security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003-2008 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *                                         Eric Paris <eparis@redhat.com>
  14  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  15  *                          <dgoeddel@trustedcs.com>
  16  *  Copyright (C) 2006, 2007, 2009 Hewlett-Packard Development Company, L.P.
  17  *      Paul Moore <paul@paul-moore.com>
  18  *  Copyright (C) 2007 Hitachi Software Engineering Co., Ltd.
  19  *                     Yuichi Nakamura <ynakam@hitachisoft.jp>
  20  *
  21  *      This program is free software; you can redistribute it and/or modify
  22  *      it under the terms of the GNU General Public License version 2,
  23  *      as published by the Free Software Foundation.
  24  */
  25
  26 #include <linux/init.h>
  27 #include <linux/kd.h>
  28 #include <linux/kernel.h>
  29 #include <linux/tracehook.h>
  30 #include <linux/errno.h>
  31 #include <linux/sched.h>
  32 #include <linux/security.h>
  33 #include <linux/xattr.h>
  34 #include <linux/capability.h>
  35 #include <linux/unistd.h>
  36 #include <linux/mm.h>
  37 #include <linux/mman.h>
  38 #include <linux/slab.h>
  39 #include <linux/pagemap.h>
  40 #include <linux/proc_fs.h>
  41 #include <linux/swap.h>
  42 #include <linux/spinlock.h>
  43 #include <linux/syscalls.h>
  44 #include <linux/dcache.h>
  45 #include <linux/file.h>
  46 #include <linux/fdtable.h>
  47 #include <linux/namei.h>
  48 #include <linux/mount.h>
  49 #include <linux/netfilter_ipv4.h>
  50 #include <linux/netfilter_ipv6.h>
  51 #include <linux/tty.h>
  52 #include <net/icmp.h>
  53 #include <net/ip.h>             /* for local_port_range[] */
  54 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  55 #include <net/net_namespace.h>
  56 #include <net/netlabel.h>
  57 #include <linux/uaccess.h>
  58 #include <asm/ioctls.h>
  59 #include <linux/atomic.h>
  60 #include <linux/bitops.h>
  61 #include <linux/interrupt.h>
  62 #include <linux/netdevice.h>    /* for network interface checks */
  63 #include <linux/netlink.h>
  64 #include <linux/tcp.h>
  65 #include <linux/udp.h>
  66 #include <linux/dccp.h>
  67 #include <linux/quota.h>
  68 #include <linux/un.h>           /* for Unix socket types */
  69 #include <net/af_unix.h>        /* for Unix socket types */
  70 #include <linux/parser.h>
  71 #include <linux/nfs_mount.h>
  72 #include <net/ipv6.h>
  73 #include <linux/hugetlb.h>
  74 #include <linux/personality.h>
  75 #include <linux/audit.h>
  76 #include <linux/string.h>
  77 #include <linux/selinux.h>
  78 #include <linux/mutex.h>
  79 #include <linux/posix-timers.h>
  80 #include <linux/syslog.h>
  81 #include <linux/user_namespace.h>
  82 #include <linux/export.h>
  83 #include <linux/msg.h>
  84 #include <linux/shm.h>
  85
  86 #include "avc.h"
  87 #include "objsec.h"
  88 #include "netif.h"
  89 #include "netnode.h"
  90 #include "netport.h"
  91 #include "xfrm.h"
  92 #include "netlabel.h"
  93 #include "audit.h"
  94 #include "avc_ss.h"
  95
  96 #define NUM_SEL_MNT_OPTS 5
  97
  98 extern struct security_operations *security_ops;
  99
 100 /* SECMARK reference count */
 101 static atomic_t selinux_secmark_refcount = ATOMIC_INIT(0);
 102
 103 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
 104 int selinux_enforcing;
 105
 106 static int __init enforcing_setup(char *str)
 107 {
 108         unsigned long enforcing;
 109         if (!strict_strtoul(str, 0, &enforcing))
 110                 selinux_enforcing = enforcing ? 1 : 0;
 111         return 1;
 112 }
 113 __setup("enforcing=", enforcing_setup);
 114 #endif
 115
 116 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 117 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 118
 119 static int __init selinux_enabled_setup(char *str)
 120 {
 121         unsigned long enabled;
 122         if (!strict_strtoul(str, 0, &enabled))
 123                 selinux_enabled = enabled ? 1 : 0;
 124         return 1;
 125 }
 126 __setup("selinux=", selinux_enabled_setup);
 127 #else
 128 int selinux_enabled = 1;
 129 #endif
 130
 131 static struct kmem_cache *sel_inode_cache;
 132
 133 /**
 134  * selinux_secmark_enabled - Check to see if SECMARK is currently enabled
 135  *
 136  * Description:
 137  * This function checks the SECMARK reference counter to see if any SECMARK
 138  * targets are currently configured, if the reference counter is greater than
 139  * zero SECMARK is considered to be enabled.  Returns true (1) if SECMARK is
 140  * enabled, false (0) if SECMARK is disabled.
 141  *
 142  */
 143 static int selinux_secmark_enabled(void)
 144 {
 145         return (atomic_read(&selinux_secmark_refcount) > 0);
 146 }
 147
 148 /*
 149  * initialise the security for the init task
 150  */
 151 static void cred_init_security(void)
 152 {
 153         struct cred *cred = (struct cred *) current->real_cred;
 154         struct task_security_struct *tsec;
 155
 156         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 157         if (!tsec)
 158                 panic("SELinux:  Failed to initialize initial task.\n");
 159
 160         tsec->osid = tsec->sid = SECINITSID_KERNEL;
 161         cred->security = tsec;
 162 }
 163
 164 /*
 165  * get the security ID of a set of credentials
 166  */
 167 static inline u32 cred_sid(const struct cred *cred)
 168 {
 169         const struct task_security_struct *tsec;
 170
 171         tsec = cred->security;
 172         return tsec->sid;
 173 }
 174
 175 /*
 176  * get the objective security ID of a task
 177  */
 178 static inline u32 task_sid(const struct task_struct *task)
 179 {
 180         u32 sid;
 181
 182         rcu_read_lock();
 183         sid = cred_sid(__task_cred(task));
 184         rcu_read_unlock();
 185         return sid;
 186 }
 187
 188 /*
 189  * get the subjective security ID of the current task
 190  */
 191 static inline u32 current_sid(void)
 192 {
 193         const struct task_security_struct *tsec = current_security();
 194
 195         return tsec->sid;
 196 }
 197
 198 /* Allocate and free functions for each kind of security blob. */
 199
 200 static int inode_alloc_security(struct inode *inode)
 201 {
 202         struct inode_security_struct *isec;
 203         u32 sid = current_sid();
 204
 205         isec = kmem_cache_zalloc(sel_inode_cache, GFP_NOFS);
 206         if (!isec)
 207                 return -ENOMEM;
 208
 209         mutex_init(&isec->lock);
 210         INIT_LIST_HEAD(&isec->list);
 211         isec->inode = inode;
 212         isec->sid = SECINITSID_UNLABELED;
 213         isec->sclass = SECCLASS_FILE;
 214         isec->task_sid = sid;
 215         inode->i_security = isec;
 216
 217         return 0;
 218 }
 219
 220 static void inode_free_security(struct inode *inode)
 221 {
 222         struct inode_security_struct *isec = inode->i_security;
 223         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 224
 225         spin_lock(&sbsec->isec_lock);
 226         if (!list_empty(&isec->list))
 227                 list_del_init(&isec->list);
 228         spin_unlock(&sbsec->isec_lock);
 229
 230         inode->i_security = NULL;
 231         kmem_cache_free(sel_inode_cache, isec);
 232 }
 233
 234 static int file_alloc_security(struct file *file)
 235 {
 236         struct file_security_struct *fsec;
 237         u32 sid = current_sid();
 238
 239         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 240         if (!fsec)
 241                 return -ENOMEM;
 242
 243         fsec->sid = sid;
 244         fsec->fown_sid = sid;
 245         file->f_security = fsec;
 246
 247         return 0;
 248 }
 249
 250 static void file_free_security(struct file *file)
 251 {
 252         struct file_security_struct *fsec = file->f_security;
 253         file->f_security = NULL;
 254         kfree(fsec);
 255 }
 256
 257 static int superblock_alloc_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec;
 260
 261         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 262         if (!sbsec)
 263                 return -ENOMEM;
 264
 265         mutex_init(&sbsec->lock);
 266         INIT_LIST_HEAD(&sbsec->isec_head);
 267         spin_lock_init(&sbsec->isec_lock);
 268         sbsec->sb = sb;
 269         sbsec->sid = SECINITSID_UNLABELED;
 270         sbsec->def_sid = SECINITSID_FILE;
 271         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 272         sb->s_security = sbsec;
 273
 274         return 0;
 275 }
 276
 277 static void superblock_free_security(struct super_block *sb)
 278 {
 279         struct superblock_security_struct *sbsec = sb->s_security;
 280         sb->s_security = NULL;
 281         kfree(sbsec);
 282 }
 283
 284 /* The file system's label must be initialized prior to use. */
 285
 286 static const char *labeling_behaviors[6] = {
 287         "uses xattr",
 288         "uses transition SIDs",
 289         "uses task SIDs",
 290         "uses genfs_contexts",
 291         "not configured for labeling",
 292         "uses mountpoint labeling",
 293 };
 294
 295 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 296
 297 static inline int inode_doinit(struct inode *inode)
 298 {
 299         return inode_doinit_with_dentry(inode, NULL);
 300 }
 301
 302 enum {
 303         Opt_error = -1,
 304         Opt_context = 1,
 305         Opt_fscontext = 2,
 306         Opt_defcontext = 3,
 307         Opt_rootcontext = 4,
 308         Opt_labelsupport = 5,
 309 };
 310
 311 static const match_table_t tokens = {
 312         {Opt_context, CONTEXT_STR "%s"},
 313         {Opt_fscontext, FSCONTEXT_STR "%s"},
 314         {Opt_defcontext, DEFCONTEXT_STR "%s"},
 315         {Opt_rootcontext, ROOTCONTEXT_STR "%s"},
 316         {Opt_labelsupport, LABELSUPP_STR},
 317         {Opt_error, NULL},
 318 };
 319
 320 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 321
 322 static int may_context_mount_sb_relabel(u32 sid,
 323                         struct superblock_security_struct *sbsec,
 324                         const struct cred *cred)
 325 {
 326         const struct task_security_struct *tsec = cred->security;
 327         int rc;
 328
 329         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 330                           FILESYSTEM__RELABELFROM, NULL);
 331         if (rc)
 332                 return rc;
 333
 334         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 335                           FILESYSTEM__RELABELTO, NULL);
 336         return rc;
 337 }
 338
 339 static int may_context_mount_inode_relabel(u32 sid,
 340                         struct superblock_security_struct *sbsec,
 341                         const struct cred *cred)
 342 {
 343         const struct task_security_struct *tsec = cred->security;
 344         int rc;
 345         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELFROM, NULL);
 347         if (rc)
 348                 return rc;
 349
 350         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 351                           FILESYSTEM__ASSOCIATE, NULL);
 352         return rc;
 353 }
 354
 355 static int sb_finish_set_opts(struct super_block *sb)
 356 {
 357         struct superblock_security_struct *sbsec = sb->s_security;
 358         struct dentry *root = sb->s_root;
 359         struct inode *root_inode = root->d_inode;
 360         int rc = 0;
 361
 362         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 363                 /* Make sure that the xattr handler exists and that no
 364                    error other than -ENODATA is returned by getxattr on
 365                    the root directory.  -ENODATA is ok, as this may be
 366                    the first boot of the SELinux kernel before we have
 367                    assigned xattr values to the filesystem. */
 368                 if (!root_inode->i_op->getxattr) {
 369                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 370                                "xattr support\n", sb->s_id, sb->s_type->name);
 371                         rc = -EOPNOTSUPP;
 372                         goto out;
 373                 }
 374                 rc = root_inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 375                 if (rc < 0 && rc != -ENODATA) {
 376                         if (rc == -EOPNOTSUPP)
 377                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 378                                        "%s) has no security xattr handler\n",
 379                                        sb->s_id, sb->s_type->name);
 380                         else
 381                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 382                                        "%s) getxattr errno %d\n", sb->s_id,
 383                                        sb->s_type->name, -rc);
 384                         goto out;
 385                 }
 386         }
 387
 388         sbsec->flags |= (SE_SBINITIALIZED | SE_SBLABELSUPP);
 389
 390         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 391                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 392                        sb->s_id, sb->s_type->name);
 393         else
 394                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 395                        sb->s_id, sb->s_type->name,
 396                        labeling_behaviors[sbsec->behavior-1]);
 397
 398         if (sbsec->behavior == SECURITY_FS_USE_GENFS ||
 399             sbsec->behavior == SECURITY_FS_USE_MNTPOINT ||
 400             sbsec->behavior == SECURITY_FS_USE_NONE ||
 401             sbsec->behavior > ARRAY_SIZE(labeling_behaviors))
 402                 sbsec->flags &= ~SE_SBLABELSUPP;
 403
 404         /* Special handling for sysfs. Is genfs but also has setxattr handler*/
 405         if (strncmp(sb->s_type->name, "sysfs", sizeof("sysfs")) == 0)
 406                 sbsec->flags |= SE_SBLABELSUPP;
 407
 408         /* Initialize the root inode. */
 409         rc = inode_doinit_with_dentry(root_inode, root);
 410
 411         /* Initialize any other inodes associated with the superblock, e.g.
 412            inodes created prior to initial policy load or inodes created
 413            during get_sb by a pseudo filesystem that directly
 414            populates itself. */
 415         spin_lock(&sbsec->isec_lock);
 416 next_inode:
 417         if (!list_empty(&sbsec->isec_head)) {
 418                 struct inode_security_struct *isec =
 419                                 list_entry(sbsec->isec_head.next,
 420                                            struct inode_security_struct, list);
 421                 struct inode *inode = isec->inode;
 422                 spin_unlock(&sbsec->isec_lock);
 423                 inode = igrab(inode);
 424                 if (inode) {
 425                         if (!IS_PRIVATE(inode))
 426                                 inode_doinit(inode);
 427                         iput(inode);
 428                 }
 429                 spin_lock(&sbsec->isec_lock);
 430                 list_del_init(&isec->list);
 431                 goto next_inode;
 432         }
 433         spin_unlock(&sbsec->isec_lock);
 434 out:
 435         return rc;
 436 }
 437
 438 /*
 439  * This function should allow an FS to ask what it's mount security
 440  * options were so it can use those later for submounts, displaying
 441  * mount options, or whatever.
 442  */
 443 static int selinux_get_mnt_opts(const struct super_block *sb,
 444                                 struct security_mnt_opts *opts)
 445 {
 446         int rc = 0, i;
 447         struct superblock_security_struct *sbsec = sb->s_security;
 448         char *context = NULL;
 449         u32 len;
 450         char tmp;
 451
 452         security_init_mnt_opts(opts);
 453
 454         if (!(sbsec->flags & SE_SBINITIALIZED))
 455                 return -EINVAL;
 456
 457         if (!ss_initialized)
 458                 return -EINVAL;
 459
 460         tmp = sbsec->flags & SE_MNTMASK;
 461         /* count the number of mount options for this sb */
 462         for (i = 0; i < 8; i++) {
 463                 if (tmp & 0x01)
 464                         opts->num_mnt_opts++;
 465                 tmp >>= 1;
 466         }
 467         /* Check if the Label support flag is set */
 468         if (sbsec->flags & SE_SBLABELSUPP)
 469                 opts->num_mnt_opts++;
 470
 471         opts->mnt_opts = kcalloc(opts->num_mnt_opts, sizeof(char *), GFP_ATOMIC);
 472         if (!opts->mnt_opts) {
 473                 rc = -ENOMEM;
 474                 goto out_free;
 475         }
 476
 477         opts->mnt_opts_flags = kcalloc(opts->num_mnt_opts, sizeof(int), GFP_ATOMIC);
 478         if (!opts->mnt_opts_flags) {
 479                 rc = -ENOMEM;
 480                 goto out_free;
 481         }
 482
 483         i = 0;
 484         if (sbsec->flags & FSCONTEXT_MNT) {
 485                 rc = security_sid_to_context(sbsec->sid, &context, &len);
 486                 if (rc)
 487                         goto out_free;
 488                 opts->mnt_opts[i] = context;
 489                 opts->mnt_opts_flags[i++] = FSCONTEXT_MNT;
 490         }
 491         if (sbsec->flags & CONTEXT_MNT) {
 492                 rc = security_sid_to_context(sbsec->mntpoint_sid, &context, &len);
 493                 if (rc)
 494                         goto out_free;
 495                 opts->mnt_opts[i] = context;
 496                 opts->mnt_opts_flags[i++] = CONTEXT_MNT;
 497         }
 498         if (sbsec->flags & DEFCONTEXT_MNT) {
 499                 rc = security_sid_to_context(sbsec->def_sid, &context, &len);
 500                 if (rc)
 501                         goto out_free;
 502                 opts->mnt_opts[i] = context;
 503                 opts->mnt_opts_flags[i++] = DEFCONTEXT_MNT;
 504         }
 505         if (sbsec->flags & ROOTCONTEXT_MNT) {
 506                 struct inode *root = sbsec->sb->s_root->d_inode;
 507                 struct inode_security_struct *isec = root->i_security;
 508
 509                 rc = security_sid_to_context(isec->sid, &context, &len);
 510                 if (rc)
 511                         goto out_free;
 512                 opts->mnt_opts[i] = context;
 513                 opts->mnt_opts_flags[i++] = ROOTCONTEXT_MNT;
 514         }
 515         if (sbsec->flags & SE_SBLABELSUPP) {
 516                 opts->mnt_opts[i] = NULL;
 517                 opts->mnt_opts_flags[i++] = SE_SBLABELSUPP;
 518         }
 519
 520         BUG_ON(i != opts->num_mnt_opts);
 521
 522         return 0;
 523
 524 out_free:
 525         security_free_mnt_opts(opts);
 526         return rc;
 527 }
 528
 529 static int bad_option(struct superblock_security_struct *sbsec, char flag,
 530                       u32 old_sid, u32 new_sid)
 531 {
 532         char mnt_flags = sbsec->flags & SE_MNTMASK;
 533
 534         /* check if the old mount command had the same options */
 535         if (sbsec->flags & SE_SBINITIALIZED)
 536                 if (!(sbsec->flags & flag) ||
 537                     (old_sid != new_sid))
 538                         return 1;
 539
 540         /* check if we were passed the same options twice,
 541          * aka someone passed context=a,context=b
 542          */
 543         if (!(sbsec->flags & SE_SBINITIALIZED))
 544                 if (mnt_flags & flag)
 545                         return 1;
 546         return 0;
 547 }
 548
 549 /*
 550  * Allow filesystems with binary mount data to explicitly set mount point
 551  * labeling information.
 552  */
 553 static int selinux_set_mnt_opts(struct super_block *sb,
 554                                 struct security_mnt_opts *opts)
 555 {
 556         const struct cred *cred = current_cred();
 557         int rc = 0, i;
 558         struct superblock_security_struct *sbsec = sb->s_security;
 559         const char *name = sb->s_type->name;
 560         struct inode *inode = sbsec->sb->s_root->d_inode;
 561         struct inode_security_struct *root_isec = inode->i_security;
 562         u32 fscontext_sid = 0, context_sid = 0, rootcontext_sid = 0;
 563         u32 defcontext_sid = 0;
 564         char **mount_options = opts->mnt_opts;
 565         int *flags = opts->mnt_opts_flags;
 566         int num_opts = opts->num_mnt_opts;
 567
 568         mutex_lock(&sbsec->lock);
 569
 570         if (!ss_initialized) {
 571                 if (!num_opts) {
 572                         /* Defer initialization until selinux_complete_init,
 573                            after the initial policy is loaded and the security
 574                            server is ready to handle calls. */
 575                         goto out;
 576                 }
 577                 rc = -EINVAL;
 578                 printk(KERN_WARNING "SELinux: Unable to set superblock options "
 579                         "before the security server is initialized\n");
 580                 goto out;
 581         }
 582
 583         /*
 584          * Binary mount data FS will come through this function twice.  Once
 585          * from an explicit call and once from the generic calls from the vfs.
 586          * Since the generic VFS calls will not contain any security mount data
 587          * we need to skip the double mount verification.
 588          *
 589          * This does open a hole in which we will not notice if the first
 590          * mount using this sb set explict options and a second mount using
 591          * this sb does not set any security options.  (The first options
 592          * will be used for both mounts)
 593          */
 594         if ((sbsec->flags & SE_SBINITIALIZED) && (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
 595             && (num_opts == 0))
 596                 goto out;
 597
 598         /*
 599          * parse the mount options, check if they are valid sids.
 600          * also check if someone is trying to mount the same sb more
 601          * than once with different security options.
 602          */
 603         for (i = 0; i < num_opts; i++) {
 604                 u32 sid;
 605
 606                 if (flags[i] == SE_SBLABELSUPP)
 607                         continue;
 608                 rc = security_context_to_sid(mount_options[i],
 609                                              strlen(mount_options[i]), &sid);
 610                 if (rc) {
 611                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 612                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 613                                mount_options[i], sb->s_id, name, rc);
 614                         goto out;
 615                 }
 616                 switch (flags[i]) {
 617                 case FSCONTEXT_MNT:
 618                         fscontext_sid = sid;
 619
 620                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid,
 621                                         fscontext_sid))
 622                                 goto out_double_mount;
 623
 624                         sbsec->flags |= FSCONTEXT_MNT;
 625                         break;
 626                 case CONTEXT_MNT:
 627                         context_sid = sid;
 628
 629                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid,
 630                                         context_sid))
 631                                 goto out_double_mount;
 632
 633                         sbsec->flags |= CONTEXT_MNT;
 634                         break;
 635                 case ROOTCONTEXT_MNT:
 636                         rootcontext_sid = sid;
 637
 638                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid,
 639                                         rootcontext_sid))
 640                                 goto out_double_mount;
 641
 642                         sbsec->flags |= ROOTCONTEXT_MNT;
 643
 644                         break;
 645                 case DEFCONTEXT_MNT:
 646                         defcontext_sid = sid;
 647
 648                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid,
 649                                         defcontext_sid))
 650                                 goto out_double_mount;
 651
 652                         sbsec->flags |= DEFCONTEXT_MNT;
 653
 654                         break;
 655                 default:
 656                         rc = -EINVAL;
 657                         goto out;
 658                 }
 659         }
 660
 661         if (sbsec->flags & SE_SBINITIALIZED) {
 662                 /* previously mounted with options, but not on this attempt? */
 663                 if ((sbsec->flags & SE_MNTMASK) && !num_opts)
 664                         goto out_double_mount;
 665                 rc = 0;
 666                 goto out;
 667         }
 668
 669         if (strcmp(sb->s_type->name, "proc") == 0)
 670                 sbsec->flags |= SE_SBPROC;
 671
 672         /* Determine the labeling behavior to use for this filesystem type. */
 673         rc = security_fs_use((sbsec->flags & SE_SBPROC) ? "proc" : sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 674         if (rc) {
 675                 printk(KERN_WARNING "%s: security_fs_use(%s) returned %d\n",
 676                        __func__, sb->s_type->name, rc);
 677                 goto out;
 678         }
 679
 680         /* sets the context of the superblock for the fs being mounted. */
 681         if (fscontext_sid) {
 682                 rc = may_context_mount_sb_relabel(fscontext_sid, sbsec, cred);
 683                 if (rc)
 684                         goto out;
 685
 686                 sbsec->sid = fscontext_sid;
 687         }
 688
 689         /*
 690          * Switch to using mount point labeling behavior.
 691          * sets the label used on all file below the mountpoint, and will set
 692          * the superblock context if not already set.
