security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *
  16  *      This program is free software; you can redistribute it and/or modify
  17  *      it under the terms of the GNU General Public License version 2,
  18  *      as published by the Free Software Foundation.
  19  */
  20
  21 #include <linux/config.h>
  22 #include <linux/module.h>
  23 #include <linux/init.h>
  24 #include <linux/kernel.h>
  25 #include <linux/ptrace.h>
  26 #include <linux/errno.h>
  27 #include <linux/sched.h>
  28 #include <linux/security.h>
  29 #include <linux/xattr.h>
  30 #include <linux/capability.h>
  31 #include <linux/unistd.h>
  32 #include <linux/mm.h>
  33 #include <linux/mman.h>
  34 #include <linux/slab.h>
  35 #include <linux/pagemap.h>
  36 #include <linux/swap.h>
  37 #include <linux/smp_lock.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/semaphore.h>
  54 #include <asm/ioctls.h>
  55 #include <linux/bitops.h>
  56 #include <linux/interrupt.h>
  57 #include <linux/netdevice.h>    /* for network interface checks */
  58 #include <linux/netlink.h>
  59 #include <linux/tcp.h>
  60 #include <linux/udp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71
  72 #include "avc.h"
  73 #include "objsec.h"
  74 #include "netif.h"
  75
  76 #define XATTR_SELINUX_SUFFIX "selinux"
  77 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  78
  79 extern unsigned int policydb_loaded_version;
  80 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  81
  82 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  83 int selinux_enforcing = 0;
  84
  85 static int __init enforcing_setup(char *str)
  86 {
  87         selinux_enforcing = simple_strtol(str,NULL,0);
  88         return 1;
  89 }
  90 __setup("enforcing=", enforcing_setup);
  91 #endif
  92
  93 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
  94 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
  95
  96 static int __init selinux_enabled_setup(char *str)
  97 {
  98         selinux_enabled = simple_strtol(str, NULL, 0);
  99         return 1;
 100 }
 101 __setup("selinux=", selinux_enabled_setup);
 102 #endif
 103
 104 /* Original (dummy) security module. */
 105 static struct security_operations *original_ops = NULL;
 106
 107 /* Minimal support for a secondary security module,
 108    just to allow the use of the dummy or capability modules.
 109    The owlsm module can alternatively be used as a secondary
 110    module as long as CONFIG_OWLSM_FD is not enabled. */
 111 static struct security_operations *secondary_ops = NULL;
 112
 113 /* Lists of inode and superblock security structures initialized
 114    before the policy was loaded. */
 115 static LIST_HEAD(superblock_security_head);
 116 static DEFINE_SPINLOCK(sb_security_lock);
 117
 118 /* Allocate and free functions for each kind of security blob. */
 119
 120 static int task_alloc_security(struct task_struct *task)
 121 {
 122         struct task_security_struct *tsec;
 123
 124         tsec = kmalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 125         if (!tsec)
 126                 return -ENOMEM;
 127
 128         memset(tsec, 0, sizeof(struct task_security_struct));
 129         tsec->magic = SELINUX_MAGIC;
 130         tsec->task = task;
 131         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 132         task->security = tsec;
 133
 134         return 0;
 135 }
 136
 137 static void task_free_security(struct task_struct *task)
 138 {
 139         struct task_security_struct *tsec = task->security;
 140
 141         if (!tsec || tsec->magic != SELINUX_MAGIC)
 142                 return;
 143
 144         task->security = NULL;
 145         kfree(tsec);
 146 }
 147
 148 static int inode_alloc_security(struct inode *inode)
 149 {
 150         struct task_security_struct *tsec = current->security;
 151         struct inode_security_struct *isec;
 152
 153         isec = kmalloc(sizeof(struct inode_security_struct), GFP_KERNEL);
 154         if (!isec)
 155                 return -ENOMEM;
 156
 157         memset(isec, 0, sizeof(struct inode_security_struct));
 158         init_MUTEX(&isec->sem);
 159         INIT_LIST_HEAD(&isec->list);
 160         isec->magic = SELINUX_MAGIC;
 161         isec->inode = inode;
 162         isec->sid = SECINITSID_UNLABELED;
 163         isec->sclass = SECCLASS_FILE;
 164         if (tsec && tsec->magic == SELINUX_MAGIC)
 165                 isec->task_sid = tsec->sid;
 166         else
 167                 isec->task_sid = SECINITSID_UNLABELED;
 168         inode->i_security = isec;
 169
 170         return 0;
 171 }
 172
 173 static void inode_free_security(struct inode *inode)
 174 {
 175         struct inode_security_struct *isec = inode->i_security;
 176         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 177
 178         if (!isec || isec->magic != SELINUX_MAGIC)
 179                 return;
 180
 181         spin_lock(&sbsec->isec_lock);
 182         if (!list_empty(&isec->list))
 183                 list_del_init(&isec->list);
 184         spin_unlock(&sbsec->isec_lock);
 185
 186         inode->i_security = NULL;
 187         kfree(isec);
 188 }
 189
 190 static int file_alloc_security(struct file *file)
 191 {
 192         struct task_security_struct *tsec = current->security;
 193         struct file_security_struct *fsec;
 194
 195         fsec = kmalloc(sizeof(struct file_security_struct), GFP_ATOMIC);
 196         if (!fsec)
 197                 return -ENOMEM;
 198
 199         memset(fsec, 0, sizeof(struct file_security_struct));
 200         fsec->magic = SELINUX_MAGIC;
 201         fsec->file = file;
 202         if (tsec && tsec->magic == SELINUX_MAGIC) {
 203                 fsec->sid = tsec->sid;
 204                 fsec->fown_sid = tsec->sid;
 205         } else {
 206                 fsec->sid = SECINITSID_UNLABELED;
 207                 fsec->fown_sid = SECINITSID_UNLABELED;
 208         }
 209         file->f_security = fsec;
 210
 211         return 0;
 212 }
 213
 214 static void file_free_security(struct file *file)
 215 {
 216         struct file_security_struct *fsec = file->f_security;
 217
 218         if (!fsec || fsec->magic != SELINUX_MAGIC)
 219                 return;
 220
 221         file->f_security = NULL;
 222         kfree(fsec);
 223 }
 224
 225 static int superblock_alloc_security(struct super_block *sb)
 226 {
 227         struct superblock_security_struct *sbsec;
 228
 229         sbsec = kmalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 230         if (!sbsec)
 231                 return -ENOMEM;
 232
 233         memset(sbsec, 0, sizeof(struct superblock_security_struct));
 234         init_MUTEX(&sbsec->sem);
 235         INIT_LIST_HEAD(&sbsec->list);
 236         INIT_LIST_HEAD(&sbsec->isec_head);
 237         spin_lock_init(&sbsec->isec_lock);
 238         sbsec->magic = SELINUX_MAGIC;
 239         sbsec->sb = sb;
 240         sbsec->sid = SECINITSID_UNLABELED;
 241         sbsec->def_sid = SECINITSID_FILE;
 242         sb->s_security = sbsec;
 243
 244         return 0;
 245 }
 246
 247 static void superblock_free_security(struct super_block *sb)
 248 {
 249         struct superblock_security_struct *sbsec = sb->s_security;
 250
 251         if (!sbsec || sbsec->magic != SELINUX_MAGIC)
 252                 return;
 253
 254         spin_lock(&sb_security_lock);
 255         if (!list_empty(&sbsec->list))
 256                 list_del_init(&sbsec->list);
 257         spin_unlock(&sb_security_lock);
 258
 259         sb->s_security = NULL;
 260         kfree(sbsec);
 261 }
 262
 263 #ifdef CONFIG_SECURITY_NETWORK
 264 static int sk_alloc_security(struct sock *sk, int family, int priority)
 265 {
 266         struct sk_security_struct *ssec;
 267
 268         if (family != PF_UNIX)
 269                 return 0;
 270
 271         ssec = kmalloc(sizeof(*ssec), priority);
 272         if (!ssec)
 273                 return -ENOMEM;
 274
 275         memset(ssec, 0, sizeof(*ssec));
 276         ssec->magic = SELINUX_MAGIC;
 277         ssec->sk = sk;
 278         ssec->peer_sid = SECINITSID_UNLABELED;
 279         sk->sk_security = ssec;
 280
 281         return 0;
 282 }
 283
 284 static void sk_free_security(struct sock *sk)
 285 {
 286         struct sk_security_struct *ssec = sk->sk_security;
 287
 288         if (sk->sk_family != PF_UNIX || ssec->magic != SELINUX_MAGIC)
 289                 return;
 290
 291         sk->sk_security = NULL;
 292         kfree(ssec);
 293 }
 294 #endif  /* CONFIG_SECURITY_NETWORK */
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_context = 1,
 320         Opt_fscontext = 2,
 321         Opt_defcontext = 4,
 322 };
 323
 324 static match_table_t tokens = {
 325         {Opt_context, "context=%s"},
 326         {Opt_fscontext, "fscontext=%s"},
 327         {Opt_defcontext, "defcontext=%s"},
 328 };
 329
 330 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 331
 332 static int try_context_mount(struct super_block *sb, void *data)
 333 {
 334         char *context = NULL, *defcontext = NULL;
 335         const char *name;
 336         u32 sid;
 337         int alloc = 0, rc = 0, seen = 0;
 338         struct task_security_struct *tsec = current->security;
 339         struct superblock_security_struct *sbsec = sb->s_security;
 340
 341         if (!data)
 342                 goto out;
 343
 344         name = sb->s_type->name;
 345
 346         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 347
 348                 /* NFS we understand. */
 349                 if (!strcmp(name, "nfs")) {
 350                         struct nfs_mount_data *d = data;
 351
 352                         if (d->version <  NFS_MOUNT_VERSION)
 353                                 goto out;
 354
 355                         if (d->context[0]) {
 356                                 context = d->context;
 357                                 seen |= Opt_context;
 358                         }
 359                 } else
 360                         goto out;
 361
 362         } else {
 363                 /* Standard string-based options. */
 364                 char *p, *options = data;
 365
 366                 while ((p = strsep(&options, ",")) != NULL) {
 367                         int token;
 368                         substring_t args[MAX_OPT_ARGS];
 369
 370                         if (!*p)
 371                                 continue;
 372
 373                         token = match_token(p, tokens, args);
 374
 375                         switch (token) {
 376                         case Opt_context:
 377                                 if (seen) {
 378                                         rc = -EINVAL;
 379                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 380                                         goto out_free;
 381                                 }
 382                                 context = match_strdup(&args[0]);
 383                                 if (!context) {
 384                                         rc = -ENOMEM;
 385                                         goto out_free;
 386                                 }
 387                                 if (!alloc)
 388                                         alloc = 1;
 389                                 seen |= Opt_context;
 390                                 break;
 391
 392                         case Opt_fscontext:
 393                                 if (seen & (Opt_context|Opt_fscontext)) {
 394                                         rc = -EINVAL;
 395                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 396                                         goto out_free;
 397                                 }
 398                                 context = match_strdup(&args[0]);
 399                                 if (!context) {
 400                                         rc = -ENOMEM;
 401                                         goto out_free;
 402                                 }
 403                                 if (!alloc)
 404                                         alloc = 1;
 405                                 seen |= Opt_fscontext;
 406                                 break;
 407
 408                         case Opt_defcontext:
 409                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 410                                         rc = -EINVAL;
 411                                         printk(KERN_WARNING "SELinux:  "
 412                                                "defcontext option is invalid "
 413                                                "for this filesystem type\n");
 414                                         goto out_free;
 415                                 }
 416                                 if (seen & (Opt_context|Opt_defcontext)) {
 417                                         rc = -EINVAL;
 418                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 419                                         goto out_free;
 420                                 }
 421                                 defcontext = match_strdup(&args[0]);
 422                                 if (!defcontext) {
 423                                         rc = -ENOMEM;
 424                                         goto out_free;
 425                                 }
 426                                 if (!alloc)
 427                                         alloc = 1;
 428                                 seen |= Opt_defcontext;
 429                                 break;
 430
 431                         default:
 432                                 rc = -EINVAL;
 433                                 printk(KERN_WARNING "SELinux:  unknown mount "
 434                                        "option\n");
 435                                 goto out_free;
 436
 437                         }
 438                 }
 439         }
 440
 441         if (!seen)
 442                 goto out;
 443
 444         if (context) {
 445                 rc = security_context_to_sid(context, strlen(context), &sid);
 446                 if (rc) {
 447                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 448                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 449                                context, sb->s_id, name, rc);
 450                         goto out_free;
 451                 }
 452
 453                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 454                                   FILESYSTEM__RELABELFROM, NULL);
 455                 if (rc)
 456                         goto out_free;
 457
 458                 rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 459                                   FILESYSTEM__RELABELTO, NULL);
 460                 if (rc)
 461                         goto out_free;
 462
 463                 sbsec->sid = sid;
 464
 465                 if (seen & Opt_context)
 466                         sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 467         }
 468
 469         if (defcontext) {
 470                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 471                 if (rc) {
 472                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 473                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 474                                defcontext, sb->s_id, name, rc);
 475                         goto out_free;
 476                 }
 477
 478                 if (sid == sbsec->def_sid)
 479                         goto out_free;
 480
 481                 rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 482                                   FILESYSTEM__RELABELFROM, NULL);
 483                 if (rc)
 484                         goto out_free;
 485
 486                 rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 487                                   FILESYSTEM__ASSOCIATE, NULL);
 488                 if (rc)
 489                         goto out_free;
 490
 491                 sbsec->def_sid = sid;
 492         }
 493
 494 out_free:
 495         if (alloc) {
 496                 kfree(context);
 497                 kfree(defcontext);
 498         }
 499 out:
 500         return rc;
 501 }
 502
 503 static int superblock_doinit(struct super_block *sb, void *data)
 504 {
 505         struct superblock_security_struct *sbsec = sb->s_security;
 506         struct dentry *root = sb->s_root;
 507         struct inode *inode = root->d_inode;
 508         int rc = 0;
 509
 510         down(&sbsec->sem);
 511         if (sbsec->initialized)
 512                 goto out;
 513
 514         if (!ss_initialized) {
 515                 /* Defer initialization until selinux_complete_init,
 516                    after the initial policy is loaded and the security
 517                    server is ready to handle calls. */
 518                 spin_lock(&sb_security_lock);
 519                 if (list_empty(&sbsec->list))
 520                         list_add(&sbsec->list, &superblock_security_head);
 521                 spin_unlock(&sb_security_lock);
 522                 goto out;
 523         }
 524
 525         /* Determine the labeling behavior to use for this filesystem type. */
 526         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 527         if (rc) {
 528                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 529                        __FUNCTION__, sb->s_type->name, rc);
 530                 goto out;
 531         }
 532
 533         rc = try_context_mount(sb, data);
 534         if (rc)
 535                 goto out;
 536
 537         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 538                 /* Make sure that the xattr handler exists and that no
 539                    error other than -ENODATA is returned by getxattr on
 540                    the root directory.  -ENODATA is ok, as this may be
 541                    the first boot of the SELinux kernel before we have
 542                    assigned xattr values to the filesystem. */
 543                 if (!inode->i_op->getxattr) {
 544                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 545                                "xattr support\n", sb->s_id, sb->s_type->name);
 546                         rc = -EOPNOTSUPP;
 547                         goto out;
 548                 }
 549                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 550                 if (rc < 0 && rc != -ENODATA) {
 551                         if (rc == -EOPNOTSUPP)
 552                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 553                                        "%s) has no security xattr handler\n",
 554                                        sb->s_id, sb->s_type->name);
 555                         else
 556                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 557                                        "%s) getxattr errno %d\n", sb->s_id,
 558                                        sb->s_type->name, -rc);
 559                         goto out;
 560                 }
 561         }
 562
 563         if (strcmp(sb->s_type->name, "proc") == 0)
 564                 sbsec->proc = 1;
 565
 566         sbsec->initialized = 1;
 567
 568         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 569                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 570                        sb->s_id, sb->s_type->name);
 571         }
 572         else {
 573                 printk(KERN_INFO "SELinux: initialized (dev %s, type %s), %s\n",
 574                        sb->s_id, sb->s_type->name,
 575                        labeling_behaviors[sbsec->behavior-1]);
 576         }
 577
 578         /* Initialize the root inode. */
 579         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 580
 581         /* Initialize any other inodes associated with the superblock, e.g.
