security/selinux/hooks.c

   1 /*
   2  *  NSA Security-Enhanced Linux (SELinux) security module
   3  *
   4  *  This file contains the SELinux hook function implementations.
   5  *
   6  *  Authors:  Stephen Smalley, <sds@epoch.ncsc.mil>
   7  *            Chris Vance, <cvance@nai.com>
   8  *            Wayne Salamon, <wsalamon@nai.com>
   9  *            James Morris <jmorris@redhat.com>
  10  *
  11  *  Copyright (C) 2001,2002 Networks Associates Technology, Inc.
  12  *  Copyright (C) 2003 Red Hat, Inc., James Morris <jmorris@redhat.com>
  13  *  Copyright (C) 2004-2005 Trusted Computer Solutions, Inc.
  14  *                          <dgoeddel@trustedcs.com>
  15  *  Copyright (C) 2006 Hewlett-Packard Development Company, L.P.
  16  *                     Paul Moore, <paul.moore@hp.com>
  17  *
  18  *      This program is free software; you can redistribute it and/or modify
  19  *      it under the terms of the GNU General Public License version 2,
  20  *      as published by the Free Software Foundation.
  21  */
  22
  23 #include <linux/module.h>
  24 #include <linux/init.h>
  25 #include <linux/kernel.h>
  26 #include <linux/ptrace.h>
  27 #include <linux/errno.h>
  28 #include <linux/sched.h>
  29 #include <linux/security.h>
  30 #include <linux/xattr.h>
  31 #include <linux/capability.h>
  32 #include <linux/unistd.h>
  33 #include <linux/mm.h>
  34 #include <linux/mman.h>
  35 #include <linux/slab.h>
  36 #include <linux/pagemap.h>
  37 #include <linux/swap.h>
  38 #include <linux/spinlock.h>
  39 #include <linux/syscalls.h>
  40 #include <linux/file.h>
  41 #include <linux/namei.h>
  42 #include <linux/mount.h>
  43 #include <linux/ext2_fs.h>
  44 #include <linux/proc_fs.h>
  45 #include <linux/kd.h>
  46 #include <linux/netfilter_ipv4.h>
  47 #include <linux/netfilter_ipv6.h>
  48 #include <linux/tty.h>
  49 #include <net/icmp.h>
  50 #include <net/ip.h>             /* for sysctl_local_port_range[] */
  51 #include <net/tcp.h>            /* struct or_callable used in sock_rcv_skb */
  52 #include <asm/uaccess.h>
  53 #include <asm/ioctls.h>
  54 #include <linux/bitops.h>
  55 #include <linux/interrupt.h>
  56 #include <linux/netdevice.h>    /* for network interface checks */
  57 #include <linux/netlink.h>
  58 #include <linux/tcp.h>
  59 #include <linux/udp.h>
  60 #include <linux/dccp.h>
  61 #include <linux/quota.h>
  62 #include <linux/un.h>           /* for Unix socket types */
  63 #include <net/af_unix.h>        /* for Unix socket types */
  64 #include <linux/parser.h>
  65 #include <linux/nfs_mount.h>
  66 #include <net/ipv6.h>
  67 #include <linux/hugetlb.h>
  68 #include <linux/personality.h>
  69 #include <linux/sysctl.h>
  70 #include <linux/audit.h>
  71 #include <linux/string.h>
  72 #include <linux/selinux.h>
  73 #include <linux/mutex.h>
  74
  75 #include "avc.h"
  76 #include "objsec.h"
  77 #include "netif.h"
  78 #include "xfrm.h"
  79 #include "netlabel.h"
  80
  81 #define XATTR_SELINUX_SUFFIX "selinux"
  82 #define XATTR_NAME_SELINUX XATTR_SECURITY_PREFIX XATTR_SELINUX_SUFFIX
  83
  84 extern unsigned int policydb_loaded_version;
  85 extern int selinux_nlmsg_lookup(u16 sclass, u16 nlmsg_type, u32 *perm);
  86 extern int selinux_compat_net;
  87
  88 #ifdef CONFIG_SECURITY_SELINUX_DEVELOP
  89 int selinux_enforcing = 0;
  90
  91 static int __init enforcing_setup(char *str)
  92 {
  93         selinux_enforcing = simple_strtol(str,NULL,0);
  94         return 1;
  95 }
  96 __setup("enforcing=", enforcing_setup);
  97 #endif
  98
  99 #ifdef CONFIG_SECURITY_SELINUX_BOOTPARAM
 100 int selinux_enabled = CONFIG_SECURITY_SELINUX_BOOTPARAM_VALUE;
 101
 102 static int __init selinux_enabled_setup(char *str)
 103 {
 104         selinux_enabled = simple_strtol(str, NULL, 0);
 105         return 1;
 106 }
 107 __setup("selinux=", selinux_enabled_setup);
 108 #else
 109 int selinux_enabled = 1;
 110 #endif
 111
 112 /* Original (dummy) security module. */
 113 static struct security_operations *original_ops = NULL;
 114
 115 /* Minimal support for a secondary security module,
 116    just to allow the use of the dummy or capability modules.
 117    The owlsm module can alternatively be used as a secondary
 118    module as long as CONFIG_OWLSM_FD is not enabled. */
 119 static struct security_operations *secondary_ops = NULL;
 120
 121 /* Lists of inode and superblock security structures initialized
 122    before the policy was loaded. */
 123 static LIST_HEAD(superblock_security_head);
 124 static DEFINE_SPINLOCK(sb_security_lock);
 125
 126 static struct kmem_cache *sel_inode_cache;
 127
 128 /* Return security context for a given sid or just the context
 129    length if the buffer is null or length is 0 */
 130 static int selinux_getsecurity(u32 sid, void *buffer, size_t size)
 131 {
 132         char *context;
 133         unsigned len;
 134         int rc;
 135
 136         rc = security_sid_to_context(sid, &context, &len);
 137         if (rc)
 138                 return rc;
 139
 140         if (!buffer || !size)
 141                 goto getsecurity_exit;
 142
 143         if (size < len) {
 144                 len = -ERANGE;
 145                 goto getsecurity_exit;
 146         }
 147         memcpy(buffer, context, len);
 148
 149 getsecurity_exit:
 150         kfree(context);
 151         return len;
 152 }
 153
 154 /* Allocate and free functions for each kind of security blob. */
 155
 156 static int task_alloc_security(struct task_struct *task)
 157 {
 158         struct task_security_struct *tsec;
 159
 160         tsec = kzalloc(sizeof(struct task_security_struct), GFP_KERNEL);
 161         if (!tsec)
 162                 return -ENOMEM;
 163
 164         tsec->task = task;
 165         tsec->osid = tsec->sid = tsec->ptrace_sid = SECINITSID_UNLABELED;
 166         task->security = tsec;
 167
 168         return 0;
 169 }
 170
 171 static void task_free_security(struct task_struct *task)
 172 {
 173         struct task_security_struct *tsec = task->security;
 174         task->security = NULL;
 175         kfree(tsec);
 176 }
 177
 178 static int inode_alloc_security(struct inode *inode)
 179 {
 180         struct task_security_struct *tsec = current->security;
 181         struct inode_security_struct *isec;
 182
 183         isec = kmem_cache_zalloc(sel_inode_cache, GFP_KERNEL);
 184         if (!isec)
 185                 return -ENOMEM;
 186
 187         mutex_init(&isec->lock);
 188         INIT_LIST_HEAD(&isec->list);
 189         isec->inode = inode;
 190         isec->sid = SECINITSID_UNLABELED;
 191         isec->sclass = SECCLASS_FILE;
 192         isec->task_sid = tsec->sid;
 193         inode->i_security = isec;
 194
 195         return 0;
 196 }
 197
 198 static void inode_free_security(struct inode *inode)
 199 {
 200         struct inode_security_struct *isec = inode->i_security;
 201         struct superblock_security_struct *sbsec = inode->i_sb->s_security;
 202
 203         spin_lock(&sbsec->isec_lock);
 204         if (!list_empty(&isec->list))
 205                 list_del_init(&isec->list);
 206         spin_unlock(&sbsec->isec_lock);
 207
 208         inode->i_security = NULL;
 209         kmem_cache_free(sel_inode_cache, isec);
 210 }
 211
 212 static int file_alloc_security(struct file *file)
 213 {
 214         struct task_security_struct *tsec = current->security;
 215         struct file_security_struct *fsec;
 216
 217         fsec = kzalloc(sizeof(struct file_security_struct), GFP_KERNEL);
 218         if (!fsec)
 219                 return -ENOMEM;
 220
 221         fsec->file = file;
 222         fsec->sid = tsec->sid;
 223         fsec->fown_sid = tsec->sid;
 224         file->f_security = fsec;
 225
 226         return 0;
 227 }
 228
 229 static void file_free_security(struct file *file)
 230 {
 231         struct file_security_struct *fsec = file->f_security;
 232         file->f_security = NULL;
 233         kfree(fsec);
 234 }
 235
 236 static int superblock_alloc_security(struct super_block *sb)
 237 {
 238         struct superblock_security_struct *sbsec;
 239
 240         sbsec = kzalloc(sizeof(struct superblock_security_struct), GFP_KERNEL);
 241         if (!sbsec)
 242                 return -ENOMEM;
 243
 244         mutex_init(&sbsec->lock);
 245         INIT_LIST_HEAD(&sbsec->list);
 246         INIT_LIST_HEAD(&sbsec->isec_head);
 247         spin_lock_init(&sbsec->isec_lock);
 248         sbsec->sb = sb;
 249         sbsec->sid = SECINITSID_UNLABELED;
 250         sbsec->def_sid = SECINITSID_FILE;
 251         sbsec->mntpoint_sid = SECINITSID_UNLABELED;
 252         sb->s_security = sbsec;
 253
 254         return 0;
 255 }
 256
 257 static void superblock_free_security(struct super_block *sb)
 258 {
 259         struct superblock_security_struct *sbsec = sb->s_security;
 260
 261         spin_lock(&sb_security_lock);
 262         if (!list_empty(&sbsec->list))
 263                 list_del_init(&sbsec->list);
 264         spin_unlock(&sb_security_lock);
 265
 266         sb->s_security = NULL;
 267         kfree(sbsec);
 268 }
 269
 270 static int sk_alloc_security(struct sock *sk, int family, gfp_t priority)
 271 {
 272         struct sk_security_struct *ssec;
 273
 274         ssec = kzalloc(sizeof(*ssec), priority);
 275         if (!ssec)
 276                 return -ENOMEM;
 277
 278         ssec->sk = sk;
 279         ssec->peer_sid = SECINITSID_UNLABELED;
 280         ssec->sid = SECINITSID_UNLABELED;
 281         sk->sk_security = ssec;
 282
 283         selinux_netlbl_sk_security_init(ssec, family);
 284
 285         return 0;
 286 }
 287
 288 static void sk_free_security(struct sock *sk)
 289 {
 290         struct sk_security_struct *ssec = sk->sk_security;
 291
 292         sk->sk_security = NULL;
 293         kfree(ssec);
 294 }
 295
 296 /* The security server must be initialized before
 297    any labeling or access decisions can be provided. */
 298 extern int ss_initialized;
 299
 300 /* The file system's label must be initialized prior to use. */
 301
 302 static char *labeling_behaviors[6] = {
 303         "uses xattr",
 304         "uses transition SIDs",
 305         "uses task SIDs",
 306         "uses genfs_contexts",
 307         "not configured for labeling",
 308         "uses mountpoint labeling",
 309 };
 310
 311 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry);
 312
 313 static inline int inode_doinit(struct inode *inode)
 314 {
 315         return inode_doinit_with_dentry(inode, NULL);
 316 }
 317
 318 enum {
 319         Opt_context = 1,
 320         Opt_fscontext = 2,
 321         Opt_defcontext = 4,
 322         Opt_rootcontext = 8,
 323 };
 324
 325 static match_table_t tokens = {
 326         {Opt_context, "context=%s"},
 327         {Opt_fscontext, "fscontext=%s"},
 328         {Opt_defcontext, "defcontext=%s"},
 329         {Opt_rootcontext, "rootcontext=%s"},
 330 };
 331
 332 #define SEL_MOUNT_FAIL_MSG "SELinux:  duplicate or incompatible mount options\n"
 333
 334 static int may_context_mount_sb_relabel(u32 sid,
 335                         struct superblock_security_struct *sbsec,
 336                         struct task_security_struct *tsec)
 337 {
 338         int rc;
 339
 340         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 341                           FILESYSTEM__RELABELFROM, NULL);
 342         if (rc)
 343                 return rc;
 344
 345         rc = avc_has_perm(tsec->sid, sid, SECCLASS_FILESYSTEM,
 346                           FILESYSTEM__RELABELTO, NULL);
 347         return rc;
 348 }
 349
 350 static int may_context_mount_inode_relabel(u32 sid,
 351                         struct superblock_security_struct *sbsec,
 352                         struct task_security_struct *tsec)
 353 {
 354         int rc;
 355         rc = avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
 356                           FILESYSTEM__RELABELFROM, NULL);
 357         if (rc)
 358                 return rc;
 359
 360         rc = avc_has_perm(sid, sbsec->sid, SECCLASS_FILESYSTEM,
 361                           FILESYSTEM__ASSOCIATE, NULL);
 362         return rc;
 363 }
 364
 365 static int try_context_mount(struct super_block *sb, void *data)
 366 {
 367         char *context = NULL, *defcontext = NULL;
 368         char *fscontext = NULL, *rootcontext = NULL;
 369         const char *name;
 370         u32 sid;
 371         int alloc = 0, rc = 0, seen = 0;
 372         struct task_security_struct *tsec = current->security;
 373         struct superblock_security_struct *sbsec = sb->s_security;
 374
 375         if (!data)
 376                 goto out;
 377
 378         name = sb->s_type->name;
 379
 380         if (sb->s_type->fs_flags & FS_BINARY_MOUNTDATA) {
 381
 382                 /* NFS we understand. */
 383                 if (!strcmp(name, "nfs")) {
 384                         struct nfs_mount_data *d = data;
 385
 386                         if (d->version <  NFS_MOUNT_VERSION)
 387                                 goto out;
 388
 389                         if (d->context[0]) {
 390                                 context = d->context;
 391                                 seen |= Opt_context;
 392                         }
 393                 } else
 394                         goto out;
 395
 396         } else {
 397                 /* Standard string-based options. */
 398                 char *p, *options = data;
 399
 400                 while ((p = strsep(&options, "|")) != NULL) {
 401                         int token;
 402                         substring_t args[MAX_OPT_ARGS];
 403
 404                         if (!*p)
 405                                 continue;
 406
 407                         token = match_token(p, tokens, args);
 408
 409                         switch (token) {
 410                         case Opt_context:
 411                                 if (seen & (Opt_context|Opt_defcontext)) {
 412                                         rc = -EINVAL;
 413                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 414                                         goto out_free;
 415                                 }
 416                                 context = match_strdup(&args[0]);
 417                                 if (!context) {
 418                                         rc = -ENOMEM;
 419                                         goto out_free;
 420                                 }
 421                                 if (!alloc)
 422                                         alloc = 1;
 423                                 seen |= Opt_context;
 424                                 break;
 425
 426                         case Opt_fscontext:
 427                                 if (seen & Opt_fscontext) {
 428                                         rc = -EINVAL;
 429                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 430                                         goto out_free;
 431                                 }
 432                                 fscontext = match_strdup(&args[0]);
 433                                 if (!fscontext) {
 434                                         rc = -ENOMEM;
 435                                         goto out_free;
 436                                 }
 437                                 if (!alloc)
 438                                         alloc = 1;
 439                                 seen |= Opt_fscontext;
 440                                 break;
 441
 442                         case Opt_rootcontext:
 443                                 if (seen & Opt_rootcontext) {
 444                                         rc = -EINVAL;
 445                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 446                                         goto out_free;
 447                                 }
 448                                 rootcontext = match_strdup(&args[0]);
 449                                 if (!rootcontext) {
 450                                         rc = -ENOMEM;
 451                                         goto out_free;
 452                                 }
 453                                 if (!alloc)
 454                                         alloc = 1;
 455                                 seen |= Opt_rootcontext;
 456                                 break;
 457
 458                         case Opt_defcontext:
 459                                 if (sbsec->behavior != SECURITY_FS_USE_XATTR) {
 460                                         rc = -EINVAL;
 461                                         printk(KERN_WARNING "SELinux:  "
 462                                                "defcontext option is invalid "
 463                                                "for this filesystem type\n");
 464                                         goto out_free;
 465                                 }
 466                                 if (seen & (Opt_context|Opt_defcontext)) {
 467                                         rc = -EINVAL;
 468                                         printk(KERN_WARNING SEL_MOUNT_FAIL_MSG);
 469                                         goto out_free;
 470                                 }
 471                                 defcontext = match_strdup(&args[0]);
 472                                 if (!defcontext) {
 473                                         rc = -ENOMEM;
 474                                         goto out_free;
 475                                 }
 476                                 if (!alloc)
 477                                         alloc = 1;
 478                                 seen |= Opt_defcontext;
 479                                 break;
 480
 481                         default:
 482                                 rc = -EINVAL;
 483                                 printk(KERN_WARNING "SELinux:  unknown mount "
 484                                        "option\n");
 485                                 goto out_free;
 486
 487                         }
 488                 }
 489         }
 490
 491         if (!seen)
 492                 goto out;
 493
 494         /* sets the context of the superblock for the fs being mounted. */
 495         if (fscontext) {
 496                 rc = security_context_to_sid(fscontext, strlen(fscontext), &sid);
 497                 if (rc) {
 498                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 499                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 500                                fscontext, sb->s_id, name, rc);
 501                         goto out_free;
 502                 }
 503
 504                 rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 505                 if (rc)
 506                         goto out_free;
 507
 508                 sbsec->sid = sid;
 509         }
 510
 511         /*
 512          * Switch to using mount point labeling behavior.
 513          * sets the label used on all file below the mountpoint, and will set
 514          * the superblock context if not already set.
 515          */
 516         if (context) {
 517                 rc = security_context_to_sid(context, strlen(context), &sid);
 518                 if (rc) {
 519                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 520                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 521                                context, sb->s_id, name, rc);
 522                         goto out_free;
 523                 }
 524
 525                 if (!fscontext) {
 526                         rc = may_context_mount_sb_relabel(sid, sbsec, tsec);
 527                         if (rc)
 528                                 goto out_free;
 529                         sbsec->sid = sid;
 530                 } else {
 531                         rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 532                         if (rc)
 533                                 goto out_free;
 534                 }
 535                 sbsec->mntpoint_sid = sid;
 536
 537                 sbsec->behavior = SECURITY_FS_USE_MNTPOINT;
 538         }
 539
 540         if (rootcontext) {
 541                 struct inode *inode = sb->s_root->d_inode;
 542                 struct inode_security_struct *isec = inode->i_security;
 543                 rc = security_context_to_sid(rootcontext, strlen(rootcontext), &sid);
 544                 if (rc) {
 545                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 546                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 547                                rootcontext, sb->s_id, name, rc);
 548                         goto out_free;
 549                 }
 550
 551                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 552                 if (rc)
 553                         goto out_free;
 554
 555                 isec->sid = sid;
 556                 isec->initialized = 1;
 557         }
 558
 559         if (defcontext) {
 560                 rc = security_context_to_sid(defcontext, strlen(defcontext), &sid);
 561                 if (rc) {
 562                         printk(KERN_WARNING "SELinux: security_context_to_sid"
 563                                "(%s) failed for (dev %s, type %s) errno=%d\n",
 564                                defcontext, sb->s_id, name, rc);
 565                         goto out_free;
 566                 }
 567
 568                 if (sid == sbsec->def_sid)
 569                         goto out_free;
 570
 571                 rc = may_context_mount_inode_relabel(sid, sbsec, tsec);
 572                 if (rc)
 573                         goto out_free;
 574
 575                 sbsec->def_sid = sid;
 576         }
 577
 578 out_free:
 579         if (alloc) {
 580                 kfree(context);
 581                 kfree(defcontext);
 582                 kfree(fscontext);
 583                 kfree(rootcontext);
 584         }
 585 out:
 586         return rc;
 587 }
 588
 589 static int superblock_doinit(struct super_block *sb, void *data)
 590 {
 591         struct superblock_security_struct *sbsec = sb->s_security;
 592         struct dentry *root = sb->s_root;
 593         struct inode *inode = root->d_inode;
 594         int rc = 0;
 595
 596         mutex_lock(&sbsec->lock);
 597         if (sbsec->initialized)
 598                 goto out;
 599
 600         if (!ss_initialized) {
 601                 /* Defer initialization until selinux_complete_init,
 602                    after the initial policy is loaded and the security
 603                    server is ready to handle calls. */
 604                 spin_lock(&sb_security_lock);
 605                 if (list_empty(&sbsec->list))
 606                         list_add(&sbsec->list, &superblock_security_head);
 607                 spin_unlock(&sb_security_lock);
 608                 goto out;
 609         }
 610
 611         /* Determine the labeling behavior to use for this filesystem type. */
 612         rc = security_fs_use(sb->s_type->name, &sbsec->behavior, &sbsec->sid);
 613         if (rc) {
 614                 printk(KERN_WARNING "%s:  security_fs_use(%s) returned %d\n",
 615                        __FUNCTION__, sb->s_type->name, rc);
 616                 goto out;
 617         }
 618
 619         rc = try_context_mount(sb, data);
 620         if (rc)
 621                 goto out;
 622
 623         if (sbsec->behavior == SECURITY_FS_USE_XATTR) {
 624                 /* Make sure that the xattr handler exists and that no
 625                    error other than -ENODATA is returned by getxattr on
 626                    the root directory.  -ENODATA is ok, as this may be
 627                    the first boot of the SELinux kernel before we have
 628                    assigned xattr values to the filesystem. */
 629                 if (!inode->i_op->getxattr) {
 630                         printk(KERN_WARNING "SELinux: (dev %s, type %s) has no "
 631                                "xattr support\n", sb->s_id, sb->s_type->name);
 632                         rc = -EOPNOTSUPP;
 633                         goto out;
 634                 }
 635                 rc = inode->i_op->getxattr(root, XATTR_NAME_SELINUX, NULL, 0);
 636                 if (rc < 0 && rc != -ENODATA) {
 637                         if (rc == -EOPNOTSUPP)
 638                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 639                                        "%s) has no security xattr handler\n",
 640                                        sb->s_id, sb->s_type->name);
 641                         else
 642                                 printk(KERN_WARNING "SELinux: (dev %s, type "
 643                                        "%s) getxattr errno %d\n", sb->s_id,
 644                                        sb->s_type->name, -rc);
 645                         goto out;
 646                 }
 647         }
 648
 649         if (strcmp(sb->s_type->name, "proc") == 0)
 650                 sbsec->proc = 1;
 651
 652         sbsec->initialized = 1;
 653
 654         if (sbsec->behavior > ARRAY_SIZE(labeling_behaviors)) {
 655                 printk(KERN_ERR "SELinux: initialized (dev %s, type %s), unknown behavior\n",
 656                        sb->s_id, sb->s_type->name);
 657         }
 658         else {
 659                 printk(KERN_DEBUG "SELinux: initialized (dev %s, type %s), %s\n",
 660                        sb->s_id, sb->s_type->name,
 661                        labeling_behaviors[sbsec->behavior-1]);
 662         }
 663
 664         /* Initialize the root inode. */
 665         rc = inode_doinit_with_dentry(sb->s_root->d_inode, sb->s_root);
 666
 667         /* Initialize any other inodes associated with the superblock, e.g.