 693          */
 694         if (context_sid) {
 695                 if (!fscontext_sid) {
 696                         rc = may_context_mount_sb_relabel(context_sid, sbsec,
 697                                                           cred);
 698                         if (rc)
 699                                 goto out;
 700                         sbsec->sid = context_sid;
 701                 } else {
 702                         rc = may_context_mount_inode_relabel(context_sid, sbsec,
 703                                                              cred);
 704                         if (rc)
 705                                 goto out;
 706                 }
 707                 if (!rootcontext_sid)
 708                         rootcontext_sid = context_sid;
 709
 710                 sbsec->mntpoint_sid = context_sid;
 711                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 712         }
 713
 714         if (rootcontext_sid) {
 715                 rc = may_context_mount_inode_relabel(rootcontext_sid, sbsec,
 716                                                      cred);
 717                 if (rc)
 718                         goto out;
 719
 720                 root_isec->sid = rootcontext_sid;
 721                 root_isec->initialized = 1;
 722         }
 723
 724         if (defcontext_sid) {
 725                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 726                         rc = -EINVAL;
 727                         printk(KERN_WARNING "SELinux: defcontext option is "
 728                                "invalid for this filesystem type\n");
 729                         goto out;
 730                 }
 731
 732                 if (defcontext_sid != sbsec->def_sid) {
 733                         rc = may_context_mount_inode_relabel(defcontext_sid,
 734                                                              sbsec, cred);
 735                         if (rc)
 736                                 goto out;
 737                 }
 738
 739                 sbsec->def_sid = defcontext_sid;
 740         }
 741
 742         rc = sb_finish_set_opts(sb);
 743 out:
 744         mutex_unlock(&sbsec->lock);
 745         return rc;
 746 out_double_mount:
 747         rc = -EINVAL;
 748         printk(KERN_WARNING "SELinux: mount invalid.  Same superblock, different "
 749                "security settings for (dev %s, type %s)\n", sb->s_id, name);
 750         goto out;
 751 }
 752
 753 static void selinux_sb_clone_mnt_opts(const struct super_block *oldsb,
 754                                         struct super_block *newsb)
 755 {
 756         const struct superblock_security_struct *oldsbsec = oldsb->s_security;
 757         struct superblock_security_struct *newsbsec = newsb->s_security;
 758
 759         int set_fscontext =     (oldsbsec->flags & FSCONTEXT_MNT);
 760         int set_context =       (oldsbsec->flags & CONTEXT_MNT);
 761         int set_rootcontext =   (oldsbsec->flags & ROOTCONTEXT_MNT);
 762
 763         /*
 764          * if the parent was able to be mounted it clearly had no special lsm
 765          * mount options.  thus we can safely deal with this superblock later
 766          */
 767         if (!ss_initialized)
 768                 return;
 769
 770         /* how can we clone if the old one wasn't set up?? */
 771         BUG_ON(!(oldsbsec->flags & SE_SBINITIALIZED));
 772
 773         /* if fs is reusing a sb, just let its options stand... */
 774         if (newsbsec->flags & SE_SBINITIALIZED)
 775                 return;
 776
 777         mutex_lock(&newsbsec->lock);
 778
 779         newsbsec->flags = oldsbsec->flags;
 780
 781         newsbsec->sid = oldsbsec->sid;
 782         newsbsec->def_sid = oldsbsec->def_sid;
 783         newsbsec->behavior = oldsbsec->behavior;
 784
 785         if (set_context) {
 786                 u32 sid = oldsbsec->mntpoint_sid;
 787
 788                 if (!set_fscontext)
 789                         newsbsec->sid = sid;
 790                 if (!set_rootcontext) {
 791                         struct inode *newinode = newsb->s_root->d_inode;
 792                         struct inode_security_struct *newisec = newinode->i_security;
 793                         newisec->sid = sid;
 794                 }
 795                 newsbsec->mntpoint_sid = sid;
 796         }
 797         if (set_rootcontext) {
 798                 const struct inode *oldinode = oldsb->s_root->d_inode;
 799                 const struct inode_security_struct *oldisec = oldinode->i_security;
 800                 struct inode *newinode = newsb->s_root->d_inode;
 801                 struct inode_security_struct *newisec = newinode->i_security;
 802
 803                 newisec->sid = oldisec->sid;
 804         }
 805
 806         sb_finish_set_opts(newsb);
 807         mutex_unlock(&newsbsec->lock);
 808 }
 809
 810 static int selinux_parse_opts_str(char *options,
 811                                   struct security_mnt_opts *opts)
 812 {
 813         char *p;
 814         char *context = NULL, *defcontext = NULL;
 815         char *fscontext = NULL, *rootcontext = NULL;
 816         int rc, num_mnt_opts = 0;
 817
 818         opts->num_mnt_opts = 0;
 819
 820         /* Standard string-based options. */
 821         while ((p = strsep(&options, "|")) != NULL) {
 822                 int token;
 823                 substring_t args[MAX_OPT_ARGS];
 824
 825                 if (!*p)
 826                         continue;
 827
 828                 token = match_token(p, tokens, args);
 829
 830                 switch (token) {
 831                 case Opt_context:
 832                         if (context || defcontext) {
 833                                 rc = -EINVAL;
 834                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 835                                 goto out_err;
 836                         }
 837                         context = match_strdup(&args[0]);
 838                         if (!context) {
 839                                 rc = -ENOMEM;
 840                                 goto out_err;
 841                         }
 842                         break;
 843
 844                 case Opt_fscontext:
 845                         if (fscontext) {
 846                                 rc = -EINVAL;
 847                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 848                                 goto out_err;
 849                         }
 850                         fscontext = match_strdup(&args[0]);
 851                         if (!fscontext) {
 852                                 rc = -ENOMEM;
 853                                 goto out_err;
 854                         }
 855                         break;
 856
 857                 case Opt_rootcontext:
 858                         if (rootcontext) {
 859                                 rc = -EINVAL;
 860                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 861                                 goto out_err;
 862                         }
 863                         rootcontext = match_strdup(&args[0]);
 864                         if (!rootcontext) {
 865                                 rc = -ENOMEM;
 866                                 goto out_err;
 867                         }
 868                         break;
 869
 870                 case Opt_defcontext:
 871                         if (context || defcontext) {
 872                                 rc = -EINVAL;
 873                                 printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 874                                 goto out_err;
 875                         }
 876                         defcontext = match_strdup(&args[0]);
 877                         if (!defcontext) {
 878                                 rc = -ENOMEM;
 879                                 goto out_err;
 880                         }
 881                         break;
 882                 case Opt_labelsupport:
 883                         break;
 884                 default:
 885                         rc = -EINVAL;
 886                         printk(KERN_WARNING "SELinux:  unknown mount option\n");
 887                         goto out_err;
 888
 889                 }
 890         }
 891
 892         rc = -ENOMEM;
 893         opts->mnt_opts = kcalloc(NUM_SEL_MNT_OPTS, sizeof(char *), GFP_ATOMIC);
 894         if (!opts->mnt_opts)
 895                 goto out_err;
 896
 897         opts->mnt_opts_flags = kcalloc(NUM_SEL_MNT_OPTS, sizeof(int), GFP_ATOMIC);
 898         if (!opts->mnt_opts_flags) {
 899                 kfree(opts->mnt_opts);
 900                 goto out_err;
 901         }
 902
 903         if (fscontext) {
 904                 opts->mnt_opts[num_mnt_opts] = fscontext;
 905                 opts->mnt_opts_flags[num_mnt_opts++] = FSCONTEXT_MNT;
 906         }
 907         if (context) {
 908                 opts->mnt_opts[num_mnt_opts] = context;
 909                 opts->mnt_opts_flags[num_mnt_opts++] = CONTEXT_MNT;
 910         }
 911         if (rootcontext) {
 912                 opts->mnt_opts[num_mnt_opts] = rootcontext;
 913                 opts->mnt_opts_flags[num_mnt_opts++] = ROOTCONTEXT_MNT;
 914         }
 915         if (defcontext) {
 916                 opts->mnt_opts[num_mnt_opts] = defcontext;
 917                 opts->mnt_opts_flags[num_mnt_opts++] = DEFCONTEXT_MNT;
 918         }
 919
 920         opts->num_mnt_opts = num_mnt_opts;
 921         return 0;
 922
 923 out_err:
 924         kfree(context);
 925         kfree(defcontext);
 926         kfree(fscontext);
 927         kfree(rootcontext);
 928         return rc;
 929 }
 930 /*
 931  * string mount options parsing and call set the sbsec
 932  */
 933 static int superblock_doinit(struct super_block *sb, void *data)
 934 {
 935         int rc = 0;
 936         char *options = data;
 937         struct security_mnt_opts opts;
 938
 939         security_init_mnt_opts(&opts);
 940
 941         if (!data)
 942                 goto out;
 943
 944         BUG_ON(sb->s_type->fs_flags & FS_BINARY_MOUNTDATA);
 945
 946         rc = selinux_parse_opts_str(options, &opts);
 947         if (rc)
 948                 goto out_err;
 949
 950 out:
 951         rc = selinux_set_mnt_opts(sb, &opts);
 952
 953 out_err:
 954         security_free_mnt_opts(&opts);
 955         return rc;
 956 }
 957
 958 static void selinux_write_opts(struct seq_file *m,
 959                                struct security_mnt_opts *opts)
 960 {
 961         int i;
 962         char *prefix;
 963
 964         for (i = 0; i < opts->num_mnt_opts; i++) {
 965                 char *has_comma;
 966
 967                 if (opts->mnt_opts[i])
 968                         has_comma = strchr(opts->mnt_opts[i], ',');
 969                 else
 970                         has_comma = NULL;
 971
 972                 switch (opts->mnt_opts_flags[i]) {
 973                 case CONTEXT_MNT:
 974                         prefix = CONTEXT_STR;
 975                         break;
 976                 case FSCONTEXT_MNT:
 977                         prefix = FSCONTEXT_STR;
 978                         break;
 979                 case ROOTCONTEXT_MNT:
 980                         prefix = ROOTCONTEXT_STR;
 981                         break;
 982                 case DEFCONTEXT_MNT:
 983                         prefix = DEFCONTEXT_STR;
 984                         break;
 985                 case SE_SBLABELSUPP:
 986                         seq_putc(m, ',');
 987                         seq_puts(m, LABELSUPP_STR);
 988                         continue;
 989                 default:
 990                         BUG();
 991                         return;
 992                 };
 993                 /* we need a comma before each option */
 994                 seq_putc(m, ',');
 995                 seq_puts(m, prefix);
 996                 if (has_comma)
 997                         seq_putc(m, '\"');
 998                 seq_puts(m, opts->mnt_opts[i]);
 999                 if (has_comma)
1000                         seq_putc(m, '\"');
1001         }
1002 }
1003
1004 static int selinux_sb_show_options(struct seq_file *m, struct super_block *sb)
1005 {
1006         struct security_mnt_opts opts;
1007         int rc;
1008
1009         rc = selinux_get_mnt_opts(sb, &opts);
1010         if (rc) {
1011                 /* before policy load we may get EINVAL, don't show anything */
1012                 if (rc == -EINVAL)
1013                         rc = 0;
1014                 return rc;
1015         }
1016
1017         selinux_write_opts(m, &opts);
1018
1019         security_free_mnt_opts(&opts);
1020
1021         return rc;
1022 }
1023
1024 static inline u16 inode_mode_to_security_class(umode_t mode)
1025 {
1026         switch (mode & S_IFMT) {
1027         case S_IFSOCK:
1028                 return SECCLASS_SOCK_FILE;
1029         case S_IFLNK:
1030                 return SECCLASS_LNK_FILE;
1031         case S_IFREG:
1032                 return SECCLASS_FILE;
1033         case S_IFBLK:
1034                 return SECCLASS_BLK_FILE;
1035         case S_IFDIR:
1036                 return SECCLASS_DIR;
1037         case S_IFCHR:
1038                 return SECCLASS_CHR_FILE;
1039         case S_IFIFO:
1040                 return SECCLASS_FIFO_FILE;
1041
1042         }
1043
1044         return SECCLASS_FILE;
1045 }
1046
1047 static inline int default_protocol_stream(int protocol)
1048 {
1049         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
1050 }
1051
1052 static inline int default_protocol_dgram(int protocol)
1053 {
1054         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
1055 }
1056
1057 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
1058 {
1059         switch (family) {
1060         case PF_UNIX:
1061                 switch (type) {
1062                 case SOCK_STREAM:
1063                 case SOCK_SEQPACKET:
1064                         return SECCLASS_UNIX_STREAM_SOCKET;
1065                 case SOCK_DGRAM:
1066                         return SECCLASS_UNIX_DGRAM_SOCKET;
1067                 }
1068                 break;
1069         case PF_INET:
1070         case PF_INET6:
1071                 switch (type) {
1072                 case SOCK_STREAM:
1073                         if (default_protocol_stream(protocol))
1074                                 return SECCLASS_TCP_SOCKET;
1075                         else
1076                                 return SECCLASS_RAWIP_SOCKET;
1077                 case SOCK_DGRAM:
1078                         if (default_protocol_dgram(protocol))
1079                                 return SECCLASS_UDP_SOCKET;
1080                         else
1081                                 return SECCLASS_RAWIP_SOCKET;
1082                 case SOCK_DCCP:
1083                         return SECCLASS_DCCP_SOCKET;
1084                 default:
1085                         return SECCLASS_RAWIP_SOCKET;
1086                 }
1087                 break;
1088         case PF_NETLINK:
1089                 switch (protocol) {
1090                 case NETLINK_ROUTE:
1091                         return SECCLASS_NETLINK_ROUTE_SOCKET;
1092                 case NETLINK_FIREWALL:
1093                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
1094                 case NETLINK_SOCK_DIAG:
1095                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
1096                 case NETLINK_NFLOG:
1097                         return SECCLASS_NETLINK_NFLOG_SOCKET;
1098                 case NETLINK_XFRM:
1099                         return SECCLASS_NETLINK_XFRM_SOCKET;
1100                 case NETLINK_SELINUX:
1101                         return SECCLASS_NETLINK_SELINUX_SOCKET;
1102                 case NETLINK_AUDIT:
1103                         return SECCLASS_NETLINK_AUDIT_SOCKET;
1104                 case NETLINK_IP6_FW:
1105                         return SECCLASS_NETLINK_IP6FW_SOCKET;
1106                 case NETLINK_DNRTMSG:
1107                         return SECCLASS_NETLINK_DNRT_SOCKET;
1108                 case NETLINK_KOBJECT_UEVENT:
1109                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
1110                 default:
1111                         return SECCLASS_NETLINK_SOCKET;
1112                 }
1113         case PF_PACKET:
1114                 return SECCLASS_PACKET_SOCKET;
1115         case PF_KEY:
1116                 return SECCLASS_KEY_SOCKET;
1117         case PF_APPLETALK:
1118                 return SECCLASS_APPLETALK_SOCKET;
1119         }
1120
1121         return SECCLASS_SOCKET;
1122 }
1123
1124 #ifdef CONFIG_PROC_FS
1125 static int selinux_proc_get_sid(struct dentry *dentry,
1126                                 u16 tclass,
1127                                 u32 *sid)
1128 {
1129         int rc;
1130         char *buffer, *path;
1131
1132         buffer = (char *)__get_free_page(GFP_KERNEL);
1133         if (!buffer)
1134                 return -ENOMEM;
1135
1136         path = dentry_path_raw(dentry, buffer, PAGE_SIZE);
1137         if (IS_ERR(path))
1138                 rc = PTR_ERR(path);
1139         else {
1140                 /* each process gets a /proc/PID/ entry. Strip off the
1141                  * PID part to get a valid selinux labeling.
1142                  * e.g. /proc/1/net/rpc/nfs -> /net/rpc/nfs */
1143                 while (path[1] >= '0' && path[1] <= '9') {
1144                         path[1] = '/';
1145                         path++;
1146                 }
1147                 rc = security_genfs_sid("proc", path, tclass, sid);
1148         }
1149         free_page((unsigned long)buffer);
1150         return rc;
1151 }
1152 #else
1153 static int selinux_proc_get_sid(struct dentry *dentry,
1154                                 u16 tclass,
1155                                 u32 *sid)
1156 {
1157         return -EINVAL;
1158 }
1159 #endif
1160
1161 /* The inode's security attributes must be initialized before first use. */
1162 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
1163 {
1164         struct superblock_security_struct *sbsec = NULL;
1165         struct inode_security_struct *isec = inode->i_security;
1166         u32 sid;
1167         struct dentry *dentry;
1168 #define INITCONTEXTLEN 255
1169         char *context = NULL;
1170         unsigned len = 0;
1171         int rc = 0;
1172
1173         if (isec->initialized)
1174                 goto out;
1175
1176         mutex_lock(&isec->lock);
1177         if (isec->initialized)
1178                 goto out_unlock;
1179
1180         sbsec = inode->i_sb->s_security;
1181         if (!(sbsec->flags & SE_SBINITIALIZED)) {
1182                 /* Defer initialization until selinux_complete_init,
1183                    after the initial policy is loaded and the security
1184                    server is ready to handle calls. */
1185                 spin_lock(&sbsec->isec_lock);
1186                 if (list_empty(&isec->list))
1187                         list_add(&isec->list, &sbsec->isec_head);
1188                 spin_unlock(&sbsec->isec_lock);
1189                 goto out_unlock;
1190         }
1191
1192         switch (sbsec->behavior) {
1193         case SECURITY_FS_USE_XATTR:
1194                 if (!inode->i_op->getxattr) {
1195                         isec->sid = sbsec->def_sid;
1196                         break;
1197                 }
1198
1199                 /* Need a dentry, since the xattr API requires one.
1200                    Life would be simpler if we could just pass the inode. */
1201                 if (opt_dentry) {
1202                         /* Called from d_instantiate or d_splice_alias. */
1203                         dentry = dget(opt_dentry);
1204                 } else {
1205                         /* Called from selinux_complete_init, try to find a dentry. */
1206                         dentry = d_find_alias(inode);
1207                 }
1208                 if (!dentry) {
1209                         /*
1210                          * this is can be hit on boot when a file is accessed
1211                          * before the policy is loaded.  When we load policy we
1212                          * may find inodes that have no dentry on the
1213                          * sbsec->isec_head list.  No reason to complain as these
1214                          * will get fixed up the next time we go through
1215                          * inode_doinit with a dentry, before these inodes could
1216                          * be used again by userspace.
1217                          */
1218                         goto out_unlock;
1219                 }
1220
1221                 len = INITCONTEXTLEN;
1222                 context = kmalloc(len+1, GFP_NOFS);
1223                 if (!context) {
1224                         rc = -ENOMEM;
1225                         dput(dentry);
1226                         goto out_unlock;
1227                 }
1228                 context[len] = '\0';
1229                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1230                                            context, len);
1231                 if (rc == -ERANGE) {
1232                         kfree(context);
1233
1234                         /* Need a larger buffer.  Query for the right size. */
1235                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
1236                                                    NULL, 0);
1237                         if (rc < 0) {
1238                                 dput(dentry);
1239                                 goto out_unlock;
1240                         }
1241                         len = rc;
1242                         context = kmalloc(len+1, GFP_NOFS);
1243                         if (!context) {
1244                                 rc = -ENOMEM;
1245                                 dput(dentry);
1246                                 goto out_unlock;
1247                         }
1248                         context[len] = '\0';
1249                         rc = inode->i_op->getxattr(dentry,
1250                                                    XATTR_NAME_SELINUX,
1251                                                    context, len);
1252                 }
1253                 dput(dentry);
1254                 if (rc < 0) {
1255                         if (rc != -ENODATA) {
1256                                 printk(KERN_WARNING "SELinux: %s:  getxattr returned "
1257                                        "%d for dev=%s ino=%ld\n", __func__,
1258                                        -rc, inode->i_sb->s_id, inode->i_ino);
1259                                 kfree(context);
1260                                 goto out_unlock;
1261                         }
1262                         /* Map ENODATA to the default file SID */
1263                         sid = sbsec->def_sid;
1264                         rc = 0;
1265                 } else {
1266                         rc = security_context_to_sid_default(context, rc, &sid,
1267                                                              sbsec->def_sid,
1268                                                              GFP_NOFS);
1269                         if (rc) {
1270                                 char *dev = inode->i_sb->s_id;
1271                                 unsigned long ino = inode->i_ino;
1272
1273                                 if (rc == -EINVAL) {
1274                                         if (printk_ratelimit())
1275                                                 printk(KERN_NOTICE "SELinux: inode=%lu on dev=%s was found to have an invalid "
1276                                                         "context=%s.  This indicates you may need to relabel the inode or the "
1277                                                         "filesystem in question.\n", ino, dev, context);
1278                                 } else {
1279                                         printk(KERN_WARNING "SELinux: %s:  context_to_sid(%s) "
1280                                                "returned %d for dev=%s ino=%ld\n",
1281                                                __func__, context, -rc, dev, ino);
1282                                 }
1283                                 kfree(context);
1284                                 /* Leave with the unlabeled SID */
1285                                 rc = 0;
1286                                 break;
1287                         }
1288                 }
1289                 kfree(context);
1290                 isec->sid = sid;
1291                 break;
1292         case SECURITY_FS_USE_TASK:
1293                 isec->sid = isec->task_sid;
1294                 break;
1295         case SECURITY_FS_USE_TRANS:
1296                 /* Default to the fs SID. */
1297                 isec->sid = sbsec->sid;
1298
1299                 /* Try to obtain a transition SID. */
1300                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1301                 rc = security_transition_sid(isec->task_sid, sbsec->sid,
1302                                              isec->sclass, NULL, &sid);
1303                 if (rc)
1304                         goto out_unlock;
1305                 isec->sid = sid;
1306                 break;
1307         case SECURITY_FS_USE_MNTPOINT:
1308                 isec->sid = sbsec->mntpoint_sid;
1309                 break;
1310         default:
1311                 /* Default to the fs superblock SID. */
1312                 isec->sid = sbsec->sid;
1313
1314                 if ((sbsec->flags & SE_SBPROC) && !S_ISLNK(inode->i_mode)) {
1315                         if (opt_dentry) {
1316                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1317                                 rc = selinux_proc_get_sid(opt_dentry,
1318                                                           isec->sclass,
1319                                                           &sid);
1320                                 if (rc)
1321                                         goto out_unlock;
1322                                 isec->sid = sid;
1323                         }
1324                 }
1325                 break;
1326         }
1327
1328         isec->initialized = 1;
1329
1330 out_unlock:
1331         mutex_unlock(&isec->lock);
1332 out:
1333         if (isec->sclass == SECCLASS_FILE)
1334                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
1335         return rc;
1336 }
1337
1338 /* Convert a Linux signal to an access vector. */
1339 static inline u32 signal_to_av(int sig)
1340 {
1341         u32 perm = 0;
1342
1343         switch (sig) {
1344         case SIGCHLD:
1345                 /* Commonly granted from child to parent. */
1346                 perm = PROCESS__SIGCHLD;
1347                 break;
1348         case SIGKILL:
1349                 /* Cannot be caught or ignored */
1350                 perm = PROCESS__SIGKILL;
1351                 break;
1352         case SIGSTOP:
1353                 /* Cannot be caught or ignored */
1354                 perm = PROCESS__SIGSTOP;
1355                 break;
1356         default:
1357                 /* All other signals. */
1358                 perm = PROCESS__SIGNAL;
1359                 break;
1360         }
1361
1362         return perm;
1363 }
1364
1365 /*
1366  * Check permission between a pair of credentials
1367  * fork check, ptrace check, etc.
1368  */
1369 static int cred_has_perm(const struct cred *actor,
1370                          const struct cred *target,
1371                          u32 perms)
1372 {
1373         u32 asid = cred_sid(actor), tsid = cred_sid(target);
1374
1375         return avc_has_perm(asid, tsid, SECCLASS_PROCESS, perms, NULL);
1376 }
1377
1378 /*
1379  * Check permission between a pair of tasks, e.g. signal checks,
1380  * fork check, ptrace check, etc.
1381  * tsk1 is the actor and tsk2 is the target
1382  * - this uses the default subjective creds of tsk1
1383  */
1384 static int task_has_perm(const struct task_struct *tsk1,
1385                          const struct task_struct *tsk2,
1386                          u32 perms)
1387 {
1388         const struct task_security_struct *__tsec1, *__tsec2;
1389         u32 sid1, sid2;
1390
1391         rcu_read_lock();
1392         __tsec1 = __task_cred(tsk1)->security;  sid1 = __tsec1->sid;
1393         __tsec2 = __task_cred(tsk2)->security;  sid2 = __tsec2->sid;
1394         rcu_read_unlock();
1395         return avc_has_perm(sid1, sid2, SECCLASS_PROCESS, perms, NULL);
1396 }
1397
1398 /*
1399  * Check permission between current and another task, e.g. signal checks,
1400  * fork check, ptrace check, etc.
1401  * current is the actor and tsk2 is the target
1402  * - this uses current's subjective creds
1403  */
1404 static int current_has_perm(const struct task_struct *tsk,
1405                             u32 perms)
1406 {
1407         u32 sid, tsid;
1408
1409         sid = current_sid();
1410         tsid = task_sid(tsk);
1411         return avc_has_perm(sid, tsid, SECCLASS_PROCESS, perms, NULL);
1412 }
1413
1414 #if CAP_LAST_CAP > 63
1415 #error Fix SELinux to handle capabilities > 63.
