common_audit_data ad;
5432         u32 sid = current_sid();
5433         int rc;
5434
5435         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5436         if (rc)
5437                 return rc;
5438
5439         isec = sma->sem_perm.security;
5440
5441         ad.type = LSM_AUDIT_DATA_IPC;
5442         ad.u.ipc_id = sma->sem_perm.key;
5443
5444         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5445                           SEM__CREATE, &ad);
5446         if (rc) {
5447                 ipc_free_security(&sma->sem_perm);
5448                 return rc;
5449         }
5450         return 0;
5451 }
5452
5453 static void selinux_sem_free_security(struct sem_array *sma)
5454 {
5455         ipc_free_security(&sma->sem_perm);
5456 }
5457
5458 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5459 {
5460         struct ipc_security_struct *isec;
5461         struct common_audit_data ad;
5462         u32 sid = current_sid();
5463
5464         isec = sma->sem_perm.security;
5465
5466         ad.type = LSM_AUDIT_DATA_IPC;
5467         ad.u.ipc_id = sma->sem_perm.key;
5468
5469         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5470                             SEM__ASSOCIATE, &ad);
5471 }
5472
5473 /* Note, at this point, sma is locked down */
5474 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5475 {
5476         int err;
5477         u32 perms;
5478
5479         switch (cmd) {
5480         case IPC_INFO:
5481         case SEM_INFO:
5482                 /* No specific object, just general system-wide information. */
5483                 return task_has_system(current, SYSTEM__IPC_INFO);
5484         case GETPID:
5485         case GETNCNT:
5486         case GETZCNT:
5487                 perms = SEM__GETATTR;
5488                 break;
5489         case GETVAL:
5490         case GETALL:
5491                 perms = SEM__READ;
5492                 break;
5493         case SETVAL:
5494         case SETALL:
5495                 perms = SEM__WRITE;
5496                 break;
5497         case IPC_RMID:
5498                 perms = SEM__DESTROY;
5499                 break;
5500         case IPC_SET:
5501                 perms = SEM__SETATTR;
5502                 break;
5503         case IPC_STAT:
5504         case SEM_STAT:
5505                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5506                 break;
5507         default:
5508                 return 0;
5509         }
5510
5511         err = ipc_has_perm(&sma->sem_perm, perms);
5512         return err;
5513 }
5514
5515 static int selinux_sem_semop(struct sem_array *sma,
5516                              struct sembuf *sops, unsigned nsops, int alter)
5517 {
5518         u32 perms;
5519
5520         if (alter)
5521                 perms = SEM__READ | SEM__WRITE;
5522         else
5523                 perms = SEM__READ;
5524
5525         return ipc_has_perm(&sma->sem_perm, perms);
5526 }
5527
5528 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5529 {
5530         u32 av = 0;
5531
5532         av = 0;
5533         if (flag & S_IRUGO)
5534                 av |= IPC__UNIX_READ;
5535         if (flag & S_IWUGO)
5536                 av |= IPC__UNIX_WRITE;
5537
5538         if (av == 0)
5539                 return 0;
5540
5541         return ipc_has_perm(ipcp, av);
5542 }
5543
5544 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5545 {
5546         struct ipc_security_struct *isec = ipcp->security;
5547         *secid = isec->sid;
5548 }
5549
5550 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5551 {
5552         if (inode)
5553                 inode_doinit_with_dentry(inode, dentry);
5554 }
5555
5556 static int selinux_getprocattr(struct task_struct *p,
5557                                char *name, char **value)
5558 {
5559         const struct task_security_struct *__tsec;
5560         u32 sid;
5561         int error;
5562         unsigned len;
5563
5564         if (current != p) {
5565                 error = current_has_perm(p, PROCESS__GETATTR);
5566                 if (error)
5567                         return error;
5568         }
5569
5570         rcu_read_lock();
5571         __tsec = __task_cred(p)->security;
5572
5573         if (!strcmp(name, "current"))
5574                 sid = __tsec->sid;
5575         else if (!strcmp(name, "prev"))
5576                 sid = __tsec->osid;
5577         else if (!strcmp(name, "exec"))
5578                 sid = __tsec->exec_sid;
5579         else if (!strcmp(name, "fscreate"))
5580                 sid = __tsec->create_sid;
5581         else if (!strcmp(name, "keycreate"))
5582                 sid = __tsec->keycreate_sid;
5583         else if (!strcmp(name, "sockcreate"))
5584                 sid = __tsec->sockcreate_sid;
5585         else
5586                 goto invalid;
5587         rcu_read_unlock();
5588
5589         if (!sid)
5590                 return 0;
5591
5592         error = security_sid_to_context(sid, value, &len);
5593         if (error)
5594                 return error;
5595         return len;
5596
5597 invalid:
5598         rcu_read_unlock();
5599         return -EINVAL;
5600 }
5601
5602 static int selinux_setprocattr(struct task_struct *p,