 668            inodes created prior to initial policy load or inodes created
 669            during get_sb by a pseudo filesystem that directly
 670            populates itself. */
 671         spin_lock(&sbsec->isec_lock);
 672 next_inode:
 673         if (!list_empty(&sbsec->isec_head)) {
 674                 struct inode_security_struct *isec =
 675                                 list_entry(sbsec->isec_head.next,
 676                                            struct inode_security_struct, list);
 677                 struct inode *inode = isec->inode;
 678                 spin_unlock(&sbsec->isec_lock);
 679                 inode = igrab(inode);
 680                 if (inode) {
 681                         if (!IS_PRIVATE (inode))
 682                                 inode_doinit(inode);
 683                         iput(inode);
 684                 }
 685                 spin_lock(&sbsec->isec_lock);
 686                 list_del_init(&isec->list);
 687                 goto next_inode;
 688         }
 689         spin_unlock(&sbsec->isec_lock);
 690 out:
 691         mutex_unlock(&sbsec->lock);
 692         return rc;
 693 }
 694
 695 static inline u16 inode_mode_to_security_class(umode_t mode)
 696 {
 697         switch (mode & S_IFMT) {
 698         case S_IFSOCK:
 699                 return SECCLASS_SOCK_FILE;
 700         case S_IFLNK:
 701                 return SECCLASS_LNK_FILE;
 702         case S_IFREG:
 703                 return SECCLASS_FILE;
 704         case S_IFBLK:
 705                 return SECCLASS_BLK_FILE;
 706         case S_IFDIR:
 707                 return SECCLASS_DIR;
 708         case S_IFCHR:
 709                 return SECCLASS_CHR_FILE;
 710         case S_IFIFO:
 711                 return SECCLASS_FIFO_FILE;
 712
 713         }
 714
 715         return SECCLASS_FILE;
 716 }
 717
 718 static inline int default_protocol_stream(int protocol)
 719 {
 720         return (protocol == IPPROTO_IP || protocol == IPPROTO_TCP);
 721 }
 722
 723 static inline int default_protocol_dgram(int protocol)
 724 {
 725         return (protocol == IPPROTO_IP || protocol == IPPROTO_UDP);
 726 }
 727
 728 static inline u16 socket_type_to_security_class(int family, int type, int protocol)
 729 {
 730         switch (family) {
 731         case PF_UNIX:
 732                 switch (type) {
 733                 case SOCK_STREAM:
 734                 case SOCK_SEQPACKET:
 735                         return SECCLASS_UNIX_STREAM_SOCKET;
 736                 case SOCK_DGRAM:
 737                         return SECCLASS_UNIX_DGRAM_SOCKET;
 738                 }
 739                 break;
 740         case PF_INET:
 741         case PF_INET6:
 742                 switch (type) {
 743                 case SOCK_STREAM:
 744                         if (default_protocol_stream(protocol))
 745                                 return SECCLASS_TCP_SOCKET;
 746                         else
 747                                 return SECCLASS_RAWIP_SOCKET;
 748                 case SOCK_DGRAM:
 749                         if (default_protocol_dgram(protocol))
 750                                 return SECCLASS_UDP_SOCKET;
 751                         else
 752                                 return SECCLASS_RAWIP_SOCKET;
 753                 case SOCK_DCCP:
 754                         return SECCLASS_DCCP_SOCKET;
 755                 default:
 756                         return SECCLASS_RAWIP_SOCKET;
 757                 }
 758                 break;
 759         case PF_NETLINK:
 760                 switch (protocol) {
 761                 case NETLINK_ROUTE:
 762                         return SECCLASS_NETLINK_ROUTE_SOCKET;
 763                 case NETLINK_FIREWALL:
 764                         return SECCLASS_NETLINK_FIREWALL_SOCKET;
 765                 case NETLINK_INET_DIAG:
 766                         return SECCLASS_NETLINK_TCPDIAG_SOCKET;
 767                 case NETLINK_NFLOG:
 768                         return SECCLASS_NETLINK_NFLOG_SOCKET;
 769                 case NETLINK_XFRM:
 770                         return SECCLASS_NETLINK_XFRM_SOCKET;
 771                 case NETLINK_SELINUX:
 772                         return SECCLASS_NETLINK_SELINUX_SOCKET;
 773                 case NETLINK_AUDIT:
 774                         return SECCLASS_NETLINK_AUDIT_SOCKET;
 775                 case NETLINK_IP6_FW:
 776                         return SECCLASS_NETLINK_IP6FW_SOCKET;
 777                 case NETLINK_DNRTMSG:
 778                         return SECCLASS_NETLINK_DNRT_SOCKET;
 779                 case NETLINK_KOBJECT_UEVENT:
 780                         return SECCLASS_NETLINK_KOBJECT_UEVENT_SOCKET;
 781                 default:
 782                         return SECCLASS_NETLINK_SOCKET;
 783                 }
 784         case PF_PACKET:
 785                 return SECCLASS_PACKET_SOCKET;
 786         case PF_KEY:
 787                 return SECCLASS_KEY_SOCKET;
 788         case PF_APPLETALK:
 789                 return SECCLASS_APPLETALK_SOCKET;
 790         }
 791
 792         return SECCLASS_SOCKET;
 793 }
 794
 795 #ifdef CONFIG_PROC_FS
 796 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 797                                 u16 tclass,
 798                                 u32 *sid)
 799 {
 800         int buflen, rc;
 801         char *buffer, *path, *end;
 802
 803         buffer = (char*)__get_free_page(GFP_KERNEL);
 804         if (!buffer)
 805                 return -ENOMEM;
 806
 807         buflen = PAGE_SIZE;
 808         end = buffer+buflen;
 809         *--end = '\0';
 810         buflen--;
 811         path = end-1;
 812         *path = '/';
 813         while (de && de != de->parent) {
 814                 buflen -= de->namelen + 1;
 815                 if (buflen < 0)
 816                         break;
 817                 end -= de->namelen;
 818                 memcpy(end, de->name, de->namelen);
 819                 *--end = '/';
 820                 path = end;
 821                 de = de->parent;
 822         }
 823         rc = security_genfs_sid("proc", path, tclass, sid);
 824         free_page((unsigned long)buffer);
 825         return rc;
 826 }
 827 #else
 828 static int selinux_proc_get_sid(struct proc_dir_entry *de,
 829                                 u16 tclass,
 830                                 u32 *sid)
 831 {
 832         return -EINVAL;
 833 }
 834 #endif
 835
 836 /* The inode's security attributes must be initialized before first use. */
 837 static int inode_doinit_with_dentry(struct inode *inode, struct dentry *opt_dentry)
 838 {
 839         struct superblock_security_struct *sbsec = NULL;
 840         struct inode_security_struct *isec = inode->i_security;
 841         u32 sid;
 842         struct dentry *dentry;
 843 #define INITCONTEXTLEN 255
 844         char *context = NULL;
 845         unsigned len = 0;
 846         int rc = 0;
 847
 848         if (isec->initialized)
 849                 goto out;
 850
 851         mutex_lock(&isec->lock);
 852         if (isec->initialized)
 853                 goto out_unlock;
 854
 855         sbsec = inode->i_sb->s_security;
 856         if (!sbsec->initialized) {
 857                 /* Defer initialization until selinux_complete_init,
 858                    after the initial policy is loaded and the security
 859                    server is ready to handle calls. */
 860                 spin_lock(&sbsec->isec_lock);
 861                 if (list_empty(&isec->list))
 862                         list_add(&isec->list, &sbsec->isec_head);
 863                 spin_unlock(&sbsec->isec_lock);
 864                 goto out_unlock;
 865         }
 866
 867         switch (sbsec->behavior) {
 868         case SECURITY_FS_USE_XATTR:
 869                 if (!inode->i_op->getxattr) {
 870                         isec->sid = sbsec->def_sid;
 871                         break;
 872                 }
 873
 874                 /* Need a dentry, since the xattr API requires one.
 875                    Life would be simpler if we could just pass the inode. */
 876                 if (opt_dentry) {
 877                         /* Called from d_instantiate or d_splice_alias. */
 878                         dentry = dget(opt_dentry);
 879                 } else {
 880                         /* Called from selinux_complete_init, try to find a dentry. */
 881                         dentry = d_find_alias(inode);
 882                 }
 883                 if (!dentry) {
 884                         printk(KERN_WARNING "%s:  no dentry for dev=%s "
 885                                "ino=%ld\n", __FUNCTION__, inode->i_sb->s_id,
 886                                inode->i_ino);
 887                         goto out_unlock;
 888                 }
 889
 890                 len = INITCONTEXTLEN;
 891                 context = kmalloc(len, GFP_KERNEL);
 892                 if (!context) {
 893                         rc = -ENOMEM;
 894                         dput(dentry);
 895                         goto out_unlock;
 896                 }
 897                 rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 898                                            context, len);
 899                 if (rc == -ERANGE) {
 900                         /* Need a larger buffer.  Query for the right size. */
 901                         rc = inode->i_op->getxattr(dentry, XATTR_NAME_SELINUX,
 902                                                    NULL, 0);
 903                         if (rc < 0) {
 904                                 dput(dentry);
 905                                 goto out_unlock;
 906                         }
 907                         kfree(context);
 908                         len = rc;
 909                         context = kmalloc(len, GFP_KERNEL);
 910                         if (!context) {
 911                                 rc = -ENOMEM;
 912                                 dput(dentry);
 913                                 goto out_unlock;
 914                         }
 915                         rc = inode->i_op->getxattr(dentry,
 916                                                    XATTR_NAME_SELINUX,
 917                                                    context, len);
 918                 }
 919                 dput(dentry);
 920                 if (rc < 0) {
 921                         if (rc != -ENODATA) {
 922                                 printk(KERN_WARNING "%s:  getxattr returned "
 923                                        "%d for dev=%s ino=%ld\n", __FUNCTION__,
 924                                        -rc, inode->i_sb->s_id, inode->i_ino);
 925                                 kfree(context);
 926                                 goto out_unlock;
 927                         }
 928                         /* Map ENODATA to the default file SID */
 929                         sid = sbsec->def_sid;
 930                         rc = 0;
 931                 } else {
 932                         rc = security_context_to_sid_default(context, rc, &sid,
 933                                                              sbsec->def_sid);
 934                         if (rc) {
 935                                 printk(KERN_WARNING "%s:  context_to_sid(%s) "
 936                                        "returned %d for dev=%s ino=%ld\n",
 937                                        __FUNCTION__, context, -rc,
 938                                        inode->i_sb->s_id, inode->i_ino);
 939                                 kfree(context);
 940                                 /* Leave with the unlabeled SID */
 941                                 rc = 0;
 942                                 break;
 943                         }
 944                 }
 945                 kfree(context);
 946                 isec->sid = sid;
 947                 break;
 948         case SECURITY_FS_USE_TASK:
 949                 isec->sid = isec->task_sid;
 950                 break;
 951         case SECURITY_FS_USE_TRANS:
 952                 /* Default to the fs SID. */
 953                 isec->sid = sbsec->sid;
 954
 955                 /* Try to obtain a transition SID. */
 956                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 957                 rc = security_transition_sid(isec->task_sid,
 958                                              sbsec->sid,
 959                                              isec->sclass,
 960                                              &sid);
 961                 if (rc)
 962                         goto out_unlock;
 963                 isec->sid = sid;
 964                 break;
 965         case SECURITY_FS_USE_MNTPOINT:
 966                 isec->sid = sbsec->mntpoint_sid;
 967                 break;
 968         default:
 969                 /* Default to the fs superblock SID. */
 970                 isec->sid = sbsec->sid;
 971
 972                 if (sbsec->proc) {
 973                         struct proc_inode *proci = PROC_I(inode);
 974                         if (proci->pde) {
 975                                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 976                                 rc = selinux_proc_get_sid(proci->pde,
 977                                                           isec->sclass,
 978                                                           &sid);
 979                                 if (rc)
 980                                         goto out_unlock;
 981                                 isec->sid = sid;
 982                         }
 983                 }
 984                 break;
 985         }
 986
 987         isec->initialized = 1;
 988
 989 out_unlock:
 990         mutex_unlock(&isec->lock);
 991 out:
 992         if (isec->sclass == SECCLASS_FILE)
 993                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
 994         return rc;
 995 }
 996
 997 /* Convert a Linux signal to an access vector. */
 998 static inline u32 signal_to_av(int sig)
 999 {
1000         u32 perm = 0;
1001
1002         switch (sig) {
1003         case SIGCHLD:
1004                 /* Commonly granted from child to parent. */
1005                 perm = PROCESS__SIGCHLD;
1006                 break;
1007         case SIGKILL:
1008                 /* Cannot be caught or ignored */
1009                 perm = PROCESS__SIGKILL;
1010                 break;
1011         case SIGSTOP:
1012                 /* Cannot be caught or ignored */
1013                 perm = PROCESS__SIGSTOP;
1014                 break;
1015         default:
1016                 /* All other signals. */
1017                 perm = PROCESS__SIGNAL;
1018                 break;
1019         }
1020
1021         return perm;
1022 }
1023
1024 /* Check permission betweeen a pair of tasks, e.g. signal checks,
1025    fork check, ptrace check, etc. */
1026 static int task_has_perm(struct task_struct *tsk1,
1027                          struct task_struct *tsk2,
1028                          u32 perms)
1029 {
1030         struct task_security_struct *tsec1, *tsec2;
1031
1032         tsec1 = tsk1->security;
1033         tsec2 = tsk2->security;
1034         return avc_has_perm(tsec1->sid, tsec2->sid,
1035                             SECCLASS_PROCESS, perms, NULL);
1036 }
1037
1038 /* Check whether a task is allowed to use a capability. */
1039 static int task_has_capability(struct task_struct *tsk,
1040                                int cap)
1041 {
1042         struct task_security_struct *tsec;
1043         struct avc_audit_data ad;
1044
1045         tsec = tsk->security;
1046
1047         AVC_AUDIT_DATA_INIT(&ad,CAP);
1048         ad.tsk = tsk;
1049         ad.u.cap = cap;
1050
1051         return avc_has_perm(tsec->sid, tsec->sid,
1052                             SECCLASS_CAPABILITY, CAP_TO_MASK(cap), &ad);
1053 }
1054
1055 /* Check whether a task is allowed to use a system operation. */
1056 static int task_has_system(struct task_struct *tsk,
1057                            u32 perms)
1058 {
1059         struct task_security_struct *tsec;
1060
1061         tsec = tsk->security;
1062
1063         return avc_has_perm(tsec->sid, SECINITSID_KERNEL,
1064                             SECCLASS_SYSTEM, perms, NULL);
1065 }
1066
1067 /* Check whether a task has a particular permission to an inode.
1068    The 'adp' parameter is optional and allows other audit
1069    data to be passed (e.g. the dentry). */
1070 static int inode_has_perm(struct task_struct *tsk,
1071                           struct inode *inode,
1072                           u32 perms,
1073                           struct avc_audit_data *adp)
1074 {
1075         struct task_security_struct *tsec;
1076         struct inode_security_struct *isec;
1077         struct avc_audit_data ad;
1078
1079         if (unlikely (IS_PRIVATE (inode)))
1080                 return 0;
1081
1082         tsec = tsk->security;
1083         isec = inode->i_security;
1084
1085         if (!adp) {
1086                 adp = &ad;
1087                 AVC_AUDIT_DATA_INIT(&ad, FS);
1088                 ad.u.fs.inode = inode;
1089         }
1090
1091         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, adp);
1092 }
1093
1094 /* Same as inode_has_perm, but pass explicit audit data containing
1095    the dentry to help the auditing code to more easily generate the
1096    pathname if needed. */
1097 static inline int dentry_has_perm(struct task_struct *tsk,
1098                                   struct vfsmount *mnt,
1099                                   struct dentry *dentry,
1100                                   u32 av)
1101 {
1102         struct inode *inode = dentry->d_inode;
1103         struct avc_audit_data ad;
1104         AVC_AUDIT_DATA_INIT(&ad,FS);
1105         ad.u.fs.mnt = mnt;
1106         ad.u.fs.dentry = dentry;
1107         return inode_has_perm(tsk, inode, av, &ad);
1108 }
1109
1110 /* Check whether a task can use an open file descriptor to
1111    access an inode in a given way.  Check access to the
1112    descriptor itself, and then use dentry_has_perm to
1113    check a particular permission to the file.