 582            inodes created prior to initial policy load or inodes created
 583            during get_sb by a pseudo filesystem that directly
 584            populates itself. */
 585         spin_lock(&sbsec->isec_lock);
 586 next_inode:
 587         if (!list_empty(&sbsec->isec_head)) {
 588                 struct inode_security_struct *isec =
 589                                 list_entry(sbsec->isec_head.next,
 590                                            struct inode_security_struct, list);
 591                 struct inode *inode = isec->inode;
 592                 spin_unlock(&sbsec->isec_lock);
 593                 inode = igrab(inode);
 594                 if (inode) {
 595                         if (!IS_PRIVATE (inode))
 596                                 inode_doinit(inode);
 597                         iput(inode);
 598                 }
 599                 spin_lock(&sbsec->isec_lock);
 600                 list_del_init(&isec->list);
 601                 goto next_inode;
 602         }
 603         spin_unlock(&sbsec->isec_lock);
 604 out:
 605         up(&sbsec->sem);
 606         return rc;
 607 }
 608
 609 static inline u16 inode_mode_to_security_class(umode_t mode)
 610 {
 611         switch (mode & S_IFMT) {
 612         case S_IFSOCK:
 613                 return SECCLASS_SOCK_FILE;
 614         case S_IFLNK:
 615                 return SECCLASS_LNK_FILE;
 616         case S_IFREG:
 617                 return SECCLASS_FILE;
 618         case S_IFBLK:
 619                 return SECCLASS_BLK_FILE;
 620         case S_IFDIR:
 621                 return SECCLASS_DIR;
 622         case S_IFCHR:
 623                 return SECCLASS_CHR_FILE;
 624         case S_IFIFO:
 625                 return SECCLASS_FIFO_FILE;
 626
 627         }
 628
 629         return SECCLASS_FILE;
 630 }
 631
 632 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 633 {
 634         switch (family) {
 635         case PF_UNIX:
 636                 switch (type) {
 637                 case SOCK_STREAM:
 638                 case SOCK_SEQPACKET:
 639                         return SECCLASS_UNIX_STREAM_SOCKET;
 640                 case SOCK_DGRAM:
 641                         return SECCLASS_UNIX_DGRAM_SOCKET;
 642                 }
 643                 break;
 644         case PF_INET:
 645         case PF_INET6:
 646                 switch (type) {
 647                 case SOCK_STREAM:
 648                         return SECCLASS_TCP_SOCKET;
 649                 case SOCK_DGRAM:
 650                         return SECCLASS_UDP_SOCKET;
 651                 case SOCK_RAW:
 652                         return SECCLASS_RAWIP_SOCKET;
 653                 }
 654                 break;
 655         case PF_NETLINK:
 656                 switch (protocol) {
 657                 case NETLINK_ROUTE:
 658                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 659                 case NETLINK_FIREWALL:
 660                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 661                 case NETLINK_TCPDIAG:
 662                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 663                 case NETLINK_NFLOG:
 664                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 665                 case NETLINK_XFRM:
 666                         return SECCLASS_NETLINK_XFRM_SOCKET;
 667                 case NETLINK_SELINUX:
 668                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 669                 case NETLINK_AUDIT:
 670                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 671                 case NETLINK_IP6_FW:
 672                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 673                 case NETLINK_DNRTMSG:
 674                         return SECCLASS_NETLINK_DNRT_SOCKET;
 675                 case NETLINK_KOBJECT_UEVENT:
 676                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 677                 default:
 678                         return SECCLASS_NETLINK_SOCKET;
 679                 }
 680         case PF_PACKET:
 681                 return SECCLASS_PACKET_SOCKET;
 682         case PF_KEY:
 683                 return SECCLASS_KEY_SOCKET;
 684         }
 685
 686         return SECCLASS_SOCKET;
 687 }
 688
 689 #ifdef CONFIG_PROC_FS
 690 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 691                                 u16 tclass,
 692                                 u32 *sid)
 693 {
 694         int buflen, rc;
 695         char *buffer, *path, *end;
 696
 697         buffer = (char*)__get_free_page(GFP_KERNEL);
 698         if (!buffer)
 699                 return -ENOMEM;
 700
 701         buflen = PAGE_SIZE;
 702         end = buffer+buflen;
 703         *--end = '\0';
 704         buflen--;
 705         path = end-1;
 706         *path = '/';
 707         while (de && de != de->parent) {
 708                 buflen -= de->namelen + 1;
 709                 if (buflen < 0)
 710                         break;
 711                 end -= de->namelen;
 712                 memcpy(end, de->name, de->namelen);
 713                 *--end = '/';
 714                 path = end;
 715                 de = de->parent;
 716         }
 717         rc = security_genfs_sid("proc", path, tclass, sid);
 718         free_page((unsigned long)buffer);
 719         return rc;
 720 }
 721 #else
 722 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 723                                 u16 tclass,
 724                                 u32 *sid)
 725 {
 726         return -EINVAL;
 727 }
 728 #endif
 729
 730 /* The inode's security attributes must be initialized before first use. */
 731 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 732 {
 733         struct superblock_security_struct *sbsec = NULL;
 734         struct inode_security_struct *isec = inode->i_security;
 735         u32 sid;
 736         struct dentry *dentry;
 737 #define INITCONTEXTLEN 255
 738         char *context = NULL;
 739         unsigned len = 0;
 740         int rc = 0;
 741         int hold_sem = 0;
 742
 743         if (isec->initialized)
 744                 goto out;
 745
 746         down(&isec->sem);
 747         hold_sem = 1;
 748         if (isec->initialized)
 749                 goto out;
 750
 751         sbsec = inode->i_sb->s_security;
 752         if (!sbsec->initialized) {
 753                 /* Defer initialization until selinux_complete_init,
 754                    after the initial policy is loaded and the security
 755                    server is ready to handle calls. */
 756                 spin_lock(&sbsec->isec_lock);
 757                 if (list_empty(&isec->list))
 758                         list_add(&isec->list, &sbsec->isec_head);
 759                 spin_unlock(&sbsec->isec_lock);
 760                 goto out;
 761         }
 762
 763         switch (sbsec->behavior) {
 764         case SECURITY_FS_USE_XATTR:
 765                 if (!inode->i_op->getxattr) {
 766                         isec->sid = sbsec->def_sid;
 767                         break;
 768                 }
 769
 770                 /* Need a dentry, since the xattr API requires one.
 771                    Life would be simpler if we could just pass the inode. */
 772                 if (opt_dentry) {
 773                         /* Called from d_instantiate or d_splice_alias. */
 774                         dentry = dget(opt_dentry);
 775                 } else {
 776                         /* Called from selinux_complete_init, try to find a dentry. */
 777                         dentry = d_find_alias(inode);
 778                 }
 779                 if (!dentry) {
 780                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 781                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 782                                inode->i_ino);
 783                         goto out;
 784                 }
 785
 786                 len = INITCONTEXTLEN;
 787                 context = kmalloc(len, GFP_KERNEL);
 788                 if (!context) {
 789                         rc = -ENOMEM;
 790                         dput(dentry);
 791                         goto out;
 792                 }
 793                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 794                                            context, len);
 795                 if (rc == -ERANGE) {
 796                         /* Need a larger buffer.  Query for the right size. */
 797                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 798                                                    NULL, 0);
 799                         if (rc < 0) {
 800                                 dput(dentry);
 801                                 goto out;
 802                         }
 803                         kfree(context);
 804                         len = rc;
 805                         context = kmalloc(len, GFP_KERNEL);
 806                         if (!context) {
 807                                 rc = -ENOMEM;
 808                                 dput(dentry);
 809                                 goto out;
 810                         }
 811                         rc = inode->i_op->getxattr(dentry,
 812                                                    XATTR_NAME_SELINUX,
 813                                                    context, len);
 814                 }
 815                 dput(dentry);
 816                 if (rc < 0) {
 817                         if (rc != -ENODATA) {
 818                                 printk(KERN_WARNING "%s:  getxattr returned "
 819                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 820                                        -rc, inode->i_sb->s_id, inode->i_ino);
 821                                 kfree(context);
 822                                 goto out;
 823                         }
 824                         /* Map ENODATA to the default file SID */
 825                         sid = sbsec->def_sid;
 826                         rc = 0;
 827                 } else {
 828                         rc = security_context_to_sid(context, rc, &sid);
 829                         if (rc) {
 830                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 831                                        "returned %d for dev=%s ino=%ld\n",
 832                                        __FUNCTION__, context, -rc,
 833                                        inode->i_sb->s_id, inode->i_ino);
 834                                 kfree(context);
 835                                 /* Leave with the unlabeled SID */
 836                                 rc = 0;
 837                                 break;
 838                         }
 839                 }
 840                 kfree(context);
 841                 isec->sid = sid;
 842                 break;
 843         case SECURITY_FS_USE_TASK:
 844                 isec->sid = isec->task_sid;
 845                 break;
 846         case SECURITY_FS_USE_TRANS:
 847                 /* Default to the fs SID. */
 848                 isec->sid = sbsec->sid;
 849
 850                 /* Try to obtain a transition SID. */
 851                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 852                 rc = security_transition_sid(isec->task_sid,
 853                                              sbsec->sid,
 854                                              isec->sclass,
 855                                              &sid);
 856                 if (rc)
 857                         goto out;
 858                 isec->sid = sid;
 859                 break;
 860         default:
 861                 /* Default to the fs SID. */
 862                 isec->sid = sbsec->sid;
 863
 864                 if (sbsec->proc) {
 865                         struct proc_inode *proci = PROC_I(inode);
 866                         if (proci->pde) {
 867                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 868                                 rc = selinux_proc_get_sid(proci->pde,
 869                                                           isec->sclass,
 870                                                           &sid);
 871                                 if (rc)
 872                                         goto out;
 873                                 isec->sid = sid;
 874                         }
 875                 }
 876                 break;
 877         }
 878
 879         isec->initialized = 1;
 880
 881 out:
 882         if (isec->sclass == SECCLASS_FILE)
 883                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 884
 885         if (hold_sem)
 886                 up(&isec->sem);
 887         return rc;
 888 }
 889
 890 /* Convert a Linux signal to an access vector. */
 891 static inline u32 signal_to_av(int sig)
 892 {
 893         u32 perm = 0;
 894
 895         switch (sig) {
 896         case SIGCHLD:
 897                 /* Commonly granted from child to parent. */
 898                 perm = PROCESS__SIGCHLD;
 899                 break;
 900         case SIGKILL:
 901                 /* Cannot be caught or ignored */
 902                 perm = PROCESS__SIGKILL;
 903                 break;
 904         case SIGSTOP:
 905                 /* Cannot be caught or ignored */
 906                 perm = PROCESS__SIGSTOP;
 907                 break;
 908         default:
 909                 /* All other signals. */
 910                 perm = PROCESS__SIGNAL;
 911                 break;
 912         }
 913
 914         return perm;
 915 }
 916
 917 /* Check permission betweeen a pair of tasks, e.g. signal checks,
 918    fork check, ptrace check, etc. */
 919 static int task_has_perm(struct task_struct *tsk1,
 920                          struct task_struct *tsk2,
 921                          u32 perms)
 922 {
 923         struct task_security_struct *tsec1, *tsec2;
 924
 925         tsec1 = tsk1->security;
 926         tsec2 = tsk2->security;
 927         return avc_has_perm(tsec1->sid, tsec2->sid,
 928                             SECCLASS_PROCESS, perms, NULL);
 929 }
 930
 931 /* Check whether a task is allowed to use a capability. */
 932 static int task_has_capability(struct task_struct *tsk,
 933                                int cap)
 934 {
 935         struct task_security_struct *tsec;
 936         struct avc_audit_data ad;
 937
 938         tsec = tsk->security;
 939
 940         AVC_AUDIT_DATA_INIT(&ad,CAP);
 941         ad.tsk = tsk;
 942         ad.u.cap = cap;
 943
 944         return avc_has_perm(tsec->sid, tsec->sid,
 945                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
 946 }
 947
 948 /* Check whether a task is allowed to use a system operation. */
 949 static int task_has_system(struct task_struct *tsk,
 950                            u32 perms)
 951 {
 952         struct task_security_struct *tsec;
 953
 954         tsec = tsk->security;
 955
 956         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
 957                             SECCLASS_SYSTEM, perms, NULL);
 958 }
 959
 960 /* Check whether a task has a particular permission to an inode.
 961    The 'adp' parameter is optional and allows other audit
 962    data to be passed (e.g. the dentry). */
 963 static int inode_has_perm(struct task_struct *tsk,
 964                           struct inode *inode,
 965                           u32 perms,
 966                           struct avc_audit_data *adp)
 967 {
 968         struct task_security_struct *tsec;
 969         struct inode_security_struct *isec;
 970         struct avc_audit_data ad;
 971
 972         tsec = tsk->security;
 973         isec = inode->i_security;
 974
 975         if (!adp) {
 976                 adp = &ad;
 977                 AVC_AUDIT_DATA_INIT(&ad, FS);
 978                 ad.u.fs.inode = inode;
 979         }
 980
 981         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
 982 }
 983
 984 /* Same as inode_has_perm, but pass explicit audit data containing
 985    the dentry to help the auditing code to more easily generate the
 986    pathname if needed. */
 987 static inline int dentry_has_perm(struct task_struct *tsk,
 988                                   struct vfsmount *mnt,
 989                                   struct dentry *dentry,
 990                                   u32 av)
 991 {
 992         struct inode *inode = dentry->d_inode;
 993         struct avc_audit_data ad;
 994         AVC_AUDIT_DATA_INIT(&ad,FS);
 995         ad.u.fs.mnt = mnt;
 996         ad.u.fs.dentry = dentry;
 997         return inode_has_perm(tsk, inode, av, &ad);
 998 }
 999
1000 /* Check whether a task can use an open file descriptor to
1001    access an inode in a given way.  Check access to the
1002    descriptor itself, and then use dentry_has_perm to
1003    check a particular permission to the file.