5603                                char *name, void *value, size_t size)
5604 {
5605         struct task_security_struct *tsec;
5606         struct task_struct *tracer;
5607         struct cred *new;
5608         u32 sid = 0, ptsid;
5609         int error;
5610         char *str = value;
5611
5612         if (current != p) {
5613                 /* SELinux only allows a process to change its own
5614                    security attributes. */
5615                 return -EACCES;
5616         }
5617
5618         /*
5619          * Basic control over ability to set these attributes at all.
5620          * current == p, but we'll pass them separately in case the
5621          * above restriction is ever removed.
5622          */
5623         if (!strcmp(name, "exec"))
5624                 error = current_has_perm(p, PROCESS__SETEXEC);
5625         else if (!strcmp(name, "fscreate"))
5626                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5627         else if (!strcmp(name, "keycreate"))
5628                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5629         else if (!strcmp(name, "sockcreate"))
5630                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5631         else if (!strcmp(name, "current"))
5632                 error = current_has_perm(p, PROCESS__SETCURRENT);
5633         else
5634                 error = -EINVAL;
5635         if (error)
5636                 return error;
5637
5638         /* Obtain a SID for the context, if one was specified. */
5639         if (size && str[1] && str[1] != '\n') {
5640                 if (str[size-1] == '\n') {
5641                         str[size-1] = 0;
5642                         size--;
5643                 }
5644                 error = security_context_to_sid(value, size, &sid, GFP_KERNEL);
5645                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5646                         if (!capable(CAP_MAC_ADMIN)) {
5647                                 struct audit_buffer *ab;
5648                                 size_t audit_size;
5649
5650                                 /* We strip a nul only if it is at the end, otherwise the
5651                                  * context contains a nul and we should audit that */
5652                                 if (str[size - 1] == '\0')
5653                                         audit_size = size - 1;
5654                                 else
5655                                         audit_size = size;
5656                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5657                                 audit_log_format(ab, "op=fscreate invalid_context=");
5658                                 audit_log_n_untrustedstring(ab, value, audit_size);
5659                                 audit_log_end(ab);
5660
5661                                 return error;
5662                         }
5663                         error = security_context_to_sid_force(value, size,
5664                                                               &sid);
5665                 }
5666                 if (error)
5667                         return error;
5668         }
5669
5670         new = prepare_creds();
5671         if (!new)
5672                 return -ENOMEM;
5673
5674         /* Permission checking based on the specified context is
5675            performed during the actual operation (execve,
5676            open/mkdir/...), when we know the full context of the
5677            operation.  See selinux_bprm_set_creds for the execve
5678            checks and may_create for the file creation checks. The
5679            operation will then fail if the context is not permitted. */
5680         tsec = new->security;
5681         if (!strcmp(name, "exec")) {
5682                 tsec->exec_sid = sid;
5683         } else if (!strcmp(name, "fscreate")) {
5684                 tsec->create_sid = sid;
5685         } else if (!strcmp(name, "keycreate")) {
5686                 error = may_create_key(sid, p);
5687                 if (error)
5688                         goto abort_change;
5689                 tsec->keycreate_sid = sid;
5690         } else if (!strcmp(name, "sockcreate")) {
5691                 tsec->sockcreate_sid = sid;
5692         } else if (!strcmp(name, "current")) {
5693                 error = -EINVAL;
5694                 if (sid == 0)
5695                         goto abort_change;
5696
5697                 /* Only allow single threaded processes to change context */
5698                 error = -EPERM;
5699                 if (!current_is_single_threaded()) {
5700                         error = security_bounded_transition(tsec->sid, sid);
5701                         if (error)
5702                                 goto abort_change;
5703                 }
5704
5705                 /* Check permissions for the transition. */
5706                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5707                                      PROCESS__DYNTRANSITION, NULL);
5708                 if (error)
5709                         goto abort_change;
5710
5711                 /* Check for ptracing, and update the task SID if ok.