1114    Access to the descriptor is implicitly granted if it
1115    has the same SID as the process.  If av is zero, then
1116    access to the file is not checked, e.g. for cases
1117    where only the descriptor is affected like seek. */
1118 static int file_has_perm(struct task_struct *tsk,
1119                                 struct file *file,
1120                                 u32 av)
1121 {
1122         struct task_security_struct *tsec = tsk->security;
1123         struct file_security_struct *fsec = file->f_security;
1124         struct vfsmount *mnt = file->f_path.mnt;
1125         struct dentry *dentry = file->f_path.dentry;
1126         struct inode *inode = dentry->d_inode;
1127         struct avc_audit_data ad;
1128         int rc;
1129
1130         AVC_AUDIT_DATA_INIT(&ad, FS);
1131         ad.u.fs.mnt = mnt;
1132         ad.u.fs.dentry = dentry;
1133
1134         if (tsec->sid != fsec->sid) {
1135                 rc = avc_has_perm(tsec->sid, fsec->sid,
1136                                   SECCLASS_FD,
1137                                   FD__USE,
1138                                   &ad);
1139                 if (rc)
1140                         return rc;
1141         }
1142
1143         /* av is zero if only checking access to the descriptor. */
1144         if (av)
1145                 return inode_has_perm(tsk, inode, av, &ad);
1146
1147         return 0;
1148 }
1149
1150 /* Check whether a task can create a file. */
1151 static int may_create(struct inode *dir,
1152                       struct dentry *dentry,
1153                       u16 tclass)
1154 {
1155         struct task_security_struct *tsec;
1156         struct inode_security_struct *dsec;
1157         struct superblock_security_struct *sbsec;
1158         u32 newsid;
1159         struct avc_audit_data ad;
1160         int rc;
1161
1162         tsec = current->security;
1163         dsec = dir->i_security;
1164         sbsec = dir->i_sb->s_security;
1165
1166         AVC_AUDIT_DATA_INIT(&ad, FS);
1167         ad.u.fs.dentry = dentry;
1168
1169         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR,
1170                           DIR__ADD_NAME | DIR__SEARCH,
1171                           &ad);
1172         if (rc)
1173                 return rc;
1174
1175         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
1176                 newsid = tsec->create_sid;
1177         } else {
1178                 rc = security_transition_sid(tsec->sid, dsec->sid, tclass,
1179                                              &newsid);
1180                 if (rc)
1181                         return rc;
1182         }
1183
1184         rc = avc_has_perm(tsec->sid, newsid, tclass, FILE__CREATE, &ad);
1185         if (rc)
1186                 return rc;
1187
1188         return avc_has_perm(newsid, sbsec->sid,
1189                             SECCLASS_FILESYSTEM,
1190                             FILESYSTEM__ASSOCIATE, &ad);
1191 }
1192
1193 /* Check whether a task can create a key. */
1194 static int may_create_key(u32 ksid,
1195                           struct task_struct *ctx)
1196 {
1197         struct task_security_struct *tsec;
1198
1199         tsec = ctx->security;
1200
1201         return avc_has_perm(tsec->sid, ksid, SECCLASS_KEY, KEY__CREATE, NULL);
1202 }
1203
1204 #define MAY_LINK   0
1205 #define MAY_UNLINK 1
1206 #define MAY_RMDIR  2
1207
1208 /* Check whether a task can link, unlink, or rmdir a file/directory. */
1209 static int may_link(struct inode *dir,
1210                     struct dentry *dentry,
1211                     int kind)
1212
1213 {
1214         struct task_security_struct *tsec;
1215         struct inode_security_struct *dsec, *isec;
1216         struct avc_audit_data ad;
1217         u32 av;
1218         int rc;
1219
1220         tsec = current->security;
1221         dsec = dir->i_security;
1222         isec = dentry->d_inode->i_security;
1223
1224         AVC_AUDIT_DATA_INIT(&ad, FS);
1225         ad.u.fs.dentry = dentry;
1226
1227         av = DIR__SEARCH;
1228         av |= (kind ? DIR__REMOVE_NAME : DIR__ADD_NAME);
1229         rc = avc_has_perm(tsec->sid, dsec->sid, SECCLASS_DIR, av, &ad);
1230         if (rc)
1231                 return rc;
1232
1233         switch (kind) {
1234         case MAY_LINK:
1235                 av = FILE__LINK;
1236                 break;
1237         case MAY_UNLINK:
1238                 av = FILE__UNLINK;
1239                 break;
1240         case MAY_RMDIR:
1241                 av = DIR__RMDIR;
1242                 break;
1243         default:
1244                 printk(KERN_WARNING "may_link:  unrecognized kind %d\n", kind);
1245                 return 0;
1246         }
1247
1248         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass, av, &ad);
1249         return rc;
1250 }
1251
1252 static inline int may_rename(struct inode *old_dir,
1253                              struct dentry *old_dentry,
1254                              struct inode *new_dir,
1255                              struct dentry *new_dentry)
1256 {
1257         struct task_security_struct *tsec;
1258         struct inode_security_struct *old_dsec, *new_dsec, *old_isec, *new_isec;
1259         struct avc_audit_data ad;
1260         u32 av;
1261         int old_is_dir, new_is_dir;
1262         int rc;
1263
1264         tsec = current->security;
1265         old_dsec = old_dir->i_security;
1266         old_isec = old_dentry->d_inode->i_security;
1267         old_is_dir = S_ISDIR(old_dentry->d_inode->i_mode);
1268         new_dsec = new_dir->i_security;
1269
1270         AVC_AUDIT_DATA_INIT(&ad, FS);
1271
1272         ad.u.fs.dentry = old_dentry;
1273         rc = avc_has_perm(tsec->sid, old_dsec->sid, SECCLASS_DIR,
1274                           DIR__REMOVE_NAME | DIR__SEARCH, &ad);
1275         if (rc)
1276                 return rc;
1277         rc = avc_has_perm(tsec->sid, old_isec->sid,
1278                           old_isec->sclass, FILE__RENAME, &ad);
1279         if (rc)
1280                 return rc;
1281         if (old_is_dir && new_dir != old_dir) {
1282                 rc = avc_has_perm(tsec->sid, old_isec->sid,
1283                                   old_isec->sclass, DIR__REPARENT, &ad);
1284                 if (rc)
1285                         return rc;
1286         }
1287
1288         ad.u.fs.dentry = new_dentry;
1289         av = DIR__ADD_NAME | DIR__SEARCH;
1290         if (new_dentry->d_inode)
1291                 av |= DIR__REMOVE_NAME;
1292         rc = avc_has_perm(tsec->sid, new_dsec->sid, SECCLASS_DIR, av, &ad);
1293         if (rc)
1294                 return rc;
1295         if (new_dentry->d_inode) {
1296                 new_isec = new_dentry->d_inode->i_security;
1297                 new_is_dir = S_ISDIR(new_dentry->d_inode->i_mode);
1298                 rc = avc_has_perm(tsec->sid, new_isec->sid,
1299                                   new_isec->sclass,
1300                                   (new_is_dir ? DIR__RMDIR : FILE__UNLINK), &ad);
1301                 if (rc)
1302                         return rc;
1303         }
1304
1305         return 0;
1306 }
1307
1308 /* Check whether a task can perform a filesystem operation. */
1309 static int superblock_has_perm(struct task_struct *tsk,
1310                                struct super_block *sb,
1311                                u32 perms,
1312                                struct avc_audit_data *ad)
1313 {
1314         struct task_security_struct *tsec;
1315         struct superblock_security_struct *sbsec;
1316
1317         tsec = tsk->security;
1318         sbsec = sb->s_security;
1319         return avc_has_perm(tsec->sid, sbsec->sid, SECCLASS_FILESYSTEM,
1320                             perms, ad);
1321 }
1322
1323 /* Convert a Linux mode and permission mask to an access vector. */
1324 static inline u32 file_mask_to_av(int mode, int mask)
1325 {
1326         u32 av = 0;
1327
1328         if ((mode & S_IFMT) != S_IFDIR) {
1329                 if (mask & MAY_EXEC)
1330                         av |= FILE__EXECUTE;
1331                 if (mask & MAY_READ)
1332                         av |= FILE__READ;
1333
1334                 if (mask & MAY_APPEND)
1335                         av |= FILE__APPEND;
1336                 else if (mask & MAY_WRITE)
1337                         av |= FILE__WRITE;
1338
1339         } else {
1340                 if (mask & MAY_EXEC)
1341                         av |= DIR__SEARCH;
1342                 if (mask & MAY_WRITE)
1343                         av |= DIR__WRITE;
1344                 if (mask & MAY_READ)
1345                         av |= DIR__READ;
1346         }
1347
1348         return av;
1349 }
1350
1351 /* Convert a Linux file to an access vector. */
1352 static inline u32 file_to_av(struct file *file)
1353 {
1354         u32 av = 0;
1355
1356         if (file->f_mode & FMODE_READ)
1357                 av |= FILE__READ;
1358         if (file->f_mode & FMODE_WRITE) {
1359                 if (file->f_flags & O_APPEND)
1360                         av |= FILE__APPEND;
1361                 else
1362                         av |= FILE__WRITE;
1363         }
1364
1365         return av;
1366 }
1367
1368 /* Hook functions begin here. */
1369
1370 static int selinux_ptrace(struct task_struct *parent, struct task_struct *child)
1371 {
1372         struct task_security_struct *psec = parent->security;
1373         struct task_security_struct *csec = child->security;
1374         int rc;
1375
1376         rc = secondary_ops->ptrace(parent,child);
1377         if (rc)
1378                 return rc;
1379
1380         rc = task_has_perm(parent, child, PROCESS__PTRACE);
1381         /* Save the SID of the tracing process for later use in apply_creds. */
1382         if (!(child->ptrace & PT_PTRACED) && !rc)
1383                 csec->ptrace_sid = psec->sid;
1384         return rc;
1385 }
1386
1387 static int selinux_capget(struct task_struct *target, kernel_cap_t *effective,
1388                           kernel_cap_t *inheritable, kernel_cap_t *permitted)
1389 {
1390         int error;
1391
1392         error = task_has_perm(current, target, PROCESS__GETCAP);
1393         if (error)
1394                 return error;
1395
1396         return secondary_ops->capget(target, effective, inheritable, permitted);
1397 }
1398
1399 static int selinux_capset_check(struct task_struct *target, kernel_cap_t *effective,
1400                                 kernel_cap_t *inheritable, kernel_cap_t *permitted)
1401 {
1402         int error;
1403
1404         error = secondary_ops->capset_check(target, effective, inheritable, permitted);
1405         if (error)
1406                 return error;
1407
1408         return task_has_perm(current, target, PROCESS__SETCAP);
1409 }
1410
1411 static void selinux_capset_set(struct task_struct *target, kernel_cap_t *effective,
1412                                kernel_cap_t *inheritable, kernel_cap_t *permitted)
1413 {
1414         secondary_ops->capset_set(target, effective, inheritable, permitted);
1415 }
1416
1417 static int selinux_capable(struct task_struct *tsk, int cap)
1418 {
1419         int rc;
1420
1421         rc = secondary_ops->capable(tsk, cap);
1422         if (rc)
1423                 return rc;
1424
1425         return task_has_capability(tsk,cap);
1426 }
1427
1428 static int selinux_sysctl_get_sid(ctl_table *table, u16 tclass, u32 *sid)
1429 {
1430         int buflen, rc;
1431         char *buffer, *path, *end;
1432
1433         rc = -ENOMEM;
1434         buffer = (char*)__get_free_page(GFP_KERNEL);
1435         if (!buffer)
1436                 goto out;
1437
1438         buflen = PAGE_SIZE;
1439         end = buffer+buflen;
1440         *--end = '\0';
1441         buflen--;
1442         path = end-1;
1443         *path = '/';
1444         while (table) {
1445                 const char *name = table->procname;
1446                 size_t namelen = strlen(name);
1447                 buflen -= namelen + 1;
1448                 if (buflen < 0)
1449                         goto out_free;
1450                 end -= namelen;
1451                 memcpy(end, name, namelen);
1452                 *--end = '/';
1453                 path = end;
1454                 table = table->parent;
1455         }
1456         buflen -= 4;
1457         if (buflen < 0)
1458                 goto out_free;
1459         end -= 4;
1460         memcpy(end, "/sys", 4);
1461         path = end;
1462         rc = security_genfs_sid("proc", path, tclass, sid);
1463 out_free:
1464         free_page((unsigned long)buffer);
1465 out:
1466         return rc;
1467 }
1468
1469 static int selinux_sysctl(ctl_table *table, int op)
1470 {
1471         int error = 0;
1472         u32 av;
1473         struct task_security_struct *tsec;
1474         u32 tsid;
1475         int rc;
1476
1477         rc = secondary_ops->sysctl(table, op);
1478         if (rc)
1479                 return rc;
1480
1481         tsec = current->security;
1482
1483         rc = selinux_sysctl_get_sid(table, (op == 0001) ?
1484                                     SECCLASS_DIR : SECCLASS_FILE, &tsid);
1485         if (rc) {
1486                 /* Default to the well-defined sysctl SID. */
1487                 tsid = SECINITSID_SYSCTL;
1488         }
1489
1490         /* The op values are "defined" in sysctl.c, thereby creating
1491          * a bad coupling between this module and sysctl.c */
1492         if(op == 001) {
1493                 error = avc_has_perm(tsec->sid, tsid,
1494                                      SECCLASS_DIR, DIR__SEARCH, NULL);
1495         } else {
1496                 av = 0;
1497                 if (op & 004)
1498                         av |= FILE__READ;
1499                 if (op & 002)
1500                         av |= FILE__WRITE;
1501                 if (av)
1502                         error = avc_has_perm(tsec->sid, tsid,
1503                                              SECCLASS_FILE, av, NULL);
1504         }
1505
1506         return error;
1507 }
1508
1509 static int selinux_quotactl(int cmds, int type, int id, struct super_block *sb)
1510 {
1511         int rc = 0;
1512
1513         if (!sb)
1514                 return 0;
1515
1516         switch (cmds) {
1517                 case Q_SYNC:
1518                 case Q_QUOTAON:
1519                 case Q_QUOTAOFF:
1520                 case Q_SETINFO:
1521                 case Q_SETQUOTA:
1522                         rc = superblock_has_perm(current,
1523                                                  sb,
1524                                                  FILESYSTEM__QUOTAMOD, NULL);
1525                         break;
1526                 case Q_GETFMT:
1527                 case Q_GETINFO:
1528                 case Q_GETQUOTA:
1529                         rc = superblock_has_perm(current,
1530                                                  sb,
1531                                                  FILESYSTEM__QUOTAGET, NULL);
1532                         break;
1533                 default:
1534                         rc = 0;  /* let the kernel handle invalid cmds */
1535                         break;
1536         }
1537         return rc;
1538 }
1539
1540 static int selinux_quota_on(struct dentry *dentry)
1541 {
1542         return dentry_has_perm(current, NULL, dentry, FILE__QUOTAON);
1543 }
1544
1545 static int selinux_syslog(int type)
1546 {
1547         int rc;
1548
1549         rc = secondary_ops->syslog(type);
1550         if (rc)
1551                 return rc;
1552
1553         switch (type) {
1554                 case 3:         /* Read last kernel messages */
1555                 case 10:        /* Return size of the log buffer */
1556                         rc = task_has_system(current, SYSTEM__SYSLOG_READ);
1557                         break;
1558                 case 6:         /* Disable logging to console */
1559                 case 7:         /* Enable logging to console */
1560                 case 8:         /* Set level of messages printed to console */
1561                         rc = task_has_system(current, SYSTEM__SYSLOG_CONSOLE);
1562                         break;
1563                 case 0:         /* Close log */
1564                 case 1:         /* Open log */
1565                 case 2:         /* Read from log */
1566                 case 4:         /* Read/clear last kernel messages */
1567                 case 5:         /* Clear ring buffer */
1568                 default:
1569                         rc = task_has_system(current, SYSTEM__SYSLOG_MOD);
1570                         break;
1571         }
1572         return rc;
1573 }
1574
1575 /*
1576  * Check that a process has enough memory to allocate a new virtual
1577  * mapping. 0 means there is enough memory for the allocation to
1578  * succeed and -ENOMEM implies there is not.
1579  *
1580  * Note that secondary_ops->capable and task_has_perm_noaudit return 0
1581  * if the capability is granted, but __vm_enough_memory requires 1 if
1582  * the capability is granted.
1583  *
1584  * Do not audit the selinux permission check, as this is applied to all
1585  * processes that allocate mappings.
1586  */
1587 static int selinux_vm_enough_memory(long pages)
1588 {
1589         int rc, cap_sys_admin = 0;
1590         struct task_security_struct *tsec = current->security;
1591
1592         rc = secondary_ops->capable(current, CAP_SYS_ADMIN);
1593         if (rc == 0)
1594                 rc = avc_has_perm_noaudit(tsec->sid, tsec->sid,
1595                                           SECCLASS_CAPABILITY,
1596                                           CAP_TO_MASK(CAP_SYS_ADMIN),
1597                                           0,
1598                                           NULL);
1599
1600         if (rc == 0)
1601                 cap_sys_admin = 1;
1602
1603         return __vm_enough_memory(pages, cap_sys_admin);
1604 }
1605
1606 /* binprm security operations */
1607
1608 static int selinux_bprm_alloc_security(struct linux_binprm *bprm)
1609 {
1610         struct bprm_security_struct *bsec;
1611
1612         bsec = kzalloc(sizeof(struct bprm_security_struct), GFP_KERNEL);
1613         if (!bsec)
1614                 return -ENOMEM;
1615
1616         bsec->bprm = bprm;
1617         bsec->sid = SECINITSID_UNLABELED;
1618         bsec->set = 0;
1619
1620         bprm->security = bsec;
1621         return 0;
1622 }
1623
1624 static int selinux_bprm_set_security(struct linux_binprm *bprm)
1625 {
1626         struct task_security_struct *tsec;
1627         struct inode *inode = bprm->file->f_path.dentry->d_inode;
1628         struct inode_security_struct *isec;
1629         struct bprm_security_struct *bsec;
1630         u32 newsid;
1631         struct avc_audit_data ad;
1632         int rc;
1633
1634         rc = secondary_ops->bprm_set_security(bprm);
1635         if (rc)
1636                 return rc;
1637
1638         bsec = bprm->security;
1639
1640         if (bsec->set)
1641                 return 0;
1642
1643         tsec = current->security;
1644         isec = inode->i_security;
1645
1646         /* Default to the current task SID. */
1647         bsec->sid = tsec->sid;
1648
1649         /* Reset fs, key, and sock SIDs on execve. */
1650         tsec->create_sid = 0;
1651         tsec->keycreate_sid = 0;
1652         tsec->sockcreate_sid = 0;
1653
1654         if (tsec->exec_sid) {
1655                 newsid = tsec->exec_sid;
1656                 /* Reset exec SID on execve. */
1657                 tsec->exec_sid = 0;
1658         } else {
1659                 /* Check for a default transition on this program. */
1660                 rc = security_transition_sid(tsec->sid, isec->sid,
1661                                              SECCLASS_PROCESS, &newsid);
1662                 if (rc)
1663                         return rc;
1664         }
1665
1666         AVC_AUDIT_DATA_INIT(&ad, FS);
1667         ad.u.fs.mnt = bprm->file->f_path.mnt;
1668         ad.u.fs.dentry = bprm->file->f_path.dentry;
1669
1670         if (bprm->file->f_path.mnt->mnt_flags & MNT_NOSUID)
1671                 newsid = tsec->sid;
1672
1673         if (tsec->sid == newsid) {
1674                 rc = avc_has_perm(tsec->sid, isec->sid,
1675                                   SECCLASS_FILE, FILE__EXECUTE_NO_TRANS, &ad);
1676                 if (rc)
1677                         return rc;
1678         } else {
1679                 /* Check permissions for the transition. */
1680                 rc = avc_has_perm(tsec->sid, newsid,
1681                                   SECCLASS_PROCESS, PROCESS__TRANSITION, &ad);
1682                 if (rc)
1683                         return rc;
1684
1685                 rc = avc_has_perm(newsid, isec->sid,
1686                                   SECCLASS_FILE, FILE__ENTRYPOINT, &ad);
1687                 if (rc)
1688                         return rc;
1689
1690                 /* Clear any possibly unsafe personality bits on exec: */
1691                 current->personality &= ~PER_CLEAR_ON_SETID;
1692
1693                 /* Set the security field to the new SID. */
1694                 bsec->sid = newsid;
1695         }
1696
1697         bsec->set = 1;
1698         return 0;
1699 }
1700
1701 static int selinux_bprm_check_security (struct linux_binprm *bprm)
1702 {
1703         return secondary_ops->bprm_check_security(bprm);
1704 }
1705
1706
1707 static int selinux_bprm_secureexec (struct linux_binprm *bprm)
1708 {
1709         struct task_security_struct *tsec = current->security;
1710         int atsecure = 0;
1711
1712         if (tsec->osid != tsec->sid) {
1713                 /* Enable secure mode for SIDs transitions unless
1714                    the noatsecure permission is granted between
1715                    the two SIDs, i.e. ahp returns 0. */
1716                 atsecure = avc_has_perm(tsec->osid, tsec->sid,
1717                                          SECCLASS_PROCESS,
1718                                          PROCESS__NOATSECURE, NULL);
1719         }
1720
1721         return (atsecure || secondary_ops->bprm_secureexec(bprm));
1722 }
1723
1724 static void selinux_bprm_free_security(struct linux_binprm *bprm)
1725 {
1726         kfree(bprm->security);
1727         bprm->security = NULL;
1728 }
1729
1730 extern struct vfsmount *selinuxfs_mount;
1731 extern struct dentry *selinux_null;
1732
1733 /* Derived from fs/exec.c:flush_old_files. */
1734 static inline void flush_unauthorized_files(struct files_struct * files)
1735 {
1736         struct avc_audit_data ad;
1737         struct file *file, *devnull = NULL;
1738         struct tty_struct *tty;
1739         struct fdtable *fdt;
1740         long j = -1;
1741         int drop_tty = 0;
1742
1743         mutex_lock(&tty_mutex);
1744         tty = get_current_tty();
1745         if (tty) {
1746                 file_list_lock();
1747                 file = list_entry(tty->tty_files.next, typeof(*file), f_u.fu_list);
1748                 if (file) {
1749                         /* Revalidate access to controlling tty.
1750                            Use inode_has_perm on the tty inode directly rather
1751                            than using file_has_perm, as this particular open
1752                            file may belong to another process and we are only
1753                            interested in the inode-based check here. */
1754                         struct inode *inode = file->f_path.dentry->d_inode;
1755                         if (inode_has_perm(current, inode,
1756                                            FILE__READ | FILE__WRITE, NULL)) {
1757                                 drop_tty = 1;
1758                         }
1759                 }
1760                 file_list_unlock();
1761         }
1762         mutex_unlock(&tty_mutex);
1763         /* Reset controlling tty. */
1764         if (drop_tty)
1765                 no_tty();
1766
1767         /* Revalidate access to inherited open files. */
1768
1769         AVC_AUDIT_DATA_INIT(&ad,FS);
1770
1771         spin_lock(&files->file_lock);
1772         for (;;) {
1773                 unsigned long set, i;
1774                 int fd;
1775
1776                 j++;
1777                 i = j * __NFDBITS;
1778                 fdt = files_fdtable(files);
1779                 if (i >= fdt->max_fds)
1780                         break;
1781                 set = fdt->open_fds->fds_bits[j];
1782                 if (!set)
1783                         continue;
1784                 spin_unlock(&files->file_lock);
1785                 for ( ; set ; i++,set >>= 1) {
1786                         if (set & 1) {
1787                                 file = fget(i);
1788                                 if (!file)
1789                                         continue;
1790                                 if (file_has_perm(current,
1791                                                   file,
1792                                                   file_to_av(file))) {
1793                                         sys_close(i);
1794                                         fd = get_unused_fd();
1795                                         if (fd != i) {
1796                                                 if (fd >= 0)
1797                                                         put_unused_fd(fd);
1798                                                 fput(file);
1799                                                 continue;
1800                                         }
1801                                         if (devnull) {
1802                                                 get_file(devnull);
1803                                         } else {
1804                                                 devnull = dentry_open(dget(selinux_null), mntget(selinuxfs_mount), O_RDWR);
1805                                                 if (IS_ERR(devnull)) {
1806                                                         devnull = NULL;
1807                                                         put_unused_fd(fd);
1808                                                         fput(file);
1809                                                         continue;
1810                                                 }
1811                                         }
1812                                         fd_install(fd, devnull);
1813                                 }
1814                                 fput(file);
1815                         }
1816                 }
1817                 spin_lock(&files->file_lock);
1818
1819         }
1820         spin_unlock(&files->file_lock);
1821 }
1822
1823 static void selinux_bprm_apply_creds(struct linux_binprm *bprm, int unsafe)
1824 {
1825         struct task_security_struct *tsec;
1826         struct bprm_security_struct *bsec;
1827         u32 sid;
1828         int rc;
1829
1830         secondary_ops->bprm_apply_creds(bprm, unsafe);
1831
1832         tsec = current->security;
1833
1834         bsec = bprm->security;
1835         sid = bsec->sid;
1836
1837         tsec->osid = tsec->sid;
1838         bsec->unsafe = 0;
1839         if (tsec->sid != sid) {
1840                 /* Check for shared state.  If not ok, leave SID
1841                    unchanged and kill. */
1842                 if (unsafe & LSM_UNSAFE_SHARE) {
1843                         rc = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
1844                                         PROCESS__SHARE, NULL);
1845                         if (rc) {
1846                                 bsec->unsafe = 1;
1847                                 return;
1848                         }
1849                 }
1850
1851                 /* Check for ptracing, and update the task SID if ok.
1852                    Otherwise, leave SID unchanged and kill. */
1853                 if (unsafe & (LSM_UNSAFE_PTRACE | LSM_UNSAFE_PTRACE_CAP)) {
1854                         rc = avc_has_perm(tsec->ptrace_sid, sid,
1855                                           SECCLASS_PROCESS, PROCESS__PTRACE,
1856                                           NULL);
1857                         if (rc) {
1858                                 bsec->unsafe = 1;
1859                                 return;
1860                         }
1861                 }
1862                 tsec->sid = sid;
1863         }
1864 }
1865
1866 /*
1867  * called after apply_creds without the task lock held
1868  */
1869 static void selinux_bprm_post_apply_creds(struct linux_binprm *bprm)
1870 {
1871         struct task_security_struct *tsec;
1872         struct rlimit *rlim, *initrlim;
1873         struct itimerval itimer;
1874         struct bprm_security_struct *bsec;
1875         int rc, i;
1876
1877         tsec = current->security;
1878         bsec = bprm->security;
1879
1880         if (bsec->unsafe) {
1881                 force_sig_specific(SIGKILL, current);
1882                 return;
1883         }
1884         if (tsec->osid == tsec->sid)
1885                 return;
1886
1887         /* Close files for which the new task SID is not authorized. */
1888         flush_unauthorized_files(current->files);
1889
1890         /* Check whether the new SID can inherit signal state
1891            from the old SID.  If not, clear itimers to avoid
1892            subsequent signal generation and flush and unblock
1893            signals. This must occur _after_ the task SID has
1894           been updated so that any kill done after the flush
1895           will be checked against the new SID. */
1896         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1897                           PROCESS__SIGINH, NULL);
1898         if (rc) {
1899                 memset(&itimer, 0, sizeof itimer);
1900                 for (i = 0; i < 3; i++)
1901                         do_setitimer(i, &itimer, NULL);
1902                 flush_signals(current);
1903                 spin_lock_irq(&current->sighand->siglock);
1904                 flush_signal_handlers(current, 1);
1905                 sigemptyset(&current->blocked);
1906                 recalc_sigpending();
1907                 spin_unlock_irq(&current->sighand->siglock);
1908         }
1909
1910         /* Check whether the new SID can inherit resource limits
1911            from the old SID.  If not, reset all soft limits to
1912            the lower of the current task's hard limit and the init
1913            task's soft limit.  Note that the setting of hard limits
1914            (even to lower them) can be controlled by the setrlimit
1915            check. The inclusion of the init task's soft limit into
1916            the computation is to avoid resetting soft limits higher
1917            than the default soft limit for cases where the default
1918            is lower than the hard limit, e.g. RLIMIT_CORE or
1919            RLIMIT_STACK.*/
1920         rc = avc_has_perm(tsec->osid, tsec->sid, SECCLASS_PROCESS,
1921                           PROCESS__RLIMITINH, NULL);
1922         if (rc) {
1923                 for (i = 0; i < RLIM_NLIMITS; i++) {
1924                         rlim = current->signal->rlim + i;
1925                         initrlim = init_task.signal->rlim+i;
1926                         rlim->rlim_cur = min(rlim->rlim_max,initrlim->rlim_cur);
1927                 }
1928                 if (current->signal->rlim[RLIMIT_CPU].rlim_cur != RLIM_INFINITY) {
1929                         /*
1930                          * This will cause RLIMIT_CPU calculations
1931                          * to be refigured.