1416 #endif
1417
1418 /* Check whether a task is allowed to use a capability. */
1419 static int cred_has_capability(const struct cred *cred,
1420                                int cap, int audit)
1421 {
1422         struct common_audit_data ad;
1423         struct av_decision avd;
1424         u16 sclass;
1425         u32 sid = cred_sid(cred);
1426         u32 av = CAP_TO_MASK(cap);
1427         int rc;
1428
1429         ad.type = LSM_AUDIT_DATA_CAP;
1430         ad.u.cap = cap;
1431
1432         switch (CAP_TO_INDEX(cap)) {
1433         case 0:
1434                 sclass = SECCLASS_CAPABILITY;
1435                 break;
1436         case 1:
1437                 sclass = SECCLASS_CAPABILITY2;
1438                 break;
1439         default:
1440                 printk(KERN_ERR
1441                        "SELinux:  out of range capability %d\n", cap);
1442                 BUG();
1443                 return -EINVAL;
1444         }
1445
1446         rc = avc_has_perm_noaudit(sid, sid, sclass, av, 0, &avd);
1447         if (audit == SECURITY_CAP_AUDIT) {
1448                 int rc2 = avc_audit(sid, sid, sclass, av, &avd, rc, &ad, 0);
1449                 if (rc2)
1450                         return rc2;
1451         }
1452         return rc;
1453 }
1454
1455 /* Check whether a task is allowed to use a system operation. */
1456 static int task_has_system(struct task_struct *tsk,
1457                            u32 perms)
1458 {
1459         u32 sid = task_sid(tsk);
1460
1461         return avc_has_perm(sid, SECINITSID_KERNEL,
1462                             SECCLASS_SYSTEM, perms, NULL);
1463 }
1464
1465 /* Check whether a task has a particular permission to an inode.
1466    The 'adp' parameter is optional and allows other audit
1467    data to be passed (e.g. the dentry). */
1468 static int inode_has_perm(const struct cred *cred,
1469                           struct inode *inode,
1470                           u32 perms,
1471                           struct common_audit_data *adp,
1472                           unsigned flags)
1473 {
1474         struct inode_security_struct *isec;
1475         u32 sid;
1476
1477         validate_creds(cred);
1478
1479         if (unlikely(IS_PRIVATE(inode)))
1480                 return 0;
1481
1482         sid = cred_sid(cred);
1483         isec = inode->i_security;
1484
1485         return avc_has_perm_flags(sid, isec->sid, isec->sclass, perms, adp, flags);
1486 }
1487
1488 /* Same as inode_has_perm, but pass explicit audit data containing
1489    the dentry to help the auditing code to more easily generate the
1490    pathname if needed. */
1491 static inline int dentry_has_perm(const struct cred *cred,
1492                                   struct dentry *dentry,
1493                                   u32 av)
1494 {
1495         struct inode *inode = dentry->d_inode;
1496         struct common_audit_data ad;
1497
1498         ad.type = LSM_AUDIT_DATA_DENTRY;
1499         ad.u.dentry = dentry;
1500         return inode_has_perm(cred, inode, av, &ad, 0);
1501 }
1502
1503 /* Same as inode_has_perm, but pass explicit audit data containing
1504    the path to help the auditing code to more easily generate the
1505    pathname if needed. */
1506 static inline int path_has_perm(const struct cred *cred,
1507                                 struct path *path,
1508                                 u32 av)
1509 {
1510         struct inode *inode = path->dentry->d_inode;
1511         struct common_audit_data ad;
1512
1513         ad.type = LSM_AUDIT_DATA_PATH;
1514         ad.u.path = *path;
1515         return inode_has_perm(cred, inode, av, &ad, 0);
1516 }
1517
1518 /* Check whether a task can use an open file descriptor to
1519    access an inode in a given way.  Check access to the
1520    descriptor itself, and then use dentry_has_perm to
1521    check a particular permission to the file.
1522    Access to the descriptor is implicitly granted if it
1523    has the same SID as the process.  If av is zero, then
1524    access to the file is not checked, e.g. for cases
1525    where only the descriptor is affected like seek. */
1526 static int file_has_perm(const struct cred *cred,
1527                          struct file *file,
1528                          u32 av)
1529 {
1530         struct file_security_struct *fsec = file->f_security;
1531         struct inode *inode = file->f_path.dentry->d_inode;
1532         struct common_audit_data ad;
1533         u32 sid = cred_sid(cred);
1534         int rc;
1535
1536         ad.type = LSM_AUDIT_DATA_PATH;
1537         ad.u.path = file->f_path;
1538
1539         if (sid != fsec->sid) {
1540                 rc = avc_has_perm(sid, fsec->sid,
1541                                   SECCLASS_FD,
1542                                   FD__USE,
1543                                   &ad);
1544                 if (rc)
1545                         goto out;
1546         }
1547
1548         /* av is zero if only checking access to the descriptor. */
1549         rc = 0;
1550         if (av)
1551                 rc = inode_has_perm(cred, inode, av, &ad, 0);
1552
1553 out:
1554         return rc;
1555 }
1556
1557 /* Check whether a task can create a file. */
1558 static int may_create(struct inode *dir,
1559                       struct dentry *dentry,
1560                       u16 tclass)
1561 {
1562         const struct task_security_struct *tsec = current_security();
1563         struct inode_security_struct *dsec;
1564         struct superblock_security_struct *sbsec;
1565         u32 sid, newsid;
1566         struct common_audit_data ad;
1567         int rc;
1568
1569         dsec = dir->i_security;
1570         sbsec = dir->i_sb->s_security;
1571
1572         sid = tsec->sid;
1573         newsid = tsec->create_sid;
1574
1575         ad.type = LSM_AUDIT_DATA_DENTRY;
1576         ad.u.dentry = dentry;
1577
1578         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR,
1579                           DIR__ADD_NAME | DIR__SEARCH,
1580                           &ad);
1581         if (rc)
1582                 return rc;
1583
1584         if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
1585                 rc = security_transition_sid(sid, dsec->sid, tclass,
1586                                              &dentry->d_name, &newsid);
1587                 if (rc)
1588                         return rc;
1589         }
1590
1591         rc = avc_has_perm(sid, newsid, tclass, FILE__CREATE, &ad);
1592         if (rc)
1593                 return rc;
1594
1595         return avc_has_perm(newsid, sbsec->sid,
1596                             SECCLASS_FILESYSTEM,
1597                             FILESYSTEM__ASSOCIATE, &ad);
1598 }
1599
1600 /* Check whether a task can create a key. */
1601 static int may_create_key(u32 ksid,
1602                           struct task_struct *ctx)
1603 {
1604         u32 sid = task_sid(ctx);
1605
1606         return avc_has_perm(sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1607 }
1608
1609 #define MAY_LINK        0
1610 #define MAY_UNLINK      1
1611 #define MAY_RMDIR       2
1612
1613 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1614 static int may_link(struct inode *dir,
1615                     struct dentry *dentry,
1616                     int kind)
1617
1618 {
1619         struct inode_security_struct *dsec, *isec;
1620         struct common_audit_data ad;
1621         u32 sid = current_sid();
1622         u32 av;
1623         int rc;
1624
1625         dsec = dir->i_security;
1626         isec = dentry->d_inode->i_security;
1627
1628         ad.type = LSM_AUDIT_DATA_DENTRY;
1629         ad.u.dentry = dentry;
1630
1631         av = DIR__SEARCH;
1632         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1633         rc = avc_has_perm(sid, dsec->sid, SECCLASS_DIR, av, &ad);
1634         if (rc)
1635                 return rc;
1636
1637         switch (kind) {
1638         case MAY_LINK:
1639                 av = FILE__LINK;
1640                 break;
1641         case MAY_UNLINK:
1642                 av = FILE__UNLINK;
1643                 break;
1644         case MAY_RMDIR:
1645                 av = DIR__RMDIR;
1646                 break;
1647         default:
1648                 printk(KERN_WARNING "SELinux: %s:  unrecognized kind %d\n",
1649                         __func__, kind);
1650                 return 0;
1651         }
1652
1653         rc = avc_has_perm(sid, isec->sid, isec->sclass, av, &ad);
1654         return rc;
1655 }
1656
1657 static inline int may_rename(struct inode *old_dir,
1658                              struct dentry *old_dentry,
1659                              struct inode *new_dir,
1660                              struct dentry *new_dentry)
1661 {
1662         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1663         struct common_audit_data ad;
1664         u32 sid = current_sid();
1665         u32 av;
1666         int old_is_dir, new_is_dir;
1667         int rc;
1668
1669         old_dsec = old_dir->i_security;
1670         old_isec = old_dentry->d_inode->i_security;
1671         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1672         new_dsec = new_dir->i_security;
1673
1674         ad.type = LSM_AUDIT_DATA_DENTRY;
1675
1676         ad.u.dentry = old_dentry;
1677         rc = avc_has_perm(sid, old_dsec->sid, SECCLASS_DIR,
1678                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1679         if (rc)
1680                 return rc;
1681         rc = avc_has_perm(sid, old_isec->sid,
1682                           old_isec->sclass, FILE__RENAME, &ad);
1683         if (rc)
1684                 return rc;
1685         if (old_is_dir && new_dir != old_dir) {
1686                 rc = avc_has_perm(sid, old_isec->sid,
1687                                   old_isec->sclass, DIR__REPARENT, &ad);
1688                 if (rc)
1689                         return rc;
1690         }
1691
1692         ad.u.dentry = new_dentry;
1693         av = DIR__ADD_NAME | DIR__SEARCH;
1694         if (new_dentry->d_inode)
1695                 av |= DIR__REMOVE_NAME;
1696         rc = avc_has_perm(sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1697         if (rc)
1698                 return rc;
1699         if (new_dentry->d_inode) {
1700                 new_isec = new_dentry->d_inode->i_security;
1701                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1702                 rc = avc_has_perm(sid, new_isec->sid,
1703                                   new_isec->sclass,
1704                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1705                 if (rc)
1706                         return rc;
1707         }
1708
1709         return 0;
1710 }
1711
1712 /* Check whether a task can perform a filesystem operation. */
1713 static int superblock_has_perm(const struct cred *cred,
1714                                struct super_block *sb,
1715                                u32 perms,
1716                                struct common_audit_data *ad)
1717 {
1718         struct superblock_security_struct *sbsec;
1719         u32 sid = cred_sid(cred);
1720
1721         sbsec = sb->s_security;
1722         return avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM, perms, ad);
1723 }
1724
1725 /* Convert a Linux mode and permission mask to an access vector. */
1726 static inline u32 file_mask_to_av(int mode, int mask)
1727 {
1728         u32 av = 0;
1729
1730         if (!S_ISDIR(mode)) {
1731                 if (mask & MAY_EXEC)
1732                         av |= FILE__EXECUTE;
1733                 if (mask & MAY_READ)
1734                         av |= FILE__READ;
1735
1736                 if (mask & MAY_APPEND)
1737                         av |= FILE__APPEND;
1738                 else if (mask & MAY_WRITE)
1739                         av |= FILE__WRITE;
1740
1741         } else {
1742                 if (mask & MAY_EXEC)
1743                         av |= DIR__SEARCH;
1744                 if (mask & MAY_WRITE)
1745                         av |= DIR__WRITE;
1746                 if (mask & MAY_READ)
1747                         av |= DIR__READ;
1748         }
1749
1750         return av;
1751 }
1752
1753 /* Convert a Linux file to an access vector. */
1754 static inline u32 file_to_av(struct file *file)
1755 {
1756         u32 av = 0;
1757
1758         if (file->f_mode & FMODE_READ)
1759                 av |= FILE__READ;
1760         if (file->f_mode & FMODE_WRITE) {
1761                 if (file->f_flags & O_APPEND)
1762                         av |= FILE__APPEND;
1763                 else
1764                         av |= FILE__WRITE;
1765         }
1766         if (!av) {
1767                 /*
1768                  * Special file opened with flags 3 for ioctl-only use.
1769                  */
1770                 av = FILE__IOCTL;
1771         }
1772
1773         return av;
1774 }
1775
1776 /*
1777  * Convert a file to an access vector and include the correct open
1778  * open permission.
1779  */
1780 static inline u32 open_file_to_av(struct file *file)
1781 {
1782         u32 av = file_to_av(file);
1783
1784         if (selinux_policycap_openperm)
1785                 av |= FILE__OPEN;
1786
1787         return av;
1788 }
1789
1790 /* Hook functions begin here. */
1791
1792 static int selinux_ptrace_access_check(struct task_struct *child,
1793                                      unsigned int mode)
1794 {
1795         int rc;
1796
1797         rc = cap_ptrace_access_check(child, mode);
1798         if (rc)
1799                 return rc;
1800
1801         if (mode & PTRACE_MODE_READ) {
1802                 u32 sid = current_sid();
1803                 u32 csid = task_sid(child);
1804                 return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
1805         }
1806
1807         return current_has_perm(child, PROCESS__PTRACE);
1808 }
1809
1810 static int selinux_ptrace_traceme(struct task_struct *parent)
1811 {
1812         int rc;
1813
1814         rc = cap_ptrace_traceme(parent);
1815         if (rc)
1816                 return rc;
1817
1818         return task_has_perm(parent, current, PROCESS__PTRACE);
1819 }
1820
1821 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1822                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1823 {
1824         int error;
1825
1826         error = current_has_perm(target, PROCESS__GETCAP);
1827         if (error)
1828                 return error;
1829
1830         return cap_capget(target, effective, inheritable, permitted);
1831 }
1832
1833 static int selinux_capset(struct cred *new, const struct cred *old,
1834                           const kernel_cap_t *effective,
1835                           const kernel_cap_t *inheritable,
1836                           const kernel_cap_t *permitted)
1837 {
1838         int error;
1839
1840         error = cap_capset(new, old,
1841                                       effective, inheritable, permitted);
1842         if (error)
1843                 return error;
1844
1845         return cred_has_perm(old, new, PROCESS__SETCAP);
1846 }
1847
1848 /*
1849  * (This comment used to live with the selinux_task_setuid hook,
1850  * which was removed).
1851  *
1852  * Since setuid only affects the current process, and since the SELinux
1853  * controls are not based on the Linux identity attributes, SELinux does not
1854  * need to control this operation.  However, SELinux does control the use of
1855  * the CAP_SETUID and CAP_SETGID capabilities using the capable hook.
1856  */
1857
1858 static int selinux_capable(const struct cred *cred, struct user_namespace *ns,
1859                            int cap, int audit)
1860 {
1861         int rc;
1862
1863         rc = cap_capable(cred, ns, cap, audit);
1864         if (rc)
1865                 return rc;
1866
1867         return cred_has_capability(cred, cap, audit);
1868 }
1869
1870 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1871 {
1872         const struct cred *cred = current_cred();
1873         int rc = 0;
1874
1875         if (!sb)
1876                 return 0;
1877
1878         switch (cmds) {
1879         case Q_SYNC:
1880         case Q_QUOTAON:
1881         case Q_QUOTAOFF:
1882         case Q_SETINFO:
1883         case Q_SETQUOTA:
1884                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAMOD, NULL);
1885                 break;
1886         case Q_GETFMT:
1887         case Q_GETINFO:
1888         case Q_GETQUOTA:
1889                 rc = superblock_has_perm(cred, sb, FILESYSTEM__QUOTAGET, NULL);
1890                 break;
1891         default:
1892                 rc = 0;  /* let the kernel handle invalid cmds */
1893                 break;
1894         }
1895         return rc;
1896 }
1897
1898 static int selinux_quota_on(struct dentry *dentry)
1899 {
1900         const struct cred *cred = current_cred();
1901
1902         return dentry_has_perm(cred, dentry, FILE__QUOTAON);
1903 }
1904
1905 static int selinux_syslog(int type)
1906 {
1907         int rc;
1908
1909         switch (type) {
1910         case SYSLOG_ACTION_READ_ALL:    /* Read last kernel messages */
1911         case SYSLOG_ACTION_SIZE_BUFFER: /* Return size of the log buffer */
1912                 rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1913                 break;
1914         case SYSLOG_ACTION_CONSOLE_OFF: /* Disable logging to console */
1915         case SYSLOG_ACTION_CONSOLE_ON:  /* Enable logging to console */
1916         /* Set level of messages printed to console */
1917         case SYSLOG_ACTION_CONSOLE_LEVEL:
1918                 rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1919                 break;
1920         case SYSLOG_ACTION_CLOSE:       /* Close log */
1921         case SYSLOG_ACTION_OPEN:        /* Open log */
1922         case SYSLOG_ACTION_READ:        /* Read from log */
1923         case SYSLOG_ACTION_READ_CLEAR:  /* Read/clear last kernel messages */
1924         case SYSLOG_ACTION_CLEAR:       /* Clear ring buffer */
1925         default:
1926                 rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1927                 break;
1928         }
1929         return rc;
1930 }
1931
1932 /*
1933  * Check that a process has enough memory to allocate a new virtual
1934  * mapping. 0 means there is enough memory for the allocation to
1935  * succeed and -ENOMEM implies there is not.
1936  *
1937  * Do not audit the selinux permission check, as this is applied to all
1938  * processes that allocate mappings.
1939  */
1940 static int selinux_vm_enough_memory(struct mm_struct *mm, long pages)
1941 {
1942         int rc, cap_sys_admin = 0;
1943
1944         rc = selinux_capable(current_cred(), &init_user_ns, CAP_SYS_ADMIN,
1945                              SECURITY_CAP_NOAUDIT);
1946         if (rc == 0)
1947                 cap_sys_admin = 1;
1948
1949         return __vm_enough_memory(mm, pages, cap_sys_admin);
1950 }
1951
1952 /* binprm security operations */
1953
1954 static int selinux_bprm_set_creds(struct linux_binprm *bprm)
1955 {
1956         const struct task_security_struct *old_tsec;
1957         struct task_security_struct *new_tsec;
1958         struct inode_security_struct *isec;
1959         struct common_audit_data ad;
1960         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1961         int rc;
1962
1963         rc = cap_bprm_set_creds(bprm);
1964         if (rc)
1965                 return rc;
1966
1967         /* SELinux context only depends on initial program or script and not
1968          * the script interpreter */
1969         if (bprm->cred_prepared)
1970                 return 0;
1971
1972         old_tsec = current_security();
1973         new_tsec = bprm->cred->security;
1974         isec = inode->i_security;
1975
1976         /* Default to the current task SID. */
1977         new_tsec->sid = old_tsec->sid;
1978         new_tsec->osid = old_tsec->sid;
1979
1980         /* Reset fs, key, and sock SIDs on execve. */
1981         new_tsec->create_sid = 0;
1982         new_tsec->keycreate_sid = 0;
1983         new_tsec->sockcreate_sid = 0;
1984
1985         if (old_tsec->exec_sid) {
1986                 new_tsec->sid = old_tsec->exec_sid;
1987                 /* Reset exec SID on execve. */
1988                 new_tsec->exec_sid = 0;
1989
1990                 /*
1991                  * Minimize confusion: if no_new_privs and a transition is
1992                  * explicitly requested, then fail the exec.
1993                  */
1994                 if (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS)
1995                         return -EPERM;
1996         } else {
1997                 /* Check for a default transition on this program. */
1998                 rc = security_transition_sid(old_tsec->sid, isec->sid,
1999                                              SECCLASS_PROCESS, NULL,
2000                                              &new_tsec->sid);
2001                 if (rc)
2002                         return rc;
2003         }
2004
2005         ad.type = LSM_AUDIT_DATA_PATH;
2006         ad.u.path = bprm->file->f_path;
2007
2008         if ((bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID) ||
2009             (bprm->unsafe & LSM_UNSAFE_NO_NEW_PRIVS))
2010                 new_tsec->sid = old_tsec->sid;
2011
2012         if (new_tsec->sid == old_tsec->sid) {
2013                 rc = avc_has_perm(old_tsec->sid, isec->sid,
2014                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
2015                 if (rc)
2016                         return rc;
2017         } else {
2018                 /* Check permissions for the transition. */
2019                 rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2020                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
2021                 if (rc)
2022                         return rc;
2023
2024                 rc = avc_has_perm(new_tsec->sid, isec->sid,
2025                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
2026                 if (rc)
2027                         return rc;
2028
2029                 /* Check for shared state */
2030                 if (bprm->unsafe & LSM_UNSAFE_SHARE) {
2031                         rc = avc_has_perm(old_tsec->sid, new_tsec->sid,
2032                                           SECCLASS_PROCESS, PROCESS__SHARE,
2033                                           NULL);
2034                         if (rc)
2035                                 return -EPERM;
2036                 }
2037
2038                 /* Make sure that anyone attempting to ptrace over a task that
2039                  * changes its SID has the appropriate permit */
2040                 if (bprm->unsafe &
2041                     (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
2042                         struct task_struct *tracer;
2043                         struct task_security_struct *sec;
2044                         u32 ptsid = 0;
2045
2046                         rcu_read_lock();
2047                         tracer = ptrace_parent(current);
2048                         if (likely(tracer != NULL)) {
2049                                 sec = __task_cred(tracer)->security;
2050                                 ptsid = sec->sid;
2051                         }
2052                         rcu_read_unlock();
2053
2054                         if (ptsid != 0) {
2055                                 rc = avc_has_perm(ptsid, new_tsec->sid,
2056                                                   SECCLASS_PROCESS,
2057                                                   PROCESS__PTRACE, NULL);
2058                                 if (rc)
2059                                         return -EPERM;
2060                         }
2061                 }
2062
2063                 /* Clear any possibly unsafe personality bits on exec: */
2064                 bprm->per_clear |= PER_CLEAR_ON_SETID;
2065         }
2066
2067         return 0;
2068 }
2069
2070 static int selinux_bprm_secureexec(struct linux_binprm *bprm)
2071 {
2072         const struct task_security_struct *tsec = current_security();
2073         u32 sid, osid;
2074         int atsecure = 0;
2075
2076         sid = tsec->sid;
2077         osid = tsec->osid;
2078
2079         if (osid != sid) {
2080                 /* Enable secure mode for SIDs transitions unless
2081                    the noatsecure permission is granted between
2082                    the two SIDs, i.e. ahp returns 0. */
2083                 atsecure = avc_has_perm(osid, sid,
2084                                         SECCLASS_PROCESS,
2085                                         PROCESS__NOATSECURE, NULL);
2086         }
2087
2088         return (atsecure || cap_bprm_secureexec(bprm));
2089 }
2090
2091 /* Derived from fs/exec.c:flush_old_files. */
2092 static inline void flush_unauthorized_files(const struct cred *cred,
2093                                             struct files_struct *files)
2094 {
2095         struct file *file, *devnull = NULL;
2096         struct tty_struct *tty;
2097         struct fdtable *fdt;
2098         long j = -1;
2099         int drop_tty = 0;
2100
2101         tty = get_current_tty();
2102         if (tty) {
2103                 spin_lock(&tty_files_lock);
2104                 if (!list_empty(&tty->tty_files)) {
2105                         struct tty_file_private *file_priv;
2106
2107                         /* Revalidate access to controlling tty.
2108                            Use path_has_perm on the tty path directly rather
2109                            than using file_has_perm, as this particular open
2110                            file may belong to another process and we are only
2111                            interested in the inode-based check here. */
2112                         file_priv = list_first_entry(&tty->tty_files,
2113                                                 struct tty_file_private, list);
2114                         file = file_priv->file;
2115                         if (path_has_perm(cred, &file->f_path, FILE__READ | FILE__WRITE))
2116                                 drop_tty = 1;
2117                 }
2118                 spin_unlock(&tty_files_lock);
2119                 tty_kref_put(tty);
2120         }
2121         /* Reset controlling tty. */
2122         if (drop_tty)
2123                 no_tty();
2124
2125         /* Revalidate access to inherited open files. */
2126         spin_lock(&files->file_lock);
2127         for (;;) {
2128                 unsigned long set, i;
2129                 int fd;
2130
2131                 j++;
2132                 i = j * __NFDBITS;
2133                 fdt = files_fdtable(files);
2134                 if (i >= fdt->max_fds)
2135                         break;
2136                 set = fdt->open_fds[j];
2137                 if (!set)
2138                         continue;
2139                 spin_unlock(&files->file_lock);
2140                 for ( ; set ; i++, set >>= 1) {
2141                         if (set & 1) {
2142                                 file = fget(i);
2143                                 if (!file)
2144                                         continue;
2145                                 if (file_has_perm(cred,
2146                                                   file,
2147                                                   file_to_av(file))) {
2148                                         sys_close(i);
2149                                         fd = get_unused_fd();
2150                                         if (fd != i) {
2151                                                 if (fd >= 0)
2152                                                         put_unused_fd(fd);
2153                                                 fput(file);
2154                                                 continue;
2155                                         }
2156                                         if (devnull) {
2157                                                 get_file(devnull);
2158                                         } else {
2159                                                 devnull = dentry_open(
2160                                                         &selinux_null,
2161                                                         O_RDWR, cred);
2162                                                 if (IS_ERR(devnull)) {
2163                                                         devnull = NULL;
2164                                                         put_unused_fd(fd);
2165                                                         fput(file);
2166                                                         continue;
2167                                                 }
2168                                         }
2169                                         fd_install(fd, devnull);
2170                                 }
2171                                 fput(file);
2172                         }
2173                 }
2174                 spin_lock(&files->file_lock);
2175
2176         }
2177         spin_unlock(&files->file_lock);
2178 }
2179
2180 /*
2181  * Prepare a process for imminent new credential changes due to exec
2182  */
2183 static void selinux_bprm_committing_creds(struct linux_binprm *bprm)
2184 {
2185         struct task_security_struct *new_tsec;
2186         struct rlimit *rlim, *initrlim;
2187         int rc, i;
2188
2189         new_tsec = bprm->cred->security;
2190         if (new_tsec->sid == new_tsec->osid)
2191                 return;
2192
2193         /* Close files for which the new task SID is not authorized. */
2194         flush_unauthorized_files(bprm->cred, current->files);
2195
2196         /* Always clear parent death signal on SID transitions. */
2197         current->pdeath_signal = 0;
2198
2199         /* Check whether the new SID can inherit resource limits from the old
2200          * SID.  If not, reset all soft limits to the lower of the current
2201          * task's hard limit and the init task's soft limit.