5712                    Otherwise, leave SID unchanged and fail. */
5713                 ptsid = 0;
5714                 rcu_read_lock();
5715                 tracer = ptrace_parent(p);
5716                 if (tracer)
5717                         ptsid = task_sid(tracer);
5718                 rcu_read_unlock();
5719
5720                 if (tracer) {
5721                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5722                                              PROCESS__PTRACE, NULL);
5723                         if (error)
5724                                 goto abort_change;
5725                 }
5726
5727                 tsec->sid = sid;
5728         } else {
5729                 error = -EINVAL;
5730                 goto abort_change;
5731         }
5732
5733         commit_creds(new);
5734         return size;
5735
5736 abort_change:
5737         abort_creds(new);
5738         return error;
5739 }
5740
5741 static int selinux_ismaclabel(const char *name)
5742 {
5743         return (strcmp(name, XATTR_SELINUX_SUFFIX) == 0);
5744 }
5745
5746 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5747 {
5748         return security_sid_to_context(secid, secdata, seclen);
5749 }
5750
5751 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5752 {
5753         return security_context_to_sid(secdata, seclen, secid, GFP_KERNEL);
5754 }
5755
5756 static void selinux_release_secctx(char *secdata, u32 seclen)
5757 {
5758         kfree(secdata);
5759 }
5760
5761 /*
5762  *      called with inode->i_mutex locked
5763  */
5764 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5765 {
5766         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5767 }
5768
5769 /*
5770  *      called with inode->i_mutex locked
5771  */
5772 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5773 {
5774         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5775 }
5776
5777 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5778 {
5779         int len = 0;
5780         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5781                                                 ctx, true);
5782         if (len < 0)
5783                 return len;
5784         *ctxlen = len;
5785         return 0;
5786 }
5787 #ifdef CONFIG_KEYS
5788
5789 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5790                              unsigned long flags)
5791 {
5792         const struct task_security_struct *tsec;
5793         struct key_security_struct *ksec;
5794
5795         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5796         if (!ksec)
5797                 return -ENOMEM;
5798
5799         tsec = cred->security;
5800         if (tsec->keycreate_sid)
5801                 ksec->sid = tsec->keycreate_sid;
5802         else
5803                 ksec->sid = tsec->sid;
5804
5805         k->security = ksec;
5806         return 0;
5807 }
5808
5809 static void selinux_key_free(struct key *k)
5810 {
5811         struct key_security_struct *ksec = k->security;
5812
5813         k->security = NULL;
5814         kfree(ksec);
5815 }
5816
5817 static int selinux_key_permission(key_ref_t key_ref,
5818                                   const struct cred *cred,
5819                                   unsigned perm)
5820 {
5821         struct key *key;
5822         struct key_security_struct *ksec;
5823         u32 sid;
5824
5825         /* if no specific permissions are requested, we skip the
5826            permission check. No serious, additional covert channels
5827            appear to be created. */
5828         if (perm == 0)
5829                 return 0;
5830
5831         sid = cred_sid(cred);
5832
5833         key = key_ref_to_ptr(key_ref);
5834         ksec = key->security;
5835
5836         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5837 }
5838
5839 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5840 {
5841         struct key_security_struct *ksec = key->security;
5842         char *context = NULL;
5843         unsigned len;
5844         int rc;
5845
5846         rc = security_sid_to_context(ksec->sid, &context, &len);
5847         if (!rc)
5848                 rc = len;
5849         *_buffer = context;
5850         return rc;
5851 }
5852
5853 #endif
5854
5855 static struct security_operations selinux_ops = {
5856         .name =                         "selinux",
5857
5858         .binder_set_context_mgr =       selinux_binder_set_context_mgr,
5859         .binder_transaction =           selinux_binder_transaction,