1004    Access to the descriptor is implicitly granted if it
1005    has the same SID as the process.  If av is zero, then
1006    access to the file is not checked, e.g. for cases
1007    where only the descriptor is affected like seek. */
1008 static inline int file_has_perm(struct task_struct *tsk,
1009                                 struct file *file,
1010                                 u32 av)
1011 {
1012         struct task_security_struct *tsec = tsk->security;
1013         struct file_security_struct *fsec = file->f_security;
1014         struct vfsmount *mnt = file->f_vfsmnt;
1015         struct dentry *dentry = file->f_dentry;
1016         struct inode *inode = dentry->d_inode;
1017         struct avc_audit_data ad;
1018         int rc;
1019
1020         AVC_AUDIT_DATA_INIT(&ad, FS);
1021         ad.u.fs.mnt = mnt;
1022         ad.u.fs.dentry = dentry;
1023
1024         if (tsec->sid != fsec->sid) {
1025                 rc = avc_has_perm(tsec->sid, fsec->sid,
1026                                   SECCLASS_FD,
1027                                   FD__USE,
1028                                   &ad);
1029                 if (rc)
1030                         return rc;
1031         }
1032
1033         /* av is zero if only checking access to the descriptor. */
1034         if (av)
1035                 return inode_has_perm(tsk, inode, av, &ad);
1036
1037         return 0;
1038 }
1039
1040 /* Check whether a task can create a file. */
1041 static int may_create(struct inode *dir,
1042                       struct dentry *dentry,
1043                       u16 tclass)
1044 {
1045         struct task_security_struct *tsec;
1046         struct inode_security_struct *dsec;
1047         struct superblock_security_struct *sbsec;
1048         u32 newsid;
1049         struct avc_audit_data ad;
1050         int rc;
1051
1052         tsec = current->security;
1053         dsec = dir->i_security;
1054         sbsec = dir->i_sb->s_security;
1055
1056         AVC_AUDIT_DATA_INIT(&ad, FS);
1057         ad.u.fs.dentry = dentry;
1058
1059         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1060                           DIR__ADD_NAME | DIR__SEARCH,
1061                           &ad);
1062         if (rc)
1063                 return rc;
1064
1065         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1066                 newsid = tsec->create_sid;
1067         } else {
1068                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1069                                              &newsid);
1070                 if (rc)
1071                         return rc;
1072         }
1073
1074         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1075         if (rc)
1076                 return rc;
1077
1078         return avc_has_perm(newsid, sbsec->sid,
1079                             SECCLASS_FILESYSTEM,
1080                             FILESYSTEM__ASSOCIATE, &ad);
1081 }
1082
1083 #define MAY_LINK   0
1084 #define MAY_UNLINK 1
1085 #define MAY_RMDIR  2
1086
1087 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1088 static int may_link(struct inode *dir,
1089                     struct dentry *dentry,
1090                     int kind)
1091
1092 {
1093         struct task_security_struct *tsec;
1094         struct inode_security_struct *dsec, *isec;
1095         struct avc_audit_data ad;
1096         u32 av;
1097         int rc;
1098
1099         tsec = current->security;
1100         dsec = dir->i_security;
1101         isec = dentry->d_inode->i_security;
1102
1103         AVC_AUDIT_DATA_INIT(&ad, FS);
1104         ad.u.fs.dentry = dentry;
1105
1106         av = DIR__SEARCH;
1107         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1108         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1109         if (rc)
1110                 return rc;
1111
1112         switch (kind) {
1113         case MAY_LINK:
1114                 av = FILE__LINK;
1115                 break;
1116         case MAY_UNLINK:
1117                 av = FILE__UNLINK;
1118                 break;
1119         case MAY_RMDIR:
1120                 av = DIR__RMDIR;
1121                 break;
1122         default:
1123                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1124                 return 0;
1125         }
1126
1127         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1128         return rc;
1129 }
1130
1131 static inline int may_rename(struct inode *old_dir,
1132                              struct dentry *old_dentry,
1133                              struct inode *new_dir,
1134                              struct dentry *new_dentry)
1135 {
1136         struct task_security_struct *tsec;
1137         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1138         struct avc_audit_data ad;
1139         u32 av;
1140         int old_is_dir, new_is_dir;
1141         int rc;
1142
1143         tsec = current->security;
1144         old_dsec = old_dir->i_security;
1145         old_isec = old_dentry->d_inode->i_security;
1146         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1147         new_dsec = new_dir->i_security;
1148
1149         AVC_AUDIT_DATA_INIT(&ad, FS);
1150
1151         ad.u.fs.dentry = old_dentry;
1152         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1153                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1154         if (rc)
1155                 return rc;
1156         rc = avc_has_perm(tsec->sid, old_isec->sid,
1157                           old_isec->sclass, FILE__RENAME, &ad);
1158         if (rc)
1159                 return rc;
1160         if (old_is_dir && new_dir != old_dir) {
1161                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1162                                   old_isec->sclass, DIR__REPARENT, &ad);
1163                 if (rc)
1164                         return rc;
1165         }
1166
1167         ad.u.fs.dentry = new_dentry;
1168         av = DIR__ADD_NAME | DIR__SEARCH;
1169         if (new_dentry->d_inode)
1170                 av |= DIR__REMOVE_NAME;
1171         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1172         if (rc)
1173                 return rc;
1174         if (new_dentry->d_inode) {
1175                 new_isec = new_dentry->d_inode->i_security;
1176                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1177                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1178                                   new_isec->sclass,
1179                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1180                 if (rc)
1181                         return rc;
1182         }
1183
1184         return 0;
1185 }
1186
1187 /* Check whether a task can perform a filesystem operation. */
1188 static int superblock_has_perm(struct task_struct *tsk,
1189                                struct super_block *sb,
1190                                u32 perms,
1191                                struct avc_audit_data *ad)
1192 {
1193         struct task_security_struct *tsec;
1194         struct superblock_security_struct *sbsec;
1195
1196         tsec = tsk->security;
1197         sbsec = sb->s_security;
1198         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1199                             perms, ad);
1200 }
1201
1202 /* Convert a Linux mode and permission mask to an access vector. */
1203 static inline u32 file_mask_to_av(int mode, int mask)
1204 {
1205         u32 av = 0;
1206
1207         if ((mode & S_IFMT) != S_IFDIR) {
1208                 if (mask & MAY_EXEC)
1209                         av |= FILE__EXECUTE;
1210                 if (mask & MAY_READ)
1211                         av |= FILE__READ;
1212
1213                 if (mask & MAY_APPEND)
1214                         av |= FILE__APPEND;
1215                 else if (mask & MAY_WRITE)
1216                         av |= FILE__WRITE;
1217
1218         } else {
1219                 if (mask & MAY_EXEC)
1220                         av |= DIR__SEARCH;
1221                 if (mask & MAY_WRITE)
1222                         av |= DIR__WRITE;
1223                 if (mask & MAY_READ)
1224                         av |= DIR__READ;
1225         }
1226
1227         return av;
1228 }
1229
1230 /* Convert a Linux file to an access vector. */
1231 static inline u32 file_to_av(struct file *file)
1232 {
1233         u32 av = 0;
1234
1235         if (file->f_mode & FMODE_READ)
1236                 av |= FILE__READ;
1237         if (file->f_mode & FMODE_WRITE) {
1238                 if (file->f_flags & O_APPEND)
1239                         av |= FILE__APPEND;
1240                 else
1241                         av |= FILE__WRITE;
1242         }
1243
1244         return av;
1245 }
1246
1247 /* Set an inode's SID to a specified value. */
1248 static int inode_security_set_sid(struct inode *inode, u32 sid)
1249 {
1250         struct inode_security_struct *isec = inode->i_security;
1251         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
1252
1253         if (!sbsec->initialized) {
1254                 /* Defer initialization to selinux_complete_init. */
1255                 return 0;
1256         }
1257
1258         down(&isec->sem);
1259         isec->sclass = inode_mode_to_security_class(inode->i_mode);
1260         isec->sid = sid;
1261         isec->initialized = 1;
1262         up(&isec->sem);
1263         return 0;
1264 }
1265
1266 /* Set the security attributes on a newly created file. */
1267 static int post_create(struct inode *dir,
1268                        struct dentry *dentry)
1269 {
1270
1271         struct task_security_struct *tsec;
1272         struct inode *inode;
1273         struct inode_security_struct *dsec;
1274         struct superblock_security_struct *sbsec;
1275         u32 newsid;
1276         char *context;
1277         unsigned int len;
1278         int rc;
1279
1280         tsec = current->security;
1281         dsec = dir->i_security;
1282         sbsec = dir->i_sb->s_security;
1283
1284         inode = dentry->d_inode;
1285         if (!inode) {
1286                 /* Some file system types (e.g. NFS) may not instantiate
1287                    a dentry for all create operations (e.g. symlink),
1288                    so we have to check to see if the inode is non-NULL. */
1289                 printk(KERN_WARNING "post_create:  no inode, dir (dev=%s, "
1290                        "ino=%ld)\n", dir->i_sb->s_id, dir->i_ino);
1291                 return 0;
1292         }
1293
1294         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1295                 newsid = tsec->create_sid;
1296         } else {
1297                 rc = security_transition_sid(tsec->sid, dsec->sid,
1298                                              inode_mode_to_security_class(inode->i_mode),
1299                                              &newsid);
1300                 if (rc) {
1301                         printk(KERN_WARNING "post_create:  "
1302                                "security_transition_sid failed, rc=%d (dev=%s "
1303                                "ino=%ld)\n",
1304                                -rc, inode->i_sb->s_id, inode->i_ino);
1305                         return rc;
1306                 }
1307         }
1308
1309         rc = inode_security_set_sid(inode, newsid);
1310         if (rc) {
1311                 printk(KERN_WARNING "post_create:  inode_security_set_sid "
1312                        "failed, rc=%d (dev=%s ino=%ld)\n",
1313                        -rc, inode->i_sb->s_id, inode->i_ino);
1314                 return rc;
1315         }
1316
1317         if (sbsec->behavior == SECURITY_FS_USE_XATTR &&
1318             inode->i_op->setxattr) {
1319                 /* Use extended attributes. */
1320                 rc = security_sid_to_context(newsid, &context, &len);
1321                 if (rc) {
1322                         printk(KERN_WARNING "post_create:  sid_to_context "
1323                                "failed, rc=%d (dev=%s ino=%ld)\n",
1324                                -rc, inode->i_sb->s_id, inode->i_ino);
1325                         return rc;
1326                 }
1327                 down(&inode->i_sem);
1328                 rc = inode->i_op->setxattr(dentry,
1329                                            XATTR_NAME_SELINUX,
1330                                            context, len, 0);
1331                 up(&inode->i_sem);
1332                 kfree(context);
1333                 if (rc < 0) {
1334                         printk(KERN_WARNING "post_create:  setxattr failed, "
1335                                "rc=%d (dev=%s ino=%ld)\n",
1336                                -rc, inode->i_sb->s_id, inode->i_ino);
1337                         return rc;
1338                 }
1339         }
1340
1341         return 0;
1342 }
1343
1344
1345 /* Hook functions begin here. */
1346
1347 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1348 {
1349         struct task_security_struct *psec = parent->security;
1350         struct task_security_struct *csec = child->security;
1351         int rc;
1352
1353         rc = secondary_ops->ptrace(parent,child);
1354         if (rc)
1355                 return rc;
1356
1357         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1358         /* Save the SID of the tracing process for later use in apply_creds. */
1359         if (!rc)
1360                 csec->ptrace_sid = psec->sid;
1361         return rc;
1362 }
1363
1364 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1365                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1366 {
1367         int error;
1368
1369         error = task_has_perm(current, target, PROCESS__GETCAP);
1370         if (error)
1371                 return error;
1372
1373         return secondary_ops->capget(target, effective, inheritable, permitted);
1374 }
1375
1376 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1377                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1378 {
1379         int error;
1380
1381         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1382         if (error)
1383                 return error;
1384
1385         return task_has_perm(current, target, PROCESS__SETCAP);
1386 }
1387
1388 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1389                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1390 {
1391         secondary_ops->capset_set(target, effective, inheritable, permitted);
1392 }
1393
1394 static int selinux_capable(struct task_struct *tsk, int cap)
1395 {
1396         int rc;
1397
1398         rc = secondary_ops->capable(tsk, cap);
1399         if (rc)
1400                 return rc;
1401
1402         return task_has_capability(tsk,cap);
1403 }
1404
1405 static int selinux_sysctl(ctl_table *table, int op)
1406 {
1407         int error = 0;
1408         u32 av;
1409         struct task_security_struct *tsec;
1410         u32 tsid;
1411         int rc;
1412
1413         rc = secondary_ops->sysctl(table, op);
1414         if (rc)
1415                 return rc;
1416
1417         tsec = current->security;
1418
1419         rc = selinux_proc_get_sid(table->de, (op == 001) ?
1420                                   SECCLASS_DIR : SECCLASS_FILE, &tsid);
1421         if (rc) {
1422                 /* Default to the well-defined sysctl SID. */
1423                 tsid = SECINITSID_SYSCTL;
1424         }
1425
1426         /* The op values are "defined" in sysctl.c, thereby creating
1427          * a bad coupling between this module and sysctl.c */
1428         if(op == 001) {
1429                 error = avc_has_perm(tsec->sid, tsid,
1430                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1431         } else {
1432                 av = 0;
1433                 if (op & 004)
1434                         av |= FILE__READ;
1435                 if (op & 002)
1436                         av |= FILE__WRITE;
1437                 if (av)
1438                         error = avc_has_perm(tsec->sid, tsid,
1439                                              SECCLASS_FILE, av, NULL);
1440         }
1441
1442         return error;
1443 }
1444
1445 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1446 {
1447         int rc = 0;
1448
1449         if (!sb)
1450                 return 0;
1451
1452         switch (cmds) {
1453                 case Q_SYNC:
1454                 case Q_QUOTAON:
1455                 case Q_QUOTAOFF:
1456                 case Q_SETINFO:
1457                 case Q_SETQUOTA:
1458                         rc = superblock_has_perm(current,
1459                                                  sb,
1460                                                  FILESYSTEM__QUOTAMOD, NULL);
1461                         break;
1462                 case Q_GETFMT:
1463                 case Q_GETINFO:
1464                 case Q_GETQUOTA:
1465                         rc = superblock_has_perm(current,
1466                                                  sb,
1467                                                  FILESYSTEM__QUOTAGET, NULL);
1468                         break;
1469                 default:
1470                         rc = 0;  /* let the kernel handle invalid cmds */
1471                         break;
1472         }
1473         return rc;
1474 }
1475
1476 static int selinux_quota_on(struct dentry *dentry)
1477 {
1478         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1479 }
1480
1481 static int selinux_syslog(int type)
1482 {
1483         int rc;
1484
1485         rc = secondary_ops->syslog(type);
1486         if (rc)
1487                 return rc;
1488
1489         switch (type) {
1490                 case 3:         /* Read last kernel messages */
1491                 case 10:        /* Return size of the log buffer */
1492                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1493                         break;
1494                 case 6:         /* Disable logging to console */
1495                 case 7:         /* Enable logging to console */
1496                 case 8:         /* Set level of messages printed to console */
1497                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1498                         break;
1499                 case 0:         /* Close log */
1500                 case 1:         /* Open log */
1501                 case 2:         /* Read from log */
1502                 case 4:         /* Read/clear last kernel messages */
1503                 case 5:         /* Clear ring buffer */
1504                 default:
1505                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1506                         break;
1507         }
1508         return rc;
1509 }
1510
1511 /*
1512  * Check that a process has enough memory to allocate a new virtual
1513  * mapping. 0 means there is enough memory for the allocation to
1514  * succeed and -ENOMEM implies there is not.
1515  *
1516  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1517  * if the capability is granted, but __vm_enough_memory requires 1 if
1518  * the capability is granted.
1519  *
1520  * Do not audit the selinux permission check, as this is applied to all
1521  * processes that allocate mappings.
1522  */
1523 static int selinux_vm_enough_memory(long pages)
1524 {
1525         int rc, cap_sys_admin = 0;
1526         struct task_security_struct *tsec = current->security;
1527
1528         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1529         if (rc == 0)
1530                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1531                                         SECCLASS_CAPABILITY,
1532                                         CAP_TO_MASK(CAP_SYS_ADMIN),
1533                                         NULL);
1534
1535         if (rc == 0)
1536                 cap_sys_admin = 1;
1537
1538         return __vm_enough_memory(pages, cap_sys_admin);
1539 }
1540
1541 /* binprm security operations */
1542
1543 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1544 {
1545         struct bprm_security_struct *bsec;
1546
1547         bsec = kmalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1548         if (!bsec)
1549                 return -ENOMEM;
1550
1551         memset(bsec, 0, sizeof *bsec);
1552         bsec->magic = SELINUX_MAGIC;
1553         bsec->bprm = bprm;
1554         bsec->sid = SECINITSID_UNLABELED;
1555         bsec->set = 0;
1556
1557         bprm->security = bsec;
1558         return 0;
1559 }
1560
1561 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1562 {
1563         struct task_security_struct *tsec;
1564         struct inode *inode = bprm->file->f_dentry->d_inode;
1565         struct inode_security_struct *isec;
1566         struct bprm_security_struct *bsec;
1567         u32 newsid;
1568         struct avc_audit_data ad;
1569         int rc;
1570
1571         rc = secondary_ops->bprm_set_security(bprm);
1572         if (rc)
1573                 return rc;
1574
1575         bsec = bprm->security;
1576
1577         if (bsec->set)
1578                 return 0;
1579
1580         tsec = current->security;
1581         isec = inode->i_security;
1582
1583         /* Default to the current task SID. */
1584         bsec->sid = tsec->sid;
1585
1586         /* Reset create SID on execve. */
1587         tsec->create_sid = 0;
1588
1589         if (tsec->exec_sid) {
1590                 newsid = tsec->exec_sid;
1591                 /* Reset exec SID on execve. */
1592                 tsec->exec_sid = 0;
1593         } else {
1594                 /* Check for a default transition on this program. */
1595                 rc = security_transition_sid(tsec->sid, isec->sid,
1596                                              SECCLASS_PROCESS, &newsid);
1597                 if (rc)
1598                         return rc;
1599         }
1600
1601         AVC_AUDIT_DATA_INIT(&ad, FS);
1602         ad.u.fs.mnt = bprm->file->f_vfsmnt;
1603         ad.u.fs.dentry = bprm->file->f_dentry;
1604
1605         if (bprm->file->f_vfsmnt->mnt_flags & MNT_NOSUID)
1606                 newsid = tsec->sid;
1607
1608         if (tsec->sid == newsid) {
1609                 rc = avc_has_perm(tsec->sid, isec->sid,
1610                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1611                 if (rc)
1612                         return rc;
1613         } else {
1614                 /* Check permissions for the transition. */
1615                 rc = avc_has_perm(tsec->sid, newsid,
1616                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1617                 if (rc)
1618                         return rc;
1619
1620                 rc = avc_has_perm(newsid, isec->sid,
1621                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1622                 if (rc)
1623                         return rc;
1624
1625                 /* Clear any possibly unsafe personality bits on exec: */
1626                 current->personality &= ~PER_CLEAR_ON_SETID;
1627
1628                 /* Set the security field to the new SID. */
1629                 bsec->sid = newsid;
1630         }
1631
1632         bsec->set = 1;
1633         return 0;
1634 }
1635
1636 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1637 {
1638         return secondary_ops->bprm_check_security(bprm);
1639 }
1640
1641
1642 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1643 {
1644         struct task_security_struct *tsec = current->security;
1645         int atsecure = 0;
1646
1647         if (tsec->osid != tsec->sid) {
1648                 /* Enable secure mode for SIDs transitions unless
1649                    the noatsecure permission is granted between
1650                    the two SIDs, i.e. ahp returns 0. */
1651                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1652                                          SECCLASS_PROCESS,
1653                                          PROCESS__NOATSECURE, NULL);
1654         }
1655
1656         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1657 }
1658
1659 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1660 {
1661         kfree(bprm->security);
1662         bprm->security = NULL;
1663 }
1664
1665 extern struct vfsmount *selinuxfs_mount;
1666 extern struct dentry *selinux_null;
1667
1668 /* Derived from fs/exec.c:flush_old_files. */
1669 static inline void flush_unauthorized_files(struct files_struct * files)
1670 {
1671         struct avc_audit_data ad;
1672         struct file *file, *devnull = NULL;
1673         struct tty_struct *tty = current->signal->tty;
1674         long j = -1;
1675
1676         if (tty) {
1677                 file_list_lock();
1678                 file = list_entry(tty->tty_files.next, typeof(*file), f_list);
1679                 if (file) {
1680                         /* Revalidate access to controlling tty.