2202          *
2203          * Note that the setting of hard limits (even to lower them) can be
2204          * controlled by the setrlimit check.  The inclusion of the init task's
2205          * soft limit into the computation is to avoid resetting soft limits
2206          * higher than the default soft limit for cases where the default is
2207          * lower than the hard limit, e.g. RLIMIT_CORE or RLIMIT_STACK.
2208          */
2209         rc = avc_has_perm(new_tsec->osid, new_tsec->sid, SECCLASS_PROCESS,
2210                           PROCESS__RLIMITINH, NULL);
2211         if (rc) {
2212                 /* protect against do_prlimit() */
2213                 task_lock(current);
2214                 for (i = 0; i < RLIM_NLIMITS; i++) {
2215                         rlim = current->signal->rlim + i;
2216                         initrlim = init_task.signal->rlim + i;
2217                         rlim->rlim_cur = min(rlim->rlim_max, initrlim->rlim_cur);
2218                 }
2219                 task_unlock(current);
2220                 update_rlimit_cpu(current, rlimit(RLIMIT_CPU));
2221         }
2222 }
2223
2224 /*
2225  * Clean up the process immediately after the installation of new credentials
2226  * due to exec
2227  */
2228 static void selinux_bprm_committed_creds(struct linux_binprm *bprm)
2229 {
2230         const struct task_security_struct *tsec = current_security();
2231         struct itimerval itimer;
2232         u32 osid, sid;
2233         int rc, i;
2234
2235         osid = tsec->osid;
2236         sid = tsec->sid;
2237
2238         if (sid == osid)
2239                 return;
2240
2241         /* Check whether the new SID can inherit signal state from the old SID.
2242          * If not, clear itimers to avoid subsequent signal generation and
2243          * flush and unblock signals.
2244          *
2245          * This must occur _after_ the task SID has been updated so that any
2246          * kill done after the flush will be checked against the new SID.
2247          */
2248         rc = avc_has_perm(osid, sid, SECCLASS_PROCESS, PROCESS__SIGINH, NULL);
2249         if (rc) {
2250                 memset(&itimer, 0, sizeof itimer);
2251                 for (i = 0; i < 3; i++)
2252                         do_setitimer(i, &itimer, NULL);
2253                 spin_lock_irq(&current->sighand->siglock);
2254                 if (!(current->signal->flags & SIGNAL_GROUP_EXIT)) {
2255                         __flush_signals(current);
2256                         flush_signal_handlers(current, 1);
2257                         sigemptyset(&current->blocked);
2258                 }
2259                 spin_unlock_irq(&current->sighand->siglock);
2260         }
2261
2262         /* Wake up the parent if it is waiting so that it can recheck
2263          * wait permission to the new task SID. */
2264         read_lock(&tasklist_lock);
2265         __wake_up_parent(current, current->real_parent);
2266         read_unlock(&tasklist_lock);
2267 }
2268
2269 /* superblock security operations */
2270
2271 static int selinux_sb_alloc_security(struct super_block *sb)
2272 {
2273         return superblock_alloc_security(sb);
2274 }
2275
2276 static void selinux_sb_free_security(struct super_block *sb)
2277 {
2278         superblock_free_security(sb);
2279 }
2280
2281 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
2282 {
2283         if (plen > olen)
2284                 return 0;
2285
2286         return !memcmp(prefix, option, plen);
2287 }
2288
2289 static inline int selinux_option(char *option, int len)
2290 {
2291         return (match_prefix(CONTEXT_STR, sizeof(CONTEXT_STR)-1, option, len) ||
2292                 match_prefix(FSCONTEXT_STR, sizeof(FSCONTEXT_STR)-1, option, len) ||
2293                 match_prefix(DEFCONTEXT_STR, sizeof(DEFCONTEXT_STR)-1, option, len) ||
2294                 match_prefix(ROOTCONTEXT_STR, sizeof(ROOTCONTEXT_STR)-1, option, len) ||
2295                 match_prefix(LABELSUPP_STR, sizeof(LABELSUPP_STR)-1, option, len));
2296 }
2297
2298 static inline void take_option(char **to, char *from, int *first, int len)
2299 {
2300         if (!*first) {
2301                 **to = ',';
2302                 *to += 1;
2303         } else
2304                 *first = 0;
2305         memcpy(*to, from, len);
2306         *to += len;
2307 }
2308
2309 static inline void take_selinux_option(char **to, char *from, int *first,
2310                                        int len)
2311 {
2312         int current_size = 0;
2313
2314         if (!*first) {
2315                 **to = '|';
2316                 *to += 1;
2317         } else
2318                 *first = 0;
2319
2320         while (current_size < len) {
2321                 if (*from != '"') {
2322                         **to = *from;
2323                         *to += 1;
2324                 }
2325                 from += 1;
2326                 current_size += 1;
2327         }
2328 }
2329
2330 static int selinux_sb_copy_data(char *orig, char *copy)
2331 {
2332         int fnosec, fsec, rc = 0;
2333         char *in_save, *in_curr, *in_end;
2334         char *sec_curr, *nosec_save, *nosec;
2335         int open_quote = 0;
2336
2337         in_curr = orig;
2338         sec_curr = copy;
2339
2340         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2341         if (!nosec) {
2342                 rc = -ENOMEM;
2343                 goto out;
2344         }
2345
2346         nosec_save = nosec;
2347         fnosec = fsec = 1;
2348         in_save = in_end = orig;
2349
2350         do {
2351                 if (*in_end == '"')
2352                         open_quote = !open_quote;
2353                 if ((*in_end == ',' && open_quote == 0) ||
2354                                 *in_end == '\0') {
2355                         int len = in_end - in_curr;
2356
2357                         if (selinux_option(in_curr, len))
2358                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2359                         else
2360                                 take_option(&nosec, in_curr, &fnosec, len);
2361
2362                         in_curr = in_end + 1;
2363                 }
2364         } while (*in_end++);
2365
2366         strcpy(in_save, nosec_save);
2367         free_page((unsigned long)nosec_save);
2368 out:
2369         return rc;
2370 }
2371
2372 static int selinux_sb_remount(struct super_block *sb, void *data)
2373 {
2374         int rc, i, *flags;
2375         struct security_mnt_opts opts;
2376         char *secdata, **mount_options;
2377         struct superblock_security_struct *sbsec = sb->s_security;
2378
2379         if (!(sbsec->flags & SE_SBINITIALIZED))
2380                 return 0;
2381
2382         if (!data)
2383                 return 0;
2384
2385         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA)
2386                 return 0;
2387
2388         security_init_mnt_opts(&opts);
2389         secdata = alloc_secdata();
2390         if (!secdata)
2391                 return -ENOMEM;
2392         rc = selinux_sb_copy_data(data, secdata);
2393         if (rc)
2394                 goto out_free_secdata;
2395
2396         rc = selinux_parse_opts_str(secdata, &opts);
2397         if (rc)
2398                 goto out_free_secdata;
2399
2400         mount_options = opts.mnt_opts;
2401         flags = opts.mnt_opts_flags;
2402
2403         for (i = 0; i < opts.num_mnt_opts; i++) {
2404                 u32 sid;
2405                 size_t len;
2406
2407                 if (flags[i] == SE_SBLABELSUPP)
2408                         continue;
2409                 len = strlen(mount_options[i]);
2410                 rc = security_context_to_sid(mount_options[i], len, &sid);
2411                 if (rc) {
2412                         printk(KERN_WARNING "SELinux: security_context_to_sid"
2413                                "(%s) failed for (dev %s, type %s) errno=%d\n",
2414                                mount_options[i], sb->s_id, sb->s_type->name, rc);
2415                         goto out_free_opts;
2416                 }
2417                 rc = -EINVAL;
2418                 switch (flags[i]) {
2419                 case FSCONTEXT_MNT:
2420                         if (bad_option(sbsec, FSCONTEXT_MNT, sbsec->sid, sid))
2421                                 goto out_bad_option;
2422                         break;
2423                 case CONTEXT_MNT:
2424                         if (bad_option(sbsec, CONTEXT_MNT, sbsec->mntpoint_sid, sid))
2425                                 goto out_bad_option;
2426                         break;
2427                 case ROOTCONTEXT_MNT: {
2428                         struct inode_security_struct *root_isec;
2429                         root_isec = sb->s_root->d_inode->i_security;
2430
2431                         if (bad_option(sbsec, ROOTCONTEXT_MNT, root_isec->sid, sid))
2432                                 goto out_bad_option;
2433                         break;
2434                 }
2435                 case DEFCONTEXT_MNT:
2436                         if (bad_option(sbsec, DEFCONTEXT_MNT, sbsec->def_sid, sid))
2437                                 goto out_bad_option;
2438                         break;
2439                 default:
2440                         goto out_free_opts;
2441                 }
2442         }
2443
2444         rc = 0;
2445 out_free_opts:
2446         security_free_mnt_opts(&opts);
2447 out_free_secdata:
2448         free_secdata(secdata);
2449         return rc;
2450 out_bad_option:
2451         printk(KERN_WARNING "SELinux: unable to change security options "
2452                "during remount (dev %s, type=%s)\n", sb->s_id,
2453                sb->s_type->name);
2454         goto out_free_opts;
2455 }
2456
2457 static int selinux_sb_kern_mount(struct super_block *sb, int flags, void *data)
2458 {
2459         const struct cred *cred = current_cred();
2460         struct common_audit_data ad;
2461         int rc;
2462
2463         rc = superblock_doinit(sb, data);
2464         if (rc)
2465                 return rc;
2466
2467         /* Allow all mounts performed by the kernel */
2468         if (flags & MS_KERNMOUNT)
2469                 return 0;
2470
2471         ad.type = LSM_AUDIT_DATA_DENTRY;
2472         ad.u.dentry = sb->s_root;
2473         return superblock_has_perm(cred, sb, FILESYSTEM__MOUNT, &ad);
2474 }
2475
2476 static int selinux_sb_statfs(struct dentry *dentry)
2477 {
2478         const struct cred *cred = current_cred();
2479         struct common_audit_data ad;
2480
2481         ad.type = LSM_AUDIT_DATA_DENTRY;
2482         ad.u.dentry = dentry->d_sb->s_root;
2483         return superblock_has_perm(cred, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2484 }
2485
2486 static int selinux_mount(char *dev_name,
2487                          struct path *path,
2488                          char *type,
2489                          unsigned long flags,
2490                          void *data)
2491 {
2492         const struct cred *cred = current_cred();
2493
2494         if (flags & MS_REMOUNT)
2495                 return superblock_has_perm(cred, path->dentry->d_sb,
2496                                            FILESYSTEM__REMOUNT, NULL);
2497         else
2498                 return path_has_perm(cred, path, FILE__MOUNTON);
2499 }
2500
2501 static int selinux_umount(struct vfsmount *mnt, int flags)
2502 {
2503         const struct cred *cred = current_cred();
2504
2505         return superblock_has_perm(cred, mnt->mnt_sb,
2506                                    FILESYSTEM__UNMOUNT, NULL);
2507 }
2508
2509 /* inode security operations */
2510
2511 static int selinux_inode_alloc_security(struct inode *inode)
2512 {
2513         return inode_alloc_security(inode);
2514 }
2515
2516 static void selinux_inode_free_security(struct inode *inode)
2517 {
2518         inode_free_security(inode);
2519 }
2520
2521 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2522                                        const struct qstr *qstr, char **name,
2523                                        void **value, size_t *len)
2524 {
2525         const struct task_security_struct *tsec = current_security();
2526         struct inode_security_struct *dsec;
2527         struct superblock_security_struct *sbsec;
2528         u32 sid, newsid, clen;
2529         int rc;
2530         char *namep = NULL, *context;
2531
2532         dsec = dir->i_security;
2533         sbsec = dir->i_sb->s_security;
2534
2535         sid = tsec->sid;
2536         newsid = tsec->create_sid;
2537
2538         if ((sbsec->flags & SE_SBINITIALIZED) &&
2539             (sbsec->behavior == SECURITY_FS_USE_MNTPOINT))
2540                 newsid = sbsec->mntpoint_sid;
2541         else if (!newsid || !(sbsec->flags & SE_SBLABELSUPP)) {
2542                 rc = security_transition_sid(sid, dsec->sid,
2543                                              inode_mode_to_security_class(inode->i_mode),
2544                                              qstr, &newsid);
2545                 if (rc) {
2546                         printk(KERN_WARNING "%s:  "
2547                                "security_transition_sid failed, rc=%d (dev=%s "
2548                                "ino=%ld)\n",
2549                                __func__,
2550                                -rc, inode->i_sb->s_id, inode->i_ino);
2551                         return rc;
2552                 }
2553         }
2554
2555         /* Possibly defer initialization to selinux_complete_init. */
2556         if (sbsec->flags & SE_SBINITIALIZED) {
2557                 struct inode_security_struct *isec = inode->i_security;
2558                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2559                 isec->sid = newsid;
2560                 isec->initialized = 1;
2561         }
2562
2563         if (!ss_initialized || !(sbsec->flags & SE_SBLABELSUPP))
2564                 return -EOPNOTSUPP;
2565
2566         if (name) {
2567                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_NOFS);
2568                 if (!namep)
2569                         return -ENOMEM;
2570                 *name = namep;
2571         }
2572
2573         if (value && len) {
2574                 rc = security_sid_to_context_force(newsid, &context, &clen);
2575                 if (rc) {
2576                         kfree(namep);
2577                         return rc;
2578                 }
2579                 *value = context;
2580                 *len = clen;
2581         }
2582
2583         return 0;
2584 }
2585
2586 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, umode_t mode)
2587 {
2588         return may_create(dir, dentry, SECCLASS_FILE);
2589 }
2590
2591 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2592 {
2593         return may_link(dir, old_dentry, MAY_LINK);
2594 }
2595
2596 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2597 {
2598         return may_link(dir, dentry, MAY_UNLINK);
2599 }
2600
2601 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2602 {
2603         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2604 }
2605
2606 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, umode_t mask)
2607 {
2608         return may_create(dir, dentry, SECCLASS_DIR);
2609 }
2610
2611 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2612 {
2613         return may_link(dir, dentry, MAY_RMDIR);
2614 }
2615
2616 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, umode_t mode, dev_t dev)
2617 {
2618         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2619 }
2620
2621 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2622                                 struct inode *new_inode, struct dentry *new_dentry)
2623 {
2624         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2625 }
2626
2627 static int selinux_inode_readlink(struct dentry *dentry)
2628 {
2629         const struct cred *cred = current_cred();
2630
2631         return dentry_has_perm(cred, dentry, FILE__READ);
2632 }
2633
2634 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2635 {
2636         const struct cred *cred = current_cred();
2637
2638         return dentry_has_perm(cred, dentry, FILE__READ);
2639 }
2640
2641 static noinline int audit_inode_permission(struct inode *inode,
2642                                            u32 perms, u32 audited, u32 denied,
2643                                            unsigned flags)
2644 {
2645         struct common_audit_data ad;
2646         struct inode_security_struct *isec = inode->i_security;
2647         int rc;
2648
2649         ad.type = LSM_AUDIT_DATA_INODE;
2650         ad.u.inode = inode;
2651
2652         rc = slow_avc_audit(current_sid(), isec->sid, isec->sclass, perms,
2653                             audited, denied, &ad, flags);
2654         if (rc)
2655                 return rc;
2656         return 0;
2657 }
2658
2659 static int selinux_inode_permission(struct inode *inode, int mask)
2660 {
2661         const struct cred *cred = current_cred();
2662         u32 perms;
2663         bool from_access;
2664         unsigned flags = mask & MAY_NOT_BLOCK;
2665         struct inode_security_struct *isec;
2666         u32 sid;
2667         struct av_decision avd;
2668         int rc, rc2;
2669         u32 audited, denied;
2670
2671         from_access = mask & MAY_ACCESS;
2672         mask &= (MAY_READ|MAY_WRITE|MAY_EXEC|MAY_APPEND);
2673
2674         /* No permission to check.  Existence test. */
2675         if (!mask)
2676                 return 0;
2677
2678         validate_creds(cred);
2679
2680         if (unlikely(IS_PRIVATE(inode)))
2681                 return 0;
2682
2683         perms = file_mask_to_av(inode->i_mode, mask);
2684
2685         sid = cred_sid(cred);
2686         isec = inode->i_security;
2687
2688         rc = avc_has_perm_noaudit(sid, isec->sid, isec->sclass, perms, 0, &avd);
2689         audited = avc_audit_required(perms, &avd, rc,
2690                                      from_access ? FILE__AUDIT_ACCESS : 0,
2691                                      &denied);
2692         if (likely(!audited))
2693                 return rc;
2694
2695         rc2 = audit_inode_permission(inode, perms, audited, denied, flags);
2696         if (rc2)
2697                 return rc2;
2698         return rc;
2699 }
2700
2701 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2702 {
2703         const struct cred *cred = current_cred();
2704         unsigned int ia_valid = iattr->ia_valid;
2705         __u32 av = FILE__WRITE;
2706
2707         /* ATTR_FORCE is just used for ATTR_KILL_S[UG]ID. */
2708         if (ia_valid & ATTR_FORCE) {
2709                 ia_valid &= ~(ATTR_KILL_SUID | ATTR_KILL_SGID | ATTR_MODE |
2710                               ATTR_FORCE);
2711                 if (!ia_valid)
2712                         return 0;
2713         }
2714
2715         if (ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2716                         ATTR_ATIME_SET | ATTR_MTIME_SET | ATTR_TIMES_SET))
2717                 return dentry_has_perm(cred, dentry, FILE__SETATTR);
2718
2719         if (selinux_policycap_openperm && (ia_valid & ATTR_SIZE))
2720                 av |= FILE__OPEN;
2721
2722         return dentry_has_perm(cred, dentry, av);
2723 }
2724
2725 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2726 {
2727         const struct cred *cred = current_cred();
2728         struct path path;
2729
2730         path.dentry = dentry;
2731         path.mnt = mnt;
2732
2733         return path_has_perm(cred, &path, FILE__GETATTR);
2734 }
2735
2736 static int selinux_inode_setotherxattr(struct dentry *dentry, const char *name)
2737 {
2738         const struct cred *cred = current_cred();
2739
2740         if (!strncmp(name, XATTR_SECURITY_PREFIX,
2741                      sizeof XATTR_SECURITY_PREFIX - 1)) {
2742                 if (!strcmp(name, XATTR_NAME_CAPS)) {
2743                         if (!capable(CAP_SETFCAP))
2744                                 return -EPERM;
2745                 } else if (!capable(CAP_SYS_ADMIN)) {
2746                         /* A different attribute in the security namespace.
2747                            Restrict to administrator. */
2748                         return -EPERM;
2749                 }
2750         }
2751
2752         /* Not an attribute we recognize, so just check the
2753            ordinary setattr permission. */
2754         return dentry_has_perm(cred, dentry, FILE__SETATTR);
2755 }
2756
2757 static int selinux_inode_setxattr(struct dentry *dentry, const char *name,
2758                                   const void *value, size_t size, int flags)
2759 {
2760         struct inode *inode = dentry->d_inode;
2761         struct inode_security_struct *isec = inode->i_security;
2762         struct superblock_security_struct *sbsec;
2763         struct common_audit_data ad;
2764         u32 newsid, sid = current_sid();
2765         int rc = 0;
2766
2767         if (strcmp(name, XATTR_NAME_SELINUX))
2768                 return selinux_inode_setotherxattr(dentry, name);
2769
2770         sbsec = inode->i_sb->s_security;
2771         if (!(sbsec->flags & SE_SBLABELSUPP))
2772                 return -EOPNOTSUPP;
2773
2774         if (!inode_owner_or_capable(inode))
2775                 return -EPERM;
2776
2777         ad.type = LSM_AUDIT_DATA_DENTRY;
2778         ad.u.dentry = dentry;
2779
2780         rc = avc_has_perm(sid, isec->sid, isec->sclass,
2781                           FILE__RELABELFROM, &ad);
2782         if (rc)
2783                 return rc;
2784
2785         rc = security_context_to_sid(value, size, &newsid);
2786         if (rc == -EINVAL) {
2787                 if (!capable(CAP_MAC_ADMIN)) {
2788                         struct audit_buffer *ab;
2789                         size_t audit_size;
2790                         const char *str;
2791
2792                         /* We strip a nul only if it is at the end, otherwise the
2793                          * context contains a nul and we should audit that */
2794                         str = value;
2795                         if (str[size - 1] == '\0')
2796                                 audit_size = size - 1;
2797                         else
2798                                 audit_size = size;
2799                         ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
2800                         audit_log_format(ab, "op=setxattr invalid_context=");
2801                         audit_log_n_untrustedstring(ab, value, audit_size);
2802                         audit_log_end(ab);
2803
2804                         return rc;
2805                 }
2806                 rc = security_context_to_sid_force(value, size, &newsid);
2807         }
2808         if (rc)
2809                 return rc;
2810
2811         rc = avc_has_perm(sid, newsid, isec->sclass,
2812                           FILE__RELABELTO, &ad);
2813         if (rc)
2814                 return rc;
2815
2816         rc = security_validate_transition(isec->sid, newsid, sid,
2817                                           isec->sclass);
2818         if (rc)
2819                 return rc;
2820
2821         return avc_has_perm(newsid,
2822                             sbsec->sid,
2823                             SECCLASS_FILESYSTEM,
2824                             FILESYSTEM__ASSOCIATE,
2825                             &ad);
2826 }
2827
2828 static void selinux_inode_post_setxattr(struct dentry *dentry, const char *name,
2829                                         const void *value, size_t size,
2830                                         int flags)
2831 {
2832         struct inode *inode = dentry->d_inode;
2833         struct inode_security_struct *isec = inode->i_security;
2834         u32 newsid;
2835         int rc;
2836
2837         if (strcmp(name, XATTR_NAME_SELINUX)) {
2838                 /* Not an attribute we recognize, so nothing to do. */
2839                 return;
2840         }
2841
2842         rc = security_context_to_sid_force(value, size, &newsid);
2843         if (rc) {
2844                 printk(KERN_ERR "SELinux:  unable to map context to SID"
2845                        "for (%s, %lu), rc=%d\n",
2846                        inode->i_sb->s_id, inode->i_ino, -rc);
2847                 return;
2848         }
2849
2850         isec->sid = newsid;
2851         return;
2852 }
2853
2854 static int selinux_inode_getxattr(struct dentry *dentry, const char *name)
2855 {
2856         const struct cred *cred = current_cred();
2857
2858         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2859 }
2860
2861 static int selinux_inode_listxattr(struct dentry *dentry)
2862 {
2863         const struct cred *cred = current_cred();
2864
2865         return dentry_has_perm(cred, dentry, FILE__GETATTR);
2866 }
2867
2868 static int selinux_inode_removexattr(struct dentry *dentry, const char *name)
2869 {
2870         if (strcmp(name, XATTR_NAME_SELINUX))
2871                 return selinux_inode_setotherxattr(dentry, name);
2872
2873         /* No one is allowed to remove a SELinux security label.
2874            You can change the label, but all data must be labeled. */
2875         return -EACCES;
2876 }
2877
2878 /*
2879  * Copy the inode security context value to the user.
2880  *
2881  * Permission check is handled by selinux_inode_getxattr hook.
2882  */
2883 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void **buffer, bool alloc)
2884 {
2885         u32 size;
2886         int error;
2887         char *context = NULL;
2888         struct inode_security_struct *isec = inode->i_security;
2889
2890         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2891                 return -EOPNOTSUPP;
2892
2893         /*
2894          * If the caller has CAP_MAC_ADMIN, then get the raw context
2895          * value even if it is not defined by current policy; otherwise,
2896          * use the in-core value under current policy.
2897          * Use the non-auditing forms of the permission checks since
2898          * getxattr may be called by unprivileged processes commonly
2899          * and lack of permission just means that we fall back to the
2900          * in-core context value, not a denial.