5860         .binder_transfer_binder =       selinux_binder_transfer_binder,
5861         .binder_transfer_file =         selinux_binder_transfer_file,
5862
5863         .ptrace_access_check =          selinux_ptrace_access_check,
5864         .ptrace_traceme =               selinux_ptrace_traceme,
5865         .capget =                       selinux_capget,
5866         .capset =                       selinux_capset,
5867         .capable =                      selinux_capable,
5868         .quotactl =                     selinux_quotactl,
5869         .quota_on =                     selinux_quota_on,
5870         .syslog =                       selinux_syslog,
5871         .vm_enough_memory =             selinux_vm_enough_memory,
5872
5873         .netlink_send =                 selinux_netlink_send,
5874
5875         .bprm_set_creds =               selinux_bprm_set_creds,
5876         .bprm_committing_creds =        selinux_bprm_committing_creds,
5877         .bprm_committed_creds =         selinux_bprm_committed_creds,
5878         .bprm_secureexec =              selinux_bprm_secureexec,
5879
5880         .sb_alloc_security =            selinux_sb_alloc_security,
5881         .sb_free_security =             selinux_sb_free_security,
5882         .sb_copy_data =                 selinux_sb_copy_data,
5883         .sb_remount =                   selinux_sb_remount,
5884         .sb_kern_mount =                selinux_sb_kern_mount,
5885         .sb_show_options =              selinux_sb_show_options,
5886         .sb_statfs =                    selinux_sb_statfs,
5887         .sb_mount =                     selinux_mount,
5888         .sb_umount =                    selinux_umount,
5889         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5890         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5891         .sb_parse_opts_str =            selinux_parse_opts_str,
5892
5893         .dentry_init_security =         selinux_dentry_init_security,
5894
5895         .inode_alloc_security =         selinux_inode_alloc_security,
5896         .inode_free_security =          selinux_inode_free_security,
5897         .inode_init_security =          selinux_inode_init_security,
5898         .inode_create =                 selinux_inode_create,
5899         .inode_link =                   selinux_inode_link,
5900         .inode_unlink =                 selinux_inode_unlink,
5901         .inode_symlink =                selinux_inode_symlink,
5902         .inode_mkdir =                  selinux_inode_mkdir,
5903         .inode_rmdir =                  selinux_inode_rmdir,
5904         .inode_mknod =                  selinux_inode_mknod,
5905         .inode_rename =                 selinux_inode_rename,
5906         .inode_readlink =               selinux_inode_readlink,
5907         .inode_follow_link =            selinux_inode_follow_link,
5908         .inode_permission =             selinux_inode_permission,
5909         .inode_setattr =                selinux_inode_setattr,
5910         .inode_getattr =                selinux_inode_getattr,
5911         .inode_setxattr =               selinux_inode_setxattr,
5912         .inode_post_setxattr =          selinux_inode_post_setxattr,
5913         .inode_getxattr =               selinux_inode_getxattr,
5914         .inode_listxattr =              selinux_inode_listxattr,
5915         .inode_removexattr =            selinux_inode_removexattr,
5916         .inode_getsecurity =            selinux_inode_getsecurity,
5917         .inode_setsecurity =            selinux_inode_setsecurity,
5918         .inode_listsecurity =           selinux_inode_listsecurity,
5919         .inode_getsecid =               selinux_inode_getsecid,
5920
5921         .file_permission =              selinux_file_permission,
5922         .file_alloc_security =          selinux_file_alloc_security,
5923         .file_free_security =           selinux_file_free_security,
5924         .file_ioctl =                   selinux_file_ioctl,
5925         .mmap_file =                    selinux_mmap_file,
5926         .mmap_addr =                    selinux_mmap_addr,
5927         .file_mprotect =                selinux_file_mprotect,
5928         .file_lock =                    selinux_file_lock,
5929         .file_fcntl =                   selinux_file_fcntl,
5930         .file_set_fowner =              selinux_file_set_fowner,
5931         .file_send_sigiotask =          selinux_file_send_sigiotask,