1932                          */
1933                         current->it_prof_expires = jiffies_to_cputime(1);
1934                 }
1935         }
1936
1937         /* Wake up the parent if it is waiting so that it can
1938            recheck wait permission to the new task SID. */
1939         wake_up_interruptible(&current->parent->signal->wait_chldexit);
1940 }
1941
1942 /* superblock security operations */
1943
1944 static int selinux_sb_alloc_security(struct super_block *sb)
1945 {
1946         return superblock_alloc_security(sb);
1947 }
1948
1949 static void selinux_sb_free_security(struct super_block *sb)
1950 {
1951         superblock_free_security(sb);
1952 }
1953
1954 static inline int match_prefix(char *prefix, int plen, char *option, int olen)
1955 {
1956         if (plen > olen)
1957                 return 0;
1958
1959         return !memcmp(prefix, option, plen);
1960 }
1961
1962 static inline int selinux_option(char *option, int len)
1963 {
1964         return (match_prefix("context=", sizeof("context=")-1, option, len) ||
1965                 match_prefix("fscontext=", sizeof("fscontext=")-1, option, len) ||
1966                 match_prefix("defcontext=", sizeof("defcontext=")-1, option, len) ||
1967                 match_prefix("rootcontext=", sizeof("rootcontext=")-1, option, len));
1968 }
1969
1970 static inline void take_option(char **to, char *from, int *first, int len)
1971 {
1972         if (!*first) {
1973                 **to = ',';
1974                 *to += 1;
1975         } else
1976                 *first = 0;
1977         memcpy(*to, from, len);
1978         *to += len;
1979 }
1980
1981 static inline void take_selinux_option(char **to, char *from, int *first,
1982                                        int len)
1983 {
1984         int current_size = 0;
1985
1986         if (!*first) {
1987                 **to = '|';
1988                 *to += 1;
1989         }
1990         else
1991                 *first = 0;
1992
1993         while (current_size < len) {
1994                 if (*from != '"') {
1995                         **to = *from;
1996                         *to += 1;
1997                 }
1998                 from += 1;
1999                 current_size += 1;
2000         }
2001 }
2002
2003 static int selinux_sb_copy_data(struct file_system_type *type, void *orig, void *copy)
2004 {
2005         int fnosec, fsec, rc = 0;
2006         char *in_save, *in_curr, *in_end;
2007         char *sec_curr, *nosec_save, *nosec;
2008         int open_quote = 0;
2009
2010         in_curr = orig;
2011         sec_curr = copy;
2012
2013         /* Binary mount data: just copy */
2014         if (type->fs_flags & FS_BINARY_MOUNTDATA) {
2015                 copy_page(sec_curr, in_curr);
2016                 goto out;
2017         }
2018
2019         nosec = (char *)get_zeroed_page(GFP_KERNEL);
2020         if (!nosec) {
2021                 rc = -ENOMEM;
2022                 goto out;
2023         }
2024
2025         nosec_save = nosec;
2026         fnosec = fsec = 1;
2027         in_save = in_end = orig;
2028
2029         do {
2030                 if (*in_end == '"')
2031                         open_quote = !open_quote;
2032                 if ((*in_end == ',' && open_quote == 0) ||
2033                                 *in_end == '\0') {
2034                         int len = in_end - in_curr;
2035
2036                         if (selinux_option(in_curr, len))
2037                                 take_selinux_option(&sec_curr, in_curr, &fsec, len);
2038                         else
2039                                 take_option(&nosec, in_curr, &fnosec, len);
2040
2041                         in_curr = in_end + 1;
2042                 }
2043         } while (*in_end++);
2044
2045         strcpy(in_save, nosec_save);
2046         free_page((unsigned long)nosec_save);
2047 out:
2048         return rc;
2049 }
2050
2051 static int selinux_sb_kern_mount(struct super_block *sb, void *data)
2052 {
2053         struct avc_audit_data ad;
2054         int rc;
2055
2056         rc = superblock_doinit(sb, data);
2057         if (rc)
2058                 return rc;
2059
2060         AVC_AUDIT_DATA_INIT(&ad,FS);
2061         ad.u.fs.dentry = sb->s_root;
2062         return superblock_has_perm(current, sb, FILESYSTEM__MOUNT, &ad);
2063 }
2064
2065 static int selinux_sb_statfs(struct dentry *dentry)
2066 {
2067         struct avc_audit_data ad;
2068
2069         AVC_AUDIT_DATA_INIT(&ad,FS);
2070         ad.u.fs.dentry = dentry->d_sb->s_root;
2071         return superblock_has_perm(current, dentry->d_sb, FILESYSTEM__GETATTR, &ad);
2072 }
2073
2074 static int selinux_mount(char * dev_name,
2075                          struct nameidata *nd,
2076                          char * type,
2077                          unsigned long flags,
2078                          void * data)
2079 {
2080         int rc;
2081
2082         rc = secondary_ops->sb_mount(dev_name, nd, type, flags, data);
2083         if (rc)
2084                 return rc;
2085
2086         if (flags & MS_REMOUNT)
2087                 return superblock_has_perm(current, nd->mnt->mnt_sb,
2088                                            FILESYSTEM__REMOUNT, NULL);
2089         else
2090                 return dentry_has_perm(current, nd->mnt, nd->dentry,
2091                                        FILE__MOUNTON);
2092 }
2093
2094 static int selinux_umount(struct vfsmount *mnt, int flags)
2095 {
2096         int rc;
2097
2098         rc = secondary_ops->sb_umount(mnt, flags);
2099         if (rc)
2100                 return rc;
2101
2102         return superblock_has_perm(current,mnt->mnt_sb,
2103                                    FILESYSTEM__UNMOUNT,NULL);
2104 }
2105
2106 /* inode security operations */
2107
2108 static int selinux_inode_alloc_security(struct inode *inode)
2109 {
2110         return inode_alloc_security(inode);
2111 }
2112
2113 static void selinux_inode_free_security(struct inode *inode)
2114 {
2115         inode_free_security(inode);
2116 }
2117
2118 static int selinux_inode_init_security(struct inode *inode, struct inode *dir,
2119                                        char **name, void **value,
2120                                        size_t *len)
2121 {
2122         struct task_security_struct *tsec;
2123         struct inode_security_struct *dsec;
2124         struct superblock_security_struct *sbsec;
2125         u32 newsid, clen;
2126         int rc;
2127         char *namep = NULL, *context;
2128
2129         tsec = current->security;
2130         dsec = dir->i_security;
2131         sbsec = dir->i_sb->s_security;
2132
2133         if (tsec->create_sid && sbsec->behavior != SECURITY_FS_USE_MNTPOINT) {
2134                 newsid = tsec->create_sid;
2135         } else {
2136                 rc = security_transition_sid(tsec->sid, dsec->sid,
2137                                              inode_mode_to_security_class(inode->i_mode),
2138                                              &newsid);
2139                 if (rc) {
2140                         printk(KERN_WARNING "%s:  "
2141                                "security_transition_sid failed, rc=%d (dev=%s "
2142                                "ino=%ld)\n",
2143                                __FUNCTION__,
2144                                -rc, inode->i_sb->s_id, inode->i_ino);
2145                         return rc;
2146                 }
2147         }
2148
2149         /* Possibly defer initialization to selinux_complete_init. */
2150         if (sbsec->initialized) {
2151                 struct inode_security_struct *isec = inode->i_security;
2152                 isec->sclass = inode_mode_to_security_class(inode->i_mode);
2153                 isec->sid = newsid;
2154                 isec->initialized = 1;
2155         }
2156
2157         if (!ss_initialized || sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2158                 return -EOPNOTSUPP;
2159
2160         if (name) {
2161                 namep = kstrdup(XATTR_SELINUX_SUFFIX, GFP_KERNEL);
2162                 if (!namep)
2163                         return -ENOMEM;
2164                 *name = namep;
2165         }
2166
2167         if (value && len) {
2168                 rc = security_sid_to_context(newsid, &context, &clen);
2169                 if (rc) {
2170                         kfree(namep);
2171                         return rc;
2172                 }
2173                 *value = context;
2174                 *len = clen;
2175         }
2176
2177         return 0;
2178 }
2179
2180 static int selinux_inode_create(struct inode *dir, struct dentry *dentry, int mask)
2181 {
2182         return may_create(dir, dentry, SECCLASS_FILE);
2183 }
2184
2185 static int selinux_inode_link(struct dentry *old_dentry, struct inode *dir, struct dentry *new_dentry)
2186 {
2187         int rc;
2188
2189         rc = secondary_ops->inode_link(old_dentry,dir,new_dentry);
2190         if (rc)
2191                 return rc;
2192         return may_link(dir, old_dentry, MAY_LINK);
2193 }
2194
2195 static int selinux_inode_unlink(struct inode *dir, struct dentry *dentry)
2196 {
2197         int rc;
2198
2199         rc = secondary_ops->inode_unlink(dir, dentry);
2200         if (rc)
2201                 return rc;
2202         return may_link(dir, dentry, MAY_UNLINK);
2203 }
2204
2205 static int selinux_inode_symlink(struct inode *dir, struct dentry *dentry, const char *name)
2206 {
2207         return may_create(dir, dentry, SECCLASS_LNK_FILE);
2208 }
2209
2210 static int selinux_inode_mkdir(struct inode *dir, struct dentry *dentry, int mask)
2211 {
2212         return may_create(dir, dentry, SECCLASS_DIR);
2213 }
2214
2215 static int selinux_inode_rmdir(struct inode *dir, struct dentry *dentry)
2216 {
2217         return may_link(dir, dentry, MAY_RMDIR);
2218 }
2219
2220 static int selinux_inode_mknod(struct inode *dir, struct dentry *dentry, int mode, dev_t dev)
2221 {
2222         int rc;
2223
2224         rc = secondary_ops->inode_mknod(dir, dentry, mode, dev);
2225         if (rc)
2226                 return rc;
2227
2228         return may_create(dir, dentry, inode_mode_to_security_class(mode));
2229 }
2230
2231 static int selinux_inode_rename(struct inode *old_inode, struct dentry *old_dentry,
2232                                 struct inode *new_inode, struct dentry *new_dentry)
2233 {
2234         return may_rename(old_inode, old_dentry, new_inode, new_dentry);
2235 }
2236
2237 static int selinux_inode_readlink(struct dentry *dentry)
2238 {
2239         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2240 }
2241
2242 static int selinux_inode_follow_link(struct dentry *dentry, struct nameidata *nameidata)
2243 {
2244         int rc;
2245
2246         rc = secondary_ops->inode_follow_link(dentry,nameidata);
2247         if (rc)
2248                 return rc;
2249         return dentry_has_perm(current, NULL, dentry, FILE__READ);
2250 }
2251
2252 static int selinux_inode_permission(struct inode *inode, int mask,
2253                                     struct nameidata *nd)
2254 {
2255         int rc;
2256
2257         rc = secondary_ops->inode_permission(inode, mask, nd);
2258         if (rc)
2259                 return rc;
2260
2261         if (!mask) {
2262                 /* No permission to check.  Existence test. */
2263                 return 0;
2264         }
2265
2266         return inode_has_perm(current, inode,
2267                                file_mask_to_av(inode->i_mode, mask), NULL);
2268 }
2269
2270 static int selinux_inode_setattr(struct dentry *dentry, struct iattr *iattr)
2271 {
2272         int rc;
2273
2274         rc = secondary_ops->inode_setattr(dentry, iattr);
2275         if (rc)
2276                 return rc;
2277
2278         if (iattr->ia_valid & ATTR_FORCE)
2279                 return 0;
2280
2281         if (iattr->ia_valid & (ATTR_MODE | ATTR_UID | ATTR_GID |
2282                                ATTR_ATIME_SET | ATTR_MTIME_SET))
2283                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2284
2285         return dentry_has_perm(current, NULL, dentry, FILE__WRITE);
2286 }
2287
2288 static int selinux_inode_getattr(struct vfsmount *mnt, struct dentry *dentry)
2289 {
2290         return dentry_has_perm(current, mnt, dentry, FILE__GETATTR);
2291 }
2292
2293 static int selinux_inode_setxattr(struct dentry *dentry, char *name, void *value, size_t size, int flags)
2294 {
2295         struct task_security_struct *tsec = current->security;
2296         struct inode *inode = dentry->d_inode;
2297         struct inode_security_struct *isec = inode->i_security;
2298         struct superblock_security_struct *sbsec;
2299         struct avc_audit_data ad;
2300         u32 newsid;
2301         int rc = 0;
2302
2303         if (strcmp(name, XATTR_NAME_SELINUX)) {
2304                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2305                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2306                     !capable(CAP_SYS_ADMIN)) {
2307                         /* A different attribute in the security namespace.
2308                            Restrict to administrator. */
2309                         return -EPERM;
2310                 }
2311
2312                 /* Not an attribute we recognize, so just check the
2313                    ordinary setattr permission. */
2314                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2315         }
2316
2317         sbsec = inode->i_sb->s_security;
2318         if (sbsec->behavior == SECURITY_FS_USE_MNTPOINT)
2319                 return -EOPNOTSUPP;
2320
2321         if (!is_owner_or_cap(inode))
2322                 return -EPERM;
2323
2324         AVC_AUDIT_DATA_INIT(&ad,FS);
2325         ad.u.fs.dentry = dentry;
2326
2327         rc = avc_has_perm(tsec->sid, isec->sid, isec->sclass,
2328                           FILE__RELABELFROM, &ad);
2329         if (rc)
2330                 return rc;
2331
2332         rc = security_context_to_sid(value, size, &newsid);
2333         if (rc)
2334                 return rc;
2335
2336         rc = avc_has_perm(tsec->sid, newsid, isec->sclass,
2337                           FILE__RELABELTO, &ad);
2338         if (rc)
2339                 return rc;
2340
2341         rc = security_validate_transition(isec->sid, newsid, tsec->sid,
2342                                           isec->sclass);
2343         if (rc)
2344                 return rc;
2345
2346         return avc_has_perm(newsid,
2347                             sbsec->sid,
2348                             SECCLASS_FILESYSTEM,
2349                             FILESYSTEM__ASSOCIATE,
2350                             &ad);
2351 }
2352
2353 static void selinux_inode_post_setxattr(struct dentry *dentry, char *name,
2354                                         void *value, size_t size, int flags)
2355 {
2356         struct inode *inode = dentry->d_inode;
2357         struct inode_security_struct *isec = inode->i_security;
2358         u32 newsid;
2359         int rc;
2360
2361         if (strcmp(name, XATTR_NAME_SELINUX)) {
2362                 /* Not an attribute we recognize, so nothing to do. */
2363                 return;
2364         }
2365
2366         rc = security_context_to_sid(value, size, &newsid);
2367         if (rc) {
2368                 printk(KERN_WARNING "%s:  unable to obtain SID for context "
2369                        "%s, rc=%d\n", __FUNCTION__, (char*)value, -rc);
2370                 return;
2371         }
2372
2373         isec->sid = newsid;
2374         return;
2375 }
2376
2377 static int selinux_inode_getxattr (struct dentry *dentry, char *name)
2378 {
2379         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2380 }
2381
2382 static int selinux_inode_listxattr (struct dentry *dentry)
2383 {
2384         return dentry_has_perm(current, NULL, dentry, FILE__GETATTR);
2385 }
2386
2387 static int selinux_inode_removexattr (struct dentry *dentry, char *name)
2388 {
2389         if (strcmp(name, XATTR_NAME_SELINUX)) {
2390                 if (!strncmp(name, XATTR_SECURITY_PREFIX,
2391                              sizeof XATTR_SECURITY_PREFIX - 1) &&
2392                     !capable(CAP_SYS_ADMIN)) {
2393                         /* A different attribute in the security namespace.
2394                            Restrict to administrator. */
2395                         return -EPERM;
2396                 }
2397
2398                 /* Not an attribute we recognize, so just check the
2399                    ordinary setattr permission. Might want a separate
2400                    permission for removexattr. */
2401                 return dentry_has_perm(current, NULL, dentry, FILE__SETATTR);
2402         }
2403
2404         /* No one is allowed to remove a SELinux security label.
2405            You can change the label, but all data must be labeled. */
2406         return -EACCES;
2407 }
2408
2409 static const char *selinux_inode_xattr_getsuffix(void)
2410 {
2411       return XATTR_SELINUX_SUFFIX;
2412 }
2413
2414 /*
2415  * Copy the in-core inode security context value to the user.  If the
2416  * getxattr() prior to this succeeded, check to see if we need to
2417  * canonicalize the value to be finally returned to the user.
2418  *
2419  * Permission check is handled by selinux_inode_getxattr hook.
2420  */
2421 static int selinux_inode_getsecurity(const struct inode *inode, const char *name, void *buffer, size_t size, int err)
2422 {
2423         struct inode_security_struct *isec = inode->i_security;
2424
2425         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2426                 return -EOPNOTSUPP;
2427
2428         return selinux_getsecurity(isec->sid, buffer, size);
2429 }
2430
2431 static int selinux_inode_setsecurity(struct inode *inode, const char *name,
2432                                      const void *value, size_t size, int flags)
2433 {
2434         struct inode_security_struct *isec = inode->i_security;
2435         u32 newsid;
2436         int rc;
2437
2438         if (strcmp(name, XATTR_SELINUX_SUFFIX))
2439                 return -EOPNOTSUPP;
2440
2441         if (!value || !size)
2442                 return -EACCES;
2443
2444         rc = security_context_to_sid((void*)value, size, &newsid);
2445         if (rc)
2446                 return rc;
2447
2448         isec->sid = newsid;
2449         return 0;
2450 }
2451
2452 static int selinux_inode_listsecurity(struct inode *inode, char *buffer, size_t buffer_size)
2453 {
2454         const int len = sizeof(XATTR_NAME_SELINUX);
2455         if (buffer && len <= buffer_size)
2456                 memcpy(buffer, XATTR_NAME_SELINUX, len);
2457         return len;
2458 }
2459
2460 /* file security operations */
2461
2462 static int selinux_file_permission(struct file *file, int mask)
2463 {
2464         int rc;
2465         struct inode *inode = file->f_path.dentry->d_inode;
2466
2467         if (!mask) {
2468                 /* No permission to check.  Existence test. */
2469                 return 0;
2470         }
2471
2472         /* file_mask_to_av won't add FILE__WRITE if MAY_APPEND is set */
2473         if ((file->f_flags & O_APPEND) && (mask & MAY_WRITE))
2474                 mask |= MAY_APPEND;
2475
2476         rc = file_has_perm(current, file,
2477                            file_mask_to_av(inode->i_mode, mask));
2478         if (rc)
2479                 return rc;
2480
2481         return selinux_netlbl_inode_permission(inode, mask);
2482 }
2483
2484 static int selinux_file_alloc_security(struct file *file)
2485 {
2486         return file_alloc_security(file);
2487 }
2488
2489 static void selinux_file_free_security(struct file *file)
2490 {
2491         file_free_security(file);
2492 }
2493
2494 static int selinux_file_ioctl(struct file *file, unsigned int cmd,
2495                               unsigned long arg)
2496 {
2497         int error = 0;
2498
2499         switch (cmd) {
2500                 case FIONREAD:
2501                 /* fall through */
2502                 case FIBMAP:
2503                 /* fall through */
2504                 case FIGETBSZ:
2505                 /* fall through */
2506                 case EXT2_IOC_GETFLAGS:
2507                 /* fall through */
2508                 case EXT2_IOC_GETVERSION:
2509                         error = file_has_perm(current, file, FILE__GETATTR);
2510                         break;
2511
2512                 case EXT2_IOC_SETFLAGS:
2513                 /* fall through */
2514                 case EXT2_IOC_SETVERSION:
2515                         error = file_has_perm(current, file, FILE__SETATTR);
2516                         break;
2517
2518                 /* sys_ioctl() checks */
2519                 case FIONBIO:
2520                 /* fall through */
2521                 case FIOASYNC:
2522                         error = file_has_perm(current, file, 0);
2523                         break;
2524
2525                 case KDSKBENT:
2526                 case KDSKBSENT:
2527                         error = task_has_capability(current,CAP_SYS_TTY_CONFIG);
2528                         break;
2529
2530                 /* default case assumes that the command will go
2531                  * to the file's ioctl() function.
2532                  */
2533                 default:
2534                         error = file_has_perm(current, file, FILE__IOCTL);
2535
2536         }
2537         return error;
2538 }
2539
2540 static int file_map_prot_check(struct file *file, unsigned long prot, int shared)
2541 {
2542 #ifndef CONFIG_PPC32
2543         if ((prot & PROT_EXEC) && (!file || (!shared && (prot & PROT_WRITE)))) {
2544                 /*
2545                  * We are making executable an anonymous mapping or a
2546                  * private file mapping that will also be writable.
2547                  * This has an additional check.