1681                            Use inode_has_perm on the tty inode directly rather
1682                            than using file_has_perm, as this particular open
1683                            file may belong to another process and we are only
1684                            interested in the inode-based check here. */
1685                         struct inode *inode = file->f_dentry->d_inode;
1686                         if (inode_has_perm(current, inode,
1687                                            FILE__READ | FILE__WRITE, NULL)) {
1688                                 /* Reset controlling tty. */
1689                                 current->signal->tty = NULL;
1690                                 current->signal->tty_old_pgrp = 0;
1691                         }
1692                 }
1693                 file_list_unlock();
1694         }
1695
1696         /* Revalidate access to inherited open files. */
1697
1698         AVC_AUDIT_DATA_INIT(&ad,FS);
1699
1700         spin_lock(&files->file_lock);
1701         for (;;) {
1702                 unsigned long set, i;
1703                 int fd;
1704
1705                 j++;
1706                 i = j * __NFDBITS;
1707                 if (i >= files->max_fds || i >= files->max_fdset)
1708                         break;
1709                 set = files->open_fds->fds_bits[j];
1710                 if (!set)
1711                         continue;
1712                 spin_unlock(&files->file_lock);
1713                 for ( ; set ; i++,set >>= 1) {
1714                         if (set & 1) {
1715                                 file = fget(i);
1716                                 if (!file)
1717                                         continue;
1718                                 if (file_has_perm(current,
1719                                                   file,
1720                                                   file_to_av(file))) {
1721                                         sys_close(i);
1722                                         fd = get_unused_fd();
1723                                         if (fd != i) {
1724                                                 if (fd >= 0)
1725                                                         put_unused_fd(fd);
1726                                                 fput(file);
1727                                                 continue;
1728                                         }
1729                                         if (devnull) {
1730                                                 atomic_inc(&devnull->f_count);
1731                                         } else {
1732                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1733                                                 if (!devnull) {
1734                                                         put_unused_fd(fd);
1735                                                         fput(file);
1736                                                         continue;
1737                                                 }
1738                                         }
1739                                         fd_install(fd, devnull);
1740                                 }
1741                                 fput(file);
1742                         }
1743                 }
1744                 spin_lock(&files->file_lock);
1745
1746         }
1747         spin_unlock(&files->file_lock);
1748 }
1749
1750 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1751 {
1752         struct task_security_struct *tsec;
1753         struct bprm_security_struct *bsec;
1754         u32 sid;
1755         int rc;
1756
1757         secondary_ops->bprm_apply_creds(bprm, unsafe);
1758
1759         tsec = current->security;
1760
1761         bsec = bprm->security;
1762         sid = bsec->sid;
1763
1764         tsec->osid = tsec->sid;
1765         bsec->unsafe = 0;
1766         if (tsec->sid != sid) {
1767                 /* Check for shared state.  If not ok, leave SID
1768                    unchanged and kill. */
1769                 if (unsafe & LSM_UNSAFE_SHARE) {
1770                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1771                                         PROCESS__SHARE, NULL);
1772                         if (rc) {
1773                                 bsec->unsafe = 1;
1774                                 return;
1775                         }
1776                 }
1777
1778                 /* Check for ptracing, and update the task SID if ok.
1779                    Otherwise, leave SID unchanged and kill. */
1780                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1781                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1782                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1783                                           NULL);
1784                         if (rc) {
1785                                 bsec->unsafe = 1;
1786                                 return;
1787                         }
1788                 }
1789                 tsec->sid = sid;
1790         }
1791 }
1792
1793 /*
1794  * called after apply_creds without the task lock held
1795  */
1796 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1797 {
1798         struct task_security_struct *tsec;
1799         struct rlimit *rlim, *initrlim;
1800         struct itimerval itimer;
1801         struct bprm_security_struct *bsec;
1802         int rc, i;
1803
1804         tsec = current->security;
1805         bsec = bprm->security;
1806
1807         if (bsec->unsafe) {
1808                 force_sig_specific(SIGKILL, current);
1809                 return;
1810         }
1811         if (tsec->osid == tsec->sid)
1812                 return;
1813
1814         /* Close files for which the new task SID is not authorized. */
1815         flush_unauthorized_files(current->files);
1816
1817         /* Check whether the new SID can inherit signal state
1818            from the old SID.  If not, clear itimers to avoid
1819            subsequent signal generation and flush and unblock
1820            signals. This must occur _after_ the task SID has
1821           been updated so that any kill done after the flush
1822           will be checked against the new SID. */
1823         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1824                           PROCESS__SIGINH, NULL);
1825         if (rc) {
1826                 memset(&itimer, 0, sizeof itimer);
1827                 for (i = 0; i < 3; i++)
1828                         do_setitimer(i, &itimer, NULL);
1829                 flush_signals(current);
1830                 spin_lock_irq(&current->sighand->siglock);
1831                 flush_signal_handlers(current, 1);
1832                 sigemptyset(&current->blocked);
1833                 recalc_sigpending();
1834                 spin_unlock_irq(&current->sighand->siglock);
1835         }
1836
1837         /* Check whether the new SID can inherit resource limits
1838            from the old SID.  If not, reset all soft limits to
1839            the lower of the current task's hard limit and the init
1840            task's soft limit.  Note that the setting of hard limits
1841            (even to lower them) can be controlled by the setrlimit
1842            check. The inclusion of the init task's soft limit into
1843            the computation is to avoid resetting soft limits higher
1844            than the default soft limit for cases where the default
1845            is lower than the hard limit, e.g. RLIMIT_CORE or
1846            RLIMIT_STACK.*/
1847         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1848                           PROCESS__RLIMITINH, NULL);
1849         if (rc) {
1850                 for (i = 0; i < RLIM_NLIMITS; i++) {
1851                         rlim = current->signal->rlim + i;
1852                         initrlim = init_task.signal->rlim+i;
1853                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1854                 }
1855                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1856                         /*
1857                          * This will cause RLIMIT_CPU calculations
1858                          * to be refigured.
1859                          */
1860                         current->it_prof_expires = jiffies_to_cputime(1);
1861                 }
1862         }
1863
1864         /* Wake up the parent if it is waiting so that it can
1865            recheck wait permission to the new task SID. */
1866         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1867 }
1868
1869 /* superblock security operations */
1870
1871 static int selinux_sb_alloc_security(struct super_block *sb)
1872 {
1873         return superblock_alloc_security(sb);
1874 }
1875
1876 static void selinux_sb_free_security(struct super_block *sb)
1877 {
1878         superblock_free_security(sb);
1879 }
1880
1881 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1882 {
1883         if (plen > olen)
1884                 return 0;
1885
1886         return !memcmp(prefix, option, plen);
1887 }
1888
1889 static inline int selinux_option(char *option, int len)
1890 {
1891         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1892                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1893                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len));
1894 }
1895
1896 static inline void take_option(char **to, char *from, int *first, int len)
1897 {
1898         if (!*first) {
1899                 **to = ',';
1900                 *to += 1;
1901         }
1902         else
1903                 *first = 0;
1904         memcpy(*to, from, len);
1905         *to += len;
1906 }
1907
1908 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
1909 {
1910         int fnosec, fsec, rc = 0;
1911         char *in_save, *in_curr, *in_end;
1912         char *sec_curr, *nosec_save, *nosec;
1913
1914         in_curr = orig;
1915         sec_curr = copy;
1916
1917         /* Binary mount data: just copy */
1918         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
1919                 copy_page(sec_curr, in_curr);
1920                 goto out;
1921         }
1922
1923         nosec = (char *)get_zeroed_page(GFP_KERNEL);
1924         if (!nosec) {
1925                 rc = -ENOMEM;
1926                 goto out;
1927         }
1928
1929         nosec_save = nosec;
1930         fnosec = fsec = 1;
1931         in_save = in_end = orig;
1932
1933         do {
1934                 if (*in_end == ',' || *in_end == '\0') {
1935                         int len = in_end - in_curr;
1936
1937                         if (selinux_option(in_curr, len))
1938                                 take_option(&sec_curr, in_curr, &fsec, len);
1939                         else
1940                                 take_option(&nosec, in_curr, &fnosec, len);
1941
1942                         in_curr = in_end + 1;
1943                 }
1944         } while (*in_end++);
1945
1946         copy_page(in_save, nosec_save);
1947         free_page((unsigned long)nosec_save);
1948 out:
1949         return rc;
1950 }
1951
1952 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
1953 {
1954         struct avc_audit_data ad;
1955         int rc;
1956
1957         rc = superblock_doinit(sb, data);
1958         if (rc)
1959                 return rc;
1960
1961         AVC_AUDIT_DATA_INIT(&ad,FS);
1962         ad.u.fs.dentry = sb->s_root;
1963         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
1964 }
1965
1966 static int selinux_sb_statfs(struct super_block *sb)
1967 {
1968         struct avc_audit_data ad;
1969
1970         AVC_AUDIT_DATA_INIT(&ad,FS);
1971         ad.u.fs.dentry = sb->s_root;
1972         return superblock_has_perm(current, sb, FILESYSTEM__GETATTR, &ad);
1973 }
1974
1975 static int selinux_mount(char * dev_name,
1976                          struct nameidata *nd,
1977                          char * type,
1978                          unsigned long flags,
1979                          void * data)
1980 {
1981         int rc;
1982
1983         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
1984         if (rc)
1985                 return rc;
1986
1987         if (flags & MS_REMOUNT)
1988                 return superblock_has_perm(current, nd->mnt->mnt_sb,
1989                                            FILESYSTEM__REMOUNT, NULL);
1990         else
1991                 return dentry_has_perm(current, nd->mnt, nd->dentry,
1992                                        FILE__MOUNTON);
1993 }
1994
1995 static int selinux_umount(struct vfsmount *mnt, int flags)
1996 {
1997         int rc;
1998
1999         rc = secondary_ops->sb_umount(mnt, flags);
2000         if (rc)
2001                 return rc;
2002
2003         return superblock_has_perm(current,mnt->mnt_sb,
2004                                    FILESYSTEM__UNMOUNT,NULL);
2005 }
2006
2007 /* inode security operations */
2008
2009 static int selinux_inode_alloc_security(struct inode *inode)
2010 {
2011         return inode_alloc_security(inode);
2012 }
2013
2014 static void selinux_inode_free_security(struct inode *inode)
2015 {
2016         inode_free_security(inode);
2017 }
2018
2019 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2020 {
2021         return may_create(dir, dentry, SECCLASS_FILE);
2022 }
2023
2024 static void selinux_inode_post_create(struct inode *dir, struct dentry *dentry, int mask)
2025 {
2026         post_create(dir, dentry);
2027 }
2028
2029 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2030 {
2031         int rc;
2032
2033         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2034         if (rc)
2035                 return rc;
2036         return may_link(dir, old_dentry, MAY_LINK);
2037 }
2038
2039 static void selinux_inode_post_link(struct dentry *old_dentry, struct inode *inode, struct dentry *new_dentry)
2040 {
2041         return;
2042 }
2043
2044 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2045 {
2046         int rc;
2047
2048         rc = secondary_ops->inode_unlink(dir, dentry);
2049         if (rc)
2050                 return rc;
2051         return may_link(dir, dentry, MAY_UNLINK);
2052 }
2053
2054 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2055 {
2056         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2057 }
2058
2059 static void selinux_inode_post_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2060 {
2061         post_create(dir, dentry);
2062 }
2063
2064 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2065 {
2066         return may_create(dir, dentry, SECCLASS_DIR);
2067 }
2068
2069 static void selinux_inode_post_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2070 {
2071         post_create(dir, dentry);
2072 }
2073
2074 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2075 {
2076         return may_link(dir, dentry, MAY_RMDIR);
2077 }
2078
2079 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2080 {
2081         int rc;
2082
2083         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2084         if (rc)
2085                 return rc;
2086
2087         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2088 }
2089
2090 static void selinux_inode_post_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2091 {
2092         post_create(dir, dentry);
2093 }
2094
2095 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2096                                 struct inode *new_inode, struct dentry *new_dentry)
2097 {
2098         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2099 }
2100
2101 static void selinux_inode_post_rename(struct inode *old_inode, struct dentry *old_dentry,
2102                                       struct inode *new_inode, struct dentry *new_dentry)
2103 {
2104         return;
2105 }
2106
2107 static int selinux_inode_readlink(struct dentry *dentry)
2108 {
2109         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2110 }
2111
2112 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2113 {
2114         int rc;
2115
2116         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2117         if (rc)
2118                 return rc;
2119         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2120 }
2121
2122 static int selinux_inode_permission(struct inode *inode, int mask,
2123                                     struct nameidata *nd)
2124 {
2125         int rc;
2126
2127         rc = secondary_ops->inode_permission(inode, mask, nd);
2128         if (rc)
2129                 return rc;
2130
2131         if (!mask) {
2132                 /* No permission to check.  Existence test. */
2133                 return 0;
2134         }
2135
2136         return inode_has_perm(current, inode,
2137                                file_mask_to_av(inode->i_mode, mask), NULL);
2138 }
2139
2140 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2141 {
2142         int rc;
2143
2144         rc = secondary_ops->inode_setattr(dentry, iattr);
2145         if (rc)
2146                 return rc;
2147
2148         if (iattr->ia_valid & ATTR_FORCE)
2149                 return 0;
2150
2151         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2152                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2153                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2154
2155         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2156 }
2157
2158 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2159 {
2160         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2161 }
2162
2163 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2164 {
2165         struct task_security_struct *tsec = current->security;
2166         struct inode *inode = dentry->d_inode;
2167         struct inode_security_struct *isec = inode->i_security;
2168         struct superblock_security_struct *sbsec;
2169         struct avc_audit_data ad;
2170         u32 newsid;
2171         int rc = 0;
2172
2173         if (strcmp(name, XATTR_NAME_SELINUX)) {
2174                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2175                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2176                     !capable(CAP_SYS_ADMIN)) {
2177                         /* A different attribute in the security namespace.
2178                            Restrict to administrator. */
2179                         return -EPERM;
2180                 }
2181
2182                 /* Not an attribute we recognize, so just check the
2183                    ordinary setattr permission. */
2184                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2185         }
2186
2187         sbsec = inode->i_sb->s_security;
2188         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2189                 return -EOPNOTSUPP;
2190
2191         if ((current->fsuid != inode->i_uid) && !capable(CAP_FOWNER))
2192                 return -EPERM;
2193
2194         AVC_AUDIT_DATA_INIT(&ad,FS);
2195         ad.u.fs.dentry = dentry;
2196
2197         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2198                           FILE__RELABELFROM, &ad);
2199         if (rc)
2200                 return rc;
2201
2202         rc = security_context_to_sid(value, size, &newsid);
2203         if (rc)
2204                 return rc;
2205
2206         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2207                           FILE__RELABELTO, &ad);
2208         if (rc)
2209                 return rc;
2210
2211         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2212                                           isec->sclass);
2213         if (rc)
2214                 return rc;
2215
2216         return avc_has_perm(newsid,
2217                             sbsec->sid,
2218                             SECCLASS_FILESYSTEM,
2219                             FILESYSTEM__ASSOCIATE,
2220                             &ad);
2221 }
2222
2223 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2224                                         void *value, size_t size, int flags)
2225 {
2226         struct inode *inode = dentry->d_inode;
2227         struct inode_security_struct *isec = inode->i_security;
2228         u32 newsid;
2229         int rc;
2230
2231         if (strcmp(name, XATTR_NAME_SELINUX)) {
2232                 /* Not an attribute we recognize, so nothing to do. */
2233                 return;
2234         }
2235
2236         rc = security_context_to_sid(value, size, &newsid);
2237         if (rc) {
2238                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2239                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2240                 return;
2241         }
2242
2243         isec->sid = newsid;
2244         return;
2245 }
2246
2247 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2248 {
2249         struct inode *inode = dentry->d_inode;
2250         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
2251
2252         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2253                 return -EOPNOTSUPP;
2254
2255         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2256 }
2257
2258 static int selinux_inode_listxattr (struct dentry *dentry)
2259 {
2260         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2261 }
2262
2263 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2264 {
2265         if (strcmp(name, XATTR_NAME_SELINUX)) {
2266                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2267                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2268                     !capable(CAP_SYS_ADMIN)) {
2269                         /* A different attribute in the security namespace.
2270                            Restrict to administrator. */
2271                         return -EPERM;
2272                 }
2273
2274                 /* Not an attribute we recognize, so just check the
2275                    ordinary setattr permission. Might want a separate
2276                    permission for removexattr. */
2277                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2278         }
2279
2280         /* No one is allowed to remove a SELinux security label.
2281            You can change the label, but all data must be labeled. */
2282         return -EACCES;
2283 }
2284
2285 static int selinux_inode_getsecurity(struct inode *inode, const char *name, void *buffer, size_t size)
2286 {
2287         struct inode_security_struct *isec = inode->i_security;
2288         char *context;
2289         unsigned len;
2290         int rc;
2291
2292         /* Permission check handled by selinux_inode_getxattr hook.*/
2293
2294         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2295                 return -EOPNOTSUPP;
2296
2297         rc = security_sid_to_context(isec->sid, &context, &len);
2298         if (rc)
2299                 return rc;
2300
2301         if (!buffer || !size) {
2302                 kfree(context);
2303                 return len;
2304         }
2305         if (size < len) {
2306                 kfree(context);
2307                 return -ERANGE;
2308         }
2309         memcpy(buffer, context, len);
2310         kfree(context);
2311         return len;
2312 }
2313
2314 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2315                                      const void *value, size_t size, int flags)
2316 {
2317         struct inode_security_struct *isec = inode->i_security;
2318         u32 newsid;
2319         int rc;
2320
2321         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2322                 return -EOPNOTSUPP;
2323
2324         if (!value || !size)
2325                 return -EACCES;
2326
2327         rc = security_context_to_sid((void*)value, size, &newsid);
2328         if (rc)
2329                 return rc;
2330
2331         isec->sid = newsid;
2332         return 0;
2333 }
2334
2335 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2336 {
2337         const int len = sizeof(XATTR_NAME_SELINUX);
2338         if (buffer && len <= buffer_size)
2339                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2340         return len;
2341 }
2342
2343 /* file security operations */
2344
2345 static int selinux_file_permission(struct file *file, int mask)
2346 {
2347         struct inode *inode = file->f_dentry->d_inode;
2348
2349         if (!mask) {
2350                 /* No permission to check.  Existence test. */
2351                 return 0;
2352         }
2353
2354         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2355         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2356                 mask |= MAY_APPEND;
2357
2358         return file_has_perm(current, file,
2359                              file_mask_to_av(inode->i_mode, mask));
2360 }
2361
2362 static int selinux_file_alloc_security(struct file *file)
2363 {
2364         return file_alloc_security(file);
2365 }
2366
2367 static void selinux_file_free_security(struct file *file)
2368 {
2369         file_free_security(file);
2370 }
2371
2372 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2373                               unsigned long arg)
2374 {
2375         int error = 0;
2376
2377         switch (cmd) {
2378                 case FIONREAD:
2379                 /* fall through */
2380                 case FIBMAP:
2381                 /* fall through */
2382                 case FIGETBSZ:
2383                 /* fall through */
2384                 case EXT2_IOC_GETFLAGS:
2385                 /* fall through */
2386                 case EXT2_IOC_GETVERSION:
2387                         error = file_has_perm(current, file, FILE__GETATTR);
2388                         break;
2389
2390                 case EXT2_IOC_SETFLAGS:
2391                 /* fall through */
2392                 case EXT2_IOC_SETVERSION:
2393                         error = file_has_perm(current, file, FILE__SETATTR);
2394                         break;
2395
2396                 /* sys_ioctl() checks */
2397                 case FIONBIO:
2398                 /* fall through */
2399                 case FIOASYNC:
2400                         error = file_has_perm(current, file, 0);
2401                         break;
2402
2403                 case KDSKBENT:
2404                 case KDSKBSENT:
2405                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2406                         break;
2407
2408                 /* default case assumes that the command will go
2409                  * to the file's ioctl() function.