2901          */
2902         error = selinux_capable(current_cred(), &init_user_ns, CAP_MAC_ADMIN,
2903                                 SECURITY_CAP_NOAUDIT);
2904         if (!error)
2905                 error = security_sid_to_context_force(isec->sid, &context,
2906                                                       &size);
2907         else
2908                 error = security_sid_to_context(isec->sid, &context, &size);
2909         if (error)
2910                 return error;
2911         error = size;
2912         if (alloc) {
2913                 *buffer = context;
2914                 goto out_nofree;
2915         }
2916         kfree(context);
2917 out_nofree:
2918         return error;
2919 }
2920
2921 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2922                                      const void *value, size_t size, int flags)
2923 {
2924         struct inode_security_struct *isec = inode->i_security;
2925         u32 newsid;
2926         int rc;
2927
2928         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2929                 return -EOPNOTSUPP;
2930
2931         if (!value || !size)
2932                 return -EACCES;
2933
2934         rc = security_context_to_sid((void *)value, size, &newsid);
2935         if (rc)
2936                 return rc;
2937
2938         isec->sid = newsid;
2939         isec->initialized = 1;
2940         return 0;
2941 }
2942
2943 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2944 {
2945         const int len = sizeof(XATTR_NAME_SELINUX);
2946         if (buffer && len <= buffer_size)
2947                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2948         return len;
2949 }
2950
2951 static void selinux_inode_getsecid(const struct inode *inode, u32 *secid)
2952 {
2953         struct inode_security_struct *isec = inode->i_security;
2954         *secid = isec->sid;
2955 }
2956
2957 /* file security operations */
2958
2959 static int selinux_revalidate_file_permission(struct file *file, int mask)
2960 {
2961         const struct cred *cred = current_cred();
2962         struct inode *inode = file->f_path.dentry->d_inode;
2963
2964         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2965         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2966                 mask |= MAY_APPEND;
2967
2968         return file_has_perm(cred, file,
2969                              file_mask_to_av(inode->i_mode, mask));
2970 }
2971
2972 static int selinux_file_permission(struct file *file, int mask)
2973 {
2974         struct inode *inode = file->f_path.dentry->d_inode;
2975         struct file_security_struct *fsec = file->f_security;
2976         struct inode_security_struct *isec = inode->i_security;
2977         u32 sid = current_sid();
2978
2979         if (!mask)
2980                 /* No permission to check.  Existence test. */
2981                 return 0;
2982
2983         if (sid == fsec->sid && fsec->isid == isec->sid &&
2984             fsec->pseqno == avc_policy_seqno())
2985                 /* No change since file_open check. */
2986                 return 0;
2987
2988         return selinux_revalidate_file_permission(file, mask);
2989 }
2990
2991 static int selinux_file_alloc_security(struct file *file)
2992 {
2993         return file_alloc_security(file);
2994 }
2995
2996 static void selinux_file_free_security(struct file *file)
2997 {
2998         file_free_security(file);
2999 }
3000
3001 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
3002                               unsigned long arg)
3003 {
3004         const struct cred *cred = current_cred();
3005         int error = 0;
3006
3007         switch (cmd) {
3008         case FIONREAD:
3009         /* fall through */
3010         case FIBMAP:
3011         /* fall through */
3012         case FIGETBSZ:
3013         /* fall through */
3014         case FS_IOC_GETFLAGS:
3015         /* fall through */
3016         case FS_IOC_GETVERSION:
3017                 error = file_has_perm(cred, file, FILE__GETATTR);
3018                 break;
3019
3020         case FS_IOC_SETFLAGS:
3021         /* fall through */
3022         case FS_IOC_SETVERSION:
3023                 error = file_has_perm(cred, file, FILE__SETATTR);
3024                 break;
3025
3026         /* sys_ioctl() checks */
3027         case FIONBIO:
3028         /* fall through */
3029         case FIOASYNC:
3030                 error = file_has_perm(cred, file, 0);
3031                 break;
3032
3033         case KDSKBENT:
3034         case KDSKBSENT:
3035                 error = cred_has_capability(cred, CAP_SYS_TTY_CONFIG,
3036                                             SECURITY_CAP_AUDIT);
3037                 break;
3038
3039         /* default case assumes that the command will go
3040          * to the file's ioctl() function.
3041          */
3042         default:
3043                 error = file_has_perm(cred, file, FILE__IOCTL);
3044         }
3045         return error;
3046 }
3047
3048 static int default_noexec;
3049
3050 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
3051 {
3052         const struct cred *cred = current_cred();
3053         int rc = 0;
3054
3055         if (default_noexec &&
3056             (prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
3057                 /*
3058                  * We are making executable an anonymous mapping or a
3059                  * private file mapping that will also be writable.
3060                  * This has an additional check.
3061                  */
3062                 rc = cred_has_perm(cred, cred, PROCESS__EXECMEM);
3063                 if (rc)
3064                         goto error;
3065         }
3066
3067         if (file) {
3068                 /* read access is always possible with a mapping */
3069                 u32 av = FILE__READ;
3070
3071                 /* write access only matters if the mapping is shared */
3072                 if (shared && (prot & PROT_WRITE))
3073                         av |= FILE__WRITE;
3074
3075                 if (prot & PROT_EXEC)
3076                         av |= FILE__EXECUTE;
3077
3078                 return file_has_perm(cred, file, av);
3079         }
3080
3081 error:
3082         return rc;
3083 }
3084
3085 static int selinux_mmap_addr(unsigned long addr)
3086 {
3087         int rc = 0;
3088         u32 sid = current_sid();
3089
3090         /*
3091          * notice that we are intentionally putting the SELinux check before
3092          * the secondary cap_file_mmap check.  This is such a likely attempt
3093          * at bad behaviour/exploit that we always want to get the AVC, even
3094          * if DAC would have also denied the operation.
3095          */
3096         if (addr < CONFIG_LSM_MMAP_MIN_ADDR) {
3097                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
3098                                   MEMPROTECT__MMAP_ZERO, NULL);
3099                 if (rc)
3100                         return rc;
3101         }
3102
3103         /* do DAC check on address space usage */
3104         return cap_mmap_addr(addr);
3105 }
3106
3107 static int selinux_mmap_file(struct file *file, unsigned long reqprot,
3108                              unsigned long prot, unsigned long flags)
3109 {
3110         if (selinux_checkreqprot)
3111                 prot = reqprot;
3112
3113         return file_map_prot_check(file, prot,
3114                                    (flags & MAP_TYPE) == MAP_SHARED);
3115 }
3116
3117 static int selinux_file_mprotect(struct vm_area_struct *vma,
3118                                  unsigned long reqprot,
3119                                  unsigned long prot)
3120 {
3121         const struct cred *cred = current_cred();
3122
3123         if (selinux_checkreqprot)
3124                 prot = reqprot;
3125
3126         if (default_noexec &&
3127             (prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
3128                 int rc = 0;
3129                 if (vma->vm_start >= vma->vm_mm->start_brk &&
3130                     vma->vm_end <= vma->vm_mm->brk) {
3131                         rc = cred_has_perm(cred, cred, PROCESS__EXECHEAP);
3132                 } else if (!vma->vm_file &&
3133                            vma->vm_start <= vma->vm_mm->start_stack &&
3134                            vma->vm_end >= vma->vm_mm->start_stack) {
3135                         rc = current_has_perm(current, PROCESS__EXECSTACK);
3136                 } else if (vma->vm_file && vma->anon_vma) {
3137                         /*
3138                          * We are making executable a file mapping that has
3139                          * had some COW done. Since pages might have been
3140                          * written, check ability to execute the possibly
3141                          * modified content.  This typically should only
3142                          * occur for text relocations.
3143                          */
3144                         rc = file_has_perm(cred, vma->vm_file, FILE__EXECMOD);
3145                 }
3146                 if (rc)
3147                         return rc;
3148         }
3149
3150         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
3151 }
3152
3153 static int selinux_file_lock(struct file *file, unsigned int cmd)
3154 {
3155         const struct cred *cred = current_cred();
3156
3157         return file_has_perm(cred, file, FILE__LOCK);
3158 }
3159
3160 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
3161                               unsigned long arg)
3162 {
3163         const struct cred *cred = current_cred();
3164         int err = 0;
3165
3166         switch (cmd) {
3167         case F_SETFL:
3168                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3169                         err = -EINVAL;
3170                         break;
3171                 }
3172
3173                 if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
3174                         err = file_has_perm(cred, file, FILE__WRITE);
3175                         break;
3176                 }
3177                 /* fall through */
3178         case F_SETOWN:
3179         case F_SETSIG:
3180         case F_GETFL:
3181         case F_GETOWN:
3182         case F_GETSIG:
3183                 /* Just check FD__USE permission */
3184                 err = file_has_perm(cred, file, 0);
3185                 break;
3186         case F_GETLK:
3187         case F_SETLK:
3188         case F_SETLKW:
3189 #if BITS_PER_LONG == 32
3190         case F_GETLK64:
3191         case F_SETLK64:
3192         case F_SETLKW64:
3193 #endif
3194                 if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
3195                         err = -EINVAL;
3196                         break;
3197                 }
3198                 err = file_has_perm(cred, file, FILE__LOCK);
3199                 break;
3200         }
3201
3202         return err;
3203 }
3204
3205 static int selinux_file_set_fowner(struct file *file)
3206 {
3207         struct file_security_struct *fsec;
3208
3209         fsec = file->f_security;
3210         fsec->fown_sid = current_sid();
3211
3212         return 0;
3213 }
3214
3215 static int selinux_file_send_sigiotask(struct task_struct *tsk,
3216                                        struct fown_struct *fown, int signum)
3217 {
3218         struct file *file;
3219         u32 sid = task_sid(tsk);
3220         u32 perm;
3221         struct file_security_struct *fsec;
3222
3223         /* struct fown_struct is never outside the context of a struct file */
3224         file = container_of(fown, struct file, f_owner);
3225
3226         fsec = file->f_security;
3227
3228         if (!signum)
3229                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
3230         else
3231                 perm = signal_to_av(signum);
3232
3233         return avc_has_perm(fsec->fown_sid, sid,
3234                             SECCLASS_PROCESS, perm, NULL);
3235 }
3236
3237 static int selinux_file_receive(struct file *file)
3238 {
3239         const struct cred *cred = current_cred();
3240
3241         return file_has_perm(cred, file, file_to_av(file));
3242 }
3243
3244 static int selinux_file_open(struct file *file, const struct cred *cred)
3245 {
3246         struct file_security_struct *fsec;
3247         struct inode_security_struct *isec;
3248
3249         fsec = file->f_security;
3250         isec = file->f_path.dentry->d_inode->i_security;
3251         /*
3252          * Save inode label and policy sequence number
3253          * at open-time so that selinux_file_permission
3254          * can determine whether revalidation is necessary.
3255          * Task label is already saved in the file security
3256          * struct as its SID.
3257          */
3258         fsec->isid = isec->sid;
3259         fsec->pseqno = avc_policy_seqno();
3260         /*
3261          * Since the inode label or policy seqno may have changed
3262          * between the selinux_inode_permission check and the saving
3263          * of state above, recheck that access is still permitted.
3264          * Otherwise, access might never be revalidated against the
3265          * new inode label or new policy.
3266          * This check is not redundant - do not remove.
3267          */
3268         return path_has_perm(cred, &file->f_path, open_file_to_av(file));
3269 }
3270
3271 /* task security operations */
3272
3273 static int selinux_task_create(unsigned long clone_flags)
3274 {
3275         return current_has_perm(current, PROCESS__FORK);
3276 }
3277
3278 /*
3279  * allocate the SELinux part of blank credentials
3280  */
3281 static int selinux_cred_alloc_blank(struct cred *cred, gfp_t gfp)
3282 {
3283         struct task_security_struct *tsec;
3284
3285         tsec = kzalloc(sizeof(struct task_security_struct), gfp);
3286         if (!tsec)
3287                 return -ENOMEM;
3288
3289         cred->security = tsec;
3290         return 0;
3291 }
3292
3293 /*
3294  * detach and free the LSM part of a set of credentials
3295  */
3296 static void selinux_cred_free(struct cred *cred)
3297 {
3298         struct task_security_struct *tsec = cred->security;
3299
3300         /*
3301          * cred->security == NULL if security_cred_alloc_blank() or
3302          * security_prepare_creds() returned an error.
3303          */
3304         BUG_ON(cred->security && (unsigned long) cred->security < PAGE_SIZE);
3305         cred->security = (void *) 0x7UL;
3306         kfree(tsec);
3307 }
3308
3309 /*
3310  * prepare a new set of credentials for modification
3311  */
3312 static int selinux_cred_prepare(struct cred *new, const struct cred *old,
3313                                 gfp_t gfp)
3314 {
3315         const struct task_security_struct *old_tsec;
3316         struct task_security_struct *tsec;
3317
3318         old_tsec = old->security;
3319
3320         tsec = kmemdup(old_tsec, sizeof(struct task_security_struct), gfp);
3321         if (!tsec)
3322                 return -ENOMEM;
3323
3324         new->security = tsec;
3325         return 0;
3326 }
3327
3328 /*
3329  * transfer the SELinux data to a blank set of creds
3330  */
3331 static void selinux_cred_transfer(struct cred *new, const struct cred *old)
3332 {
3333         const struct task_security_struct *old_tsec = old->security;
3334         struct task_security_struct *tsec = new->security;
3335
3336         *tsec = *old_tsec;
3337 }
3338
3339 /*
3340  * set the security data for a kernel service
3341  * - all the creation contexts are set to unlabelled
3342  */
3343 static int selinux_kernel_act_as(struct cred *new, u32 secid)
3344 {
3345         struct task_security_struct *tsec = new->security;
3346         u32 sid = current_sid();
3347         int ret;
3348
3349         ret = avc_has_perm(sid, secid,
3350                            SECCLASS_KERNEL_SERVICE,
3351                            KERNEL_SERVICE__USE_AS_OVERRIDE,
3352                            NULL);
3353         if (ret == 0) {
3354                 tsec->sid = secid;
3355                 tsec->create_sid = 0;
3356                 tsec->keycreate_sid = 0;
3357                 tsec->sockcreate_sid = 0;
3358         }
3359         return ret;
3360 }
3361
3362 /*
3363  * set the file creation context in a security record to the same as the
3364  * objective context of the specified inode
3365  */
3366 static int selinux_kernel_create_files_as(struct cred *new, struct inode *inode)
3367 {
3368         struct inode_security_struct *isec = inode->i_security;
3369         struct task_security_struct *tsec = new->security;
3370         u32 sid = current_sid();
3371         int ret;
3372
3373         ret = avc_has_perm(sid, isec->sid,
3374                            SECCLASS_KERNEL_SERVICE,
3375                            KERNEL_SERVICE__CREATE_FILES_AS,
3376                            NULL);
3377
3378         if (ret == 0)
3379                 tsec->create_sid = isec->sid;
3380         return ret;
3381 }
3382
3383 static int selinux_kernel_module_request(char *kmod_name)
3384 {
3385         u32 sid;
3386         struct common_audit_data ad;
3387
3388         sid = task_sid(current);
3389
3390         ad.type = LSM_AUDIT_DATA_KMOD;
3391         ad.u.kmod_name = kmod_name;
3392
3393         return avc_has_perm(sid, SECINITSID_KERNEL, SECCLASS_SYSTEM,
3394                             SYSTEM__MODULE_REQUEST, &ad);
3395 }
3396
3397 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
3398 {
3399         return current_has_perm(p, PROCESS__SETPGID);
3400 }
3401
3402 static int selinux_task_getpgid(struct task_struct *p)
3403 {
3404         return current_has_perm(p, PROCESS__GETPGID);
3405 }
3406
3407 static int selinux_task_getsid(struct task_struct *p)
3408 {
3409         return current_has_perm(p, PROCESS__GETSESSION);
3410 }
3411
3412 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
3413 {
3414         *secid = task_sid(p);
3415 }
3416
3417 static int selinux_task_setnice(struct task_struct *p, int nice)
3418 {
3419         int rc;
3420
3421         rc = cap_task_setnice(p, nice);
3422         if (rc)
3423                 return rc;
3424
3425         return current_has_perm(p, PROCESS__SETSCHED);
3426 }
3427
3428 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
3429 {
3430         int rc;
3431
3432         rc = cap_task_setioprio(p, ioprio);
3433         if (rc)
3434                 return rc;
3435
3436         return current_has_perm(p, PROCESS__SETSCHED);
3437 }
3438
3439 static int selinux_task_getioprio(struct task_struct *p)
3440 {
3441         return current_has_perm(p, PROCESS__GETSCHED);
3442 }
3443
3444 static int selinux_task_setrlimit(struct task_struct *p, unsigned int resource,
3445                 struct rlimit *new_rlim)
3446 {
3447         struct rlimit *old_rlim = p->signal->rlim + resource;
3448
3449         /* Control the ability to change the hard limit (whether
3450            lowering or raising it), so that the hard limit can
3451            later be used as a safe reset point for the soft limit
3452            upon context transitions.  See selinux_bprm_committing_creds. */
3453         if (old_rlim->rlim_max != new_rlim->rlim_max)
3454                 return current_has_perm(p, PROCESS__SETRLIMIT);
3455
3456         return 0;
3457 }
3458
3459 static int selinux_task_setscheduler(struct task_struct *p)
3460 {
3461         int rc;
3462
3463         rc = cap_task_setscheduler(p);
3464         if (rc)
3465                 return rc;
3466
3467         return current_has_perm(p, PROCESS__SETSCHED);
3468 }
3469
3470 static int selinux_task_getscheduler(struct task_struct *p)
3471 {
3472         return current_has_perm(p, PROCESS__GETSCHED);
3473 }
3474
3475 static int selinux_task_movememory(struct task_struct *p)
3476 {
3477         return current_has_perm(p, PROCESS__SETSCHED);
3478 }
3479
3480 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
3481                                 int sig, u32 secid)
3482 {
3483         u32 perm;
3484         int rc;
3485
3486         if (!sig)
3487                 perm = PROCESS__SIGNULL; /* null signal; existence test */
3488         else
3489                 perm = signal_to_av(sig);
3490         if (secid)
3491                 rc = avc_has_perm(secid, task_sid(p),
3492                                   SECCLASS_PROCESS, perm, NULL);
3493         else
3494                 rc = current_has_perm(p, perm);
3495         return rc;
3496 }
3497
3498 static int selinux_task_wait(struct task_struct *p)
3499 {
3500         return task_has_perm(p, current, PROCESS__SIGCHLD);
3501 }
3502
3503 static void selinux_task_to_inode(struct task_struct *p,
3504                                   struct inode *inode)
3505 {
3506         struct inode_security_struct *isec = inode->i_security;
3507         u32 sid = task_sid(p);
3508
3509         isec->sid = sid;
3510         isec->initialized = 1;
3511 }
3512
3513 /* Returns error only if unable to parse addresses */
3514 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
3515                         struct common_audit_data *ad, u8 *proto)
3516 {
3517         int offset, ihlen, ret = -EINVAL;
3518         struct iphdr _iph, *ih;
3519
3520         offset = skb_network_offset(skb);
3521         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
3522         if (ih == NULL)
3523                 goto out;
3524
3525         ihlen = ih->ihl * 4;
3526         if (ihlen < sizeof(_iph))
3527                 goto out;
3528
3529         ad->u.net->v4info.saddr = ih->saddr;
3530         ad->u.net->v4info.daddr = ih->daddr;
3531         ret = 0;
3532
3533         if (proto)
3534                 *proto = ih->protocol;
3535
3536         switch (ih->protocol) {
3537         case IPPROTO_TCP: {
3538                 struct tcphdr _tcph, *th;
3539
3540                 if (ntohs(ih->frag_off) & IP_OFFSET)
3541                         break;
3542
3543                 offset += ihlen;
3544                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3545                 if (th == NULL)
3546                         break;
3547
3548                 ad->u.net->sport = th->source;
3549                 ad->u.net->dport = th->dest;
3550                 break;
3551         }
3552
3553         case IPPROTO_UDP: {
3554                 struct udphdr _udph, *uh;
3555
3556                 if (ntohs(ih->frag_off) & IP_OFFSET)
3557                         break;
3558
3559                 offset += ihlen;
3560                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3561                 if (uh == NULL)
3562                         break;
3563
3564                 ad->u.net->sport = uh->source;
3565                 ad->u.net->dport = uh->dest;
3566                 break;
3567         }
3568
3569         case IPPROTO_DCCP: {
3570                 struct dccp_hdr _dccph, *dh;
3571
3572                 if (ntohs(ih->frag_off) & IP_OFFSET)
3573                         break;
3574
3575                 offset += ihlen;
3576                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3577                 if (dh == NULL)
3578                         break;
3579
3580                 ad->u.net->sport = dh->dccph_sport;
3581                 ad->u.net->dport = dh->dccph_dport;
3582                 break;
3583         }
3584
3585         default:
3586                 break;
3587         }
3588 out:
3589         return ret;
3590 }
3591
3592 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3593
3594 /* Returns error only if unable to parse addresses */
3595 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3596                         struct common_audit_data *ad, u8 *proto)
3597 {
3598         u8 nexthdr;
3599         int ret = -EINVAL, offset;
3600         struct ipv6hdr _ipv6h, *ip6;
3601         __be16 frag_off;
3602
3603         offset = skb_network_offset(skb);
3604         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3605         if (ip6 == NULL)
3606                 goto out;
3607
3608         ad->u.net->v6info.saddr = ip6->saddr;
3609         ad->u.net->v6info.daddr = ip6->daddr;
3610         ret = 0;
3611
3612         nexthdr = ip6->nexthdr;
3613         offset += sizeof(_ipv6h);
3614         offset = ipv6_skip_exthdr(skb, offset, &nexthdr, &frag_off);
3615         if (offset < 0)
3616                 goto out;
3617
3618         if (proto)
3619                 *proto = nexthdr;
3620
3621         switch (nexthdr) {
3622         case IPPROTO_TCP: {
3623                 struct tcphdr _tcph, *th;
3624
3625                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3626                 if (th == NULL)
3627                         break;
3628
3629                 ad->u.net->sport = th->source;
3630                 ad->u.net->dport = th->dest;
3631                 break;
3632         }
3633
3634         case IPPROTO_UDP: {
3635                 struct udphdr _udph, *uh;
3636
3637                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3638                 if (uh == NULL)
3639                         break;
3640
3641                 ad->u.net->sport = uh->source;
3642                 ad->u.net->dport = uh->dest;
3643                 break;
3644         }
3645
3646         case IPPROTO_DCCP: {
3647                 struct dccp_hdr _dccph, *dh;
3648
3649                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3650                 if (dh == NULL)
3651                         break;
3652
3653                 ad->u.net->sport = dh->dccph_sport;
3654                 ad->u.net->dport = dh->dccph_dport;
3655                 break;
3656         }
3657
3658         /* includes fragments */
3659         default:
3660                 break;
3661         }
3662 out:
3663         return ret;
3664 }
3665
3666 #endif /* IPV6 */
3667
3668 static int selinux_parse_skb(struct sk_buff *skb, struct common_audit_data *ad,
3669                              char **_addrp, int src, u8 *proto)
3670 {
3671         char *addrp;
3672         int ret;
3673
3674         switch (ad->u.net->family) {
3675         case PF_INET:
3676                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3677                 if (ret)
3678                         goto parse_error;
3679                 addrp = (char *)(src ? &ad->u.net->v4info.saddr :
3680                                        &ad->u.net->v4info.daddr);
3681                 goto okay;
3682
3683 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3684         case PF_INET6:
3685                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3686                 if (ret)
3687                         goto parse_error;
3688                 addrp = (char *)(src ? &ad->u.net->v6info.saddr :
3689                                        &ad->u.net->v6info.daddr);
3690                 goto okay;
3691 #endif  /* IPV6 */
3692         default:
3693                 addrp = NULL;
3694                 goto okay;
3695         }
3696
3697 parse_error:
3698         printk(KERN_WARNING
3699                "SELinux: failure in selinux_parse_skb(),"
3700                " unable to parse packet\n");
3701         return ret;
3702
3703 okay:
3704         if (_addrp)
3705                 *_addrp = addrp;
3706         return 0;
3707 }
3708
3709 /**
3710  * selinux_skb_peerlbl_sid - Determine the peer label of a packet
3711  * @skb: the packet
3712  * @family: protocol family
3713  * @sid: the packet's peer label SID
3714  *
3715  * Description:
3716  * Check the various different forms of network peer labeling and determine
3717  * the peer label/SID for the packet; most of the magic actually occurs in
3718  * the security server function security_net_peersid_cmp().  The function
3719  * returns zero if the value in @sid is valid (although it may be SECSID_NULL)
3720  * or -EACCES if @sid is invalid due to inconsistencies with the different
3721  * peer labels.