2548                  */
2549                 int rc = task_has_perm(current, current, PROCESS__EXECMEM);
2550                 if (rc)
2551                         return rc;
2552         }
2553 #endif
2554
2555         if (file) {
2556                 /* read access is always possible with a mapping */
2557                 u32 av = FILE__READ;
2558
2559                 /* write access only matters if the mapping is shared */
2560                 if (shared && (prot & PROT_WRITE))
2561                         av |= FILE__WRITE;
2562
2563                 if (prot & PROT_EXEC)
2564                         av |= FILE__EXECUTE;
2565
2566                 return file_has_perm(current, file, av);
2567         }
2568         return 0;
2569 }
2570
2571 static int selinux_file_mmap(struct file *file, unsigned long reqprot,
2572                              unsigned long prot, unsigned long flags,
2573                              unsigned long addr, unsigned long addr_only)
2574 {
2575         int rc = 0;
2576         u32 sid = ((struct task_security_struct*)(current->security))->sid;
2577
2578         if (addr < mmap_min_addr)
2579                 rc = avc_has_perm(sid, sid, SECCLASS_MEMPROTECT,
2580                                   MEMPROTECT__MMAP_ZERO, NULL);
2581         if (rc || addr_only)
2582                 return rc;
2583
2584         if (selinux_checkreqprot)
2585                 prot = reqprot;
2586
2587         return file_map_prot_check(file, prot,
2588                                    (flags & MAP_TYPE) == MAP_SHARED);
2589 }
2590
2591 static int selinux_file_mprotect(struct vm_area_struct *vma,
2592                                  unsigned long reqprot,
2593                                  unsigned long prot)
2594 {
2595         int rc;
2596
2597         rc = secondary_ops->file_mprotect(vma, reqprot, prot);
2598         if (rc)
2599                 return rc;
2600
2601         if (selinux_checkreqprot)
2602                 prot = reqprot;
2603
2604 #ifndef CONFIG_PPC32
2605         if ((prot & PROT_EXEC) && !(vma->vm_flags & VM_EXEC)) {
2606                 rc = 0;
2607                 if (vma->vm_start >= vma->vm_mm->start_brk &&
2608                     vma->vm_end <= vma->vm_mm->brk) {
2609                         rc = task_has_perm(current, current,
2610                                            PROCESS__EXECHEAP);
2611                 } else if (!vma->vm_file &&
2612                            vma->vm_start <= vma->vm_mm->start_stack &&
2613                            vma->vm_end >= vma->vm_mm->start_stack) {
2614                         rc = task_has_perm(current, current, PROCESS__EXECSTACK);
2615                 } else if (vma->vm_file && vma->anon_vma) {
2616                         /*
2617                          * We are making executable a file mapping that has
2618                          * had some COW done. Since pages might have been
2619                          * written, check ability to execute the possibly
2620                          * modified content.  This typically should only
2621                          * occur for text relocations.
2622                          */
2623                         rc = file_has_perm(current, vma->vm_file,
2624                                            FILE__EXECMOD);
2625                 }
2626                 if (rc)
2627                         return rc;
2628         }
2629 #endif
2630
2631         return file_map_prot_check(vma->vm_file, prot, vma->vm_flags&VM_SHARED);
2632 }
2633
2634 static int selinux_file_lock(struct file *file, unsigned int cmd)
2635 {
2636         return file_has_perm(current, file, FILE__LOCK);
2637 }
2638
2639 static int selinux_file_fcntl(struct file *file, unsigned int cmd,
2640                               unsigned long arg)
2641 {
2642         int err = 0;
2643
2644         switch (cmd) {
2645                 case F_SETFL:
2646                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2647                                 err = -EINVAL;
2648                                 break;
2649                         }
2650
2651                         if ((file->f_flags & O_APPEND) && !(arg & O_APPEND)) {
2652                                 err = file_has_perm(current, file,FILE__WRITE);
2653                                 break;
2654                         }
2655                         /* fall through */
2656                 case F_SETOWN:
2657                 case F_SETSIG:
2658                 case F_GETFL:
2659                 case F_GETOWN:
2660                 case F_GETSIG:
2661                         /* Just check FD__USE permission */
2662                         err = file_has_perm(current, file, 0);
2663                         break;
2664                 case F_GETLK:
2665                 case F_SETLK:
2666                 case F_SETLKW:
2667 #if BITS_PER_LONG == 32
2668                 case F_GETLK64:
2669                 case F_SETLK64:
2670                 case F_SETLKW64:
2671 #endif
2672                         if (!file->f_path.dentry || !file->f_path.dentry->d_inode) {
2673                                 err = -EINVAL;
2674                                 break;
2675                         }
2676                         err = file_has_perm(current, file, FILE__LOCK);
2677                         break;
2678         }
2679
2680         return err;
2681 }
2682
2683 static int selinux_file_set_fowner(struct file *file)
2684 {
2685         struct task_security_struct *tsec;
2686         struct file_security_struct *fsec;
2687
2688         tsec = current->security;
2689         fsec = file->f_security;
2690         fsec->fown_sid = tsec->sid;
2691
2692         return 0;
2693 }
2694
2695 static int selinux_file_send_sigiotask(struct task_struct *tsk,
2696                                        struct fown_struct *fown, int signum)
2697 {
2698         struct file *file;
2699         u32 perm;
2700         struct task_security_struct *tsec;
2701         struct file_security_struct *fsec;
2702
2703         /* struct fown_struct is never outside the context of a struct file */
2704         file = container_of(fown, struct file, f_owner);
2705
2706         tsec = tsk->security;
2707         fsec = file->f_security;
2708
2709         if (!signum)
2710                 perm = signal_to_av(SIGIO); /* as per send_sigio_to_task */
2711         else
2712                 perm = signal_to_av(signum);
2713
2714         return avc_has_perm(fsec->fown_sid, tsec->sid,
2715                             SECCLASS_PROCESS, perm, NULL);
2716 }
2717
2718 static int selinux_file_receive(struct file *file)
2719 {
2720         return file_has_perm(current, file, file_to_av(file));
2721 }
2722
2723 /* task security operations */
2724
2725 static int selinux_task_create(unsigned long clone_flags)
2726 {
2727         int rc;
2728
2729         rc = secondary_ops->task_create(clone_flags);
2730         if (rc)
2731                 return rc;
2732
2733         return task_has_perm(current, current, PROCESS__FORK);
2734 }
2735
2736 static int selinux_task_alloc_security(struct task_struct *tsk)
2737 {
2738         struct task_security_struct *tsec1, *tsec2;
2739         int rc;
2740
2741         tsec1 = current->security;
2742
2743         rc = task_alloc_security(tsk);
2744         if (rc)
2745                 return rc;
2746         tsec2 = tsk->security;
2747
2748         tsec2->osid = tsec1->osid;
2749         tsec2->sid = tsec1->sid;
2750
2751         /* Retain the exec, fs, key, and sock SIDs across fork */
2752         tsec2->exec_sid = tsec1->exec_sid;
2753         tsec2->create_sid = tsec1->create_sid;
2754         tsec2->keycreate_sid = tsec1->keycreate_sid;
2755         tsec2->sockcreate_sid = tsec1->sockcreate_sid;
2756
2757         /* Retain ptracer SID across fork, if any.
2758            This will be reset by the ptrace hook upon any
2759            subsequent ptrace_attach operations. */
2760         tsec2->ptrace_sid = tsec1->ptrace_sid;
2761
2762         return 0;
2763 }
2764
2765 static void selinux_task_free_security(struct task_struct *tsk)
2766 {
2767         task_free_security(tsk);
2768 }
2769
2770 static int selinux_task_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2771 {
2772         /* Since setuid only affects the current process, and
2773            since the SELinux controls are not based on the Linux
2774            identity attributes, SELinux does not need to control
2775            this operation.  However, SELinux does control the use
2776            of the CAP_SETUID and CAP_SETGID capabilities using the
2777            capable hook. */
2778         return 0;
2779 }
2780
2781 static int selinux_task_post_setuid(uid_t id0, uid_t id1, uid_t id2, int flags)
2782 {
2783         return secondary_ops->task_post_setuid(id0,id1,id2,flags);
2784 }
2785
2786 static int selinux_task_setgid(gid_t id0, gid_t id1, gid_t id2, int flags)
2787 {
2788         /* See the comment for setuid above. */
2789         return 0;
2790 }
2791
2792 static int selinux_task_setpgid(struct task_struct *p, pid_t pgid)
2793 {
2794         return task_has_perm(current, p, PROCESS__SETPGID);
2795 }
2796
2797 static int selinux_task_getpgid(struct task_struct *p)
2798 {
2799         return task_has_perm(current, p, PROCESS__GETPGID);
2800 }
2801
2802 static int selinux_task_getsid(struct task_struct *p)
2803 {
2804         return task_has_perm(current, p, PROCESS__GETSESSION);
2805 }
2806
2807 static void selinux_task_getsecid(struct task_struct *p, u32 *secid)
2808 {
2809         selinux_get_task_sid(p, secid);
2810 }
2811
2812 static int selinux_task_setgroups(struct group_info *group_info)
2813 {
2814         /* See the comment for setuid above. */
2815         return 0;
2816 }
2817
2818 static int selinux_task_setnice(struct task_struct *p, int nice)
2819 {
2820         int rc;
2821
2822         rc = secondary_ops->task_setnice(p, nice);
2823         if (rc)
2824                 return rc;
2825
2826         return task_has_perm(current,p, PROCESS__SETSCHED);
2827 }
2828
2829 static int selinux_task_setioprio(struct task_struct *p, int ioprio)
2830 {
2831         return task_has_perm(current, p, PROCESS__SETSCHED);
2832 }
2833
2834 static int selinux_task_getioprio(struct task_struct *p)
2835 {
2836         return task_has_perm(current, p, PROCESS__GETSCHED);
2837 }
2838
2839 static int selinux_task_setrlimit(unsigned int resource, struct rlimit *new_rlim)
2840 {
2841         struct rlimit *old_rlim = current->signal->rlim + resource;
2842         int rc;
2843
2844         rc = secondary_ops->task_setrlimit(resource, new_rlim);
2845         if (rc)
2846                 return rc;
2847
2848         /* Control the ability to change the hard limit (whether
2849            lowering or raising it), so that the hard limit can
2850            later be used as a safe reset point for the soft limit
2851            upon context transitions. See selinux_bprm_apply_creds. */
2852         if (old_rlim->rlim_max != new_rlim->rlim_max)
2853                 return task_has_perm(current, current, PROCESS__SETRLIMIT);
2854
2855         return 0;
2856 }
2857
2858 static int selinux_task_setscheduler(struct task_struct *p, int policy, struct sched_param *lp)
2859 {
2860         return task_has_perm(current, p, PROCESS__SETSCHED);
2861 }
2862
2863 static int selinux_task_getscheduler(struct task_struct *p)
2864 {
2865         return task_has_perm(current, p, PROCESS__GETSCHED);
2866 }
2867
2868 static int selinux_task_movememory(struct task_struct *p)
2869 {
2870         return task_has_perm(current, p, PROCESS__SETSCHED);
2871 }
2872
2873 static int selinux_task_kill(struct task_struct *p, struct siginfo *info,
2874                                 int sig, u32 secid)
2875 {
2876         u32 perm;
2877         int rc;
2878         struct task_security_struct *tsec;
2879
2880         rc = secondary_ops->task_kill(p, info, sig, secid);
2881         if (rc)
2882                 return rc;
2883
2884         if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
2885                 return 0;
2886
2887         if (!sig)
2888                 perm = PROCESS__SIGNULL; /* null signal; existence test */
2889         else
2890                 perm = signal_to_av(sig);
2891         tsec = p->security;
2892         if (secid)
2893                 rc = avc_has_perm(secid, tsec->sid, SECCLASS_PROCESS, perm, NULL);
2894         else
2895                 rc = task_has_perm(current, p, perm);
2896         return rc;
2897 }
2898
2899 static int selinux_task_prctl(int option,
2900                               unsigned long arg2,
2901                               unsigned long arg3,
2902                               unsigned long arg4,
2903                               unsigned long arg5)
2904 {
2905         /* The current prctl operations do not appear to require
2906            any SELinux controls since they merely observe or modify
2907            the state of the current process. */
2908         return 0;
2909 }
2910
2911 static int selinux_task_wait(struct task_struct *p)
2912 {
2913         u32 perm;
2914
2915         perm = signal_to_av(p->exit_signal);
2916
2917         return task_has_perm(p, current, perm);
2918 }
2919
2920 static void selinux_task_reparent_to_init(struct task_struct *p)
2921 {
2922         struct task_security_struct *tsec;
2923
2924         secondary_ops->task_reparent_to_init(p);
2925
2926         tsec = p->security;
2927         tsec->osid = tsec->sid;
2928         tsec->sid = SECINITSID_KERNEL;
2929         return;
2930 }
2931
2932 static void selinux_task_to_inode(struct task_struct *p,
2933                                   struct inode *inode)
2934 {
2935         struct task_security_struct *tsec = p->security;
2936         struct inode_security_struct *isec = inode->i_security;
2937
2938         isec->sid = tsec->sid;
2939         isec->initialized = 1;
2940         return;
2941 }
2942
2943 /* Returns error only if unable to parse addresses */
2944 static int selinux_parse_skb_ipv4(struct sk_buff *skb,
2945                         struct avc_audit_data *ad, u8 *proto)
2946 {
2947         int offset, ihlen, ret = -EINVAL;
2948         struct iphdr _iph, *ih;
2949
2950         offset = skb_network_offset(skb);
2951         ih = skb_header_pointer(skb, offset, sizeof(_iph), &_iph);
2952         if (ih == NULL)
2953                 goto out;
2954
2955         ihlen = ih->ihl * 4;
2956         if (ihlen < sizeof(_iph))
2957                 goto out;
2958
2959         ad->u.net.v4info.saddr = ih->saddr;
2960         ad->u.net.v4info.daddr = ih->daddr;
2961         ret = 0;
2962
2963         if (proto)
2964                 *proto = ih->protocol;
2965
2966         switch (ih->protocol) {
2967         case IPPROTO_TCP: {
2968                 struct tcphdr _tcph, *th;
2969
2970                 if (ntohs(ih->frag_off) & IP_OFFSET)
2971                         break;
2972
2973                 offset += ihlen;
2974                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
2975                 if (th == NULL)
2976                         break;
2977
2978                 ad->u.net.sport = th->source;
2979                 ad->u.net.dport = th->dest;
2980                 break;
2981         }
2982
2983         case IPPROTO_UDP: {
2984                 struct udphdr _udph, *uh;
2985
2986                 if (ntohs(ih->frag_off) & IP_OFFSET)
2987                         break;
2988
2989                 offset += ihlen;
2990                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
2991                 if (uh == NULL)
2992                         break;
2993
2994                 ad->u.net.sport = uh->source;
2995                 ad->u.net.dport = uh->dest;
2996                 break;
2997         }
2998
2999         case IPPROTO_DCCP: {
3000                 struct dccp_hdr _dccph, *dh;
3001
3002                 if (ntohs(ih->frag_off) & IP_OFFSET)
3003                         break;
3004
3005                 offset += ihlen;
3006                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3007                 if (dh == NULL)
3008                         break;
3009
3010                 ad->u.net.sport = dh->dccph_sport;
3011                 ad->u.net.dport = dh->dccph_dport;
3012                 break;
3013         }
3014
3015         default:
3016                 break;
3017         }
3018 out:
3019         return ret;
3020 }
3021
3022 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3023
3024 /* Returns error only if unable to parse addresses */
3025 static int selinux_parse_skb_ipv6(struct sk_buff *skb,
3026                         struct avc_audit_data *ad, u8 *proto)
3027 {
3028         u8 nexthdr;
3029         int ret = -EINVAL, offset;
3030         struct ipv6hdr _ipv6h, *ip6;
3031
3032         offset = skb_network_offset(skb);
3033         ip6 = skb_header_pointer(skb, offset, sizeof(_ipv6h), &_ipv6h);
3034         if (ip6 == NULL)
3035                 goto out;
3036
3037         ipv6_addr_copy(&ad->u.net.v6info.saddr, &ip6->saddr);
3038         ipv6_addr_copy(&ad->u.net.v6info.daddr, &ip6->daddr);
3039         ret = 0;
3040
3041         nexthdr = ip6->nexthdr;
3042         offset += sizeof(_ipv6h);
3043         offset = ipv6_skip_exthdr(skb, offset, &nexthdr);
3044         if (offset < 0)
3045                 goto out;
3046
3047         if (proto)
3048                 *proto = nexthdr;
3049
3050         switch (nexthdr) {
3051         case IPPROTO_TCP: {
3052                 struct tcphdr _tcph, *th;
3053
3054                 th = skb_header_pointer(skb, offset, sizeof(_tcph), &_tcph);
3055                 if (th == NULL)
3056                         break;
3057
3058                 ad->u.net.sport = th->source;
3059                 ad->u.net.dport = th->dest;
3060                 break;
3061         }
3062
3063         case IPPROTO_UDP: {
3064                 struct udphdr _udph, *uh;
3065
3066                 uh = skb_header_pointer(skb, offset, sizeof(_udph), &_udph);
3067                 if (uh == NULL)
3068                         break;
3069
3070                 ad->u.net.sport = uh->source;
3071                 ad->u.net.dport = uh->dest;
3072                 break;
3073         }
3074
3075         case IPPROTO_DCCP: {
3076                 struct dccp_hdr _dccph, *dh;
3077
3078                 dh = skb_header_pointer(skb, offset, sizeof(_dccph), &_dccph);
3079                 if (dh == NULL)
3080                         break;
3081
3082                 ad->u.net.sport = dh->dccph_sport;
3083                 ad->u.net.dport = dh->dccph_dport;
3084                 break;
3085         }
3086
3087         /* includes fragments */
3088         default:
3089                 break;
3090         }
3091 out:
3092         return ret;
3093 }
3094
3095 #endif /* IPV6 */
3096
3097 static int selinux_parse_skb(struct sk_buff *skb, struct avc_audit_data *ad,
3098                              char **addrp, int *len, int src, u8 *proto)
3099 {
3100         int ret = 0;
3101
3102         switch (ad->u.net.family) {
3103         case PF_INET:
3104                 ret = selinux_parse_skb_ipv4(skb, ad, proto);
3105                 if (ret || !addrp)
3106                         break;
3107                 *len = 4;
3108                 *addrp = (char *)(src ? &ad->u.net.v4info.saddr :
3109                                         &ad->u.net.v4info.daddr);
3110                 break;
3111
3112 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3113         case PF_INET6:
3114                 ret = selinux_parse_skb_ipv6(skb, ad, proto);
3115                 if (ret || !addrp)
3116                         break;
3117                 *len = 16;
3118                 *addrp = (char *)(src ? &ad->u.net.v6info.saddr :
3119                                         &ad->u.net.v6info.daddr);
3120                 break;
3121 #endif  /* IPV6 */
3122         default:
3123                 break;
3124         }
3125
3126         return ret;
3127 }
3128
3129 /**
3130  * selinux_skb_extlbl_sid - Determine the external label of a packet
3131  * @skb: the packet
3132  * @sid: the packet's SID
3133  *
3134  * Description:
3135  * Check the various different forms of external packet labeling and determine
3136  * the external SID for the packet.  If only one form of external labeling is
3137  * present then it is used, if both labeled IPsec and NetLabel labels are
3138  * present then the SELinux type information is taken from the labeled IPsec
3139  * SA and the MLS sensitivity label information is taken from the NetLabel
3140  * security attributes.  This bit of "magic" is done in the call to
3141  * selinux_netlbl_skbuff_getsid().
3142  *
3143  */
3144 static void selinux_skb_extlbl_sid(struct sk_buff *skb, u32 *sid)
3145 {
3146         u32 xfrm_sid;
3147         u32 nlbl_sid;
3148
3149         selinux_skb_xfrm_sid(skb, &xfrm_sid);
3150         if (selinux_netlbl_skbuff_getsid(skb,
3151                                          (xfrm_sid == SECSID_NULL ?
3152                                           SECINITSID_NETMSG : xfrm_sid),
3153                                          &nlbl_sid) != 0)
3154                 nlbl_sid = SECSID_NULL;
3155         *sid = (nlbl_sid == SECSID_NULL ? xfrm_sid : nlbl_sid);
3156 }
3157
3158 /* socket security operations */
3159 static int socket_has_perm(struct task_struct *task, struct socket *sock,
3160                            u32 perms)
3161 {
3162         struct inode_security_struct *isec;
3163         struct task_security_struct *tsec;
3164         struct avc_audit_data ad;
3165         int err = 0;
3166
3167         tsec = task->security;
3168         isec = SOCK_INODE(sock)->i_security;
3169
3170         if (isec->sid == SECINITSID_KERNEL)
3171                 goto out;
3172
3173         AVC_AUDIT_DATA_INIT(&ad,NET);
3174         ad.u.net.sk = sock->sk;
3175         err = avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
3176
3177 out:
3178         return err;
3179 }
3180
3181 static int selinux_socket_create(int family, int type,
3182                                  int protocol, int kern)
3183 {
3184         int err = 0;
3185         struct task_security_struct *tsec;
3186         u32 newsid;
3187
3188         if (kern)
3189                 goto out;
3190
3191         tsec = current->security;
3192         newsid = tsec->sockcreate_sid ? : tsec->sid;
3193         err = avc_has_perm(tsec->sid, newsid,
3194                            socket_type_to_security_class(family, type,
3195                            protocol), SOCKET__CREATE, NULL);
3196
3197 out:
3198         return err;
3199 }
3200
3201 static int selinux_socket_post_create(struct socket *sock, int family,
3202                                       int type, int protocol, int kern)
3203 {
3204         int err = 0;
3205         struct inode_security_struct *isec;
3206         struct task_security_struct *tsec;
3207         struct sk_security_struct *sksec;
3208         u32 newsid;
3209
3210         isec = SOCK_INODE(sock)->i_security;
3211
3212         tsec = current->security;
3213         newsid = tsec->sockcreate_sid ? : tsec->sid;
3214         isec->sclass = socket_type_to_security_class(family, type, protocol);
3215         isec->sid = kern ? SECINITSID_KERNEL : newsid;
3216         isec->initialized = 1;
3217
3218         if (sock->sk) {
3219                 sksec = sock->sk->sk_security;
3220                 sksec->sid = isec->sid;
3221                 err = selinux_netlbl_socket_post_create(sock);
3222         }
3223
3224         return err;
3225 }
3226
3227 /* Range of port numbers used to automatically bind.