2410                  */
2411                 default:
2412                         error = file_has_perm(current, file, FILE__IOCTL);
2413
2414         }
2415         return error;
2416 }
2417
2418 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2419 {
2420 #ifndef CONFIG_PPC32
2421         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2422                 /*
2423                  * We are making executable an anonymous mapping or a
2424                  * private file mapping that will also be writable.
2425                  * This has an additional check.
2426                  */
2427                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2428                 if (rc)
2429                         return rc;
2430         }
2431 #endif
2432
2433         if (file) {
2434                 /* read access is always possible with a mapping */
2435                 u32 av = FILE__READ;
2436
2437                 /* write access only matters if the mapping is shared */
2438                 if (shared && (prot & PROT_WRITE))
2439                         av |= FILE__WRITE;
2440
2441                 if (prot & PROT_EXEC)
2442                         av |= FILE__EXECUTE;
2443
2444                 return file_has_perm(current, file, av);
2445         }
2446         return 0;
2447 }
2448
2449 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2450                              unsigned long prot, unsigned long flags)
2451 {
2452         int rc;
2453
2454         rc = secondary_ops->file_mmap(file, reqprot, prot, flags);
2455         if (rc)
2456                 return rc;
2457
2458         if (selinux_checkreqprot)
2459                 prot = reqprot;
2460
2461         return file_map_prot_check(file, prot,
2462                                    (flags & MAP_TYPE) == MAP_SHARED);
2463 }
2464
2465 static int selinux_file_mprotect(struct vm_area_struct *vma,
2466                                  unsigned long reqprot,
2467                                  unsigned long prot)
2468 {
2469         int rc;
2470
2471         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2472         if (rc)
2473                 return rc;
2474
2475         if (selinux_checkreqprot)
2476                 prot = reqprot;
2477
2478 #ifndef CONFIG_PPC32
2479         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXECUTABLE) &&
2480            (vma->vm_start >= vma->vm_mm->start_brk &&
2481             vma->vm_end <= vma->vm_mm->brk)) {
2482                 /*
2483                  * We are making an executable mapping in the brk region.
2484                  * This has an additional execheap check.
2485                  */
2486                 rc = task_has_perm(current, current, PROCESS__EXECHEAP);
2487                 if (rc)
2488                         return rc;
2489         }
2490         if (vma->vm_file != NULL && vma->anon_vma != NULL && (prot & PROT_EXEC)) {
2491                 /*
2492                  * We are making executable a file mapping that has
2493                  * had some COW done. Since pages might have been written,
2494                  * check ability to execute the possibly modified content.
2495                  * This typically should only occur for text relocations.
2496                  */
2497                 int rc = file_has_perm(current, vma->vm_file, FILE__EXECMOD);
2498                 if (rc)
2499                         return rc;
2500         }
2501         if (!vma->vm_file && (prot & PROT_EXEC) &&
2502                 vma->vm_start <= vma->vm_mm->start_stack &&
2503                 vma->vm_end >= vma->vm_mm->start_stack) {
2504                 /* Attempt to make the process stack executable.
2505                  * This has an additional execstack check.
2506                  */
2507                 rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2508                 if (rc)
2509                         return rc;
2510         }
2511 #endif
2512
2513         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2514 }
2515
2516 static int selinux_file_lock(struct file *file, unsigned int cmd)
2517 {
2518         return file_has_perm(current, file, FILE__LOCK);
2519 }
2520
2521 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2522                               unsigned long arg)
2523 {
2524         int err = 0;
2525
2526         switch (cmd) {
2527                 case F_SETFL:
2528                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2529                                 err = -EINVAL;
2530                                 break;
2531                         }
2532
2533                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2534                                 err = file_has_perm(current, file,FILE__WRITE);
2535                                 break;
2536                         }
2537                         /* fall through */
2538                 case F_SETOWN:
2539                 case F_SETSIG:
2540                 case F_GETFL:
2541                 case F_GETOWN:
2542                 case F_GETSIG:
2543                         /* Just check FD__USE permission */
2544                         err = file_has_perm(current, file, 0);
2545                         break;
2546                 case F_GETLK:
2547                 case F_SETLK:
2548                 case F_SETLKW:
2549 #if BITS_PER_LONG == 32
2550                 case F_GETLK64:
2551                 case F_SETLK64:
2552                 case F_SETLKW64:
2553 #endif
2554                         if (!file->f_dentry || !file->f_dentry->d_inode) {
2555                                 err = -EINVAL;
2556                                 break;
2557                         }
2558                         err = file_has_perm(current, file, FILE__LOCK);
2559                         break;
2560         }
2561
2562         return err;
2563 }
2564
2565 static int selinux_file_set_fowner(struct file *file)
2566 {
2567         struct task_security_struct *tsec;
2568         struct file_security_struct *fsec;
2569
2570         tsec = current->security;
2571         fsec = file->f_security;
2572         fsec->fown_sid = tsec->sid;
2573
2574         return 0;
2575 }
2576
2577 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2578                                        struct fown_struct *fown, int signum)
2579 {
2580         struct file *file;
2581         u32 perm;
2582         struct task_security_struct *tsec;
2583         struct file_security_struct *fsec;
2584
2585         /* struct fown_struct is never outside the context of a struct file */
2586         file = (struct file *)((long)fown - offsetof(struct file,f_owner));
2587
2588         tsec = tsk->security;
2589         fsec = file->f_security;
2590
2591         if (!signum)
2592                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2593         else
2594                 perm = signal_to_av(signum);
2595
2596         return avc_has_perm(fsec->fown_sid, tsec->sid,
2597                             SECCLASS_PROCESS, perm, NULL);
2598 }
2599
2600 static int selinux_file_receive(struct file *file)
2601 {
2602         return file_has_perm(current, file, file_to_av(file));
2603 }
2604
2605 /* task security operations */
2606
2607 static int selinux_task_create(unsigned long clone_flags)
2608 {
2609         int rc;
2610
2611         rc = secondary_ops->task_create(clone_flags);
2612         if (rc)
2613                 return rc;
2614
2615         return task_has_perm(current, current, PROCESS__FORK);
2616 }
2617
2618 static int selinux_task_alloc_security(struct task_struct *tsk)
2619 {
2620         struct task_security_struct *tsec1, *tsec2;
2621         int rc;
2622
2623         tsec1 = current->security;
2624
2625         rc = task_alloc_security(tsk);
2626         if (rc)
2627                 return rc;
2628         tsec2 = tsk->security;
2629
2630         tsec2->osid = tsec1->osid;
2631         tsec2->sid = tsec1->sid;
2632
2633         /* Retain the exec and create SIDs across fork */
2634         tsec2->exec_sid = tsec1->exec_sid;
2635         tsec2->create_sid = tsec1->create_sid;
2636
2637         /* Retain ptracer SID across fork, if any.
2638            This will be reset by the ptrace hook upon any
2639            subsequent ptrace_attach operations. */
2640         tsec2->ptrace_sid = tsec1->ptrace_sid;
2641
2642         return 0;
2643 }
2644
2645 static void selinux_task_free_security(struct task_struct *tsk)
2646 {
2647         task_free_security(tsk);
2648 }
2649
2650 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2651 {
2652         /* Since setuid only affects the current process, and
2653            since the SELinux controls are not based on the Linux
2654            identity attributes, SELinux does not need to control
2655            this operation.  However, SELinux does control the use
2656            of the CAP_SETUID and CAP_SETGID capabilities using the
2657            capable hook. */
2658         return 0;
2659 }
2660
2661 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2662 {
2663         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2664 }
2665
2666 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2667 {
2668         /* See the comment for setuid above. */
2669         return 0;
2670 }
2671
2672 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2673 {
2674         return task_has_perm(current, p, PROCESS__SETPGID);
2675 }
2676
2677 static int selinux_task_getpgid(struct task_struct *p)
2678 {
2679         return task_has_perm(current, p, PROCESS__GETPGID);
2680 }
2681
2682 static int selinux_task_getsid(struct task_struct *p)
2683 {
2684         return task_has_perm(current, p, PROCESS__GETSESSION);
2685 }
2686
2687 static int selinux_task_setgroups(struct group_info *group_info)
2688 {
2689         /* See the comment for setuid above. */
2690         return 0;
2691 }
2692
2693 static int selinux_task_setnice(struct task_struct *p, int nice)
2694 {
2695         int rc;
2696
2697         rc = secondary_ops->task_setnice(p, nice);
2698         if (rc)
2699                 return rc;
2700
2701         return task_has_perm(current,p, PROCESS__SETSCHED);
2702 }
2703
2704 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2705 {
2706         struct rlimit *old_rlim = current->signal->rlim + resource;
2707         int rc;
2708
2709         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2710         if (rc)
2711                 return rc;
2712
2713         /* Control the ability to change the hard limit (whether
2714            lowering or raising it), so that the hard limit can
2715            later be used as a safe reset point for the soft limit
2716            upon context transitions. See selinux_bprm_apply_creds. */
2717         if (old_rlim->rlim_max != new_rlim->rlim_max)
2718                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2719
2720         return 0;
2721 }
2722
2723 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2724 {
2725         return task_has_perm(current, p, PROCESS__SETSCHED);
2726 }
2727
2728 static int selinux_task_getscheduler(struct task_struct *p)
2729 {
2730         return task_has_perm(current, p, PROCESS__GETSCHED);
2731 }
2732
2733 static int selinux_task_kill(struct task_struct *p, struct siginfo *info, int sig)
2734 {
2735         u32 perm;
2736         int rc;
2737
2738         rc = secondary_ops->task_kill(p, info, sig);
2739         if (rc)
2740                 return rc;
2741
2742         if (info && ((unsigned long)info == 1 ||
2743                      (unsigned long)info == 2 || SI_FROMKERNEL(info)))
2744                 return 0;
2745
2746         if (!sig)
2747                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2748         else
2749                 perm = signal_to_av(sig);
2750
2751         return task_has_perm(current, p, perm);
2752 }
2753
2754 static int selinux_task_prctl(int option,
2755                               unsigned long arg2,
2756                               unsigned long arg3,
2757                               unsigned long arg4,
2758                               unsigned long arg5)
2759 {
2760         /* The current prctl operations do not appear to require
2761            any SELinux controls since they merely observe or modify
2762            the state of the current process. */
2763         return 0;
2764 }
2765
2766 static int selinux_task_wait(struct task_struct *p)
2767 {
2768         u32 perm;
2769
2770         perm = signal_to_av(p->exit_signal);
2771
2772         return task_has_perm(p, current, perm);
2773 }
2774
2775 static void selinux_task_reparent_to_init(struct task_struct *p)
2776 {
2777         struct task_security_struct *tsec;
2778
2779         secondary_ops->task_reparent_to_init(p);
2780
2781         tsec = p->security;
2782         tsec->osid = tsec->sid;
2783         tsec->sid = SECINITSID_KERNEL;
2784         return;
2785 }
2786
2787 static void selinux_task_to_inode(struct task_struct *p,
2788                                   struct inode *inode)
2789 {
2790         struct task_security_struct *tsec = p->security;
2791         struct inode_security_struct *isec = inode->i_security;
2792
2793         isec->sid = tsec->sid;
2794         isec->initialized = 1;
2795         return;
2796 }
2797
2798 #ifdef CONFIG_SECURITY_NETWORK
2799
2800 /* Returns error only if unable to parse addresses */
2801 static int selinux_parse_skb_ipv4(struct sk_buff *skb, struct avc_audit_data *ad)
2802 {
2803         int offset, ihlen, ret = -EINVAL;
2804         struct iphdr _iph, *ih;
2805
2806         offset = skb->nh.raw - skb->data;
2807         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2808         if (ih == NULL)
2809                 goto out;
2810
2811         ihlen = ih->ihl * 4;
2812         if (ihlen < sizeof(_iph))
2813                 goto out;
2814
2815         ad->u.net.v4info.saddr = ih->saddr;
2816         ad->u.net.v4info.daddr = ih->daddr;
2817         ret = 0;
2818
2819         switch (ih->protocol) {
2820         case IPPROTO_TCP: {
2821                 struct tcphdr _tcph, *th;
2822
2823                 if (ntohs(ih->frag_off) & IP_OFFSET)
2824                         break;
2825
2826                 offset += ihlen;
2827                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2828                 if (th == NULL)
2829                         break;
2830
2831                 ad->u.net.sport = th->source;
2832                 ad->u.net.dport = th->dest;
2833                 break;
2834         }
2835
2836         case IPPROTO_UDP: {
2837                 struct udphdr _udph, *uh;
2838
2839                 if (ntohs(ih->frag_off) & IP_OFFSET)
2840                         break;
2841
2842                 offset += ihlen;
2843                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2844                 if (uh == NULL)
2845                         break;
2846
2847                 ad->u.net.sport = uh->source;
2848                 ad->u.net.dport = uh->dest;
2849                 break;
2850         }
2851
2852         default:
2853                 break;
2854         }
2855 out:
2856         return ret;
2857 }
2858
2859 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2860
2861 /* Returns error only if unable to parse addresses */
2862 static int selinux_parse_skb_ipv6(struct sk_buff *skb, struct avc_audit_data *ad)
2863 {
2864         u8 nexthdr;
2865         int ret = -EINVAL, offset;
2866         struct ipv6hdr _ipv6h, *ip6;
2867
2868         offset = skb->nh.raw - skb->data;
2869         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
2870         if (ip6 == NULL)
2871                 goto out;
2872
2873         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
2874         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
2875         ret = 0;
2876
2877         nexthdr = ip6->nexthdr;
2878         offset += sizeof(_ipv6h);
2879         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
2880         if (offset < 0)
2881                 goto out;
2882
2883         switch (nexthdr) {
2884         case IPPROTO_TCP: {
2885                 struct tcphdr _tcph, *th;
2886
2887                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2888                 if (th == NULL)
2889                         break;
2890
2891                 ad->u.net.sport = th->source;
2892                 ad->u.net.dport = th->dest;
2893                 break;
2894         }
2895
2896         case IPPROTO_UDP: {
2897                 struct udphdr _udph, *uh;
2898
2899                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2900                 if (uh == NULL)
2901                         break;
2902
2903                 ad->u.net.sport = uh->source;
2904                 ad->u.net.dport = uh->dest;
2905                 break;
2906         }
2907
2908         /* includes fragments */
2909         default:
2910                 break;
2911         }
2912 out:
2913         return ret;
2914 }
2915
2916 #endif /* IPV6 */
2917
2918 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
2919                              char **addrp, int *len, int src)
2920 {
2921         int ret = 0;
2922
2923         switch (ad->u.net.family) {
2924         case PF_INET:
2925                 ret = selinux_parse_skb_ipv4(skb, ad);
2926                 if (ret || !addrp)
2927                         break;
2928                 *len = 4;
2929                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
2930                                         &ad->u.net.v4info.daddr);
2931                 break;
2932
2933 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
2934         case PF_INET6:
2935                 ret = selinux_parse_skb_ipv6(skb, ad);
2936                 if (ret || !addrp)
2937                         break;
2938                 *len = 16;
2939                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
2940                                         &ad->u.net.v6info.daddr);
2941                 break;
2942 #endif  /* IPV6 */
2943         default:
2944                 break;
2945         }
2946
2947         return ret;
2948 }
2949
2950 /* socket security operations */
2951 static int socket_has_perm(struct task_struct *task, struct socket *sock,
2952                            u32 perms)
2953 {
2954         struct inode_security_struct *isec;
2955         struct task_security_struct *tsec;
2956         struct avc_audit_data ad;
2957         int err = 0;
2958
2959         tsec = task->security;
2960         isec = SOCK_INODE(sock)->i_security;
2961
2962         if (isec->sid == SECINITSID_KERNEL)
2963                 goto out;
2964
2965         AVC_AUDIT_DATA_INIT(&ad,NET);
2966         ad.u.net.sk = sock->sk;
2967         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
2968
2969 out:
2970         return err;
2971 }
2972
2973 static int selinux_socket_create(int family, int type,
2974                                  int protocol, int kern)
2975 {
2976         int err = 0;
2977         struct task_security_struct *tsec;
2978
2979         if (kern)
2980                 goto out;
2981
2982         tsec = current->security;
2983         err = avc_has_perm(tsec->sid, tsec->sid,
2984                            socket_type_to_security_class(family, type,
2985                            protocol), SOCKET__CREATE, NULL);
2986
2987 out:
2988         return err;
2989 }
2990
2991 static void selinux_socket_post_create(struct socket *sock, int family,
2992                                        int type, int protocol, int kern)
2993 {
2994         struct inode_security_struct *isec;
2995         struct task_security_struct *tsec;
2996
2997         isec = SOCK_INODE(sock)->i_security;
2998
2999         tsec = current->security;
3000         isec->sclass = socket_type_to_security_class(family, type, protocol);
3001         isec->sid = kern ? SECINITSID_KERNEL : tsec->sid;
3002         isec->initialized = 1;
3003
3004         return;
3005 }
3006
3007 /* Range of port numbers used to automatically bind.