5932         .file_receive =                 selinux_file_receive,
5933
5934         .file_open =                    selinux_file_open,
5935
5936         .task_create =                  selinux_task_create,
5937         .cred_alloc_blank =             selinux_cred_alloc_blank,
5938         .cred_free =                    selinux_cred_free,
5939         .cred_prepare =                 selinux_cred_prepare,
5940         .cred_transfer =                selinux_cred_transfer,
5941         .kernel_act_as =                selinux_kernel_act_as,
5942         .kernel_create_files_as =       selinux_kernel_create_files_as,
5943         .kernel_module_request =        selinux_kernel_module_request,
5944         .task_setpgid =                 selinux_task_setpgid,
5945         .task_getpgid =                 selinux_task_getpgid,
5946         .task_getsid =                  selinux_task_getsid,
5947         .task_getsecid =                selinux_task_getsecid,
5948         .task_setnice =                 selinux_task_setnice,
5949         .task_setioprio =               selinux_task_setioprio,
5950         .task_getioprio =               selinux_task_getioprio,
5951         .task_setrlimit =               selinux_task_setrlimit,
5952         .task_setscheduler =            selinux_task_setscheduler,
5953         .task_getscheduler =            selinux_task_getscheduler,
5954         .task_movememory =              selinux_task_movememory,
5955         .task_kill =                    selinux_task_kill,
5956         .task_wait =                    selinux_task_wait,
5957         .task_to_inode =                selinux_task_to_inode,
5958
5959         .ipc_permission =               selinux_ipc_permission,
5960         .ipc_getsecid =                 selinux_ipc_getsecid,
5961
5962         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5963         .msg_msg_free_security =        selinux_msg_msg_free_security,
5964
5965         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5966         .msg_queue_free_security =      selinux_msg_queue_free_security,
5967         .msg_queue_associate =          selinux_msg_queue_associate,
5968         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5969         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5970         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5971
5972         .shm_alloc_security =           selinux_shm_alloc_security,
5973         .shm_free_security =            selinux_shm_free_security,
5974         .shm_associate =                selinux_shm_associate,
5975         .shm_shmctl =                   selinux_shm_shmctl,
5976         .shm_shmat =                    selinux_shm_shmat,
5977
5978         .sem_alloc_security =           selinux_sem_alloc_security,
5979         .sem_free_security =            selinux_sem_free_security,
5980         .sem_associate =                selinux_sem_associate,
5981         .sem_semctl =                   selinux_sem_semctl,
5982         .sem_semop =                    selinux_sem_semop,
5983
5984         .d_instantiate =                selinux_d_instantiate,
5985
5986         .getprocattr =                  selinux_getprocattr,
5987         .setprocattr =                  selinux_setprocattr,
5988
5989         .ismaclabel =                   selinux_ismaclabel,
5990         .secid_to_secctx =              selinux_secid_to_secctx,
5991         .secctx_to_secid =              selinux_secctx_to_secid,
5992         .release_secctx =               selinux_release_secctx,
5993         .inode_notifysecctx =           selinux_inode_notifysecctx,
5994         .inode_setsecctx =              selinux_inode_setsecctx,
5995         .inode_getsecctx =              selinux_inode_getsecctx,
5996
5997         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5998         .unix_may_send =                selinux_socket_unix_may_send,
5999
6000         .socket_create =                selinux_socket_create,
6001         .socket_post_create =           selinux_socket_post_create,
6002         .socket_bind =                  selinux_socket_bind,
6003         .socket_connect =               selinux_socket_connect,
6004         .socket_listen =                selinux_socket_listen,
6005         .socket_accept =                selinux_socket_accept,
6006         .socket_sendmsg =               selinux_socket_sendmsg,
6007         .socket_recvmsg =               selinux_socket_recvmsg,