3722  *
3723  */
3724 static int selinux_skb_peerlbl_sid(struct sk_buff *skb, u16 family, u32 *sid)
3725 {
3726         int err;
3727         u32 xfrm_sid;
3728         u32 nlbl_sid;
3729         u32 nlbl_type;
3730
3731         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3732         selinux_netlbl_skbuff_getsid(skb, family, &nlbl_type, &nlbl_sid);
3733
3734         err = security_net_peersid_resolve(nlbl_sid, nlbl_type, xfrm_sid, sid);
3735         if (unlikely(err)) {
3736                 printk(KERN_WARNING
3737                        "SELinux: failure in selinux_skb_peerlbl_sid(),"
3738                        " unable to determine packet's peer label\n");
3739                 return -EACCES;
3740         }
3741
3742         return 0;
3743 }
3744
3745 /* socket security operations */
3746
3747 static int socket_sockcreate_sid(const struct task_security_struct *tsec,
3748                                  u16 secclass, u32 *socksid)
3749 {
3750         if (tsec->sockcreate_sid > SECSID_NULL) {
3751                 *socksid = tsec->sockcreate_sid;
3752                 return 0;
3753         }
3754
3755         return security_transition_sid(tsec->sid, tsec->sid, secclass, NULL,
3756                                        socksid);
3757 }
3758
3759 static int sock_has_perm(struct task_struct *task, struct sock *sk, u32 perms)
3760 {
3761         struct sk_security_struct *sksec = sk->sk_security;
3762         struct common_audit_data ad;
3763         struct lsm_network_audit net = {0,};
3764         u32 tsid = task_sid(task);
3765
3766         if (sksec->sid == SECINITSID_KERNEL)
3767                 return 0;
3768
3769         ad.type = LSM_AUDIT_DATA_NET;
3770         ad.u.net = &net;
3771         ad.u.net->sk = sk;
3772
3773         return avc_has_perm(tsid, sksec->sid, sksec->sclass, perms, &ad);
3774 }
3775
3776 static int selinux_socket_create(int family, int type,
3777                                  int protocol, int kern)
3778 {
3779         const struct task_security_struct *tsec = current_security();
3780         u32 newsid;
3781         u16 secclass;
3782         int rc;
3783
3784         if (kern)
3785                 return 0;
3786
3787         secclass = socket_type_to_security_class(family, type, protocol);
3788         rc = socket_sockcreate_sid(tsec, secclass, &newsid);
3789         if (rc)
3790                 return rc;
3791
3792         return avc_has_perm(tsec->sid, newsid, secclass, SOCKET__CREATE, NULL);
3793 }
3794
3795 static int selinux_socket_post_create(struct socket *sock, int family,
3796                                       int type, int protocol, int kern)
3797 {
3798         const struct task_security_struct *tsec = current_security();
3799         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3800         struct sk_security_struct *sksec;
3801         int err = 0;
3802
3803         isec->sclass = socket_type_to_security_class(family, type, protocol);
3804
3805         if (kern)
3806                 isec->sid = SECINITSID_KERNEL;
3807         else {
3808                 err = socket_sockcreate_sid(tsec, isec->sclass, &(isec->sid));
3809                 if (err)
3810                         return err;
3811         }
3812
3813         isec->initialized = 1;
3814
3815         if (sock->sk) {
3816                 sksec = sock->sk->sk_security;
3817                 sksec->sid = isec->sid;
3818                 sksec->sclass = isec->sclass;
3819                 err = selinux_netlbl_socket_post_create(sock->sk, family);
3820         }
3821
3822         return err;
3823 }
3824
3825 /* Range of port numbers used to automatically bind.
3826    Need to determine whether we should perform a name_bind
3827    permission check between the socket and the port number. */
3828
3829 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3830 {
3831         struct sock *sk = sock->sk;
3832         u16 family;
3833         int err;
3834
3835         err = sock_has_perm(current, sk, SOCKET__BIND);
3836         if (err)
3837                 goto out;
3838
3839         /*
3840          * If PF_INET or PF_INET6, check name_bind permission for the port.
3841          * Multiple address binding for SCTP is not supported yet: we just
3842          * check the first address now.
3843          */
3844         family = sk->sk_family;
3845         if (family == PF_INET || family == PF_INET6) {
3846                 char *addrp;
3847                 struct sk_security_struct *sksec = sk->sk_security;
3848                 struct common_audit_data ad;
3849                 struct lsm_network_audit net = {0,};
3850                 struct sockaddr_in *addr4 = NULL;
3851                 struct sockaddr_in6 *addr6 = NULL;
3852                 unsigned short snum;
3853                 u32 sid, node_perm;
3854
3855                 if (family == PF_INET) {
3856                         addr4 = (struct sockaddr_in *)address;
3857                         snum = ntohs(addr4->sin_port);
3858                         addrp = (char *)&addr4->sin_addr.s_addr;
3859                 } else {
3860                         addr6 = (struct sockaddr_in6 *)address;
3861                         snum = ntohs(addr6->sin6_port);
3862                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3863                 }
3864
3865                 if (snum) {
3866                         int low, high;
3867
3868                         inet_get_local_port_range(&low, &high);
3869
3870                         if (snum < max(PROT_SOCK, low) || snum > high) {
3871                                 err = sel_netport_sid(sk->sk_protocol,
3872                                                       snum, &sid);
3873                                 if (err)
3874                                         goto out;
3875                                 ad.type = LSM_AUDIT_DATA_NET;
3876                                 ad.u.net = &net;
3877                                 ad.u.net->sport = htons(snum);
3878                                 ad.u.net->family = family;
3879                                 err = avc_has_perm(sksec->sid, sid,
3880                                                    sksec->sclass,
3881                                                    SOCKET__NAME_BIND, &ad);
3882                                 if (err)
3883                                         goto out;
3884                         }
3885                 }
3886
3887                 switch (sksec->sclass) {
3888                 case SECCLASS_TCP_SOCKET:
3889                         node_perm = TCP_SOCKET__NODE_BIND;
3890                         break;
3891
3892                 case SECCLASS_UDP_SOCKET:
3893                         node_perm = UDP_SOCKET__NODE_BIND;
3894                         break;
3895
3896                 case SECCLASS_DCCP_SOCKET:
3897                         node_perm = DCCP_SOCKET__NODE_BIND;
3898                         break;
3899
3900                 default:
3901                         node_perm = RAWIP_SOCKET__NODE_BIND;
3902                         break;
3903                 }
3904
3905                 err = sel_netnode_sid(addrp, family, &sid);
3906                 if (err)
3907                         goto out;
3908
3909                 ad.type = LSM_AUDIT_DATA_NET;
3910                 ad.u.net = &net;
3911                 ad.u.net->sport = htons(snum);
3912                 ad.u.net->family = family;
3913
3914                 if (family == PF_INET)
3915                         ad.u.net->v4info.saddr = addr4->sin_addr.s_addr;
3916                 else
3917                         ad.u.net->v6info.saddr = addr6->sin6_addr;
3918
3919                 err = avc_has_perm(sksec->sid, sid,
3920                                    sksec->sclass, node_perm, &ad);
3921                 if (err)
3922                         goto out;
3923         }
3924 out:
3925         return err;
3926 }
3927
3928 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3929 {
3930         struct sock *sk = sock->sk;
3931         struct sk_security_struct *sksec = sk->sk_security;
3932         int err;
3933
3934         err = sock_has_perm(current, sk, SOCKET__CONNECT);
3935         if (err)
3936                 return err;
3937
3938         /*
3939          * If a TCP or DCCP socket, check name_connect permission for the port.
3940          */
3941         if (sksec->sclass == SECCLASS_TCP_SOCKET ||
3942             sksec->sclass == SECCLASS_DCCP_SOCKET) {
3943                 struct common_audit_data ad;
3944                 struct lsm_network_audit net = {0,};
3945                 struct sockaddr_in *addr4 = NULL;
3946                 struct sockaddr_in6 *addr6 = NULL;
3947                 unsigned short snum;
3948                 u32 sid, perm;
3949
3950                 if (sk->sk_family == PF_INET) {
3951                         addr4 = (struct sockaddr_in *)address;
3952                         if (addrlen < sizeof(struct sockaddr_in))
3953                                 return -EINVAL;
3954                         snum = ntohs(addr4->sin_port);
3955                 } else {
3956                         addr6 = (struct sockaddr_in6 *)address;
3957                         if (addrlen < SIN6_LEN_RFC2133)
3958                                 return -EINVAL;
3959                         snum = ntohs(addr6->sin6_port);
3960                 }
3961
3962                 err = sel_netport_sid(sk->sk_protocol, snum, &sid);
3963                 if (err)
3964                         goto out;
3965
3966                 perm = (sksec->sclass == SECCLASS_TCP_SOCKET) ?
3967                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3968
3969                 ad.type = LSM_AUDIT_DATA_NET;
3970                 ad.u.net = &net;
3971                 ad.u.net->dport = htons(snum);
3972                 ad.u.net->family = sk->sk_family;
3973                 err = avc_has_perm(sksec->sid, sid, sksec->sclass, perm, &ad);
3974                 if (err)
3975                         goto out;
3976         }
3977
3978         err = selinux_netlbl_socket_connect(sk, address);
3979
3980 out:
3981         return err;
3982 }
3983
3984 static int selinux_socket_listen(struct socket *sock, int backlog)
3985 {
3986         return sock_has_perm(current, sock->sk, SOCKET__LISTEN);
3987 }
3988
3989 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3990 {
3991         int err;
3992         struct inode_security_struct *isec;
3993         struct inode_security_struct *newisec;
3994
3995         err = sock_has_perm(current, sock->sk, SOCKET__ACCEPT);
3996         if (err)
3997                 return err;
3998
3999         newisec = SOCK_INODE(newsock)->i_security;
4000
4001         isec = SOCK_INODE(sock)->i_security;
4002         newisec->sclass = isec->sclass;
4003         newisec->sid = isec->sid;
4004         newisec->initialized = 1;
4005
4006         return 0;
4007 }
4008
4009 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
4010                                   int size)
4011 {
4012         return sock_has_perm(current, sock->sk, SOCKET__WRITE);
4013 }
4014
4015 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
4016                                   int size, int flags)
4017 {
4018         return sock_has_perm(current, sock->sk, SOCKET__READ);
4019 }
4020
4021 static int selinux_socket_getsockname(struct socket *sock)
4022 {
4023         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4024 }
4025
4026 static int selinux_socket_getpeername(struct socket *sock)
4027 {
4028         return sock_has_perm(current, sock->sk, SOCKET__GETATTR);
4029 }
4030
4031 static int selinux_socket_setsockopt(struct socket *sock, int level, int optname)
4032 {
4033         int err;
4034
4035         err = sock_has_perm(current, sock->sk, SOCKET__SETOPT);
4036         if (err)
4037                 return err;
4038
4039         return selinux_netlbl_socket_setsockopt(sock, level, optname);
4040 }
4041
4042 static int selinux_socket_getsockopt(struct socket *sock, int level,
4043                                      int optname)
4044 {
4045         return sock_has_perm(current, sock->sk, SOCKET__GETOPT);
4046 }
4047
4048 static int selinux_socket_shutdown(struct socket *sock, int how)
4049 {
4050         return sock_has_perm(current, sock->sk, SOCKET__SHUTDOWN);
4051 }
4052
4053 static int selinux_socket_unix_stream_connect(struct sock *sock,
4054                                               struct sock *other,
4055                                               struct sock *newsk)
4056 {
4057         struct sk_security_struct *sksec_sock = sock->sk_security;
4058         struct sk_security_struct *sksec_other = other->sk_security;
4059         struct sk_security_struct *sksec_new = newsk->sk_security;
4060         struct common_audit_data ad;
4061         struct lsm_network_audit net = {0,};
4062         int err;
4063
4064         ad.type = LSM_AUDIT_DATA_NET;
4065         ad.u.net = &net;
4066         ad.u.net->sk = other;
4067
4068         err = avc_has_perm(sksec_sock->sid, sksec_other->sid,
4069                            sksec_other->sclass,
4070                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
4071         if (err)
4072                 return err;
4073
4074         /* server child socket */
4075         sksec_new->peer_sid = sksec_sock->sid;
4076         err = security_sid_mls_copy(sksec_other->sid, sksec_sock->sid,
4077                                     &sksec_new->sid);
4078         if (err)
4079                 return err;
4080
4081         /* connecting socket */
4082         sksec_sock->peer_sid = sksec_new->sid;
4083
4084         return 0;
4085 }
4086
4087 static int selinux_socket_unix_may_send(struct socket *sock,
4088                                         struct socket *other)
4089 {
4090         struct sk_security_struct *ssec = sock->sk->sk_security;
4091         struct sk_security_struct *osec = other->sk->sk_security;
4092         struct common_audit_data ad;
4093         struct lsm_network_audit net = {0,};
4094
4095         ad.type = LSM_AUDIT_DATA_NET;
4096         ad.u.net = &net;
4097         ad.u.net->sk = other->sk;
4098
4099         return avc_has_perm(ssec->sid, osec->sid, osec->sclass, SOCKET__SENDTO,
4100                             &ad);
4101 }
4102
4103 static int selinux_inet_sys_rcv_skb(int ifindex, char *addrp, u16 family,
4104                                     u32 peer_sid,
4105                                     struct common_audit_data *ad)
4106 {
4107         int err;
4108         u32 if_sid;
4109         u32 node_sid;
4110
4111         err = sel_netif_sid(ifindex, &if_sid);
4112         if (err)
4113                 return err;
4114         err = avc_has_perm(peer_sid, if_sid,
4115                            SECCLASS_NETIF, NETIF__INGRESS, ad);
4116         if (err)
4117                 return err;
4118
4119         err = sel_netnode_sid(addrp, family, &node_sid);
4120         if (err)
4121                 return err;
4122         return avc_has_perm(peer_sid, node_sid,
4123                             SECCLASS_NODE, NODE__RECVFROM, ad);
4124 }
4125
4126 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
4127                                        u16 family)
4128 {
4129         int err = 0;
4130         struct sk_security_struct *sksec = sk->sk_security;
4131         u32 sk_sid = sksec->sid;
4132         struct common_audit_data ad;
4133         struct lsm_network_audit net = {0,};
4134         char *addrp;
4135
4136         ad.type = LSM_AUDIT_DATA_NET;
4137         ad.u.net = &net;
4138         ad.u.net->netif = skb->skb_iif;
4139         ad.u.net->family = family;
4140         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4141         if (err)
4142                 return err;
4143
4144         if (selinux_secmark_enabled()) {
4145                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4146                                    PACKET__RECV, &ad);
4147                 if (err)
4148                         return err;
4149         }
4150
4151         err = selinux_netlbl_sock_rcv_skb(sksec, skb, family, &ad);
4152         if (err)
4153                 return err;
4154         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
4155
4156         return err;
4157 }
4158
4159 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
4160 {
4161         int err;
4162         struct sk_security_struct *sksec = sk->sk_security;
4163         u16 family = sk->sk_family;
4164         u32 sk_sid = sksec->sid;
4165         struct common_audit_data ad;
4166         struct lsm_network_audit net = {0,};
4167         char *addrp;
4168         u8 secmark_active;
4169         u8 peerlbl_active;
4170
4171         if (family != PF_INET && family != PF_INET6)
4172                 return 0;
4173
4174         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
4175         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4176                 family = PF_INET;
4177
4178         /* If any sort of compatibility mode is enabled then handoff processing
4179          * to the selinux_sock_rcv_skb_compat() function to deal with the
4180          * special handling.  We do this in an attempt to keep this function
4181          * as fast and as clean as possible. */
4182         if (!selinux_policycap_netpeer)
4183                 return selinux_sock_rcv_skb_compat(sk, skb, family);
4184
4185         secmark_active = selinux_secmark_enabled();
4186         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4187         if (!secmark_active && !peerlbl_active)
4188                 return 0;
4189
4190         ad.type = LSM_AUDIT_DATA_NET;
4191         ad.u.net = &net;
4192         ad.u.net->netif = skb->skb_iif;
4193         ad.u.net->family = family;
4194         err = selinux_parse_skb(skb, &ad, &addrp, 1, NULL);
4195         if (err)
4196                 return err;
4197
4198         if (peerlbl_active) {
4199                 u32 peer_sid;
4200
4201                 err = selinux_skb_peerlbl_sid(skb, family, &peer_sid);
4202                 if (err)
4203                         return err;
4204                 err = selinux_inet_sys_rcv_skb(skb->skb_iif, addrp, family,
4205                                                peer_sid, &ad);
4206                 if (err) {
4207                         selinux_netlbl_err(skb, err, 0);
4208                         return err;
4209                 }
4210                 err = avc_has_perm(sk_sid, peer_sid, SECCLASS_PEER,
4211                                    PEER__RECV, &ad);
4212                 if (err)
4213                         selinux_netlbl_err(skb, err, 0);
4214         }
4215
4216         if (secmark_active) {
4217                 err = avc_has_perm(sk_sid, skb->secmark, SECCLASS_PACKET,
4218                                    PACKET__RECV, &ad);
4219                 if (err)
4220                         return err;
4221         }
4222
4223         return err;
4224 }
4225
4226 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
4227                                             int __user *optlen, unsigned len)
4228 {
4229         int err = 0;
4230         char *scontext;
4231         u32 scontext_len;
4232         struct sk_security_struct *sksec = sock->sk->sk_security;
4233         u32 peer_sid = SECSID_NULL;
4234
4235         if (sksec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
4236             sksec->sclass == SECCLASS_TCP_SOCKET)
4237                 peer_sid = sksec->peer_sid;
4238         if (peer_sid == SECSID_NULL)
4239                 return -ENOPROTOOPT;
4240
4241         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
4242         if (err)
4243                 return err;
4244
4245         if (scontext_len > len) {
4246                 err = -ERANGE;
4247                 goto out_len;
4248         }
4249
4250         if (copy_to_user(optval, scontext, scontext_len))
4251                 err = -EFAULT;
4252
4253 out_len:
4254         if (put_user(scontext_len, optlen))
4255                 err = -EFAULT;
4256         kfree(scontext);
4257         return err;
4258 }
4259
4260 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
4261 {
4262         u32 peer_secid = SECSID_NULL;
4263         u16 family;
4264
4265         if (skb && skb->protocol == htons(ETH_P_IP))
4266                 family = PF_INET;
4267         else if (skb && skb->protocol == htons(ETH_P_IPV6))
4268                 family = PF_INET6;
4269         else if (sock)
4270                 family = sock->sk->sk_family;
4271         else
4272                 goto out;
4273
4274         if (sock && family == PF_UNIX)
4275                 selinux_inode_getsecid(SOCK_INODE(sock), &peer_secid);
4276         else if (skb)
4277                 selinux_skb_peerlbl_sid(skb, family, &peer_secid);
4278
4279 out:
4280         *secid = peer_secid;
4281         if (peer_secid == SECSID_NULL)
4282                 return -EINVAL;
4283         return 0;
4284 }
4285
4286 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
4287 {
4288         struct sk_security_struct *sksec;
4289
4290         sksec = kzalloc(sizeof(*sksec), priority);
4291         if (!sksec)
4292                 return -ENOMEM;
4293
4294         sksec->peer_sid = SECINITSID_UNLABELED;
4295         sksec->sid = SECINITSID_UNLABELED;
4296         selinux_netlbl_sk_security_reset(sksec);
4297         sk->sk_security = sksec;
4298
4299         return 0;
4300 }
4301
4302 static void selinux_sk_free_security(struct sock *sk)
4303 {
4304         struct sk_security_struct *sksec = sk->sk_security;
4305
4306         sk->sk_security = NULL;
4307         selinux_netlbl_sk_security_free(sksec);
4308         kfree(sksec);
4309 }
4310
4311 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
4312 {
4313         struct sk_security_struct *sksec = sk->sk_security;
4314         struct sk_security_struct *newsksec = newsk->sk_security;
4315
4316         newsksec->sid = sksec->sid;
4317         newsksec->peer_sid = sksec->peer_sid;
4318         newsksec->sclass = sksec->sclass;
4319
4320         selinux_netlbl_sk_security_reset(newsksec);
4321 }
4322
4323 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
4324 {
4325         if (!sk)
4326                 *secid = SECINITSID_ANY_SOCKET;
4327         else {
4328                 struct sk_security_struct *sksec = sk->sk_security;
4329
4330                 *secid = sksec->sid;
4331         }
4332 }
4333
4334 static void selinux_sock_graft(struct sock *sk, struct socket *parent)
4335 {
4336         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
4337         struct sk_security_struct *sksec = sk->sk_security;
4338
4339         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
4340             sk->sk_family == PF_UNIX)
4341                 isec->sid = sksec->sid;
4342         sksec->sclass = isec->sclass;
4343 }
4344
4345 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
4346                                      struct request_sock *req)
4347 {
4348         struct sk_security_struct *sksec = sk->sk_security;
4349         int err;
4350         u16 family = sk->sk_family;
4351         u32 newsid;
4352         u32 peersid;
4353
4354         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4355         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4356                 family = PF_INET;
4357
4358         err = selinux_skb_peerlbl_sid(skb, family, &peersid);
4359         if (err)
4360                 return err;
4361         if (peersid == SECSID_NULL) {
4362                 req->secid = sksec->sid;
4363                 req->peer_secid = SECSID_NULL;
4364         } else {
4365                 err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
4366                 if (err)
4367                         return err;
4368                 req->secid = newsid;
4369                 req->peer_secid = peersid;
4370         }
4371
4372         return selinux_netlbl_inet_conn_request(req, family);
4373 }
4374
4375 static void selinux_inet_csk_clone(struct sock *newsk,
4376                                    const struct request_sock *req)
4377 {
4378         struct sk_security_struct *newsksec = newsk->sk_security;
4379
4380         newsksec->sid = req->secid;
4381         newsksec->peer_sid = req->peer_secid;
4382         /* NOTE: Ideally, we should also get the isec->sid for the
4383            new socket in sync, but we don't have the isec available yet.