3008    Need to determine whether we should perform a name_bind
3009    permission check between the socket and the port number. */
3010 #define ip_local_port_range_0 sysctl_local_port_range[0]
3011 #define ip_local_port_range_1 sysctl_local_port_range[1]
3012
3013 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3014 {
3015         u16 family;
3016         int err;
3017
3018         err = socket_has_perm(current, sock, SOCKET__BIND);
3019         if (err)
3020                 goto out;
3021
3022         /*
3023          * If PF_INET or PF_INET6, check name_bind permission for the port.
3024          */
3025         family = sock->sk->sk_family;
3026         if (family == PF_INET || family == PF_INET6) {
3027                 char *addrp;
3028                 struct inode_security_struct *isec;
3029                 struct task_security_struct *tsec;
3030                 struct avc_audit_data ad;
3031                 struct sockaddr_in *addr4 = NULL;
3032                 struct sockaddr_in6 *addr6 = NULL;
3033                 unsigned short snum;
3034                 struct sock *sk = sock->sk;
3035                 u32 sid, node_perm, addrlen;
3036
3037                 tsec = current->security;
3038                 isec = SOCK_INODE(sock)->i_security;
3039
3040                 if (family == PF_INET) {
3041                         addr4 = (struct sockaddr_in *)address;
3042                         snum = ntohs(addr4->sin_port);
3043                         addrlen = sizeof(addr4->sin_addr.s_addr);
3044                         addrp = (char *)&addr4->sin_addr.s_addr;
3045                 } else {
3046                         addr6 = (struct sockaddr_in6 *)address;
3047                         snum = ntohs(addr6->sin6_port);
3048                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3049                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3050                 }
3051
3052                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3053                            snum > ip_local_port_range_1)) {
3054                         err = security_port_sid(sk->sk_family, sk->sk_type,
3055                                                 sk->sk_protocol, snum, &sid);
3056                         if (err)
3057                                 goto out;
3058                         AVC_AUDIT_DATA_INIT(&ad,NET);
3059                         ad.u.net.sport = htons(snum);
3060                         ad.u.net.family = family;
3061                         err = avc_has_perm(isec->sid, sid,
3062                                            isec->sclass,
3063                                            SOCKET__NAME_BIND, &ad);
3064                         if (err)
3065                                 goto out;
3066                 }
3067
3068                 switch(sk->sk_protocol) {
3069                 case IPPROTO_TCP:
3070                         node_perm = TCP_SOCKET__NODE_BIND;
3071                         break;
3072
3073                 case IPPROTO_UDP:
3074                         node_perm = UDP_SOCKET__NODE_BIND;
3075                         break;
3076
3077                 default:
3078                         node_perm = RAWIP_SOCKET__NODE_BIND;
3079                         break;
3080                 }
3081
3082                 err = security_node_sid(family, addrp, addrlen, &sid);
3083                 if (err)
3084                         goto out;
3085
3086                 AVC_AUDIT_DATA_INIT(&ad,NET);
3087                 ad.u.net.sport = htons(snum);
3088                 ad.u.net.family = family;
3089
3090                 if (family == PF_INET)
3091                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3092                 else
3093                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3094
3095                 err = avc_has_perm(isec->sid, sid,
3096                                    isec->sclass, node_perm, &ad);
3097                 if (err)
3098                         goto out;
3099         }
3100 out:
3101         return err;
3102 }
3103
3104 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3105 {
3106         struct inode_security_struct *isec;
3107         int err;
3108
3109         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3110         if (err)
3111                 return err;
3112
3113         /*
3114          * If a TCP socket, check name_connect permission for the port.
3115          */
3116         isec = SOCK_INODE(sock)->i_security;
3117         if (isec->sclass == SECCLASS_TCP_SOCKET) {
3118                 struct sock *sk = sock->sk;
3119                 struct avc_audit_data ad;
3120                 struct sockaddr_in *addr4 = NULL;
3121                 struct sockaddr_in6 *addr6 = NULL;
3122                 unsigned short snum;
3123                 u32 sid;
3124
3125                 if (sk->sk_family == PF_INET) {
3126                         addr4 = (struct sockaddr_in *)address;
3127                         if (addrlen != sizeof(struct sockaddr_in))
3128                                 return -EINVAL;
3129                         snum = ntohs(addr4->sin_port);
3130                 } else {
3131                         addr6 = (struct sockaddr_in6 *)address;
3132                         if (addrlen != sizeof(struct sockaddr_in6))
3133                                 return -EINVAL;
3134                         snum = ntohs(addr6->sin6_port);
3135                 }
3136
3137                 err = security_port_sid(sk->sk_family, sk->sk_type,
3138                                         sk->sk_protocol, snum, &sid);
3139                 if (err)
3140                         goto out;
3141
3142                 AVC_AUDIT_DATA_INIT(&ad,NET);
3143                 ad.u.net.dport = htons(snum);
3144                 ad.u.net.family = sk->sk_family;
3145                 err = avc_has_perm(isec->sid, sid, isec->sclass,
3146                                    TCP_SOCKET__NAME_CONNECT, &ad);
3147                 if (err)
3148                         goto out;
3149         }
3150
3151 out:
3152         return err;
3153 }
3154
3155 static int selinux_socket_listen(struct socket *sock, int backlog)
3156 {
3157         return socket_has_perm(current, sock, SOCKET__LISTEN);
3158 }
3159
3160 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3161 {
3162         int err;
3163         struct inode_security_struct *isec;
3164         struct inode_security_struct *newisec;
3165
3166         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3167         if (err)
3168                 return err;
3169
3170         newisec = SOCK_INODE(newsock)->i_security;
3171
3172         isec = SOCK_INODE(sock)->i_security;
3173         newisec->sclass = isec->sclass;
3174         newisec->sid = isec->sid;
3175         newisec->initialized = 1;
3176
3177         return 0;
3178 }
3179
3180 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3181                                   int size)
3182 {
3183         return socket_has_perm(current, sock, SOCKET__WRITE);
3184 }
3185
3186 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3187                                   int size, int flags)
3188 {
3189         return socket_has_perm(current, sock, SOCKET__READ);
3190 }
3191
3192 static int selinux_socket_getsockname(struct socket *sock)
3193 {
3194         return socket_has_perm(current, sock, SOCKET__GETATTR);
3195 }
3196
3197 static int selinux_socket_getpeername(struct socket *sock)
3198 {
3199         return socket_has_perm(current, sock, SOCKET__GETATTR);
3200 }
3201
3202 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3203 {
3204         return socket_has_perm(current, sock, SOCKET__SETOPT);
3205 }
3206
3207 static int selinux_socket_getsockopt(struct socket *sock, int level,
3208                                      int optname)
3209 {
3210         return socket_has_perm(current, sock, SOCKET__GETOPT);
3211 }
3212
3213 static int selinux_socket_shutdown(struct socket *sock, int how)
3214 {
3215         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3216 }
3217
3218 static int selinux_socket_unix_stream_connect(struct socket *sock,
3219                                               struct socket *other,
3220                                               struct sock *newsk)
3221 {
3222         struct sk_security_struct *ssec;
3223         struct inode_security_struct *isec;
3224         struct inode_security_struct *other_isec;
3225         struct avc_audit_data ad;
3226         int err;
3227
3228         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3229         if (err)
3230                 return err;
3231
3232         isec = SOCK_INODE(sock)->i_security;
3233         other_isec = SOCK_INODE(other)->i_security;
3234
3235         AVC_AUDIT_DATA_INIT(&ad,NET);
3236         ad.u.net.sk = other->sk;
3237
3238         err = avc_has_perm(isec->sid, other_isec->sid,
3239                            isec->sclass,
3240                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3241         if (err)
3242                 return err;
3243
3244         /* connecting socket */
3245         ssec = sock->sk->sk_security;
3246         ssec->peer_sid = other_isec->sid;
3247
3248         /* server child socket */
3249         ssec = newsk->sk_security;
3250         ssec->peer_sid = isec->sid;
3251
3252         return 0;
3253 }
3254
3255 static int selinux_socket_unix_may_send(struct socket *sock,
3256                                         struct socket *other)
3257 {
3258         struct inode_security_struct *isec;
3259         struct inode_security_struct *other_isec;
3260         struct avc_audit_data ad;
3261         int err;
3262
3263         isec = SOCK_INODE(sock)->i_security;
3264         other_isec = SOCK_INODE(other)->i_security;
3265
3266         AVC_AUDIT_DATA_INIT(&ad,NET);
3267         ad.u.net.sk = other->sk;
3268
3269         err = avc_has_perm(isec->sid, other_isec->sid,
3270                            isec->sclass, SOCKET__SENDTO, &ad);
3271         if (err)
3272                 return err;
3273
3274         return 0;
3275 }
3276
3277 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3278 {
3279         u16 family;
3280         char *addrp;
3281         int len, err = 0;
3282         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3283         u32 sock_sid = 0;
3284         u16 sock_class = 0;
3285         struct socket *sock;
3286         struct net_device *dev;
3287         struct avc_audit_data ad;
3288
3289         family = sk->sk_family;
3290         if (family != PF_INET && family != PF_INET6)
3291                 goto out;
3292
3293         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3294         if (family == PF_INET6 && skb->protocol == ntohs(ETH_P_IP))
3295                 family = PF_INET;
3296
3297         read_lock_bh(&sk->sk_callback_lock);
3298         sock = sk->sk_socket;
3299         if (sock) {
3300                 struct inode *inode;
3301                 inode = SOCK_INODE(sock);
3302                 if (inode) {
3303                         struct inode_security_struct *isec;
3304                         isec = inode->i_security;
3305                         sock_sid = isec->sid;
3306                         sock_class = isec->sclass;
3307                 }
3308         }
3309         read_unlock_bh(&sk->sk_callback_lock);
3310         if (!sock_sid)
3311                 goto out;
3312
3313         dev = skb->dev;
3314         if (!dev)
3315                 goto out;
3316
3317         err = sel_netif_sids(dev, &if_sid, NULL);
3318         if (err)
3319                 goto out;
3320
3321         switch (sock_class) {
3322         case SECCLASS_UDP_SOCKET:
3323                 netif_perm = NETIF__UDP_RECV;
3324                 node_perm = NODE__UDP_RECV;
3325                 recv_perm = UDP_SOCKET__RECV_MSG;
3326                 break;
3327
3328         case SECCLASS_TCP_SOCKET:
3329                 netif_perm = NETIF__TCP_RECV;
3330                 node_perm = NODE__TCP_RECV;
3331                 recv_perm = TCP_SOCKET__RECV_MSG;
3332                 break;
3333
3334         default:
3335                 netif_perm = NETIF__RAWIP_RECV;
3336                 node_perm = NODE__RAWIP_RECV;
3337                 break;
3338         }
3339
3340         AVC_AUDIT_DATA_INIT(&ad, NET);
3341         ad.u.net.netif = dev->name;
3342         ad.u.net.family = family;
3343
3344         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1);
3345         if (err)
3346                 goto out;
3347
3348         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, &ad);
3349         if (err)
3350                 goto out;
3351
3352         /* Fixme: this lookup is inefficient */
3353         err = security_node_sid(family, addrp, len, &node_sid);
3354         if (err)
3355                 goto out;
3356
3357         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, &ad);
3358         if (err)
3359                 goto out;
3360
3361         if (recv_perm) {
3362                 u32 port_sid;
3363
3364                 /* Fixme: make this more efficient */
3365                 err = security_port_sid(sk->sk_family, sk->sk_type,
3366                                         sk->sk_protocol, ntohs(ad.u.net.sport),
3367                                         &port_sid);
3368                 if (err)
3369                         goto out;
3370
3371                 err = avc_has_perm(sock_sid, port_sid,
3372                                    sock_class, recv_perm, &ad);
3373         }
3374 out:
3375         return err;
3376 }
3377
3378 static int selinux_socket_getpeersec(struct socket *sock, char __user *optval,
3379                                      int __user *optlen, unsigned len)
3380 {
3381         int err = 0;
3382         char *scontext;
3383         u32 scontext_len;
3384         struct sk_security_struct *ssec;
3385         struct inode_security_struct *isec;
3386
3387         isec = SOCK_INODE(sock)->i_security;
3388         if (isec->sclass != SECCLASS_UNIX_STREAM_SOCKET) {
3389                 err = -ENOPROTOOPT;
3390                 goto out;
3391         }
3392
3393         ssec = sock->sk->sk_security;
3394
3395         err = security_sid_to_context(ssec->peer_sid, &scontext, &scontext_len);
3396         if (err)
3397                 goto out;
3398
3399         if (scontext_len > len) {
3400                 err = -ERANGE;
3401                 goto out_len;
3402         }
3403
3404         if (copy_to_user(optval, scontext, scontext_len))
3405                 err = -EFAULT;
3406
3407 out_len:
3408         if (put_user(scontext_len, optlen))
3409                 err = -EFAULT;
3410
3411         kfree(scontext);
3412 out:
3413         return err;
3414 }
3415
3416 static int selinux_sk_alloc_security(struct sock *sk, int family, int priority)
3417 {
3418         return sk_alloc_security(sk, family, priority);
3419 }
3420
3421 static void selinux_sk_free_security(struct sock *sk)
3422 {
3423         sk_free_security(sk);
3424 }
3425
3426 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3427 {
3428         int err = 0;
3429         u32 perm;
3430         struct nlmsghdr *nlh;
3431         struct socket *sock = sk->sk_socket;
3432         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3433
3434         if (skb->len < NLMSG_SPACE(0)) {
3435                 err = -EINVAL;
3436                 goto out;
3437         }
3438         nlh = (struct nlmsghdr *)skb->data;
3439
3440         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3441         if (err) {
3442                 if (err == -EINVAL) {
3443                         audit_log(current->audit_context, AUDIT_SELINUX_ERR,
3444                                   "SELinux:  unrecognized netlink message"
3445                                   " type=%hu for sclass=%hu\n",
3446                                   nlh->nlmsg_type, isec->sclass);
3447                         if (!selinux_enforcing)
3448                                 err = 0;
3449                 }
3450
3451                 /* Ignore */
3452                 if (err == -ENOENT)
3453                         err = 0;
3454                 goto out;
3455         }
3456
3457         err = socket_has_perm(current, sock, perm);
3458 out:
3459         return err;
3460 }
3461
3462 #ifdef CONFIG_NETFILTER
3463
3464 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3465                                               struct sk_buff **pskb,
3466                                               const struct net_device *in,
3467                                               const struct net_device *out,
3468                                               int (*okfn)(struct sk_buff *),
3469                                               u16 family)
3470 {
3471         char *addrp;
3472         int len, err = NF_ACCEPT;
3473         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3474         struct sock *sk;
3475         struct socket *sock;
3476         struct inode *inode;
3477         struct sk_buff *skb = *pskb;
3478         struct inode_security_struct *isec;
3479         struct avc_audit_data ad;
3480         struct net_device *dev = (struct net_device *)out;
3481
3482         sk = skb->sk;
3483         if (!sk)
3484                 goto out;
3485
3486         sock = sk->sk_socket;
3487         if (!sock)
3488                 goto out;
3489
3490         inode = SOCK_INODE(sock);
3491         if (!inode)
3492                 goto out;
3493
3494         err = sel_netif_sids(dev, &if_sid, NULL);
3495         if (err)
3496                 goto out;
3497
3498         isec = inode->i_security;
3499
3500         switch (isec->sclass) {
3501         case SECCLASS_UDP_SOCKET:
3502                 netif_perm = NETIF__UDP_SEND;
3503                 node_perm = NODE__UDP_SEND;
3504                 send_perm = UDP_SOCKET__SEND_MSG;
3505                 break;
3506
3507         case SECCLASS_TCP_SOCKET:
3508                 netif_perm = NETIF__TCP_SEND;
3509                 node_perm = NODE__TCP_SEND;
3510                 send_perm = TCP_SOCKET__SEND_MSG;
3511                 break;
3512
3513         default:
3514                 netif_perm = NETIF__RAWIP_SEND;
3515                 node_perm = NODE__RAWIP_SEND;
3516                 break;
3517         }
3518
3519
3520         AVC_AUDIT_DATA_INIT(&ad, NET);
3521         ad.u.net.netif = dev->name;
3522         ad.u.net.family = family;
3523
3524         err = selinux_parse_skb(skb, &ad, &addrp,
3525                                 &len, 0) ? NF_DROP : NF_ACCEPT;
3526         if (err != NF_ACCEPT)
3527                 goto out;
3528
3529         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF,
3530                            netif_perm, &ad) ? NF_DROP : NF_ACCEPT;
3531         if (err != NF_ACCEPT)
3532                 goto out;
3533
3534         /* Fixme: this lookup is inefficient */
3535         err = security_node_sid(family, addrp, len,
3536                                 &node_sid) ? NF_DROP : NF_ACCEPT;
3537         if (err != NF_ACCEPT)
3538                 goto out;
3539
3540         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE,
3541                            node_perm, &ad) ? NF_DROP : NF_ACCEPT;
3542         if (err != NF_ACCEPT)
3543                 goto out;
3544
3545         if (send_perm) {
3546                 u32 port_sid;
3547
3548                 /* Fixme: make this more efficient */
3549                 err = security_port_sid(sk->sk_family,
3550                                         sk->sk_type,
3551                                         sk->sk_protocol,
3552                                         ntohs(ad.u.net.dport),
3553                                         &port_sid) ? NF_DROP : NF_ACCEPT;
3554                 if (err != NF_ACCEPT)
3555                         goto out;
3556
3557                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3558                                    send_perm, &ad) ? NF_DROP : NF_ACCEPT;