6008         .socket_getsockname =           selinux_socket_getsockname,
6009         .socket_getpeername =           selinux_socket_getpeername,
6010         .socket_getsockopt =            selinux_socket_getsockopt,
6011         .socket_setsockopt =            selinux_socket_setsockopt,
6012         .socket_shutdown =              selinux_socket_shutdown,
6013         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
6014         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
6015         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
6016         .sk_alloc_security =            selinux_sk_alloc_security,
6017         .sk_free_security =             selinux_sk_free_security,
6018         .sk_clone_security =            selinux_sk_clone_security,
6019         .sk_getsecid =                  selinux_sk_getsecid,
6020         .sock_graft =                   selinux_sock_graft,
6021         .inet_conn_request =            selinux_inet_conn_request,
6022         .inet_csk_clone =               selinux_inet_csk_clone,
6023         .inet_conn_established =        selinux_inet_conn_established,
6024         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
6025         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
6026         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
6027         .req_classify_flow =            selinux_req_classify_flow,
6028         .tun_dev_alloc_security =       selinux_tun_dev_alloc_security,
6029         .tun_dev_free_security =        selinux_tun_dev_free_security,
6030         .tun_dev_create =               selinux_tun_dev_create,
6031         .tun_dev_attach_queue =         selinux_tun_dev_attach_queue,
6032         .tun_dev_attach =               selinux_tun_dev_attach,
6033         .tun_dev_open =                 selinux_tun_dev_open,
6034
6035 #ifdef CONFIG_SECURITY_NETWORK_XFRM
6036         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
6037         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
6038         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
6039         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
6040         .xfrm_state_alloc =             selinux_xfrm_state_alloc,
6041         .xfrm_state_alloc_acquire =     selinux_xfrm_state_alloc_acquire,
6042         .xfrm_state_free_security =     selinux_xfrm_state_free,
6043         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
6044         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
6045         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
6046         .xfrm_decode_session =          selinux_xfrm_decode_session,
6047 #endif
6048
6049 #ifdef CONFIG_KEYS
6050         .key_alloc =                    selinux_key_alloc,
6051         .key_free =                     selinux_key_free,
6052         .key_permission =               selinux_key_permission,
6053         .key_getsecurity =              selinux_key_getsecurity,
6054 #endif
6055
6056 #ifdef CONFIG_AUDIT
6057         .audit_rule_init =              selinux_audit_rule_init,
6058         .audit_rule_known =             selinux_audit_rule_known,
6059         .audit_rule_match =             selinux_audit_rule_match,
6060         .audit_rule_free =              selinux_audit_rule_free,
6061 #endif
6062 };
6063
6064 static __init int selinux_init(void)
6065 {
6066         if (!security_module_enable(&selinux_ops)) {
6067                 selinux_enabled = 0;
6068                 return 0;
6069         }
6070
6071         if (!selinux_enabled) {
6072                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
6073                 return 0;
6074         }
6075
6076         printk(KERN_INFO "SELinux:  Initializing.\n");
6077
6078         /* Set the security state for the initial task. */
6079         cred_init_security();
6080
6081         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
6082
6083         sel_inode_cache = kmem_cache_create("selinux_inode_security",
6084                                             sizeof(struct inode_security_struct),
6085                                             0, SLAB_PANIC, NULL);
6086         avc_init();
6087
6088         if (register_security(&selinux_ops))
6089                 panic("SELinux: Unable to register with kernel.\n");
6090
6091         if (avc_add_callback(selinux_netcache_avc_callback, AVC_CALLBACK_RESET))
6092                 panic("SELinux: Unable to register AVC netcache callback\n");
6093
6094         if (selinux_enforcing)