4384            So we will wait until sock_graft to do it, by which
4385            time it will have been created and available. */
4386
4387         /* We don't need to take any sort of lock here as we are the only
4388          * thread with access to newsksec */
4389         selinux_netlbl_inet_csk_clone(newsk, req->rsk_ops->family);
4390 }
4391
4392 static void selinux_inet_conn_established(struct sock *sk, struct sk_buff *skb)
4393 {
4394         u16 family = sk->sk_family;
4395         struct sk_security_struct *sksec = sk->sk_security;
4396
4397         /* handle mapped IPv4 packets arriving via IPv6 sockets */
4398         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
4399                 family = PF_INET;
4400
4401         selinux_skb_peerlbl_sid(skb, family, &sksec->peer_sid);
4402 }
4403
4404 static int selinux_secmark_relabel_packet(u32 sid)
4405 {
4406         const struct task_security_struct *__tsec;
4407         u32 tsid;
4408
4409         __tsec = current_security();
4410         tsid = __tsec->sid;
4411
4412         return avc_has_perm(tsid, sid, SECCLASS_PACKET, PACKET__RELABELTO, NULL);
4413 }
4414
4415 static void selinux_secmark_refcount_inc(void)
4416 {
4417         atomic_inc(&selinux_secmark_refcount);
4418 }
4419
4420 static void selinux_secmark_refcount_dec(void)
4421 {
4422         atomic_dec(&selinux_secmark_refcount);
4423 }
4424
4425 static void selinux_req_classify_flow(const struct request_sock *req,
4426                                       struct flowi *fl)
4427 {
4428         fl->flowi_secid = req->secid;
4429 }
4430
4431 static int selinux_tun_dev_create(void)
4432 {
4433         u32 sid = current_sid();
4434
4435         /* we aren't taking into account the "sockcreate" SID since the socket
4436          * that is being created here is not a socket in the traditional sense,
4437          * instead it is a private sock, accessible only to the kernel, and
4438          * representing a wide range of network traffic spanning multiple
4439          * connections unlike traditional sockets - check the TUN driver to
4440          * get a better understanding of why this socket is special */
4441
4442         return avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET, TUN_SOCKET__CREATE,
4443                             NULL);
4444 }
4445
4446 static void selinux_tun_dev_post_create(struct sock *sk)
4447 {
4448         struct sk_security_struct *sksec = sk->sk_security;
4449
4450         /* we don't currently perform any NetLabel based labeling here and it
4451          * isn't clear that we would want to do so anyway; while we could apply
4452          * labeling without the support of the TUN user the resulting labeled
4453          * traffic from the other end of the connection would almost certainly
4454          * cause confusion to the TUN user that had no idea network labeling
4455          * protocols were being used */
4456
4457         /* see the comments in selinux_tun_dev_create() about why we don't use
4458          * the sockcreate SID here */
4459
4460         sksec->sid = current_sid();
4461         sksec->sclass = SECCLASS_TUN_SOCKET;
4462 }
4463
4464 static int selinux_tun_dev_attach(struct sock *sk)
4465 {
4466         struct sk_security_struct *sksec = sk->sk_security;
4467         u32 sid = current_sid();
4468         int err;
4469
4470         err = avc_has_perm(sid, sksec->sid, SECCLASS_TUN_SOCKET,
4471                            TUN_SOCKET__RELABELFROM, NULL);
4472         if (err)
4473                 return err;
4474         err = avc_has_perm(sid, sid, SECCLASS_TUN_SOCKET,
4475                            TUN_SOCKET__RELABELTO, NULL);
4476         if (err)
4477                 return err;
4478
4479         sksec->sid = sid;
4480
4481         return 0;
4482 }
4483
4484 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
4485 {
4486         int err = 0;
4487         u32 perm;
4488         struct nlmsghdr *nlh;
4489         struct sk_security_struct *sksec = sk->sk_security;
4490
4491         if (skb->len < NLMSG_SPACE(0)) {
4492                 err = -EINVAL;
4493                 goto out;
4494         }
4495         nlh = nlmsg_hdr(skb);
4496
4497         err = selinux_nlmsg_lookup(sksec->sclass, nlh->nlmsg_type, &perm);
4498         if (err) {
4499                 if (err == -EINVAL) {
4500                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
4501                                   "SELinux:  unrecognized netlink message"
4502                                   " type=%hu for sclass=%hu\n",
4503                                   nlh->nlmsg_type, sksec->sclass);
4504                         if (!selinux_enforcing || security_get_allow_unknown())
4505                                 err = 0;
4506                 }
4507
4508                 /* Ignore */
4509                 if (err == -ENOENT)
4510                         err = 0;
4511                 goto out;
4512         }
4513
4514         err = sock_has_perm(current, sk, perm);
4515 out:
4516         return err;
4517 }
4518
4519 #ifdef CONFIG_NETFILTER
4520
4521 static unsigned int selinux_ip_forward(struct sk_buff *skb, int ifindex,
4522                                        u16 family)
4523 {
4524         int err;
4525         char *addrp;
4526         u32 peer_sid;
4527         struct common_audit_data ad;
4528         struct lsm_network_audit net = {0,};
4529         u8 secmark_active;
4530         u8 netlbl_active;
4531         u8 peerlbl_active;
4532
4533         if (!selinux_policycap_netpeer)
4534                 return NF_ACCEPT;
4535
4536         secmark_active = selinux_secmark_enabled();
4537         netlbl_active = netlbl_enabled();
4538         peerlbl_active = netlbl_active || selinux_xfrm_enabled();
4539         if (!secmark_active && !peerlbl_active)
4540                 return NF_ACCEPT;
4541
4542         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid) != 0)
4543                 return NF_DROP;
4544
4545         ad.type = LSM_AUDIT_DATA_NET;
4546         ad.u.net = &net;
4547         ad.u.net->netif = ifindex;
4548         ad.u.net->family = family;
4549         if (selinux_parse_skb(skb, &ad, &addrp, 1, NULL) != 0)
4550                 return NF_DROP;
4551
4552         if (peerlbl_active) {
4553                 err = selinux_inet_sys_rcv_skb(ifindex, addrp, family,
4554                                                peer_sid, &ad);
4555                 if (err) {
4556                         selinux_netlbl_err(skb, err, 1);
4557                         return NF_DROP;
4558                 }
4559         }
4560
4561         if (secmark_active)
4562                 if (avc_has_perm(peer_sid, skb->secmark,
4563                                  SECCLASS_PACKET, PACKET__FORWARD_IN, &ad))
4564                         return NF_DROP;
4565
4566         if (netlbl_active)
4567                 /* we do this in the FORWARD path and not the POST_ROUTING
4568                  * path because we want to make sure we apply the necessary
4569                  * labeling before IPsec is applied so we can leverage AH
4570                  * protection */
4571                 if (selinux_netlbl_skbuff_setsid(skb, family, peer_sid) != 0)
4572                         return NF_DROP;
4573
4574         return NF_ACCEPT;
4575 }
4576
4577 static unsigned int selinux_ipv4_forward(unsigned int hooknum,
4578                                          struct sk_buff *skb,
4579                                          const struct net_device *in,
4580                                          const struct net_device *out,
4581                                          int (*okfn)(struct sk_buff *))
4582 {
4583         return selinux_ip_forward(skb, in->ifindex, PF_INET);
4584 }
4585
4586 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4587 static unsigned int selinux_ipv6_forward(unsigned int hooknum,
4588                                          struct sk_buff *skb,
4589                                          const struct net_device *in,
4590                                          const struct net_device *out,
4591                                          int (*okfn)(struct sk_buff *))
4592 {
4593         return selinux_ip_forward(skb, in->ifindex, PF_INET6);
4594 }
4595 #endif  /* IPV6 */
4596
4597 static unsigned int selinux_ip_output(struct sk_buff *skb,
4598                                       u16 family)
4599 {
4600         u32 sid;
4601
4602         if (!netlbl_enabled())
4603                 return NF_ACCEPT;
4604
4605         /* we do this in the LOCAL_OUT path and not the POST_ROUTING path
4606          * because we want to make sure we apply the necessary labeling
4607          * before IPsec is applied so we can leverage AH protection */
4608         if (skb->sk) {
4609                 struct sk_security_struct *sksec = skb->sk->sk_security;
4610                 sid = sksec->sid;
4611         } else
4612                 sid = SECINITSID_KERNEL;
4613         if (selinux_netlbl_skbuff_setsid(skb, family, sid) != 0)
4614                 return NF_DROP;
4615
4616         return NF_ACCEPT;
4617 }
4618
4619 static unsigned int selinux_ipv4_output(unsigned int hooknum,
4620                                         struct sk_buff *skb,
4621                                         const struct net_device *in,
4622                                         const struct net_device *out,
4623                                         int (*okfn)(struct sk_buff *))
4624 {
4625         return selinux_ip_output(skb, PF_INET);
4626 }
4627
4628 static unsigned int selinux_ip_postroute_compat(struct sk_buff *skb,
4629                                                 int ifindex,
4630                                                 u16 family)
4631 {
4632         struct sock *sk = skb->sk;
4633         struct sk_security_struct *sksec;
4634         struct common_audit_data ad;
4635         struct lsm_network_audit net = {0,};
4636         char *addrp;
4637         u8 proto;
4638
4639         if (sk == NULL)
4640                 return NF_ACCEPT;
4641         sksec = sk->sk_security;
4642
4643         ad.type = LSM_AUDIT_DATA_NET;
4644         ad.u.net = &net;
4645         ad.u.net->netif = ifindex;
4646         ad.u.net->family = family;
4647         if (selinux_parse_skb(skb, &ad, &addrp, 0, &proto))
4648                 return NF_DROP;
4649
4650         if (selinux_secmark_enabled())
4651                 if (avc_has_perm(sksec->sid, skb->secmark,
4652                                  SECCLASS_PACKET, PACKET__SEND, &ad))
4653                         return NF_DROP_ERR(-ECONNREFUSED);
4654
4655         if (selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto))
4656                 return NF_DROP_ERR(-ECONNREFUSED);
4657
4658         return NF_ACCEPT;
4659 }
4660
4661 static unsigned int selinux_ip_postroute(struct sk_buff *skb, int ifindex,
4662                                          u16 family)
4663 {
4664         u32 secmark_perm;
4665         u32 peer_sid;
4666         struct sock *sk;
4667         struct common_audit_data ad;
4668         struct lsm_network_audit net = {0,};
4669         char *addrp;
4670         u8 secmark_active;
4671         u8 peerlbl_active;
4672
4673         /* If any sort of compatibility mode is enabled then handoff processing
4674          * to the selinux_ip_postroute_compat() function to deal with the
4675          * special handling.  We do this in an attempt to keep this function
4676          * as fast and as clean as possible. */
4677         if (!selinux_policycap_netpeer)
4678                 return selinux_ip_postroute_compat(skb, ifindex, family);
4679 #ifdef CONFIG_XFRM
4680         /* If skb->dst->xfrm is non-NULL then the packet is undergoing an IPsec
4681          * packet transformation so allow the packet to pass without any checks
4682          * since we'll have another chance to perform access control checks
4683          * when the packet is on it's final way out.
4684          * NOTE: there appear to be some IPv6 multicast cases where skb->dst
4685          *       is NULL, in this case go ahead and apply access control. */
4686         if (skb_dst(skb) != NULL && skb_dst(skb)->xfrm != NULL)
4687                 return NF_ACCEPT;
4688 #endif
4689         secmark_active = selinux_secmark_enabled();
4690         peerlbl_active = netlbl_enabled() || selinux_xfrm_enabled();
4691         if (!secmark_active && !peerlbl_active)
4692                 return NF_ACCEPT;
4693
4694         /* if the packet is being forwarded then get the peer label from the
4695          * packet itself; otherwise check to see if it is from a local
4696          * application or the kernel, if from an application get the peer label
4697          * from the sending socket, otherwise use the kernel's sid */
4698         sk = skb->sk;
4699         if (sk == NULL) {
4700                 if (skb->skb_iif) {
4701                         secmark_perm = PACKET__FORWARD_OUT;
4702                         if (selinux_skb_peerlbl_sid(skb, family, &peer_sid))
4703                                 return NF_DROP;
4704                 } else {
4705                         secmark_perm = PACKET__SEND;
4706                         peer_sid = SECINITSID_KERNEL;
4707                 }
4708         } else {
4709                 struct sk_security_struct *sksec = sk->sk_security;
4710                 peer_sid = sksec->sid;
4711                 secmark_perm = PACKET__SEND;
4712         }
4713
4714         ad.type = LSM_AUDIT_DATA_NET;
4715         ad.u.net = &net;
4716         ad.u.net->netif = ifindex;
4717         ad.u.net->family = family;
4718         if (selinux_parse_skb(skb, &ad, &addrp, 0, NULL))
4719                 return NF_DROP;
4720
4721         if (secmark_active)
4722                 if (avc_has_perm(peer_sid, skb->secmark,
4723                                  SECCLASS_PACKET, secmark_perm, &ad))
4724                         return NF_DROP_ERR(-ECONNREFUSED);
4725
4726         if (peerlbl_active) {
4727                 u32 if_sid;
4728                 u32 node_sid;
4729
4730                 if (sel_netif_sid(ifindex, &if_sid))
4731                         return NF_DROP;
4732                 if (avc_has_perm(peer_sid, if_sid,
4733                                  SECCLASS_NETIF, NETIF__EGRESS, &ad))
4734                         return NF_DROP_ERR(-ECONNREFUSED);
4735
4736                 if (sel_netnode_sid(addrp, family, &node_sid))
4737                         return NF_DROP;
4738                 if (avc_has_perm(peer_sid, node_sid,
4739                                  SECCLASS_NODE, NODE__SENDTO, &ad))
4740                         return NF_DROP_ERR(-ECONNREFUSED);
4741         }
4742
4743         return NF_ACCEPT;
4744 }
4745
4746 static unsigned int selinux_ipv4_postroute(unsigned int hooknum,
4747                                            struct sk_buff *skb,
4748                                            const struct net_device *in,
4749                                            const struct net_device *out,
4750                                            int (*okfn)(struct sk_buff *))
4751 {
4752         return selinux_ip_postroute(skb, out->ifindex, PF_INET);
4753 }
4754
4755 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4756 static unsigned int selinux_ipv6_postroute(unsigned int hooknum,
4757                                            struct sk_buff *skb,
4758                                            const struct net_device *in,
4759                                            const struct net_device *out,
4760                                            int (*okfn)(struct sk_buff *))
4761 {
4762         return selinux_ip_postroute(skb, out->ifindex, PF_INET6);
4763 }
4764 #endif  /* IPV6 */
4765
4766 #endif  /* CONFIG_NETFILTER */
4767
4768 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
4769 {
4770         int err;
4771
4772         err = cap_netlink_send(sk, skb);
4773         if (err)
4774                 return err;
4775
4776         return selinux_nlmsg_perm(sk, skb);
4777 }
4778
4779 static int ipc_alloc_security(struct task_struct *task,
4780                               struct kern_ipc_perm *perm,
4781                               u16 sclass)
4782 {
4783         struct ipc_security_struct *isec;
4784         u32 sid;
4785
4786         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4787         if (!isec)
4788                 return -ENOMEM;
4789
4790         sid = task_sid(task);
4791         isec->sclass = sclass;
4792         isec->sid = sid;
4793         perm->security = isec;
4794
4795         return 0;
4796 }
4797
4798 static void ipc_free_security(struct kern_ipc_perm *perm)
4799 {
4800         struct ipc_security_struct *isec = perm->security;
4801         perm->security = NULL;
4802         kfree(isec);
4803 }
4804
4805 static int msg_msg_alloc_security(struct msg_msg *msg)
4806 {
4807         struct msg_security_struct *msec;
4808
4809         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4810         if (!msec)
4811                 return -ENOMEM;
4812
4813         msec->sid = SECINITSID_UNLABELED;
4814         msg->security = msec;
4815
4816         return 0;
4817 }
4818
4819 static void msg_msg_free_security(struct msg_msg *msg)
4820 {
4821         struct msg_security_struct *msec = msg->security;
4822
4823         msg->security = NULL;
4824         kfree(msec);
4825 }
4826
4827 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4828                         u32 perms)
4829 {
4830         struct ipc_security_struct *isec;
4831         struct common_audit_data ad;
4832         u32 sid = current_sid();
4833
4834         isec = ipc_perms->security;
4835
4836         ad.type = LSM_AUDIT_DATA_IPC;
4837         ad.u.ipc_id = ipc_perms->key;
4838
4839         return avc_has_perm(sid, isec->sid, isec->sclass, perms, &ad);
4840 }
4841
4842 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4843 {
4844         return msg_msg_alloc_security(msg);
4845 }
4846
4847 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4848 {
4849         msg_msg_free_security(msg);
4850 }
4851
4852 /* message queue security operations */
4853 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4854 {
4855         struct ipc_security_struct *isec;
4856         struct common_audit_data ad;
4857         u32 sid = current_sid();
4858         int rc;
4859
4860         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4861         if (rc)
4862                 return rc;
4863
4864         isec = msq->q_perm.security;
4865
4866         ad.type = LSM_AUDIT_DATA_IPC;
4867         ad.u.ipc_id = msq->q_perm.key;
4868
4869         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4870                           MSGQ__CREATE, &ad);
4871         if (rc) {
4872                 ipc_free_security(&msq->q_perm);
4873                 return rc;
4874         }
4875         return 0;
4876 }
4877
4878 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4879 {
4880         ipc_free_security(&msq->q_perm);
4881 }
4882
4883 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4884 {
4885         struct ipc_security_struct *isec;
4886         struct common_audit_data ad;
4887         u32 sid = current_sid();
4888
4889         isec = msq->q_perm.security;
4890
4891         ad.type = LSM_AUDIT_DATA_IPC;
4892         ad.u.ipc_id = msq->q_perm.key;
4893
4894         return avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4895                             MSGQ__ASSOCIATE, &ad);
4896 }
4897
4898 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4899 {
4900         int err;
4901         int perms;
4902
4903         switch (cmd) {
4904         case IPC_INFO:
4905         case MSG_INFO:
4906                 /* No specific object, just general system-wide information. */
4907                 return task_has_system(current, SYSTEM__IPC_INFO);
4908         case IPC_STAT:
4909         case MSG_STAT:
4910                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4911                 break;
4912         case IPC_SET:
4913                 perms = MSGQ__SETATTR;
4914                 break;
4915         case IPC_RMID:
4916                 perms = MSGQ__DESTROY;
4917                 break;
4918         default:
4919                 return 0;
4920         }
4921
4922         err = ipc_has_perm(&msq->q_perm, perms);
4923         return err;
4924 }
4925
4926 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4927 {
4928         struct ipc_security_struct *isec;
4929         struct msg_security_struct *msec;
4930         struct common_audit_data ad;
4931         u32 sid = current_sid();
4932         int rc;
4933
4934         isec = msq->q_perm.security;
4935         msec = msg->security;
4936
4937         /*
4938          * First time through, need to assign label to the message
4939          */
4940         if (msec->sid == SECINITSID_UNLABELED) {
4941                 /*
4942                  * Compute new sid based on current process and
4943                  * message queue this message will be stored in
4944                  */
4945                 rc = security_transition_sid(sid, isec->sid, SECCLASS_MSG,
4946                                              NULL, &msec->sid);
4947                 if (rc)
4948                         return rc;
4949         }
4950
4951         ad.type = LSM_AUDIT_DATA_IPC;
4952         ad.u.ipc_id = msq->q_perm.key;
4953
4954         /* Can this process write to the queue? */
4955         rc = avc_has_perm(sid, isec->sid, SECCLASS_MSGQ,
4956                           MSGQ__WRITE, &ad);
4957         if (!rc)
4958                 /* Can this process send the message */
4959                 rc = avc_has_perm(sid, msec->sid, SECCLASS_MSG,
4960                                   MSG__SEND, &ad);
4961         if (!rc)
4962                 /* Can the message be put in the queue? */
4963                 rc = avc_has_perm(msec->sid, isec->sid, SECCLASS_MSGQ,
4964                                   MSGQ__ENQUEUE, &ad);
4965
4966         return rc;
4967 }
4968
4969 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4970                                     struct task_struct *target,
4971                                     long type, int mode)
4972 {
4973         struct ipc_security_struct *isec;
4974         struct msg_security_struct *msec;
4975         struct common_audit_data ad;
4976         u32 sid = task_sid(target);
4977         int rc;
4978
4979         isec = msq->q_perm.security;
4980         msec = msg->security;
4981
4982         ad.type = LSM_AUDIT_DATA_IPC;
4983         ad.u.ipc_id = msq->q_perm.key;
4984
4985         rc = avc_has_perm(sid, isec->sid,
4986                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4987         if (!rc)
4988                 rc = avc_has_perm(sid, msec->sid,
4989                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4990         return rc;
4991 }
4992
4993 /* Shared Memory security operations */
4994 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4995 {
4996         struct ipc_security_struct *isec;
4997         struct common_audit_data ad;
4998         u32 sid = current_sid();
4999         int rc;
5000
5001         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
5002         if (rc)
5003                 return rc;
5004
5005         isec = shp->shm_perm.security;
5006
5007         ad.type = LSM_AUDIT_DATA_IPC;
5008         ad.u.ipc_id = shp->shm_perm.key;
5009
5010         rc = avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5011                           SHM__CREATE, &ad);
5012         if (rc) {
5013                 ipc_free_security(&shp->shm_perm);
5014                 return rc;
5015         }
5016         return 0;
5017 }
5018
5019 static void selinux_shm_free_security(struct shmid_kernel *shp)
5020 {
5021         ipc_free_security(&shp->shm_perm);
5022 }
5023
5024 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
5025 {
5026         struct ipc_security_struct *isec;
5027         struct common_audit_data ad;
5028         u32 sid = current_sid();
5029
5030         isec = shp->shm_perm.security;
5031
5032         ad.type = LSM_AUDIT_DATA_IPC;
5033         ad.u.ipc_id = shp->shm_perm.key;
5034
5035         return avc_has_perm(sid, isec->sid, SECCLASS_SHM,
5036                             SHM__ASSOCIATE, &ad);
5037 }
5038
5039 /* Note, at this point, shp is locked down */
5040 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
5041 {
5042         int perms;
5043         int err;
5044
5045         switch (cmd) {
5046         case IPC_INFO:
5047         case SHM_INFO:
5048                 /* No specific object, just general system-wide information. */
5049                 return task_has_system(current, SYSTEM__IPC_INFO);
5050         case IPC_STAT:
5051         case SHM_STAT:
5052                 perms = SHM__GETATTR | SHM__ASSOCIATE;
5053                 break;
5054         case IPC_SET:
5055                 perms = SHM__SETATTR;
5056                 break;
5057         case SHM_LOCK:
5058         case SHM_UNLOCK:
5059                 perms = SHM__LOCK;
5060                 break;
5061         case IPC_RMID:
5062                 perms = SHM__DESTROY;
5063                 break;
5064         default:
5065                 return 0;
5066         }
5067
5068         err = ipc_has_perm(&shp->shm_perm, perms);
5069         return err;
5070 }
5071
5072 static int selinux_shm_shmat(struct shmid_kernel *shp,
5073                              char __user *shmaddr, int shmflg)
5074 {
5075         u32 perms;
5076
5077         if (shmflg & SHM_RDONLY)
5078                 perms = SHM__READ;
5079         else
5080                 perms = SHM__READ | SHM__WRITE;
5081
5082         return ipc_has_perm(&shp->shm_perm, perms);
5083 }
5084
5085 /* Semaphore security operations */
5086 static int selinux_sem_alloc_security(struct sem_array *sma)
5087 {
5088         struct ipc_security_struct *isec;
5089         struct common_audit_data ad;
5090         u32 sid = current_sid();
5091         int rc;
5092
5093         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
5094         if (rc)
5095                 return rc;
5096
5097         isec = sma->sem_perm.security;
5098
5099         ad.type = LSM_AUDIT_DATA_IPC;
5100         ad.u.ipc_id = sma->sem_perm.key;
5101
5102         rc = avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5103                           SEM__CREATE, &ad);
5104         if (rc) {
5105                 ipc_free_security(&sma->sem_perm);
5106                 return rc;
5107         }
5108         return 0;
5109 }
5110
5111 static void selinux_sem_free_security(struct sem_array *sma)
5112 {
5113         ipc_free_security(&sma->sem_perm);
5114 }
5115
5116 static int selinux_sem_associate(struct sem_array *sma, int semflg)
5117 {
5118         struct ipc_security_struct *isec;
5119         struct common_audit_data ad;
5120         u32 sid = current_sid();
5121
5122         isec = sma->sem_perm.security;
5123
5124         ad.type = LSM_AUDIT_DATA_IPC;
5125         ad.u.ipc_id = sma->sem_perm.key;
5126
5127         return avc_has_perm(sid, isec->sid, SECCLASS_SEM,
5128                             SEM__ASSOCIATE, &ad);
5129 }
5130
5131 /* Note, at this point, sma is locked down */
5132 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
5133 {
5134         int err;
5135         u32 perms;
5136
5137         switch (cmd) {
5138         case IPC_INFO:
5139         case SEM_INFO:
5140                 /* No specific object, just general system-wide information. */
5141                 return task_has_system(current, SYSTEM__IPC_INFO);
5142         case GETPID:
5143         case GETNCNT:
5144         case GETZCNT:
5145                 perms = SEM__GETATTR;
5146                 break;
5147         case GETVAL:
5148         case GETALL:
5149                 perms = SEM__READ;
5150                 break;
5151         case SETVAL:
5152         case SETALL:
5153                 perms = SEM__WRITE;
5154                 break;
5155         case IPC_RMID:
5156                 perms = SEM__DESTROY;
5157                 break;
5158         case IPC_SET:
5159                 perms = SEM__SETATTR;
5160                 break;
5161         case IPC_STAT:
5162         case SEM_STAT:
5163                 perms = SEM__GETATTR | SEM__ASSOCIATE;
5164                 break;
5165         default:
5166                 return 0;
5167         }
5168
5169         err = ipc_has_perm(&sma->sem_perm, perms);
5170         return err;
5171 }
5172
5173 static int selinux_sem_semop(struct sem_array *sma,
5174                              struct sembuf *sops, unsigned nsops, int alter)
5175 {
5176         u32 perms;
5177
5178         if (alter)
5179                 perms = SEM__READ | SEM__WRITE;
5180         else
5181                 perms = SEM__READ;
5182
5183         return ipc_has_perm(&sma->sem_perm, perms);
5184 }
5185
5186 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
5187 {
5188         u32 av = 0;
5189
5190         av = 0;
5191         if (flag & S_IRUGO)
5192                 av |= IPC__UNIX_READ;
5193         if (flag & S_IWUGO)
5194                 av |= IPC__UNIX_WRITE;
5195
5196         if (av == 0)
5197                 return 0;
5198
5199         return ipc_has_perm(ipcp, av);
5200 }
5201
5202 static void selinux_ipc_getsecid(struct kern_ipc_perm *ipcp, u32 *secid)
5203 {
5204         struct ipc_security_struct *isec = ipcp->security;
5205         *secid = isec->sid;
5206 }
5207
5208 static void selinux_d_instantiate(struct dentry *dentry, struct inode *inode)
5209 {
5210         if (inode)
5211                 inode_doinit_with_dentry(inode, dentry);
5212 }
5213
5214 static int selinux_getprocattr(struct task_struct *p,
5215                                char *name, char **value)
5216 {
5217         const struct task_security_struct *__tsec;
5218         u32 sid;
5219         int error;
5220         unsigned len;
5221
5222         if (current != p) {
5223                 error = current_has_perm(p, PROCESS__GETATTR);
5224                 if (error)
5225                         return error;
5226         }
5227
5228         rcu_read_lock();
5229         __tsec = __task_cred(p)->security;
5230
5231         if (!strcmp(name, "current"))
5232                 sid = __tsec->sid;
5233         else if (!strcmp(name, "prev"))
5234                 sid = __tsec->osid;
5235         else if (!strcmp(name, "exec"))
5236                 sid = __tsec->exec_sid;
5237         else if (!strcmp(name, "fscreate"))
5238                 sid = __tsec->create_sid;
5239         else if (!strcmp(name, "keycreate"))
5240                 sid = __tsec->keycreate_sid;
5241         else if (!strcmp(name, "sockcreate"))
5242                 sid = __tsec->sockcreate_sid;
5243         else
5244                 goto invalid;
5245         rcu_read_unlock();
5246
5247         if (!sid)
5248                 return 0;
5249
5250         error = security_sid_to_context(sid, value, &len);
5251         if (error)
5252                 return error;
5253         return len;
5254
5255 invalid:
5256         rcu_read_unlock();
5257         return -EINVAL;
5258 }
5259
5260 static int selinux_setprocattr(struct task_struct *p,
5261                                char *name, void *value, size_t size)
5262 {
5263         struct task_security_struct *tsec;
5264         struct task_struct *tracer;
5265         struct cred *new;
5266         u32 sid = 0, ptsid;
5267         int error;
5268         char *str = value;
5269
5270         if (current != p) {
5271                 /* SELinux only allows a process to change its own
5272                    security attributes. */
5273                 return -EACCES;
5274         }
5275
5276         /*
5277          * Basic control over ability to set these attributes at all.