3228    Need to determine whether we should perform a name_bind
3229    permission check between the socket and the port number. */
3230 #define ip_local_port_range_0 sysctl_local_port_range[0]
3231 #define ip_local_port_range_1 sysctl_local_port_range[1]
3232
3233 static int selinux_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
3234 {
3235         u16 family;
3236         int err;
3237
3238         err = socket_has_perm(current, sock, SOCKET__BIND);
3239         if (err)
3240                 goto out;
3241
3242         /*
3243          * If PF_INET or PF_INET6, check name_bind permission for the port.
3244          * Multiple address binding for SCTP is not supported yet: we just
3245          * check the first address now.
3246          */
3247         family = sock->sk->sk_family;
3248         if (family == PF_INET || family == PF_INET6) {
3249                 char *addrp;
3250                 struct inode_security_struct *isec;
3251                 struct task_security_struct *tsec;
3252                 struct avc_audit_data ad;
3253                 struct sockaddr_in *addr4 = NULL;
3254                 struct sockaddr_in6 *addr6 = NULL;
3255                 unsigned short snum;
3256                 struct sock *sk = sock->sk;
3257                 u32 sid, node_perm, addrlen;
3258
3259                 tsec = current->security;
3260                 isec = SOCK_INODE(sock)->i_security;
3261
3262                 if (family == PF_INET) {
3263                         addr4 = (struct sockaddr_in *)address;
3264                         snum = ntohs(addr4->sin_port);
3265                         addrlen = sizeof(addr4->sin_addr.s_addr);
3266                         addrp = (char *)&addr4->sin_addr.s_addr;
3267                 } else {
3268                         addr6 = (struct sockaddr_in6 *)address;
3269                         snum = ntohs(addr6->sin6_port);
3270                         addrlen = sizeof(addr6->sin6_addr.s6_addr);
3271                         addrp = (char *)&addr6->sin6_addr.s6_addr;
3272                 }
3273
3274                 if (snum&&(snum < max(PROT_SOCK,ip_local_port_range_0) ||
3275                            snum > ip_local_port_range_1)) {
3276                         err = security_port_sid(sk->sk_family, sk->sk_type,
3277                                                 sk->sk_protocol, snum, &sid);
3278                         if (err)
3279                                 goto out;
3280                         AVC_AUDIT_DATA_INIT(&ad,NET);
3281                         ad.u.net.sport = htons(snum);
3282                         ad.u.net.family = family;
3283                         err = avc_has_perm(isec->sid, sid,
3284                                            isec->sclass,
3285                                            SOCKET__NAME_BIND, &ad);
3286                         if (err)
3287                                 goto out;
3288                 }
3289
3290                 switch(isec->sclass) {
3291                 case SECCLASS_TCP_SOCKET:
3292                         node_perm = TCP_SOCKET__NODE_BIND;
3293                         break;
3294
3295                 case SECCLASS_UDP_SOCKET:
3296                         node_perm = UDP_SOCKET__NODE_BIND;
3297                         break;
3298
3299                 case SECCLASS_DCCP_SOCKET:
3300                         node_perm = DCCP_SOCKET__NODE_BIND;
3301                         break;
3302
3303                 default:
3304                         node_perm = RAWIP_SOCKET__NODE_BIND;
3305                         break;
3306                 }
3307
3308                 err = security_node_sid(family, addrp, addrlen, &sid);
3309                 if (err)
3310                         goto out;
3311
3312                 AVC_AUDIT_DATA_INIT(&ad,NET);
3313                 ad.u.net.sport = htons(snum);
3314                 ad.u.net.family = family;
3315
3316                 if (family == PF_INET)
3317                         ad.u.net.v4info.saddr = addr4->sin_addr.s_addr;
3318                 else
3319                         ipv6_addr_copy(&ad.u.net.v6info.saddr, &addr6->sin6_addr);
3320
3321                 err = avc_has_perm(isec->sid, sid,
3322                                    isec->sclass, node_perm, &ad);
3323                 if (err)
3324                         goto out;
3325         }
3326 out:
3327         return err;
3328 }
3329
3330 static int selinux_socket_connect(struct socket *sock, struct sockaddr *address, int addrlen)
3331 {
3332         struct inode_security_struct *isec;
3333         int err;
3334
3335         err = socket_has_perm(current, sock, SOCKET__CONNECT);
3336         if (err)
3337                 return err;
3338
3339         /*
3340          * If a TCP or DCCP socket, check name_connect permission for the port.
3341          */
3342         isec = SOCK_INODE(sock)->i_security;
3343         if (isec->sclass == SECCLASS_TCP_SOCKET ||
3344             isec->sclass == SECCLASS_DCCP_SOCKET) {
3345                 struct sock *sk = sock->sk;
3346                 struct avc_audit_data ad;
3347                 struct sockaddr_in *addr4 = NULL;
3348                 struct sockaddr_in6 *addr6 = NULL;
3349                 unsigned short snum;
3350                 u32 sid, perm;
3351
3352                 if (sk->sk_family == PF_INET) {
3353                         addr4 = (struct sockaddr_in *)address;
3354                         if (addrlen < sizeof(struct sockaddr_in))
3355                                 return -EINVAL;
3356                         snum = ntohs(addr4->sin_port);
3357                 } else {
3358                         addr6 = (struct sockaddr_in6 *)address;
3359                         if (addrlen < SIN6_LEN_RFC2133)
3360                                 return -EINVAL;
3361                         snum = ntohs(addr6->sin6_port);
3362                 }
3363
3364                 err = security_port_sid(sk->sk_family, sk->sk_type,
3365                                         sk->sk_protocol, snum, &sid);
3366                 if (err)
3367                         goto out;
3368
3369                 perm = (isec->sclass == SECCLASS_TCP_SOCKET) ?
3370                        TCP_SOCKET__NAME_CONNECT : DCCP_SOCKET__NAME_CONNECT;
3371
3372                 AVC_AUDIT_DATA_INIT(&ad,NET);
3373                 ad.u.net.dport = htons(snum);
3374                 ad.u.net.family = sk->sk_family;
3375                 err = avc_has_perm(isec->sid, sid, isec->sclass, perm, &ad);
3376                 if (err)
3377                         goto out;
3378         }
3379
3380 out:
3381         return err;
3382 }
3383
3384 static int selinux_socket_listen(struct socket *sock, int backlog)
3385 {
3386         return socket_has_perm(current, sock, SOCKET__LISTEN);
3387 }
3388
3389 static int selinux_socket_accept(struct socket *sock, struct socket *newsock)
3390 {
3391         int err;
3392         struct inode_security_struct *isec;
3393         struct inode_security_struct *newisec;
3394
3395         err = socket_has_perm(current, sock, SOCKET__ACCEPT);
3396         if (err)
3397                 return err;
3398
3399         newisec = SOCK_INODE(newsock)->i_security;
3400
3401         isec = SOCK_INODE(sock)->i_security;
3402         newisec->sclass = isec->sclass;
3403         newisec->sid = isec->sid;
3404         newisec->initialized = 1;
3405
3406         return 0;
3407 }
3408
3409 static int selinux_socket_sendmsg(struct socket *sock, struct msghdr *msg,
3410                                   int size)
3411 {
3412         int rc;
3413
3414         rc = socket_has_perm(current, sock, SOCKET__WRITE);
3415         if (rc)
3416                 return rc;
3417
3418         return selinux_netlbl_inode_permission(SOCK_INODE(sock), MAY_WRITE);
3419 }
3420
3421 static int selinux_socket_recvmsg(struct socket *sock, struct msghdr *msg,
3422                                   int size, int flags)
3423 {
3424         return socket_has_perm(current, sock, SOCKET__READ);
3425 }
3426
3427 static int selinux_socket_getsockname(struct socket *sock)
3428 {
3429         return socket_has_perm(current, sock, SOCKET__GETATTR);
3430 }
3431
3432 static int selinux_socket_getpeername(struct socket *sock)
3433 {
3434         return socket_has_perm(current, sock, SOCKET__GETATTR);
3435 }
3436
3437 static int selinux_socket_setsockopt(struct socket *sock,int level,int optname)
3438 {
3439         int err;
3440
3441         err = socket_has_perm(current, sock, SOCKET__SETOPT);
3442         if (err)
3443                 return err;
3444
3445         return selinux_netlbl_socket_setsockopt(sock, level, optname);
3446 }
3447
3448 static int selinux_socket_getsockopt(struct socket *sock, int level,
3449                                      int optname)
3450 {
3451         return socket_has_perm(current, sock, SOCKET__GETOPT);
3452 }
3453
3454 static int selinux_socket_shutdown(struct socket *sock, int how)
3455 {
3456         return socket_has_perm(current, sock, SOCKET__SHUTDOWN);
3457 }
3458
3459 static int selinux_socket_unix_stream_connect(struct socket *sock,
3460                                               struct socket *other,
3461                                               struct sock *newsk)
3462 {
3463         struct sk_security_struct *ssec;
3464         struct inode_security_struct *isec;
3465         struct inode_security_struct *other_isec;
3466         struct avc_audit_data ad;
3467         int err;
3468
3469         err = secondary_ops->unix_stream_connect(sock, other, newsk);
3470         if (err)
3471                 return err;
3472
3473         isec = SOCK_INODE(sock)->i_security;
3474         other_isec = SOCK_INODE(other)->i_security;
3475
3476         AVC_AUDIT_DATA_INIT(&ad,NET);
3477         ad.u.net.sk = other->sk;
3478
3479         err = avc_has_perm(isec->sid, other_isec->sid,
3480                            isec->sclass,
3481                            UNIX_STREAM_SOCKET__CONNECTTO, &ad);
3482         if (err)
3483                 return err;
3484
3485         /* connecting socket */
3486         ssec = sock->sk->sk_security;
3487         ssec->peer_sid = other_isec->sid;
3488
3489         /* server child socket */
3490         ssec = newsk->sk_security;
3491         ssec->peer_sid = isec->sid;
3492         err = security_sid_mls_copy(other_isec->sid, ssec->peer_sid, &ssec->sid);
3493
3494         return err;
3495 }
3496
3497 static int selinux_socket_unix_may_send(struct socket *sock,
3498                                         struct socket *other)
3499 {
3500         struct inode_security_struct *isec;
3501         struct inode_security_struct *other_isec;
3502         struct avc_audit_data ad;
3503         int err;
3504
3505         isec = SOCK_INODE(sock)->i_security;
3506         other_isec = SOCK_INODE(other)->i_security;
3507
3508         AVC_AUDIT_DATA_INIT(&ad,NET);
3509         ad.u.net.sk = other->sk;
3510
3511         err = avc_has_perm(isec->sid, other_isec->sid,
3512                            isec->sclass, SOCKET__SENDTO, &ad);
3513         if (err)
3514                 return err;
3515
3516         return 0;
3517 }
3518
3519 static int selinux_sock_rcv_skb_compat(struct sock *sk, struct sk_buff *skb,
3520                 struct avc_audit_data *ad, u16 family, char *addrp, int len)
3521 {
3522         int err = 0;
3523         u32 netif_perm, node_perm, node_sid, if_sid, recv_perm = 0;
3524         struct socket *sock;
3525         u16 sock_class = 0;
3526         u32 sock_sid = 0;
3527
3528         read_lock_bh(&sk->sk_callback_lock);
3529         sock = sk->sk_socket;
3530         if (sock) {
3531                 struct inode *inode;
3532                 inode = SOCK_INODE(sock);
3533                 if (inode) {
3534                         struct inode_security_struct *isec;
3535                         isec = inode->i_security;
3536                         sock_sid = isec->sid;
3537                         sock_class = isec->sclass;
3538                 }
3539         }
3540         read_unlock_bh(&sk->sk_callback_lock);
3541         if (!sock_sid)
3542                 goto out;
3543
3544         if (!skb->dev)
3545                 goto out;
3546
3547         err = sel_netif_sids(skb->dev, &if_sid, NULL);
3548         if (err)
3549                 goto out;
3550
3551         switch (sock_class) {
3552         case SECCLASS_UDP_SOCKET:
3553                 netif_perm = NETIF__UDP_RECV;
3554                 node_perm = NODE__UDP_RECV;
3555                 recv_perm = UDP_SOCKET__RECV_MSG;
3556                 break;
3557
3558         case SECCLASS_TCP_SOCKET:
3559                 netif_perm = NETIF__TCP_RECV;
3560                 node_perm = NODE__TCP_RECV;
3561                 recv_perm = TCP_SOCKET__RECV_MSG;
3562                 break;
3563
3564         case SECCLASS_DCCP_SOCKET:
3565                 netif_perm = NETIF__DCCP_RECV;
3566                 node_perm = NODE__DCCP_RECV;
3567                 recv_perm = DCCP_SOCKET__RECV_MSG;
3568                 break;
3569
3570         default:
3571                 netif_perm = NETIF__RAWIP_RECV;
3572                 node_perm = NODE__RAWIP_RECV;
3573                 break;
3574         }
3575
3576         err = avc_has_perm(sock_sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3577         if (err)
3578                 goto out;
3579
3580         err = security_node_sid(family, addrp, len, &node_sid);
3581         if (err)
3582                 goto out;
3583
3584         err = avc_has_perm(sock_sid, node_sid, SECCLASS_NODE, node_perm, ad);
3585         if (err)
3586                 goto out;
3587
3588         if (recv_perm) {
3589                 u32 port_sid;
3590
3591                 err = security_port_sid(sk->sk_family, sk->sk_type,
3592                                         sk->sk_protocol, ntohs(ad->u.net.sport),
3593                                         &port_sid);
3594                 if (err)
3595                         goto out;
3596
3597                 err = avc_has_perm(sock_sid, port_sid,
3598                                    sock_class, recv_perm, ad);
3599         }
3600
3601 out:
3602         return err;
3603 }
3604
3605 static int selinux_socket_sock_rcv_skb(struct sock *sk, struct sk_buff *skb)
3606 {
3607         u16 family;
3608         char *addrp;
3609         int len, err = 0;
3610         struct avc_audit_data ad;
3611         struct sk_security_struct *sksec = sk->sk_security;
3612
3613         family = sk->sk_family;
3614         if (family != PF_INET && family != PF_INET6)
3615                 goto out;
3616
3617         /* Handle mapped IPv4 packets arriving via IPv6 sockets */
3618         if (family == PF_INET6 && skb->protocol == htons(ETH_P_IP))
3619                 family = PF_INET;
3620
3621         AVC_AUDIT_DATA_INIT(&ad, NET);
3622         ad.u.net.netif = skb->dev ? skb->dev->name : "[unknown]";
3623         ad.u.net.family = family;
3624
3625         err = selinux_parse_skb(skb, &ad, &addrp, &len, 1, NULL);
3626         if (err)
3627                 goto out;
3628
3629         if (selinux_compat_net)
3630                 err = selinux_sock_rcv_skb_compat(sk, skb, &ad, family,
3631                                                   addrp, len);
3632         else
3633                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3634                                    PACKET__RECV, &ad);
3635         if (err)
3636                 goto out;
3637
3638         err = selinux_netlbl_sock_rcv_skb(sksec, skb, &ad);
3639         if (err)
3640                 goto out;
3641
3642         err = selinux_xfrm_sock_rcv_skb(sksec->sid, skb, &ad);
3643 out:
3644         return err;
3645 }
3646
3647 static int selinux_socket_getpeersec_stream(struct socket *sock, char __user *optval,
3648                                             int __user *optlen, unsigned len)
3649 {
3650         int err = 0;
3651         char *scontext;
3652         u32 scontext_len;
3653         struct sk_security_struct *ssec;
3654         struct inode_security_struct *isec;
3655         u32 peer_sid = SECSID_NULL;
3656
3657         isec = SOCK_INODE(sock)->i_security;
3658
3659         if (isec->sclass == SECCLASS_UNIX_STREAM_SOCKET ||
3660             isec->sclass == SECCLASS_TCP_SOCKET) {
3661                 ssec = sock->sk->sk_security;
3662                 peer_sid = ssec->peer_sid;
3663         }
3664         if (peer_sid == SECSID_NULL) {
3665                 err = -ENOPROTOOPT;
3666                 goto out;
3667         }
3668
3669         err = security_sid_to_context(peer_sid, &scontext, &scontext_len);
3670
3671         if (err)
3672                 goto out;
3673
3674         if (scontext_len > len) {
3675                 err = -ERANGE;
3676                 goto out_len;
3677         }
3678
3679         if (copy_to_user(optval, scontext, scontext_len))
3680                 err = -EFAULT;
3681
3682 out_len:
3683         if (put_user(scontext_len, optlen))
3684                 err = -EFAULT;
3685
3686         kfree(scontext);
3687 out:
3688         return err;
3689 }
3690
3691 static int selinux_socket_getpeersec_dgram(struct socket *sock, struct sk_buff *skb, u32 *secid)
3692 {
3693         u32 peer_secid = SECSID_NULL;
3694         int err = 0;
3695
3696         if (sock && sock->sk->sk_family == PF_UNIX)
3697                 selinux_get_inode_sid(SOCK_INODE(sock), &peer_secid);
3698         else if (skb)
3699                 selinux_skb_extlbl_sid(skb, &peer_secid);
3700
3701         if (peer_secid == SECSID_NULL)
3702                 err = -EINVAL;
3703         *secid = peer_secid;
3704
3705         return err;
3706 }
3707
3708 static int selinux_sk_alloc_security(struct sock *sk, int family, gfp_t priority)
3709 {
3710         return sk_alloc_security(sk, family, priority);
3711 }
3712
3713 static void selinux_sk_free_security(struct sock *sk)
3714 {
3715         sk_free_security(sk);
3716 }
3717
3718 static void selinux_sk_clone_security(const struct sock *sk, struct sock *newsk)
3719 {
3720         struct sk_security_struct *ssec = sk->sk_security;
3721         struct sk_security_struct *newssec = newsk->sk_security;
3722
3723         newssec->sid = ssec->sid;
3724         newssec->peer_sid = ssec->peer_sid;
3725
3726         selinux_netlbl_sk_security_clone(ssec, newssec);
3727 }
3728
3729 static void selinux_sk_getsecid(struct sock *sk, u32 *secid)
3730 {
3731         if (!sk)
3732                 *secid = SECINITSID_ANY_SOCKET;
3733         else {
3734                 struct sk_security_struct *sksec = sk->sk_security;
3735
3736                 *secid = sksec->sid;
3737         }
3738 }
3739
3740 static void selinux_sock_graft(struct sock* sk, struct socket *parent)
3741 {
3742         struct inode_security_struct *isec = SOCK_INODE(parent)->i_security;
3743         struct sk_security_struct *sksec = sk->sk_security;
3744
3745         if (sk->sk_family == PF_INET || sk->sk_family == PF_INET6 ||
3746             sk->sk_family == PF_UNIX)
3747                 isec->sid = sksec->sid;
3748
3749         selinux_netlbl_sock_graft(sk, parent);
3750 }
3751
3752 static int selinux_inet_conn_request(struct sock *sk, struct sk_buff *skb,
3753                                      struct request_sock *req)
3754 {
3755         struct sk_security_struct *sksec = sk->sk_security;
3756         int err;
3757         u32 newsid;
3758         u32 peersid;
3759
3760         selinux_skb_extlbl_sid(skb, &peersid);
3761         if (peersid == SECSID_NULL) {
3762                 req->secid = sksec->sid;
3763                 req->peer_secid = SECSID_NULL;
3764                 return 0;
3765         }
3766
3767         err = security_sid_mls_copy(sksec->sid, peersid, &newsid);
3768         if (err)
3769                 return err;
3770
3771         req->secid = newsid;
3772         req->peer_secid = peersid;
3773         return 0;
3774 }
3775
3776 static void selinux_inet_csk_clone(struct sock *newsk,
3777                                    const struct request_sock *req)
3778 {
3779         struct sk_security_struct *newsksec = newsk->sk_security;
3780
3781         newsksec->sid = req->secid;
3782         newsksec->peer_sid = req->peer_secid;
3783         /* NOTE: Ideally, we should also get the isec->sid for the
3784            new socket in sync, but we don't have the isec available yet.