6095                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
6096         else
6097                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
6098
6099         return 0;
6100 }
6101
6102 static void delayed_superblock_init(struct super_block *sb, void *unused)
6103 {
6104         superblock_doinit(sb, NULL);
6105 }
6106
6107 void selinux_complete_init(void)
6108 {
6109         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
6110
6111         /* Set up any superblocks initialized prior to the policy load. */
6112         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
6113         iterate_supers(delayed_superblock_init, NULL);
6114 }
6115
6116 /* SELinux requires early initialization in order to label
6117    all processes and objects when they are created. */
6118 security_initcall(selinux_init);
6119
6120 #if defined(CONFIG_NETFILTER)
6121
6122 static struct nf_hook_ops selinux_nf_ops[] = {
6123         {
6124                 .hook =         selinux_ipv4_postroute,
6125                 .owner =        THIS_MODULE,
6126                 .pf =           NFPROTO_IPV4,
6127                 .hooknum =      NF_INET_POST_ROUTING,
6128                 .priority =     NF_IP_PRI_SELINUX_LAST,
6129         },
6130         {
6131                 .hook =         selinux_ipv4_forward,
6132                 .owner =        THIS_MODULE,
6133                 .pf =           NFPROTO_IPV4,
6134                 .hooknum =      NF_INET_FORWARD,
6135                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6136         },
6137         {
6138                 .hook =         selinux_ipv4_output,
6139                 .owner =        THIS_MODULE,
6140                 .pf =           NFPROTO_IPV4,
6141                 .hooknum =      NF_INET_LOCAL_OUT,
6142                 .priority =     NF_IP_PRI_SELINUX_FIRST,
6143         },
6144 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
6145         {
6146                 .hook =         selinux_ipv6_postroute,
6147                 .owner =        THIS_MODULE,
6148                 .pf =           NFPROTO_IPV6,
6149                 .hooknum =      NF_INET_POST_ROUTING,
6150                 .priority =     NF_IP6_PRI_SELINUX_LAST,
6151         },
6152         {
6153                 .hook =         selinux_ipv6_forward,
6154                 .owner =        THIS_MODULE,
6155                 .pf =           NFPROTO_IPV6,
6156                 .hooknum =      NF_INET_FORWARD,
6157                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
6158         },
6159 #endif  /* IPV6 */
6160 };
6161
6162 static int __init selinux_nf_ip_init(void)
6163 {
6164         int err;
6165
6166         if (!selinux_enabled)
6167                 return 0;
6168
6169         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
6170
6171         err = nf_register_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6172         if (err)
6173                 panic("SELinux: nf_register_hooks: error %d\n", err);
6174
6175         return 0;
6176 }
6177
6178 __initcall(selinux_nf_ip_init);
6179
6180 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6181 static void selinux_nf_ip_exit(void)
6182 {
6183         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
6184
6185         nf_unregister_hooks(selinux_nf_ops, ARRAY_SIZE(selinux_nf_ops));
6186 }
6187 #endif
6188
6189 #else /* CONFIG_NETFILTER */
6190
6191 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6192 #define selinux_nf_ip_exit()
6193 #endif
6194
6195 #endif /* CONFIG_NETFILTER */
6196
6197 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
6198 static int selinux_disabled;
6199
6200 int selinux_disable(void)
6201 {
6202         if (ss_initialized) {
6203                 /* Not permitted after initial policy load. */
6204                 return -EINVAL;
6205         }
6206
6207         if (selinux_disabled) {
6208                 /* Only do this once. */
6209                 return -EINVAL;
6210         }
6211
6212         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
6213
6214         selinux_disabled = 1;
6215         selinux_enabled = 0;
6216
6217         reset_security_ops();
6218
6219         /* Try to destroy the avc node cache */
6220         avc_disable();
6221
6222         /* Unregister netfilter hooks. */
6223         selinux_nf_ip_exit();
6224
6225         /* Unregister selinuxfs. */
6226         exit_sel_fs();
6227
6228         return 0;
6229 }
6230 #endif