5278          * current == p, but we'll pass them separately in case the
5279          * above restriction is ever removed.
5280          */
5281         if (!strcmp(name, "exec"))
5282                 error = current_has_perm(p, PROCESS__SETEXEC);
5283         else if (!strcmp(name, "fscreate"))
5284                 error = current_has_perm(p, PROCESS__SETFSCREATE);
5285         else if (!strcmp(name, "keycreate"))
5286                 error = current_has_perm(p, PROCESS__SETKEYCREATE);
5287         else if (!strcmp(name, "sockcreate"))
5288                 error = current_has_perm(p, PROCESS__SETSOCKCREATE);
5289         else if (!strcmp(name, "current"))
5290                 error = current_has_perm(p, PROCESS__SETCURRENT);
5291         else
5292                 error = -EINVAL;
5293         if (error)
5294                 return error;
5295
5296         /* Obtain a SID for the context, if one was specified. */
5297         if (size && str[1] && str[1] != '\n') {
5298                 if (str[size-1] == '\n') {
5299                         str[size-1] = 0;
5300                         size--;
5301                 }
5302                 error = security_context_to_sid(value, size, &sid);
5303                 if (error == -EINVAL && !strcmp(name, "fscreate")) {
5304                         if (!capable(CAP_MAC_ADMIN)) {
5305                                 struct audit_buffer *ab;
5306                                 size_t audit_size;
5307
5308                                 /* We strip a nul only if it is at the end, otherwise the
5309                                  * context contains a nul and we should audit that */
5310                                 if (str[size - 1] == '\0')
5311                                         audit_size = size - 1;
5312                                 else
5313                                         audit_size = size;
5314                                 ab = audit_log_start(current->audit_context, GFP_ATOMIC, AUDIT_SELINUX_ERR);
5315                                 audit_log_format(ab, "op=fscreate invalid_context=");
5316                                 audit_log_n_untrustedstring(ab, value, audit_size);
5317                                 audit_log_end(ab);
5318
5319                                 return error;
5320                         }
5321                         error = security_context_to_sid_force(value, size,
5322                                                               &sid);
5323                 }
5324                 if (error)
5325                         return error;
5326         }
5327
5328         new = prepare_creds();
5329         if (!new)
5330                 return -ENOMEM;
5331
5332         /* Permission checking based on the specified context is
5333            performed during the actual operation (execve,
5334            open/mkdir/...), when we know the full context of the
5335            operation.  See selinux_bprm_set_creds for the execve
5336            checks and may_create for the file creation checks. The
5337            operation will then fail if the context is not permitted. */
5338         tsec = new->security;
5339         if (!strcmp(name, "exec")) {
5340                 tsec->exec_sid = sid;
5341         } else if (!strcmp(name, "fscreate")) {
5342                 tsec->create_sid = sid;
5343         } else if (!strcmp(name, "keycreate")) {
5344                 error = may_create_key(sid, p);
5345                 if (error)
5346                         goto abort_change;
5347                 tsec->keycreate_sid = sid;
5348         } else if (!strcmp(name, "sockcreate")) {
5349                 tsec->sockcreate_sid = sid;
5350         } else if (!strcmp(name, "current")) {
5351                 error = -EINVAL;
5352                 if (sid == 0)
5353                         goto abort_change;
5354
5355                 /* Only allow single threaded processes to change context */
5356                 error = -EPERM;
5357                 if (!current_is_single_threaded()) {
5358                         error = security_bounded_transition(tsec->sid, sid);
5359                         if (error)
5360                                 goto abort_change;
5361                 }
5362
5363                 /* Check permissions for the transition. */
5364                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
5365                                      PROCESS__DYNTRANSITION, NULL);
5366                 if (error)
5367                         goto abort_change;
5368
5369                 /* Check for ptracing, and update the task SID if ok.
5370                    Otherwise, leave SID unchanged and fail. */
5371                 ptsid = 0;
5372                 task_lock(p);
5373                 tracer = ptrace_parent(p);
5374                 if (tracer)
5375                         ptsid = task_sid(tracer);
5376                 task_unlock(p);
5377
5378                 if (tracer) {
5379                         error = avc_has_perm(ptsid, sid, SECCLASS_PROCESS,
5380                                              PROCESS__PTRACE, NULL);
5381                         if (error)
5382                                 goto abort_change;
5383                 }
5384
5385                 tsec->sid = sid;
5386         } else {
5387                 error = -EINVAL;
5388                 goto abort_change;
5389         }
5390
5391         commit_creds(new);
5392         return size;
5393
5394 abort_change:
5395         abort_creds(new);
5396         return error;
5397 }
5398
5399 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
5400 {
5401         return security_sid_to_context(secid, secdata, seclen);
5402 }
5403
5404 static int selinux_secctx_to_secid(const char *secdata, u32 seclen, u32 *secid)
5405 {
5406         return security_context_to_sid(secdata, seclen, secid);
5407 }
5408
5409 static void selinux_release_secctx(char *secdata, u32 seclen)
5410 {
5411         kfree(secdata);
5412 }
5413
5414 /*
5415  *      called with inode->i_mutex locked
5416  */
5417 static int selinux_inode_notifysecctx(struct inode *inode, void *ctx, u32 ctxlen)
5418 {
5419         return selinux_inode_setsecurity(inode, XATTR_SELINUX_SUFFIX, ctx, ctxlen, 0);
5420 }
5421
5422 /*
5423  *      called with inode->i_mutex locked
5424  */
5425 static int selinux_inode_setsecctx(struct dentry *dentry, void *ctx, u32 ctxlen)
5426 {
5427         return __vfs_setxattr_noperm(dentry, XATTR_NAME_SELINUX, ctx, ctxlen, 0);
5428 }
5429
5430 static int selinux_inode_getsecctx(struct inode *inode, void **ctx, u32 *ctxlen)
5431 {
5432         int len = 0;
5433         len = selinux_inode_getsecurity(inode, XATTR_SELINUX_SUFFIX,
5434                                                 ctx, true);
5435         if (len < 0)
5436                 return len;
5437         *ctxlen = len;
5438         return 0;
5439 }
5440 #ifdef CONFIG_KEYS
5441
5442 static int selinux_key_alloc(struct key *k, const struct cred *cred,
5443                              unsigned long flags)
5444 {
5445         const struct task_security_struct *tsec;
5446         struct key_security_struct *ksec;
5447
5448         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
5449         if (!ksec)
5450                 return -ENOMEM;
5451
5452         tsec = cred->security;
5453         if (tsec->keycreate_sid)
5454                 ksec->sid = tsec->keycreate_sid;
5455         else
5456                 ksec->sid = tsec->sid;
5457
5458         k->security = ksec;
5459         return 0;
5460 }
5461
5462 static void selinux_key_free(struct key *k)
5463 {
5464         struct key_security_struct *ksec = k->security;
5465
5466         k->security = NULL;
5467         kfree(ksec);
5468 }
5469
5470 static int selinux_key_permission(key_ref_t key_ref,
5471                                   const struct cred *cred,
5472                                   key_perm_t perm)
5473 {
5474         struct key *key;
5475         struct key_security_struct *ksec;
5476         u32 sid;
5477
5478         /* if no specific permissions are requested, we skip the
5479            permission check. No serious, additional covert channels
5480            appear to be created. */
5481         if (perm == 0)
5482                 return 0;
5483
5484         sid = cred_sid(cred);
5485
5486         key = key_ref_to_ptr(key_ref);
5487         ksec = key->security;
5488
5489         return avc_has_perm(sid, ksec->sid, SECCLASS_KEY, perm, NULL);
5490 }
5491
5492 static int selinux_key_getsecurity(struct key *key, char **_buffer)
5493 {
5494         struct key_security_struct *ksec = key->security;
5495         char *context = NULL;
5496         unsigned len;
5497         int rc;
5498
5499         rc = security_sid_to_context(ksec->sid, &context, &len);
5500         if (!rc)
5501                 rc = len;
5502         *_buffer = context;
5503         return rc;
5504 }
5505
5506 #endif
5507
5508 static struct security_operations selinux_ops = {
5509         .name =                         "selinux",
5510
5511         .ptrace_access_check =          selinux_ptrace_access_check,
5512         .ptrace_traceme =               selinux_ptrace_traceme,
5513         .capget =                       selinux_capget,
5514         .capset =                       selinux_capset,
5515         .capable =                      selinux_capable,
5516         .quotactl =                     selinux_quotactl,
5517         .quota_on =                     selinux_quota_on,
5518         .syslog =                       selinux_syslog,
5519         .vm_enough_memory =             selinux_vm_enough_memory,
5520
5521         .netlink_send =                 selinux_netlink_send,
5522
5523         .bprm_set_creds =               selinux_bprm_set_creds,
5524         .bprm_committing_creds =        selinux_bprm_committing_creds,
5525         .bprm_committed_creds =         selinux_bprm_committed_creds,
5526         .bprm_secureexec =              selinux_bprm_secureexec,
5527
5528         .sb_alloc_security =            selinux_sb_alloc_security,
5529         .sb_free_security =             selinux_sb_free_security,
5530         .sb_copy_data =                 selinux_sb_copy_data,
5531         .sb_remount =                   selinux_sb_remount,
5532         .sb_kern_mount =                selinux_sb_kern_mount,
5533         .sb_show_options =              selinux_sb_show_options,
5534         .sb_statfs =                    selinux_sb_statfs,
5535         .sb_mount =                     selinux_mount,
5536         .sb_umount =                    selinux_umount,
5537         .sb_set_mnt_opts =              selinux_set_mnt_opts,
5538         .sb_clone_mnt_opts =            selinux_sb_clone_mnt_opts,
5539         .sb_parse_opts_str =            selinux_parse_opts_str,
5540
5541
5542         .inode_alloc_security =         selinux_inode_alloc_security,
5543         .inode_free_security =          selinux_inode_free_security,
5544         .inode_init_security =          selinux_inode_init_security,
5545         .inode_create =                 selinux_inode_create,
5546         .inode_link =                   selinux_inode_link,
5547         .inode_unlink =                 selinux_inode_unlink,
5548         .inode_symlink =                selinux_inode_symlink,
5549         .inode_mkdir =                  selinux_inode_mkdir,
5550         .inode_rmdir =                  selinux_inode_rmdir,
5551         .inode_mknod =                  selinux_inode_mknod,
5552         .inode_rename =                 selinux_inode_rename,
5553         .inode_readlink =               selinux_inode_readlink,
5554         .inode_follow_link =            selinux_inode_follow_link,
5555         .inode_permission =             selinux_inode_permission,
5556         .inode_setattr =                selinux_inode_setattr,
5557         .inode_getattr =                selinux_inode_getattr,
5558         .inode_setxattr =               selinux_inode_setxattr,
5559         .inode_post_setxattr =          selinux_inode_post_setxattr,
5560         .inode_getxattr =               selinux_inode_getxattr,
5561         .inode_listxattr =              selinux_inode_listxattr,
5562         .inode_removexattr =            selinux_inode_removexattr,
5563         .inode_getsecurity =            selinux_inode_getsecurity,
5564         .inode_setsecurity =            selinux_inode_setsecurity,
5565         .inode_listsecurity =           selinux_inode_listsecurity,
5566         .inode_getsecid =               selinux_inode_getsecid,
5567
5568         .file_permission =              selinux_file_permission,
5569         .file_alloc_security =          selinux_file_alloc_security,
5570         .file_free_security =           selinux_file_free_security,
5571         .file_ioctl =                   selinux_file_ioctl,
5572         .mmap_file =                    selinux_mmap_file,
5573         .mmap_addr =                    selinux_mmap_addr,
5574         .file_mprotect =                selinux_file_mprotect,
5575         .file_lock =                    selinux_file_lock,
5576         .file_fcntl =                   selinux_file_fcntl,
5577         .file_set_fowner =              selinux_file_set_fowner,
5578         .file_send_sigiotask =          selinux_file_send_sigiotask,
5579         .file_receive =                 selinux_file_receive,
5580
5581         .file_open =                    selinux_file_open,
5582
5583         .task_create =                  selinux_task_create,
5584         .cred_alloc_blank =             selinux_cred_alloc_blank,
5585         .cred_free =                    selinux_cred_free,
5586         .cred_prepare =                 selinux_cred_prepare,
5587         .cred_transfer =                selinux_cred_transfer,
5588         .kernel_act_as =                selinux_kernel_act_as,
5589         .kernel_create_files_as =       selinux_kernel_create_files_as,
5590         .kernel_module_request =        selinux_kernel_module_request,
5591         .task_setpgid =                 selinux_task_setpgid,
5592         .task_getpgid =                 selinux_task_getpgid,
5593         .task_getsid =                  selinux_task_getsid,
5594         .task_getsecid =                selinux_task_getsecid,
5595         .task_setnice =                 selinux_task_setnice,
5596         .task_setioprio =               selinux_task_setioprio,
5597         .task_getioprio =               selinux_task_getioprio,
5598         .task_setrlimit =               selinux_task_setrlimit,
5599         .task_setscheduler =            selinux_task_setscheduler,
5600         .task_getscheduler =            selinux_task_getscheduler,
5601         .task_movememory =              selinux_task_movememory,
5602         .task_kill =                    selinux_task_kill,
5603         .task_wait =                    selinux_task_wait,
5604         .task_to_inode =                selinux_task_to_inode,
5605
5606         .ipc_permission =               selinux_ipc_permission,
5607         .ipc_getsecid =                 selinux_ipc_getsecid,
5608
5609         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
5610         .msg_msg_free_security =        selinux_msg_msg_free_security,
5611
5612         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
5613         .msg_queue_free_security =      selinux_msg_queue_free_security,
5614         .msg_queue_associate =          selinux_msg_queue_associate,
5615         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
5616         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
5617         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
5618
5619         .shm_alloc_security =           selinux_shm_alloc_security,
5620         .shm_free_security =            selinux_shm_free_security,
5621         .shm_associate =                selinux_shm_associate,
5622         .shm_shmctl =                   selinux_shm_shmctl,
5623         .shm_shmat =                    selinux_shm_shmat,
5624
5625         .sem_alloc_security =           selinux_sem_alloc_security,
5626         .sem_free_security =            selinux_sem_free_security,
5627         .sem_associate =                selinux_sem_associate,
5628         .sem_semctl =                   selinux_sem_semctl,
5629         .sem_semop =                    selinux_sem_semop,
5630
5631         .d_instantiate =                selinux_d_instantiate,
5632
5633         .getprocattr =                  selinux_getprocattr,
5634         .setprocattr =                  selinux_setprocattr,
5635
5636         .secid_to_secctx =              selinux_secid_to_secctx,
5637         .secctx_to_secid =              selinux_secctx_to_secid,
5638         .release_secctx =               selinux_release_secctx,
5639         .inode_notifysecctx =           selinux_inode_notifysecctx,
5640         .inode_setsecctx =              selinux_inode_setsecctx,
5641         .inode_getsecctx =              selinux_inode_getsecctx,
5642
5643         .unix_stream_connect =          selinux_socket_unix_stream_connect,
5644         .unix_may_send =                selinux_socket_unix_may_send,
5645
5646         .socket_create =                selinux_socket_create,
5647         .socket_post_create =           selinux_socket_post_create,
5648         .socket_bind =                  selinux_socket_bind,
5649         .socket_connect =               selinux_socket_connect,
5650         .socket_listen =                selinux_socket_listen,
5651         .socket_accept =                selinux_socket_accept,
5652         .socket_sendmsg =               selinux_socket_sendmsg,
5653         .socket_recvmsg =               selinux_socket_recvmsg,
5654         .socket_getsockname =           selinux_socket_getsockname,
5655         .socket_getpeername =           selinux_socket_getpeername,
5656         .socket_getsockopt =            selinux_socket_getsockopt,
5657         .socket_setsockopt =            selinux_socket_setsockopt,
5658         .socket_shutdown =              selinux_socket_shutdown,
5659         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
5660         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
5661         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
5662         .sk_alloc_security =            selinux_sk_alloc_security,
5663         .sk_free_security =             selinux_sk_free_security,
5664         .sk_clone_security =            selinux_sk_clone_security,
5665         .sk_getsecid =                  selinux_sk_getsecid,
5666         .sock_graft =                   selinux_sock_graft,
5667         .inet_conn_request =            selinux_inet_conn_request,
5668         .inet_csk_clone =               selinux_inet_csk_clone,
5669         .inet_conn_established =        selinux_inet_conn_established,
5670         .secmark_relabel_packet =       selinux_secmark_relabel_packet,
5671         .secmark_refcount_inc =         selinux_secmark_refcount_inc,
5672         .secmark_refcount_dec =         selinux_secmark_refcount_dec,
5673         .req_classify_flow =            selinux_req_classify_flow,
5674         .tun_dev_create =               selinux_tun_dev_create,
5675         .tun_dev_post_create =          selinux_tun_dev_post_create,
5676         .tun_dev_attach =               selinux_tun_dev_attach,
5677
5678 #ifdef CONFIG_SECURITY_NETWORK_XFRM
5679         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
5680         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
5681         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
5682         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
5683         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
5684         .xfrm_state_free_security =     selinux_xfrm_state_free,
5685         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
5686         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
5687         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
5688         .xfrm_decode_session =          selinux_xfrm_decode_session,
5689 #endif
5690
5691 #ifdef CONFIG_KEYS
5692         .key_alloc =                    selinux_key_alloc,
5693         .key_free =                     selinux_key_free,
5694         .key_permission =               selinux_key_permission,
5695         .key_getsecurity =              selinux_key_getsecurity,
5696 #endif
5697
5698 #ifdef CONFIG_AUDIT
5699         .audit_rule_init =              selinux_audit_rule_init,
5700         .audit_rule_known =             selinux_audit_rule_known,
5701         .audit_rule_match =             selinux_audit_rule_match,
5702         .audit_rule_free =              selinux_audit_rule_free,
5703 #endif
5704 };
5705
5706 static __init int selinux_init(void)
5707 {
5708         if (!security_module_enable(&selinux_ops)) {
5709                 selinux_enabled = 0;
5710                 return 0;
5711         }
5712
5713         if (!selinux_enabled) {
5714                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
5715                 return 0;
5716         }
5717
5718         printk(KERN_INFO "SELinux:  Initializing.\n");
5719
5720         /* Set the security state for the initial task. */
5721         cred_init_security();
5722
5723         default_noexec = !(VM_DATA_DEFAULT_FLAGS & VM_EXEC);
5724
5725         sel_inode_cache = kmem_cache_create("selinux_inode_security",
5726                                             sizeof(struct inode_security_struct),
5727                                             0, SLAB_PANIC, NULL);
5728         avc_init();
5729
5730         if (register_security(&selinux_ops))
5731                 panic("SELinux: Unable to register with kernel.\n");
5732
5733         if (selinux_enforcing)
5734                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
5735         else
5736                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
5737
5738         return 0;
5739 }
5740
5741 static void delayed_superblock_init(struct super_block *sb, void *unused)
5742 {
5743         superblock_doinit(sb, NULL);
5744 }
5745
5746 void selinux_complete_init(void)
5747 {
5748         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
5749
5750         /* Set up any superblocks initialized prior to the policy load. */
5751         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
5752         iterate_supers(delayed_superblock_init, NULL);
5753 }
5754
5755 /* SELinux requires early initialization in order to label
5756    all processes and objects when they are created. */
5757 security_initcall(selinux_init);
5758
5759 #if defined(CONFIG_NETFILTER)
5760
5761 static struct nf_hook_ops selinux_ipv4_ops[] = {
5762         {
5763                 .hook =         selinux_ipv4_postroute,
5764                 .owner =        THIS_MODULE,
5765                 .pf =           NFPROTO_IPV4,
5766                 .hooknum =      NF_INET_POST_ROUTING,
5767                 .priority =     NF_IP_PRI_SELINUX_LAST,
5768         },
5769         {
5770                 .hook =         selinux_ipv4_forward,
5771                 .owner =        THIS_MODULE,
5772                 .pf =           NFPROTO_IPV4,
5773                 .hooknum =      NF_INET_FORWARD,
5774                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5775         },
5776         {
5777                 .hook =         selinux_ipv4_output,
5778                 .owner =        THIS_MODULE,
5779                 .pf =           NFPROTO_IPV4,
5780                 .hooknum =      NF_INET_LOCAL_OUT,
5781                 .priority =     NF_IP_PRI_SELINUX_FIRST,
5782         }
5783 };
5784
5785 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5786
5787 static struct nf_hook_ops selinux_ipv6_ops[] = {
5788         {
5789                 .hook =         selinux_ipv6_postroute,
5790                 .owner =        THIS_MODULE,
5791                 .pf =           NFPROTO_IPV6,
5792                 .hooknum =      NF_INET_POST_ROUTING,
5793                 .priority =     NF_IP6_PRI_SELINUX_LAST,
5794         },
5795         {
5796                 .hook =         selinux_ipv6_forward,
5797                 .owner =        THIS_MODULE,
5798                 .pf =           NFPROTO_IPV6,
5799                 .hooknum =      NF_INET_FORWARD,
5800                 .priority =     NF_IP6_PRI_SELINUX_FIRST,
5801         }
5802 };
5803
5804 #endif  /* IPV6 */
5805
5806 static int __init selinux_nf_ip_init(void)
5807 {
5808         int err = 0;
5809
5810         if (!selinux_enabled)
5811                 goto out;
5812
5813         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5814
5815         err = nf_register_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5816         if (err)
5817                 panic("SELinux: nf_register_hooks for IPv4: error %d\n", err);
5818
5819 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5820         err = nf_register_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5821         if (err)
5822                 panic("SELinux: nf_register_hooks for IPv6: error %d\n", err);
5823 #endif  /* IPV6 */
5824
5825 out:
5826         return err;
5827 }
5828
5829 __initcall(selinux_nf_ip_init);
5830
5831 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5832 static void selinux_nf_ip_exit(void)
5833 {
5834         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5835
5836         nf_unregister_hooks(selinux_ipv4_ops, ARRAY_SIZE(selinux_ipv4_ops));
5837 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5838         nf_unregister_hooks(selinux_ipv6_ops, ARRAY_SIZE(selinux_ipv6_ops));
5839 #endif  /* IPV6 */
5840 }
5841 #endif
5842
5843 #else /* CONFIG_NETFILTER */
5844
5845 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5846 #define selinux_nf_ip_exit()
5847 #endif
5848
5849 #endif /* CONFIG_NETFILTER */
5850
5851 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5852 static int selinux_disabled;
5853
5854 int selinux_disable(void)
5855 {
5856         if (ss_initialized) {
5857                 /* Not permitted after initial policy load. */
5858                 return -EINVAL;
5859         }
5860
5861         if (selinux_disabled) {
5862                 /* Only do this once. */
5863                 return -EINVAL;
5864         }
5865
5866         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5867
5868         selinux_disabled = 1;
5869         selinux_enabled = 0;
5870
5871         reset_security_ops();
5872
5873         /* Try to destroy the avc node cache */
5874         avc_disable();
5875
5876         /* Unregister netfilter hooks. */
5877         selinux_nf_ip_exit();
5878
5879         /* Unregister selinuxfs. */
5880         exit_sel_fs();
5881
5882         return 0;
5883 }
5884 #endif