3785            So we will wait until sock_graft to do it, by which
3786            time it will have been created and available. */
3787
3788         /* We don't need to take any sort of lock here as we are the only
3789          * thread with access to newsksec */
3790         selinux_netlbl_sk_security_reset(newsksec, req->rsk_ops->family);
3791 }
3792
3793 static void selinux_inet_conn_established(struct sock *sk,
3794                                 struct sk_buff *skb)
3795 {
3796         struct sk_security_struct *sksec = sk->sk_security;
3797
3798         selinux_skb_extlbl_sid(skb, &sksec->peer_sid);
3799 }
3800
3801 static void selinux_req_classify_flow(const struct request_sock *req,
3802                                       struct flowi *fl)
3803 {
3804         fl->secid = req->secid;
3805 }
3806
3807 static int selinux_nlmsg_perm(struct sock *sk, struct sk_buff *skb)
3808 {
3809         int err = 0;
3810         u32 perm;
3811         struct nlmsghdr *nlh;
3812         struct socket *sock = sk->sk_socket;
3813         struct inode_security_struct *isec = SOCK_INODE(sock)->i_security;
3814
3815         if (skb->len < NLMSG_SPACE(0)) {
3816                 err = -EINVAL;
3817                 goto out;
3818         }
3819         nlh = nlmsg_hdr(skb);
3820
3821         err = selinux_nlmsg_lookup(isec->sclass, nlh->nlmsg_type, &perm);
3822         if (err) {
3823                 if (err == -EINVAL) {
3824                         audit_log(current->audit_context, GFP_KERNEL, AUDIT_SELINUX_ERR,
3825                                   "SELinux:  unrecognized netlink message"
3826                                   " type=%hu for sclass=%hu\n",
3827                                   nlh->nlmsg_type, isec->sclass);
3828                         if (!selinux_enforcing)
3829                                 err = 0;
3830                 }
3831
3832                 /* Ignore */
3833                 if (err == -ENOENT)
3834                         err = 0;
3835                 goto out;
3836         }
3837
3838         err = socket_has_perm(current, sock, perm);
3839 out:
3840         return err;
3841 }
3842
3843 #ifdef CONFIG_NETFILTER
3844
3845 static int selinux_ip_postroute_last_compat(struct sock *sk, struct net_device *dev,
3846                                             struct avc_audit_data *ad,
3847                                             u16 family, char *addrp, int len)
3848 {
3849         int err = 0;
3850         u32 netif_perm, node_perm, node_sid, if_sid, send_perm = 0;
3851         struct socket *sock;
3852         struct inode *inode;
3853         struct inode_security_struct *isec;
3854
3855         sock = sk->sk_socket;
3856         if (!sock)
3857                 goto out;
3858
3859         inode = SOCK_INODE(sock);
3860         if (!inode)
3861                 goto out;
3862
3863         isec = inode->i_security;
3864
3865         err = sel_netif_sids(dev, &if_sid, NULL);
3866         if (err)
3867                 goto out;
3868
3869         switch (isec->sclass) {
3870         case SECCLASS_UDP_SOCKET:
3871                 netif_perm = NETIF__UDP_SEND;
3872                 node_perm = NODE__UDP_SEND;
3873                 send_perm = UDP_SOCKET__SEND_MSG;
3874                 break;
3875
3876         case SECCLASS_TCP_SOCKET:
3877                 netif_perm = NETIF__TCP_SEND;
3878                 node_perm = NODE__TCP_SEND;
3879                 send_perm = TCP_SOCKET__SEND_MSG;
3880                 break;
3881
3882         case SECCLASS_DCCP_SOCKET:
3883                 netif_perm = NETIF__DCCP_SEND;
3884                 node_perm = NODE__DCCP_SEND;
3885                 send_perm = DCCP_SOCKET__SEND_MSG;
3886                 break;
3887
3888         default:
3889                 netif_perm = NETIF__RAWIP_SEND;
3890                 node_perm = NODE__RAWIP_SEND;
3891                 break;
3892         }
3893
3894         err = avc_has_perm(isec->sid, if_sid, SECCLASS_NETIF, netif_perm, ad);
3895         if (err)
3896                 goto out;
3897
3898         err = security_node_sid(family, addrp, len, &node_sid);
3899         if (err)
3900                 goto out;
3901
3902         err = avc_has_perm(isec->sid, node_sid, SECCLASS_NODE, node_perm, ad);
3903         if (err)
3904                 goto out;
3905
3906         if (send_perm) {
3907                 u32 port_sid;
3908
3909                 err = security_port_sid(sk->sk_family,
3910                                         sk->sk_type,
3911                                         sk->sk_protocol,
3912                                         ntohs(ad->u.net.dport),
3913                                         &port_sid);
3914                 if (err)
3915                         goto out;
3916
3917                 err = avc_has_perm(isec->sid, port_sid, isec->sclass,
3918                                    send_perm, ad);
3919         }
3920 out:
3921         return err;
3922 }
3923
3924 static unsigned int selinux_ip_postroute_last(unsigned int hooknum,
3925                                               struct sk_buff **pskb,
3926                                               const struct net_device *in,
3927                                               const struct net_device *out,
3928                                               int (*okfn)(struct sk_buff *),
3929                                               u16 family)
3930 {
3931         char *addrp;
3932         int len, err = 0;
3933         struct sock *sk;
3934         struct sk_buff *skb = *pskb;
3935         struct avc_audit_data ad;
3936         struct net_device *dev = (struct net_device *)out;
3937         struct sk_security_struct *sksec;
3938         u8 proto;
3939
3940         sk = skb->sk;
3941         if (!sk)
3942                 goto out;
3943
3944         sksec = sk->sk_security;
3945
3946         AVC_AUDIT_DATA_INIT(&ad, NET);
3947         ad.u.net.netif = dev->name;
3948         ad.u.net.family = family;
3949
3950         err = selinux_parse_skb(skb, &ad, &addrp, &len, 0, &proto);
3951         if (err)
3952                 goto out;
3953
3954         if (selinux_compat_net)
3955                 err = selinux_ip_postroute_last_compat(sk, dev, &ad,
3956                                                        family, addrp, len);
3957         else
3958                 err = avc_has_perm(sksec->sid, skb->secmark, SECCLASS_PACKET,
3959                                    PACKET__SEND, &ad);
3960
3961         if (err)
3962                 goto out;
3963
3964         err = selinux_xfrm_postroute_last(sksec->sid, skb, &ad, proto);
3965 out:
3966         return err ? NF_DROP : NF_ACCEPT;
3967 }
3968
3969 static unsigned int selinux_ipv4_postroute_last(unsigned int hooknum,
3970                                                 struct sk_buff **pskb,
3971                                                 const struct net_device *in,
3972                                                 const struct net_device *out,
3973                                                 int (*okfn)(struct sk_buff *))
3974 {
3975         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET);
3976 }
3977
3978 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
3979
3980 static unsigned int selinux_ipv6_postroute_last(unsigned int hooknum,
3981                                                 struct sk_buff **pskb,
3982                                                 const struct net_device *in,
3983                                                 const struct net_device *out,
3984                                                 int (*okfn)(struct sk_buff *))
3985 {
3986         return selinux_ip_postroute_last(hooknum, pskb, in, out, okfn, PF_INET6);
3987 }
3988
3989 #endif  /* IPV6 */
3990
3991 #endif  /* CONFIG_NETFILTER */
3992
3993 static int selinux_netlink_send(struct sock *sk, struct sk_buff *skb)
3994 {
3995         int err;
3996
3997         err = secondary_ops->netlink_send(sk, skb);
3998         if (err)
3999                 return err;
4000
4001         if (policydb_loaded_version >= POLICYDB_VERSION_NLCLASS)
4002                 err = selinux_nlmsg_perm(sk, skb);
4003
4004         return err;
4005 }
4006
4007 static int selinux_netlink_recv(struct sk_buff *skb, int capability)
4008 {
4009         int err;
4010         struct avc_audit_data ad;
4011
4012         err = secondary_ops->netlink_recv(skb, capability);
4013         if (err)
4014                 return err;
4015
4016         AVC_AUDIT_DATA_INIT(&ad, CAP);
4017         ad.u.cap = capability;
4018
4019         return avc_has_perm(NETLINK_CB(skb).sid, NETLINK_CB(skb).sid,
4020                             SECCLASS_CAPABILITY, CAP_TO_MASK(capability), &ad);
4021 }
4022
4023 static int ipc_alloc_security(struct task_struct *task,
4024                               struct kern_ipc_perm *perm,
4025                               u16 sclass)
4026 {
4027         struct task_security_struct *tsec = task->security;
4028         struct ipc_security_struct *isec;
4029
4030         isec = kzalloc(sizeof(struct ipc_security_struct), GFP_KERNEL);
4031         if (!isec)
4032                 return -ENOMEM;
4033
4034         isec->sclass = sclass;
4035         isec->ipc_perm = perm;
4036         isec->sid = tsec->sid;
4037         perm->security = isec;
4038
4039         return 0;
4040 }
4041
4042 static void ipc_free_security(struct kern_ipc_perm *perm)
4043 {
4044         struct ipc_security_struct *isec = perm->security;
4045         perm->security = NULL;
4046         kfree(isec);
4047 }
4048
4049 static int msg_msg_alloc_security(struct msg_msg *msg)
4050 {
4051         struct msg_security_struct *msec;
4052
4053         msec = kzalloc(sizeof(struct msg_security_struct), GFP_KERNEL);
4054         if (!msec)
4055                 return -ENOMEM;
4056
4057         msec->msg = msg;
4058         msec->sid = SECINITSID_UNLABELED;
4059         msg->security = msec;
4060
4061         return 0;
4062 }
4063
4064 static void msg_msg_free_security(struct msg_msg *msg)
4065 {
4066         struct msg_security_struct *msec = msg->security;
4067
4068         msg->security = NULL;
4069         kfree(msec);
4070 }
4071
4072 static int ipc_has_perm(struct kern_ipc_perm *ipc_perms,
4073                         u32 perms)
4074 {
4075         struct task_security_struct *tsec;
4076         struct ipc_security_struct *isec;
4077         struct avc_audit_data ad;
4078
4079         tsec = current->security;
4080         isec = ipc_perms->security;
4081
4082         AVC_AUDIT_DATA_INIT(&ad, IPC);
4083         ad.u.ipc_id = ipc_perms->key;
4084
4085         return avc_has_perm(tsec->sid, isec->sid, isec->sclass, perms, &ad);
4086 }
4087
4088 static int selinux_msg_msg_alloc_security(struct msg_msg *msg)
4089 {
4090         return msg_msg_alloc_security(msg);
4091 }
4092
4093 static void selinux_msg_msg_free_security(struct msg_msg *msg)
4094 {
4095         msg_msg_free_security(msg);
4096 }
4097
4098 /* message queue security operations */
4099 static int selinux_msg_queue_alloc_security(struct msg_queue *msq)
4100 {
4101         struct task_security_struct *tsec;
4102         struct ipc_security_struct *isec;
4103         struct avc_audit_data ad;
4104         int rc;
4105
4106         rc = ipc_alloc_security(current, &msq->q_perm, SECCLASS_MSGQ);
4107         if (rc)
4108                 return rc;
4109
4110         tsec = current->security;
4111         isec = msq->q_perm.security;
4112
4113         AVC_AUDIT_DATA_INIT(&ad, IPC);
4114         ad.u.ipc_id = msq->q_perm.key;
4115
4116         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4117                           MSGQ__CREATE, &ad);
4118         if (rc) {
4119                 ipc_free_security(&msq->q_perm);
4120                 return rc;
4121         }
4122         return 0;
4123 }
4124
4125 static void selinux_msg_queue_free_security(struct msg_queue *msq)
4126 {
4127         ipc_free_security(&msq->q_perm);
4128 }
4129
4130 static int selinux_msg_queue_associate(struct msg_queue *msq, int msqflg)
4131 {
4132         struct task_security_struct *tsec;
4133         struct ipc_security_struct *isec;
4134         struct avc_audit_data ad;
4135
4136         tsec = current->security;
4137         isec = msq->q_perm.security;
4138
4139         AVC_AUDIT_DATA_INIT(&ad, IPC);
4140         ad.u.ipc_id = msq->q_perm.key;
4141
4142         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4143                             MSGQ__ASSOCIATE, &ad);
4144 }
4145
4146 static int selinux_msg_queue_msgctl(struct msg_queue *msq, int cmd)
4147 {
4148         int err;
4149         int perms;
4150
4151         switch(cmd) {
4152         case IPC_INFO:
4153         case MSG_INFO:
4154                 /* No specific object, just general system-wide information. */
4155                 return task_has_system(current, SYSTEM__IPC_INFO);
4156         case IPC_STAT:
4157         case MSG_STAT:
4158                 perms = MSGQ__GETATTR | MSGQ__ASSOCIATE;
4159                 break;
4160         case IPC_SET:
4161                 perms = MSGQ__SETATTR;
4162                 break;
4163         case IPC_RMID:
4164                 perms = MSGQ__DESTROY;
4165                 break;
4166         default:
4167                 return 0;
4168         }
4169
4170         err = ipc_has_perm(&msq->q_perm, perms);
4171         return err;
4172 }
4173
4174 static int selinux_msg_queue_msgsnd(struct msg_queue *msq, struct msg_msg *msg, int msqflg)
4175 {
4176         struct task_security_struct *tsec;
4177         struct ipc_security_struct *isec;
4178         struct msg_security_struct *msec;
4179         struct avc_audit_data ad;
4180         int rc;
4181
4182         tsec = current->security;
4183         isec = msq->q_perm.security;
4184         msec = msg->security;
4185
4186         /*
4187          * First time through, need to assign label to the message
4188          */
4189         if (msec->sid == SECINITSID_UNLABELED) {
4190                 /*
4191                  * Compute new sid based on current process and
4192                  * message queue this message will be stored in
4193                  */
4194                 rc = security_transition_sid(tsec->sid,
4195                                              isec->sid,
4196                                              SECCLASS_MSG,
4197                                              &msec->sid);
4198                 if (rc)
4199                         return rc;
4200         }
4201
4202         AVC_AUDIT_DATA_INIT(&ad, IPC);
4203         ad.u.ipc_id = msq->q_perm.key;
4204
4205         /* Can this process write to the queue? */
4206         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_MSGQ,
4207                           MSGQ__WRITE, &ad);
4208         if (!rc)
4209                 /* Can this process send the message */
4210                 rc = avc_has_perm(tsec->sid, msec->sid,
4211                                   SECCLASS_MSG, MSG__SEND, &ad);
4212         if (!rc)
4213                 /* Can the message be put in the queue? */
4214                 rc = avc_has_perm(msec->sid, isec->sid,
4215                                   SECCLASS_MSGQ, MSGQ__ENQUEUE, &ad);
4216
4217         return rc;
4218 }
4219
4220 static int selinux_msg_queue_msgrcv(struct msg_queue *msq, struct msg_msg *msg,
4221                                     struct task_struct *target,
4222                                     long type, int mode)
4223 {
4224         struct task_security_struct *tsec;
4225         struct ipc_security_struct *isec;
4226         struct msg_security_struct *msec;
4227         struct avc_audit_data ad;
4228         int rc;
4229
4230         tsec = target->security;
4231         isec = msq->q_perm.security;
4232         msec = msg->security;
4233
4234         AVC_AUDIT_DATA_INIT(&ad, IPC);
4235         ad.u.ipc_id = msq->q_perm.key;
4236
4237         rc = avc_has_perm(tsec->sid, isec->sid,
4238                           SECCLASS_MSGQ, MSGQ__READ, &ad);
4239         if (!rc)
4240                 rc = avc_has_perm(tsec->sid, msec->sid,
4241                                   SECCLASS_MSG, MSG__RECEIVE, &ad);
4242         return rc;
4243 }
4244
4245 /* Shared Memory security operations */
4246 static int selinux_shm_alloc_security(struct shmid_kernel *shp)
4247 {
4248         struct task_security_struct *tsec;
4249         struct ipc_security_struct *isec;
4250         struct avc_audit_data ad;
4251         int rc;
4252
4253         rc = ipc_alloc_security(current, &shp->shm_perm, SECCLASS_SHM);
4254         if (rc)
4255                 return rc;
4256
4257         tsec = current->security;
4258         isec = shp->shm_perm.security;
4259
4260         AVC_AUDIT_DATA_INIT(&ad, IPC);
4261         ad.u.ipc_id = shp->shm_perm.key;
4262
4263         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4264                           SHM__CREATE, &ad);
4265         if (rc) {
4266                 ipc_free_security(&shp->shm_perm);
4267                 return rc;
4268         }
4269         return 0;
4270 }
4271
4272 static void selinux_shm_free_security(struct shmid_kernel *shp)
4273 {
4274         ipc_free_security(&shp->shm_perm);
4275 }
4276
4277 static int selinux_shm_associate(struct shmid_kernel *shp, int shmflg)
4278 {
4279         struct task_security_struct *tsec;
4280         struct ipc_security_struct *isec;
4281         struct avc_audit_data ad;
4282
4283         tsec = current->security;
4284         isec = shp->shm_perm.security;
4285
4286         AVC_AUDIT_DATA_INIT(&ad, IPC);
4287         ad.u.ipc_id = shp->shm_perm.key;
4288
4289         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SHM,
4290                             SHM__ASSOCIATE, &ad);
4291 }
4292
4293 /* Note, at this point, shp is locked down */
4294 static int selinux_shm_shmctl(struct shmid_kernel *shp, int cmd)
4295 {
4296         int perms;
4297         int err;
4298
4299         switch(cmd) {
4300         case IPC_INFO:
4301         case SHM_INFO:
4302                 /* No specific object, just general system-wide information. */
4303                 return task_has_system(current, SYSTEM__IPC_INFO);
4304         case IPC_STAT:
4305         case SHM_STAT:
4306                 perms = SHM__GETATTR | SHM__ASSOCIATE;
4307                 break;
4308         case IPC_SET:
4309                 perms = SHM__SETATTR;
4310                 break;
4311         case SHM_LOCK:
4312         case SHM_UNLOCK:
4313                 perms = SHM__LOCK;
4314                 break;
4315         case IPC_RMID:
4316                 perms = SHM__DESTROY;
4317                 break;
4318         default:
4319                 return 0;
4320         }
4321
4322         err = ipc_has_perm(&shp->shm_perm, perms);
4323         return err;
4324 }
4325
4326 static int selinux_shm_shmat(struct shmid_kernel *shp,
4327                              char __user *shmaddr, int shmflg)
4328 {
4329         u32 perms;
4330         int rc;
4331
4332         rc = secondary_ops->shm_shmat(shp, shmaddr, shmflg);
4333         if (rc)
4334                 return rc;
4335
4336         if (shmflg & SHM_RDONLY)
4337                 perms = SHM__READ;
4338         else
4339                 perms = SHM__READ | SHM__WRITE;
4340
4341         return ipc_has_perm(&shp->shm_perm, perms);
4342 }
4343
4344 /* Semaphore security operations */
4345 static int selinux_sem_alloc_security(struct sem_array *sma)
4346 {
4347         struct task_security_struct *tsec;
4348         struct ipc_security_struct *isec;
4349         struct avc_audit_data ad;
4350         int rc;
4351
4352         rc = ipc_alloc_security(current, &sma->sem_perm, SECCLASS_SEM);
4353         if (rc)
4354                 return rc;
4355
4356         tsec = current->security;
4357         isec = sma->sem_perm.security;
4358
4359         AVC_AUDIT_DATA_INIT(&ad, IPC);
4360         ad.u.ipc_id = sma->sem_perm.key;
4361
4362         rc = avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4363                           SEM__CREATE, &ad);
4364         if (rc) {
4365                 ipc_free_security(&sma->sem_perm);
4366                 return rc;
4367         }
4368         return 0;
4369 }
4370
4371 static void selinux_sem_free_security(struct sem_array *sma)
4372 {
4373         ipc_free_security(&sma->sem_perm);
4374 }
4375
4376 static int selinux_sem_associate(struct sem_array *sma, int semflg)
4377 {
4378         struct task_security_struct *tsec;
4379         struct ipc_security_struct *isec;
4380         struct avc_audit_data ad;
4381
4382         tsec = current->security;
4383         isec = sma->sem_perm.security;
4384
4385         AVC_AUDIT_DATA_INIT(&ad, IPC);
4386         ad.u.ipc_id = sma->sem_perm.key;
4387
4388         return avc_has_perm(tsec->sid, isec->sid, SECCLASS_SEM,
4389                             SEM__ASSOCIATE, &ad);
4390 }
4391
4392 /* Note, at this point, sma is locked down */
4393 static int selinux_sem_semctl(struct sem_array *sma, int cmd)
4394 {
4395         int err;
4396         u32 perms;
4397
4398         switch(cmd) {
4399         case IPC_INFO:
4400         case SEM_INFO:
4401                 /* No specific object, just general system-wide information. */
4402                 return task_has_system(current, SYSTEM__IPC_INFO);
4403         case GETPID:
4404         case GETNCNT:
4405         case GETZCNT:
4406                 perms = SEM__GETATTR;
4407                 break;
4408         case GETVAL:
4409         case GETALL:
4410                 perms = SEM__READ;
4411                 break;
4412         case SETVAL:
4413         case SETALL:
4414                 perms = SEM__WRITE;
4415                 break;
4416         case IPC_RMID:
4417                 perms = SEM__DESTROY;
4418                 break;
4419         case IPC_SET:
4420                 perms = SEM__SETATTR;
4421                 break;
4422         case IPC_STAT:
4423         case SEM_STAT:
4424                 perms = SEM__GETATTR | SEM__ASSOCIATE;
4425                 break;
4426         default:
4427                 return 0;
4428         }
4429
4430         err = ipc_has_perm(&sma->sem_perm, perms);
4431         return err;
4432 }
4433
4434 static int selinux_sem_semop(struct sem_array *sma,
4435                              struct sembuf *sops, unsigned nsops, int alter)
4436 {
4437         u32 perms;
4438
4439         if (alter)
4440                 perms = SEM__READ | SEM__WRITE;
4441         else
4442                 perms = SEM__READ;
4443
4444         return ipc_has_perm(&sma->sem_perm, perms);
4445 }
4446
4447 static int selinux_ipc_permission(struct kern_ipc_perm *ipcp, short flag)
4448 {
4449         u32 av = 0;
4450
4451         av = 0;
4452         if (flag & S_IRUGO)
4453                 av |= IPC__UNIX_READ;
4454         if (flag & S_IWUGO)
4455                 av |= IPC__UNIX_WRITE;
4456
4457         if (av == 0)
4458                 return 0;
4459
4460         return ipc_has_perm(ipcp, av);
4461 }
4462
4463 /* module stacking operations */
4464 static int selinux_register_security (const char *name, struct security_operations *ops)
4465 {
4466         if (secondary_ops != original_ops) {
4467                 printk(KERN_ERR "%s:  There is already a secondary security "
4468                        "module registered.\n", __FUNCTION__);
4469                 return -EINVAL;
4470         }
4471
4472         secondary_ops = ops;
4473
4474         printk(KERN_INFO "%s:  Registering secondary module %s\n",
4475                __FUNCTION__,
4476                name);
4477
4478         return 0;
4479 }
4480
4481 static int selinux_unregister_security (const char *name, struct security_operations *ops)
4482 {
4483         if (ops != secondary_ops) {
4484                 printk(KERN_ERR "%s:  trying to unregister a security module "
4485                         "that is not registered.\n", __FUNCTION__);
4486                 return -EINVAL;
4487         }
4488
4489         secondary_ops = original_ops;
4490
4491         return 0;
4492 }
4493
4494 static void selinux_d_instantiate (struct dentry *dentry, struct inode *inode)
4495 {
4496         if (inode)
4497                 inode_doinit_with_dentry(inode, dentry);
4498 }
4499
4500 static int selinux_getprocattr(struct task_struct *p,
4501                                char *name, char **value)
4502 {
4503         struct task_security_struct *tsec;
4504         u32 sid;
4505         int error;
4506         unsigned len;
4507
4508         if (current != p) {
4509                 error = task_has_perm(current, p, PROCESS__GETATTR);
4510                 if (error)
4511                         return error;
4512         }
4513
4514         tsec = p->security;
4515
4516         if (!strcmp(name, "current"))
4517                 sid = tsec->sid;
4518         else if (!strcmp(name, "prev"))
4519                 sid = tsec->osid;
4520         else if (!strcmp(name, "exec"))
4521                 sid = tsec->exec_sid;
4522         else if (!strcmp(name, "fscreate"))
4523                 sid = tsec->create_sid;
4524         else if (!strcmp(name, "keycreate"))
4525                 sid = tsec->keycreate_sid;
4526         else if (!strcmp(name, "sockcreate"))
4527                 sid = tsec->sockcreate_sid;
4528         else
4529                 return -EINVAL;
4530
4531         if (!sid)
4532                 return 0;
4533
4534         error = security_sid_to_context(sid, value, &len);
4535         if (error)
4536                 return error;
4537         return len;
4538 }
4539
4540 static int selinux_setprocattr(struct task_struct *p,
4541                                char *name, void *value, size_t size)
4542 {
4543         struct task_security_struct *tsec;
4544         u32 sid = 0;
4545         int error;
4546         char *str = value;
4547
4548         if (current != p) {
4549                 /* SELinux only allows a process to change its own
4550                    security attributes. */
4551                 return -EACCES;
4552         }
4553
4554         /*
4555          * Basic control over ability to set these attributes at all.