3559         }
3560
3561 out:
3562         return err;
3563 }
3564
3565 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3566                                                 struct sk_buff **pskb,
3567                                                 const struct net_device *in,
3568                                                 const struct net_device *out,
3569                                                 int (*okfn)(struct sk_buff *))
3570 {
3571         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3572 }
3573
3574 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3575
3576 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3577                                                 struct sk_buff **pskb,
3578                                                 const struct net_device *in,
3579                                                 const struct net_device *out,
3580                                                 int (*okfn)(struct sk_buff *))
3581 {
3582         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3583 }
3584
3585 #endif  /* IPV6 */
3586
3587 #endif  /* CONFIG_NETFILTER */
3588
3589 #else
3590
3591 static inline int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3592 {
3593         return 0;
3594 }
3595
3596 #endif  /* CONFIG_SECURITY_NETWORK */
3597
3598 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3599 {
3600         struct task_security_struct *tsec;
3601         struct av_decision avd;
3602         int err;
3603
3604         err = secondary_ops->netlink_send(sk, skb);
3605         if (err)
3606                 return err;
3607
3608         tsec = current->security;
3609
3610         avd.allowed = 0;
3611         avc_has_perm_noaudit(tsec->sid, tsec->sid,
3612                                 SECCLASS_CAPABILITY, ~0, &avd);
3613         cap_mask(NETLINK_CB(skb).eff_cap, avd.allowed);
3614
3615         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
3616                 err = selinux_nlmsg_perm(sk, skb);
3617
3618         return err;
3619 }
3620
3621 static int selinux_netlink_recv(struct sk_buff *skb)
3622 {
3623         if (!cap_raised(NETLINK_CB(skb).eff_cap, CAP_NET_ADMIN))
3624                 return -EPERM;
3625         return 0;
3626 }
3627
3628 static int ipc_alloc_security(struct task_struct *task,
3629                               struct kern_ipc_perm *perm,
3630                               u16 sclass)
3631 {
3632         struct task_security_struct *tsec = task->security;
3633         struct ipc_security_struct *isec;
3634
3635         isec = kmalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
3636         if (!isec)
3637                 return -ENOMEM;
3638
3639         memset(isec, 0, sizeof(struct ipc_security_struct));
3640         isec->magic = SELINUX_MAGIC;
3641         isec->sclass = sclass;
3642         isec->ipc_perm = perm;
3643         if (tsec) {
3644                 isec->sid = tsec->sid;
3645         } else {
3646                 isec->sid = SECINITSID_UNLABELED;
3647         }
3648         perm->security = isec;
3649
3650         return 0;
3651 }
3652
3653 static void ipc_free_security(struct kern_ipc_perm *perm)
3654 {
3655         struct ipc_security_struct *isec = perm->security;
3656         if (!isec || isec->magic != SELINUX_MAGIC)
3657                 return;
3658
3659         perm->security = NULL;
3660         kfree(isec);
3661 }
3662
3663 static int msg_msg_alloc_security(struct msg_msg *msg)
3664 {
3665         struct msg_security_struct *msec;
3666
3667         msec = kmalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
3668         if (!msec)
3669                 return -ENOMEM;
3670
3671         memset(msec, 0, sizeof(struct msg_security_struct));
3672         msec->magic = SELINUX_MAGIC;
3673         msec->msg = msg;
3674         msec->sid = SECINITSID_UNLABELED;
3675         msg->security = msec;
3676
3677         return 0;
3678 }
3679
3680 static void msg_msg_free_security(struct msg_msg *msg)
3681 {
3682         struct msg_security_struct *msec = msg->security;
3683         if (!msec || msec->magic != SELINUX_MAGIC)
3684                 return;
3685
3686         msg->security = NULL;
3687         kfree(msec);
3688 }
3689
3690 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
3691                         u32 perms)
3692 {
3693         struct task_security_struct *tsec;
3694         struct ipc_security_struct *isec;
3695         struct avc_audit_data ad;
3696
3697         tsec = current->security;
3698         isec = ipc_perms->security;
3699
3700         AVC_AUDIT_DATA_INIT(&ad, IPC);
3701         ad.u.ipc_id = ipc_perms->key;
3702
3703         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3704 }
3705
3706 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
3707 {
3708         return msg_msg_alloc_security(msg);
3709 }
3710
3711 static void selinux_msg_msg_free_security(struct msg_msg *msg)
3712 {
3713         msg_msg_free_security(msg);
3714 }
3715
3716 /* message queue security operations */
3717 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
3718 {
3719         struct task_security_struct *tsec;
3720         struct ipc_security_struct *isec;
3721         struct avc_audit_data ad;
3722         int rc;
3723
3724         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
3725         if (rc)
3726                 return rc;
3727
3728         tsec = current->security;
3729         isec = msq->q_perm.security;
3730
3731         AVC_AUDIT_DATA_INIT(&ad, IPC);
3732         ad.u.ipc_id = msq->q_perm.key;
3733
3734         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3735                           MSGQ__CREATE, &ad);
3736         if (rc) {
3737                 ipc_free_security(&msq->q_perm);
3738                 return rc;
3739         }
3740         return 0;
3741 }
3742
3743 static void selinux_msg_queue_free_security(struct msg_queue *msq)
3744 {
3745         ipc_free_security(&msq->q_perm);
3746 }
3747
3748 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
3749 {
3750         struct task_security_struct *tsec;
3751         struct ipc_security_struct *isec;
3752         struct avc_audit_data ad;
3753
3754         tsec = current->security;
3755         isec = msq->q_perm.security;
3756
3757         AVC_AUDIT_DATA_INIT(&ad, IPC);
3758         ad.u.ipc_id = msq->q_perm.key;
3759
3760         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3761                             MSGQ__ASSOCIATE, &ad);
3762 }
3763
3764 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
3765 {
3766         int err;
3767         int perms;
3768
3769         switch(cmd) {
3770         case IPC_INFO:
3771         case MSG_INFO:
3772                 /* No specific object, just general system-wide information. */
3773                 return task_has_system(current, SYSTEM__IPC_INFO);
3774         case IPC_STAT:
3775         case MSG_STAT:
3776                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
3777                 break;
3778         case IPC_SET:
3779                 perms = MSGQ__SETATTR;
3780                 break;
3781         case IPC_RMID:
3782                 perms = MSGQ__DESTROY;
3783                 break;
3784         default:
3785                 return 0;
3786         }
3787
3788         err = ipc_has_perm(&msq->q_perm, perms);
3789         return err;
3790 }
3791
3792 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
3793 {
3794         struct task_security_struct *tsec;
3795         struct ipc_security_struct *isec;
3796         struct msg_security_struct *msec;
3797         struct avc_audit_data ad;
3798         int rc;
3799
3800         tsec = current->security;
3801         isec = msq->q_perm.security;
3802         msec = msg->security;
3803
3804         /*
3805          * First time through, need to assign label to the message
3806          */
3807         if (msec->sid == SECINITSID_UNLABELED) {
3808                 /*
3809                  * Compute new sid based on current process and
3810                  * message queue this message will be stored in
3811                  */
3812                 rc = security_transition_sid(tsec->sid,
3813                                              isec->sid,
3814                                              SECCLASS_MSG,
3815                                              &msec->sid);
3816                 if (rc)
3817                         return rc;
3818         }
3819
3820         AVC_AUDIT_DATA_INIT(&ad, IPC);
3821         ad.u.ipc_id = msq->q_perm.key;
3822
3823         /* Can this process write to the queue? */
3824         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
3825                           MSGQ__WRITE, &ad);
3826         if (!rc)
3827                 /* Can this process send the message */
3828                 rc = avc_has_perm(tsec->sid, msec->sid,
3829                                   SECCLASS_MSG, MSG__SEND, &ad);
3830         if (!rc)
3831                 /* Can the message be put in the queue? */
3832                 rc = avc_has_perm(msec->sid, isec->sid,
3833                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
3834
3835         return rc;
3836 }
3837
3838 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
3839                                     struct task_struct *target,
3840                                     long type, int mode)
3841 {
3842         struct task_security_struct *tsec;
3843         struct ipc_security_struct *isec;
3844         struct msg_security_struct *msec;
3845         struct avc_audit_data ad;
3846         int rc;
3847
3848         tsec = target->security;
3849         isec = msq->q_perm.security;
3850         msec = msg->security;
3851
3852         AVC_AUDIT_DATA_INIT(&ad, IPC);
3853         ad.u.ipc_id = msq->q_perm.key;
3854
3855         rc = avc_has_perm(tsec->sid, isec->sid,
3856                           SECCLASS_MSGQ, MSGQ__READ, &ad);
3857         if (!rc)
3858                 rc = avc_has_perm(tsec->sid, msec->sid,
3859                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
3860         return rc;
3861 }
3862
3863 /* Shared Memory security operations */
3864 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
3865 {
3866         struct task_security_struct *tsec;
3867         struct ipc_security_struct *isec;
3868         struct avc_audit_data ad;
3869         int rc;
3870
3871         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
3872         if (rc)
3873                 return rc;
3874
3875         tsec = current->security;
3876         isec = shp->shm_perm.security;
3877
3878         AVC_AUDIT_DATA_INIT(&ad, IPC);
3879         ad.u.ipc_id = shp->shm_perm.key;
3880
3881         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3882                           SHM__CREATE, &ad);
3883         if (rc) {
3884                 ipc_free_security(&shp->shm_perm);
3885                 return rc;
3886         }
3887         return 0;
3888 }
3889
3890 static void selinux_shm_free_security(struct shmid_kernel *shp)
3891 {
3892         ipc_free_security(&shp->shm_perm);
3893 }
3894
3895 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
3896 {
3897         struct task_security_struct *tsec;
3898         struct ipc_security_struct *isec;
3899         struct avc_audit_data ad;
3900
3901         tsec = current->security;
3902         isec = shp->shm_perm.security;
3903
3904         AVC_AUDIT_DATA_INIT(&ad, IPC);
3905         ad.u.ipc_id = shp->shm_perm.key;
3906
3907         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
3908                             SHM__ASSOCIATE, &ad);
3909 }
3910
3911 /* Note, at this point, shp is locked down */
3912 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
3913 {
3914         int perms;
3915         int err;
3916
3917         switch(cmd) {
3918         case IPC_INFO:
3919         case SHM_INFO:
3920                 /* No specific object, just general system-wide information. */
3921                 return task_has_system(current, SYSTEM__IPC_INFO);
3922         case IPC_STAT:
3923         case SHM_STAT:
3924                 perms = SHM__GETATTR | SHM__ASSOCIATE;
3925                 break;
3926         case IPC_SET:
3927                 perms = SHM__SETATTR;
3928                 break;
3929         case SHM_LOCK:
3930         case SHM_UNLOCK:
3931                 perms = SHM__LOCK;
3932                 break;
3933         case IPC_RMID:
3934                 perms = SHM__DESTROY;
3935                 break;
3936         default:
3937                 return 0;
3938         }
3939
3940         err = ipc_has_perm(&shp->shm_perm, perms);
3941         return err;
3942 }
3943
3944 static int selinux_shm_shmat(struct shmid_kernel *shp,
3945                              char __user *shmaddr, int shmflg)
3946 {
3947         u32 perms;
3948         int rc;
3949
3950         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
3951         if (rc)
3952                 return rc;
3953
3954         if (shmflg & SHM_RDONLY)
3955                 perms = SHM__READ;
3956         else
3957                 perms = SHM__READ | SHM__WRITE;
3958
3959         return ipc_has_perm(&shp->shm_perm, perms);
3960 }
3961
3962 /* Semaphore security operations */
3963 static int selinux_sem_alloc_security(struct sem_array *sma)
3964 {
3965         struct task_security_struct *tsec;
3966         struct ipc_security_struct *isec;
3967         struct avc_audit_data ad;
3968         int rc;
3969
3970         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
3971         if (rc)
3972                 return rc;
3973
3974         tsec = current->security;
3975         isec = sma->sem_perm.security;
3976
3977         AVC_AUDIT_DATA_INIT(&ad, IPC);
3978         ad.u.ipc_id = sma->sem_perm.key;
3979
3980         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
3981                           SEM__CREATE, &ad);
3982         if (rc) {
3983                 ipc_free_security(&sma->sem_perm);
3984                 return rc;
3985         }
3986         return 0;
3987 }
3988
3989 static void selinux_sem_free_security(struct sem_array *sma)
3990 {
3991         ipc_free_security(&sma->sem_perm);
3992 }
3993
3994 static int selinux_sem_associate(struct sem_array *sma, int semflg)
3995 {
3996         struct task_security_struct *tsec;
3997         struct ipc_security_struct *isec;
3998         struct avc_audit_data ad;
3999
4000         tsec = current->security;
4001         isec = sma->sem_perm.security;
4002
4003         AVC_AUDIT_DATA_INIT(&ad, IPC);
4004         ad.u.ipc_id = sma->sem_perm.key;
4005
4006         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4007                             SEM__ASSOCIATE, &ad);
4008 }
4009
4010 /* Note, at this point, sma is locked down */
4011 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4012 {
4013         int err;
4014         u32 perms;
4015
4016         switch(cmd) {
4017         case IPC_INFO:
4018         case SEM_INFO:
4019                 /* No specific object, just general system-wide information. */
4020                 return task_has_system(current, SYSTEM__IPC_INFO);
4021         case GETPID:
4022         case GETNCNT:
4023         case GETZCNT:
4024                 perms = SEM__GETATTR;
4025                 break;
4026         case GETVAL:
4027         case GETALL:
4028                 perms = SEM__READ;
4029                 break;
4030         case SETVAL:
4031         case SETALL:
4032                 perms = SEM__WRITE;
4033                 break;
4034         case IPC_RMID:
4035                 perms = SEM__DESTROY;
4036                 break;
4037         case IPC_SET:
4038                 perms = SEM__SETATTR;
4039                 break;
4040         case IPC_STAT:
4041         case SEM_STAT:
4042                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4043                 break;
4044         default:
4045                 return 0;
4046         }
4047
4048         err = ipc_has_perm(&sma->sem_perm, perms);
4049         return err;
4050 }
4051
4052 static int selinux_sem_semop(struct sem_array *sma,
4053                              struct sembuf *sops, unsigned nsops, int alter)
4054 {
4055         u32 perms;
4056
4057         if (alter)
4058                 perms = SEM__READ | SEM__WRITE;
4059         else
4060                 perms = SEM__READ;
4061
4062         return ipc_has_perm(&sma->sem_perm, perms);
4063 }
4064
4065 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4066 {
4067         u32 av = 0;
4068
4069         av = 0;
4070         if (flag & S_IRUGO)
4071                 av |= IPC__UNIX_READ;
4072         if (flag & S_IWUGO)
4073                 av |= IPC__UNIX_WRITE;
4074
4075         if (av == 0)
4076                 return 0;
4077
4078         return ipc_has_perm(ipcp, av);
4079 }
4080
4081 /* module stacking operations */
4082 static int selinux_register_security (const char *name, struct security_operations *ops)
4083 {
4084         if (secondary_ops != original_ops) {
4085                 printk(KERN_INFO "%s:  There is already a secondary security "
4086                        "module registered.\n", __FUNCTION__);
4087                 return -EINVAL;
4088         }
4089
4090         secondary_ops = ops;
4091
4092         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4093                __FUNCTION__,
4094                name);
4095
4096         return 0;
4097 }
4098
4099 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4100 {
4101         if (ops != secondary_ops) {
4102                 printk (KERN_INFO "%s:  trying to unregister a security module "
4103                         "that is not registered.\n", __FUNCTION__);
4104                 return -EINVAL;
4105         }
4106
4107         secondary_ops = original_ops;
4108
4109         return 0;
4110 }
4111
4112 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4113 {
4114         if (inode)
4115                 inode_doinit_with_dentry(inode, dentry);
4116 }
4117
4118 static int selinux_getprocattr(struct task_struct *p,
4119                                char *name, void *value, size_t size)
4120 {
4121         struct task_security_struct *tsec;
4122         u32 sid, len;
4123         char *context;
4124         int error;
4125
4126         if (current != p) {
4127                 error = task_has_perm(current, p, PROCESS__GETATTR);
4128                 if (error)
4129                         return error;
4130         }
4131
4132         if (!size)
4133                 return -ERANGE;
4134
4135         tsec = p->security;
4136
4137         if (!strcmp(name, "current"))
4138                 sid = tsec->sid;
4139         else if (!strcmp(name, "prev"))
4140                 sid = tsec->osid;
4141         else if (!strcmp(name, "exec"))
4142                 sid = tsec->exec_sid;
4143         else if (!strcmp(name, "fscreate"))
4144                 sid = tsec->create_sid;
4145         else
4146                 return -EINVAL;
4147
4148         if (!sid)
4149                 return 0;
4150
4151         error = security_sid_to_context(sid, &context, &len);
4152         if (error)
4153                 return error;
4154         if (len > size) {
4155                 kfree(context);
4156                 return -ERANGE;
4157         }
4158         memcpy(value, context, len);
4159         kfree(context);
4160         return len;
4161 }
4162
4163 static int selinux_setprocattr(struct task_struct *p,
4164                                char *name, void *value, size_t size)
4165 {
4166         struct task_security_struct *tsec;
4167         u32 sid = 0;
4168         int error;
4169         char *str = value;
4170
4171         if (current != p) {
4172                 /* SELinux only allows a process to change its own
4173                    security attributes. */
4174                 return -EACCES;
4175         }
4176
4177         /*
4178          * Basic control over ability to set these attributes at all.