4556          * current == p, but we'll pass them separately in case the
4557          * above restriction is ever removed.
4558          */
4559         if (!strcmp(name, "exec"))
4560                 error = task_has_perm(current, p, PROCESS__SETEXEC);
4561         else if (!strcmp(name, "fscreate"))
4562                 error = task_has_perm(current, p, PROCESS__SETFSCREATE);
4563         else if (!strcmp(name, "keycreate"))
4564                 error = task_has_perm(current, p, PROCESS__SETKEYCREATE);
4565         else if (!strcmp(name, "sockcreate"))
4566                 error = task_has_perm(current, p, PROCESS__SETSOCKCREATE);
4567         else if (!strcmp(name, "current"))
4568                 error = task_has_perm(current, p, PROCESS__SETCURRENT);
4569         else
4570                 error = -EINVAL;
4571         if (error)
4572                 return error;
4573
4574         /* Obtain a SID for the context, if one was specified. */
4575         if (size && str[1] && str[1] != '\n') {
4576                 if (str[size-1] == '\n') {
4577                         str[size-1] = 0;
4578                         size--;
4579                 }
4580                 error = security_context_to_sid(value, size, &sid);
4581                 if (error)
4582                         return error;
4583         }
4584
4585         /* Permission checking based on the specified context is
4586            performed during the actual operation (execve,
4587            open/mkdir/...), when we know the full context of the
4588            operation.  See selinux_bprm_set_security for the execve
4589            checks and may_create for the file creation checks. The
4590            operation will then fail if the context is not permitted. */
4591         tsec = p->security;
4592         if (!strcmp(name, "exec"))
4593                 tsec->exec_sid = sid;
4594         else if (!strcmp(name, "fscreate"))
4595                 tsec->create_sid = sid;
4596         else if (!strcmp(name, "keycreate")) {
4597                 error = may_create_key(sid, p);
4598                 if (error)
4599                         return error;
4600                 tsec->keycreate_sid = sid;
4601         } else if (!strcmp(name, "sockcreate"))
4602                 tsec->sockcreate_sid = sid;
4603         else if (!strcmp(name, "current")) {
4604                 struct av_decision avd;
4605
4606                 if (sid == 0)
4607                         return -EINVAL;
4608
4609                 /* Only allow single threaded processes to change context */
4610                 if (atomic_read(&p->mm->mm_users) != 1) {
4611                         struct task_struct *g, *t;
4612                         struct mm_struct *mm = p->mm;
4613                         read_lock(&tasklist_lock);
4614                         do_each_thread(g, t)
4615                                 if (t->mm == mm && t != p) {
4616                                         read_unlock(&tasklist_lock);
4617                                         return -EPERM;
4618                                 }
4619                         while_each_thread(g, t);
4620                         read_unlock(&tasklist_lock);
4621                 }
4622
4623                 /* Check permissions for the transition. */
4624                 error = avc_has_perm(tsec->sid, sid, SECCLASS_PROCESS,
4625                                      PROCESS__DYNTRANSITION, NULL);
4626                 if (error)
4627                         return error;
4628
4629                 /* Check for ptracing, and update the task SID if ok.
4630                    Otherwise, leave SID unchanged and fail. */
4631                 task_lock(p);
4632                 if (p->ptrace & PT_PTRACED) {
4633                         error = avc_has_perm_noaudit(tsec->ptrace_sid, sid,
4634                                                      SECCLASS_PROCESS,
4635                                                      PROCESS__PTRACE, 0, &avd);
4636                         if (!error)
4637                                 tsec->sid = sid;
4638                         task_unlock(p);
4639                         avc_audit(tsec->ptrace_sid, sid, SECCLASS_PROCESS,
4640                                   PROCESS__PTRACE, &avd, error, NULL);
4641                         if (error)
4642                                 return error;
4643                 } else {
4644                         tsec->sid = sid;
4645                         task_unlock(p);
4646                 }
4647         }
4648         else
4649                 return -EINVAL;
4650
4651         return size;
4652 }
4653
4654 static int selinux_secid_to_secctx(u32 secid, char **secdata, u32 *seclen)
4655 {
4656         return security_sid_to_context(secid, secdata, seclen);
4657 }
4658
4659 static void selinux_release_secctx(char *secdata, u32 seclen)
4660 {
4661         if (secdata)
4662                 kfree(secdata);
4663 }
4664
4665 #ifdef CONFIG_KEYS
4666
4667 static int selinux_key_alloc(struct key *k, struct task_struct *tsk,
4668                              unsigned long flags)
4669 {
4670         struct task_security_struct *tsec = tsk->security;
4671         struct key_security_struct *ksec;
4672
4673         ksec = kzalloc(sizeof(struct key_security_struct), GFP_KERNEL);
4674         if (!ksec)
4675                 return -ENOMEM;
4676
4677         ksec->obj = k;
4678         if (tsec->keycreate_sid)
4679                 ksec->sid = tsec->keycreate_sid;
4680         else
4681                 ksec->sid = tsec->sid;
4682         k->security = ksec;
4683
4684         return 0;
4685 }
4686
4687 static void selinux_key_free(struct key *k)
4688 {
4689         struct key_security_struct *ksec = k->security;
4690
4691         k->security = NULL;
4692         kfree(ksec);
4693 }
4694
4695 static int selinux_key_permission(key_ref_t key_ref,
4696                             struct task_struct *ctx,
4697                             key_perm_t perm)
4698 {
4699         struct key *key;
4700         struct task_security_struct *tsec;
4701         struct key_security_struct *ksec;
4702
4703         key = key_ref_to_ptr(key_ref);
4704
4705         tsec = ctx->security;
4706         ksec = key->security;
4707
4708         /* if no specific permissions are requested, we skip the
4709            permission check. No serious, additional covert channels
4710            appear to be created. */
4711         if (perm == 0)
4712                 return 0;
4713
4714         return avc_has_perm(tsec->sid, ksec->sid,
4715                             SECCLASS_KEY, perm, NULL);
4716 }
4717
4718 #endif
4719
4720 static struct security_operations selinux_ops = {
4721         .ptrace =                       selinux_ptrace,
4722         .capget =                       selinux_capget,
4723         .capset_check =                 selinux_capset_check,
4724         .capset_set =                   selinux_capset_set,
4725         .sysctl =                       selinux_sysctl,
4726         .capable =                      selinux_capable,
4727         .quotactl =                     selinux_quotactl,
4728         .quota_on =                     selinux_quota_on,
4729         .syslog =                       selinux_syslog,
4730         .vm_enough_memory =             selinux_vm_enough_memory,
4731
4732         .netlink_send =                 selinux_netlink_send,
4733         .netlink_recv =                 selinux_netlink_recv,
4734
4735         .bprm_alloc_security =          selinux_bprm_alloc_security,
4736         .bprm_free_security =           selinux_bprm_free_security,
4737         .bprm_apply_creds =             selinux_bprm_apply_creds,
4738         .bprm_post_apply_creds =        selinux_bprm_post_apply_creds,
4739         .bprm_set_security =            selinux_bprm_set_security,
4740         .bprm_check_security =          selinux_bprm_check_security,
4741         .bprm_secureexec =              selinux_bprm_secureexec,
4742
4743         .sb_alloc_security =            selinux_sb_alloc_security,
4744         .sb_free_security =             selinux_sb_free_security,
4745         .sb_copy_data =                 selinux_sb_copy_data,
4746         .sb_kern_mount =                selinux_sb_kern_mount,
4747         .sb_statfs =                    selinux_sb_statfs,
4748         .sb_mount =                     selinux_mount,
4749         .sb_umount =                    selinux_umount,
4750
4751         .inode_alloc_security =         selinux_inode_alloc_security,
4752         .inode_free_security =          selinux_inode_free_security,
4753         .inode_init_security =          selinux_inode_init_security,
4754         .inode_create =                 selinux_inode_create,
4755         .inode_link =                   selinux_inode_link,
4756         .inode_unlink =                 selinux_inode_unlink,
4757         .inode_symlink =                selinux_inode_symlink,
4758         .inode_mkdir =                  selinux_inode_mkdir,
4759         .inode_rmdir =                  selinux_inode_rmdir,
4760         .inode_mknod =                  selinux_inode_mknod,
4761         .inode_rename =                 selinux_inode_rename,
4762         .inode_readlink =               selinux_inode_readlink,
4763         .inode_follow_link =            selinux_inode_follow_link,
4764         .inode_permission =             selinux_inode_permission,
4765         .inode_setattr =                selinux_inode_setattr,
4766         .inode_getattr =                selinux_inode_getattr,
4767         .inode_setxattr =               selinux_inode_setxattr,
4768         .inode_post_setxattr =          selinux_inode_post_setxattr,
4769         .inode_getxattr =               selinux_inode_getxattr,
4770         .inode_listxattr =              selinux_inode_listxattr,
4771         .inode_removexattr =            selinux_inode_removexattr,
4772         .inode_xattr_getsuffix =        selinux_inode_xattr_getsuffix,
4773         .inode_getsecurity =            selinux_inode_getsecurity,
4774         .inode_setsecurity =            selinux_inode_setsecurity,
4775         .inode_listsecurity =           selinux_inode_listsecurity,
4776
4777         .file_permission =              selinux_file_permission,
4778         .file_alloc_security =          selinux_file_alloc_security,
4779         .file_free_security =           selinux_file_free_security,
4780         .file_ioctl =                   selinux_file_ioctl,
4781         .file_mmap =                    selinux_file_mmap,
4782         .file_mprotect =                selinux_file_mprotect,
4783         .file_lock =                    selinux_file_lock,
4784         .file_fcntl =                   selinux_file_fcntl,
4785         .file_set_fowner =              selinux_file_set_fowner,
4786         .file_send_sigiotask =          selinux_file_send_sigiotask,
4787         .file_receive =                 selinux_file_receive,
4788
4789         .task_create =                  selinux_task_create,
4790         .task_alloc_security =          selinux_task_alloc_security,
4791         .task_free_security =           selinux_task_free_security,
4792         .task_setuid =                  selinux_task_setuid,
4793         .task_post_setuid =             selinux_task_post_setuid,
4794         .task_setgid =                  selinux_task_setgid,
4795         .task_setpgid =                 selinux_task_setpgid,
4796         .task_getpgid =                 selinux_task_getpgid,
4797         .task_getsid =                  selinux_task_getsid,
4798         .task_getsecid =                selinux_task_getsecid,
4799         .task_setgroups =               selinux_task_setgroups,
4800         .task_setnice =                 selinux_task_setnice,
4801         .task_setioprio =               selinux_task_setioprio,
4802         .task_getioprio =               selinux_task_getioprio,
4803         .task_setrlimit =               selinux_task_setrlimit,
4804         .task_setscheduler =            selinux_task_setscheduler,
4805         .task_getscheduler =            selinux_task_getscheduler,
4806         .task_movememory =              selinux_task_movememory,
4807         .task_kill =                    selinux_task_kill,
4808         .task_wait =                    selinux_task_wait,
4809         .task_prctl =                   selinux_task_prctl,
4810         .task_reparent_to_init =        selinux_task_reparent_to_init,
4811         .task_to_inode =                selinux_task_to_inode,
4812
4813         .ipc_permission =               selinux_ipc_permission,
4814
4815         .msg_msg_alloc_security =       selinux_msg_msg_alloc_security,
4816         .msg_msg_free_security =        selinux_msg_msg_free_security,
4817
4818         .msg_queue_alloc_security =     selinux_msg_queue_alloc_security,
4819         .msg_queue_free_security =      selinux_msg_queue_free_security,
4820         .msg_queue_associate =          selinux_msg_queue_associate,
4821         .msg_queue_msgctl =             selinux_msg_queue_msgctl,
4822         .msg_queue_msgsnd =             selinux_msg_queue_msgsnd,
4823         .msg_queue_msgrcv =             selinux_msg_queue_msgrcv,
4824
4825         .shm_alloc_security =           selinux_shm_alloc_security,
4826         .shm_free_security =            selinux_shm_free_security,
4827         .shm_associate =                selinux_shm_associate,
4828         .shm_shmctl =                   selinux_shm_shmctl,
4829         .shm_shmat =                    selinux_shm_shmat,
4830
4831         .sem_alloc_security =           selinux_sem_alloc_security,
4832         .sem_free_security =            selinux_sem_free_security,
4833         .sem_associate =                selinux_sem_associate,
4834         .sem_semctl =                   selinux_sem_semctl,
4835         .sem_semop =                    selinux_sem_semop,
4836
4837         .register_security =            selinux_register_security,
4838         .unregister_security =          selinux_unregister_security,
4839
4840         .d_instantiate =                selinux_d_instantiate,
4841
4842         .getprocattr =                  selinux_getprocattr,
4843         .setprocattr =                  selinux_setprocattr,
4844
4845         .secid_to_secctx =              selinux_secid_to_secctx,
4846         .release_secctx =               selinux_release_secctx,
4847
4848         .unix_stream_connect =          selinux_socket_unix_stream_connect,
4849         .unix_may_send =                selinux_socket_unix_may_send,
4850
4851         .socket_create =                selinux_socket_create,
4852         .socket_post_create =           selinux_socket_post_create,
4853         .socket_bind =                  selinux_socket_bind,
4854         .socket_connect =               selinux_socket_connect,
4855         .socket_listen =                selinux_socket_listen,
4856         .socket_accept =                selinux_socket_accept,
4857         .socket_sendmsg =               selinux_socket_sendmsg,
4858         .socket_recvmsg =               selinux_socket_recvmsg,
4859         .socket_getsockname =           selinux_socket_getsockname,
4860         .socket_getpeername =           selinux_socket_getpeername,
4861         .socket_getsockopt =            selinux_socket_getsockopt,
4862         .socket_setsockopt =            selinux_socket_setsockopt,
4863         .socket_shutdown =              selinux_socket_shutdown,
4864         .socket_sock_rcv_skb =          selinux_socket_sock_rcv_skb,
4865         .socket_getpeersec_stream =     selinux_socket_getpeersec_stream,
4866         .socket_getpeersec_dgram =      selinux_socket_getpeersec_dgram,
4867         .sk_alloc_security =            selinux_sk_alloc_security,
4868         .sk_free_security =             selinux_sk_free_security,
4869         .sk_clone_security =            selinux_sk_clone_security,
4870         .sk_getsecid =                  selinux_sk_getsecid,
4871         .sock_graft =                   selinux_sock_graft,
4872         .inet_conn_request =            selinux_inet_conn_request,
4873         .inet_csk_clone =               selinux_inet_csk_clone,
4874         .inet_conn_established =        selinux_inet_conn_established,
4875         .req_classify_flow =            selinux_req_classify_flow,
4876
4877 #ifdef CONFIG_SECURITY_NETWORK_XFRM
4878         .xfrm_policy_alloc_security =   selinux_xfrm_policy_alloc,
4879         .xfrm_policy_clone_security =   selinux_xfrm_policy_clone,
4880         .xfrm_policy_free_security =    selinux_xfrm_policy_free,
4881         .xfrm_policy_delete_security =  selinux_xfrm_policy_delete,
4882         .xfrm_state_alloc_security =    selinux_xfrm_state_alloc,
4883         .xfrm_state_free_security =     selinux_xfrm_state_free,
4884         .xfrm_state_delete_security =   selinux_xfrm_state_delete,
4885         .xfrm_policy_lookup =           selinux_xfrm_policy_lookup,
4886         .xfrm_state_pol_flow_match =    selinux_xfrm_state_pol_flow_match,
4887         .xfrm_decode_session =          selinux_xfrm_decode_session,
4888 #endif
4889
4890 #ifdef CONFIG_KEYS
4891         .key_alloc =                    selinux_key_alloc,
4892         .key_free =                     selinux_key_free,
4893         .key_permission =               selinux_key_permission,
4894 #endif
4895 };
4896
4897 static __init int selinux_init(void)
4898 {
4899         struct task_security_struct *tsec;
4900
4901         if (!selinux_enabled) {
4902                 printk(KERN_INFO "SELinux:  Disabled at boot.\n");
4903                 return 0;
4904         }
4905
4906         printk(KERN_INFO "SELinux:  Initializing.\n");
4907
4908         /* Set the security state for the initial task. */
4909         if (task_alloc_security(current))
4910                 panic("SELinux:  Failed to initialize initial task.\n");
4911         tsec = current->security;
4912         tsec->osid = tsec->sid = SECINITSID_KERNEL;
4913
4914         sel_inode_cache = kmem_cache_create("selinux_inode_security",
4915                                             sizeof(struct inode_security_struct),
4916                                             0, SLAB_PANIC, NULL, NULL);
4917         avc_init();
4918
4919         original_ops = secondary_ops = security_ops;
4920         if (!secondary_ops)
4921                 panic ("SELinux: No initial security operations\n");
4922         if (register_security (&selinux_ops))
4923                 panic("SELinux: Unable to register with kernel.\n");
4924
4925         if (selinux_enforcing) {
4926                 printk(KERN_DEBUG "SELinux:  Starting in enforcing mode\n");
4927         } else {
4928                 printk(KERN_DEBUG "SELinux:  Starting in permissive mode\n");
4929         }
4930
4931 #ifdef CONFIG_KEYS
4932         /* Add security information to initial keyrings */
4933         selinux_key_alloc(&root_user_keyring, current,
4934                           KEY_ALLOC_NOT_IN_QUOTA);
4935         selinux_key_alloc(&root_session_keyring, current,
4936                           KEY_ALLOC_NOT_IN_QUOTA);
4937 #endif
4938
4939         return 0;
4940 }
4941
4942 void selinux_complete_init(void)
4943 {
4944         printk(KERN_DEBUG "SELinux:  Completing initialization.\n");
4945
4946         /* Set up any superblocks initialized prior to the policy load. */
4947         printk(KERN_DEBUG "SELinux:  Setting up existing superblocks.\n");
4948         spin_lock(&sb_lock);
4949         spin_lock(&sb_security_lock);
4950 next_sb:
4951         if (!list_empty(&superblock_security_head)) {
4952                 struct superblock_security_struct *sbsec =
4953                                 list_entry(superblock_security_head.next,
4954                                            struct superblock_security_struct,
4955                                            list);
4956                 struct super_block *sb = sbsec->sb;
4957                 sb->s_count++;
4958                 spin_unlock(&sb_security_lock);
4959                 spin_unlock(&sb_lock);
4960                 down_read(&sb->s_umount);
4961                 if (sb->s_root)
4962                         superblock_doinit(sb, NULL);
4963                 drop_super(sb);
4964                 spin_lock(&sb_lock);
4965                 spin_lock(&sb_security_lock);
4966                 list_del_init(&sbsec->list);
4967                 goto next_sb;
4968         }
4969         spin_unlock(&sb_security_lock);
4970         spin_unlock(&sb_lock);
4971 }
4972
4973 /* SELinux requires early initialization in order to label
4974    all processes and objects when they are created. */
4975 security_initcall(selinux_init);
4976
4977 #if defined(CONFIG_NETFILTER)
4978
4979 static struct nf_hook_ops selinux_ipv4_op = {
4980         .hook =         selinux_ipv4_postroute_last,
4981         .owner =        THIS_MODULE,
4982         .pf =           PF_INET,
4983         .hooknum =      NF_IP_POST_ROUTING,
4984         .priority =     NF_IP_PRI_SELINUX_LAST,
4985 };
4986
4987 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
4988
4989 static struct nf_hook_ops selinux_ipv6_op = {
4990         .hook =         selinux_ipv6_postroute_last,
4991         .owner =        THIS_MODULE,
4992         .pf =           PF_INET6,
4993         .hooknum =      NF_IP6_POST_ROUTING,
4994         .priority =     NF_IP6_PRI_SELINUX_LAST,
4995 };
4996
4997 #endif  /* IPV6 */
4998
4999 static int __init selinux_nf_ip_init(void)
5000 {
5001         int err = 0;
5002
5003         if (!selinux_enabled)
5004                 goto out;
5005
5006         printk(KERN_DEBUG "SELinux:  Registering netfilter hooks\n");
5007
5008         err = nf_register_hook(&selinux_ipv4_op);
5009         if (err)
5010                 panic("SELinux: nf_register_hook for IPv4: error %d\n", err);
5011
5012 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5013
5014         err = nf_register_hook(&selinux_ipv6_op);
5015         if (err)
5016                 panic("SELinux: nf_register_hook for IPv6: error %d\n", err);
5017
5018 #endif  /* IPV6 */
5019
5020 out:
5021         return err;
5022 }
5023
5024 __initcall(selinux_nf_ip_init);
5025
5026 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5027 static void selinux_nf_ip_exit(void)
5028 {
5029         printk(KERN_DEBUG "SELinux:  Unregistering netfilter hooks\n");
5030
5031         nf_unregister_hook(&selinux_ipv4_op);
5032 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
5033         nf_unregister_hook(&selinux_ipv6_op);
5034 #endif  /* IPV6 */
5035 }
5036 #endif
5037
5038 #else /* CONFIG_NETFILTER */
5039
5040 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5041 #define selinux_nf_ip_exit()
5042 #endif
5043
5044 #endif /* CONFIG_NETFILTER */
5045
5046 #ifdef CONFIG_SECURITY_SELINUX_DISABLE
5047 int selinux_disable(void)
5048 {
5049         extern void exit_sel_fs(void);
5050         static int selinux_disabled = 0;
5051
5052         if (ss_initialized) {
5053                 /* Not permitted after initial policy load. */
5054                 return -EINVAL;
5055         }
5056
5057         if (selinux_disabled) {
5058                 /* Only do this once. */
5059                 return -EINVAL;
5060         }
5061
5062         printk(KERN_INFO "SELinux:  Disabled at runtime.\n");
5063
5064         selinux_disabled = 1;
5065         selinux_enabled = 0;
5066
5067         /* Reset security_ops to the secondary module, dummy or capability. */
5068         security_ops = secondary_ops;
5069
5070         /* Unregister netfilter hooks. */
5071         selinux_nf_ip_exit();
5072
5073         /* Unregister selinuxfs. */
5074         exit_sel_fs();
5075
5076         return 0;
5077 }
5078 #endif
5079
5080