4179          * current == p, but we'll pass them separately in case the
4180          * above restriction is ever removed.
4181          */
4182         if (!strcmp(name, "exec"))
4183                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4184         else if (!strcmp(name, "fscreate"))
4185                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4186         else if (!strcmp(name, "current"))
4187                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4188         else
4189                 error = -EINVAL;
4190         if (error)
4191                 return error;
4192
4193         /* Obtain a SID for the context, if one was specified. */
4194         if (size && str[1] && str[1] != '\n') {
4195                 if (str[size-1] == '\n') {
4196                         str[size-1] = 0;
4197                         size--;
4198                 }
4199                 error = security_context_to_sid(value, size, &sid);
4200                 if (error)
4201                         return error;
4202         }
4203
4204         /* Permission checking based on the specified context is
4205            performed during the actual operation (execve,
4206            open/mkdir/...), when we know the full context of the
4207            operation.  See selinux_bprm_set_security for the execve
4208            checks and may_create for the file creation checks. The
4209            operation will then fail if the context is not permitted. */
4210         tsec = p->security;
4211         if (!strcmp(name, "exec"))
4212                 tsec->exec_sid = sid;
4213         else if (!strcmp(name, "fscreate"))
4214                 tsec->create_sid = sid;
4215         else if (!strcmp(name, "current")) {
4216                 struct av_decision avd;
4217
4218                 if (sid == 0)
4219                         return -EINVAL;
4220
4221                 /* Only allow single threaded processes to change context */
4222                 if (atomic_read(&p->mm->mm_users) != 1) {
4223                         struct task_struct *g, *t;
4224                         struct mm_struct *mm = p->mm;
4225                         read_lock(&tasklist_lock);
4226                         do_each_thread(g, t)
4227                                 if (t->mm == mm && t != p) {
4228                                         read_unlock(&tasklist_lock);
4229                                         return -EPERM;
4230                                 }
4231                         while_each_thread(g, t);
4232                         read_unlock(&tasklist_lock);
4233                 }
4234
4235                 /* Check permissions for the transition. */
4236                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4237                                      PROCESS__DYNTRANSITION, NULL);
4238                 if (error)
4239                         return error;
4240
4241                 /* Check for ptracing, and update the task SID if ok.
4242                    Otherwise, leave SID unchanged and fail. */
4243                 task_lock(p);
4244                 if (p->ptrace & PT_PTRACED) {
4245                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4246                                                      SECCLASS_PROCESS,
4247                                                      PROCESS__PTRACE, &avd);
4248                         if (!error)
4249                                 tsec->sid = sid;
4250                         task_unlock(p);
4251                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4252                                   PROCESS__PTRACE, &avd, error, NULL);
4253                         if (error)
4254                                 return error;
4255                 } else {
4256                         tsec->sid = sid;
4257                         task_unlock(p);
4258                 }
4259         }
4260         else
4261                 return -EINVAL;
4262
4263         return size;
4264 }
4265
4266 static struct security_operations selinux_ops = {
4267         .ptrace =                       selinux_ptrace,
4268         .capget =                       selinux_capget,
4269         .capset_check =                 selinux_capset_check,
4270         .capset_set =                   selinux_capset_set,
4271         .sysctl =                       selinux_sysctl,
4272         .capable =                      selinux_capable,
4273         .quotactl =                     selinux_quotactl,
4274         .quota_on =                     selinux_quota_on,
4275         .syslog =                       selinux_syslog,
4276         .vm_enough_memory =             selinux_vm_enough_memory,
4277
4278         .netlink_send =                 selinux_netlink_send,
4279         .netlink_recv =                 selinux_netlink_recv,
4280
4281         .bprm_alloc_security =          selinux_bprm_alloc_security,
4282         .bprm_free_security =           selinux_bprm_free_security,
4283         .bprm_apply_creds =             selinux_bprm_apply_creds,
4284         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4285         .bprm_set_security =            selinux_bprm_set_security,
4286         .bprm_check_security =          selinux_bprm_check_security,
4287         .bprm_secureexec =              selinux_bprm_secureexec,
4288
4289         .sb_alloc_security =            selinux_sb_alloc_security,
4290         .sb_free_security =             selinux_sb_free_security,
4291         .sb_copy_data =                 selinux_sb_copy_data,
4292         .sb_kern_mount =                selinux_sb_kern_mount,
4293         .sb_statfs =                    selinux_sb_statfs,
4294         .sb_mount =                     selinux_mount,
4295         .sb_umount =                    selinux_umount,
4296
4297         .inode_alloc_security =         selinux_inode_alloc_security,
4298         .inode_free_security =          selinux_inode_free_security,
4299         .inode_create =                 selinux_inode_create,
4300         .inode_post_create =            selinux_inode_post_create,
4301         .inode_link =                   selinux_inode_link,
4302         .inode_post_link =              selinux_inode_post_link,
4303         .inode_unlink =                 selinux_inode_unlink,
4304         .inode_symlink =                selinux_inode_symlink,
4305         .inode_post_symlink =           selinux_inode_post_symlink,
4306         .inode_mkdir =                  selinux_inode_mkdir,
4307         .inode_post_mkdir =             selinux_inode_post_mkdir,
4308         .inode_rmdir =                  selinux_inode_rmdir,
4309         .inode_mknod =                  selinux_inode_mknod,
4310         .inode_post_mknod =             selinux_inode_post_mknod,
4311         .inode_rename =                 selinux_inode_rename,
4312         .inode_post_rename =            selinux_inode_post_rename,
4313         .inode_readlink =               selinux_inode_readlink,
4314         .inode_follow_link =            selinux_inode_follow_link,
4315         .inode_permission =             selinux_inode_permission,
4316         .inode_setattr =                selinux_inode_setattr,
4317         .inode_getattr =                selinux_inode_getattr,
4318         .inode_setxattr =               selinux_inode_setxattr,
4319         .inode_post_setxattr =          selinux_inode_post_setxattr,
4320         .inode_getxattr =               selinux_inode_getxattr,
4321         .inode_listxattr =              selinux_inode_listxattr,
4322         .inode_removexattr =            selinux_inode_removexattr,
4323         .inode_getsecurity =            selinux_inode_getsecurity,
4324         .inode_setsecurity =            selinux_inode_setsecurity,
4325         .inode_listsecurity =           selinux_inode_listsecurity,
4326
4327         .file_permission =              selinux_file_permission,
4328         .file_alloc_security =          selinux_file_alloc_security,
4329         .file_free_security =           selinux_file_free_security,
4330         .file_ioctl =                   selinux_file_ioctl,
4331         .file_mmap =                    selinux_file_mmap,
4332         .file_mprotect =                selinux_file_mprotect,
4333         .file_lock =                    selinux_file_lock,
4334         .file_fcntl =                   selinux_file_fcntl,
4335         .file_set_fowner =              selinux_file_set_fowner,
4336         .file_send_sigiotask =          selinux_file_send_sigiotask,
4337         .file_receive =                 selinux_file_receive,
4338
4339         .task_create =                  selinux_task_create,
4340         .task_alloc_security =          selinux_task_alloc_security,
4341         .task_free_security =           selinux_task_free_security,
4342         .task_setuid =                  selinux_task_setuid,
4343         .task_post_setuid =             selinux_task_post_setuid,
4344         .task_setgid =                  selinux_task_setgid,
4345         .task_setpgid =                 selinux_task_setpgid,
4346         .task_getpgid =                 selinux_task_getpgid,
4347         .task_getsid =                  selinux_task_getsid,
4348         .task_setgroups =               selinux_task_setgroups,
4349         .task_setnice =                 selinux_task_setnice,
4350         .task_setrlimit =               selinux_task_setrlimit,
4351         .task_setscheduler =            selinux_task_setscheduler,
4352         .task_getscheduler =            selinux_task_getscheduler,
4353         .task_kill =                    selinux_task_kill,
4354         .task_wait =                    selinux_task_wait,
4355         .task_prctl =                   selinux_task_prctl,
4356         .task_reparent_to_init =        selinux_task_reparent_to_init,
4357         .task_to_inode =                selinux_task_to_inode,
4358
4359         .ipc_permission =               selinux_ipc_permission,
4360
4361         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4362         .msg_msg_free_security =        selinux_msg_msg_free_security,
4363
4364         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4365         .msg_queue_free_security =      selinux_msg_queue_free_security,
4366         .msg_queue_associate =          selinux_msg_queue_associate,
4367         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4368         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4369         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4370
4371         .shm_alloc_security =           selinux_shm_alloc_security,
4372         .shm_free_security =            selinux_shm_free_security,
4373         .shm_associate =                selinux_shm_associate,
4374         .shm_shmctl =                   selinux_shm_shmctl,
4375         .shm_shmat =                    selinux_shm_shmat,
4376
4377         .sem_alloc_security =           selinux_sem_alloc_security,
4378         .sem_free_security =            selinux_sem_free_security,
4379         .sem_associate =                selinux_sem_associate,
4380         .sem_semctl =                   selinux_sem_semctl,
4381         .sem_semop =                    selinux_sem_semop,
4382
4383         .register_security =            selinux_register_security,
4384         .unregister_security =          selinux_unregister_security,
4385
4386         .d_instantiate =                selinux_d_instantiate,
4387
4388         .getprocattr =                  selinux_getprocattr,
4389         .setprocattr =                  selinux_setprocattr,
4390
4391 #ifdef CONFIG_SECURITY_NETWORK
4392         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4393         .unix_may_send =                selinux_socket_unix_may_send,
4394
4395         .socket_create =                selinux_socket_create,
4396         .socket_post_create =           selinux_socket_post_create,
4397         .socket_bind =                  selinux_socket_bind,
4398         .socket_connect =               selinux_socket_connect,
4399         .socket_listen =                selinux_socket_listen,
4400         .socket_accept =                selinux_socket_accept,
4401         .socket_sendmsg =               selinux_socket_sendmsg,
4402         .socket_recvmsg =               selinux_socket_recvmsg,
4403         .socket_getsockname =           selinux_socket_getsockname,
4404         .socket_getpeername =           selinux_socket_getpeername,
4405         .socket_getsockopt =            selinux_socket_getsockopt,
4406         .socket_setsockopt =            selinux_socket_setsockopt,
4407         .socket_shutdown =              selinux_socket_shutdown,
4408         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4409         .socket_getpeersec =            selinux_socket_getpeersec,
4410         .sk_alloc_security =            selinux_sk_alloc_security,
4411         .sk_free_security =             selinux_sk_free_security,
4412 #endif
4413 };
4414
4415 static __init int selinux_init(void)
4416 {
4417         struct task_security_struct *tsec;
4418
4419         if (!selinux_enabled) {
4420                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4421                 return 0;
4422         }
4423
4424         printk(KERN_INFO "SELinux:  Initializing.\n");
4425
4426         /* Set the security state for the initial task. */
4427         if (task_alloc_security(current))
4428                 panic("SELinux:  Failed to initialize initial task.\n");
4429         tsec = current->security;
4430         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4431
4432         avc_init();
4433
4434         original_ops = secondary_ops = security_ops;
4435         if (!secondary_ops)
4436                 panic ("SELinux: No initial security operations\n");
4437         if (register_security (&selinux_ops))
4438                 panic("SELinux: Unable to register with kernel.\n");
4439
4440         if (selinux_enforcing) {
4441                 printk(KERN_INFO "SELinux:  Starting in enforcing mode\n");
4442         } else {
4443                 printk(KERN_INFO "SELinux:  Starting in permissive mode\n");
4444         }
4445         return 0;
4446 }
4447
4448 void selinux_complete_init(void)
4449 {
4450         printk(KERN_INFO "SELinux:  Completing initialization.\n");
4451
4452         /* Set up any superblocks initialized prior to the policy load. */
4453         printk(KERN_INFO "SELinux:  Setting up existing superblocks.\n");
4454         spin_lock(&sb_security_lock);
4455 next_sb:
4456         if (!list_empty(&superblock_security_head)) {
4457                 struct superblock_security_struct *sbsec =
4458                                 list_entry(superblock_security_head.next,
4459                                            struct superblock_security_struct,
4460                                            list);
4461                 struct super_block *sb = sbsec->sb;
4462                 spin_lock(&sb_lock);
4463                 sb->s_count++;
4464                 spin_unlock(&sb_lock);
4465                 spin_unlock(&sb_security_lock);
4466                 down_read(&sb->s_umount);
4467                 if (sb->s_root)
4468                         superblock_doinit(sb, NULL);
4469                 drop_super(sb);
4470                 spin_lock(&sb_security_lock);
4471                 list_del_init(&sbsec->list);
4472                 goto next_sb;
4473         }
4474         spin_unlock(&sb_security_lock);
4475 }
4476
4477 /* SELinux requires early initialization in order to label
4478    all processes and objects when they are created. */
4479 security_initcall(selinux_init);
4480
4481 #if defined(CONFIG_SECURITY_NETWORK) && defined(CONFIG_NETFILTER)
4482
4483 static struct nf_hook_ops selinux_ipv4_op = {
4484         .hook =         selinux_ipv4_postroute_last,
4485         .owner =        THIS_MODULE,
4486         .pf =           PF_INET,
4487         .hooknum =      NF_IP_POST_ROUTING,
4488         .priority =     NF_IP_PRI_SELINUX_LAST,
4489 };
4490
4491 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4492
4493 static struct nf_hook_ops selinux_ipv6_op = {
4494         .hook =         selinux_ipv6_postroute_last,
4495         .owner =        THIS_MODULE,
4496         .pf =           PF_INET6,
4497         .hooknum =      NF_IP6_POST_ROUTING,
4498         .priority =     NF_IP6_PRI_SELINUX_LAST,
4499 };
4500
4501 #endif  /* IPV6 */
4502
4503 static int __init selinux_nf_ip_init(void)
4504 {
4505         int err = 0;
4506
4507         if (!selinux_enabled)
4508                 goto out;
4509
4510         printk(KERN_INFO "SELinux:  Registering netfilter hooks\n");
4511
4512         err = nf_register_hook(&selinux_ipv4_op);
4513         if (err)
4514                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
4515
4516 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4517
4518         err = nf_register_hook(&selinux_ipv6_op);
4519         if (err)
4520                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
4521
4522 #endif  /* IPV6 */
4523 out:
4524         return err;
4525 }
4526
4527 __initcall(selinux_nf_ip_init);
4528
4529 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4530 static void selinux_nf_ip_exit(void)
4531 {
4532         printk(KERN_INFO "SELinux:  Unregistering netfilter hooks\n");
4533
4534         nf_unregister_hook(&selinux_ipv4_op);
4535 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4536         nf_unregister_hook(&selinux_ipv6_op);
4537 #endif  /* IPV6 */
4538 }
4539 #endif
4540
4541 #else /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4542
4543 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4544 #define selinux_nf_ip_exit()
4545 #endif
4546
4547 #endif /* CONFIG_SECURITY_NETWORK && CONFIG_NETFILTER */
4548
4549 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
4550 int selinux_disable(void)
4551 {
4552         extern void exit_sel_fs(void);
4553         static int selinux_disabled = 0;
4554
4555         if (ss_initialized) {
4556                 /* Not permitted after initial policy load. */
4557                 return -EINVAL;
4558         }
4559
4560         if (selinux_disabled) {
4561                 /* Only do this once. */
4562                 return -EINVAL;
4563         }
4564
4565         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
4566
4567         selinux_disabled = 1;
4568
4569         /* Reset security_ops to the secondary module, dummy or capability. */
4570         security_ops = secondary_ops;
4571
4572         /* Unregister netfilter hooks. */
4573         selinux_nf_ip_exit();
4574
4575         /* Unregister selinuxfs. */
4576         exit_sel_fs();
4577
4578         return 0;
4579 }
4580 #endif
4581
4582